Thursday, January 10, 2008

Identity Theft in Nashville

A huge amount of data was stolen from the Metro election commission here in Nashville. Over 300,000 people's names, addresses, social security numbers, etc. were taken, so the city, in it's infinite wisdom (cough, cough, covering their asses) decided to provide identity theft protection for all those whose data was stolen. Sound like a great idea? The problem is, it's a band-aid for a hemorrhage...not enough. Here's an email to one of our council members from someone very close to me which describes the shortcomings of metro's decision:

Your website was forwarded to me since I live in your district. As you, I was pleased to see Metro trying to take some action in responding to the recent breach at the Metro Election office. I was greatly disappointed to learn of the program selected and the ineffective measures proposed and the exorbitant costs that the city will incur. Nashville is home to two of the largest ID Theft Protection Services in the country and to my knowledge neither of them were contacted. I am very familiar with the Debix program and it is an extremely superficial approach to deal with ID Theft and breach resolution. Their program is strictly a fraud alert system, with some technical bells and whistles, which can be done for free by all citizens simply by calling one credit bureau which is required to notify the others. The other preventative services such as Opt-Out and the Do Not Call Registry, Debix's other preventative measures, are all free consumer services that can be easily accessed by web site links or toll free numbers. Credit related events only account for 48% of Identity Theft so this approach only addresses half of the problem...if that. An effective program should include restoration services that cover all types of ID Theft and takes over all of the work if a person becomes a victim. The menace of ID Theft is the amount of time and frustration an individual has to spend cleaning up the problem. The FTC and independent studies indicate that it takes between 400-600 hours and up to five years to resolve an Identity Theft. Spending the amount of money you noted to only partially protect the preventative side of this risk and provide no protection if the event actually occurs is a total waste of the City's money. I know from experience that companies can provide blanket restoration services which means all citizens would be fully covered if they did become a victim, regardless of the type of ID Theft (Credit, Social Security, Insurance, Benefit, Employment, Criminal, Medical,etc.). I am just disappointed to see that a lack of understanding of what the true risk of ID Theft is has lead to such a quick and poor decision by the City. There are much better and more effective options available if someone did a bit more homework.