The credit reference and public record search company Experian has been linked to a site providing information to identity thieves, once again demonstrating why privately owned credit bureau services are a terrible idea.
These pervasive organizations maintain files on private citizens who likely have no idea as to their very existence or what information these organizations obtain and collate. Public utilities, banks and lending facilities and even landlords betray your most personal of details to these organizations with – at best – a vague reference in a tersely worded privacy policy that claims that third parties may have access to some information where it is useful or expedient for them to do so.
This unacceptable profiling is loosely regulated in most jurisdictions thus creating a sort of Wild West where your most private financial information becomes a sought after commodity. It is also something that is nearly impossible to opt out of (we all need housing and access to utilities, right?).
The other interesting thing to note is the incestuous relationships between many of these organizations and Internet advertising companies. It is not inconceivable that at some point in the future (if it isn’t happening already) your web activity could determine how you are treated in the real world. Perhaps you land on several sites for information on a serious medical condition and frequent forums for sufferers. You may find your insurance premium will increase. The dumb computer that collects all this information knows little about context. You may be researching said condition for a project or perhaps supporting a family member. It doesn’t matter. You are now an insurance risk. Visiting drug related discussion groups? Perhaps this will also be added to your dossier.
The examples I speak of may sound far fetched but this is truly the direction in which I see these companies moving if legislature isn’t brought in to control these practices.
In my humble opinion the ludicrous American credit score model should be immediately abolished and replaced with a simple true/false credit check that takes into account only if you have legally provable issues like bankruptcy proceedings or are otherwise on public record as being insolvent. Such data should be discarded after the legally mandated bankruptcy period is over.
This will go a long way towards preventing the discrimination that the current system causes towards people who have committed minor indiscretions in the past and/or have been victims of identity theft (the latter in itself is a major issue with the current system – the onus is on the individual to prove they are not responsible for said debts, totally the opposite to natural justice and the maxim of “innocent until proven guilty”) and more importantly abolish the credit reference companies who trade on what is often a rumor or the say so of another company who need only sign a form to substantiate that such a debt exists). The system I speak of should be operated by a government department and more importantly have a well established appeal process.
As for Experian and their connection with SuperGet (the identity theft resource site we spoke of earlier), the full story is available on Krebs On Security.
Mike the Crypto Goat 