Up Front

Arizona Law Looks to Crack Down on ID Theft

An Arizona House Bill that attempts to reduce the amount of identity theft in the state went into effect Oct. 1, 2006.

House Bill 2484, sponsored by Arizona Rep. John McComish, was signed into law in April. The new law aims to establish record discard and disposal requirements for businesses and government agencies in the state, which had the highest per-capita rate of ID theft in 2005 in the areas of Phoenix, Mesa and Scottsdale.

The new law stipulates that an entity must not knowingly discard or dispose of records or documents without redacting the information or destroying documents that contain the combination of an individual’s last name and first name or initial along with a Social Security number; credit card, charge card or debit card number; retirement account number; savings, checking or securities account number; or driver’s license number or non-operating ID license number.

Entities that are already subject to the Gramm-Leach-Bliley Act, HIPAA or the Federal Fair Credit Reporting Act are exempt from the new law.

The new law only applies to paper records, not to information stored on electronic equipment.

Entities that fail to comply with the new law are subject to fines of $500 for the first violation, $1,000 for a second violation and $5,000 for every subsequent violation.

The State Fair of Texas filed suit against Iron Mountain Information Management (IMIM) in September in a Dallas district court, alleging that the company and its employees participated in a scheme to steal and resell thousands of Fair coupons that the company was contractually obligated to destroy.

Laura Sudnik, a spokeswoman for Iron Mountain’s corporate office in Boston, notes in an e-mail to Secure Destruction Business:

"The ‘scheme to steal,’ as alleged by the State Fair of Texas, was fully investigated in 2005 by the Dallas Police, who found no evidence of criminal wrongdoing and in fact, reported that to officials at the State Fair of Texas. Additionally, attorneys representing the State Fair itself deposed Iron Mountain employees, and their testimony did not support the allegations. Finally, Iron Mountain’s own security staff investigated in an attempt to shed light on any irregularities and, here again, found no evidence.

"Iron Mountain has repeatedly requested that the State Fair of Texas share any information that might help us to understand the basis for their claims—so that we can respond appropriately. Thus far, no such information has been forthcoming," according to Sudnik’s statement.

State Fair officials say the suit was filed after a year-long investigation by private detectives that identified dozens of people who bought coupons as well as former IMIM employees who were allegedly involved in selling them.

The lawsuit alleges that the coupons from the 2004 State Fair were "pilfered after IMIM took possession of them and with the express or implied authority of IMIM by its employees who, in turn, released the coupons for sale through a network of clandestine agents."

According to fair officials, Iron Mountain employees signed for 76 boxes of coupons, most still sealed from the printer, from the 2004 fair with a value of almost $3 million. More than $1 million in coupons that should have been shredded were used at the 2005 fair.

"The state fair allowed its valued customers to use the preceding year’s coupons, which have a face value of 50 cents, for the next year’s fair," Texas State Fair spokesman David Margulies says. According to the lawsuit, in just the last four days of the 2005 fair, approximately 137 people were caught trying to use coupons that should have been destroyed the year before. Fairgoers purchase the coupons, which are then exchanged for food, rides or entertainment at the fair.

Margulies notes that representatives from the fair, who went to the off-site shredding operation to witness the destruction of the coupons, were told that the shredder was not operational.

In addition to IMIM, the lawsuit also names several former Iron Mountain employees. The suit alleges that the company failed to secure the coupons during a time when it claimed that its shredding equipment was inoperable. Instead, the suit claims the coupons were kept in locked containers that numerous IMIM employees could open.

The State Fair of Texas has hired another company to handle the on-site destruction of unused coupons for the 2006 fair, which was held this fall from Sept. 29 to Oct. 22.

American Security Shredding Inc., an independent plant-based shredding firm in Asheville, N.C., has been named the Small Business of the Month for October by the Asheville Chamber of Commerce.

The company serves western North Carolina and parts of South Carolina.

Wesley Boyd, company president, says he feels that the American Security Shredding’s local connection and ability to offer rapid service to its customers have contributed to the shredding company’s success.

ARMA International, Lenexa, Kan., has announced that The Royal College of Physicians and Surgeons of Canada and Koch Industries Inc. were named as the winners of the Iron Mountain/ARMA International Award for Excellence in Records and Information Management.

According to a press release from ARMA, winners of the Iron Mountain/ARMA International Award for Excellence in Records and Information Management "exemplify the best practices in records and information management today." Awards are given in two categories: Overall Program Excellence and Excellence in Program Innovation and Improvement.

The Royal College of Physicians and Surgeons of Canada, Ottawa, Ontario, was awarded in the Overall Program Excellence category for the organization’s conversion from paper to electronic records management "using solid strategic techniques and innovative solutions," according to ARMA, which describes the conversion process as "efficient and effective."

The cost savings experienced by the new program is realized by a 75 percent reduction in the use of paper files and a 75 percent reduction in the amount of staff time needed to manage files. The conversion, implementation and management of the new program involved input and support from multiple levels of staff at the college, resulting in a successful one-year project and an impressive savings.

Koch Industries Inc., Wichita, Kan., was awarded the Excellence in Program Innovation and Improvement award for initiating a change in its corporate records and information culture. With a presence in nearly 60 countries and about 80,000 employees, Koch Industries is engaged in the refining and chemicals industries, process equipment and technologies, fibers and polymers, commodity and financial trading and forest and consumer products industries.

In addition to the standard records and information management (RIM) training offered by each Koch company, Koch Industries had a special focus on RIM education during the month of April, which is RIM month. The company used outside consultants, internal RIM staff and coordinators to offer 15 different seminars with a total of 40 educational sessions ranging from intellectual property and records management to identity theft to corporate archives.

The award ceremony was held Oct. 23, 2006, at ARMA’s 51st Annual Conference and Expo in San Antonio, Texas.

Digital Information Security

Redemtech Partners with Brinks to Launch Secure Transport Service Columbus, Ohio-based Redemtech, a leading provider of IT asset management services, and Dallas-based Brink’s Inc., through its Secure Data Solutions transportation services, have announced a new secure transport option that is designed to protect highly sensitive data on in-transit computers that have been taken off network to be reused, resold or recycled. According to a press release from Redemtech, “The service, the first of its kind to be offered through an IT asset management company, provides secure transportation of IT assets to ensure the integrity and control of chain-of-custody, reducing the potential for loss or theft of data-bearing assets.” Robert Houghton, Redemtech president, says, “Data security has become the No. 1 priority for many CEOs and CIOs due to the rising frequency and costs of privacy breaches. Our clients are continuously looking for new and better ways to safeguard sensitive data and eliminate the risk of loss or theft.” He adds, “Brink’s Secure Data Solutions transportation services, in conjunction with Redemtech’s full complement of secure recovery solutions, provide the ultimate protection for data-bearing assets during transit.” Brink’s Secure Data Solutions transportation service is offered by Brink’s Global Services U.S.A. Inc., a wholly owned subsidiary of Brink’s Inc. It offers person-to-person armed transport from the point of consignment to delivery. Dedicated personnel inventory all assets at the point of recovery and seal the shipments with tamper-resistant packaging before signing them over to Brink’s for transport. The Brink’s service primarily uses ground transportation, and armed guards escort the shipments through delivery to Redemtech, eliminating potentially risky freight transfers, according to the company. Assets transported by Brink’s are guarded throughout transport and are inventoried again at their final destination to document safe delivery. If air freight is required, Brink’s guards escort sealed shipments directly to the airline for loading on the flight, and a second Brink’s representative meets the flight on arrival and reclaims the secured freight. Redemtech has designated employees who have been specially trained to accept shipments directly from a Brink’s representative at each of its U.S. Technology Change Management (TCM) Centers. “This person-to-person secure delivery process ensures chain-of-custody and proper transfer of control,” according to the company. “We are excited to partner with Redemtech to offer their customers a premium-level transport service,” Shai Anbar, senior vice president, Brink’s Global Services U.S.A., says. “With so much attention today on data security and personal identity theft, it makes perfect sense for companies to take extra precautions to safeguard their sensitive data at every step.”

For the past six years, Iron Mountain has sponsored the Iron Mountain/ARMA International Award for Excellence in Records and Information Management.

ARMA International is a nonprofit professional association serving records and information management professionals. More information is available online at www.arma.org.

RealTime Shredding, the developer of a self-service kiosk designed for consumers and small businesses, has installed two kiosks in Amarillo, Texas.

At Cal Farley’s Boys Ranch Independent School District, administrators say they have reduced the time spent on shredding by at least 75 percent and anticipate savings in staff cost of $10,000 or more annual with the addition of the kiosk.

At Fort Amarillo RV Park, owner Bobby Prescott says he offers the kiosk as an additional convenience for park visitors. Guests can bring in any material they would like to shred and do so at a cost of $1 per two-minute session.

RealTime Shredding Inc. develops and markets self-service shredding kiosks designed for consumers and businesses. It offers multiple kiosk models and options, with purchase, revenue-sharing and lease plans available.

New York Gov. George Pataki has signed three measures into law intended to further protect consumers’ privacy.

The bills establish the Consumer Communication Records Privacy Act, limit the use and disclosure of Social Security numbers and further define computer crime, according to a press release from the governor’s office.

The Consumer Communication Records Privacy Act protects consumers by prohibiting the sale, fraudulent transfer or solicitation of a consumer’s telephone records without consent. The new measures also will place restrictions on the use of Social Security numbers.

A third bill further defines and clarifies New York State’s Penal Law concerning unauthorized use of computers and strengthens existing laws to allow for the prosecution of those who intentionally disrupt, steal personal information and plant malicious programs on computers without authorization.

More information on these bills and existing identity theft legislation in New York is available at www.ny.gov/governor.