ID "theft" -- so what?

[Greg Troxel]

"Jörn" Schmidt <joern2473 at yahoo.com> writes:

> The answer to this dilemma? I'm afraid this time it really is
> legislation. Frankly, I'm not even sure if that would work but, at this
> time, it's our best shot. Congress won't do anything about this unless
> a few representatives have their identities stolen and experience
> first-hand what a PITA it is to have to deal with the fallout.

I agree that legislative changes are necessary, but I think they are
fairly small.   Consider the following:

  Alice is a model citizen with a good credit history

  Bob "steals Alice's identity" by finding out semi-public static
  information

  Bob gets a loan from Charlie under Alice's identity, where Charlie
  transfers something of value to Bob and records a debt from Alice.

Here, Bob has committed a crime, and this being a crime isn't
controversial.  Until this point, Alice hasn't really been harmed
unless she tries to interact with Charlie herself.

  Charlie tries to collect from Alice, or
  Charlie reports that Alice owes a debt to a third party, or
  Charlie reports that Alice is in default to a third party.

In my view, _Charlie_ has comitted a tort against Alice because he has
been negligent (or at least incorrect) in issuing credit.  If Charlie
has decided to issue credit with minimal checks because the business
benefit of that is more than the fraud losses (similar to our credit
card system today), then it's only fair for Charlie to cover the full
burden to Alice, including all the effort of cleanup.  If Charlie
isn't being careful to the some degree, so that such incidents are
rare, triple damages are probably in order.  Even if Charlie is very
careful, actual damages should be paid.

A reasonable penalty for Charlie might be on the order of $1000
statutory damages plus $100/hr for any time over two hours Alice has
to spend dealing with the issue, plus any legal fees incurred if any
problems remain 30 days after the first report.  This puts the onus on
Charlie and the reporting systems will quickly adjust to enable
Charlie to withdraw the incorrect report completely and quickly.

Of course, Charlie should be able to recover all of his own costs, as
well as payments to Alice, in triplicate from Bob.
  
Many credit issuers willfully conduct their business with the
knowledge that this will occur.  So, as I see it the basic problem is
not one of security, but the fact that credit issuers etc. impose
costs on innocent third parties and get away with it.

-- 
        Greg Troxel <gdt at ir.bbn.com>

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com