Data Mining Doesn't Always Pay: $1.135 Million Judgment
1st Source was harvesting cell phone numbers from web sites and doing reverse lookups for cellphone numbers and selling the information to other businesss for $110 to $195. To make things worse they were also selling records of the calls made from specific cell phone numbers; an additional huge invasion of privacy.
The Cingular complaint claimed the defendants "engage[d] in deceit, trickery and dishonesty to obtain private information from Cingular's (customer service representatives) through 'social engineering,' improper hacking and/or through unauthorized access to online account information stored on Cingular's database."
The stated techniques included "instances of the defendants or their employees using customers' passwords to access their accounts, pretending to be Cingular customers seeking information about their own accounts or posing as "fellow [Cingular] employees facing an urgent access problem in accessing a customer account.""
Social engineering is a tough threat to guard against, and is widely used. This case highlights the importance of training personnel on an ongoing basis for how to safeguard information, including how to prevent successful social engineering attempts.
Coincidentally Dr. Gary Hinson at NoticeBored issued his monthly newsletter a couple of days ago, the topic for which was social engineering. Dr. Hinson's site has many great article on this topic; it is a good place to go to get ideas for your own awareness and training activities.
This case also shows that organizations, information security and privacy practitioners in particular, need to be diligent in knowing their company's (likely marketing department's) plans for harvesting data such as cell phone numbers and email addresses for marketing purposes. They must also check before purchasing customer contact lists to make sure the information they want to purchase was gathered legally and with the individuals' consent.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
Comments
I agree that inappropriate sharing of private information is wrong, but it simply is not "data mining". Data mining is a sophisticated statistical analytical process, not simple information gathering. Please, let's keep the terminology straight.
Posted by: Will Dwinnell | December 1, 2006 6:45 AM
Will, thanks for your comment.
Yes, in the true academic and scientific sense, "data mining" is not using tools to harvest information from websites. As NIST describes, "Data Mining can take many forms, but it involves the search for some underlying structure. This structure can be regularity in data, or an optimization of some property(s), or even a method such as an algorithm." (http://math.nist.gov/mcsd/savg/datamine/index.html)
However, as the press regularly uses the term "data mining" it is much broader and involves such activities as harvesting information from websites, as the article from the law.com site illustrates.
The general public, most lawyers filing cases such as this one, and reporters now regularly use the term "data mining" interchangeably with "data harvesting." This highlights a general problem with issues information security and privacy; there are communications gaps between different positions that lead to significant differences in interpreting legal compliance requirements, performing cybercrime investigations and associated prosecutions, and so on. This communication gap is a challenge faced by information security and privacy practitioners daily.
Similar to those arguing the correct definition of "hacker," "data mining" is also a term that those in academia, in research, in marketing, in technology, and so on, also debate.
Your point is well taken. Perhaps I should have used the term "data harvesting" in my post title instead of "data mining," but since the story used that term, that is the one I chose to use.
If you would like to educate folks on the true definition of "data mining" and have a link to an article to share, I welcome you posting a URL to it.
Posted by: Rebecca | December 1, 2006 8:52 AM