Case description

ChoicePoint, a Georgia-based corporation and 1997 spin-off from Equifax Inc., provides risk-management and fraud-prevention data. Traditionally, ChoicePoint provided motor vehicle reports, claims histories, and similar data to the automobile insurance industry, but in recent years it broadened its customer base to include general business and government agencies. ChoicePoint collects, stores, and sells the personal information of consumers (e.g., social security numbers, birth dates, employment information, criminal histories and credit histories) to more than 50,000 businesses and agencies. The company also offered data for volunteer and job-applicant screening and data to assist in the location of missing children. In 2004 ChoicePoint had over 4,000 employees, and its revenue was $918 million.
In the fall of 2004, ChoicePoint was the victim of a fraudulent spoofing attack in which unauthorized individuals posed as legitimate customers and obtained personal data on more than 145,000 individuals. According to the company's Web site:
“These criminals were able to pass our customer authentication due diligence processes by using stolen identities to create and produce the documents needed to appear legitimate. As small business customers of ChoicePoint, these fraudsters accessed products that contained basic telephone directory-type data (name and address information) as well as a combination of Social Security numbers and/or driver's license numbers and, at times, abbreviated credit reports. They were also able to obtain other public record information including, but not limited to bankruptcies, liens, and judgments; professional licenses; and real property data.”
ChoicePoint became fully aware of the problem in October 2004, when it noticed unusual processing activity on some accounts in Los Angeles. Accordingly, the company contacted the Los Angeles Police Department, which requested that ChoicePoint not reveal the activity until the department could conduct an investigation. In January, the LAPD notified ChoicePoint that it could contact the individuals whose data had been compromised.
This crime is an example of a failure of authentication and not a network break-in. ChoicePoint's firewalls and other safeguards were not overcome. Instead, the criminals spoofed legitimate businesses. The infiltrators obtained valid California business licenses, and until their unusual processing activity was detected, appeared to be legitimate users.
In response to this problem, ChoicePoint established a hotline for individuals whose data were compromised to call for assistance. They also purchased a credit report for each of these people and paid for a one-year credit-report-monitoring service. In February 2005, attorneys initiated a class-action lawsuit for 145,000 individuals with an initial loss claim of $75,000 each. It was later acknowledged by ChoicePoint that the total number of individuals whose records were compromised was actually well over this number. At the same time, the U.S. Senate announced that it would conduct an investigation. Later, both the U.S. Federal Trade Commission and Securities and Exchange Commission announced separate investigations into the incident and the response by ChoicePoint executives.
Ironically, ChoicePoint exposed itself to a public relations nightmare, considerable expense, a class-action lawsuit, federal investigation, and a 20 percent drop in its share price because it contacted the police and cooperated in the attempt to apprehend the criminals. When ChoicePoint noticed the unusual account activity, had it simply shut down data access for the illegitimate businesses, no one would have known. Of course, the 145,000 plus individuals whose identities had been compromised would have unknowingly been subject to identity theft, but it is unlikely that such thefts would have been tracked back to ChoicePoint. According to the FTC (which later fined ChoicePoint $10m for their negligence) at least 800 cases of identity theft resulted from the breach.

Case questions

1. Describe how the information security breach occurred and the business impact of the information security breach at ChoicePoint. Be sure to include both tangible and intangible losses. • The criminals posed as customers by using stolen identities to create and produce the documents needed to appear legitimate and obtained personal data of 145,000 individuals • Tangible business losses include: o Purchased credit reports and paid for one year credit monitoring service for those accounts compromised o 20 percent drop in share price o $10mil fine from FTC for negligence • Intangible business impacts include: o Public relations nightmare, class action lawsuit, and federal investigation

2. Describe the actions taken by both ChoicePoint and external entities in response to the information security breach. Include your assessment of each action taken in your answer. ChoicePoint internal actions:
|purchased a credit report for affected accounts and paid |This action does well in alerting the accounts affected, but does not go |
|for a one-year credit-report-monitoring service |beyond this to reimburse the money and information compromised |
|contacted the police and cooperated in the attempt to |This action is ethically correct in alerting police to apprehend the |
|apprehend the criminals |criminals, but consequently compromised the perception of the company and |
| |had many negative financial implications |

External actions:
|LAPD requested ChoicePoint to not notify those accounts effected |The initial investigation took several months before ChoicePoint |
|until they conducted an investigation |was able to alert the accounts compromised; this seemingly |
| |negligent action was in compliance with LAPD’s orders |
|The Senate along with the U.S. Federal Trade Commission and the |These intensive investigations were for the benefit and safety of |
|SEC conducted separate investigations into the incident and |the public, but I feel harshly impacted ChoicePoint and ignored |
|response by ChoicePoint executives resulting in a $10mil fine from|the difficult but ethical decision made to alert police when they |
|the FTC |could have kept silent |

3. Describe possible reactive steps by ChoicePoint that might have mitigated their losses subsequent to their discovery of the information security breach? Explain/justify your choices. • Rather then dealing directly with police and allowing transparency with the general pubic to the situation, ChoicePoint could have better compensated and worked directly with those accounts effected by the breach by going further then paying for a credit report • Timeliness is key in a security situation where sensitive information is leaked, and ChoicePoint was deemed negligent by the FTC with a hefty $10mil fine possibly for the months they were aware of the situation and complied with LAPD in not notifying those accounts effected, they should have responded more promptly and with larger compensation

4. Describe possible proactive steps by ChoicePoint that might deter a reoccurrence of information security breaches in the future? Explain/justify your choices. • This crime was a failure of authentication on ChoicePoint’s part and not a network break-in therefore CP’s firewalls and other safeguards were not faulty but rather they could have considered stricter authentication of businesses and limited access to the information • Security features could be implemented to react quicker and notify CP when information of other accounts are extracted because users of their service should only have access to their own account information