News Release
Ottawa, July 10, 2007 – Recent experience
has shown Canadian companies must take precautions to ensure personal
information and customer data is not vulnerable to data thieves
and pretexters. Strong identification and authentication procedures
are essential in blocking unauthorized attempts to access the personal
information of Canadians.
An investigation by the Office of the Privacy Commissioner of Canada
(OPC) has found that human error and weaknesses in the policies and
procedures of three telecommunications companies allowed a data broker
to gain unauthorized access to personal phone records.
The investigation was prompted by an article in Maclean’s alleging
the magazine had been able to purchase the telephone records of Privacy
Commissioner Jennifer Stoddart and a senior Maclean’s editor from
US-based data broker Locatecell.com.
The investigation found that Locatecell.com used “social engineering” to
trick phone company customer service representatives into divulging
confidential information, either in the specific instances alleged and/or
subsequent test cases. Social engineering involves manipulating
people into divulging personal information, for example, by pretexting,
or pretending to be someone authorized to obtain the information.
The OPC looked at improper disclosures of personal information to pretexters
seeking to gain unauthorized access to phone records of individuals
without their knowledge or consent. The three companies investigated
were Bell Canada, Telus Mobility and Fido.
“In each case, we found that customer service representatives
had not followed the companies’ established authentication
procedures. We also found that training of customer service
representatives was not comprehensive enough to protect customers’ personal
information from illegal access by pretexters,” says Assistant
Commissioner Raymond D’Aoust. “As a result, the three
companies failed to meet the requirements of the Protection
of Personal Information and Electronic Documents Act (PIPEDA).”
All three companies revised their customer authentication procedures
shortly after the disclosures took place. The OPC reviewed
those changes and recommended further steps to address weaknesses
in their policies and procedures to prevent unauthorized individuals
from gaining access to customers’ personal information. All
three companies have since taken additional steps to further mitigate
the risks resulting from pretexting and unauthorized access to
personal records. The Office of the Privacy Commissioner
is generally satisfied that all three companies have put in place
an adequate set of measures to address the problems.
Nonetheless, the Assistant Commissioner says the companies should
have been better prepared to deal with social engineering in the
first place. The issue of data brokers using social engineering
to obtain call records in the United States had been in the news
some time before these incidents occurred.
“It’s particularly troubling that not enough was
done to let call centre employees know about this kind of threat,” says
Assistant Commissioner D’Aoust.
“Given the prevalence of identity theft, it is absolutely
crucial that all companies adopt strong authentication processes
to help ensure that they are providing information to someone
who is actually authorized to have that information. It
is equally vital that companies ensure that their employees are
following these processes and are aware of the threats to personal
information that pretexting poses.”
The OPC has developed Guidelines
for Identification and Authentication on its
web site.
A summary of findings in the three cases is also available on
the web site.
New laws in the US have recently made it an offence to use pretexting
to obtain individuals’ phone records in an effort to curb
the activities of US information brokers, including Locatecell.com. However,
this does not mean the problem has gone away either in the US,
or elsewhere, particularly in other countries, including Canada,
where no similar legislation yet exists.
In an appearance before a Parliamentary committee last month,
Commissioner Stoddart called on the federal government to work
collaboratively with the provinces and international partners
to adopt a range of legislative and policy solutions to address
this problem.
The Privacy Commissioner of Canada is mandated by Parliament to
act as an ombudsman, advocate and guardian of privacy and the protection
of personal information rights of Canadians.
— 30 —
For more information and/or media interview requests, contact:
Colin McKay, Office of the Privacy Commissioner of Canada
Tel: (613) 995-0103
E-mail: cmckay@privcom.gc.ca
