Security of personal information sacrificed for sake of theatre tickets

Posted on 24 Mar 2005 at 13:17

Nine in ten people gave researchers for this month's InfoSec conference the personal information often needed to access bank accounts - for the chance to win a theatre ticket.

Posing as researchers interested in the theatre-going habits of the public, the InfoSec crew reeled off innocuous questions, interspersed with clever ruses to reveal a combination of their pet's name and mother's maiden name and the name of their first school.

One bank employee recognised that the researchers would have enough information to open a bank account, although that didn't prevent her from subsequently handing out that information. Another, returned in a panic, worried that the researcher would be able to get into his bank account.

Detective Inspector, Chris Simpson Head of Scotland Yard's Computer Crime Unit commented: 'The results of the survey are disturbing to say the least. However they do highlight the need to raise public awareness of identity theft, what it actually means, how it can happen and the potential consequences.'

'Preventing the theft of your own identity is relatively simple,' he added, 'but it relies on the individual taking steps to protect themselves i.e. restricting the people to whom you reveal sensitive personal data (whether in the physical or virtual context); shredding or destroying personal correspondence before disposing of it and never sharing passwords to access computer systems.'

One expects to hand over some personal information, if only to ensure deliveries are made to the correct address, for example.

What the research highlights is the difficulty of making online services such as banking both secure and usable: that 'componentised' passwords aren't enough if those components aren't themselves sufficiently complex and protected.

Detective Inspector, Chris Simpson is speaking in a keynote session on, 'Law Enforcement - Cybercrime and International Co-Operation, Prevention, Detection and Punishment,' at Infosecurity Europe 2005 - Olympia, London, UK 26th-28th April.

Interviewees were entered into a genuine draw for theatre tickets, the winners of which have already been chosen and will shortly receive their prize.

Author: Matt Whipp