Better Protections Wanted

In Wake Of Tax Office ID Theft

HARTFORD — Attorney General Richard Blumenthal is urging the Department of Revenue Services (DRS) to take stronger measures to protect more than 100,000 Connecticut taxpayers at risk of identity theft because of a stolen laptop, as well as make major changes to a contract with a private firm hired to help shield consumers.

In a letter to Department of Revenue Services (DRS) Commissioner Pam Law, Mr Blumenthal said that DRS should:

*Provide taxpayers with free “credit freezes” in addition to the “credit alerts” proposed by DRS. Credit freezes afford far greater protection from identity theft than credit alerts.

*Cover the cost of credit protection for two years instead of one.

*Provide each taxpayer at least $25,000 in identity theft insurance instead of the proposed $5,000.

*Protect taxpayers against risks of misuse of confidential financial information given to Debix One, Inc (Debix), an identity theft warning service hired by DRS, and stop automatic renewals at each taxpayer’s expense of the Debix service.

Mr Blumenthal asked DRS to change numerous provisions of its contract with Debix, including the absence of any prohibition on the company retaining and selling a Connecticut taxpayer’s information.

“DRS is offering taxpayers a security blanket when they need financial body armor,” the attorney general said. “The DRS proposal fails to provide real protection on three counts: It’s not long enough, it’s not strong enough, and it’s not secure or sure enough. The agency’s proposal is riddled with risks — soft spots and shortcomings.”

Best Protections Required

“DRS should meet the same standard of protection — or even higher — that we have asked and received from private companies when security breaches occur,” the attorney general said. “The DRS proposal falls short, leaving taxpayers exposed to identity thieves. Consumers need a firewall — a freeze on loans and lines of credit to identity thieves — not just an alert. They need protection for two years, not just one. They need real insurance, not the pittance offered. They need protection against misuse of confidential, private financial information they give to Debix.

“Credit freezes lock down credit and lock out identity thieves by prohibiting information releases necessary for new loans or credit. A freeze literally freezes out identity thieves, stopping access to information needed to pillage credit ratings and ruin lives.

“Debix must assure that consumer information is kept confidential and taxpayers are not tricked into expensive contract extensions. Consumers should not surrender ownership of personal financial information for protection against identity theft. I will work with DRS to provide consumers the highest level of protection possible, while reviewing policies and procedures to eliminate the likelihood of future breaches.”

DRS has proposed helping the more than 100,000 taxpayers affected by the security breach establish and maintain “credit alerts” on their accounts at the nation’s three credit rating agencies for a year. The agency has hired Debix to automatically renew fraud alerts every 90 days and call taxpayers whenever someone attempts to open an account in their names — a service normally provided under an alert only when the consumer is a previous victim of identity theft.

Credit Freezes Demanded

Mr Blumenthal called such assistance inadequate standing alone. He said that DRS should reimburse for “credit freezes” — which afford a far greater level of protection — along with the Debix service. Under a credit freeze, credit rating agencies are prohibited from releasing any information without a consumer’s express permission, making identity theft virtually impossible. Consumers must pay fees whenever they freeze or unfreeze their credit, costs Mr Blumenthal said the state should pick up for two years.

Mr Blumenthal called on DRS to provide the same level of protection to victims of security breaches as private companies. The Hartford Insurance Company, for example, provided free credit freezes after similar security breaches, while Pfizer extended credit protection for two years.

Mr Blumenthal said that DRS must make major revisions to its proposed contract with Debix, including:

*Requiring Debix to keep confidential all information about Connecticut taxpayers and to destroy such information when the service expires.

*Eliminating a provision providing for automatic renewal unless the consumer tells Debix he or she wishes to cancel. The provision may violate state laws restricting automatic renewals, Mr Blumenthal said.

*Eliminating a requirement that disputes be settled in Texas courts.

*Requiring Debix to allow more than one consumer to use a single e-mail address.

*Clarifying terms governing state payments to the company.