[IP] Connected: Verizon puts your privacy in precarious position
http://www.post-gazette.com/pg/05197/538849.stm
Connected: Verizon puts your privacy in precarious position
Saturday, July 16, 2005
By David Radin
Would you give your credit card number to a company if you knew it
was to be used for anything else besides taking your payment? That is
exactly what is happening for thousands of people nationwide who have
signed up for Verizon's VoiceWing Voice over IP telephone service.
-------------------------------------
You are subscribed as roessler@xxxxxxxxxxxxxxxxxx
To manage your subscription, go to
http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/
VoiceWing is different from Verizon's traditional telephone service
in several ways, one of which is that the company only accepts credit
cards as payment. It will not direct bill you. So you must provide
your card to get the service. Once you have the service, Verizon
debits your card monthly -- and also uses the last four digits of
your card number to verify who you are when you call for support.
According to Margo Hammar, chief privacy officer at Verizon, using
your credit card digits this way is just like paying for your gas at
the pump, then crumbling the receipt and throwing it away.
But it's not the same. At the pump, the credit card is inserted for a
one-time transaction and not saved by the gas station. It is you who
makes the decision on the spot to provide the card data; and it is
you who decides whether to print the receipt and crumble it (or keep
it). In the VoiceWing scenario, your credit card information is
placed into a database at Verizon -- and then the last four digits
are shown to any customer support rep who pulls up your record --
even if no transaction is taking place.
Hammar told me that "Verizon takes the safeguarding of client
information very seriously" and that the company has created a method
and procedure to be used by employees with a need to know. As the key
privacy person, she has pushed the company to move away from using
Social Security numbers for customer authentication, but has not yet
provoked the company to stop using this credit card data for the same
task.
According to Dean Ocampo, product marketing manager for security
software developer Check Point Software Technologies, using only the
last four digits minimizes risk compared to using the entire number,
"but ideally you don't want to use any of it." He says the issue goes
deeper than whether the company is using the digits. It involves the
processes they employ and the depth of security.
In the Verizon situation, your credit card digits are displayed to
first-tier customer support reps -- people who are not in a "need to
know" position regarding your credit card. In one call that I made to
VoiceWing support, I refused to give the CSR my digits, which made
him exclaim that the digits are right in front of him already; it's
not like I'm revealing anything new to him.
That, in fact, is the problem. The digits should not be in front of
him. He has no reason to see a customer's credit card data, no matter
how ethical he is. Check Point's Ocampo agrees: "The more you put
private data through the company, the more likely it can be hacked
and stolen." He cites instances in which companies have not properly
secured the data at every juncture, even though it thinks it has.
Recent news items about security problems at Citibank, ChoicePoint
and CVS provide examples. Ocampo's examples include points of attach
within the company, including PCs living around the perimeter of the
network that have not been completely secure.
Since businesses make decisions over time, other factors may later
create security risks. For instance, a move to outsourcing customer
support offshore would put your credit card data in a rep's hands in
another country -- perhaps a country that doesn't have the same
protection laws that are in force in the United States. Securing
customer privacy is not a science. What's good for the business is
not always good for privacy, and vice versa. Companies are always
dealing with the trade-offs when making business decisions.
Verizon's published privacy policy promises that the company will use
SSL (a security mechanism) whenever it transmits your credit card,
but it doesn't promise to use your card number only for your
transactions. As long as Verizon continues to use customer credit
card numbers as authentication, in whole or in part, it is putting
the customer at risk, no matter how slight.
(David Radin is a Pittsburgh-based consultant whose daily nationally
syndicated radio show can be heard locally on XM and Sirius. You can
sign up for his tip letter, contact him and find an archive of his
previous columns at www.MegabyteMinute.com.)
-------------------------------------
You are subscribed as roessler@xxxxxxxxxxxxxxxxxx
To manage your subscription, go to
http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/