Clarke: ID theft prevention tied to anti-terrorism efforts

Kevin Rademacher

Wednesday, April 13, 2005 | 10:44 a.m.

Business efforts to prevent identity theft, protect privacy and secure financial accounts are closely tied to the nation's homeland security strategies, a leading counterterrorism expert said.

Richard Clarke, former counterterrorism czar for presidents George W. Bush and Bill Clinton, said that the risk of terrorist attacks in the United States continue. He pointed out that recent attacks in other countries were funded through financial crimes.

"The Bali bombing was funded by criminal acts ... like credit card fraud," Clarke said on Tuesday at the CardTech/SecurTech conference in Las Vegas.

He pointed to a series of high-profile security breaches in the United States, including the ongoing revelations about compromised consumer information by data provider LexisNexis, as national vulnerabilities that need to be shored up.

Clarke, who left the Bush administration in 2003 and wrote the book "Against All Enemies," which criticized the president's handling of terror threats prior to Sept. 11, 2001, described the financial and identity threats alongside weaknesses in protecting other possible U.S. targets, such as chemical manufacturers.

"We are vulnerable to people who would use our chemicals against us," he said. "We are vulnerable to people who would use our airplanes against us, and we are vulnerable to people who would use our identities against us."

He went on to criticize U.S. enterprises for their reluctance to adopt more stringent security measures. That delay was blamed on a long-standing resistance to broad federal guidelines. He challenged conference attendees to press for greater security.

"You've got a problem you need to overcome, not just for your industry but for the sake of our country, that's that this is a country that fears big government," he said.

Clark also cautioned that just because the United States has avoided a terrorist strike since the Sept. 11 attacks, that doesn't mean the country is no longer a target.

"The threat isn't over by any means," he said.

Clarke explained that while al-Qaida has been smashed a series of offspring groups is thriving.

"The resentment caused by the invasion of Iraq ... provides motivation for them," he said. "The second wave of attacks comes two or three years later ... and it comes at a time we've been lulled into thinking it's over."

Don Davis, chief editor of Card Technology magazine, said that countries such as the United Kingdom and Canada are ahead of the United States in taking up more secure methods of identity protection.

In the United Kingdom a national push has seen to it that 100 million smart cards have been issued and that 71 percent of that country's consumers expect to use such a device with their next transaction.

Smart cards can incorporate secondary identity confirmation such as fingerprints or personal identification numbers to make transactions that were once handled with card swipes and signatures. They can also prevent -- through transmission of secondary information along with the transaction information -- thieves from copying cards or card numbers and using them to make unauthorized purchases.

Similar technology, such as devices that generate random password numbers for accessing computer networks, can prevent hackers from breaking into systems and stealing stored information.

Canada has set a deadline of 2010 to transition from swipe cards to smart cards.

Industry experts said that as other nations step forward, the pressure will increase on the United States to take action.

Francois Lasnier is a vice president with Axalto, an industry leader in developing smart card technology.

"We have substantial data showing fraud migration," he said. "When the U.K. adopted new technology it moved to other countries. Fraud has declined in the U.K. Mexico is migrating to new technology as well. In the U.S. we're going to see pressure to migrate as well."

Clarke said a move by the federal government to mandate that all federal employees and contractors convert to smart card identification should speed the adoption in other U.S. industries.

"We will look back three years from now and say (that) was the break through," he said.

In the meantime, Clarke said consumers should protect their identities at every step and demand better security from vendors. He said he ordered the company managing his stock portfolio to disable all online access to his account because they could not provide "two-factor" authorization.

"That's my life savings," Clarke said. "Even I can crack a (personal identification number) code in two minutes."

Craig Ronzone, a detective with the Nevada Department of Public Safety's Investigations Division, said a significant problem in the past has been that the same companies that create security measures also sell devices designed to bypass it. He pointed to the same companies that make radar guns and radar detectors as an example.

"If you are going to feed one side, you're going to have to starve the other," Ronzone said, who is assigned to the Nevada Cyber Crimes Task Force.

He added that it is likely to be a never-ending battle. "Everything advances every day. We need to keep on top of it."

He also criticized banks that have experienced system intrusions but declined to have it investigated for fear of publicity that could scare away customers and stock holders.

"Instead of trying to pursue it, they write it off," he said. "The bottom line is the money."

Ronzone said that while the efforts to protect identities and financial information are advancing, his office gets busier each year, investigating 531 cases in the past 30 months.

"It is getting better, but we need to continue," he said. "We are still behind the curve."

He recommended that people be judicious about giving out their personal information.

"To me, businesses are probably asking for too much information," he said, pointing to the common practice of asking for a driver's license with a check. "A check card should be enough."

Better yet, he said, use a debit card. He also cautioned consumers on the amount of information printed on their checks.

"People have their whole life story on there, from their address and phone number to the college they received their MBA degree from," he said.