Companies To Be Liable For Deals With Online Criminals

Dionysius, God of Wine and Leaf, sends us to DarkReading for a backgrounder on new rules from the FTC, taking effect in November, that will require any business that handles private consumer data to check its customers and suppliers against databases of known online criminals. Companies that fail to do so may be liable for large fines or jail time. In practice, most companies will contract with specialist services to perform these checks. Yet another list you don't want to get on. "The [FTC's] Red Flag program... requires enterprises to check their customers and suppliers against databases of known online criminals — much like what OFAC [the Treasury Department's Office of Foreign Asset Control] does with terrorists — and also carries potential fines and penalties for businesses that don't do their due diligence before making a major transaction."

Hm..

[kvezach (1199717)]

Does the crime of Slashdot first-posting get you on that list?

Onerous Burden on Businesses?

[Apple Acolyte (517892)]

This sounds like quite an onerous burden on businesses, and I imagine it will be struck down by the courts soon enough unless it's much narrower and specific a regulation than the story makes it appear. Private parties should not be expected to do the job of law enforcement.

Re:Onerous Burden on Businesses?

[Serenissima (1210562)]

Well fortunately, online criminals have no way of pretending to be someone else so it should be a relatively painless procedure for businesses to check their identities.

Re:

[HalAtWork (926717)]

Why do they have to check them if no crime is being committed? This is just like gathering a bunch of information on people that could be used as evidence in case a crime will be committed in the future. Do we have to start reading people their miranda rights every time a transaction occurs on the internet?

Re:Onerous Burden on Businesses?

[inviolet (797804)]

Well fortunately, online criminals have no way of pretending to be someone else so it should be a relatively painless procedure for businesses to check their identities.

A solution's effectiveness is a tertiary concern for a government agency when addressing a problem. The agency's primary concern is to increase its own power. The secondary concern is to receive public approbation by doing something very visible. A "no-fly list" like this one is the perfect implemention of an agency's two main goals.

That's only 90% crazy though. Sometimes, the function of law-enforcement is just to remind everyone that law enforcement exists. After all, whether any random soul will cross the line from dove to hawk mostly depends his assessment of law enforcement's effectiveness. Therefore, an appearance of effectiveness is often just as good as actual effectiveness.

But not in this case. The bad guys know exactly how to beat the list (fake or stolen credentials) and they can even test whether they've succeeded. Therefore, this "no-fly list" creates a false sense of security, which means that people will be overall less safe.

Re:Onerous Burden on Businesses?

[tha_mink (518151)]

This sounds like quite an onerous burden on businesses, and I imagine it will be struck down by the courts soon enough unless it's much narrower and specific a regulation than the story makes it appear. Private parties should not be expected to do the job of law enforcement.

It depends on how easy it is to do. I think for the most part, businesses that will be affected by this will probably want to insure that they are not helping criminals. I know I can speak for our business.

Plus, this thing kinda reminds me of the Payment card industry standard which, among other things, requires business that accept credit and bank cards to adhear to a strict policy of security when dealing with these cards. Every year, even on the smallest level, companies should be filling out a "self test" which requires you answer questions about your card security. Among the questions is a whole bunch of requirements you'd expect of a data center but not, say, a restaurant. Glass walls, biometric access, camera systems, etc. Fines start at $100,000 and you risk losing your ability to take credit cards. The published standard is here. [pcisecuritystandards.org]

I'm sure that 99% of small businesses that accept Visa/MC/AMEX etc have *no idea* about this standard and even if they did, they have no resources to adhear to it. That's why this "Red Flag" deal reminds me of it.

I'm doing business with Mastercard

[MacDork (560499)]

Mastercard is the one doing actual business with terrorists... why aren't THEY responsible for this "small" fee?

Re:

[bcwright (871193)]

I think if you read the actual proposed regulation that's published at http://www.ftc.gov/ [ftc.gov] you'll see that that's exactly what happens. This regulation does not appear to apply to businesses who merely accept credit cards, but rather to those who issue credit cards or other forms of credit.

Re:

[Hijacked Public (999535)]

Insurance companies (in the US at least) having been doing this type of thing since shortly after 9/11.

Prior to paying a claim they have to check the recipient against a list of people associated with terrorism. The fine for a violation is 7 figures.

Re:

[CSMatt (1175471)]

Not surprising. If I ran an insurance agency I wouldn't want to give life insurance to someone who's just going to strap a bomb to his chest.

Re:Yes they are

[Tanktalus (794810)]

We are also running headlong into an age of "lifelong punishment," where 50 year old men are denied needed services because of a crime they commited when they were 19 and drunk, and which they would not commit now that they have grown up. This sort of thing is happening *today*, is utterly unjust, and will only get worst if we continue with this sort of personal data tracking.

This is where a pardon is supposed to come in. Pardons aren't just for the wealthy and the connected. They're also for the 30-year-olds who did something stupid at 19 while drunk, paid their dues (fines, revocation of privileges such as driver's license, and/or jail time) and haven't had a criminal charge since. A successful pardon application, which may take a year or two to process, should also automatically (I hope!) remove your name from all criminal registries, including sex offender registries (though I imagine that these would be harder to get pardons for).

Ok, maybe I'm dreaming...

Is rootkit Sony on the list?

[MacDork (560499)]

No? How about forged packet Comcast? No again? What about exposing most of the internet to id theft and cross site scripting Barefruit? Not a very thorough list, is it?

Re:

[Kartoffel (30238)]

Exactly. The FTC needs to clearly define the penalties for doing business with "criminals". If I do business with Comcast (presumably, a known criminal entity) just what, exactly, am I liable for? Can I still buy a Sony PS3, or will there be additional fines for having done business with an criminal organization?

Re:

[Smidge204 (605297)]

What about companies that pay for ads distributed by spam botnets? If you can't attack the spammers directly, attack their source of revenue.

=Smidge=

Mistaken Idenity

[DiceRoller (1178315)]

.. but what happens if I Jason Smith am not a criminal and there happens to be a Jason Smith criminal out there that isn't me. Also who in their right mind uses their real name on the internet? Just gives the goverment more knowledge where you are on the internet. ( I'm still stuck on Baker St on the internet).

Changing Idenity

[iamsamed (1276082)]

.. but what happens if I Jason Smith am not a criminal and there happens to be a Jason Smith criminal out there that isn't me. Also who in their right mind uses their real name on the internet?

Aaaaaannnnnd, changing identity is easy. It's nothing to create a corporate entity - and that's a real one. Fake ones? Ha! So, while they're checking their all seeing database of criminals, the crooks are changing their identity.

It's even done by legal, although unethical, businesses. Get too many complaints to the Better Business Bureau just change your business' name.

Maybe not such a great idea

[Kartoffel (30238)]

At first this sounds like an incentive for businesses not to conduct transactions with criminals. Take identity theft, for example. I don't want vendors consorting with thieves, should somebody steal my credit card info. But how should vendors know it's a thief and not me? It's not reasonable.

Worst case scenario: this turns out to be another vague No-Fly list that persecutes the innocent while doing little to no actual good. In any case, it will be more work and more liability for vendors.

Pointless

[damn_registrars (1103043)]

Won't the criminals just switch to doing business with foreign companies instead, to avoid the reach of US laws?

Oh wait, many of them already have. Just take a look at the guys on the spamhaus list - they do their work just fine without help from US companies.

Jail?

[sm62704 (957197)]

Companies that fail to do so may be liable for large fines or jail time

They're going to put whole companies in jail?

But at any rate, after Sony's criminal rootkit vandalism of millions of computers, I'm going to have to see a CEO in shackles before I believe it. And Martha Stewart doesn't count.

For those of you unfamiliar with Sony's evil, deliberate vandalism, here are two links:
serious [wikipedia.org]
content-free [uncyclopedia.org]

Re:

[arieswind (789699)]

hate to rain on your sony crusade, but the person who would end up in jail is the person who was responsible for running the check. that may be a salesman, or a manager, or whoever. when it comes to this kind of fine/jail time, there is a lot of finger pointing and assigning blame, and companies will go to great lengths to make sure the blame is placed right. granted, this is more likely to be applied to larger purchases than your 20$ book purchase off amazon.

Red Flag?

[EricWright (16803)]

OK, I'm just a bit confused. A quick search for FTC Red Flag returned this site [ftc.gov], which exclusively talks about misleading weight loss claims. What does this have to do with vetting customer lists against known criminal lists?

Re:

[EricWright (16803)]

Bad form... replying to self... get over it.

Not paying enough attention, I missed this link [ftc.gov] from TFA. This notice is all about identity theft, while the summary indicates that companies will be required to check customer lists against known criminals.

If someone steals my identity and uses it to buy something, it will be my name in the customer database, not the criminal's. How would checking the customer list help? As far as I know, I'm not a known criminal or terrorist.

Although, I guess I would (incorre

Re:

[Kartoffel (30238)]

If someone steals my identity and uses it to buy something, it will be my name in the customer database, not the criminal's. How would checking the customer list help? As far as I know, I'm not a known criminal or terrorist.

Unless your name happens to be Robert Johnson or Dan Brown. The TSA has wisely identified all persons having those names to be complete terrorists. ;)

*sniff* What's this here?

[BenParr (1276718)]

Is it just me, or does this stink of lobbyists?

EU Export

[Tiberius_Fel (770739)]

To my knowledge, European Union regulations already require you to check the people to whom you are shipping goods, to see if they are on a list of known terrorists and their associates.

Re:

[dargaud (518470)]

check the people to whom you are shipping goods, to see if they are on a list of known terrorists

If they know his name and address, why don't they go and arrest him ? And if he's too small-fishy to warrant an arrest, why can't the guy purchase his porn online like anybody else...?

Does that include the government itself?

[Reality Master 201 (578873)]

Or are we only counting criminals that aren't considered above the law?

Your papers, please...

[GogglesPisano (199483)]

I remember a common threat in grade school was "this will be on your permanent record". We used to joke about it - it seemed ridiculous.

As an adult, it's starkly clear to me that "permanent records" do exist for all of us, and they control our lives to a large degree. Credit reports, "no-fly" lists, and now this "red flag" list - somewhere out there grim people in small offices quietly compile lists of citizens whom they feel should be "less free".

What kind of oversight exists for this list? What does one have to do (or not do) to appear on it? If you're on it, how can you be removed?

I wish I could say I was surprised by this new step towards an Orwellian dystopia, but the past several years have numbed me to it.

Re:

[alen (225700)]

probably anyone who has a conviction in a court of law for a crime committed online will be on this list. kind of like a registered sex offender

Who does this apply to?

[BoberFett (127537)]

The FTC page that the original article links to

http://www.ftc.gov/opa/2007/10/redflag.shtm [ftc.gov]

Only talks about financial institutions and creditors. It doesn't seem to indicate that Mary's Online Potpourri Barn has to do a background check on everybody that orders a lemon scented candle.

Re:

[zappepcs (820751)]

holy flying c-notes batman.... The financial institutions and creditors ARE the criminals. How the hell is that supposed to work?

Re:

[iamdrscience (541136)]

You're exactly right. This article is obviously little more than a regurgitated press release for MicroBilt. The reality is that this law is intended for big companies and companies doing big money deals and they're the only ones that are going to have to worry about it. Microbilt is just trying to get some more customers by making it sound like a broader law than it is and given that it's been written up as an article and been posted to Slashdot, I'd say they've done a pretty good job.

Why aren't these "known criminals" in jail?

[Vellmont (569020)]

This seems like some kind of backdoor conviction without a trial. If the government "knows" these people are criminals, why haven't they been arrested, convicted, and sentenced? If the government is forbidding people to do business with these people, shouldn't they have a trial or some kind of public hearing where the facts are presented?

This kind of thing seems like it could lead to rampant abuse, or at least error if someone winds up on one of these lists that shouldn't be on it.

Re:

[Kartoffel (30238)]

Yeah, really. Are they going to fine everybody who buys Martha Stewart stuff online?

Re:

[alen (225700)]

probably because they served a sentence and now they are out, or does slashdot now advocate life sentences for any crime?

Re:Why aren't these "known criminals" in jail?

[mini me (132455)]

If they have served their time, why are we preventing them from integrating back into society?

If it's like OFAC's list...

[brennanw (5761)]

... then it's a list of names of people and the known aliases of people who commit crimes but who haven't been apprehended yet. Usually crimes like extortion, terrorism, racketeering, international stuff that makes it difficult to just walk up to someone, put cuffs on them, and haul them off to jail.

Which isn't to say this can't lead to rampant abuse -- it certainly can -- but the idea of the list is more along the lines of "this is a guy who is suspected of being involved in illegal activity right this ver

They got the color wrong.

[Ungrounded Lightning (62228)]

This kind of thing seems like it could lead to rampant abuse, or at least error if someone winds up on one of these lists that shouldn't be on it.

Yep. And they got the color wrong, too.

This is not a "red flag". It's a government-maintained "blacklist":
- It creates a broad penalty for anyone they put on the list, making it virtually impossible for them to get or hold a well-paying job, buy a house, buy a car, or do most of the other big-ticket business of life.
- Putting people on it is done

This will be the year of the Linux desktop

[houghi (78078)]

... because nobody will be able to do business with Microsoft. They are convicted in Europe.

I don't get it.

[jellomizer (103300)]

1. Inocent until proven guilty. So why should there be a black list of people who havn't been threw justice system.

2. Rights after you serve your time. So if the person was an online criminal and served his/her time. Is is really reasonable to block them for using the inernet ever again, espectially in a world with increasing demmand to use the internet for daily communication and comerse.

3. People on probation is such a small portion of a list that the forced blacklist is an undue burden.

4. These people are criminals... They have been proven to be untrustworthy, what makes it so they don't lie on an online form or use someone elses idenity.

5. Small ISP and companies don't have resources to do this. a 10-15k project for a big company is a drop in the bucket for for a small ISP it is a huge undertaking, which could kill it.

6. Why punish honest/trusting people. America's growth was based on contract by handshake. There are a lot of companies that still want to keep that type additude. But laws like this make it so you need a lawer for everthing... (on a side note why the hell do we keep electing lawers into government)

7. In a slumbing echonomy is it prudent to make it difficult for people to do business.

8. If it forces criminals to be smarter and hide their tracks more, doesn't it make it more difficult for authorities to track such people.

9. If the criminals cannot work online they will still be criminals and be on the street with guns and drugs.

10. What happends if your name matches a criminal.

Re:

[jellomizer (103300)]

Unfortunatly that is where there is a problem with our justice system. Do do a crime you get punished for it. Then you are continiously punished because you are statiticly shown to do it again. Thus being in a situation where you have reduced rights and limited ways to improve youself thus you are stuck to commit crimes again to survive.

There are some crimes where people can stop and others that cannot.
Sex Crimes are often due to mental problems which need to be addressed and monitored for a long time. (y

Plus there's a car analogy....

[penguin_dance (536599)]

From the article: OK, pop quiz. A local car dealership sells a car to a new customer. A week later, that same automobile is used in a terrorist car bombing. The business can't be held liable for what the customer did, right?

Now the idea that terrorist would buy a car to blow up rather than stealing one so it can't be tracked back to them seems rather ridiculous. But we here at slashdot love a car analogy so let's stick with that.

Businesses, unlike airport screeners apparently, KNOW where most modern terror

Does not fly - will increase ID theft.

[LauraLolly (229637)]

The "Do Not Fly" list already has shown how well false positives work - it's caused trouble for people who are wrongly put onto the list. Those with particularly common names will have particular trouble.

Unless there's a swift and clear grievance system, this will cause so many false positives that positives will be worked around. And who says that any bad people wouldn't steal or set up identities under which to do business?

The end result in three years? There will be lots of news about false positives, and the bad guys will just use more ID theft. Which will put those with stolen IDs into still more of a mess.

I don't think that this passed the "run it by a six-year-old first" test.

At last, a list I want to be on

[clovis (4684)]

It appears to me that if I get on that list it will greatly reduce my exposure to Identity Theft.

We're developing our program now

[Pagey123 (1278182)]

I work for a small community bank, and we are in the process of developing our program now. The regulations implement sections 114 and and 315 of the FACT Act. Section 114 requires all covered institutions to create and implement a written Identity Theft Prevention Program consisting of four elements: 1. Identification of Red Flags 2. Detection of Red Flags 3. Responding to Red Flags 4. Updating the Program To be covered, an institution must offer what is called a "covered account." A covered account is (1) an account primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, or (2) any other account for which there is a reasonably foreseeable risk to customers or the safety and soundness of the financial institution or creditor from identity theft. The regulatory bodies go on to offer guidance on 5 categories of potential Red Flags, including: 1. Alerts, notifications, or other warnings received from consumer reporting agencies or service providers, such as fraud detection services; 2. The presentation of suspicious documents; 3. The presentation of suspicious personal identifying information, such as a suspicious address change; 4. The unusual use of, or other suspicious activity related to, a covered account 5. Notice from customers, victims of identity theft, law enforcement authorities, or other persons regarding possible identity theft in connection with covered accounts held by the financial institution or creditor. Section 114 also requires the issuer of a debit or credit card to verify the vailidity of an address change followed by the request for a new, additional, or replacement card if requested within 30 days of the address change. In other words, if you receive a request for a new card within 30 days of an address change, you are required to validate the address change with the customer to be sure it is indeed a valid request before mailing the new card. Section 315 requires the users of consumer reports (i.e., credit reports) to verify the identity of the consumer if the report notes a substantial difference in the address provided by the institution versus the address last on file with the Credit Reporting Agency. This applies only if a continuing relationship is established with the consumer. One of the ways to comply with Element 2, detecting Red Flags, is to use various software programs (such as those for BSA/AML) or databases to run checks against, but the regulations clearly state that the program must be appropriate for the size of the institution and the scope of its operations. I highly doubt they'll expect mom & pop types institutions to deploy extraordinary measures to verify that Jim Bob is not a terrorist. Now, if you're Bank of American or Fifth Third, for example, you'll be expected to do a little more. Also note that bank's service providers are required to have a Red Flags program in place. Meaning if I am generating mortgage or auto loans for a financial institution, I'm required to detect and respond to Red Flags, and the bank is required to assess my program. Hope this helps!

Scope isn't as broad as it looks

[44BSD (701309)]

From the federal register item linked to in TFA:

The final rules require each financial institution and creditor that holds any consumer account, or other account for which there is a reasonably foreseeable risk of identity theft

to do these things. If you sell something to someone for cash, you are not a creditor. If you were a financial institution, and thus covered by GLBA, you'd know it already. Unless you extend credit, you're not a creditor. Not much to see here, and the fact that this article had its origin in somebody selling a service to help you comply with this may be meaningful.

Why are there known criminals free?

[tygt (792974)]

Can someone explain how we have a list of known criminals and their location (name = location, on the internet, and if you can access them on-line you can figure out where they are) and they're still free?

eBay screwed!

[Dahamma (304068)]

Wow, this would exclude half of eBay's customer base...

Re:

[tha_mink (518151)]

I am really starting to DESPISE those who claim to represent our country...It's gotten to where I cannot even read the news anymore without getting sick to my stomach.

Well, there's always Canada. Of course, you can vote, organize a protest, write your congressman...but then, ah it's just easier to bitch about it and go back to sleep.

Re:

[ArsenneLupin (766289)]

Well, there's always Canada.

You mean the country where they put you in jail, torture you and deny you access to a lawyer, all for the heinous crime of having no family that will inquire about your whereabouts?

And no, friends and lovers don't count: Canada's stringent data protection laws prevent authorities to admitting to any wrongdoings to an unrelated person.

No thanks, I prefer Red China any days. At least it doesn't try to pretend to be a democracy. And it treats its tourists better.