Whodunit?

By Guy Bunker | October 13, 2008 | Leave a Comment

With yet more data loss incidents occurring over the past few days it now seems like the time to ask ‘Whodunit?’ What do I mean, well, let’s say your credit card is cloned and used illegally, or more scarily someone has taken your ID and used it to open a new bank account or credit card and then run up a large debt. (The first you would know about it is when your credit is checked and turns out to be bad…) So, you wonder… who is responsible for that data leak?

The answer is… well, you just don’t know. Unless there is something very specific about the data that was lost and subsequently used. Even with breach notification in place, that will only let you know that the loss has occurred and you could have half a dozen or more of these every year! Of course you might have automatic credit checking in place as part of the data breach resolution (heck, there might even be a service to consolidate all the checks going on – else the same checks will be being run by multiple vendors, or even the same one over and over on your behalf), but it still won’t tell you whodunit. Furthermore, the notification only happens when the leak or breach is noticed – what about those which go unnoticed for years?

I believe breach notification is useful, after all, not being told would be worse than being told several times – but perhaps its time to look at what would be useful to the individual by taking a holistic view of their needs, rather than on a company-by-company basis.

Bookmark It