Trilight Zone

[tricore]

When you get a lot of e-mail, you get a lot of phishing attacks. It's hard not to see the constant barrage and draw the conclusion that it's widespread. Clearly, the attempts to steal someone's identity are extensive. But how common are actual identity thefts, and how many of them are high-tech thefts? Fred Cate, Director of the Indiana University Center for Applied Cybersecurity Research, argues in the Washington Post that the threat is exaggerated in the media. The most overstated fear is of data compromises, such as the recent rash of lost and stolen government laptop computers. Actual research indicates that account holders compromised in those thefts were actually no more likely than anyone else to have their identities stolen. The target in the famous VA computer theft case was the computer, not the data. Cate also shows that most identity theft is mundane and low-tech; most cases in which the perpetrator is identified involve a family member, relative, friend, or neighbor. Victims identify the most common source of theft as a "lost or stolen wallet, checkbook, or credit card."

All of this makes sense, and it's good news. Most criminals aren't the evil high-tech geniuses you see on TV. Two-thirds of cases involve credit card fraud, which limits consumer liability and helps to identify the perpetrator.

When Cate says that "The Justice Department estimates that there were only 538,700 cases of true identity theft (those in which personal information was used to open accounts in the victim's name) in the second half of 2004," one can be leery. That looks like a large number, even for a country as big as the U.S. and even if, as he claims, the numbers are trending down.

It would be a mistake to read Cate as arguing that protective measures against phishing and other electronic forms of identity theft are a waste. Quite the contrary. One would assume that if the numbers are trending downward, it's because of measures, electronic and otherwise, taken to combat identity theft. More widespread and sophisticated application of these measures could save time, money, and aggravation for consumers and corporations victimized by thefts.

The corporate world is in the same boat the with consumers who are victims of identity theft. They experience the costs of non-compensation for goods, administrative overhead, and often the misuse and dilution of their brands.

One can read Cate's analysis as encouraging news that we can cut identity theft even more as we work harder at it.