Bank Lawyer's Blog

One Woman's James Bond Is Another Woman's Trojan Horse

In what might have seemed like a good idea after she downed her third scotch-and-soda, Tanya Blackwell, a foreclosure defense attorney, got a job at GMAC’s Ally Financial and, according to allegations by Ally, proceeded to grab all the confidential information of Ally’s she could lay her hands on and shoot it out the door to third parties, presumably to aid the employee’s law firm and others in fighting residential loan foreclosures commenced by Ally against delinquent borrowers. Those activities not only got her fired, they got her sued. Last Friday afternoon, Ally and the defendant stipulated to a preliminary injunction pursuant to which “Blackwell is forbidden from ‘using, disclosing, disseminating or transmitting’ any of Ally’s proprietary information or destroying any information that would apply to this case,” and “she must also within 48 hours return any proprietary information to Ally and give her former employer all of her email passwords for accounts that contain information related to Ally.”

I may be wrong, but I don’t think this will turn out well for Ms. Blackwell. Her sanctions may not end with an adverse judgment or settlement in the civil litigation filed by Ally. I wouldn’t be surprised to see further repercussions.

 As for Ally Financial, I guess it doesn’t use a social media review procedure as part of its pre-hiring due diligence process. I understand that some employment law attorneys have advised their clients not to review social media sites like Facebook, Twitter or MySpace for fear that the employer will uncover such impermissible information as race, age, or sex and be sued if it decides not to hire the prospective employee. I respectfully disagree with that approach, and believe that those risks can be managed. In fact, I think the weightier argument is that the employer may be deemed negligent if it doesn’t review social media sites.

Look at the case of Ms. Blackwell and Ally. Ms. Blackwell’s Facebook page makes it very clear that she’s all about representing the borrower against the lender. Is that someone a mortgage lender would think is a perfect fit for its in-house legal staff?

There have been a number of articles recently that profile social media “scouring” and the third party vendors who provide this service. As one employment law attorney opines, you’re probably better off using a professional who can filter out the impermissible information and only pass along the squeaky clean stuff to you.

“It’s probably safer to work with a company to do the checks because that is what they are in the business of doing,” Potter said. “They understand the rules.”

Whether you hire a third party or "roll your own," to me, there’s more risk in not doing a social media check that there is in doing one.

The Home Stretch

Yesterday, WilmerHale put out one of those short client alerts that doesn't bore bankers with its excruciating in-depth analysis of some esoteric nuance of Dodd-Frank. Instead, it basically points out to bankers who've been living in caves or strung out on a drug of their choice that they've got one month to wake up and smell the deadlines. Three deadlines, to be precise.

First, December 31, 2010 is the red letter day when the FTC will FINALLY (and they mean it this time) start enforcing their Red Flags Rule. If you don't what a "red flag" is by know, pray to the deity of your choice, because you'll need his, her, or its help.

Second, January 1, 2011 marks the day that banks must use the model privacy notice form if they want to have the benefit of the GLBA "safe harbor." Again, if any banker doesn't know what I'm talking about, grab your closest bank regulatory lawyer and ask him about civil money penalties.

Finally, January 1, 2011 is also the day that the FRB/FTC joint rules governing the risk-based pricing notice mandated by the FACT Act will go into effect. The rules set forth what types of information the notices must contain and what alternative information or exceptions might apply.

These deadlines have been approaching for some time now, and you'd think every affected financial institution would have been prepared for them by this point, so that a Chinese fire drill could be avoided during a month when vast quantities of eggnog should be consumed and mistletoe should be hung at completely inappropriate places throughout the office. But as we saw four years ago when the multi-factor authentication "guidance" deadlines approached, then passed, with some bankers taking an "ignorance-is-bliss" or "What, me worry?" attitude toward the whole affair, I'm sure they'll be a few bankers who've patterned their professional careers after John Belusi's character in Animal House, and have spent the last several years smashing beer cans against their foreheads instead of worrying about these petty deadlines.

WilmerHale offers these slackers a helping hand.

If you have questions about compliance requirements for the FTC's Red Flags Rule, use of model privacy notices or compliance with GLBA privacy rules, or proper implementation of the FACT Act risk-based pricing rule, please do not hesitate to contact us.

Or wait, and then hire them later to defend you against regulatory enforcement actions. You can pay them now, or pay them later.

Odds and Ends

Tomorrow's a bank holiday and because of that I expect traffic to be light for the rest of the week. For those who do stop by over the next couple of days, however, I provide the following "quick hits" to a few items that might be of interest:

• The American Banker's Jeff Horwitz has an investigative piece in today's edition that the editors have taken outside the firewall (in other words, access to the article is free). Jeff's looked under some rocks in the field of residential mortgage servicing and he's found that false affidavits and sloppy foreclosure processing paperwork aren't the only things that have come scurrying out. A scandal-in-the-making could be the matter of "forced-placed insurance" and the unholy alliance between servicers and insurers. There's enough here to trouble not only borrower's and their counsel, but also federal regulators (including HUD, which smells RESPA burning), state insurance supervisors, and investors. Sometimes it takes a financial disaster to uncover the worst facets of a business that were covered up and let slide when real estate values were rising like a Dallas socialite's hairdo. I can't believe this is the last piece we're going to read on this subject.
• At last month's BAI Retail Deliver conference, "mobile banking" was such a hot topic that it should have come with its own fire extinguisher. Tracy Kitten at The Farud Blog looks at the security vulnerabilities in mobile banking and finds plenty of blame to go around.
• Linda McGlasson of The Agency Insider blog examines other security threats, these to debit and credit cards. "Flash Attacks" and "Blitz Attacks" might sound like subjects that would be of concern to the US military; however, its banks and their customers that are the victims. Linda speaks the truth when she warns that "criminals are continuing to evolve their attack methods and the technology used to commit the fraud." It's a never-ending battle and bankers have to keep on top of it.
• Edwards Angell Palmer & Dodge has a nice client advisory on the FTC's "red flag rules" that go into effect December 31, 2010. By now, all financial institutions should have been all over this subject matter, but as we saw with multi-factor authentication a couple of years ago, there are always laggards. As the firm points out, the definitional net of "financial institutions" is cast far and wide.
• On November 16, I'll be moderating a panel on a webinar for Bank Law Stuff that will discuss how banks and other financial institutions should handle crisis communications to meet the expectations of the banking regulators and to survive PR perils when "bad things happen to good banks." The panelists will be Sharlyn Lauby, president of ITM Group of Ft. Lauderdale, Florida, and Tom Bieging, a long-time banking lawyer and counsel to the Independent Bankers of Colorado. I'll be throwing in my two cents worth (or, if I'm lucky, four cents worth), as well.

Have a great day off and a great weekend.

What We Have Here Is A Failure To Truncate

The Wall Street Journal's Law Blog had an update last Friday about the status of class action lawsuits filed by aggrieved consumers (in other words, by class action attorneys who've "discovered" lead plaintiffs) to punish merchants who left too much information on electronically-printed credit card receipts in violation of the Fair and Accurate Credit Transactions Act (FACTA). Oddly, the Law Blog's link to FACTA ties to a Yahoo article by Chris Kelleher ("an award-winning small-business advisor and attorney") about the disposal requirements of FACTA, not the truncation requirements. Oh well, "close" is enough in horseshoes and law blogging, right?

The latest post is an update of a post earlier in April that discussed a split in lower courts, with one trial court denying class action status partly on the basis of an "annihilation defense" (class action damages would "annihilate" the defendant), and another court declining to strike down class certification on that basis. One commenter to that post points out that the "overwhelming majority" of the 300 class action lawsuits filed involve the failure to delete the expiration date of the consumer's credit card on the receipt, not all but the last five digits of the credit card number. The commenter alleges that "[t]he expiration date is of NO benefit to an identity thief..." I'm not certain that's correct, since it's one piece of information that, taken with others, can aid an identity thief. Moreover, its elimination is technically required by FACTA, and the failure to delete it exposes these defendants to between $100 and $1,000 per class plaintiff (and, of course, the always-beneficial-to-society class action attorneys' fees), so there you have it. If the plaintiffs can prove reckless or willful disregard for the law, then the upper limit of damages is a real possibility.

A commenter to the earlier post who claims to be an attorney whose firm is defending some of these suits makes the claim that the liability should be covered by the retailer's liability insurance, and, therefore, "so as long as we can keep the settlements reasonable, it won’t spell the end of the companies (just their ability to acquire reasonably-priced insurance in the future)." That's certainly a very practical take on the problem. Once again, the insurance company pays over the short run, but everybody pays over the long run through higher premiums, although this isn't an issue that's likely to be recurring, is it?

It might be because I followed FACTA so closely for some of my clients, but I'm not sympathetic to the ignorance of retailers, especially some of the large ones, who claim ignorance of the law (never a sufficient excuse in any event). In an article in last April's WSJ, an attorney for a retailers trade group blamed credit card companies for doing a lousy job of notifying retailers. I thought that was the job of retailers trade groups.  I simply don't see the equities lying in favor of the businesses in this case. With identity theft such a high profile crime, and with the  lead time provided to businesses to comply, the stick-your-head-in-the-sand approach doesn't seem to garner much sympathy, notwithstanding the fact that, once again, it's our favorite punching bag, class action plaintiffs' attorneys, trolling town for consumers with "nontruncated" credit card receipts.

At least one commenter claimed that class action litigation caused companies to change their practices, which is undoubtedly true, and which is used a justification for class actions. Ironically, a publication from September 2007 on this topic by Jones Day offers "prompt corrective action" as a tactic for defeating class action status.

At least two federal district court judges have denied class certification for these types of cases. When comparing the plaintiffs' failure to show any actual harm against the potential harm to the defendants in the tens of millions to hundreds of millions of dollars, the court determined that class actions were not the best method to adjudicate these claims...That both defendants immediately corrected their error upon filing of the complaints served as a major consideration behind these decisions...

Maybe an indication as to how much of a non-issue this hubbub might eventually turn out to be is demonstrated by the settlement outlined in the most recent Law Blog post.

In a settlement approved on Tuesday in the Western District of Pennsylvania, Kings Family Restaurant agreed to offer the plaintiff-class one of the following four options:

• a free ‘appeteaser’ and a free mini-sundae, with a retail value of up to $ 4.68; or

• a free homemade bowl of soup and a free slice of apple or pumpkin pie, with a retail value of up to $ 4.78; or

• a free cup of soup and a free ‘appeteaser,’ with a retail value of up to $ 4.38; or

• a free dinner salad and a free single scoop of Kings Premium Ice Cream, with a retail value of up to $ 4.38.

According to the opinion, defendant has further agreed to donate 500 gift certificates for kids’ soft drinks, with a retail value of $ 0.99 per drink, to First Tee, a non-profit organization which offers underprivileged children the opportunity to play golf. Defendant also agreed to pay plaintiffs attorneys fees and costs not to exceed $75,000.

The Law Blog states that only 165 class members (less than 1% of the class) obtained "coupons" (I assume the author meant the right to obtain the free "goodies" offered by the restaurant), which meant that the attorneys fees exceeded the recovery by 100 to 1. That's a relatively sweet deal for the lawyers, but not much reward for the class members, unless you're into "appeteasers."

As a parting observation, you have to love the comment by one anonymous person, presumably a lawyer: "I say 75 k is not worth my time." No wonder so many people hate lawyers.

More Accurate Identity Theft Reporting By Banks: The Opening Salvo

Last year, Chris Hoofnagle, Senior Staff Attorney, Samuelson Law, Technology & Public Policy Clinic and Senior Fellow, Berkeley Center for Law and Technology, University of California-Berkeley Boalt Hall School of Law, published an article in the Harvard Journal of Law & Technology entitled "Identity Theft: Making the Known Unknowns Known." Essentially, Chris argues that we have little public information available on the extent of the problem of identity theft crimes against bank customers, either in the form of "new account fraud" (where an impostor opens an account in the victim's name) or "account takeover" (where an impostor uses an existing account, such as a credit card, to commit fraud). Although the FTC maintains information concerning reports by victims of identity theft, Chris argues that "financial institutions are in a better position [than victims of identity theft] to report information on identity theft."

Why, you might ask, is it necessary to have more detailed and accurate reports of this crime? Chris is glad that you asked.

First, it would identify the business practices most vulnerable to fraud. Second, it would help to identify the consumer protections that work and those that do not, and thus assist regulators and law enforcement agencies in allocating resources to combat the crime. Third, improved reporting would help focus public attention on the root causes of the crime. In particular, it could provide a potential counterpoint to the conclusions of some victim surveys that have relied on questionable assumptions and asserted that the fault for identity theft lies with the victims.

Finally, providing more accurate, institution-level statistics on identity theft would make the security of personal information a new product differentiator, similar to low interest rates and fee-free accounts. It would enable benchmarking of financial institutions using that factor so that consumers could tell which institutions have the highest and lowest rates of fraud. Assuming that the market is competitive, it is likely that lenders that provide the safest financial products would be rewarded with consumer loyalty. This rubric would also pressure institutions bearing the ignominious mark of having the most identity theft to adapt or to be driven from the marketplace.

Chris proposes that financial institutions be required to report three principal categories of information: (1) the number of identity theft incidents suffered or avoided; (2) the forms of identity theft attempted and the financial products targeted (e.g., mortgage loan or credit card); and (3) the amount of loss suffered or avoided.

Chris lays out a detailed argument as to why current data (including that gleaned from SARs, which is not public information in any event) is not sufficient, and why more detailed reporting by financial institutions would give regulators, law enforcement agencies and regulatory authorities a better picture of the extent of identity theft, which financial institutions appear to be more vulnerable to the crime, where bank regulatory and law enforcement efforts should be directed, and, finally, which institutions ought to be avoided by customers who are concerned about this form of crime.

I concede the validity of Chris's arguments that reporting by banks would provide more accurate data. However, I question whether consumers, as a practical reality, will alter their behavior based upon the results. I suspect that the entire issue of personal privacy is a lot like Mark Twain's observation about the weather: everyone talks about it and no one does anything about it. When I listen to speeches or read articles such as those by Professor Fred Cate of the Indiana University School of Law, that recount instances of consumers selling their personal information for Starbucks vouchers, I question whether consumers will really punish those banks that seem to be doing a poor job of meeting the challenge of identity theft.

On the other hand, I have no doubt that regulators would find a failure to take effective measures to prevent this crime to be an unsafe and unsound banking practice. Therefore, I think that more detailed reporting by banks to bank regulators (state and federal, as appropriate) would be beneficial. I'm certain that a nasty argument would break out as to whether national banks and federal thrifts should also report this information to state law enforcement authorities so that the Marc Dann's and Andy Cuomo's of the world can make political hay with it. Finally, I expect that skeptics of the current federal bank regulatory regime won't take much comfort in the prospect of relying on federal bank regulators to punish banks that are "guilty" of excessive identity theft. Many critics of the federal bank regulators will want a private right of action against banks, or at least a right of action by state attorneys general, in addition to federal enforcement.

I expect that banks, already burdened with BSA/Anti-Money Laundering reporting, and disillusioned with the apparent fruitlessness of much of the suspicious activity reporting that they currently make (recent federal regulatory protestations to the contrary notwithstanding), would fight hard against such detailed reporting requirements. Given the current credit crisis and the resulting pressure on capital and the bottom lines of many banks, the howls from the banking industry will be long and loud.

Chris also points out the difficulty of tracking "synthetic identity theft," which, we have previously noted, is becoming the identity theft crime of choice. I don't find a practical solution to the difficulties he presents, and I don't see an impetus on the part of financial institutions to voluntarily come up with such a solution. That will be a tough nut to crack.

I have a number of other issues, but lack the time at present to discuss them. I hope to get to them in future posts.

For those who might tend to brush off Chris's article as impractical "law professor posturing," they'll need to rethink any such out-of-hand dismissal. To force the hand of financial institutions, on February 26, 2008, Chris released a paper (download it here) entitled "Measuring Identity Theft at Top Banks." He used a FOIA request to the FTC to obtain data on identity theft reported by victims and, using that data, has compared the largest banks. He admits the problems with the data and with his methodologies, yet asserts that it's the best information available and an appropriate methodology to use in light of the lack of self-reporting by institutions. Among the biggest banks, HSBC, Bank of America and Wamu fair poorly, ING Bank very well.

I suppose that banks can try to ignore Professor Hoofnagle and hope that he goes away or is ignored. Then again, if gadflies like bloggers publicize his studies, and more main stream publications pick up on the results, banks may find themselves forced to start reporting more information as a matter of self defense. The "beauty part" of that result would be that Chris wouldn't have any skin in the game as to the accuracy or inaccuracy of his initial rankings using the limited information available. His ultimate goal is to force the acquisition and reporting of more accurate information so that more accurate rankings might be obtained. That being his goal, this opening salvo is quite a clever gambit.

UPDATE 03/11/08: An anal attentive commenter has pointed out the grievous error I made in incorrectly referring to the "Indiana University School of Law" as the "University of Indiana Law School." I have corrected this misnomer and beg the forgiveness of Hoosiers everywhere.

The Secret To Subprime

A problem that's stirred vast partisan debate, hate mail (or is that just my mail?), and downright demagoguery, has a simple answer, at least according to the leader of one small bank (paid subscription required).

As pundits blame everything and everyone — from Wall Street to the rating agencies to Alan Greenspan — for contributing to the mortgage crisis, Stephen Lange Ranzini says a simpler root cause has been overlooked: false advertising.

In an interview Tuesday, Mr. Ranzini, the president of the $86.8 million-asset University Bank in Ann Arbor, Mich., said ads promising bogus rates, published in places such as the weekly listings of mortgage rates in a local newspaper, are endemic to the industry — even among the "big firms" and "brand name identities."

The problem burgeoned in recent years with the advent of nontraditional loan products, he said. He recalled an ad for a 30-year loan with a 4% rate; it turned out that the rate was fixed for two years, then jumped to 7%. The ad "sounded fabulous," Mr. Ranzini said, but "it was completely false."

Of course, most lenders stopped offering hybrid adjustable-rate mortgages in recent months, as the secondary market dried up. Still, Mr Ranzini said, "I don't really see a big change" in the truthfulness of mortgage ads. "I just see that it's bad."

And here I thought that the definitive answer to why subprime went south was provided by the FDIC's Sheila Bair: the mortgage banking business model in which the originator sells the loan to a third party has a dysfunctional "transactional nature." Memo to Plato: what's the "Platonic" ideal form of mortgage banking toward which all earthly models of mortgage banking aspire? Is the "nature" of "mortgage banking" truly corrupt, or is it merely that no physical representation of the ideal form can be anything other than a poor imitation? These metaphysical concerns preoccupy the leader of a certain federal banking agency, so after you've reanimated yourself (and perhaps your guru, Socrates), would you give her your thoughts and maybe we can get back to the business of doing the business with which that agency is charged, like, oh, I don't know, approving a few ILC applications? Thanks.

Others have complained that subprime went sour because corrupt mortgage originators "did a bunch of junk" to poor, innocent borrowers. Some cynics have suggested that it's because lenders were greedy and borrowers were willing participants in schemes to obtain mortgages that anyone with an IQ above that of a cucumber would have realized they couldn't pay back. A small band of merry men, including a certain elevator-riding politician on the prowl for fresh interns, have railed that the fiasco is the fault of investors in mortgage-backed securities who supplied the fuel that kindled this fire, then set it to raging out of control.

Fools! All fools!

Big Steve, the Prez of an $86.8 million bank, says it was false advertising. Simple as that. Stop the false ads, you stop subprime abuse. I guess this calls for tougher laws on false advertising. Hi-ho, Steverino?

He does not advocate legislation to address the problem. Regulators are already overwhelmed with more pressing issues like mortgage fraud, he said, and "I can't say I'm a big fan of big regulations either." Instead, publishers, ad executives, and lenders could self-regulate by forming boards that would set standards and reprimand violators — much as the municipal bond rulemaking bodies do, he said.

I say! That's a great idea! Self-regulation. Yeah...yeah... "self-regulation." Yeah, that's the ticket! Self-regulate while you self-medicate! A great slogan for an astounding solution.

Let's apply that methodology to doctors, lawyers, accountants, and other professionals. They all have excellent "self-regulatory" bodies as it is, so let's do away with professional liability torts and resort to the courts.

Do I hear an "AMEN," brothers and sisters?

I think that Bank Lawyer's Blog has pretty convincingly proved that any piss-ant with Internet access can pop off to a wide audience and inflame fear and loathing not only in Las Vegas, but throughout the civilized world. Welcome to my world, Big Steve! There's always room for someone with no "street cred" but plenty of hot opinions.

Oh, and just so you don't think that Steve is not without influence, the article finishes with the amazing "coincidence" of the timing of Steve's broadside and the immediate reaction of the FTC.

Mr. Ranzini voiced his concerns about false advertising and ineffective policing in a letter to the Financial Times published Monday. The next day, the FTC said it was contacting 200 advertisers and publishers to warn them that mortgage ads sometimes contain false information. The warnings come after an industry review the agency did in June. 

Right, the FTC was already working on those 200 letters when Steve's letter appeared in the Financial Times. Pure coincidence, the FTC would say. I don't think so. I think that this Ranzini guy speaks loudly AND carries a big stick. I don't think that we've heard the last of Stephen Lange Ranzini. Not by a long shot. At least, I hope not.

And by the way, FTC, why don't you stop leaning on the Better Business Bureau like Iranian President Imahandajob, Amasonofablob, Ahmadinejad relies on a bush jacket and an Enrique Iglesias-like three-day growth of beard to convey the false impression that he's a "man of the people." You're not fooling anyone, Mahmoud. Neither are you, FTC.

Mr. Ranzini said the Federal Trade Commission effectively delegates its responsibility for policing advertisers to the Better Business Bureaus, which he said "have no teeth."

A spokesman for the FTC said it does not delegate enforcement responsibility for deceptive advertising.

Phhhht! Notwithstanding the window dressing, all of us "in the know" know that the BBB is merely "a beard" for the FTC, like Liza Minelli was for David Gest. BBB: the spouse who wears the pants. FTC: a weak sister masquerading as an Amazon.

I hope that Mr. Ranzini keeps writing letters. This is the stuff of which legends are made. 

Power Grope

Chairman Mao's Frank's mid-June meltdown continues to ooze hot stuff that seeps through the cracks of the floorboards of Congress and drips, like Chinese water torture, onto the heads of the Federal Reserve Board (paid subscription required).

A month after House Financial Services Committee Chairman Barney Frank told the Federal Reserve Board to use or lose its power to ban unfair and deceptive banking practices, the Massachusetts Democrat said he wants to hand that power to two other agencies.

At a hearing Wednesday, Rep. Frank said the Federal Trade Commission Act should be amended to give not just the Fed but also the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corp. the power to police lending practices.

The Office of Thrift Supervision has similar authority, he said, but for reasons for which "no rational explanation is even conceivable, much less likely," lawmakers have denied the OCC and the FDIC the same right.

"My strong view now is that something should be done legislatively to correct that," Rep. Frank said.

Last month, he threatened to give the OTS "The Powah." Now, he's decided that the Lilliputians already "got them some," so he's edging closer to his secret love, Sheila Bair. Did I mention previously that Sheila Bair won the 1989 American Natural Bodybuilding Conference Women's Championship? I did? Not the same Sheila Bair? Well,then, never mind.

A talking head from the land of bankers tried to misdirect Chairman Frank, but he was having none of it. NONE OF IT, I SAID!

Testifying on behalf of the American Bankers Association, Arthur Johnson, the chairman and chief executive of United Bank of Michigan in Grand Rapids, said he would support such a move, but only if the agencies issued uniform rules.

"It would be anomalous — and harmful — for the five federal agencies … to adopt different standards of what is an unfair or deceptive act or practice," Mr. Johnson said.

But Rep. Frank said lawmakers learned from their experience with the Fair and Accurate Credit Transactions Act of 2003 that giving seven regulators the shared task of writing rules proved to be a disaster. The law is still not fully in effect, because regulators have not finalized the implementing rules.

That many regulators are "incapable of action," he said. "So that one doesn't work to me."

Unfortunately, instead of merely beating down the Fed and pumping up Ms. Bair's biceps, Barney Rubble had to smack down our favorite tool of capitalist oppression and imperialist power-projection: federal preemption.

Barney's got a point. While waiting for the final FACTA regulations to be issued, I plan to sell the last of my carbon offsets to Al Gore and board a starship to the Shoulder of Orion immediately prior to (1) the Northern Hemisphere being lashed (FINALLY!!!) by those hurricanes Jesus has been telling Pat Robertson for years will ("This year, Pat, I swear on the heads of the Father and the Holy Spirit") batter the Sodom and Gomorrah known as "America," and (2) the Southern Hemisphere freezing into the gigantic rink so long yearned for by those of us eager to ice skate in Hell. [Editors side note: as a devout Roman Catholic, I always get a kick out of the way the Lord wools Pat around every year about the upcoming hurricane season. Then again, in Pat's eyes, inasmuch as I am a devout Roman Catholic, the Big Guy's coming back to vaporize me, the rabbi next door, every crank and crack dealer, and "all those gays on Broadway."]

Rep. Frank tried to bolster his argument for reform by saying the current federal regulatory regime does not protect consumers adequately, because preemption has undercut state laws.

"The current set of tools and resources that the federal banking regulators have were configured in an era where the assumption was there was a lot of state consumer regulation going on," he said. "There is now, for national banks, virtually no state consumer regulation, certainly none that is specific to banks."

The preemption issue "is not going away," he said.

Rep. Frank said he is still weighing how best to use state supervisors and attorneys general to enforce rules and laws against unfair and deceptive practices.

I understand that after the hearing, he told reporters "off the record," that he'd like to dress some of the state supervisors and attorneys general up in tuxedo shirts and surfer jammies, and take them clubbing. How that addresses federal preemption is beyond me, but it sure does sound like a whole bushel and a peck of fun, doesn't it?

Frank's Republican counterpart on the Committee weighed in on the issue as only a member of that out-of-power party can.

The committee's ranking Republican, Rep. Spencer Bachus of Alabama, missed the hearing...

That might have been a tad unfair, since he had someone else read a written statement at the hearing, but as I recall, it only addressed wool tariffs in Botswana.

Consumer advocates also had their say, which would be expected at any hearing chaired by Barney.

Travis Plunkett, the legislative director for the Consumer Federation of America, who testified on behalf of six consumer organizations, said banking regulators have enough power to stop unfair practices but have chosen not to use it. He said the FTC should be able to take enforcement actions against depository institutions and to ban specific bank practices.

"The key to addressing these root problems is to make the regulatory process more independent of the financial institutions that are regulated," he said.

Yeah, make sure the regulators aren't familiar with financial institutions, so that they have little idea how their enforcement actions, policies and regulations affect them. Someone like: Travis Plunkett.

There was more "blah, blah, blah," but we've hit the highlights, or at least those we've been able to hit before our lithium kicked in.

 

The News From TJX Gets Worse

The TJ Maxx information security breach debacle is apparently even worse than we imagined when we first commented upon it in February. In public filings by the retailer's parent company TJX last week, the company admitted that credit card information on over 45.7 million customers was stolen from January to November 2003. Unfortunately, no estimate was given for the number of additional customers whose information was compromised for the remainder of the 18-month period, ending June 28, 2004, for which customer information might have been compromised. The company claims that information for that period was probably deleted and not stolen, although they can't be certain.

TJX said in the filing that "substantially all stolen data" from transactions in the period Nov. 24, 2003, to June 28, 2004, were deleted. Lang said the company was investigating why information stolen earlier in 2003 wasn't routinely deleted.

Deleting such information after transactions "should be standard practice" to guard against theft, said Taneja, the security expert, but many firms nevertheless don't follow through.

Why banks are so angry about the retailer's failure to protect against the hacking or to detect it in a timely manner (it lasted from January 2005 until December 2006) is illustrated by the expensive hoops that banks had to jump through in one small area of Texas. As reported by the local media in Brownsville, Texas, two banks in that area of South Texas had to issue over 26,000 new credit and debit cards to customers as a result of the breach. As we reported previously, the cost to the bank of each card replacement ranges from $5 to $20. Therefore, two relatively small banks in Texas have been scorched for somewhere between $130,000 to in excess of $520,000. That area had only five Marshall Stores. That's a lot of damage, and it's been multiplied many times over, nationwide and worldwide.

According to the Associated Press, "[t]he case has led banks to reissue cards to customers as a precaution against further fraud beyond cases detected as far away as Sweden and Hong Kong, according to the Massachussets Bankers Association, which is tracking fraud reports linked to Framingham, Mass.-based TJX, parent company of stores across North America and the United Kingdom."

The damage to consumers is not confined to the theft of credit card numbers and related information.   The public filings also reveal that "another 455,000 customers who returned merchandise without receipts had their data stolen, including driver's license numbers."

Experts say TJX's disclosures in a regulatory filing late Wednesday revealed security holes that persist at many firms entrusted with consumer data: failure to promptly delete data on customer transactions, and to guard secrets about how such data is protected through encryption.

"It's not clear when information was deleted, it's not clear who had access to what, and it's not clear whether the data kept in all these files was encrypted, so it's very hard to know how big this was," said Deepak Taneja, chief executive of Aveksa, a Waltham, Mass.-based firm that advises companies on information security.

This latest bad news will give a boost to advocates of state and federal legislation the make the retailer responsible for paying the banks' costs of reissuing cards. Something has to slap companies up the side of the head to take information security seriously, although the FTC and plaintiffs' trial lawyers have already been unleashed.

TJX faces an investigation by the Federal Trade Commission, which could fine the company, and lawsuits accusing the firm of failing to safeguard private data.

The Handwriting on the Wall

As we noted last fall, real estate valuation web site "zillow.com" was the subject of a complaint to the FTC made by a community activist group that claimed that Zillow's "Zestimates" were inaccurate, and that such inaccuracies were being used by unscrupulous predatory lenders to harm disadvantaged consumers. Although the dispute has not yet been resolved, recent press reports indicate that those allegations aren't slowing the growth of Zillow's popularity.

Zillow spokespersons have been consistent in claiming that the computerized valuation process is "a work in progress" and provides only a "starting point" for determining a home's fair market value for loan purposes or to set a reasonable listing price. Given those disclaimers, as I stated last November, I'd like to see the proof of how "Zestimates" are being used to defraud or otherwise harm poor consumers.

As Stan Humphries, Zillow's vice president of data and analytics told The Wall Street Journal (paid subscription required) last month, the program "tends to work best for midrange homes in areas where there are a lot of comparable houses... It is less accurate for low- and high-end homes because there are fewer of those and thus less data available from comparable sales, known as 'comps.' Values of rural homes are hard to gauge for the same reason. Partly for that reason, none of the Web sites can offer 100% coverage of U.S. homes; Zillow says it has estimates on about 57% of all homes."

The WSJ article also noted that Texas makes Zillow's job tougher for the same reason that it makes an informed consumer's job tougher.

Some states, including Texas, don't provide public records showing housing transaction prices. To improve its performance in Texas, Zillow last month began tapping sales data from multiple-listing services, databases of property for sale through real-estate brokers.

As expected, realtors don't like Zillow much. One was quoted in the WSJ article telling of a client who missed out on a great house because, relying on a "Zestimate," she low-balled an offer. Another realtor, in a recent article in The Detroit News, related the sad case of another civilian who relied on a too-high Zestimate, with the result that his house sat on the market for over six months before he pulled it off. My initial reaction to these incidents is that realtors, though hardly unbiased observers, are likely relating the facts accurately. Those are cautionary lessons with which Zillow executives would readily agree. A Zestimate is not yet, nor does it purport to be, a definitive source of setting the value of a home. Anyone who relies on one as such is foolish.

On the other hand, as more and better information becomes incorporated into the Zillow algorithms, and as the algorithms themselves become more sophisticated, this tool, and others like it, will increasingly prove more and more valuable in helping consumers set prices, without having to rely totally upon the expertise of local realtors. As the world now stands, I know local realtors who I trust and I'd rely on their expertise in making a final decision. Nevertheless, technology is reshaping the world. You can engage it with a sneer or with a cold, clear eye. Those realtors with a sneer on their lips appear to be whistling while filing past a graveyard.

Attorneys shouldn't feel too comfortable or superior, however. One of the functions we used to monopolize was access to the law. That's already gone by the boards, thanks to free sites like findlaw.com and others, as well as numerous government, non-profit and commercial sites where a vast amount of legal information is available to anyone with access to the Internet. Lawyers also used to be the purveyors of forms for routine commercial and consumer transactions, a monopoly that was eroding for decades prior to relatively recent innovations through software and online applications. Attorneys, like realtors and other professionals, will have to embrace these new tools and adapt. They'll have to continue to find ways to make themselves relatively unique "value adders," as opposed to mere information purveyors. In other words, if what you do is capable of becoming routinized and commoditized, technology innovators will likely eventually find a way to do it better than you can.

As always, the most skilled surfers find a way to ride the big waves, while others are swept under and away.
 

The Tortoise and the Hare

Three months ago, politicians in Washington, D.C. were braying about a (then) nine-month delay by the FTC in getting money to potential claimants from a $5 million fund established by credit reporting agency ChoicePoint. The FTC required ChoicePoint to set up the fund in January as part of a settlement of charges filed by the FTC over identity thefts caused by ChoicePoint's failure to assure the legitimacy of businesses using its credit reporting services (an FCRA violation). On top of the $5 million fund, the FTC hit ChoicePoint with a whopping $10 million fine, the largest civil fine in the FTC's history.

Obviously, the FTC cuts no slack for poor business practices by private enterprises that violate the law. Bureaucratic  sluggishness, however, is of less concern. Even the gentle prodding of members of Congress (e.g., the delay is "outrageous") hasn't been enough to make the FTC show them (claimants) the money.

Well, we're getting there. This week, the FTC announced that it had mailed out 1400 "claims forms" to potential claimants. Completed forms must be returned postmarked no later than February 4, 2007. Miss the deadline by a day and it's like a would-be Christian convert  who gets hit by a bus on the way to his baptism. God looks at him, winces, snaps his fingers, and says "You were THAT close!"

Don't worry claimants. Your time will come. You may be dead by the time you get your money, but your heirs will spend it wisely, I'm sure.

The linked article mentions in passing that as a result of the fiasco, ChoicePoint "hired Carol DiBattiste as the company's chief credentialing, compliance and privacy officer." I recall at the time thinking that her hiring might have been intended by ChoicePoint solely as a public relations move. If it was, no one told Carol, because she came in with guns blazing and an apparently endless supply of ammunition, at least according to an April article in Information Security News.

DiBattiste's first priority was to shore up the lax vetting of customers. She and her team immersed themselves in each of ChoicePoint's business units to learn their security and privacy processes and procedures in an attempt to marry the two disciplines. She hired consultants from Ernst & Young's privacy team to introduce industry best practices to ChoicePoint and tailor them around its business model. Each of these activities came under the umbrella of a new risk mitigation model, which was the focus of more than 50 outreach events internally and externally that DiBattiste coordinated before the end of 2005.

"Customers are thrilled because it's a business imperative for us," she says.

Credentialing procedures for new customers were ramped up, starting with the hiring of more than 40 individuals dedicated to checking customers and verifying who they are, the legitimacy of the companies they represent and whether they are, in fact, agents of the company. Existing customers will also be recredentialed, an exercise DiBattiste expects to continue through August.

Checklists vet customer identities through various sources, including bank references. Site visits are mandated for customers seeking access to the most sensitive ChoicePoint information stores. A quality control board then reviews the credentialing teams to ensure no human error was introduced during the vetting process and that each of the multiple verifications was done properly.

"There are certain things on our checklist that, if you don't pass, it's a hard fail and you're not going to be one of our customers," DiBattiste says. "I think our credentialing process is one of the best out there. It goes through a lot of checking of who you say you are, and whether you are going to use data in a manner that is permissible under law."

ChoicePoint customers can also expect periodic audits of their account activities-- some scheduled, some without notice. Hun-dreds of accounts have already been cut off because of suspicious behavior, DiBattiste says.

Customer privacy training is also a priority for 2006, in addition to mandatory online privacy training for employees.

"We want to get customers aware of what their obligations are with the data," DiBattiste says. "That's a heavy lift. All of this is key to our risk mitigation model. With this combination of site visits and rigorous checklists, we hope to keep another incident from happening."

All those changes must have worked. Not only has there been no further scandal at ChoicePoint, but in September, Ms. Battiste was kicked upstairs to the position of General Counsel and Chief Privacy Officer.

Amazing, isn't it, what private enterprise can do when it sets its mind to it? Bring in a pro, let her go to work, and mountains are moved. I'm sure not without a bit of pain for all involved, yet in a year or so she seems to have fixed a big problem for a major corporation. Too bad it took $15 million in penalties and public humiliation to bring her into the company. It makes me shudder to think what ChoicePoint must have paid its outside counsel in legal fees. That expense alone might have been punishment enough, not to mention the brain damage inflicted by having to deal with litigators.

I wonder how quickly Ms. Battiste would have distributed the restitution fund if she'd started with the FTC in, say, February of 2006? My guess is that she'd have the entire fund in the hands of rightful claimants by now.