Showing posts with label personal information. Show all posts
Showing posts with label personal information. Show all posts

Wednesday, September 16, 2015

The Consequences of Revealing Innocuous Data

Once you've lost your privacy, you realize you've lost an extremely valuable thing. - Billy Graham

Privacy is not something that I'm merely entitled to, it's an absolute prerequisite. - Marlon Brando

The #1206 “fiction” series continues …


The short, well-dressed but nondescript man sat in the car dealership with other customers in the customer service waiting area as they waited for their vehicles.  While most people put waiting at the dealership only a few pegs lower on the “fun scale” behind seeing their dentist or renewing their licence in the DMV line, he actually enjoyed spending time here.

After all, he wasn’t here waiting for his vehicle.

He was here to steal someone else’s.

Customers came and went over the next hour as he waited for a specific event to take place that would make his day worthwhile.  Finally, his wait was rewarded when the customer service supervisor walked into the waiting area and on a large board on one wall, began to write customer names and vehicle identifying information.  It was a promotion for a vehicle buy-back program that the dealership was running and they had written on the board, the names of the customers who would be in the dealership that week.

He pulled out his phone and began texting the information on the board to a colleague of his and as he did so, he smiled.  He and his team used to roam the streets of Calgary looking for specific models that were either easy to steal, easy to sell or both.  He had invested a lot of money in the security system disabler for those specific vehicles so he was locked into specific makes and models unless he chose to diversify his operation.

Now as he sat amongst the bored, tired and stressed customers, an employee of the dealership posted the information he needed which took away the need to waste hours roaming the streets.

“Efficiency is the name of the game in any business”, he thought with a smile.

When he first discovered this some time ago, he tried to take a photo of the board but someone stopped him and said it was a violation of privacy to do so.  He could have protested that the posting of information was more of a violation than photographing it but he needed the information and so he had apologized with a smile and sat down.

Now he stopped in every few days to obtain a new list of names, texted the information to a colleague and once confirmation came back regarding the home addresses of the individuals on the board, he would get up and leave. 

He didn’t take everyone’s name down but rather, only the ones whose vehicle descriptions were of appeal to him and over the next 24 hours, those vehicles would disappear from the driveways of unsuspecting customers and within hours after that, be disposed of.

As he noted the names from today’s “harvest”, he paused and frowned when he got to the last name on the list.

The name was very familiar to him.

After pausing for a moment more, he sent the name to his colleague as with the other ones but this one didn’t have any vehicle that he was interested in.


About 8 hours later, he sat parked in his car on a quiet street in Calgary ….. waiting in the dark.

As the vehicle he had seen on the list earlier in the day pulled into the driveway, for a moment he was distracted as memories tumbled through his mind.

Memories of love …. of pain …. and of revenge.

The restraining order that had been issued against him had insulted and embarrassed him in front of his friends and had been almost too much to bear.

When she had gone into hiding, it angered him because he wasn’t able to talk to her about her obvious misunderstanding and he swore that someday, she would pay for what she had done to him.

And now, in a moment of serendipity, he saw her climb out of her car and walk towards her door.

He turned off his interior vehicle lights so they wouldn’t illuminate when he opened the door, opened the door quietly and began to walk towards her quickly.

To be continued.


© 2015 – Harry Tucker – All Rights Reserved

Background

The story was inspired by an event that occurred this morning.  In the process of getting my vehicle serviced for a recall at a car dealership in Calgary, I realized that my name, my vehicle information and similar information for other customers was posted prominently on a board in the customer service area.

Given that the information was being used in a public area for a promotion and was being displayed without my consent, I requested that my name be removed.  I also pointed out that the information could be used to violate someone’s privacy and to prove the point, within 5 minutes, I had obtained the home addresses of 8 of the 10 customers displayed.

When I attempted to obtain a photo of the board, I was informed that photos couldn’t be taken because of privacy reasons.  Unfortunately, the privacy of these customers (and who knows how many before them) may have already been breached merely by posting the info on the board.

The tale of the auto thief is fiction and serves as an example of what a miscreant can do with such information.

The security system disabler referenced in this post is real and is easily obtained by those who make crime their bread and butter.

By the time this post was written, the board at the dealership had been erased but I still managed to obtain a photo anyway.

Was it erased to appease a customer and then redone when the customer left or will it remain empty?

By the way, it was interesting to note that the service people’s names on the bottom of the list were identified by first name only.  We mustn’t breach their privacy after all!

Maybe I should stop back tomorrow to check  ….. before someone else sees the board first.  Criminals are, after all, opportunists.  We need to think before we do stupid things so that we stop creating opportunities for them. [Author note: I checked the next day and the names are no longer on the board.  This dealership has always been amazing to me and I will continue to give them my business.  Sometimes what sets someone apart from others when it comes to service is how they respond when a customer has an issue and this dealership responded quickly and appropriately. However, may this post serve as a warning to what happens when we don’t think before we act when it comes to other people’s privacy.]

What do you think?

PS As a long time strategy advisor, I am paid to “see into the future”, anticipate actions and measurable outcomes for my client as well as for competitors and to create proactive strategic plans that maximize results while minimizing / mitigating risk.  If more people thought through their actions in the manner in which people in my industry do, with full knowledge of what could be, we would be able to avoid situations like this.  No matter how strange a scenario, failure to anticipate it almost always enables it.

Truth is stranger, and often more frightening, than fiction.

An Amusing Anecdote – Related But Not

I remember some years ago when a car dealership in my hometown was offering high-end stereos with the purchase of a new vehicle.  It turned out that the dealership had purchased a small number of these stereos and so when they sold new cars with the stereo installed in it, they arranged for someone to go to the home address of the new car buyers in order to steal the stereo from the new vehicle.  The stolen stereos were then “re-sold” in new vehicles, thus allowing the promotion to continue.

I don’t remember who eventually figured this out, but the notion of a car dealership involved in theft (instead of enabling it) came to mind as I wrote this. Smile

Series Origin

This series, a departure from my usual musings, is inspired as a result of conversations with former senior advisors to multiple Presidents of the United States, senior officers in the US Military and other interesting folks as well as my own professional background as a Wall St. / Fortune 25 strategy and large-scale technology architect.

While this musing is just “fiction” (note the quotes) and a departure from my musings on technology, strategy, politics and society, as a strategy guy, I do everything for a reason and with a measurable outcome in mind. :-)

This “fictional” musing is a continuation of the #1206 series noted here.

Wednesday, February 15, 2012

Privacy and the Real Weakest Link

An interaction I had with someone in a coffee shop today reminded me that much of our anxiety about privacy is being focused in the wrong direction.

This gentleman was speaking quite loudly into his cell phone and given that he had his phone volume turned very high, I was able to hear both sides of the conversation quite plainly.

When he was done, he noticed I was sitting in close proximity and came over with paper in hand.  As I looked up, he asked me if I would be kind enough to review and execute the document he held out to me.

I looked at it and realized he was asking me to sign a nondisclosure agreement (NDA) on behalf of a company clearly identified on the documents.  The purpose of the document, for those unfamiliar with NDAs) is to protect him and his client from any inappropriate use of the information I had gleaned from his conversation.

When I indicated that I had no interest in signing the document, he grew a little agitated and insisted that I sign it or face some kind of unidentified penalty.  I got equally insistent (and slightly agitated) that I had no interest in signing it and was not legally bound to do so merely due to his inappropriate activity.

He got very upset but left without further incident.

After he left, I got to thinking about privacy in general.  As someone who has consulted to Wall St. organizations, Fortune 25 companies and government agencies for years, I know for a fact that privacy and security of information is merely a suggestion, an empty promise made to the public so that they will continue to consume the services offered by these organizations.

Major compromises of this information by people who have the capability to steal our private information at will are not an “if” but a “when”, with most of them waiting for the appropriate time that provides them with maximum value for the data stolen.

Meanwhile we live with the myth that everything has been done to safeguard our information (in much the same way that we promote the myth of airline security so that people will continue to fly).

Despite these myths, we pour billions of dollars into information and personal security, providing little real security with the exception of financial security for the firms providing ineffective solutions.

Closer to Home

Thinking back to my interaction with this guy this morning, I have enough information to sink this company or to create an overnight competitor.  Clearly his activity is in violation of the very NDA agreement he and his client are pushing on others.

But he is not alone in inappropriate behaviour.

I have overheard other interesting conversations in public places over the years, including accountants explaining to clients how to illegally circumvent taxation rules, lawyers explaining to DUI hit-and-run clients how to successfully get the charges dropped through various loopholes, company executives discussing private information prior to mergers, acquisitions and takeovers and a potpourri of other tidbits that I really shouldn’t be privy to.

Such incidents are not limited to conversations overheard in public areas.  On a red-eye from Calgary, Alberta to St. John’s, Newfoundland a couple of years ago, as I walked to the bathroom in executive class I walked by two well-known Newfoundland and Labrador Government Ministers.  They had both fallen asleep in their seats, with a collection of clearly marked highly confidential documents spread out on their trays.  I could have lifted a few, dropped them off at a newspaper office anonymously and watched with amusement as a controversy developed.

How about the NTSB official sitting next to me on a flight out of Newark, NJ who went to the bathroom and left a highly confidential crash report (complete with delicate photos) spread out on his tray?

How about the two women (whom I assume to be social workers of some type) sitting next to me as I write this, explicitly naming the people in their case files and expressing disgust over the best way to “handle them”.

Or one of my favourites … when I inadvertently happened to look over someone’s shoulder in a Starbucks and discovered a potential terrorist documenting his interests and intentions.  I wrote about that in “The Power of Trusting Your Instinct”.

The bottom line is this.

Technology is not and should not be the sole focus of our concern around the protection of sensitive information.

The weakest link is, not surprisingly, the individuals who carry the information and how they conduct business when in possession of this information.

Until we demand better common sense and accountability from these individuals, our concerns around privacy will go unanswered, mostly because we are pouring too much of our time, energy and money into solving the wrong problem while still feeling good about how secure we are.

When organizations tout some technology as the latest and greatest in information protection, we should never forget that the weakest link when it comes to vulnerability will always be people and we should hold these organizations to be appropriately accountable as a result.

When they assure us that everything is secure, we must never be timid in asking “How do you know?” and to continue asking until we are satisfied with the answer.

Now … what about this company in Calgary?

Their secret is safe with me.

However, the next guy who overhears such a conversation may not be as kind.

Create a great day for yourself and others, in service and servanthood.

Harry

Addendum – August 20, 2013

After listening to some team members of Alberta Health Services today openly discussing things that I shouldn’t have overheard, I wrote The Coffee Shop–The New Source of Privacy Leaks.