Sensitive data dumped at recycling center

[DesiChap]

Sensitive data dumped at recycling center Indian Consulate tossed visa applications from business, political figures at S.F. facility Thousands of visa applications and other sensitive documents, including paperwork submitted by top executives and political figures, sat for more than a month in the open yard of a San Francisco recycling center after they were dumped there by the city's Indian Consulate. The documents, which security experts say represented a potential treasure trove for identity thieves or terrorists, finally were hauled away Wednesday after The Chronicle inspected the site and questioned officials at the consulate and the recycling facility. Among the papers were visa applications submitted by Byron Pollitt, chief financial officer of San Francisco's Gap Inc., and Anne Gust, wife of California Attorney General Jerry Brown. "It's shocking and totally unacceptable," Brown said when asked about the incident. Information on the documents includes applicants' names, addresses, phone numbers, birth dates, professions, employers, passport numbers and photos. Accompanying letters detail people's travel plans and reasons for visiting India. "As we see it, the documents are not confidential," said B.S. Prakash, the consul general. "We would see something as confidential if it has a Social Security number or a credit card number, not a passport number." But security experts say it wouldn't be hard to obtain someone's Social Security number using the information available in the consular documents. They also point out that some of the Sept. 11 hijackers used false passports, which wouldn't be hard to obtain using data and photos from the documents. "This is absolutely sensitive information," said Charles Cresson Wood, a Sausalito information-security consultant. "It needs to be safeguarded." Pratik Sircar, deputy consul general for the Indian Consulate, said the office on Arguello Boulevard processes visa applications and other paperwork for 14 Western states. "We have a shortage of space," he said. "We keep this material for a year, and then we have to destroy it." However, the consulate didn't destroy the documents. Instead, it hired a hauling company in December to cart the boxes to the Haight Ashbury Neighborhood Council recycling center near Golden Gate Park on Frederick Street. The open-air facility is accessible to the public seven days a week. Anyone can walk through the gate and poke around. "We thought it was their job to shred the material as soon as they got it," Sircar said. Andy Pugni, general manager of the recycling center, responded that he doesn't know where the consulate got this idea. "We take in paper, put it in large containers and ship it off for recycling," he said. "That's all we do. We don't shred." Pugni added: "We assume anyone who brings stuff over here will be smart enough to destroy any sensitive materials. I wouldn't bring any of my own materials here." Alerted by The Chronicle to the presence of confidential documents in a corner of the recycling yard -- many of the white boxes were clearly marked "visa applications" -- Pugni had a truck brought in to haul the papers to an East Bay company that will boil them down and recycle them as blank pages. All that remained in the yard Thursday were remnants of the boxes. But a sampling of documents obtained by The Chronicle indicate that the boxes contained confidential paperwork for virtually everyone in California and other Western states who applied for visas to travel to India between 2002 and 2005. They also contained thousands of documents submitted by Indian citizens and people of Indian background residing in the region. "It's hard to believe that this is how confidential information is treated," said San Francisco resident Farah Champsi, who was born in Mumbai, formerly known as Bombay, and requested copies of her birth certificate in 2005. Her application ended up at the recycling center. "This is terrible," Champsi said. Visa applications were submitted by current and former executives of many of the region's leading employers, including AT&T Wireless Inc., Oracle Corp., Intel Corp., Microsoft Corp., Qualcomm Inc. and Williams-Sonoma Inc. The documents illustrate the extent to which major U.S. companies have established operations in India or rely on India for key services. A letter from Gap's then-CEO Paul Pressler accompanying the visa application for Pollitt says the company's CFO was heading to India for several days in April 2004 "for the purpose of visiting Gap Inc.'s sites and vendor facilities." After the application surfaced this week, Pollitt said he found it "both astonishing and alarming to learn that basic safeguards were apparently not in place to ensure the privacy of my personal information. "As a past victim of identity theft, I am painfully aware of how important it is to ensure personal information is well protected," he said. Another Bay Area exec whose privacy was jeopardized is Rob Haragan, co-founder of NetDevices Inc., a Los Altos company that specializes in network security. Much of NetDevices' research is conducted at a facility in Bangalore. Haragan, a former executive at Cisco Systems Inc., applied for a visa to travel to India in 2004. He estimates that he's since been to the country more than a dozen times. He said he was surprised to learn that his application spent weeks at a recycling center. "The consulate absolutely needs to correct this," Haragan said. "It's a breach of trust." Brian Biega oversees storage of internal paperwork at Redwood City software giant Oracle, so he knows a thing or two about the proper handling of confidential documents. He, too, applied for a visa to visit India in 2004, and his application also ended up at the recycling center. Biega didn't hesitate when asked how Oracle's famously truculent CEO Larry Ellison would react if boxes of sensitive information were left at a recycling center. "I'm sure I'd lose my job," he replied. At the Indian Consulate, Consul General Prakash said there may be a cultural dimension to the level of outrage related to the incident among Western visa applicants. "In India, I would not be alarmed," he said. "We have grown up giving such information in many, many places. We would not be so worried if someone had our passport number." Deputy Consul General Sircar said that in other countries, Indian officials are able to go to the roofs of their offices and burn documents they're no longer able to store. "In America, you cannot do that," he said. Sircar said the consulate would find some other way to deal with its excess paperwork in the future. Pugni at the recycling center said that shortly after he had the documents carted away, a representative of the consulate arrived at the facility. "He apologized for everything," Pugni said. "Then he said he was on his way to Best Buy to pick up a shredder." http://sfgate.com/cgi-bin/article.cgi?f=/c/a/2007/02/02/MNGHNNTLI81.DTL

[yoda]

Re: Sensitive data dumped at recycling center

"He apologized for everything," Pugni said. "Then he said he was on his way to Best Buy to pick up a shredder."

:lmao: :lmao: :lmao: Terrible. Yes, it is confidential. Credit card numbers need to be SSL level secure, but people's phone numbers, passport numbers, etc should also be treated as confidential.

[DesiChap]

US: Indian consulate caught dumping visa applications The Indian Consulate in San Francisco was caught in a controversy when the San Francisco Chronicle reported that it dumped documents and paperwork submitted along with the visa application, in the open. Visa applications by Byron Pollitt, chief financial officer of San Francisco's Gap Inc, and Anne Gust, wife of California Attorney General Jerry Brown, were among the documents lying for more than a month in the open yard of a recycling company, the report said. Brown, a former governor of California and a good friend of the Indian community, termed it as shocking and unacceptable. After the Chronicle reporter examined the site and questioned the people, the documents were taken away on January 31. The documents contained information on applicants' names, addresses, phone numbers, birth dates, professions, employers, passport numbers and photos. Accompanying letters detailed people's travel plans and reasons for visiting India. But Consul General BS Prakash told the newspaper that the documents were not confidential and did not contain social security numbers or credit card numbers. The consulate officials did not return a call from rediff.com. The report said that it was not difficult to find the social security number of a person using the information contained in the dumped papers. 'Data from the documents could be used to get false passports. Some of the 9/11 hijackers used false passports. This is absolutely sensitive information. It needs to be safeguarded,' Charles Cresson Wood, a Sausalito information-security consultant, was quoted in the report. After keeping the documents for a year, the consulate would destroy them due to space problem, Pratik Sircar, deputy consul general, told the paper. The consulate hired a company in December to cart the boxes to the Haight Ashbury Neighborhood Council recycling center near Golden Gate Park on Frederick Street. 'We thought it was their job to shred the material as soon as they got it,' Sircar said. But Andy Pugni, general manager of the recycling center, said, 'We take in paper, put it in large containers and ship it off for recycling. That is all we do. We don't shred.' The documents were in the open ground where public could get easy access. Many of the boxes were marked 'visa applications.' After the reporter's intervention, a truck was brought in to send the papers to an East Bay company that will boil them down and recycle them as blank pages. Paperwork of almost all those who applied for visas between 2002 and 2005 were in the boxes. The documents submitted by Indian citizens were in other boxes. Pollitt said he found it 'both astonishing and alarming to learn that basic safeguards were apparently not in place to ensure the privacy of my personal information. As a past victim of identity theft, I am painfully aware of how important it is to ensure personal information is well protected,' he told the Chronicle. Consul General Prakash said there might be a cultural dimension to the level of outrage related to the incident among Western visa applicants. 'In India, I would not be alarmed. We have grown up giving such information in many, many places. We would not be so worried if someone had our passport number,' he was quoted in the report. http://www.rediff.com/news/2007/feb/03visa.htm

[yoda]

Re: Sensitive data dumped at recycling center Anyways, there are many such instances of companies losing/exposing confidential information. Banks and credit card companies in the US routinely "lose" customer information including SSN and CC numbers. They typically employ a third party to handle these issues who end up "losing" them.