Personally Identifiable Information (PII) and Data Breaches
By Stevie D. Diggs
University Maryland University College
IFSM201 Section 7974 Semester 1309

Personally Identifiable Information (PII) and Data Breaches
Knowing and training on personally identifiable information (PII) is important in today’s society. There has been research on data breaches and identity theft that links them both together. This is to help personnel have a clear understanding on the impact of what is at steak and an explanation of PII. Many businesses and organizations have different definition for PII because of the classification of data for each, and that is why understanding PII is important. Examples of PII include, but are not limited to the following: full name, maiden name, mother‘s maiden name, or alias; personal identification number, social security number (SSN), passport number, driver‘s license number, taxpayer identification number, or financial account or credit card number; address information, street address or email address; personal characteristics, including photographic image, fingerprints, handwriting, or other biometric data.
How do you protect PII? Who has access to PII? Who are affected by data breaches and identity theft? How to prevent data breaches and identity theft? The research introduced in this essay is from Verizon along with multiple articles involving military and organizations. PII is defined definitely by military and organizations. Training along with knowing ways to prevent data breaches and identity theft helps today’s society protect PII. So what is PII? The ALARACT defines PII as ‘any information about an individual which can be used to distinguish or trace an individual’s identity such as name, social security number, date and place of birth, mother’s maiden name, and biometric records’ (Dunn, 2011). This definition is a good explanation for all military branches due to the removal of social security numbers (SSN) from Department of Defense identification (ID) cards that have been switched to the use of Department of Defense identification and benefits numbers. A service member picture, SSN, along with full first, middle, and last name was accessible if the ID card was lost or stolen. PII is ―any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information (McCallister, 2010). This definition is based on an organization and the records they may hold. The United States Department of Labor has a similar definition but also further, PII is defined as information: (i) that directly identifies an individual (e.g., name, address, social security number or other identifying number or code, telephone number, email address, etc.) or (ii) by which an agency intends to identify specific individuals in conjunction with other data elements, i.e., indirect identification. (These data elements may include a combination of gender, race, birth date, geographic indicator, and other descriptors) (Doing Business With the Department of Labor -- Guidance on the Protection of Personal Identifiable Information). This data is personnel information that can be access via electronic or paper. How is unauthorized access to this data happening? Data breaches have been increasing since the last decade involving PII. Verizon conducted research on security breaches that occurred in 2011 which had a negative impact on personnel. These breaches sometimes lead to actual identity thefts in which the PII is used to open financial accounts and make fraudulent purchases in the victims' names (Chalmers, 2013). The data retrieved from the breach is not always used by the hacker. Cyber criminals and data thieves assign great value to PII, not because the information itself is valuable but because they can sell it or use it to gain access bank accounts and physical assets (Bucolo, 2013). Personnel are not the only ones affected by the breaches. Businesses are also impact by the breaches which occurred within their organization. As a result both the personnel and business is affected financially. “Data breaches are spiraling out of control, and companies like Sony, Citi and Epsilon are finding out just how expensive it is to not protect customer data properly,” stated Suni Munshani, CEO of Protegrity and author of the report (Murphy, 2009). Multiple reports have stated that if a proper policy was implemented along with adequate training, breaches could have been prevented. Many of the articles stated that only those with the need to know should have access to certain data. One way to manage and limit access to certain data is by classifying the data. For a business they can use restricted, confidential, and public. Restricted would include personal data such as credit card and financial account number, Social Security number, state ID number, biométrie data, health data, and date of birth (Chaney, 2009). Confidential would include strategic plans, financial results prior to release, and pricing, payroll, and marketing strategies that are nonpublic and would adversely impact the organization if disclosed to unauthorized individuals (Chaney, 2009). Public would include data that is readily available to the public and may require little or no security (Chaney, 2009). The military has similar classification definitions, but wouldn’t include public due to the sensitivity of their data. Top Secret is applied to information that reasonably could be expected to cause exceptionally grave damage to the national security if disclosed to unauthorized sources (Security Clearance Classification). This classification would not be is similar to any of the organization data classification. Secret is applied to information that reasonably could be expected to cause serious damage to the national security if disclosed to unauthorized sources (Security Clearance Classification). This particular classification would be similar to an organization ‘restricted’ data. Confidential is applied to information that reasonably could be expected to cause damage to the national security if disclosed to unauthorized sources (Security Clearance Classification). This classification would be almost the same as an organization ‘confidential’ data. Unclassified is a security classification assigned to official information that does not warrant the assignment of Confidential, Secret, or Top Secret markings but which is not publicly-releasable without authorization (Bagley, 1993). This last classification is the same as an organization ‘public’ data. This is just one of many implementations to a policy. Another implementation to a policy would be training periodically. Both military and organizations are taking this seriously due to the increase of data breaches and the loss of PII. For at least the past two years, every uniformed, civilian, and contract member of the Department of the Navy has been required to complete training on protecting PII (Murphy, 2009). For the military and DOD the training is annually. Other organizations are conducting training annually like the military while others are bi-annually. The military and DOD training is conducted via a Microsoft PowerPoint that is conducted online. Organizations are falling suite with military and DOD for conducting training online. There is only one down fall to this which is due to integrity. There's plenty to be said for personal integrity in training completion, but protecting PII and information systems is too important to rely on trust alone (Murphy, 2009). PII can have multiple definitions that basically mean the same after summarizing it. PII is any form of information that identifies who a person is. The increase of breaches has shown that today’s society needs to increase their knowledge on PII. Implementing a policy can help increase military, DOD, and organizations knowledge on protecting PII. Classifying data and including training can help decrease breaches and identity theft. Overall today’s society should understand how serious it is to protect PII, but it can’t be just military, DOD, and organizations. Everyone needs to play a role by knowing and training on PII.

References
Bagley, J. (1993). Understanding Controls on Unclassified Government Information. Retrieved December 06, 2013, from http://www.fas.org/sgp/eprint/bagley.html
Bucolo, C. (2013). Is Risky Data Lurking In Your Business Systems? ISO & Agent, pp. 78-80.
Chalmers, H. R. (2013). DATA BREACH CASELOAD: ABOUT TO BLOW? Litigation News, pp. 8-10.
Chaney, C. (2009). Data on the Move. Internal Auditor, pp. 23-25.
Doing Business With the Department of Labor -- Guidance on the Protection of Personal Identifiable Information. (n.d.). Retrieved December 05, 2013, from U.S. Department of Labor: http://www.dol.gov/dol/ppii.htm
Dunn, S. E. (2011). Reporting Requirements Incident to Breaches of Personally Identifiable Information. Army Lawyer, 37.
Eddy, N. (2011). Sony, Epsilon Security Breaches Preventable: Report. Channel Insider, p. 1.
McCallister, E. G. (2010, April). Guide to Protecting the Confidentiality of Personally Identifiable Information (PII). Retrieved December 05, 2013, from http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf
Murphy, J. (2009). Get Serious About Security Training. U.S. Naval Institute Proceedings, p. 16.
Security Clearance Classification. (n.d.). Retrieved December 06, 2013, from Military.com: http://www.military.com/veteran-jobs/security-clearance-jobs/security-clearance-types.html

--------------------------------------------
[ 1 ]. All Army Activities (ALARACT) submitted an instruction on the reporting requirements necessary for unauthorized access to PII.
[ 2 ]. “Recent study by Verizon found that in 2011, more than 850 security breaches were reported, involving more than 170 million confidential records.[4]”