Disappeared News

by Larry Geller

A few notes on this morning’s conference call with National ID watch on the UH security breach in which 40,101 alumni personal data records were breached.

First, no one from the University of Hawaii was on the call, or they refused to identify themselves if they were there. No press were on the call except for Disappeared News and Burt Lum and Ryan Ozawa from Bytemarks (tonight at 5 p.m. on Hawaii Public Radio, KIPO, 89.3 FM).

On the timing of the discovery of the breach, National ID Watch discovered the data leak with a Google search that anyone could have done, on October 18 and notified UH. They managed, with some difficulty apparently, to convince Google to take the data out of their cache, and then notified the press on October 27.

As to the possibility of a lawsuit against UH, it would be difficult, according to Aaron Titus the attorney who discovered the breach. Paraphrasing his response to a caller’s question:

1. You’d have to prove five things, all difficult:
2. The person must suffer actual monetary damage
3. They must actually find the ID thief
4. They would have to prove that the data came from UH
5. They must show that UH had a duty to protect the data
6. It would be necessary to show that UH violated that duty

A better route, it was suggested, would be legislation imposing a fine for each breach of personal data. Another course would be to demand  3rd-party audit of UH security policies and procedures.

I understand that the conference call was recorded and may be posted at the National ID Watch website.

It was also confirmed that UH will not pay for ID theft insurance etc., and in answer to whether UH has notified those affected, probably a large number of affected alumni have changed their address and could be unreachable. Unless I misunderstood, UH has yet to attempt to contact anyone. Also, thinking about this just now, if UH alumni retain their email addresses after graduation, that would seem to be a way to reach those affected besides the US mail.

Permalink posted by Larry @ 11/03/2010 01:13:00 PM