ChoicePoint is a leading U.S. personal “data broker” that provides products and services to governments, businesses and individuals. Products and services provided include pre-employment screenings, public-records searches, background checks and direct marketing searches among several others (ChoicePoint (A) Case Study, Exhibit 2). In order to provide these products and services, ChoicePoint’s businesses all depend on access to personal and private information, to which needs to be accurate and protected. However, ChoicePoint has seen problems with both the accuracy and the protection of the data they hold in their databases. ChoicePoint has had several instances in which the data they have provided to a client was inaccurate and it has caused unjust hardships on innocent individuals. For example, a woman in Chicago was fired as a result of the information her company acquired from ChoicePoint incorrectly stated that she was a drug dealer and shoplifter (ChoicePoint (A) Case Study, pg. 5, paragraph 3). Although ChoicePoint has acknowledged that maintaining accuracy is a challenge they have not been proactive in changing their policies in order to correct these inaccuracies in their data. ChoicePoint has maintained the status quo stating that their several public and private sources are able to update their records faster than they can buy or collect the information (ChoicePoint (A) Case Study, pg. 6, paragraph 1). Although, the stale data and inaccuracies are a major concern, ChoicePoint has an even bigger problem they need to resolve; as they have not effectively protected the information they hold. This is a bigger problem, than the accuracy issue because it overall affects more stakeholders and individuals. In addition, the issue with data protection can be a source of inaccuracies due to identity theft. 162,000 American’s data was mistakenly released in 2004, when ChoicePoint approved bogus small business applications to gain access to their databases (ChoicePoint (A) Case Study, pg. 1, paragraph 2). With the personal data industry being extremely unregulated it is up to ChoicePoint to clearly define their processes and be proactive when it comes to protecting the sensitive data they hold. The data breach that ChoicePoint incurred has forced the company to acknowledge that they need to implement new policies and procedures in order to prevent further damage to their reputation. The problem ChoicePoint has with the protection of their data affects a number of stakeholders. External stakeholders, such as clients and individuals probably have the most at stake in regards to this issue. It is their information that is essentially being stolen as a result of ChoicePoint’s lack of oversight and processes. When personal information is given to the wrong individuals, external stakeholders are at risk of having their identities’ stolen which can lead to even more issues, specifically accuracy issues with data circulating amongst several different entities. Internal stakeholders, such as the CEO and the board of directors, are also affected by this problem, because if something is not done about this, there could be damage done to their reputation and valuable business relationships needed to sustain the company. In addition there is the possibility of push back from individuals to have governmental oversight over these types of businesses. ChoicePoint has focused their efforts more so on the data collection portion of their company rather than focusing on the protection of the data that they collect. Although the company states that they limit the use of the specific data they hold, for example an insurance company can only receive and view insurance related material, and that they have administered a “credentialing process” for potential customers, it is clear that these internal controls are not being properly managed and maintained. If they had been, ChoicePoint would have been able to identify the individuals whose information was compromised at the onset of the data breach. However, ChoicePoint had difficulty identifying these individuals, blaming it on the imperfect tracking of usage within the company. In addition, the “credentialing process” is a significant weakness because only certain accounts are audited for accuracy and the initial process for approval includes a phone call to the main line listed on the application. Also, the breach the occurred throughout 2004 was not the first of its kind. In 2002, a similar breach was brought on against the company resulting in a 7,000 consumers being subject to identity thieves and a company loss of approximately one million dollars (ChoicePoint (A) Case Study, pg. 11, paragraph 3). With the inefficiencies and weaknesses of these specific processes, it is rational that these would lead to ineffective protection of the data they hold. The article “The Myth of Securing Computing” discusses network attacks, intrusions and malicious threats companies are faced with as well as the operational approach of managing said threats. Under the operational approach, there are eight processes that ChoicePoint need to either develop or build upon and then properly manage. These processes are: 1) Identify your company’s digital assets, and decide how much protection each deserves, 2) Define the appropriate use of IT resources, 3) Control access to your systems, 4) Insist on secure software, 5) Know exactly what software is running, 6) Test and benchmark, 7) Rehearse your response, and 8) Analyze the root causes (Austin, et. al., 2003 pgs.123-126, under “operational approach”). Although ChoicePoint needs to improve upon each of these processes, they are clearly lacking on controlling access to their systems as they are providing access to individuals posing as fake companies and they are unable to track the usage of their databases as well. If these specific processes were developed and managed in a coherent, consistent way, ChoicePoint’s databases would be protected more efficiently. ChoicePoint has a few options they should consider in order to do their due diligence in protecting the sensitive information they possess. One potential solution would be to implement a better software system that allows ChoicePoint to more accurately track their users. Another solution they could consider is to work on improving their credentialing process. Lastly they could build upon their current structure and create a new department to which is in charge of compliance, data protection and the credentialing process for potential clients. By implementing a system that better tracks the information their clients are accessing, ChoicePoint would be able to strengthen their control over the access of their systems. In addition the company would also be able to pinpoint what individuals information was accessed by the fraudulent companies or by any other potential hackers in an efficient manner. By having the information quickly, the company can mitigate any further damage that could affect their software systems and any damage that may be done to their reputation as well. Improving upon the current credentialing process is another solution that ChoicePoint could implement that would protect the information they possess as well. ChoicePoint could strengthen their credentialing process by making potential clients submit additional paperwork, such as bank statements. They could also implement a policy that a company must be in business for at least three months prior to applying for their services. In addition, a team could be put into place so that personal site visits could be done as well. This solution allows for the company to develop a better relationship with their clients and know who exactly is accessing their databases. ChoicePoint could also implement a compliance and data protection department. The department would be charged with the tasks of revamping the credentialing process, reviewing and approving applications as they are received and for implementing and managing the processes identified in “The Myth of Secure Computing” article. The department would allow for the company to properly stay abreast of emerging threats and how to manage them efficiently and effectively. Although all solutions strengthen the overall data protection of the information ChoicePoint holds, the development of the compliance and data protection department is the best course of action. By implementing this department, the proper review on potential clients and current clients can be done which would strengthen the data protection at ChoicePoint due to more oversight and stronger processes. The department solution would be more effective than the other two solutions because of the involvement that would be required by management and current employees and it’s a long-term solution. The new software system to track usage of the database can easily be implemented and then forgotten about if no one is actually analyzing the information that is generated by the program on a scheduled basis. The employees who are approving and validating applicants could also ignore the new procedures under the new and improved credentialing process. By having a department tasked with the final review and analyzing information for compliance issues on a scheduled basis, ChoicePoint will be in a better place to protect themselves against any potential future treats. However, the development of a new department is time consuming and costly, which are two of the main reasons why companies are not properly protecting the information they hold. Initially, ChoicePoint’s upper management would need to determine the feasibility of the department. Then they would need to develop a department budget, find space to house the employees of the department and clearly define the mission of the new department. Once approved, the department should first initially set clear processes in regards to data protection and create policies that would also strengthen the protection of the data, such as a new credentialing process. There could be resistance to the new department and the implementation of several new processes and policies. However, upper management and general managers need to develop a plan to implement things slowly but also effectively. The development of an important department is going to take time, patience and money but in the long run it will allow ChoicePoint to properly protect individuals’ identities while still being able to provide their clients with the information they need.

Works Cited

Austin, Robert D., and Christopher A.R. Darby. 2003. "The Myth of Secure Computing." Harvard Business Review 81, no. 6: 120-126. Business Source Complete, EBSCOhost (accessed March 1, 2015).

Paine, L. & Phillips, Z. 2008. “ChoicePoint (A)” Harvard Business Review No. 306-082.