6

A recent previous question of mine had an answer that sparked a different and unrelated question in my mind:

Customer wants to modify the .properties files packaged in our WAR file

The question that I thought of after reading this answer is, just how low-risk is the data being collected on people (non-users, lets just say, "people") in my application?

  • A first name and last name
  • Company or organization that person currently is employed at.
  • (Optional) An email address
  • (Optional) A persons phone number
  • A photograph of the persons face
  • An digitally signed PDF document physically signed with electronic signature pad (a persons hand written signature)

No other sensitive data like social security numbers, credit card numbers or anything that can accurately identify a person with 100% accuracy. How sensitive would you rate the data types listed above? Is identity theft even remotely possible with the above information?

In light of all the recent news outbreaks of hacking successes and data breaches, if such a thing were to happen to my application (assume that I have reasonable security measures, SSL, encrypted passwords with salt, account lock after so many failed attempts, etc...), what kind of a response would be appropriate for my organization in your opinion? Should every attempt be made to notify the persons that this information has been compromised? Is it worth it?

Thanks for sharing your thoughts.

|improve this question
  • Sony lost name, address, birthday, and email and got hammered as it increased the risk of identity theft for those whose data was exposed. – Mayo Jul 14 '11 at 15:54
  • @Mayo, They also lost social security numbers. Somebody can open up a credit card in your name if they have your SS#. – maple_shaft♦ Jul 14 '11 at 18:31
13

Anything that can be used to harm your users is sensitive

It's not only 'sensitive' when it allows for identity theft, that is but one form of harm.

If data can be used that way depends on the context.

For example: the first and last names and the portrait are definitively sensitive user data in, uhmm, 'adult toy stores', they are not on facebook. The phone number may be non-sensitive for all those who let it print in phone books, but it may be for the unlucky ones that get stalked.

The user is in a better position to judge his context than you, therefore i would consider all of your items sensitve, until proven otherwise or told by the user.

|improve this answer
  • 4
    Yep. All customer data is sensitive until the customer tells you it isn't. Then you still treat it with as much care as you possibly can and still get the job done. – ElGringoGrande Jul 14 '11 at 14:50
4

I would answer by looking at the legislation in the countries you will be operating.

For the UK you can look at the 1998 Data Protection Act: http://www.legislation.gov.uk/ukpga/1998/29/section/2.

2 Sensitive personal data.

In this Act “sensitive personal data” means personal data consisting of information as to— (a)the racial or ethnic origin of the data subject,

(b)his political opinions,

(c)his religious beliefs or other beliefs of a similar nature,

(d)whether he is a member of a trade union (within the meaning of the M1Trade Union and Labour Relations (Consolidation) Act 1992),

(e)his physical or mental health or condition,

(f)his sexual life,

(g)the commission or alleged commission by him of any offence, or

(h)any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

I am not a lawyer.

|improve this answer
  • We do not have any customers in the UK... yet... however the app is sufficiently internationalized. They could possibly identify race by the photo. Thanks for sharing! – maple_shaft♦ Jul 14 '11 at 14:02
  • 1
    Have a read through of the Data Protection Directive for the US (your profile location + google fu + ??? == PROFIT!), or search for {country} data protection legislation if you're releasing to or (importantly) STORING on the cloud in a country that might not have sufficient Data Protection legislation. This is part of DPA, should be part of the DPD and might be part of others. – StuperUser Jul 14 '11 at 14:08
2

First and last names are good identifiers of people. Not unique, but pretty good. Tie that to a phone number and email address, and you can pretend to be a bank and get their account info. After all, only a legitimate bank would have a person's correct name, phone number, and email address, right? And if you get a photo of the person, you could stalk them too (or do all sorts of other things with it, in their name)!

|improve this answer
  • 1
    Hmmm... and perhaps they could use the digitally signed document to practice forging a persons signature? Good insights... – maple_shaft♦ Jul 14 '11 at 14:04
2

Well even just their first and last name gives implicit information about their activities. It shows that they're involved with your application. If it were, say, an S&M focused project, then it's fairly sensitive.

How Sensitive? Well sensitivity depends on how much they could be hurt by the release of the information. It also depends on the target. The name, credit card#, and signature of a poor person in debt with a negative credit score isn't all that sensitive. Pretty much anything about a celebrity or famous person can be very sensitive.
Will they be embarrassed?
Will their secrets be exposed?
Will they be spammed?
Will they be phished?
Will they be a victim of Identity theft? (which is mostly credit card fraud but also being falsely signed up for things)
Will they be sued?
Will they arrested?
Will they hunted down by an angry mob with pitchforks and torches?

For your data list? They'd certainly be vulnerable to spam and phishing, for anyone that included email or phone numbers. The photo will probably be considered more "personal", but there's not really a black market for that. The signature is a bit concerning though. With that, and the photo, they could theoretically be signed up for things. But everything I can think of would also want their address, SSN, or such.

What kind of a response would be appropriate for my organization in your opinion? Should every attempt be made to notify the persons that this information has been compromised?

Well yes, if you have a breach like that, the right thing to do would be to inform everyone of exactly what was leaked. It's not so vital that I'd go beyond one mass-email and a notice on your website/service/application/whatever.

Is it worth it?

Monetarily? No. It's egg on your face and doesn't make you a dime. But it should help you sleep at night.

|improve this answer
  • Even the poor's person name and financial data may be sensitive, because they influence his credit rating, or his standing when bargaining, etc. (+1, btw) – keppla Jul 15 '11 at 16:32
1

Seems clear

http://www.hipaa.com/2009/09/hipaa-protected-health-information-what-does-phi-include/

Yes, it's in a health-care context, but it's a pretty specific set of guidelines that can be applied to other areas.

|improve this answer
1

There is plenty of information here to improve spam. Matching a name to an email address is plenty. When I get a "Hey Joe" because they guessed my name based on first initial, I know it's bad. A digital image of the signature is pretty personal.

What disadvantage do you see in notifying users? The cover-up will get you into more trouble.

|improve this answer
  • The users are actually the ones trying to track information on other people. The thing is that digitally alone you can't uniquely identify one person record from another, For instance 'Joe Smith' at 'BadCo Inc.' could be the same as 'Joseph Smith' at 'BadCo Inc.' or 'Joe Smith' at 'BadCo Incorporated'. The photos could be different too. The reason I ask isn't because I want to cover it up, its because somebody would have to inspect each and every person record in such an event and ATTEMPT to find out who that person actually is with potentially virtually no uniquely identifiable information. – maple_shaft♦ Jul 14 '11 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.