The tragicomic security failures of the financial services industry: Acxiom's story

The security situation in the financial services industry has passed beyond shocking into darkly comical. For about four years the personal data, effectively the digital identities, of millions of Americans were sold for less than a dollar apiece to criminal organizations. The source was Acxiom, a little-known financial services company that provides transactional services for the credit card industry. This very poorly written story also has some interesting details on how extraordinary the financial data mining industry has become: (I've edited it as much as I can to help make it a bit more coherent):

Data Thief Exposes Flimsy Security, Nets 8 Years

Posted on 02/24/2006 @ 16:55:34 in Security.

The former owner of an email marketing company in Boca Raton, Florida [Scott Levine] will be spending eight years on a forced sabbatical for filching one billion data records from Acxiom, one of the world's largest managers of personal, financial, and corporate data.

According to the Cincinnati Post, Acxiom handles "14 of the 15 top credit cards companies, five of the six biggest retail banks and seven of the top 10 car makers. All share the credit card and other information of their customers with Acxiom."Other customers include TransUnion and the City of Chicago. In addition, Acxiom maintains nearly 850 terabytes of storage across five football fields worth of data centers worldwide, including the US Europe, China and Australia. Among other things, they process over a billion US postal records a day.

Acxiom claims it "continually gathers data from thousands of public and private sources," enabling it to offer the "widest and latest selection of data possible" with "the most informative, accurate and recent demographic, socio-economic and lifestyle data available-at the individual or household level."

And all that data's not being collected for posterity. Acxiom offers it to direct marketers, among others, to identify the best prospects. For example, its CPI score, which is updated monthly, tracks an individual's economic life and "quantifies the size of a specific consumer's economic footprint, indicating the historical consumer purchasing and relative amount of marketing activity surrounding that individual."

... Daniel Baas... was the systems administrator for a small shop that did business with Acxiom. He was tasked with downloading his company's files from Acxiom's FTP server.

Gregory Lockhart, the US Attorney in Charge said, "Baas committed a crime when he exceeded his authorized access, looked for and downloaded an encrypted password file, and ran a password cracking program against the file."

... Baas illegally obtained about 300 passwords, including one that acted like a "master key" and allowed him to download files that belonged to other Acxiom customers. The downloaded files contained personal identification information.

Millions of records worth US$1.9 million.

... Baas burned CDs full of Acxiom's data from 10 December 2002 through New Years [year?], Acxiom said it had no idea its security had been breached till the sheriff called nearly eight months later.

During the course of the Baas investigation, technicians stumbled over another illicit data miner... Scott Levine, owner of Snipermail... yet another Acxiom customer with a password.

The feds claimed that Levine cracked Acxiom's password system so he could filch other peoples' data. From January through July 2003, he abused this authority, ultimately downloading a billion records with a purported street value of US$7 million. ..

... Despite all this, you might say Scott Levine is lucky. His original indictment in July 2004 carried 144 counts. But by the time his jury was finished a year later, the US prison system's latest inductee was found guilty of just 120 counts of unauthorized access of a protected computer, two counts of access device fraud, and one count of obstruction of justice.

So there were two separate identified break-ins of which one led to one conviction on two counts. There were no consequences for Acxiom's crummy security -- after all, they were the "injured" party. The inability of the jury to convict more broadly is typical of these crimes; they are too complex for most trials. Given the history it is reasonable to assume there were other unidentified break-ins.

Bruce Schneier has written for years that nothing will happen until the financial services companies are held directly liable for their security.

There's a lot of enthusiasm in many quarters for electronic health care standards and transactions. Often the security of financial industry transactions is upheld as an indicator that privacy and security issues will be managed well. Pardon my skepticism.

Discarding receipts: IRS accepts scanned images

It's a bit quirky, but my Brother MFC 7820N device is now working as a networked scanner to my Mac and XP machines. I can put something on the flatbed or sheet feeder, press a button and walk away. In under a minute the document is scanned to a reasonably sized black and white 300 dpi 8.5x11 PDF stored on my OS X box. [1]

So now I wonder if I can toss the paper receipts -- at least for tax purposes. The IRS says yes (more on NeatReceipts below):

Welcome to NeatReceipts

Does the IRS accept digital receipts?

Yes. According to ruling Rev. Proc. 97-22, the IRS allows one to prepare, record, transfer, index, store, preserve, retrieve, and reproduce books and records by either electronically imaging hard copy documents to an electronic storage media, or transferring computerized books and records to an electronic storage media that allows them to be viewed or reproduced without using the original program.

Can I throw away my receipts once I have captured an acceptable image?

Yes. According to ruling Rev. Proc. 97-22, the IRS permits the destruction of the original hard copy books and records and the deletion of original computerized records after a taxpayer completes testing of the storage system.

NeatReceipts, incidentally, is a wonderful business idea. They provide custom software and a portable scanner for automated scanning and processing of receipts. I don't know how it works in practice; it has at least two big drawbacks from my perspective. For one it's XP only, and I'm trying to minimize the use of XP at home. For another I don't want yet another scanner. I have a multi-function device with a document scanner, a flat bed scanner, and a Nikon negative scanner. I just can't handle the hassle of another device to fuss with.

[1] I have to be logged in to the account that receives the transfer and I have the firewall disabled, I am trying to figure out what ports are in use so I can reenable the firewall -- but this machine is fairly protected anyway. I can't get things working as well with the XP box, it seems to ignore my configuration settings. I don't have confidence in the software I'm using -- there's no business model to make it robust and reliable. I do have confidence in PDF as an image format so I'll probably switch to something else some day.

The National Parks: Reason 143 to despise Bush

Even if I didn't have 142 other reasons to intensely dislike the GOP and GWB, their attack on the national parks would do all by itself:

Crossroads in the National Parks - New York Times

The Interior Department has extended the period in which the public may comment on the National Park Service's controversial plan to rewrite the management policies for the national parks.

.. The main problem with the proposed revisions is that, taken together, they shift the management focus from the park service's central, historic mission — preserving natural resources for the enjoyment of future generations — to commercial and recreational use of the park for today's generation. As many members of the House and Senate have pointed out in letters to Interior Secretary Gale Norton, air quality and wilderness are especially at risk since the policy appears to invite greater use of snowmobiles and other off-road vehicles.

... President Bush's new budget calls for a $100 million cut in park appropriations. Viewed cynically, deliberately underfinancing the parks could create the necessary cover for opening the parks to more commercial activity — the last thing the parks need. It also makes a mockery of one of the few campaign promises George W. Bush ever made about the environment: his promise in 2000 to end the maintenance backlog in the national parks. The sharpest cuts — some $84.6 million — would come from money for construction and major maintenance, the very area Mr. Bush promised to address.

... Despite efforts to cram snowmobiles down the public's throat, snowmobile use in Yellowstone has dropped this year, falling well below the 720 machines that are allowed into the park each day. Visitors — including former snowmobilers — are increasingly choosing to use snow coaches, the specially equipped buses that are vastly cleaner than even the cleanest snowmobiles. And Yellowstone is seeing a greater variety of visitors in winter than it used to see when snowmobilers dominated the park.

This battle — as well as the larger battle over the parks' true purpose —isn't likely to end soon. Off-road vehicle groups are doing their best to pressure an already pliable park service leadership in Yellowstone and Washington into increasing access...

The tragedy of the motor brigade is that by winning they destroy what they love -- the wilderness. The Yellowstone story has impressed me though -- given better alternatives they choose the snow coaches to preserve quiet and clean air. That result was predicted by Clinton-era surveys, but of course Norton/Bush disregarded it.

Hacking the universe: counterfactual computing

You can measure something -- without actually doing the measurement.

You just threaten to do the measurement. The answer then appears.

It smells like a variant of 'spooky action at a distance'.

That's my summary of counterfactual computing. It will do for me until the Scientific American article comes out, which I will read and fail to comprehend.

This all feels as though we're hacking the infrastructure upon which our "program" runs.

If this stuff turns out to actually have real world implications the next forty years will be even less predictable than expected.

PS. Cosmic Variance has a serious attempt at an explanation.

Drug testing in sports: time to give up?

A few years ago JAMA featured a series of articles on drug testing for atheletes. I don't recall the details, but I do remember concluding that this was a doomed effort. The drug use was getting very sophisticated, and the tests couldn't keep up. Careful users could stay within the published bounds, and eventually every athelete's metrics would converge on the very limits of the test regimen. (This ought to be an amusing study by the way -- plot the narrowing of the distribution of lab values over time.)

Salon reports the end is now:

Salon.com | King Kaufman's Sports Daily

4. Officials administered a reported 1,200 drug tests, a 71 percent increase over the last Winter Games, in 2002. And there was one positive. One. In Salt Lake, seven athletes tested positive out of 700 tests.

So, thanks to the crackdown by world anti-doping forces, we've gone from 1 percent of the tests coming up positive to 0.0083 percent. Problem solved! Glad we cleared that up.

Drug tests performed on the Austrian cross-country skiers and biathletes following the raid on their quarters that reportedly turned up dozens of syringes and unlabeled drugs came up negative. The International Olympic Committee says the investigation is ongoing.

Positive tests are not required to punish athletes for drug use, the IOC says. It takes circumstantial evidence into account.

That's probably wise, because drug testing is obviously one of the most abject, spectacular law enforcement failures since Prohibition.
Either that or the Olympics are now suddenly a collection of the cleanest, most drug-free saints ever gathered in one place. On second thought, yeah, I'm sure that's it.

The drug tests still serve a purpose. They set an 'upper bound' on how performance enhancing drugs can be used -- users cannot exceed maximal physiologic outcomes.

In a sense the drugs now compensate for the fundamental inequities of genetic gifts ... So in the interests of fairness we should make the most sophisticated drug regimens and monitoring systems universally available to all atheletes. When they are are equallly tuned, including the use of cognitive modifiers, then the outcome of competition will be chance and training ...

Defining a disease: how often are atypical presentations due to multiple agents?

It's been a long time since I was a real doctor, but occasionally I play one when the kids are sick (my wife is still a real doctor). In the latest episode our six year old had a week of vomiting, persistent fevers, hand and foot complaints and rashes that, to tired and worried parents, looked a bit like Kawaski's Disease. Happily a set of bloodlettings cured him and he never made the diagnostic criteria.

So what did he "really" have? "Bad adenovirus" is the story our most excellent pediatrican gave, though he admits he really doesn't know. In reality, of course, there's no reason why he had to have just one virus. There's nothing about being infected with, say, an enterovirus, that makes one immune to infection with an adenovirus. Likewise a strep infection, for example, does not prevent coronavirus infection. They're all around us in Minnesota at this time of year.

We're used to thinking about multi-organism infections in the context of HIV and ICUs, but they must happen reasonably often in the ambulatory setting. How many unusual presentations, including some with persistent injury or even death, are really the result of coincidental simultaneous viral (or bacterial) infections that together produce far more disease than each would alone? How often does a pathogen cause a commensal to become pathogenic? Our models of disease are, like all models in science, only approximations. We haven't had the instruments to further refine these models, and thus to reconsider the nature and definition of infectious diseases. It will be interesting to see how these things change as we get cheaper and better rapid tests for viral and bacterial infections.

Of course I'm sure all of these speculations are old hat in the infectious disease and microbiology communities, but my background is in primary care. I think changing from a simplified model of disease to a multifactorial and 'emergent' model, will have some interesting consequences in many domains. (I've omitted mention of additional genetic and environmental interactions because that's kind of obvious ...)

PS. Incidentally, when reading about KD both my wife and I were struck yet again about how feeble the descriptions of disease are in the biomedical literature. Most of the descriptions are a list of uncorrelated and unsequenced complaints and findings, as though combinations and temporal evolution were irrelevant -- when in fact those are often the key 'signatures' of a disease. If I didn't know better I'd say our medical writers are encrypting their knowledge, but in fact this I know there's no conspiracy here. It's simply that the audience doesn't demand better.

By comparison layperson stories are often much richer; one parent's website featured a terrific slideshow and description of the evolution of their daughter's successful treatment that shamed every medical text we reviewed. Osler's descriptions of disease in the early 20th century are far better than what we read nowadays.

Some curmudgeon needs to write a paper about this!

PPS. And then there's the remarkable paucity of data in most reviews and articles on the prevalence of cardiac aneurysms in treated Kawasaki's Disease. Come on gang! Applied biomedicine could use a kick in the old pants ...

What's really going on with the "Port" story?

Google has about 2380 articles about the port story. That's a heck of a lot of noise. None of it makes much sense. There isn't enough there to justify all the fuss. Sure, US port security sucks. Sure this is an incredible sign of incompetence five years after 9/11. That's the fault of the GOP and the Bush administratiion, not the port management company. Dubai is as good an ally as the near-friendless US has these days. The friendless part is also the fault of the GOP and the Bush administration. Sure foreigners are buying up fundamental US assets, but that's because our governmental finances are a complete mess. That's also the fault of the GOP and the Bush administration.

No news here.

So what's really going on that so many Senators have their knickers in knot? It has to be something that no-one is ready to talk about. I have two suggestions:

1. Sure Dubai is an ally. So was Iran under the Shah. Dubai is not a democracy. Maybe security analysts suspect it's ripe for revolution. Maybe Senators know that. It's a rather impolitic thing to say. This is one way in which Duba is not the UK.

2. Follow the money. (This one comes via Emily.) No deal of any size is done in the US today without a kickback to the GOP. They got a percentage, somehow, womewhere. The deal was done pre-Abramoff, and now the GOP is afraid this one might get attention.

Or maybe the answer is #1 and #2 and something else. The one thing I'm betting on is that it isn't anything that's being talked about.

Google to PayPal: your days are numbered

Google's official blog features a remarkably bland post on payment systems that includes a remarkably coy phrase:

Official Google Blog: An update on payments:

... We expect to add payment functionality to Google services where our users need a way to buy online....

There's no mention of when this will be released. My bet would be that we'll see the announcement within 3 weeks.

[note: in the original version of this post I wrote 'eBay' instead of 'PayPal'. I meant the latter.]

Another update on America 1984

Hilzoy of obsidian wings has extensive commentary on a recent New Yorker Article on America's torture program. The torment of the "20th hijacker" is truly impressive. Stalin would have approved.

What I want now is an international panel of wise women and men, trustworthy group of outsider, to pronounce judgment on America. Is it "happening here"?

Air America: On Groundhog Day

I'm a bit behind on my email. I just found this in my inbox (thanks K.):

This year, Groundhog Day and the State of the Union Address fall within two days of each other. As Air America Radio pointed out, "It is an ironic juxtaposition: one involves a meaningless ritual in which we look to a creature of little intelligence for prognostication, and the other involves a groundhog."

Newsweek shreds Bush, but is he incompetent or delusional?

Shrillblog sent me to this massacre of the Bush administration by Bill Hirsch, a senior editor at Newsweek:

Hirsh: Bush’s Poor Leadership in Terror War - Newsweek Politics - MSNBC.com

... What a contrast to four years ago, when the rapid collapse of the Taliban caught bin Laden by surprise as he sought to escape the Afghan mountains of Tora Bora. It was probably the last time, we must now conclude, that the terror impresario was surprised at all. As Gary Berntsen, the CIA officer in charge of the operation, records in his new book 'Jawbreaker,' (Crown, 2005) bin Laden told his followers, 'Forgive me,' and apologized for getting them pinned down by the Americans (Berntsen's men were listening on radio). Bin Laden then asked them to pray. And, lo, a miracle occurred. As Berntsen stewed in frustration over the Pentagon’s refusal to rush in more troops to encircle the trapped “sheikh,’ bin Laden was allowed to flee. And not only did Bush stop talking about the man he wanted “dead or alive,” the president began to shift U.S. Special Forces (in particular the Arabic-speaking 5th Group, which had built close relations with its Afghan allies) and Predator drones to the Iraq theater.

It is time to have an accounting of just how badly run, and conceived, this 'war on terror' has been...

...Al-Qaeda’s leaders worried about a military response from the United States, but in such a response they spied opportunity: they had fought the Soviet Union in Afghanistan, and they fondly remembered that war as a galvanizing experience, an event that roused the indifferent of the Arab world to fight and win against a technologically superior Western infidel. The jihadis expected the United States, like the Soviet Union, to be a clumsy opponent."

Not in their fondest dreams did they realize how clumsy...

... How then did we arrive at this day, with anti-American Islamist governments rising in the Mideast, bin Laden sneering at us, Qaeda lieutenants escaping from prison, Iran brazenly enriching uranium, and America as hated and mistrusted as it ever has been? The answer, in a word, is incompetence ... So catastrophic was Bush's decision to shift his attention and resources to Iraq, when bin Laden was panting at Tora Bora, that one is tempted to rank it with Adolf Hitler's decision to invade the Soviet Union in June 1941...

... bin Laden and Zawahiri have been fortunate in their enemies. Had the Bush administration been more competent, these two would have long since been bloody pulp, perhaps largely forgotten. Luckily for the rest of us, the Al Qaeda revolutionary program is so abhorrent that most of the world still has no choice but to stick with us, through thick and thin—and dumb and dumber. How long we can test the world’s patience is another matter. Alan Cullison’s 2004 article based on Zawahiri’s private thoughts is again instructive here. "Al Qaeda understood that its attacks would not lead to a quick collapse of the great powers,” he wrote. “Rather, its aim was to tempt the powers to strike back in a way that would create sympathy for the terrorists. ... One wonders if the United States is indeed playing the role written for it on the computer." What I wonder is, how many more years will we have to wait for Rumsfeld to figure that one out?

Hirsch led the 9/11 coverage for Newsweek. He takes this story seriously.

I'm not sure incompetence is the correct charge however. I think the problem is deeper. Bush is very competent at getting what he wants, but he's delusional. He gets what he wants, but it doesn't produce the results he expects.

We are led by the a faith-based delusional regime. It wouldn't be so bad if God seemed to favor them, but based on how things are going the evidence suggests God doesn't like GWB very much ...

Breakthrough in Crohn's disease?

Newspapers announce disease breakthroughs all the time, but this smells different ...

BBC NEWS | Health | Fresh theory on cause of Crohn's

...The UCL team also tested Crohn's patients' response to bacteria by injecting a harmless form of E. coli under their skin.

This resulted in a huge increase in blood flow to the inflamed area in healthy volunteers - but a much smaller increase in the Crohn's patients.

The researchers found this abnormally low blood flow could be corrected by treatment with Viagra.

The researchers believe that, because Crohn's patients have weakened immune systems, they are unable to destroy bacteria that penetrate the intestinal wall.

Thus the bacteria are left to build up in the tissue, stimulating the secretion of inflammatory chemicals that trigger the symptoms of Crohn's...

Wow. A new theory, some supporting evidence, a new therapeutic direction... This doesn't happen too often. Crohn's may be another of those mysterious diseases that were once thought to be infectious, then auto-immune, and are now again considered infectious.

Will ulcerative colitis turn out to have an utterly unrelated mechanism? And what does this do to one of my favorite research programs -- using worms to treat inflammatory bowel disease?

Keeping fingers crossed ...

Ugly people are the under class

The ugly are the natural underclass, often born to the homely and inclined to suffer ...

Economist's View: "I'm too ugly to get a job"

..Not only are physically unattractive teenagers likely to be stay-at-homes on prom night, they're also more likely to grow up to be criminals, say two economists... "We find that unattractive individuals commit more crime in comparison to average-looking ones, and very attractive individuals commit less crime in comparison to those who are average-looking," claim Naci Mocan of the University of Colorado and Erdal Tekin of Georgia State University...

-- comments --

.... Attractiveness in most species is a marker for overall fitness. The beautiful, on average, probably have better genes than homely folk like me. [jf: So do their parents, so they are also typically wealthier ...]

I remember well one summer watching a group of first year Harvard med students entering class. The ugliest among them was prettier than almost all of my McGill med school class. Clearly, physical beauty was a part of their selection process (probably filed under "leadership potential"). Why not?

On the other hand, if I were better looking I'd have been even worse behaved as a young man than I was. There's something to be said for having decidely average looks.

For a more interesting question -- what is the relationship between acne, the appearance of young females, and the probability of being raped? What is the adaptive advantage of female acne?

What can we do about this? If we're around in a hundred years maybe we'll be wise enough to sort this out -- or we'll have engineered homeliness out of the human species.

Michael Brown: more than a cartoon

Michael Brown, former head of FEMA, talks about what it's like to be mocked by a million strangers...

A Conversation With Michael Brown

...You're talking about your turf battles within the Department of Homeland Security. You think you should've left earlier.

Frankly, I should've given up. In hindsight, there were points where I knew I was losing the battle....

I searched my blog, it appears I never said anything about Michael Brown. I think I'll pat myself on the back. I had a hunch there was more going on than the initial media coverage. It's well worth reading for a sense of how suffocating and alienated Washington can be.

All Gore, I miss your reinventing government efforts.

Monbiot on a world without privacy

Monbiot writes for the Guardian. He's a reliably left-wing future-is-scary sort of guy. Mostly I think he's off-base or uninteresting, but I follow his blog postings because every month or two he is interesting and unique. This time he writes about implantable RFID chips and the gradual transformation of society:

George Monbiot: Children of the Machine:

... There will be no dramatic developments. We will not step out of our homes one morning to discover that the state, or our boss, or our insurance company, knows everything about us. But, if the muted response to the ID card is anything to go by, we will gradually submit, in the name of our own protection, to the demands of the machine. And it will not then require a tyrannical new government to deprive us of our freedom. Step by voluntary step, we will have given it up already.

I fought this back in the 1980s and early 1990s. I gave up; even before 9/11 it became clear that either people couldn't understand this topic or didn't really care. We live now in a world that would have shocked citizens of 1980s America, but the transition has mostly gone without remark.

Monbiot conflates loss of privacy with loss of freedom. David Brin (Surveillance society) has done a good job of showing that they're not necessarily identical. Privacy loss is necessary, but not sufficient, for a loss of freedom. Practically speaking, however, the falling cost of havoc and the a separate drive to protect economic interests means freedom will likely follow privacy.

Is there anything to do? Sure there is. There are better worlds. Will Americans take another path? No, we re-elected George Bush. Will Europeans? Seems not. Canadians? No. Maybe in New Zealand ...