Hackers get bum rap for corporate America's digital delinquency

If Phil Howard’s calculations prove true, by year’s end the 2 billionth personal record – some American’s social-security or credit-card number, academic grades or medical history – will become compromised, and it’s corporate America, not rogue hackers, who are primarily to blame. By his reckoning, electronic records in the United States are bleeding at the rate of 6 million a month in 2007, up some 200,000 a month from last year.

Howard, an assistant professor of communication at the University of Washington, bases his projections on a review of breached-record incidents as reported in major U.S. news media from 1980 to 2006. The total through last year stood at 1.9 billion – or roughly nine records per American adult.

His report delving into the flood of escaping records and some of the related dynamics, co-authored with Kris Erickson, a UW geography doctoral student, will appear in the July edition of the Journal of Computer-Mediated Communication. If anything, Howard contends the numbers they collected are conservative.

He said they were careful to avoid double counting press accounts of the same breached-record incident that led to exposed credit histories and other personal information. He believes similar incidents took place, but went un- or underreported before 2003, when California’s pioneering Notice of Security Breach law took effect. That law requires companies to disclose such lapses, and more than 20 states, including Washington, have since adopted statutes modeled on California’s, Howard said.

He and Erickson also found that:

-- Malicious intrusions by hackers make up a minority (31 percent) of 550 confirmed incidents between 1980 and 2006; 60 percent were attributable to organizational mismanagement such as missing or stolen hardware; the balance of 9 percent was due to unspecified breaches.
-- Likely as a result of California’s law and similar legislation adopted by other states, the number of reported incidents more than tripled in 2005 and 2006 (424 cases) compared to the previous 24 years (126 cases).
-- The education sector, primarily colleges and universities, amounted to less than 1 percent of all lost records, but accounted for 30 percent of all reported incidents.

A single 2003 incident involving 1.6 billion records held by Acxiom, an Arkansas-based company that stores personal, financial and corporate data, dwarfs all others. In that case, the offender controlled a company that did business with Acxiom and had permission to access some files on Acxiom’s servers. But he illegally hacked into other records and then tried to conceal the theft, prosecutors charged.

A much different picture emerges, however, when the past quarter century is viewed in terms of the number of reported incidents. Three out of five point to organizational malfeasance of some variety, including missing or stolen hardware, insider abuse or theft, administrative error, or accidentally exposing data online, Howard and Erickson found.

Thanks to the mandatory reporting process established by California, "We’ve actually been able to get a much better snapshot of the spectrum of privacy violations," Howard said. "And the surprising part is how much of those violations are organizationally prompted – they’re not about lone wolf hackers doing their thing with malicious intent."

While corporate America would prefer to let "market forces" – factors such as negative publicity and expenses generated by data loss – take care of the problem the authors aren’t convinced that would make for an effective strategy, especially with identity theft listed as the fastest-growing crime in the United States. Based on recent history, it looks as though states are more apt to fill the regulatory void than the federal government, Howard said.

Another noteworthy trend, he said, is what’s happening in the education sector, which accounted for nearly a third of reported breaches. This could be explained, Howard and Erickson said, by the fact that colleges and universities "have an organizational culture geared towards information sharing."

Source: University of Washington

Related stories:

Low maternal cholesterol tied to premature birth
Pregnant women who have very low cholesterol may face a greater risk of delivering their babies prematurely than women with more moderate cholesterol levels, a team led by the National Human Genome Research Institute (NHGRI), part of the National Institutes of Health (NIH), reported today.
MIT IDs mechanism behind fear
Researchers from MIT's Picower Institute for Learning and Memory have uncovered a molecular mechanism that governs the formation of fears stemming from traumatic events. The work could lead to the first drug to treat the millions of adults who suffer each year from persistent, debilitating fears - including hundreds of soldiers returning from conflict in Iraq and Afghanistan.
Single genetic defect causes early heart disease
A team of researchers from the United States and Iran has identified a genetic mutation that causes early onset coronary artery disease in members of a large Iranian family. The genetic mutation leads to heart disease by causing high blood pressure, high blood levels of "bad cholesterol" and diabetes, all risk factors for heart disease. Coronary artery disease is the leading cause of death worldwide.
Researchers link ice-age climate-change records to ocean salinity
Sudden decreases in temperature over Greenland and tropical rainfall patterns during the last Ice Age have been linked for the first time to rapid changes in the salinity of the north Atlantic Ocean, according to research published Oct. 5, 2006, in the journal Nature. The results provide further evidence that ocean circulation and chemistry respond to changes in climate.
HP Unveils Revolutionary Wireless Chip that Links the Digital and Physical Worlds
HP today announced that its researchers have developed a miniature wireless data chip that could provide broad access to digital content in the physical world.
Globe Talk: Enron's broadband debacle
Enron was nothing if not flamboyant and eager to pursue the latest business trends. While its focus was on energy trading, it had expanded into telecommunications among other industries as executives cooked the books and the company's finances spun out of control.
Entertainment industry fights piracy
Finding itself in a whirlwind battle of fighting revenue losses as a result of piracy, the entertainment industry is pushing legislation that would prevent the exploitation of a gap in content protection technology known as the "analog hole."
The Web: Pols embracing podcasting
Howard Dean this week headlined the Democratic National Committee's first "podcast" on the Internet -- a brief, recorded audio broadcast that listeners around the globe downloaded, signaling, experts told United Press International's The Web, that podcasting is going mainstream.

News discussion:

Technology news