Bank Lawyer's Blog

Net Neutrality Takes A Beating

While it appeared to be gaining momentum last month, "net neutrality" (previously discussed here and here) was rejected by the House earlier this month, and isn't making much progress in the Senate, either. Wednesday's Senate Commerce Committee vote was just the latest setback.

By an 11-11 tie, the Senate Commerce Committee failed to approve a Democrat-backed amendment that would have ensured all Internet traffic is treated the same no matter what its "source" or "destination" might be. A majority was needed for the amendment to succeed.

Nevertheless, all is not lost for the forces promoting the concept (mostly Democrats). The Wall Street Journal reported yesterday (paid subscription required) that Democratic Senator Ron Wyden of Oregon plans to filibuster the bill on the Senate floor if it is not amended to provide for net neutrality. Commerce Committee Chairman Ted Stevens of Alaska, an opponent of net neutrality, admits that he hasn't got the 60 votes necessary to shut off a filibuster. Guess Ted used up his political capital on the "Bridge to Nowhere."

While I generally believe in letting the free market find solutions, this is a subject where I could be persuaded that some Congressional action is required to maximize the potential (or at least not hinder the evolution) of online banking. It's a topic that ought to concern banks and other financial institutions, although I don't see much interest expressed publicly by banking interests. It may seem more "techie" than sexy to banks, but believe me when I tell you: chicks dig the net. Get up to speed on this topic. You'll thank me later.

Overkill At The VA

Veterans Administration Secretary Jim Nicholson testified before Congress on Tuesday that the Bush administration "was asking for at least $160.5 million in emergency funds for credit counseling and other measures to protect veterans and military troops whose sensitive personal information was stolen."Besides covering credit monitoring for about half of the 17.5 million people whose Social Security numbers were compromised, the money would pay for out-of-pocket expenses for those whose identities are stolen, he told a House panel.

Nicholson said that the $160.5 million wouldn't cover all of the upgrading to security procedures that he intended to implement at the VA in order to turn that agency into a "model for information security." Also, more money would be needed if the VA decided to extend credit monitoring services for veterans beyond the one-year of protection now being provided.

Is it just me, or does this seem out of whack?

When the theft of the VA laptop was first announced, the VA alleged that the data was stored in a format that made it very difficult to retrieve and use. The VA also stated (with support from local law enforcement officials) that the laptop was almost certainly stolen for its hardware and software, not for its data, that the hard drive was likely wiped clean by either the thief or the immediate purchaser in order to enhance its "saleability" and cover the tracks of the thieves and "fences," and that it was likely already resold in the black market sans any personal information. In less than a month, we've come all the way from inadequate disclosure of the extent of the data that was contained on the hard drive, to using $29 million of the VA's funds already budgeted for 2006 that the VA claims it wouldn't otherwise use, and asking for over $130 million more from Congress.

I have sources who are retired military officers and non-coms who advise me that the VA could certainly put the existing $29 million - not to mention an additional $130 million or so - to a lot better use than protecting against the "possibility" that data might have been compromised and might be misused. For example, the VA might use it to provide better health care than it's now providing to veterans.

Last November, I discussed a study by ID Analytics that showed that less than one-tenth of one percent of data security breaches result in a consumer becoming a victim of identity theft or fraud. That's a potential victim pool of 17,500 people, IF the data has actually been compromised, which is not certain and, according to the people involved, is, in fact, highly unlikely to have occurred.

As I discussed a couple of days ago, Professor Fred Cate has pointed out even where crooks steal information and try to use it, they are often unsuccessful. According to Cate, data available as of last summer "indicates that 67% of victims of identity-based frauds report suffering no economic loss and paying no out-of-pocket expenses. The costs were usually paid by businesses, and ultimately by all consumers." We're down to 11,725 people at risk at the outside, not 17.5 million, and even that assumes that the data was, in fact, stolen.

Thus far, no identity theft or fraud has taken place. Anyone care to hold his or her breath awaiting the first incident?

For all that, we need to divert and appropriate (or misappropriate) another $160.5 million. Has anyone in the federal government heard of the term "proportionate response"?

The press reports and public statements on this matter are filled with bureaucratic butt-covering on one side and attacks motivated in most part by pure partisan politics on the other side. There doesn't appear to me to be any thoughtful analysis of the actual risk involved and a measured response to it. An employee took a laptop home in violation of VA policy. He was canned and his boss was canned. That's a good start. Here's the finish: "Don't do that anymore guys, ok? Also, as you're now required to do by OMB Guidelines, encrypt your hard drives. As to any of you vets, if any of you suffer a loss, we'll make you whole. We promise."

Problem solved. That'll cost you a lot less than $160.5 million. $160 million less, in fact. Best part: I accept U.S. Treasury Notes in payment of my invoices.

Many of the people taking up space in Washington, D.C. could be replaced by cigar store Native Americans and you'd get an immediate step-up in the competence level.

UPDATE 6/29/06: Lost Laptop Located!

Well, isn't this a happy coincidence. On the day I rant about a wasted $160.5 million, the stolen laptop is found and it appears that the data was never accessed. Now, nobody in their right mind can say you've got to spend money for credit monitoring. Can they?

Sen. Larry Craig, R-Idaho, the Senate Veterans’ Committee chairman, said he thought the VA had learned some lessons and that recovery of the laptop could save money if data has not been compromised. The VA then would not have to proceed with plans to provide free credit monitoring services for veterans and to pay a company to keep checking for new credit applications to determine if anyone was trying to falsely use the identity of a veteran or service member.

“If the FBI can confirm that the data has not been removed from the computer since it was stolen, I think we will be able to save taxpayers millions of dollars,” Craig said.

Tell you what, Lar, even if the FBI can't confirm that the data wasn't "removed" (I think he meant to say "accessed" or "viewed"), there was no justification for the $160.5 million appropriation in the first place, and there is absoultely no reason to even consider it now.

Biting My Tongue - Sort Of

News of another tragic laptop loss reached us this week.

The Federal Trade Commission -- an agency whose mission includes consumer protection and occasionally involves suing companies for negligence in protecting customer information -- today disclosed a recent theft of two laptop computers containing personal and financial data on consumers.

In a statement, the FTC said two employee laptops were stolen from a locked vehicle. The PCs contained data on about 110 people that was "gathered in law enforcement investigations and included, variously, names, addresses, Social Security numbers, dates of birth, and in some instances, financial account numbers."

The commission said it has "no reason to believe the information on the laptops, as opposed to the laptops themselves, was the target of the theft. In addition, the stolen laptops were password protected and the personal information was a very small part of several thousand files contained in one of the laptops." The agency also said it would offer affected individuals one year of free credit monitoring.

From an FTC press release issued in June 2005:

BJ’s Wholesale Club, Inc. has agreed to settle Federal Trade Commission charges that its failure to take appropriate security measures to protect the sensitive information of thousands of its customers was an unfair practice that violated federal law. According to the FTC, this information was used by an unauthorized person or persons to make millions of dollars of fraudulent purchases. The settlement will require BJ’s to implement a comprehensive information security program and obtain audits by an independent third party security professional every other year for 20 years.

[...]

"Consumers must have the confidence that companies that possess their confidential information will handle it with due care and appropriately provide for its security,” said Deborah Platt Majoras, Chairman of the FTC. “This case demonstrates our intention to challenge companies that fail to protect adequately consumers’ sensitive information.”

And who challenges government agencies that permit employees to take laptops containing unencrypted personal information on consumers outside the office? Password protection is nice, but when JP Morgan Chase's Chief Privacy Officer announces to a room of other privacy officers, attorneys and other interested persons that 99.9% of the hard drives of that bank's laptops are encrypted (the remaining 1/10th of 1% allows for the rogue laptop no one knows about except the rogue employee who possesses it), is there a valid argument that such encryption ought to be the standard employed by those empowered to judge the "unfairness" of the security practices of American businesses?

Just asking.

From Wikipedia:

The expression “irony of fate” stems from the notion that the gods (or the Fates) are amusing themselves by toying with the minds of mortals, with deliberate ironic intent. Closely connected with cosmic irony, it arises from sharp contrasts between reality and human ideals, or between human intentions and actual results.

Encryption, Authentication and the "Right Focus" On Data Breaches

I attended a conference last week in New York City on privacy law, and the most provacative, interesting, and humorous speaker was the last of the conference, Professor Fred Cate of the University of Indiana. Fred might be categorized as a "privacy skeptic." He's not denigrating those who make their living from privacy consulting, and he recognizes that people are legitimately concerned about data theft and the fraud that results from the misuse of personal information by crooks. However, as with many provocateurs, Professor Cate thinks that many of us are looking at the problem and the solution in the wrong way. If we are, it has serious implications for the banks we represent and for those of us who are trying to guide them through the privacy and security minefields.

If anyone's interested, they can download from the site linked above Professor Cate's paper "Information Security Breaches and the Threat to Consumers," and an article he authored that was recently published in the Indiana University Alumni Association magazine. Without rehashing them in their entirety, I'll reiterate a few central points contained within them and/or made by Cate in his presentation last week.

In Cate's view, security breaches are not where state or federal legislators or regulators ought to be directing their major efforts. Certainly, safeguards against such breaches are not to be entirely neglected. However, criminals who use personal data are stealing information in much greater amounts from other sources, including credit card and check theft. In yesterday's post, I discussed a Washington Post article that revealed that consumer information was being auctioned off on foreign web sites. If the crooks want the information, they can get it from sources other than hacking into networks or stealing hard drives. As I also noted yesterday, very few data security breaches or computer thefts result identity theft or fraud.

Professor Cate contends that since the battle against cybercriminals will be an ongoing, and largely technological, struggle, it will be necessary to be forward-thinking and intelligent in combating it. Hamstringing banks and other businesses with unnecessary regulations concerning data security breach prevention and notification measures is going to hamper, not help, the fight against identity theft and related crimes. According to Cate, well-funded and technologically sophisticated organized crime organizations are involved in much of the illegal exploitation of personal information, and such organizations are increasingly engaging in the crime of "synthetic identity fraud," a crime to which data security breach laws are not even related.

...Rather than making fraudulent use of an existing credit card or bank account, or opening a new fraudulent account in the name of an unsuspecting victim, synthetic identity theft involves creating an entirely new identity. The perpetrator applies for prepaid credit-card, cellular, and similar accounts in the name of the nonexistent individual. This creates a credit report, which is the key to applying for high-limit credit cards and unsecured loans. The perpetrator obtains as much money as he can before disappearing.       

Synthetic identity fraud requires good organization and up-front money, but multiplied across thousands of accounts opened in the names of nonexistent people, it can be very lucrative. Moreover, it is hard to detect since the fraudulent activity doesn’t show up on anyone’s credit-card statement or credit report. In fact, it may not be visible for years, as thieves develop credit records for the new identities they have created. Synthetic identity fraud poses significant risks for businesses and others that grant credit or provide products and services to the nonexistent, “synthetic” person. And it can be very dangerous for society more broadly if the frauds perpetrated by the creators of the synthetic identities become widespread or if those identities are used by terrorists to gain access to airplanes, government buildings, or other critical infrastructure.

One of the other points that Cate made in his speech, if not in his articles, is that privacy legislation (such as Gramm-Leach-Bliley) and security breach notification legislation makes the assumption that decisions concerning, and control of, personal information is best left to the consumer. In one study cited by Cate, the vast majority of consumers approached on the street who were offered a discount card to Starbucks in return for revealing the user name and password to their workplace computer willingly made the exchange. Another fact cited by Cate is that the vast majority of identity theft is the result of negligent actions or omissions of consumers.

There is nothing that industry or government can do to protect individuals who use weak passwords or share them with friends, who fail to check their credit-card and banking statements for fraudulent transactions, or who do not report evidence of identity theft when they find it.

Cate believes that the consumer may, in fact, be the worst "actor" in the economic game to make intelligent, informed decisions that would protect against the improper use of his or her personal information. Businesses may be much better able to offer that protection, if businesses are willing to do what's necessary, and if consumers are willing to let them do it. The first step is to shift emphasis away from (but not abandon) laws, processes and technologies that prevent crooks from obtaining personal information (and that require businesses to notify customers when data security is breached), to those measures that make it harder for crooks to use the information.

One example Cate gave is the recent dual authentication requirements that banks are expected to implement by the end of this year. Cate asks whether dual authentication is enough, and, if not, whether it is not incumbent on businesses to implement tougher measures (triple or quadruple authentication), even if consumers find them annoying. Businesses should be focusing on making it as tough as possible to fraudulently use personal information (of "real" or "synthetic" human beings), and educating their customers on the benefits and the risk-reward balance of tougher authentication procedures that may make it more time consuming to use online online banking.

I've been consistently skeptical of the willingness of consumers to accept cumbersome identity verification measures to do their online banking. Perhaps I'm selling the consumer short. It wouldn't be the first time.

It's worth considering and it's worth discussing.

Laptop Thefts: Much Ado About Nothing?

Last Thursday's The Washington Post had yet another article with a sensational headline concerning laptop thefts and how a "spike" in such thefts was "stirring jitters." It was either laptops that were stirring the jitters or it was a triple shot of espresso. I'm pretty sure it was laptops.

One of the latest examples of this laptop theft craze involved a Washington, D.C.-based, lower-level (described by the obviously elitist WAPO reporter as a "working-class type") employee of ING, who took home a laptop that contained the personal information of retirement account holders. A thief broke into his home and took not only the laptop but more tragically, nine cans of beer. Cans? Definitely, a working-class type. We'll assume they weren't micro-brews.

Much of the article laundry-lists numerous similar instances of laptop thefts, and the wide variety of personal information that was contained on the unencrypted hard drives. Thus, the most intimate personal information on each and every one of us (I assume that my personal proclivities regarding female trapeze artists and nautical knots are on someone's laptop) has been placed in the soiled hands of common (and perhaps a few uncommon) criminals. The article intimates that executives of corporations that suffer such thefts are ordering Tums by the gross, while the rest of us should be very, very worried.

Should we be?

Laptop theft is clearly on the rise in the District, said Capt. Michael Reese, who heads the D.C. police department's special investigations unit. Reese said the laptops turn up in pawnshops for about $400 or on the street sold by junkies for $20. But he doesn't remember ever tracing a case of identity theft back to a stolen computer.

"There are various ways that people have their identity stolen: wallet, trash, copying your name at the restaurant, looking at a credit card real quick, all different ways," Reese said. "But not the kind of 'I Spy' stuff like getting it off a stolen laptop."

Other "experts" quoted in the article point out that there are many more efficient methods of obtaining consumer's personal information than following a bank employee home and stealing his or her laptop. For example, the kleptocracies that have have arisen from the smoldering ruins of the former Soviet (Evil) Empire host web sites that auction stolen personal information to the highest bidder. eBay, the Sopranos way. The free-enterprise system takes a decidedly unpleasant twist when it's not tempered by the lingering fumes of a stolid Judeo-Christian morality that still permeate at least a portion of Western societies.

It appears that most laptops are stolen and sold for their hardware, not the personal information that's contained on their hard drives. In fact, the thieves often sell the computers without even turning them on. Whew, that's a relief.

Not so fast, Buckwheat!

But assuming that stolen data will remain untapped is dangerous, said Beth Givens, director of the Privacy Rights Clearinghouse, a consumer advocacy group in San Diego.

Givens said it's probable that, in many cases, laptops are taken by unsophisticated burglars uninterested in what's inside. But she said the majority of identity theft cases are never traced back to the origin of the theft.

"I don't want to be alarmist, but there are so many breaches being reported these days," Givens said. "We all just need to assume our personal information, especially our Social Security numbers, are at risk."

A cynic might observe that people who make their living as privacy consultants, privacy newsletter publishers, and professional privacy advocates have a vested interest in keeping people in a lather about the crisis in privacy breaches ("Hey, look! There's a storm comin'. I've got an umbrella, and I'll sell it to you for a mere $500 an hour"). Luckily, you won't find any cynics here in the Garden of Eden, so I'll merely observe that the jury's still out on whether or not we should all be afraid.

On the other hand, I'm not losing any sleep.

Cybercrime: What's Good For Business HAS To Be Good For The Country

Sitting in a New York City hotel bar this past Tuesday evening, following an enjoyable evening of Indian food and Monty Python, watching the Dallas Mavericks' Dirk Nowitzki clang bricks off the rim, quaffing pints of Guinness draft, and wondering whether Mark Cuban is putting us all on or if he really is a thumb-sucking fat frat boy gone very, very wrong, the thought suddenly struck me: is cybercrime up or down? I needed to know, right there and then. Waiting...just...wouldn't...do...

Luckily, I passed out. Just like the Mavericks.

But, arriving back at the office today, what do I find in my inbox, but an article from last week's Cnet news.com that addresses just this question. Is this a wild and freaky world or what?

For the fourth straight year, the financial losses incurred by businesses due to incidents such as computer break-ins have fallen, according to the 2006 annual survey by the Computer Security Institute and the FBI. Robert Richardson, editorial director at the CSI, discussed the survey's findings in a presentation at the CSI NetSec Conference [in Scottsdale, Arizona on June 14, 2006].

Respondents in the 2005 survey reported an average of $204,000 in cybercrime losses, Richardson said. This year, that's down to $168,000, about an 18 percent drop, he added. Compared with 2004, the average loss is down 68 percent.

[...]

Most important, perhaps, the 615 U.S. CSI members who responded to this year's survey reported fewer security incidents. Viruses, laptop theft and insider abuse of Net access are still the most reported threats, but all have decreased compared with last year.

[...]

"Overall, you have a picture that is pretty good in many ways," Richardson said. "We're seeing fewer of some of the attacks that have been such a plague for us in many years, and respondents are using less and less money."

Well, that surely should ease your mind and make you question all the silly hoopla about cybercrime and security breaches, shouldn't it? You know, alarmist articles like those featured on this blog, which is well known in fear-mongering circles as the "Chicken Little" of bank blogs.

Well, if you're an actual human being, as opposed to a creature of statute like a corporation, a limited liability company, or a lobbyist, it turns out the survey results are not quite as favorable, at least on their face.

When it comes to cybercrime losses, consumers might be bearing the brunt of them, and they are not covered by the survey, Richardson suggested. "Consumers are the low-hanging fruit," he said. Costs related to identity theft, for example, fall largely back onto the consumer, he added, even if it did start with a data breach at an enterprise.

"Low-hanging fruit." I hate being that. Unless I can be a banana, of course.

Maybe this is an area of the economy where, although at first blush it looks better for businesses than for consumers, some of the benefits to businesses of having the consumer bear the initial shock wave of data breaches and thefts, eventually will "trickle down" to the consumer. What do you think? Sounds like a sure fire winner for some party's platform in 2008 to me. Maybe we should take another survey.

Now, back to the Guinness.

Hiatus

Bank Lawyer's Blog will be on vacation until June 23rd.

Fannie Mae's Solo Solon

A commenter to a previous post on the foibles of Fannie Mae took the position that hard-core lobbying efforts of Fannie Mae officials prevented OFHEO officials from uncovering the accounting scandal that led to the ouster of Fannie Mae's top management and restatement of earnings. He or she contended that lobbying by GSEs should be banned.

A story in this past weekend's edition of National Mortgage News supports that contention.

In a last-ditch effort to distract attention from its accounting problems, Fannie Mae used its clout on Capitol Hill to "undermine" and "discredit" a special examination of its books, according to a report by the Office of Federal Housing Enterprise Oversight.

Moreover, last week former OFHEO chief Armando Falcon Jr. said Fannie's behavior reminded him of the "Keating Five" scandal of the late 1980s when five U.S. senators pressured thrift regulators to go easy on his rogue S&L.

Speaking at a luncheon here, Mr. Falcon said he found it "particularly offensive" that Fannie instigated an inspector general probe of his agency by the Department of Housing and Urban Development. (Mr. Falcon left OFHEO on his own accord in May 2005.

[...]

As OFHEO's special examination was getting underway in early 2004, Fannie worked with a powerful Senate appropriator to launch an investigation of OFHEO by HUD's IG office.

The OFHEO report documents that Fannie lobbyist Duane Duncan -- with the approval of higher-ups -- instigated the request and drafted a letter for Sen. Christopher Bond, R-Mo., to send to HUD IG Kenneth Donohue.

The letter asked the IG to investigate several "leaks" that OFHEO allegedly had made to the press that proved damaging to Fannie.

Mr. Duncan admitted under oath that "Fannie Mae had generated the request" for the HUD IG investigation, according to OFHEO's final report on Fannie's accounting scandal.

"It is clear that Fannie Mae sought to use the ... investigation of OFHEO by the HUD inspector general to attempt to undermine the special examination," the OFHEO report says.

OFHEO also reported that Fannie lobbyists wanted to use the VA-HUD appropriations bill to pressure the Bush administration to replace OFHEO director Falcon, and his deputy, Stephen Blumenthal, who was leading the special investigation.

As the chairman of the VA-HUD Appropriations Subcommittee, Sen. Bond included language in OFHEO's $60 million budget that penalized the agency if Mr. Falcon remained at the helm.

[...]

Sen. Bond's subcommittee approved S. 2825 on Sept. 21, 2004 -- the same day that Fannie Mae reported a $3,500 political action committee contribution to Sen. Bond, who was running for re-election.

A Center for Responsive Politics report prepared for NMN also shows that then-Fannie chairman and chief executive Franklin Raines made a personal $1,000 contribution to Sen. Bond in November 2003.

The current CEO and president, Daniel Mudd, contributed $1,000 to Sen. Bond in 2003.

Sen. Bond continued to call for Mr. Falcon's removal after the HUD IG released the results of its investigation in mid-November of 2004. "Administrator Falcon's term expired six weeks ago. He should be gone by now," Sen. Bond said in a Nov. 19, 2004 statement.

The IG report raised serious questions about the conduct of Messrs. Falcon and Blumenthal. However, the IG concluded that OFHEO did nothing wrong.

[...]

Two weeks ago, Fannie agreed to a $400 million settlement with the SEC and OFHEO for engaging in financial fraud.

Those of us who represented savings and loans in the 1980s certainly recall the infamous Keating Five. Although Senator John McCain was one of "The Five," he survived the scandal relatively unscathed. However, in his autobiography, he considers his participation in the group one of the worst mistakes of his career.

In this case, it appears that there was at least a "Fannie Mae One": Senator Christopher "Kit" Bond of Missouri.

Here's a list from Senator Bond's biography on Wikopedia, under a section entitled "Actions as Senator":

In 2004, Bond sent a letter asking the Department of Housing and Urban Development's inspector general to investigate whether the Office of Federal Housing Enterprise Oversight (OFHEO) had improperly leaked confidential information about Fannie Mae, which OFHEO regulates. In 2006, OFHEO investigators found a draft of Bond's letter seeking the probe of OFHEO on a Fannie Mae computer system nearly two weeks before the actual request was sent to HUD's inspector general.

On October 5, 2005, Bond was one of only nine Senators to vote against the Interrogation Limits bill, which strictly defines the methods of interrogation that can be used by US forces.

On March 28, 2006, Bond voted against creating the Office of Public Integrity, which would have looked into charges of corruption by lawmakers.

Not what he'd want written as his epitaph, I'm sure.

As I stated previously, this little scandal is far from played out.

Bernanke: We'll Be Watching You

Worst case of "Ben Envy" I've ever seen.

Fannie Mae Under The Microscope (And The Gun)

Congressmen from both parties have been piling on former Fannie Mae officials Franklin Raines, Daniel Mudd and Timothy Howard. Rep. Richard Baker of Louisiana went so far as to accuse former CEO Raines with having perjured himself before Congress.

In his testimony before a House subcommittee this week, acting Director of OFHEO, James Lockhart, was also tough on Raines.

"Fannie Mae has a special mandate and position of public trust. The previous management team, led by chairman and chief executive officer Franklin Raines, violated that trust," testified James B. Lockhart, acting director of the Office of Federal Housing Enterprise Oversight.

"By encouraging rapid growth, unconstrained by proper internal controls, risk management and other systems, they did serious harm to Fannie Mae while enriching themselves through earnings manipulation," he said.

[...]

Raines, a prominent Washington figure who was a White House budget director in the Clinton administration, earned more than $90 million from 1998 to 2003, according to the report  - including some $52 million in bonuses directly tied to the company hitting earnings targets. He is one of 30 current and former Fannie Mae executives and employees who are being reviewed for possible disciplinary action, termination or forfeiture of their bonuses.

The report says that Raines, Howard and other senior executives "engaged in improper earnings management in order to generate unjustified levels of compensation for themselves and other executives." Raines and Howard, whose name also was mentioned by lawmakers Tuesday, testified under oath in 2004 and insisted that the regulators' allegations of accounting improprieties represented an arguable interpretation of complex rules.

[...]

In last month's action, Washington-based Fannie Mae was fined $400 million by OFHEO and the SEC_ one of the biggest penalties ever in an accounting fraud case, according to the SEC. The company also agreed to limit the growth of its multibillion-dollar mortgage holdings, at least temporarily, capping them at $727 billion, and to make top-to-bottom changes in its corporate culture, accounting procedures and ways of managing risk.

Anyone who has been following this story for awhile knows that Fannie Mae officials were paid boatloads of money while they were employed and even after they were booted out the door. Raines severance package guaranteed him close to $1 million a year "base pay" for the rest of his life.

While Enron's received most of the press of late, Fannie Mae smells every bit as foul. I realize that the officers didn't bankrupt the company. It's a GSE, so it's doubtful the federal government would allow it to fail. Nevertheless, the rape and pillaging of the shareholders through the device of bogus inflated earnings engendered by accounting tricks strikes the casual observer as very Enron-like.

The fact that Raines was a Clinton appointee, and a former Clinton Administration Budget Director, suggests that greed crossed all party lines. Tom Delay and Ken Lay may be today's popular poster boys for "the culture of greed," but Franklin Raines et al. should be enshrined with them in the Bernie Ebbers Hall of Shame.

Attempting to water down Section 404 of SOX seems to be an uphill battle when stories like this continue to unfold. And this story is far from over.