It's 2 to 1

Yesterday's mail contained letters from Experian confirming they've placed a security freeze on our credit accounts after the theft of our Social Security Numbers from the Davidson County Election Commission. Why Experian and Equifax had no problem with the form letter from the Election Commission and the blanket theft report and TransUnion did still remains a mystery. Last week their phone representative insisted that a supervisor would call me back...no call, no message, no letter so far.

TransUnion says no

I've just gotten off the phone with TransUnion. After writing them a very specific letter with 5 pages of documentation with the information they require I got back a 9 page form letter telling me what my rights are and how to put a freeze on our accounts. I called them back and it turns out that they blew off my letter because the police report doesn't specifically say I'm the victim of fraud and they won't put a freeze on my credit report without my paying their $7.50 fee. What? They expect 337,000 people to get personalized crime reports from their local precincts? I actually have to have been harmed before they'll do this? The best "Jenna" could offer was to have a supervisor call me back. Right. To her credit she didn't lose her temper when I lost mine.

Heads up folks. Oh, and if you decide to call TransUnion use the Dispute number (1-800-680-7289) where actual people answer the phone instead of the Fraud number where you're stuck in a never ending automatic circle.

Equifax didn't have a problem with any of our documentation at all and I got letters from them yesterday saying our accounts were frozen and they provided PIN numbers for when we want to make any changes. Simple one page confirmation letter. No request for any payment or additional information.

Who is Debix.com?

Mayor Karl Dean has certainly returned from vacation. He's hot on this SSN theft and this afternoon has announced that Metro is willing to pay for ID protection. Thanks, but no thanks. I'm not comfortable having the government pick this service for me. As a taxpayer, I'm thrilled you got a good deal and I'm frustrated that this is coming out of tax money.

From CM Karen Bennet's (District 8 Inglewood) email this afternoon to her constituents which is quoting a press release from Nashville Mayor Karl Dean :

The Metropolitan Government of Nashville is contracting with Debix
Identity Protection Network to provide affected citizens a full year
of identity theft coverage from the date of registration and the
option to renew for a second year of coverage for $9.50, a steep
reduction from the consumer price of $99 per year.

(snip)

Voters will receive a letter containing detailed instructions on how
to enroll with Debix no later than next week. An enrollment form and
an activation code will be included with the letter. Voters can use
the activation code to either mail in their enrollment form or
register for the service online at www.debix.com/nashville.

(snip)

Based on past experience, Debix expects 25 to 35 percent of affected
voters to take advantage of the service. Under the contract agreement
with Metro, Debix will receive $9.75 per account activation for the
first 20,000 enrollees and $9.25 for all others.


Debix protection includes:


· Fraud alerts: Every 90 days fraud alerts with all three
national credit bureaus are automatically renewed.


· Credit monitoring: Customers are notified in real-time via
phone and e-mail on up to three numbers every time a new account for
credit is being opened. Declined transactions are reported to the
police within 24 hours after confirmation that the transaction was
due to fraud.


· ID theft insurance: Each registered customer is provided with
$10,000 of identity theft coverage with no deductible and direct
access to an identity theft specialist. The insurance covers identity
restoration costs, lost wages and legal defense fees.


· Stop pre-approved offers: Customers are placed on the
National Do Not Call Registry if requested and opted out of pre-
approved offers of credit and insurance.

I've just initiated a freeze on my credit...why is Debix better? I'd like to know more about Debix and how they got this contract. Here's a NY Times piece from November 2007 about Debix's founding, along with some info about LifeLock and TrustID.

Debix has signed up 275,000 customers in the last two years by offering the service through companies and state governments that have lost their customers’ or citizens’ private data and now want to extend an additional layer of identity protection to victims

Consumer Reports (the real one) weighed in on this in 2003. They said then "It's not typically worth the money." As of April 2007 they haven't changed their mind. They do have some great info though. They also point out:

Neither the Federal Trade Commission nor consumer groups including Consumers Union, the Identity Theft Resource Center, and the Privacy Rights Clearing House recommend or endorse credit-monitoring services. If you're tempted to sign up, however, you should know that credit-bureau monitoring services have the following limitations.

(snip)

But scrutinize the terms of coverage for loopholes. For example, some insurers exclude coverage for losses that occurred prior to your purchase of the product. It can take months or years for ID theft to be discovered. So if a thief opened a fraudulent account in your name two years ago, you bought monitoring one year ago, and you don't discover the crime until next year when a collection agency hunts you down, your insurance protection and payout might be zero with some policies.

Be careful out there.

UPDATE: CM Emily Evans' blog entry regarding this is titled: "Mayor Announces Free ID Theft Protection". It's not free if taxpayers foot the bill. It may be at no direct cost to us...but the money has to come from taxpayers somehow. I encourage Metro to recoup the cost from Wackenhut or Specialized Security Services. Then you can call it free.

3 1/2 hours of my life I'll never get back

I've finished writing the letters to the three credit bureaus for two of the adults in our home. I've got years of secretarial experience behind me, keep really good records and have office equipment in my home. I can't imagine how frustrating this process is going to be for people who don't have the right documents (utility bills in your name, copies of driver's licenses, the police report), have to hand write or peck around on a typewriter to create the letter requesting the freeze, make a trip to Kinkos (by car, bus, walk before/after work, or picking up the children) to make copies and copies, and still schlep to the post office to mail these certified. I'm sure many of our citizens will be so overwhelmed that they'll avoid the task and hope nothing happens.

While I could create a partial form letter each bureau required somewhat different information that had to be included in the letter. It's a lot of different parts to put together and you want to make sure it's complete before sending it off. AND you have to keep a copy for your own records--just in case. Thank Goodness one of our utility bills is still in my name. Heaven forbid I overlook something or confuse the letters and the bureau writes back and I have to start over. They may exchange info on the phone for a 90 day fraud alert but they don't for credit freezes.

Each letter is $3.23 to send certified (which the credit bureaus require). I also opted for a return receipt after the Inglewood Post Office folks, who provide stellar service, suggested the electronic version which is .85 cents vs. $2.15 for the old familiar green post card. That's six letters at $4.08 each for a total of $24.48.

I've had absolutely no sympathy for Wackenhut, Specialized Security Consultants or Metro employees who failed to protect our information. Even more so now that I've spent, so far, a frustrating several hours, lots of printer ink, and the cost of six gallons of milk cleaning up their mess.

I hope that guard enjoyed those Christmas tunes, cause lots of folks are going to be singing the blues.

SSN breach, Round 2

Yesterday the Brooks household received official notice from the Davidson County Election Commission that our SSN's had been compromised. We also got notices from all three credit reporting agencies acknowledging our initial phoned in fraud alerts. (The Post Office may get the immediate financial bump from all the notices flying back and forth.)

Experian gets an A for being the easiest to read and easiest on the eyes. TransUnion seems stuck in DOS format using a dot-matrix printer, but their website is much easier to use.

The Election Commission couldn't have made their letter much more bland and 'oh by the way-ish'. Seems to me it could have been formatted better. Something like:

Dear Voter:

YOUR SOCIAL SECURITY NUMBER HAS BEEN STOLEN AND YOU MUST TAKE IMMEDIATE ACTION TO PROTECT YOUR IDENTITY.

would have been a better way to begin the letter instead of waiting 6 lines. It also doesn't come with a real signature unless Ray Barrett normally writes in perfect Script MT Bold.

So now we've got to gather documents, write letters and send it all off certified to the three credit reporting agencies for a freeze on our credit. The upside to it being stolen is the freeze will be free.

Equifax instructions.
Experian instructions.
TransUnion instructions.

And since I need a copy of the police report I finally got around to reading it. I don't know why Mr. Murphy is outing himself in this morning's Tennessean. It looks like his name has been redacted from the police report. The police report does say that he noticed a window being up but made an assumption about why it was so and continued on. Isn't that something the previous guard should have mentioned, if such had been the case? It was the next guard (a woman, btw) who noticed and actually went in to check it out.

Op #1 [Murphy] advised on Sunday 12/23/07 around 1800 hrs he observed the roll up door/window to the Metro Davidson County Election Commission (on the inside) was raised up a little; believing this was normal as that door/window was left up to accommodate electrical wiring, OP#1 continued his shift at location.

OP#2 advised on 12/26/07 around 0100 hrs as she was conducting her rounds she observed the same door/window raised; noticing the Christmas decorations lying in the floor, OP#2 checked the Election Commission Office further and found entry had been made thru the window to the outside wall by a rock thrown thru it. OP#2 advised she checked the building and was not able to confirm if anything was stolen.

No security is provided on Sats at location and no alarm calls occurred were reported/dispatched after 12/21/07. ID responded to process scene.

Yet, Mr. Murphy is quoted in this morning's Tennessean as saying "he noticed that Christmas decorations and a roll-up window at the election commission were out of place when he started work at 6 p.m. on Sunday, Dec. 23." Why don't the police report and Murphy's later version to the paper jibe? Why the door and decorations caught the attention of OP#2 enough to check and not Murphy is why he's no longer employed.

Metro has a whole web page on the incident--to include links to the hearings the Public Safety Commission had for online viewing.

I'm glad the Mayor is back and requiring all departments to reevaluate their security procedures. This time let's make sure that the IT department's recommendations are followed and we know who gets the responsibility. I do think CM Jim Gotto (District 12 Hermitage) is right to call for an independent audit. I think those guys are going to be very busy once they start looking into this.

Watergate lite

I couldn't disagree with Gail Kerr more regarding her "Other Peeves" point in her column today:

Note to the Metro Council: You are the council. Not a grand jury or special prosecutor's office.

Chill with the Watergate-like hearings.

Note to Mayor Dean: You have a staff. This is what they are for. Ditto your police chief and police force.

If you need investigations done, guess what? That's what they do!

I would have expected Gail Kerr to see that this Council and this hearing exactly mirrors Congress and their committees but on the local level. Would she have said the same thing about the Watergate break-in? Would she have written: "President Nixon: You have a staff. This is what they are for."? We're not talking about someone stealing a couple of campaign files, or knocking off the vending machines. We're talking about the personal information of 337,000 citizens. We have learned so much about how our Metro government does and doesn't run as a result of this ONE hearing, I can't imagine how much more has been swept under the rug because it wasn't subject to such a public hearing but quietly investigated.

Mayor Dean is out of the country...not much he can do right now. Unfortunate timing but 'them's the chances ya takes'. Thieves were apparently the only ones working this holiday season and so here we are. I don't recall anyone on his staff taking the lead in his absence. In fact I don't recall reading or hearing much from councilman at all while constituents were demanding answers and none were coming. The Public Safety Committee, chaired by CM Michael Craddock (District 4-Madison) did exactly the right thing in calling in department heads to answer some pointed questions and account for their actions. Our community is better off as a result.

Some suggestions

I'm still absolutely astonished at how badly the Metro Election Commission, the Metro IT folks and the other Keystone Cop members of our government have handled our very sensitive information. I had another meeting to attend on Thursday so I couldn't watch all the Public Safety Commission hearing but what I heard and what I've read so far is just absolutely astonishing. Time after time I kept thinking "What?!", "Why not?!", "Who?!" "Well, it's gonna cost us now!" This cannot stop with one security guard losing his job for dereliction of duty. The dereliction goes much further. At some point some folks way up this chain need to be fired and lose their pension and other benefits.

And since I understand that suing Metro for damages may result in higher taxes (like I need that) I will decline to be part of this class action lawsuit as long as Metro is a defendant. I don't mind suing the pants off Wackenhut or it's sub-contractor, but Metro money is my money. It doesn't make sense to take it from me and give it to me.

In the meantime I'm concerned about the thousands of people who are behind the curve on protecting their identities. Because it's tax season I'm going to suggest that tax preparers take up a huge public service project and:

1. alert every one of their customers about this breach of security,
2. provide a packet of information about what has occurred, and what minimal steps they should take. They could even include a chart and calendar to remind folks to do it all and keep doing it all over the years.
   
3. help them make the initial fraud alert phone call, and
4. help them request that first free copy of a credit report from at least one of the three credit reporting agencies for review.

Maybe this is something the local CPA's can spearhead along with the Y's or senior centers. But it has to be done.

Also, as we speak some low life cretins are preparing to pick the pockets of the uninformed and offer them some sort of credit monitoring, repair or protection which will result in even more damage to the credit of those unaware much of this is available free or for a very small fee. Yes, there are legitimate business that do this BUT I predict the rats are coming.

I'm going to further suggest that the Election Commission place large posters in front of stacks of information packets at their main office, at every polling place and include a notice on every piece of mail to a voter for quite some time. I'd also like to see a phone line next to the display so that voters can make those fraud alert calls right then and there. Poll workers should be trained in assisting voters in making that initial fraud alert call. We are reminded when switching back and forth from daylight savings to change our smoke detector batteries, so entering a polling place or receiving our sample ballots should be the reminder that if we haven't done it in the last 90 days it's time to renew our fraud alert.

Hopefully, this is just the beginning of a wholesale check on the procedures at every entity that holds our information. From the schools all the way to our dentists, this information should be encrypted, password protected (sans the Post-It thank you) and locked away. It shouldn't take just a rock and the back-handed help of Keystone Cop Security to get this information.

SSN breach live on Metro 3 today

Starting at 5:30 p.m. today the Council's Public Safety Committee, headed by CM Michael Craddock, will meet to discuss how on earth our SSN's weren't secured and what's being done to make sure this incident isn't repeated.

Frankly, heads should roll. I don't care if they're republican or democrat. In this day and time it's a no brainer that ID theft is the fastest growing crime around and that SSN's are the 'key to the city'. It's just unconscionable that this information was left out, unattended, in a first floor office with nothing but safety glass between them and what will now be a lifetime of concern about our identities. Maybe, it won't happen this week, maybe not next month....but who knows how many copies of this information are out there being passed around. The smart thief will quietly wait for the brouhaha to die down. When we've gotten tired of renewing fraud alerts every 90 days, when we've forgotten to check those credit reports in a couple of years and move on with our lives this will raise it's ugly head and catch us unawares.

I don't want to burden taxpayers with paying for fraud monitoring for 337,000 people for life. But I'll have no sympathy for any employee who failed to follow procedure or for any administrator who didn't realize that we're in a new day and age and this information should have had the highest protection available. It was too expensive you say? We don't even know what this theft is going to cost good citizens who did the right thing by registering to vote.

It's going to be broadcast live via Metro 3. You can view it online at this link.

At 4:30 they'll be talking about school safety, another very big issue. Government's first job is to protect it's citizens. We cannot compel children to attend school and not ensure their safety. I've never trusted the incident information MNPS provides. It's not specific enough regarding what happened or where it happened. I'd like to see a comparison of MNPS and MPD statistics. I'll bet it'd be quite eye opening.

Oh well then...

Persons unknown have managed to break into two government offices over the Christmas holiday and gain access to our contact information and even our Social Security numbers. Both the Davidson County Election Commission and the Department of Safety (just a short car ride along Murfreesboro Road as AC Kleinheider illustrates) were hit.

The Election Commission does not anticipate that the theft will cause any problems in upcoming Presidential Primary voting which begins on January 16. Press Release dated 2007-12-28

Oh, well then...like that was the first concern I had upon hearing this bad news.

Actually, my first question after reading this Tennessean account:

Security workers were on duty over the holiday, but the theft went undetected until the day after Christmas, when Barrett unlocked the office at 7:30 a.m. and found a broken window and missing office equipment —

was what were we paying security for if they never noticed a broken window????? Good grief, my local convenience market has more security over the beer case, apparently.

Dave Ramsey's ID Protection Insurance is $72.00 a pop. Who do I send the invoice to to cover the three voters and drivers in our household?

While we wait for the dust to settle you may want to keep an eye your credit report via the Federal Trade Commission's AnnualCreditReport.com. The law requires all three credit reporting agencies to provide one free report each year.

UPDATE: Bill Hobbs has some good suggestions. Vote in some Democrats that will require real ID's before voting and get the election commission to issue voter cards with pictures and keep those laptops with our essential information in a location that is actually secure.