msia711.041 e- enterprise liability liability requirements (how to incur liability): –by law –by...

MSIA711.04 1

E- enterprise Liability

• Liability Requirements (how to incur liability):– By law

– By contract• Promise of a duty to perform

• Implied promise of a duty to perform

– By Tort• intentional (libel and slander)

• negligent (lack of reasonable care in handling information)

• strict liability (limited to statutory acts, such as blasting)

– By Relationship• Husband-to-wife, parents-to-children, guardians-to-children

• Business relationship: master/servant, principal/agent

MSIA711.04 2


• Duties of Internet Services Providers:– Protect Lawful Copyright Holders

• Against infringement by subscribers who post material to ISP site.

• Millennium Act: holds ISPs liable for copyright infringement jointly with subscriber if:

– ISP is informed by the copyright holder of the infringement, and (1) does not inform the subscriber of the complaint, or (2) does not remove the infringing material from the web within a reasonable time.

– ISP not liable if the subscriber refutes the copyright holder’s claim, and the copyright holder does not sue subscriber.

MSIA711.04 3


– Protect the Public at Large• Against libel: libel is a method of defamation expressed by print,

writing, pictures or signs. Defamation is an intentional false communication, either published or publicly spoken, that injures another’s reputation or good name.

• Against slander:the speaking of base and defamatory words tending to prejudice another in his reputation, community standing, office, trade, business, or means of livelihood.

• If an ISP allows a subscriber to defame someone using the ISP’s bulletin board:

– Is it libel or slander?

– Is the ISP liable, jointly with the subscriber?

MSIA711.04 4


• Duties of Internet Services Providers (continued):– Protect the privacy of subscribers:

• Against discovery?

• Against spam?

• Against disclosure of subscriber account information?

– Protect the information of subscribers:• Against uses not authorized by subscribers, by employees

• Against uses not authorized by subscribers, by hackers

MSIA711.04 5


• Duties of Internet Services Providers (continued)– Publisher (Prodigy model)

• Prodigy opted to establish and enforce rules regarding what content may be posted by subscribers, to its bulletin boards.

• A subscriber posted libelous information, and Prodigy was held liable jointly with the subscriber, for failing to exercise a reasonable duty to enforce its own content policy.

– Distributor (Compuserve model)• Compuserve opted to establish and enforce no rules regarding what

content may be posted by subscribers to its bulletin boards.

• A subscriber posted libelous information, and Compuserve was not held liable jointly with the subscriber, because the court found that Compuserve had no duty to police its bulletin board.

MSIA711.04 6

E- enterprise LiabilityCustomer Information Protection

• Duties of Website and Portal Providers– Gramm-Leach-Bliley Act, 15 USC §§ 6801-6810, Protection of

Nonpublic Personal Information• Establishes duties for financial institutions to “respect the privacy of

its customers and to protect the security and confidentiality of those customers’ nonpublic personal information. Duties include:

– to insure the security and confidentiality of customer records and information

– to protect against any anticipated threats or hazards to the security or integrity of such records

– to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

MSIA711.04 7


• Duties of website and portals providers (continued)– In general, a financial institution may not disclose nonpublic personal

information to a nonaffiliated third party unless:• such institution clearly and conspicuously discloses to the consumer, in writing or in

electronic form or other form permitted by the regulations prescribed under section 6804 of this title, that such information may be disclosed to such third party;

• the consumer is given the opportunity, before the time that such information is initially disclosed, to direct that such information not be disclosed to such third party; and

• the consumer is given an explanation of how the consumer can exercise that nondisclosure option.

– For the consumer, then:• If the consumer arranges in advance for no disclosure, can a website disclose even if

it follows the above notice requirements? • What if the consumer arranges nothing in advance, and does not respond?

MSIA711.04 8


• Duties of websites and portal sites, continued:– Five FTC Enforcement Actions since the Act’s effective date in

1998:• FTC v. GeoCities: settled FTC charges that it misrepresented the

purposes for which it was collecting indentifying information from adults and children; Geocities agreed to post on its site in a clear and prominent Privacy Notice, a message to consumers about what information is being collected and for what purpose, to whom it will be disclosed, and how consumers can access and remove the information. To ensure parental control, Geocities would have to obtain parental consent before collecting information from children ages 12 and under.

MSIA711.04 9


• Duties of web and portal sites, continued:– FTC v. ReverseAuction.com, Inc., settled charges that it violated

consumers’ privacy by harvesting consumers’ personal information from a competitor’s site (eBay) and then sent deceptive spam to those consumers to solicit their business.

• Settlement bars defendant from engaging in such unlawful practices in the future.

• Defendant must delete the personal information of consumers who received spam but declined to register with defendant, and to give those who did register notice of the FTC charges and an opportunity to cancel their registrations and have their personal information deleted from defendant’s database.

MSIA711.04 10


• Duties of web and portal sites, continued:– FTC v. Rennert, et al: Operators of a group of online pharmacies

that promoted themselves touting medical and pharmaceutical facilities they didn’t actually have and making privacy and confidentiality assurances they didn’t keep, settled with FTC

• Settlement prohibits the deceptive claims and requires disclosures about medical and pharmaceutical relationships

• Defendants barred from billing charge cards without proper consumer authorization and prohibited from disclosing information collected from consumers without the consumer’s authorization

• Defendants required to notify consumers of their practices regarding the collection and use of consumers’ personal identifying information.

MSIA711.04 11


• Duties of web and portal sites, continued:– FTC v. Toysmart.com: defendant misrepresented to consumers

that personal information would never be shared with third parties, and then as part of a bankruptcy settlement, disclosed, sold, or offered that information for sale in violation of the company’s own privacy statement.

– Agreement forbids the sale of this consumer information except under very limited circumstances

• Defendant only allowed to sell such lists as a package which includes the entire web site, and only to a qualified buyer, or one that is in a related market and that expressly agrees to be defendant’s “successor in interest” as to the customer information.

MSIA711.04 12

Enforcing the Law and Regulations in the Conduct of E-Business: Who is Responsible?

• Respondeat Superior and Negligence Doctrine, and the “law of the deep pocket”– “Let the Master Answer”

– The employer should have known. . .

– Sue the one who has money

• Can an employer be held liable for fraud perpetrated by an employee, when the employee uses the employer’s e-mail?– The agency concept

– The “scope of employment” concept

MSIA711.04 13


Agency Law• Conduct of a servant is within the scope of employment if,

but only if:– it is of the kind he is employed to perform– it occurs substantially within the authorized time and space limits– it is actuated, at least in part, by a purpose to serve the master, and– if force is intentionally used by the servant against another, the use

of force is not expectable by the master.

• Conduct of a servant is not within the scope of employment if:– it is different in kind from that authorized, far beyond the authorized

time of space limits, or too little actuated by a purpose to serve the master.

MSIA711.04 14


• Employee misconduct on the Internet in Agency Law:– Extensive case law confirms that courts traditionally do not use

respondeat superior as a basis for expanding an employer’s liability when the employee commits wrongful acts so attenuated or outrageous that they fall outside the scope of employment.

• Employee misconduct on the Internet in Negligence Law:– Negligent retention or supervision: the employer allowed the

wrong to occur because the employer failed to take reasonable care in supervising or retaining the employee-perpetrator.

– Notice of an employee who is a bad actor, actual or implied: obligation to use “proper diligence” to discover bad behavior by employees, and proactively investigate workplace incidents.

MSIA711.04 15


• Foreseeability of Perpetrator-Employee conduct:– The employer’s liability will depend upon the scope of the original

foreseeable risk tht the employee created through his acts.

– If the intervening cause is one which in ordinary human experience is reasonably to be anticipated, or one which the defendant employer has reason to anticipate under the particular circumstances, the defendant employer may be negligent, among other reasons, for failing to guard against it.

– Issue for the court: “how was employer put on notice about employee’s misconduct?

MSIA711.04 16


• The Duty to Spot Criminal Conduct by Employees in the Online Worklplace– Is there a duty?

– E-mail notwithstanding, are companies held liable routinely for criminal use of their telephone and FAX systems by employee-perpetrators?

• Will a Company policy proscribing illegal uses of its E-business systems shield it from liability?– Well-drafted policy can show that the employer is not negligent

– Published policy should also deter abuse of employer e-business systems.

MSIA711.04 17

Spies and Saboteurs

• Trade Theft in Cyberspace: Economic Espionage Act of 1996 (EEA):– The following is a summary of the Act’s criminal provisions:

• Imposes up to a $500,000 fine and a 15-year prison sentence on any person that steals or misappropriates a trade secret in order to advantage a foreign government, instrumentality, or agent.

• Imposes up to a $10 million fine on any organization that commits an offense described in the previous provision.

• Imposes a fine and up to a 10-year prison sentence on any person who steals a trade secret in order to benefit any party, including a foreign corporation, other than the owner.

• Imposes up to a $5 million fine on any organization that commits an offense described in the previous provision.

MSIA711.04 18

Spies and Saboteurs

• Trade Theft in Cyberspace: Economic Espionage Act of 1996 (EEA) - in practice:– Labwerks (1998)

• A state court judge ordered Sladecutter, Inc., a web design firm, to stop hacking into the computer systems of Labwerks.

• Court order was the result of a legal wiretap against Sladecutter.

– Peoplesoft v. Harris Group (civil case - 1998)• Harris sued for hacking into Peoplesoft’s database and obtaining

secrets about job seeking client’s salaries and employers. Settled.

MSIA711.04 19

Spies and Saboteurs

• Trade Theft in Cyberspace: Economic Espionage Act of 1996 (EEA) in practice (continued):– Cisco theft:

• May, 2000, David Hawkins was convicted of stealing information about a new CISCO product worth billions, which he used to set up his own company that would manufacture a competing product.

• Hawkins received a 3-year prison sentence.

MSIA711.04 20

EEA Compliance Advice

• Compliance standards and procedures:– The organization must have established compliance standards and

procedures to be followed by its employees and other agents that are reasonably capable of reducing the prospect of criminal conduct.

• Responsibility to oversee compliance:– Specific individuals within high-level personnel of the

organization must have been assigned overall responsibility to oversee compliance with such standards and procedures.

MSIA711.04 21


• Delegation of discretion:– The organization must have used due care not to delegate

substantial discretionary authority to individuals whom the organization know or should have known through the exercise of due diligence had a propensity to engage in illegal activities.

• Communications and training:– The organization must have taken steps to communicate

effectively its standards and procedures to all employees and other agents, e.g., by requiring participation in training programs or by disseminating publications that explain in a practical manner what is required.

MSIA711.04 22


• Monitoring and reporting:– Reasonable steps to achieve compliance with its standards by

utilizing, monitoring, and auditing systems designed to detect criminal conduct by its employees and other agents and by having in place and publicizing a reporting system whereby employees and other agents could report criminal conduct by others within the organization without fear.

• Enforcement and discipline:– Standards must have been consistently enforced, through

appropriate disciplinary mechanisms, including, as appropriate, discipline of individuals responsible for the failure to detect an offense.

MSIA711.04 23


• Enforcement and discipline (continued):– Adequate discipline of individuals responsible for an offense is a

necessary component of enforcement; however, the form of discipline that will be appropriate will be case-specific.

• Continuous improvement:– After an offense has been detected, the organization must have

taken all reasonable steps to respond appropriately to the offense and to prevent further similar offenses including any necessary modification to its program to prevent and detect violations of the law.

MSIA711.04 24

Information Warfare (IW)

• “Moonlight Maze” and “Electronic Pearl Harbor”

• What is it?– “Coming to grips with information warfare is like the effort of the

blind men to discover the nature of the elephant: the one who touched its leg called it a tree, another who touched its tail called it a rope, and so on. Is a good definition possible? Does having one matter? Perhaps there is no elephant: only trees and ropes that aspire to become one. One aspect of information warfare, perhaps, championed by a single constituency, assumes the role of the entire concept, thus becoming grossly inflated in importance.” Martin Libicki of the National Defense University.

• “National Security” and “Bogeyman” varieties of IW

MSIA711.04 25


• IW Forms:– C2W: command and control systems warfare

– IBW: Intercontinental Ballistic Warfare

– EW: Electronic Warfare (antiradar, anticomms, cryptography)

– PSYOPS: Psychological warfare (propaganda, deception)

– Hacker Warfare

– Economic information warfare (“economic blockade”).

– Cyberwarfare:• techno imperialism simula-warfare

• Info terrorism Gibson warfare (scifi)

• Semantic

MSIA711.04 26


• Chinaspam– Red China’s embassy in Belgrade was bombed by NATO

warplanes during May, 1999.

– Although an accident, Red China began an IW blitz against U.S. targets world wide. 72,000 attacks in August, 1999.

– Similar attacks commenced after the U.S. P2 was downed after a mid-air collision with a Red Chinese Mig.

• Yugospam– Yugoslavia attempted to blitz NATO with IW.

• Code war v. Cold war:– Tamil “internet black tigers”; Aum Shinri Kyo cult.

MSIA711.04 27


• Digital Dirty Tricks and Cyber Plumbers– “Australian Underground”- “we have declared infowar on you”

• Within 20 minutes, the rival political group’s office had its call center disabled, e-mail jammed, and computer system shut down.

– hillaryno.com: diverted internet traffic to the other side.

– gwbush.com: cybersquatter that satirized a Presidential candidate.

– “blackfax:”• A tactic in which the sender repeatedly faxes an all-black piece of

paper in a deliberate attempt to break the recipient’s machine.

• Backlash from the Rep. Hyde scandal.

MSIA711.04 28


• Defensive Information Warfare - Recommendations– Contact law enforcement when attacks are detected.

– Turn on audit trails and logs.

– Use keystroke monitoring.

– Designate an incident management team.

– Designate evidence custodian.

– Record dollar losses associated with the incident.

– Make back-ups, print out logs.

– Document activity

– “Theorize” - law enforcement will need to know where to start, they will ask how the hacker got in, etc.

MSIA711.04 29

The First Amendment and the Internet

• The Communications Decency Act of 1996 – Part of the Telecommunications Act of 1996

– Struck Down by the Federal Court

• Judicial Review of 1st Amendment Restrictions Imposed by the Communications Decency Act– Strict Scrutiny: Court found that the CDA’s premises were not

proven.

– Were the statutory requirements the least intrusive?• Technical means to achieve the CDA’s objectives

• Parental Controls such as the V-chip

• Industry-standard ratings for violence, sex, foul language, etc.

MSIA711.04 30

After CDA: The Children’s Online Protection Act (COPA)

• Addresses the two CDA provisions that were found to be unconstitutional:– Cannot transmit any “communications which is obscene or

indecent, knowing that the recipient of the communication is under 18 years of age.”

– No transmission to someone under 18 “communication that, in the context, depicts or describes, in terms patently offensive as measured by contemporary community standards, sexual or excretory activities or organs.”

• Supreme Court holding in CDA case:– Compelling state interest, but. . .

– No reason for unnecessarily broad suppression of speech to adults

MSIA711.04 31


• COPA– Prohibits “knowingly and with knowledge of the character of the

material. . .by means of the world wide web, making or communication for commercial purposes. . .available to any minor. . .that includes any material that is harmful to minors.”

• Only applies to web communications

• Only commercial communications are affected

• Only applies to communication that is harmful to minors

– Non-compliance with the COPA results in criminal and civil penalties, including fines and imprisonment.

– Allows for good faith defenses, including credit/debit cards, adult access code, or adult PIN, digital certificate that verifies age, etc.

MSIA711.04 32


• COPA Challenged:– Did not fix the CDA problems

– Congress attempted to use internet technology to verify age and distinguish minors from adults, as an attempt to fix the CDA problems of “too burdensome.”

– District Court stayed COPA, after finding that the Constitutional issues raised by plaintiffs (ACLU and others) have a good chance at succeeding when the case makes it to the Supreme Court.

– Is it possible to craft a statute that protects children online from indecent communication?

MSIA711.04 33

FIRST AMENDMENT RIGHTS V.THE NEED TO PROTECT CHILDREN

• Methods used by websites to obtain info from kids:– Info needed to chat with fictitious cartoon characters

– Info needed to play games, enter contests and enter chat rooms

• 1996 FTC Workshop Conclusions:– Children are a special online audience

– Information collection from children raises special concerns

– A need to notify parents of web site information practices

– A need to provide parental control over info collected from kids

MSIA711.04 34

FIRST AMENDMENT RIGHTS V.THE NEED TO PROTECT CHILDREN

• DOJ/FBI Staff Report:– Child chat rooms are used by adult predators of children

– A reporter, posing as a known child murderer, obtained a list of 5,000 children living in various neighborhoods

MSIA711.04 35

The FTC’s “Son of COPA”

• The FTC’s Child Online Privacy Protection Rule (4/2000)– Supplements COPA

• Definitions follow COPA, but account for developing technology• Notice is further required at each site, and specified• Operator prohibited from conditioning child participation on personal

information disclosure

– Added procedural sense to COPA• Operators must make a good faith effort to obtain “verifiable parental

consent” before information can be taken and stored from children• Reasonable exceptions, triggered by good faith efforts on the part of

operators, remove the objectionable aspects of COPA• FTC rules received positive acclaim from the privacy lobby as a

reasonable compromise to COPA’s draconian measures.

MSIA711.04 36

FBI Crackdown on Predators of Children, and Child Pornography

• FBI “Innocent Images” Program– Launched in 1994, the FBI discovered that pedophiles frequently

share child pornographic materials through elaborate encryption schemes. Also, packs of predators would hunt children online.

– FBI agents, posing as children, conducted online sting operations

• Results (1997 numbers):– 200 search warrants

– 40 consensual searches

– 91 arrests

– 83 felony convictions

– By 1999, 1,497 cases were opened, yielding 532 arrests.

MSIA711.04 37

The Effectiveness of Protecting Our Children’s Privacy Online

• CDA, COPA: Wrapped up in Court Challenges• FTC’s Rules:

– Violators don’t take rules seriously: estimated 88% of the most popular children’s sites still collect personal information from children without parental consent.

– Systematic detection is not technically feasible right now.

• Self-regulation?– TrustE and BBB guidelines work well, but parents and children

must be diligent to allow kids to use websites that contain those service marks, exclusively.

– If parents were diligent in the first place, would COPA and the FTC regulations be necessary?

MSIA711.04 38

GOVERNMENT ENFORCEMENT

• Federal– FTC, FCC, DOJ, BATF, Dept. of Commerce

• State: – Consumer protection laws, tax laws

• Local– Courts (enforce contracts0

• International: – Treaties (e.g., WTO/World Court)

MSIA711.04 39

Criminal Liability

• Laws to Combat Internet Crimes:

• Hacking Cracking:– Counterfeit Access Device and Computer Fraud and Abuse Law fo

1984; Computer Fraud and Abuse Act of 1986

– National Information Infrastructure Protection Act of 1996:• Applies to computers and computers attached to the internet in one or

multiple states. Codified at 18 USC §1030 et seq.

• Prohibits computer espionage and theft of financial information.

• Prohibits theft of U.S. government information and information from protected computers and hacking.

• Makes computer fraud and trespass illegal.

• Outlaws password trafficking and computer extortion.

MSIA711.04 40

Criminal Liability

• National Stolen Property Act– Covers illegal fund transfers and software transmission.

• Electronic Communications Privacy Act of 1986 (ECPA)– Bars illegal surveillance and unauthorized access to data.

• Fraud (statutes):– Federal Trade Commission Act– Clayton Act– Truth in Lending Act– Fair Credit Billing Act– Fair Credit Reporting Act– Telephone Disclosure and Dispute Resolutions Act

MSIA711.04 41

Criminal Liability

• Fraud (400 FTC regulations covering specific transactions) for example:– Used car rule

– Franchise rule

– Telemarketing sales rule

– The “Ten dot.cons”

• Cyberstalking: – Executive Order 13133, Unlawful Conduct Using the Internet

• Theft of Intellectual Property– No Electronic Theft Act

– Economic Espionage Act

– Copyright Felony Act

MSIA711.04 42

INTERNET FRAUDFTC’s Dot.com Disclosures: Information

about Online Advertising• The same consumer protection laws that apply to

commercial activities in other media apply online– No “unfair or deceptive acts or practices”

– FTC issues rules and guides for specific industries and subject areas, e.g., telemarketing, vitamin supplements and travel agencies.

– The “Plain Language” rule

– “Clear and conspicuous disclosure” rule

– Duty to communicate with customers can be satisfied online: ship goods when promised or otherwise within 30 days, negative option communications, written warranty obligations

MSIA711.04 43


about Online Advertising• To Guaranty that disclosures are not misleading,

advertisers should consider:– The Placement of the disclosure in an ad and its proximity to the

relevant claim.

– The Prominence of the disclosure

– Whether items in other parts of the ad distract attention from the disclosure

– Whether the ad is so lengthy that the disclosure needs to be repeated

– Audio disclosures are in appropriate volume and cadence

– Visual disclosures are of sufficient duration

MSIA711.04 44


about Online Advertising• To make a disclosure clear and conspicuous, advertisers

should:– Place disclosures near, and when possible, on the same screen as

the triggering claim

– Use text or visual cues to encourage consumers to scroll down a Web page when it is necessary to view a disclosure

– When using hyperlinks to view a disclosure:• Make the link obvious * Label the hyperlink appropriately

• Use consistent styles so the customer knows they are there

• Place the hyperlink near relevant info * Make it noticeable

• Take consumers directly to the disclosure on the click-thru page

• Assess effectiveness - monitor click-thru rates and change if needed

MSIA711.04 45


about Online Advertising• To make a disclosure is clear and conspicuous, advertisers

should (continued):– Recognize and respond to any technological limitation or unique

disclosure techniques, such as frames or pop-ups

– Display disclosures prior to purchase, and don’t necessarily restrict them to the order page

– Creatively incorporate disclosures in banner ads or disclose them clearly and conspicuously on the page the banner ad links to.

– Prominently display disclosures so they are noticeable by consumers, and evaluate their size, color, and graphic treatment

– Ensure that the text, graphics, hyperlinks, or sound do not distract consumers’ attention from the disclosure.

MSIA711.04 46


about Online Advertising• To make sure that disclosures are clear and conspicuous,

advertisers should (continued):– Repeat disclosures as needed on lengthy websites and in

connection with repeated claims.

– Use audio disclosures when making audio claims, and present them in a volume and a cadence so that consumers can hear and understand them

– Display visual disclosures long enough for consumers to notice, read, and understand them.

– Use clear language and syntax so that consumers understand the disclosures.

MSIA711.04 47


about Online Advertising• FTC rules and guides that use specific terms: “written,” “writing,”

“printed” or “direct mail” are adaptable to the internet– Rules and guides that apply to written ads or printed materials also apply

to visual text displayed on the Internet.

– If a seller uses email to comply with Commission rule or guide notice requirements, the seller should ensure that consumers understand that they will receive such information by email and provide it in a form that consumers can retain.

– “Direct Mail” solicitations include e-mail. If an email invites consumers to call the sender to purchase goods or services, that telephone call and subsequent sale must comply with the Telemarketing Sales rule requirement.

MSIA711.04 48

Spies and Saboteurs

• Insiders - the Disgruntled Employee– “Adelyn loves Larry,” so Larry fires Adelyn

• Larry Ellison, Oracle’s CEO had an alleged affair with an employee, Adelyn Lee. After an unsuccessful date, Larry has Adelyn fired.

• Adelyn sues Oracle for wrongful dismissal, after producing numerous e-mail messages between them and between Larry and the guy he ordered to fire Adelyn. She wins $100k.

• County prosecutors found evidence, however, that Adelyn herself created those incriminating e-mails. She was found guilty of felony perjury, had to give the $100K back, and spent a few months in jail.

MSIA711.04 49

Spies and Saboteurs

• The Disgruntled Employee– “Omega Man,” Tim Allen Lloyd

• Omega Engineering Corp. serves NASA and the USN; lost $10 million due to Lloyd’s software “time bomb” that “exploded” two weeks after Lloyd was terminated by Omega.

• Lloyd went from “hero to zero,” lashing out at his colleagues both physically and verbally; bottlenecked projects that he wasn’t placed in charge of, and even knowingly loaded faulty programs to make co-workers look bad. He was written up twice, demoted, and terminated.

• Lloyd was convicted and sent to jail.

MSIA711.04 50

Cyber Muggers and Molesters

• Identity Theft– Adelaide Andrews

• Investment researcher began receiving disturbing phone calls from money lenders and collection agencies looking for payments she had no idea that she owed. Situation grew worse: her application for refinancing her home mortgage was rejected, because the bank said she was a bad credit risk. IRS informed her she owed taxes on income she never earned. There was even a Nevada arrest warrant for domestic battery issued against her.

• Someone used her identity to establish credit lines of up to $100k, rented apartments, set up utilities, and took in income.

• Adelaide hired a PI to track down the identity thief, whom she suspected.

MSIA711.04 51

Criminal Liability

• The Identity Theft Epidemic– Trans Union consumer complaints rose from 35,236 in 1992 to

522,922 in 1997.

– Techniques:• Chinese method: hack into databases to compromise credit cards and

identity details (Social Security Numbers are biggest prize).

• Nigerian method: bribe bank officials to obtain customer information.

• How to Prevent Identity Theft:– Call 888.567.8688 and request that your name be removed from

marketing lists to reduce the number of pre-approved credit card applications that you receive via snail mail.

– Protect your SSN and check your credit reports annually.

MSIA711.04 52

Criminal Liability

• How to Prevent Identity Theft (continued):– Credit reporters that need to be checked annually:

• Equifax <www.equifax.com>, fraud line 800.997.2493

• Experian <www.experian.com>, 888.397.3742

• Trans Union: <www.transunion.com>, fraud line 800.680.7289

• What to do if you become a victim:– Secret Service’s tips (<www.treas.gov/usss/>):

• Report the crime to your local police immediately, and obtain a case number that banks and financial outfits will ask for, later.

• Contact immediately your credit card issuers, and get replacement cards with new account numbers; close out existing accounts “by customer request. Follow up these requests in writing.

• Report theft to the credit reporters above, and have accounts flagged.

MSIA711.04 53

Criminal Liability

• What to do if you become an Identity Fraud Victim(cont’d)– File a complaint with the FTC:

• The FTC has no statutory authority to bring a criminal case against an identity thief, but it has vast resources to investigate theft and gather evidence against identity thieves. It can also refer your complaint and the evidence to the FBI, Secret Service, and others.

• Consumer Response Center, Federal Trade Commission, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580.

• <www.ftc.gov/ftc/complaint.htm>

• 877.382.4357

msia711.041 e- enterprise liability liability requirements (how to incur liability): –by law –by...

Documents