14 th conference on: Computers, Freedom & Privacy UK Identity Theft Mark Webber 23 rd April 2004

1. 14th conference on: Computers, Freedom & Privacy UK Identity Theft Mark Webber 23rd April 2004

2. UK Identity theft • Fraud Advisory Panel Report • Costs UK £1.3bn ($2.34) • Up 39% in 2003 • Home Office – 300 hours average to set the record straight after ID fraud • £50m of UK benefits fraud based on fictitious identities • Impersonation fraud up by ¼

3. Identity theft in the UK • Fraud Advisory Panel Report • Recommends the UK Government considers data sharing between government and business to combat the fraudsters • Applications fraud • Account takeover • Wholesale assumption of identity • Fraudulent use of business identity

4. Perception vs. Reality The Times23 Dec 03

5. Corporate ID Theft • Fraudulent use of business identity • "account takeover" fraud that hijacks a clean identity for illicit trading • UK Companies House – does not validate any data provided • Spoof emails and "pfishing" • Corporate Governance implications • UK's Turnbull Report (internal controls)

6. Data Protection Act 1998 • Processing Personal Data in the UK • Processing - obtaining, using, organising, storing, retrieving, adapting, destroying, copying……… • Data - can now include paper held information • Personal Data - possible to i.d a living person directly or indirectly

7. 8 Principles Personal data must be: • fairly & lawfully processed • obtained only for specified and lawful purposes • adequate, relevant and not excessive • accurate and, where necessary, up to date • Kept for no longer than is necessary • processed in accordance with individual rights • secure • not transferred outside EEA without adequate security

8. Data Protection Act 1998 Section 55(1) A person must not knowingly or recklessly, without the consent of the data controller: (a) obtain or disclose personal data or the information contained in personal data, or (b) procure the disclosure to another person of the information contained in personal data

9. Computer Misuse Act 1990 Unauthorised access to computer material (1) A person is guilty of an offence if – • he causes a computer to perform any function with intent to secure access to any program of data held in a computer; • The access he intends to secure is unauthorised; and • He knows at the time when he caused the computer to perform the function that this is the case.

10. Developments • UK Entitlement / Identity Cards • Cut the myriad of means to prove identity • Proposed new criminal offence of "identity fraud" • Civil liberties arguments • Criminalize legitimate anonymity? • National Criminal Intelligence Service

11. Mark Webber • Mark Webber is an English qualified lawyer based in the Silicon Valley office of pan-European law firm Osborne Clarke. Since joining Osborne Clarke in 1997 he has advised on numerous IP and technology transactions for a wide spectrum of businesses, in particular technology, telecoms and biotechnology companies, concentrating on UK transactions, but also coordinating deals with a pan-European reach. His experience includes counselling and negotiating technology deals including: licensing, cross-border alliances, the appointment of European agents and distributors, outsourcing, joint ventures, privacy and online issues. • Coordinating resources in 15 local European offices, but permanently based in California, Mark’s practice centres around US mature enterprises or start-ups facing European trading or establishment issues. From the first steps in inward investment to managing IP exploitation or partnering opportunities he focuses on assisting US entrepreneurs navigate the hurdles of the European legal systems. e-mail: mark.webber@osborneclarke.comOsborne Clarke Office: Silicon ValleyAddress:200 Page Mill RoadSuite 100 Palo AltoCA 94306 Tel: +1 650 462 4022Fax: +1 650 462 4023 Specialism: Commercial Telecoms Privacy Outsourcing Intellectual property Technology