The real problem is that Equifax treats data which rightfully belongs to individuals as its own, and the solution is to give individuals control over their own data.
The real problem is that we use publicly available, non-secret data to establish identity. Instead, we need a secure, unique personal identification system, as well as tougher punishments for people that commit identity-based fraud and theft.
That is precisely the data that rightfully belongs to individuals. It should be much, much harder for companies to collect it and sell it.
"Data is a toxic asset." — Bruce Schneier
Pretending that a "secure" system can be devised which will protect that data is irresponsible, because it is impossible. The data will leak eventually.
When it does, under the current regime, the damage inflicted on individual victims is wildly disproportionate. Equifax is the analogue to a gross polluter dumping dioxin into a community's backyards. But getting damages proportionate to the harm out of Equifax is hopeless, because US laws do not acknowledge the toxicity of data.
The US needs something like the GDPR in order to protect us from grotesquely harmful institutions like the CRAs. We are in the early days of the internet, akin to the early days of the industrial revolution — before the harm that toxic chemical pollution causes was recognized and regulated.
That is precisely what it's not. Your existence isn't a secret. Things like your address, phone number, and legal information are freely available from a variety of sources. When you do business with banks or other lending institutions, you are explicitly granting them the right to exchange your payment information with other institutions and CRAs. When you seek or attain employment, you are told if the company makes use of some service like The Work Number for previous employment and salary tracking.
> Pretending that a "secure" system can be devised which will protect that data is irresponsible, because it is impossible. The data will leak eventually.
This is sadly true.
> grotesquely harmful institutions like the CRAs
Without CRAs, how would companies judge your credit worthiness? Access to credit and loans would be much more difficult, and would be much more expensive, without them. Or some similar mechanism to share that sort of information.
Again, the harm doesn't come from the CRAs. A CRA doesn't grant an identity thief access to your accounts, or open credit in your name. That's the banks, CC companies, utilities, etc. who will open accounts with insufficient proof of identity.
It's not the data that's toxic, it's the misuse of it. Allowing accounts to be opened or accessed with easily searched or guessed information is where the real problem is.
It’s not like we have a choice. Every such business participates. I suppose it’s possible to avoid credit reporting by not having a bank account or utilities or a job, but that’s not a very practical way for most people to live.
I don’t see the point in blaming banks instead of credit reporting agencies. They’re all part of one big system that works together. All parts of the system make it the way it is. It’s no more sensible to try to blame an individual component of the system than it is to debate whether to blame a murderer’s hands or his legs.
Think about how the process works. A criminal goes online and applies for a CC, using your personal information. The CC company goes to a CRA to check credit worthiness. The CRA says "Sure, mikeash is a responsible person who pays his debts on time". The CC company says "Great!" and hands the criminal an account in your name. It's the CC company that didn't do the due diligence to verify that it was really you.
However, since the Equifax hack and the resulting backlash, the CRAs have started offering much greater consumer control to consumers. Equifax has a free service that allows you to keep your information locked and actually notify you in real time when a request is made, that you can block or allow as you wish. Basically 2FA for credit. If the other CRAs don't have that service, they soon will.
A third party I’ve never interacted with gives out my private information without first asking for my permission. This is a crucial step in a common pattern of fraud. If they asked me for permission before they gave out my private info, it would shut down this entire type of fraud. They are fully aware of all of this, and continue with business as usual anyway. How is any of this ok?
But they don't give out private information. They don't get anything but some aggregate data about how well you pay your bills. I.E. how many accounts are open, how many have been paid late in the last 30 days, etc.
> If they asked me for permission before they gave out my private info, it would shut down this entire type of fraud.
That is now possible with the two CRAs:
TransUnion: https://www.transunion.com/product/transunion-credit-protect...
Equifax: https://www.equifax.com/personal/products/credit/credit-lock...
Experian and Innovis: I didn't see anything similar, but I'd be shocked if it wasn't imminent for them as well.
These locks just provide a way to shut up the outlier loudest complainers and a rationale for victim-blaming everyone else. ("You could have locked your credit, you know...") By what right do the CRAs demand individuals consumers' time and protection money?
It is incredibly frustrating to see these feckless, disingenuous half-measures cited as progress. It only confirms to me the futility of collaborating on market-based solutions with market players whose interests would be harmed by meaningful solutions.
I wish it didn't come down to imposing regulations, because regulations truly harm market efficiency. But what choice are we left with?
But that's what we need. But what do our "leaders" think when people rant and rave without showing they even understand the problem?
Citizen: I need you to do something about identity theft!
Lawmaker: Yes, it's clear we need to get some regulation in this space.
C: I'm tired of getting turned down for loans, or having credit cards opened in my name! We need to shut down the CRAs!
L: ... Uh, you know that CRAs don't actually do that? It's your bank or credit card company that opens the account, they're the ones that need to verify identity to make sure that people are who they claim to be...
C: Don't try to defend them! They kept me from buying a car!
L: ... Thank you, citizen. I'll get right on it. Vote Quimby!
It’s possible with two of them. Great. Let me know when it’s mandatory for all of them.
Any one warehousing my data needs to tell me what, how, why.
PS- You and rectang are doing yeoman work in this thread, thank you.
You already have all of this from CRAs:
* They are required by law to tell you what they have related to you every year, for free.
* These reports include the source of the information.
* The why is well known, as it's their business model.
Edit: not only that, but the law restricts who can actually request access to any of this data, under "permissible purpose".
First, I have to ask. I'm advocating default opt-out. For everything.
Second, they're always wrong and hard to correct. Been there, done that.
In this system, you'd never get credit. You'd apply for a loan or CC, they'd ask you for permission to check with a CRA and share your info, you'd say no, and they'd show you the door.
> Second, they're always wrong and hard to correct. Been there, done that.
No, they're not. Sometimes they're wrong, either because bad info was reported, or there's a problem at the CRA. Sometimes the errors are hard to correct. I've never had any bad information on my reports. That doesn't mean it doesn't happen, any more than you seeing something wrong on your report means they're "always wrong". It just means that no system is perfect.
That's like saying strychnine is harmless unless you swallow it.
The credit reporting system is built atop the tortured bodies of the victims of identity theft. Every time an individual's personal data is transmitted, that individual is put at risk. The CRAs profit from the profligate dissemination of sensitive data, but the individuals who were compelled to participate and then came to harm are systematically prevented from obtaining recompense.
Well, yeah... of course.
> The CRAs profit from the profligate dissemination of sensitive data,
Everyone profits. The CRAs who are the aggregators, the companies that share the information, and the consumers who get access to cheap and easy credit.
Victims of identity theft exist. Even if you are content to sacrifice them for the greater good, they are real people.
All I'm saying is that the system we have now provides a great many benefits to people, and that we should look at how to fix it, rather than eliminate it. The CRAs are just 3 companies, out of the thousands that have had data stolen over the years, and will continue to do so forever, because it is impossible to have perfect security.
People have cars. Sometimes they get stolen. Should we eliminate cars, so that we can eliminate car theft?
Counting on Equifax to solve this problem is absurd. Equifax doesn't care about individual consumers because those consumers are not their customers. Combating identity theft is a cost center; CRAs cannot differentiate themselves in the marketplace through better tools to prevent an externality.
Consumers have to fight for their own interests because the CRAs will only be dragged along kicking and screaming.
Who cares if people know person X's firstname is Mark. When you start combining that data with address, phone number, age, SS#, employment history, mothers maiden name etc and that set of data also happens to be globally misused by the industry as auth basis data it becomes dangerous.
If they can't secure the combined data set (and you seem to agree that they can't) they certainly should not both be proposing its use for authentication (which they offer as many costly services for business and govt) and also creating the huge data store against the population.
The net here is that this data is unsuitable for auth -- but at the same time it IS USED for auth -- finally it is gathered and stored as if it is not credential material.
I also agree that this review/investigation is barking up the wrong tree -- the most serious crime here is that this information (even without any major mental gymnastics) can and will be easily used to identify likely covert government employees easily by and adversary that has access to it.
Secure. Unique. Personally identifiable. Pick any two.
It was stolen, not made "publicly accessible". You or I could never have accessed it, it took a sophisticated team months to do it.
Don't forget the Yahoo! and Marriott breaches, both of which were considerably larger than the data "Equifax made [...] publicly accessible".
It takes teams months to get to the moon too, but that doesn't mean it's not out there for anyone to access.
The moon thing is a great analogy. Everyone knows the moon is there, but the process of getting to it is an enormous task beyond the reach of all but the most determined, skilled, and well-financed parties.
I know for sure that I'd rather take extra burden for any future credit checks, but in my experience it isn't even possible to get the . I've not been fully able to consistently freeze my credit with all three major agencies and not for lack of trying (several times of very slow correspondence that claims "insufficient identifying evidence"). The fact that its drastically harder for me to freeze my credit than it is to open a new credit card at a brand new address is just batshit insane.
There are alternatives to (economic) slavery and death.
For personal credit scoring, in particular, I'd also accept either Sweden (https://en.wikipedia.org/wiki/Credit_score#Sweden) or Switzerland (https://en.wikipedia.org/wiki/Zentralstelle_für_Kreditinform...) strategies.
Both are civilized, transparent, accountable. Alas, sadly, no unnecessary corporate profiteering.
You get your cut when you apply for cheap, fast credit and get it.
> There are alternatives to (economic) slavery and death.
How is any of this "slavery and death"?
So instead your proposal is turning it over to the government? Interesting.
My cheap, fast credit comes from my high earnings, high savings, and low burn rate. I receive zero benefit from Equifax (et al). They, however, benefit from my data.
My data is me. Anyone profiting from my data owes me my cut.
Further, aggregating and warehousing my data is done on the expectation of future profit. So, again, I should get paid.
AKA royalties and licensing, respectively.
> My cheap, fast credit comes from my high earnings, high savings, and low burn rate. I receive zero benefit from Equifax (et al). They, however, benefit from my data.
And how would you prove those things to a prospective creditor?
> My data is me. Anyone profiting from my data owes me my cut.
It's not yours. It's the data that belongs to the credit grantors that provide it to Equifax.
> Further, aggregating and warehousing my data is done on the expectation of future profit. So, again, I should get paid.
The "future profit" is CRAs establishing themselves as trusted aggregators of this information for their customers, and therefore getting repeat business. And again, it's not your data.
You trust corporations, but not governments, to maintain a list of liens (unpaid debts)?
"It's not yours. It's the data that belongs to the credit grantors..."
Who owns your medical history? The lab company? Your care providers? Big Pharma? The hospital IT dept?
Is your medical data is yours? Do you have some righteous sovereignty over it, how it's used, who gets to use it?
If yes, how are medical and financial data different?
Just to make my position clear: We need a better way of establishing identity. We need tougher standards for credit grantors to use these better standards. We need better control over financial data misuse. The systems we have are insufficient.