Asset Protection BLOG - Mark Nestmann

Obama Gives States a REAL New Year's Gift

Imagine walking down the street to the corner store for a newspaper and being stopped by policeman.  He demands to see an official government-issued photo ID.  You don't have it with you.  The policeman tells you you're subject to a fine, and takes you into custody until authorities can ascertain your identity.

Is this a totalitarian nightmare of East Germany or the Soviet Union?  No, this is everyday life in dozens of countries that have issued citizens national ID cards that must be carried at all times.  Failing to present the card upon demand is an offense in many of these countries (e.g., Spain).

Once a system of universal identification is established, it's a short step to requiring people to have and carry ID cards.  And at least in the United States, that's where an obscure law called the "Real ID Act" comes into play.

Enacted in 2005, the Real ID Act established "national uniform standards" for driver's licenses.  Once the law comes into effect, state driver's licenses that fail to conform to federally mandated "minimum standards" will no longer be valid for any federal "official purpose." Examples of "official purposes" include boarding an airplane, buying a firearm, obtaining federal benefits, or even entering a federal courthouse.  

From the outset, state governments hated the REAL ID initiative.  The main reason had nothing to do with any concern about privacy, states' rights, or any other constitutional concern, but a much more immediate problem: money. 

REAL ID is a classic "unfunded mandate," foisted upon the states by the federal government.  Estimates of implementing it nationwide run into the tens of billions of dollars.  That's chump change in comparison with the cost, say, of bailing out AIG.  But for fiscally strapped states, it represents a big stack of mostly borrowed dollars.

But now, President Obama has come to the rescue!  Earlier this month, Homeland Security Administration Secretary Janet Napolitano announced that the Obama administration would abandon the Dec. 31, 2009 deadline for states to adhere to the new requirements.  Presumably, in the next few months, the HSA will roll out its own REAL ID deadline, or push for a less expensive "PASS ID" proposal backed by Napolitano.

As I've pointed out in a previous blog entry, neither REAL ID nor PASS ID will improve security.  Computer experts have easily duplicated virtually every state-of-the-art identification document that current exists.  There's zero proof that high-tech drivers' licenses will be any different.

Indeed, the REAL ID initiative will actually make us less secure, particularly against crimes like identity theft.  The law authorizes creation of a national database to include details on nearly 250 million licensed drivers.  The database will consist of a series of interlinking systems operated and administered by the states.  Each state must provide electronic access to all other states to information contained in its motor vehicle database.  An interlinked system is a far greater security risk than a decentralized one with each state issuing ID cards according to its own rules. 

Call me a cynic, but I think the real reason Congress enacted the REAL ID has nothing to do with security.  The REAL ID system is merely a stepping-stone to get Americans accustomed to carrying supposedly secure identification documents all the time.  Once we've been conditioned to do that, the government can expand the use of a secure ID so that it can also be used as a debit or credit card.  And when that's accomplished, the government could eliminate cash altogether.  It's a short step from "debit/credit cards accepted here" to "Sorry, we only take debit/credit cards." 

This will be my last blog entry of 2009—best wishes for the coming year!

Copyright © 2009 by Mark Nestmann

EU Caves in to U.S. Demands on Financial Data

If you're not a U.S. citizen, don't have a U.S. bank account, and don't invest in U.S. assets, you might assume that the United States has no right to snoop into your financial affairs.  But if you believe that, you're wrong.

That's a consequence of a top-secret U.S. initiative called the Terrorist Finance Tracking Program (TFTP).  Shortly after the 9/11 attacks, the U.S. Treasury Department issued a secret administrative subpoena to the Society for Worldwide Interbank Financial Telecommunication, or SWIFT.  This international banking consortium routes more than US$6 trillion daily between nearly 8,000 financial institutions.  While SWIFT is based in Belgium, it currently uses U.S.-based servers that mirror all the financial transfers overseen by the Belgian parent.

The Treasury subpoena demanded that SWIFT provide essentially unrestricted access to its records.  And SWIFT complied without apparent complaint until The New York Times revealed the existence of the TFTP in 2006.  

Then, all hell broke loose.  Officials at the Bush White House briefly considered an indictment of the Times and its editors for treason.  The Belgian government, which was content to ignore the monitoring until it became public knowledge, threatened to shut down the TFTP as a violation of EU privacy laws. 

After considerable diplomatic maneuvering, Belgium and the EU permitted the program to continue.  The United States promised strict controls over the data it extracted, although the entire program continued to operate in near-total secrecy.  In February 2009, the European Commission announced that the United States had abided by these promises and recommended that the program be allowed to continue.  And on November 30, the EU Home Affairs Ministers agreed to a nine-month extension of the monitoring program. 

The agreement is only in effect until September 2010.  By then, SWIFT anticipates that it will complete a transition of its U.S. databases and servers to Switzerland.  Presumably, U.S. officials will then have to negotiate a new agreement with Switzerland to access its data.

I'm not holding my breath that Switzerland will be any more protective of SWIFT data after next September than under the current agreement.  Only a few months ago, Switzerland dramatically expanded the grounds under which it would release Swiss banking information to foreign tax authorities.  Why should we believe it will behave any differently when the United States demand it provide unfettered access to information about global financial flows? 

Copyright © 2009 by Mark Nestmann

FBI Delays Result in Extended Wait Times for Economic Citizenship

One of the requirements to obtain economic citizenship in the Commonwealth of Dominica is to prove you don't have a criminal record.  For U.S. applicants, you obtain a copy of your FBI criminal record.  You have local police take your fingerprints, and then submit them to the FBI.  Hopefully, you'll receive a "certificate of no record" back from the FBI.

Until a few months ago, it took the FBI only two or three weeks to process these applications.  But it's now taking 8-10 weeks, sometimes longer.  This in turn has resulted in delays in processing applications for economic citizenship.

I now recommend anyone considering economic citizenship in Dominica to send in the form to obtain your FBI criminal record as the first step in the application process.  You can download the FBI fingerprint card at http://www.fbi.gov/hq/cjisd/fprequest.htm. 

Why might you wish to consider economic citizenship?  Click here to find out the unique advantages of a second passport.

Happy holidays to all!

Copyright © 2009 by Mark Nestmann

Supremes to Rule in Electronic Privacy Case

“Sexting”—sending sexually explicit text messages—is an increasingly popular pastime. And it’s one with increasing legal fallout.

Tiger Woods allegedly “sexted” women in several different countries.  His messages will no doubt be a prominent part of any divorce proceeding that his wife, Elin Nordegren, eventually initiates.

Several teenagers in the USA face child pornography charges related to sexting.  That’s because possession of sexually explicit photographs of a person under 18 years old is a felony in almost every state. 

But the sexting case before the Supreme Court involves a love triangle between a member of the Ontario, California SWAT team, his wife, and his girlfriend.  Sergeant Jeff Quon was sending hundreds of text messages each month during his shifts on the digital pager the city issued him.  When his bosses discovered what they considered excessive use, they decided to investigate. 

Ontario policy gives the city the right “to monitor and log all network activity including e-mail and Internet use.”  The policy also forbids “inappropriate,” “obscene,” or “suggestive” language in its employees’ communications. 

Armed with this legal rationale, the city obtained transcripts of Quon’s text messages.  They discovered that on average, Quon sent 25 personal text messages during each shift.  Most went to friends in the department, Quon’s wife, and his girlfriend.  Indeed, Quon sent eight times as many personal text messages during his shifts as work-related messages.  Many of the messages were, in the words of a trial judge, “to say the least, sexually explicit.”

When Quon’s supervisors fired him for violating city policy, he did the all-American thing.  He hired a lawyer.  The lawyer promptly brought a privacy invasion lawsuit against the city, the police department, and the company providing wireless services for its digital pagers.  And proving that money trumps embarrassment or good taste, both Quon’s wife and girlfriend signed on as co-plaintiffs.

What Quon’s lawsuit alleges is that if your employer issues you an electronic device, it should ask your permission before auditing your use of it.  That’s true even if the employer informs you that it has the right to monitor your use of device, and forbids certain types of communications.

A U.S. District Court ruled in Quon's favor, and in 2008, the U.S. Ninth Circuit Court of Appeals upheld that decision.  The city has now appealed to the Supreme Court, which recently agreed to hear the case.

In an era where the courts increasingly view privacy as a quaint anachronism, how has Quon’s lawsuit come so far?  Apparently, a police lieutenant informed Quon that the city wouldn’t monitor his communications if he paid the costs of any messages he sent beyond 25,000 characters monthly.  That, says Quon, proves that the city tacitly accepted the fact that employees might use city-issued electronic devices to send and receive personal messages.

These facts may be enough to get the Supreme Court to rule in Quon’s favor.  But don’t get your hopes up that you can “sext” with impunity on your employer-provided pager or cell phone.  While the Fourth Amendment restricts searches and seizures the government carries out, it doesn't impose the same limitations on private companies.  Unless you work for a government agency, a favorable result won’t change the privacy rules in your favor.

What the lawsuit does highlight, though, is that none of your electronic communications are private.  Anyone armed with the requisite legal authority—or a hacker masquerading as such a person—can obtain a great deal of information about these messages.  That fact in turn underscores the wisdom of advice I’ve long conveyed in my writings.  That is to never say anything on the telephone, in a fax, or in an e-mail or text message that you wouldn’t want to become Exhibit A in a lawsuit—or a criminal indictment.

Copyright © 2009 by Mark Nestmann

Civil Forfeiture: A New Tool to Balance State and Local Budgets

While the talking heads on television declare the recession over, in the meantime, state and local governments face record deficits.  Here in Arizona, our state budget deficit represents more than 50% of anticipated 2010 revenues.  And while Arizona faces perhaps the largest per-capita budget shortfall in the United States, many other states have a similar funding crisis.

Unfortunately, there are very few politically expedient ways to stem the flow of red ink.  Raising taxes is not only politically unpopular, but threatens to further depress state and local economies.  Cutting benefits is even less popular. 

On the other hand, confiscating the "proceeds of crime" has a near-universal appeal.  And using "civil forfeiture" statutes in effect in all 50 states, police have pursued this tactic aggressively.

Civil forfeiture is a legal procedure in which prosecutors can seize your property without accusing you, much less convicting you, of any crime.  Most federal civil forfeitures require the government to at least demonstrate probable cause that your property is somehow connected to a crime to confiscate it.  But the federal rules don't generally extend to state and local governments.  In many states, the government can simply seize your property and wait months before allowing you to contest the forfeiture.

That was the situation facing the U.S. Supreme Court in a case that I wrote about here. I had very low expectations that the court would overturn the Illinois statute that authorizes the civil forfeiture of cars and other property allegedly used in connection with drug offenses.  The issue before the court was a matter of fundamental due process: under Illinois law, the state need not schedule a forfeiture hearing for at least six months after the initial seizure.  Often, owners of seized property must wait much longer than that for an opportunity to argue that their property wasn't used illegally, or was used without their knowledge or consent.

For that reason, I wasn't in the least surprised that the court didn't overturn the Illinois law at issue.  The court did so by relying on a legal technicality that permits it to declare an issue "moot."  Here, the court ruled since there was no longer any "case or controversy" between the parties, it had no jurisdiction over the case.  Both sides admitted they had resolved their property disputes during the course of the litigation.

So, as matters now stand, the state of Illinois can continue seizing property of innocent owners and depriving them of a hearing for at least six months.  Other states that don't already have aggressive civil forfeiture procedures in place are certain to take notice.  And, because police will allege that the property seized is connected to "crime," such forfeitures should be politically popular.

How can you avoid becoming a civil forfeiture victim?  The most important precaution is to never permit anyone to use your home or vehicle for any purpose that could be construed as being illegal.  Another important precaution is to beware of holding large quantities of cash, unless you can demonstrate ironclad proof that it came from a legitimate source. 

Probably the best way to avoid civil forfeiture, though, is to relocate liquid assets out of the United States, as fast as you can.  Today wouldn't be too soon to begin.

Copyright © 2009 by Mark Nestman

How Thieves Can Use Your GPS—and Cell Phone—to Rob You Blind

Modern electronic technologies such as GPS and cell phones are wonderfully convenient.  But they're also irresistible targets for thieves.

GPS devices are now the number one item being stolen from motor vehicles.  You might think that thieves might simply fence your GPS at a local pawnbroker.  That's often the case, but a more sophisticated thief will do much more than that.

Consider what happened in one recent case.  A couple went to a football game to cheer on their favorite team.  While they were there, a thief broke into their vehicle and stole their GPS—and their garage door remote control.  When they returned home, their house was ransacked.  Everything in the home worth more than a few dollars that could easily be carried out the door was missing.

The MO of the theft was simplicity itself.  The thief simply looked up the couple's home address on the GPS and let the system guide him there.  Then he used the garage door opener to gain access to it.  He knew the couple probably wouldn't return home until after the game ended.  That made him reasonably confident he had at least an hour or two to find any valuables in the home and remove them. 

How could the couple have prevented the theft?  They could have omitted their home address from the GPS, or simply taken it with them to the game.  They could also have installed a home alarm system.  Even locking the door from the garage into the home would have been a deterrent. 

Information you program into a cell phone poses another security threat.  In one case I recently read about, a thief snatched a woman's handbag as she was walking down the street.  The handbag contained her cell phone.  She called her husband from a cell phone to let him know of the theft. 

He informed her that a few minutes before she called, he'd received a text message from her cell phone asking for the PIN to their local bank account.  He had replied with the PIN. 

They immediately contacted the bank, only to find that all the money in the account had been withdrawn.  The thief had perused the contacts list in the cell phone and sent a text message to the contact labeled "Hubby." 

Several precautions could have prevented this theft.  First, never disclose the relationship between you and the persons on your cell phone contact list.  Second, never respond to a text message asking for confidential information without confirming that the message came from the person you believe sent it.  Third, limit the amount of money you can withdraw at one time from your bank account at an ATM.  A few hundred dollars per day should be sufficient.

Finally, keep in mind that if you're ever arrested, in most states, police can confiscate your cell phone and inspect its entire contents, without a warrant.  Don't keep anything remotely incriminating in it.  Delete suggestive text messages, naked photos, or anything else that a prudish officer might find offensive, or try to use against you.

Copyright © 2009 by Mark Nestmann

TSA: Worst than Useless

We all have stories about the Transportation Security Authority.   My "favorite" was the time I waited behind a woman in a wheelchair to pass through the metal detector on the way to board a flight in Miami.  The woman was at least 80 years old and quite frail.  Nonetheless, the security screener confiscated her hairpin.  After all, the woman, while unable to walk unassisted, might have used it as a weapon. 

Airport security in the USA is a joke, and a bad one at that.  It's easy to create a fake boarding pass with Photoshop.  And it's not that much more difficult to steal someone's identity to create fake identification documents.  Indeed, the entire U.S. airline security process is nothing but "security theater," a term coined by programmer and security consultant Bruce Schneier. 

But we still have ID checks, secret databases, and no-fly lists. According to Schneier, it would be much more effective to focus on "suspicious people" trying to board a flight, rather than "suspicious objects."  He would do away with most of the remaining security apparatus, including ID check requirements and the no-fly list.

Why do we bother with them at all?  Mainly, because the population must be convinced that "experts are "doing something" to prevent future terrorist attacks.  Also, if security personnel focus on suspicious people who happen to be members of specific ethnic groups or religions, they're accused of "racial profiling."  And thus we perpetuate security theater.

For these reasons, TSA's intentional posting of a security instruction manual on federal procurement Web site is not only a huge security breach, but highly ironic.  The instruction manual includes pictures of ID documents used by congressional representatives, air marshals and even CIA agents.  It also specifies which passengers are exempt from screening and which should be screened more carefully.  Sensitive sections of the manual were redacted, but a simple copy and paste operation of the redacted sections allowed anyone to recover the deleted material. 

If the TSA didn't rely on ID checks and no-fly lists to identify suspicious people or cargo, posting this information on an unsecured Web site wouldn't be a big deal.  But it does.  In essence, the document could be used as a blueprint to bypass U.S. airport security systems. 

That's not to say this information can't be found elsewhere.  It can.  TSA manuals are available in the aviation community.  The problem, again, is that the TSA's entire security model is defective. 

The TSA, of course, isn't about to admit that.  It's successfully convinced Congress to allocate tens of billions of dollars to erect a flawed security infrastructure.  And so, instead of focusing on the fundamental flaws in its current security model, the agency will probably try to persuade Congress to reinstate the "Real ID" initiative.  This is a plan that would require each state to issue more secure driver's licenses.  This, say advocates of the plan, would make it much more difficult for airline passengers to present a false ID.

Of course, this just perpetuates the flawed system.  The more reliance we place on a single form of ID, the more valuable it becomes.  Even the most secure ID documents are vulnerable.   Last summer, security researchers in the United Kingdom cloned RFID chips used in the newest generation of U.K. passports.  After cloning the chips, the researchers implanted digital images of Osama bin Laden and a suicide bomber.  Then they tested the "passport" using passport reader software used by the U.N. agency that sets standards for e-passports.  It passed with flying colors.

Real terrorists will find ways to create false identities, just as they always have.  If we want airport security, we need to abandon the flawed model we now use.  The TSA and its security procedures are worse than useless.  It annoys the law-abiding while relying on an easily defeated security architecture.

Copyright © 2009 by Mark Nestmann

Want to be a Responsible Employer? Just Follow These "Simple" Rules…

Is housework becoming a burden? Then you might be considering hiring a housekeeper to help around the home.  But before you do, you'll want to understand your legal obligations when it comes to tax and immigration laws.

First, you need to contact the IRS and obtain an employer identification number (EIN).  To do this, download IRS Form SS-4.  To get your EIN over the phone, contact the IRS at 1-800-829-4933.

You'll be glad to learn that once you've obtained your EIN, you can be automatically enrolled in the Electronic Federal Tax Payment System (EFTPS).   This system lets you make federal tax payments online.  I highly recommend you do this. 

Never assume that you can simply send the IRS a check for taxes you as an employer have withheld.  That would be way too simple.  Indeed, an employer can actually be fined for sending a check directly to the IRS, if it's too large.  (I know, because it happened to me). 

You also need to withhold the appropriate taxes from your housekeeper's paycheck.  Make certain she completes Form W-4 so you know how many dependents she's claiming.  Also, you need to inform your housekeeper about various federal tax provisions such as the "Earned Income Tax Credit." 

Next, you need to give your prospective housekeeper Immigration and Naturalization Service Form I-9.  If your housekeeper doesn't speak English, you (or someone fluent in your housekeeper's mother tongue) will need to complete it for her (or him).  You'll find it helpful to keep a copy of the INS's "Handbook for Employers" handy so you understand what forms of identification are acceptable.  Don't forget that if your housekeeper isn't a U.S. citizen, she must prove her eligibility to work in the United States. 

If you're tempted to skip this process, you should know that hiring an illegal alien, of course, is…well, illegal.  You can be fined and imprisoned up to five years for "felony harboring" of an illegal alien.  But don’t worry…in most cases you'll only face a civil penalty.  Fines range from US$250 for a first-time offender up to US$10,000. 

But I digress…and you wouldn't want to break the law, would you?  And besides, we're just getting started! If your housekeeper doesn't have a Social Security number, she'll need to apply for one using IRS Form SS-5.  Naturally, if she doesn't speak English, you (or someone fluent in her language) will need to assist her in gathering the required documents and completing the application.

Next, you'll need to register yourself as an "employer" at your state employment agency.  Basically, you'll apply for Unemployment Insurance Tax Account Number and then begin making quarterly or monthly payments to the state employment agency.  Of course, there's a form to submit with each payment.  And as you'd expect, those failing to make the payments, or complete the form, may be severely punished. 

Also, once you register as an employer, auditors can make announced or unannounced visits at any time to make certain your complying with state unemployment rules.  So can representatives of the federal Occupational Health & Safety Administration (and state agencies with the same mandate), in order to enforce workplace safety rules. 

Are we having fun yet?  I certainly hope so, because we still have a ways to go!  The next step is to register as an employer with your state revenue department.  In Arizona, you can actually register as an employer for unemployment insurance purposes and for employer withholding tax purposes on a single form.  But in most other states, you need to complete separate forms.  Not surprisingly, once you register, you must file quarterly or monthly forms with the state tax department, along with whatever tax you calculate must be deducted.  You'll also need to file a year-end employer tax return. Once again, severe penalties apply for those tempted to ignore these requirements.

Don't forget to check local licensing requirements.  You may need to apply for an employer license.  In some cases, you'll discover that you won't receive a license unless your home is zoned "commercial" and not "residential."  If that's the case, you won't be able to hire the housekeeper. Sorry!

Well, we're almost done! Just remember that by February 1 of each year, you need to give your housekeeper IRS Form W-2 (typed, not handwritten, please!).  Don't forget to mail IRS Form W-3 to the Social Security Administration by March 1.  Penalties naturally apply for failing to meet these deadlines.

By now, you may just be tempted to start scrubbing the toilets yourself.  But wait!  President Obama is coming to the rescue. 

Last week, the White House sponsored a “Jobs Summit” to get ideas on how to create new jobs.  The gathering of professional politicians, community organizers, university professors, representatives from liberal think tanks and union bosses seems certain to generate millions of new jobs.  After all, private companies can no longer negotiate the maze of local, state, and federal regulations necessary to hire anyone.  But fortunately, we can trust these "experts," most of whom have never been an employer, or even worked for a for-profit company.

Obama did say one thing that might be helpful.  He claims he wants “fresh perspectives and new ideas”  to create new jobs.  Here's one: how about eliminating 90% or more of the bureaucratic maze prospective employers have to negotiate in order to actually put someone on the payroll? 

Somehow, I suspect this suggestion may be omitted from the White House report to be published on the Job Summit...

Copyright © 2009 by Mark Nestmann

Yahoo, Verizon: Our Spy Capabilities Would Shock You

Every now and then, ordinary citizens can glimpse the breadth and depth of the surveillance infrastructure erect to monitor us. In the last few days, Americans have had such an opportunity, thanks to privacy researcher Christopher Soghoian, a doctoral student at Indiana University.

On December 1, Soghoian published an audio recording of a presentation to a law enforcement industry conference on surveillance.  The speech was from Paul Taylor, manager of Sprint's electronic surveillance team.  According to Taylor, Sprint provided law enforcement agencies with its customers' (GPS) location information over 8 million times between September 2008 and October 2009.  (Soghoian has now removed the recordings at the insistence of the conference organizers, who claimed he had violated copyright laws by posting them.)

Sprint says the 8 million represents the number of individual "pings" for specific location information, not the number of targeted customers.  According to Sprint, "Each investigation may generate thousands of individual pings to the network as the law enforcement or public safety agency attempts to track or locate an individual."

That may be the case.  But it underscores how pervasive surveillance technology has become.  And also the phenomenon of "surveillance creep:" how technology or law intended for a humanitarian purpose winds up being used to enhance surveillance capabilities.

For instance, the technology that makes possible it possible for police to track you from your cell phone arrived pursuant to the so-called E-911 initiative.  Back in 2003, the Federal Communications Commission justified E-911 as making it easier for emergency crews to respond to 911 calls.  After all, help could arrive more quickly if emergency crews knew where to find the caller, if the caller couldn't provide this information.  Thanks to E-911, you can be tracked whenever your cell phone is on, sometimes within a few feet of your actual location. But it's plain to see from the Sprint admissions how surveillance creep has occurred.

U.S. courts are divided on whether locational surveillance requires a warrant.  And it's just one type of data routinely made available to police.  The government can also obtain customer records from ISPs and telecom providers revealing telephone numbers dialed; text messages, emails and instant messages sent; web pages browsed; and the queries submitted to search engines.  Very few of these inquiries require a warrant. 

But Soghoian was just getting started.  A few months ago, he filed Freedom of Information Act requests with the Department of Justice to find out how much telecom companies and ISPs charge law enforcement agencies to conduct surveillance.  And he definitely struck a nerve.  In letters also posted December 1, the attorney representing Yahoo wrote that should this data be disclosed, it "would be used to 'shame' Yahoo and other companies" and would "shock" their customers. 

Verizon made a different argument.  It claimed that if it made public its law enforcement surveillance pricelist, it would be overrun with requests from ordinary customers to conduct surveillance on their behalf.  "Such calls would stretch limited resources, especially those that are reserved only for law enforcement emergencies” according to Verizon.

But other companies allowed the Justice Department to release at least some of the data Soghoian requested.  Cox Communications, for instance, charges the government US$2,500 to record digits dialed to or from a particular phone, and US$2,000 for each additional 60-day-interval.  Wiretaps cost more: US$3,500 for the first 30 days and $2,500 for each additional 30 days. To get a month's worth of your call detail records costs US$40.

So just how many requests for records do telecoms and ISPs receive each year from police?  Yahoo won't say, but Verizon admits it receives “tens of thousands” of requests annually for customer records and information from law enforcement agencies.  According to Soghoian, only Facebook and AOL have publicly disclosed how many requests they receive for police assistance.  Facebook acknowledges 10-20 daily requests.  AOL says it receives about 1,000 requests monthly.

So, how can you avoid this type of surveillance?  For telephones, your best bet is to use prepaid cell phones purchased anonymously, over the counter, with cash. 

For the Internet, a technology called virtual private networking acts as a middleman between your ISP and the Web sites you surf.  A VPN can also encrypt the data stream between its servers and your PC.  With these countermeasures in place, the only thing your ISP can monitor is the fact that you're online and that you're connected to a VPN. 

There are many VPN services available.  I prefer services that don’t have networks installed in the United States to avoid possible compromise under legislation such as the USA PATRIOT Act.  The service that I use is http://www.cryptohippie.com.  Its only U.S. presence is to authenticate connections to Cryptohippie servers in other countries.  None of Cryptohippie’s servers are in the United States.

Copyright © 2009 by Mark Nestmann

Heaven Forbid…a GOOD Lawsuit?

Some lawsuits are frivolous, but most are not.  If industry practices, the government, or some other combination of factors makes it impossible for you to avoid some kind of loss, your only recourse may be to file a lawsuit.

I was reminded of this principal recently when I learned a couple in Illinois recently sued their bank for failing to secure their account from identity thieves.  The bank tried to quash the lawsuit, but an Illinois district court judge recently issued a ruling allowing it to proceed.  And for once, I agree.  The lawsuit is definitely not frivolous.

Here's what happened, according to the allegations in the lawsuit:

In February 2007, an intruder obtained online access to the wife's Citizens Financial banking account using her user name and password.   The intruder authorized an electronic transfer of US$26,500 from the couple's line of credit to the wife's business account.  Next, the intruder initiated a transfer of the funds to an Austrian bank.

When the couple realized what had happened, they contacted Citizens Financial and requested the money be returned.  The bank refused and suggested that they contact the bank in Austria.  But, the Austrian bank also refused to return the money.

Shortly thereafter, Citizens Financial began billing the couple pay off the line of credit.  When they failed to pay, the bank reported them as delinquent to national credit reporting agencies.  The bank also threatened foreclosure proceedings against their home.  These threats stopped once the couple began making monthly payments to the bank for the stolen funds.

Under the circumstances, the couple felt they had no option except to file a lawsuit against the bank.  Among other claims, the lawsuit alleges negligence under Illinois law.  According to the lawsuit, the bank didn't use the best available technology to protect its depositors, leaving the account vulnerable to identity fraud.

This is a situation in which a legitimate account holder really can't control.  It's remarkably easy for an identity thief to plant a "backdoor" program on your computer.   From that point, the program records every keystroke on your PC.  Periodically, it sends a report to the thief.  In the couple's case, the program apparently recorded the log on information to their bank account.  Once the thief had this information, initiating the US$26,500 theft was easy.

The only solution to the problem is for banks that offer online access to make it impractical for identity thieves to impersonate legitimate account holders.  There are numerous technologies available to make this possible.  However, unless banks are held legally accountable for these types of losses, they have little incentive to introduce this technology. 

This is the model the credit card industry uses, and it works.  Under federal law, if someone steals your credit card number, you're only responsible for paying the first $50 of any fraudulent purchases made on it.  Credit card fraud is a problem, but the cost is borne by credit card companies—and even more, by merchants.

This illustrates an important security principle.  The person or entity most able to reduce a security risk should be responsible for dealing with it.  In this case, the couple had no practical way to ensure the security of their account.  Only the bank had the ability to do so, and they apparently failed in this obligation.

This lawsuit has a long way to go before the situation is resolved, and the banking industry is certain to resist taking responsibility for the online services they offer.  But they must do so, if only because they are the only possible solution to this type of identity theft. 

(For background on this incident, click here.)

Copyright © 2009 by Mark Nestmann