Complaint resolution service publishes case studies, recall information and consumer news.

One year after testing whole body imaging at New York’s Staten Island Ferry and weeks after a pilot program in the busy Phoenix airport, the US Transportation Security Administration is ready to start getting a closer look at consumers traveling.

For consumers who have been “patted down” or “frisked” while traveling, the new machine may seem like an alternative to an undignified position some travelers undergo because of their undergarments, medical devices or similarly benign issues. We wholeheartedly endorse national security and understand the need for stringent measures, but more than one consumer has shared with us that being frisked in the middle of a crowded public facility is unpleasant at best and often embarrassing.

Hand-held metal detectors are often used in such cases, but a nervous twitch can cause the machine to come in contact with a traveler’s ’s body. And while many consumers seem resigned to shuck off their shoes and travel through the airport in stockinged or (heaven help us) bare feet, removing jackets, belts and other clothing is often time-consuming at best.

“I like belts with big buckles,” one consumer recently told me. “I can’t wear them to the airport though because I have to take off my coat, my shoes, my belt and put my computer in a tray. I used to be able to just undo the buckle and show them the back, but now I have to take it off, and it’s not worth the hassle.”

Whole body imaging is supposed to replace the need for a pat-down although other measures will still be in force. Many travel and privacy advocates say a whole body image invades a consumer’s privacy, but federal officials counter with a statistic that 90% of travelers subjected to the process in Phoenix preferred it to a “pat down” or similar measures.

The TSA also says that they will not maintain or store records of any captured images, but that doesn’t address the point that the consumer is, well, exposed, for a time to strangers.

The image on the left is representative of what the TSA says its officers will see. With paperless bordering passes and other biometrics processes quickly being tested throughout the nation, we want to believe that this image isn’t stored, but we also wanted to believe that doctors wouldn’t read a celebrity’s medical file and IRS employees wouldn’t snoop through the taxes of the rich and famous.

Without more explanation of what safeguards are in place to protect a consumer’s privacy, whole body imaging is a promising idea we can’t yet support. Once we learn that images will never be associated with personally identifyig information and that no mechanism exists to save the image, we would be more willing to endorse and embrace this idea.

There clearly isn’t enough time for that public reassurance, however, because the government has announced that travelers moving through Los Angeles’ LAX or New York’s JFK airports will soon be subjected to whole body imaging or being frisked if they set off a detector.

Apparently willing to base taxpayer dollars and consumer acceptance on a limited one airport test, the TSA has also reportedly ordered 30 more machines for use in other airports this year.

Posted under Travel

Guidance Software Inc. has agreed to settle Federal Trade Commission charges that its failure to take reasonable security measures to protect sensitive customer data contradicted security promises made on its Web site and violated federal law. According to the FTC, Guidance’s data-security failure allowed hackers to access sensitive credit card information for thousands of consumers. The settlement will require the company to implement a comprehensive information-security program and obtain audits by an independent third-party security professional every other year for 10 years.

Guidance sells software and related training, materials, and services customers use to investigate and respond to computer breaches and other security incidents.

According to the FTC complaint, Guidance failed to implement simple, inexpensive and readily available security measures to protect consumers’ data. In contrast to claims about data security made on Guidance’s Web site, the company created unnecessary risks to credit card information by permanently storing it in clear readable text. In addition, the complaint alleges that Guidance failed to protect the information by:

* failing to assess adequately the vulnerability of its network to commonly known or reasonably foreseeable Web-based attacks, such as structured query language injection attacks;

* failing to implement simple, low-cost, and readily available defenses to such attacks;

* storing in clear, readable text network administrator credentials, such as user name and password, that facilitated access to credit card information stored on the network;

* failing to use readily available security measures to monitor and limit access from the corporate network to the Internet; and

* failing to employ measures to detect unauthorized access to consumers’ credit card information.

The settlement bars misrepresentations about security measures in the future and requires Guidance to establish and maintain a comprehensive information-security program that includes administrative, technical, and physical safeguards. The settlement also requires Guidance to obtain, every two years for the next 10 years, an audit from a qualified, independent, third-party professional to assure that its security program meets the standards of the order. The company also will be subject to standard record keeping and reporting provisions to allow the FTC to monitor compliance.

Posted under Privacy

An April 15 report by the United States Government Accountability Office found that the Internal Revenue Service had corrected 32 of 53 weaknesses cited in a 2002 review of the agency information security structure.

The GAO announced that in addition to the IRS’ failure to correct 21 deficiencies, the tax agency has 39 “security control weaknesses” that “impair….confidentiality, integrity, and availability of its sensitive financial and taxpayer data.” The GAO report states that the IRS cannot completely assure taxpayers that their personal information is secure.

The full text of the 30 page report can be found in a PDF at:

http://www.gao.gov/new.items/d05482.pdf

Posted under Finance