Companies To Be Liable For Deals With Online Criminals 171
Dionysius, God of Wine and Leaf, sends us to DarkReading for a backgrounder on new rules from the FTC, taking effect in November, that will require any business that handles private consumer data to check its customers and suppliers against databases of known online criminals. Companies that fail to do so may be liable for large fines or jail time. In practice, most companies will contract with specialist services to perform these checks. Yet another list you don't want to get on. "The [FTC's] Red Flag program... requires enterprises to check their customers and suppliers against databases of known online criminals — much like what OFAC [the Treasury Department's Office of Foreign Asset Control] does with terrorists — and also carries potential fines and penalties for businesses that don't do their due diligence before making a major transaction."
Hm.. (Score:3, Interesting)
No, but you don't even need to get on it yourself (Score:2)
The TSA is currently screwing people over with that flaw. (See Adam Curry of "The Daily Source Code" fame.)
Onerous Burden on Businesses? (Score:5, Insightful)
Re:Onerous Burden on Businesses? (Score:5, Insightful)
Re: (Score:2)
Hold companies liable for dealing in bad deals, absolutely. Please, please apply this to the companies that deal with spammers; if companies know it's illegal to contract with the spam companies (because the spam companies break the law in countless ways, what with the botnets and packet/header fraud any everything else), spam will finally start drying up.
Re: (Score:3, Insightful)
Re:Onerous Burden on Businesses? (Score:4, Insightful)
A solution's effectiveness is a tertiary concern for a government agency when addressing a problem. The agency's primary concern is to increase its own power. The secondary concern is to receive public approbation by doing something very visible. A "no-fly list" like this one is the perfect implemention of an agency's two main goals.
That's only 90% crazy though. Sometimes, the function of law-enforcement is just to remind everyone that law enforcement exists. After all, whether any random soul will cross the line from dove to hawk mostly depends his assessment of law enforcement's effectiveness. Therefore, an appearance of effectiveness is often just as good as actual effectiveness.
But not in this case. The bad guys know exactly how to beat the list (fake or stolen credentials) and they can even test whether they've succeeded. Therefore, this "no-fly list" creates a false sense of security, which means that people will be overall less safe.
Re: (Score:2)
Re: (Score:2)
should have read '... and can you provide a photo of her....?' but I cocked it up. Yes - I confess, I should have used the 'Preview' button....
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Yeah, but an ounce of prevention is worth a pound of metamoderation....
Re: (Score:2)
Re: (Score:2)
Re:Onerous Burden on Businesses? (Score:4, Interesting)
Plus, this thing kinda reminds me of the Payment card industry standard which, among other things, requires business that accept credit and bank cards to adhear to a strict policy of security when dealing with these cards. Every year, even on the smallest level, companies should be filling out a "self test" which requires you answer questions about your card security. Among the questions is a whole bunch of requirements you'd expect of a data center but not, say, a restaurant. Glass walls, biometric access, camera systems, etc. Fines start at $100,000 and you risk losing your ability to take credit cards. The published standard is here. [pcisecuritystandards.org]
I'm sure that 99% of small businesses that accept Visa/MC/AMEX etc have *no idea* about this standard and even if they did, they have no resources to adhear to it. That's why this "Red Flag" deal reminds me of it.
Re: (Score:2)
That's not to say that I wouldn't be doing this as part of my own policy for larger customers for our own protection, bu
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Spam is a good example, if Target, Walmart and other businesses that are handing money over to spammers were required to check who they were doing business with, the rates for spamming their ads would go down significantly.
For quite a while it's been required for pharmacies to only sell pseudoephedrine and similar to people that were identified. And hand over the records, I don't see a huge impact on those stores.
Th
Re: (Score:2)
because, when you strip out all the emotive stuff about spammers - and who doesn't want to see a dead-or-tortured bounty on spammers? - there's an important principle here.
to be a known criminal, you've been caught and convicted. the court has sentenced you to a specific punishment, taking into account the nature and severity of your crime and any previous convictions. now, when you've done your time then yo
I'm doing business with Mastercard (Score:5, Insightful)
Re: (Score:3, Informative)
Re: (Score:2)
Prior to paying a claim they have to check the recipient against a list of people associated with terrorism. The fine for a violation is 7 figures.
Re: (Score:2, Informative)
That transaction log itself contains great data mining material for TLA:
This is simplified, but imagine the query sent to TLA by PoopyCorp was "SELECT * FROM BAD_GUYS WHERE NAME='Joe Bloggs'". Now, TLA knows that Joe Bloggs does business with PoopyCorp - possibly very valuable information if Joe Bloggs is a politician and PoopyCorp manufactures
Re: (Score:3, Insightful)
Re: (Score:2)
Yeah? Well be a gent and send all those people my way, would you? Because at my insurance agency, I love to take insurance premiums from people who I know I will never have to pay benefits for because like basically every life insurance plan in existence mine don't cover suicides.
Re: (Score:2)
Re: (Score:2)
In my experience, the reason doesn't matter. They just don't want to pay.
Re: (Score:2)
Re: (Score:2)
You don't seem to understand that the databases in
Re: (Score:2)
Re: (Score:2, Insightful)
Oh, they don't want to do it ? Why not ? Because they're afraid of false positives ? Proof that the system is worthless.
It's quite simple: if Lex Luthor can't spend his dirty money in the USA, he'll drive up to Canada, get things done, then come back to the states to be a terrorists again. Not only does it NOT solve the crime problem, it actually diverts money away from the local econom
You won't see a problem until... (Score:2)
Lovely isn't it?
Someday people will see the absurdity of forcing others to pay for the stupidity of some group or other.
Re:Yes they are (Score:4, Insightful)
This is where a pardon is supposed to come in. Pardons aren't just for the wealthy and the connected. They're also for the 30-year-olds who did something stupid at 19 while drunk, paid their dues (fines, revocation of privileges such as driver's license, and/or jail time) and haven't had a criminal charge since. A successful pardon application, which may take a year or two to process, should also automatically (I hope!) remove your name from all criminal registries, including sex offender registries (though I imagine that these would be harder to get pardons for).
Ok, maybe I'm dreaming...
Re: (Score:2)
In fact, the cumulative effect of this regulation when added to the numerous other identity checking rules established by the
Re: (Score:2)
The one IBM (you know, multi-billion dollar company with zillions in government contracts) got put on a month or so ago, because of a contract dispute with the EPA?
Yeah, that's not ripe for abuse at all.
Is rootkit Sony on the list? (Score:5, Insightful)
Re: (Score:3, Interesting)
Re: (Score:2)
=Smidge=
Mistaken Idenity (Score:2, Insightful)
Changing Idenity (Score:2, Interesting)
.. but what happens if I Jason Smith am not a criminal and there happens to be a Jason Smith criminal out there that isn't me. Also who in their right mind uses their real name on the internet?
Aaaaaannnnnd, changing identity is easy. It's nothing to create a corporate entity - and that's a real one. Fake ones? Ha! So, while they're checking their all seeing database of criminals, the crooks are changing their identity.
It's even done by legal, although unethical, businesses. Get too many complaints to the Better Business Bureau just change your business' name.
Maybe not such a great idea (Score:5, Insightful)
Worst case scenario: this turns out to be another vague No-Fly list that persecutes the innocent while doing little to no actual good. In any case, it will be more work and more liability for vendors.
Re: (Score:2)
How do I get on the list?
Pointless (Score:2)
Oh wait, many of them already have. Just take a look at the guys on the spamhaus list - they do their work just fine without help from US companies.
Jail? (Score:5, Insightful)
They're going to put whole companies in jail?
But at any rate, after Sony's criminal rootkit vandalism of millions of computers, I'm going to have to see a CEO in shackles before I believe it. And Martha Stewart doesn't count.
For those of you unfamiliar with Sony's evil, deliberate vandalism, here are two links:
serious [wikipedia.org]
content-free [uncyclopedia.org]
Re: (Score:2)
Red Flag? (Score:2)
Re: (Score:3, Interesting)
Not paying enough attention, I missed this link [ftc.gov] from TFA. This notice is all about identity theft, while the summary indicates that companies will be required to check customer lists against known criminals.
If someone steals my identity and uses it to buy something, it will be my name in the customer database, not the criminal's. How would checking the customer list help? As far as I know, I'm not a known criminal or terrorist.
Although, I guess I would (incorre
Re: (Score:2)
Unless your name happens to be Robert Johnson or Dan Brown. The TSA has wisely identified all persons having those names to be complete terrorists.
Re: (Score:2)
Have you considered the thought that this is what the Feds WANT to accomplish with this law?
Follow the logic to its conclusion. Working taxpayers are seen as the enemy of the state.
Wake up. Theres a purpose behind all this crap.
*sniff* What's this here? (Score:2, Insightful)
EU Export (Score:4, Informative)
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
laden, laden....hmmm
oh yes here it tis....
o. samabin laden
666 CaveofBears Drive
Aghila, Afghanistan, 66666
SHIP IT!
Uh I predict, oh swameee, that they only catch STUPID criminals with this one.
Also predict, theres some company here in the States that the Feds are after.
Does that include the government itself? (Score:3, Insightful)
Your papers, please... (Score:4, Insightful)
As an adult, it's starkly clear to me that "permanent records" do exist for all of us, and they control our lives to a large degree. Credit reports, "no-fly" lists, and now this "red flag" list - somewhere out there grim people in small offices quietly compile lists of citizens whom they feel should be "less free".
What kind of oversight exists for this list? What does one have to do (or not do) to appear on it? If you're on it, how can you be removed?
I wish I could say I was surprised by this new step towards an Orwellian dystopia, but the past several years have numbed me to it.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Who does this apply to? (Score:5, Insightful)
http://www.ftc.gov/opa/2007/10/redflag.shtm [ftc.gov]
Only talks about financial institutions and creditors. It doesn't seem to indicate that Mary's Online Potpourri Barn has to do a background check on everybody that orders a lemon scented candle.
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
Why aren't these "known criminals" in jail? (Score:5, Insightful)
This kind of thing seems like it could lead to rampant abuse, or at least error if someone winds up on one of these lists that shouldn't be on it.
Re: (Score:2)
Re: (Score:2)
Re:Why aren't these "known criminals" in jail? (Score:4, Insightful)
Re: (Score:2)
probably because they served a sentence and now they are out, or does slashdot now advocate life sentences for any crime?
Was not doing any sort of commerce with any business in their sentence, or part of their release agreement? If not, I'm not sure how this is legal punishment.
Re: (Score:2)
If it's like OFAC's list... (Score:3, Insightful)
Which isn't to say this can't lead to rampant abuse -- it certainly can -- but the idea of the list is more along the lines of "this is a guy who is suspected of being involved in illegal activity right this ver
Re: (Score:2)
"this is a guy who is suspected of being involved in illegal activity right this very moment -- do not do business with him"
(emphasis mine)
Which is kind of my point. We have this idea that people are innocent until proven guilty in this country. While it may be difficult to apprehend these people, that's no excuse for doling out punishment before a trial.
They got the color wrong. (Score:3, Insightful)
Yep. And they got the color wrong, too.
This is not a "red flag". It's a government-maintained "blacklist":
- It creates a broad penalty for anyone they put on the list, making it virtually impossible for them to get or hold a well-paying job, buy a house, buy a car, or do most of the other big-ticket business of life.
- Putting people on it is done
Comment removed (Score:3, Interesting)
I don't get it. (Score:4, Insightful)
2. Rights after you serve your time. So if the person was an online criminal and served his/her time. Is is really reasonable to block them for using the inernet ever again, espectially in a world with increasing demmand to use the internet for daily communication and comerse.
3. People on probation is such a small portion of a list that the forced blacklist is an undue burden.
4. These people are criminals... They have been proven to be untrustworthy, what makes it so they don't lie on an online form or use someone elses idenity.
5. Small ISP and companies don't have resources to do this. a 10-15k project for a big company is a drop in the bucket for for a small ISP it is a huge undertaking, which could kill it.
6. Why punish honest/trusting people. America's growth was based on contract by handshake. There are a lot of companies that still want to keep that type additude. But laws like this make it so you need a lawer for everthing... (on a side note why the hell do we keep electing lawers into government)
7. In a slumbing echonomy is it prudent to make it difficult for people to do business.
8. If it forces criminals to be smarter and hide their tracks more, doesn't it make it more difficult for authorities to track such people.
9. If the criminals cannot work online they will still be criminals and be on the street with guns and drugs.
10. What happends if your name matches a criminal.
Re: (Score:2)
Re: (Score:2)
2. No, it is not.
4. no it doesn't, they have been proven of a crime.
6. No, lawyers advise getting a contract, but it's the company the decide whether or not to follow that advice.(on a side note, why do you think all lawyers are bad?)
7. No
8. Yes.
9. Not true. You seem to be suppo
Re: (Score:3, Insightful)
There are some crimes where people can stop and others that cannot.
Sex Crimes are often due to mental problems which need to be addressed and monitored for a long time. (y
Plus there's a car analogy.... (Score:2)
Now the idea that terrorist would buy a car to blow up rather than stealing one so it can't be tracked back to them seems rather ridiculous. But we here at slashdot love a car analogy so let's stick with that.
Businesses, unlike airport screeners apparently, KNOW where most modern terror
Does not fly - will increase ID theft. (Score:5, Insightful)
Unless there's a swift and clear grievance system, this will cause so many false positives that positives will be worked around. And who says that any bad people wouldn't steal or set up identities under which to do business?
The end result in three years? There will be lots of news about false positives, and the bad guys will just use more ID theft. Which will put those with stolen IDs into still more of a mess.
I don't think that this passed the "run it by a six-year-old first" test.
At last, a list I want to be on (Score:4, Interesting)
Roadmap (Score:2)
If any value came out of Germany in the '40s is its meticulous use of lists and record keeping about its citizens. That way when history repeats itself there's a clear and concise roadmap of what needs to be done. No need to reinvent the wheel.
-[d]- br.
Re: (Score:2)
I believe that they can be done right to limit or prevent abuse, it just hasn't been.
We're developing our program now (Score:3, Interesting)
Scope isn't as broad as it looks (Score:3, Informative)
Re: (Score:2)
Wrong (Score:2)
Universal Criminals (Score:2)
Why are there known criminals free? (Score:3, Insightful)
Does "Business" include free services like GMAIL? (Score:2)
I mean, these services are undoubtedly businesses that handle private consumer data, aren't they?
If that's really the case I see no way this law can ever be fully enforc
Three Easy Steps (Score:2)
1. Provide an unnecessary, unwanted service to perform background checks on the entire population of the US.
2. Lobby to have your service legislated into a legal requirement.
3. Profit.
There is no step ?.
Mental Note: (Score:2)
The Big Brother network tightens (Score:2)
Re: (Score:2)
eBay screwed! (Score:3, Interesting)
Hmmmmm..... (Score:2)
Smells like the leavings of a lobbyist.
Interestingly enough, its amazing how much the government wants to regulate our lives, but dosn't wan't to pay for it, and make us foot the bill in order to comply with their whims..... Whims that are conjured up by some of the most power hungry, ass-backward, demented, half-witted individuals on the planet. This is another case of placing blame where it doesn't belong. You have the right to do business with anybody, and you cann
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Well, there's always Canada.
You mean the country where they put you in jail, torture you and deny you access to a lawyer, all for the heinous crime of having no family that will inquire about your whereabouts?
And no, friends and lovers don't count: Canada's stringent data protection laws prevent authorities to admitting to any wrongdoings to an unrelated person.
No thanks, I prefer Red China any days. At least it doesn't try to pretend to be a democracy. And it treats its tourists better.
Re: (Score:2)
Or a Sergent Transaction, or Lance Corporal Transaction.