EE Failures – the Saga Continues

EE, having promised to phone between 12 and 3 today, failed to do so, wasting yet another half day of the DeliveryDemon’s time. This company is demonstrating quite unashamedly that it has no intention of providing the service being paid for, or any other form of customer service.

Telecomms is part of any country’s national infrastructure these days, and an essential utility for everyday living. People deprived of an effective telecomms service are being cut off from some of life’s essentials. The DeliveryDemon has decided to see if those paid to represent the interests of the public are actually prepared to take action when an infrastructure provider is in such blatant breach of its responsibilities. She has emailed those whose roles claim some responsibility in this area. It will be interesting to see whether any of them are prepared to take action.

The local MP, Tom Pursglove seems to be an obvious contact to start with. The email has received an automated reply.

David Cameron is far too grand to accept normal email, and restricts communications to a form limited to a measly 1000 characters. On top of this he requires an email confirmation.

Sajid Javid has responsibility for business innovation, and should be interested in the way infrastructure failure affects small businesses. The email has received an automated reply.

Greg Clark is another minister with responsibilities for local businesses. He doesn’t seem to have an automated acknowledgement set up.

John Whittingdale has responsibilities for next generation mobile communications, so might be expected to understand that you can’t build a next generation on the foundations of the failing current generation. No automated acknowledgement from him either.

Sharon White heads Ofcom, so should have an interest in the fact that their dispute resolution arrangements are worse than useless. No automated acknowledgement yet.

Elizabeth Truss has responsibility for rural affairs so should be interested in broadband failure outside the M25. No acknowledgement so far.

Matthew Hancock, with Cabinet Office responsibility, should have an interest in the gross deficiencies in provision of national infrastructure. Another automated acknowledgement.

Cabinet Minsters have a lazy habit of not providing ministerial contact details until you email them, then announcing that you have to use a completely different email address – hardly a commitment to serving the public who pay them. So that means another bout of emailing to get past that barrier. Open government anyone??

Aiding and Abetting Criminal Activity

That’s what our phone companies are doing. It is an offence to harass people. It is fraud to entice people into believing that they have money due to them when the caller has no evidence that that is the case. It is an offence to hold people’s data without their permission. It is fraud to lie to persuade people to reveal their personal information. According to a government task force, a BILLION of these crimes are committed every year, with the assistance of our phone companies.
Our telecoms companies are making money out of these crooks, one way or another. They are certainly making no effort to prevent their infrastructure being used for criminal activity, despite being fully aware of the scale of what is going on. All we get is mealy mouthed platitudes recommending that we take actions which are either unfeasible or ineffective. Let’s get a few facts straight on just how useless these recommendations are.

• Register with TPS? It’s a waste of time.
  • TPS doesn’t actually do anything with complaints
  • The crooks ignore TPS anyway
• Block callers?
  • The crooks are spoofing numbers so blocking one number has little effect
• Don’t answer if the number is withheld?
  • There are, unfortunately, some genuine companies which call from withheld numbers, ignoring good customer service for their own administrative convenience
• Don’t answer if you don’t recognise the number?
  • Few if any people have complete knowledge of all the numbers they could be called from, whether personal or business. A child whose phone battery is dead could borrow a friend’s phone to call so no parent can afford to ignore unknown numbers. A friend can change phone number. A business contact could call from a landline when you only have their mobile number recorded. There is a host of reasons why a call from an unknown number could be both valid and important.

There are various reporting mechanisms – the ICO, Action Fraud, TPS, Ofcom, to name but a few. All those websites are badly designed. Their automated responses are uninformative and, in the case of Action Fraud, hide the content of their response in a dubious looking attachment. There is little if any evidence of any use being made of the information provided by these routes.
It would not be unreasonable to expect phone companies to make significant and meaningful effort to prevent their infrastructure being used to harass people, commit large scale fraud, and commit widespread identity theft. It would not be unreasonable to expect legitimate organisations not to behave in a way which emulates crooked behaviour.
Here are a few suggestions for the Nuisance Call Task Force.

• Make it an offence to spoof a number
• Make it an offence to deliver a call with a spoofed number
• Make it an offence for a commercial organisation to withhold their number
• Make it an offence for any organisation to sell or give away the personal details they collect
• Limit the period for which an organisation can retain personal details and use them for sales and marketing
• Create a single, simple, effective means of reporting the numbers used by scammers
• Use the scammer reporting facility to create and maintain a single database of numbers recognised as being used by scammers
• Make the database publicly visible
• Flag numbers which are consistently being used in a criminal manner – say after 10 reports of the number as one which makes scam / harassing calls
• Make it an offence for a phone company to issue the scamming number to anyone
• Make the ban on reissue of scammer numbers meaningful – say a 10 year ban on their reissue
• Make use of existing legislation to prosecute scammers for harassment as well as data protection and telecoms offences
• Hold the directors of those companies responsible – directors of the calling company, its parent company, and any company on whose behalf it makes outbound calls
• Since the crimes are being committed in this country in the homes of those being called, ignore the country of residence of those responsible for the scams and arrest any responsible directors who set foot in this country
• Recognise that it is individuals who are responsible for encouraging / permitting these crimes and hold all directors responsible and liable to prosecution
• Set penalties so that they automatically include both default and a significant fine

So why does the DeliveryDemon thinks this would work?

• It will create an incentive for phone companies to take responsibility for the way in which they allow their infrastructure to be used
• It would prevent genuine customers from being issued with numbers which people have blocked because the numbers were being used for scam calls
• It would prevent banks from grooming their customers to give away security information to people who call them – for over a decade banks’ cavalier attitude to customer security has been demonstrated time and again when they make outbound calls to customers and proceed to ask for passwords and other sensitive information
• It would encourage organisations to start to take data protection seriously
• It would do away with the loophole which allows all the enforcement organisations to abdicate responsibility for scam calls originating overseas
• A mandatory penalty of imprisonment would prevent those responsible from buying their way out of loss of liberty
  Significant fines for every offence would start to undermine the business model which makes scam calls profitable.

Let’s face it, we are talking of 32 crimes every second of every day. If our politicians and legislature and police and regulators aren’t prepared to take this seriously, the DeliveryDemon wonders what the hell we pay them for.

Harassment – The Crime Committed By Nuisance Cold Callers and Similar Scammers

We’ve all had it, the persistent calls at ridiculous hours, with recorded or spoken scripts riddled with lies. The smarmy sleazy voices. They pretend to represent or be authorised by government departments. They pretend they know about a claim or right you have. They pretend you have to do something because of new legislation. They lie and lie and lie. They want your money for some dubious product, and people have been scammed out of thousands of pounds this way. They want your personal information, and giving them that is a large step on the way to the hell of ID theft and further fraud.

They got your data from somewhere illegally, and once one bunch of these crooks have your data it gets sold around. Try as you will, you can’t stop it. It’s not just data breaches. It’s not just small naïve organisations not being good enough with their data security. It’s not just all these marketing offers. Government departments have been publishing sensitive personal data for years, and two of the biggest are doing their damndest to start selling it on a large scale to all and sundry – step forward HMRC and the NHS. We have in the space of a few short years been forced into dealing with constant harassment within our homes.

I’m actually surprised that telecoms companies aren’t protesting about this. There’s been a lot of recent publicity about people giving up on landlines for the simple reason that the bulk of calls come from fraudsters autodialling or using illegally obtained information. At least with a mobile you can cut the call off. When it comes to the primitive technology of landlines, the caller has control and can block your line.
With elections coming up we’re getting mealy mouthed platitudes from politicians about doing something to stop this. Why haven’t they done it before? The legislation already exists. These calls easily fall within harassment legislation and it is a criminal offence.
• It certainly distresses people to be constantly interrupted
• Frequently numbers are withheld, which is intrinsically threatening since the caller appears to be untraceable
• Many of these calls are silent, which is particularly threatening.
• A frequent tactic is to pretend that there is legislation which means the called person must do something
• The callers refuse to say where they obtained the personal information they so clearly have, which is a tactic of intimidation – ‘we know about you, we won’t say how’
• Buying or selling or passing on illegally obtained information is certainly harassment since it perpetuates and escalates the distress being caused.

The CPS provides the following definition of harassment:
‘the term harassment is used to cover the ‘causing alarm or distress’ offences under section 2 of the Protection from Harassment Act 1997…. The term can also include harassment by two or more defendants against an individual or harassment against more than one victim.
Although harassment is not specifically defined in section 7(2) of the PHA, it can include repeated attempts to impose unwanted communications and contact upon a victim in a manner that could be expected to cause distress or fear in any reasonable person.
A prosecution under section 2 or 4 requires proof of harassment. In addition, there must be evidence to prove the conduct was targeted at an individual, was calculated to alarm or cause him/her distress, and was oppressive and unreasonable.
Closely connected groups may also be subjected to ‘collective’ harassment. The primary intention of this type of harassment is not generally directed at an individual but rather at members of a group. This could include: members of the same family; residents of a particular neighbourhood; groups of a specific identity including ethnicity or sexuality, for example, the racial harassment of the users of a specific ethnic community centre; harassment of a group of disabled people; harassment of gay clubs; or of those engaged in a specific trade or profession.

Well, distress is being caused on a large scale. There are very clearly repeated attempts to impose unwanted communication, and there is no realistic opt out – the so called opt out option on automated calls has long been recognised as being used as confirmation that the person called is gullible so a good target for further harassment.

As to evidence, since these scammers are being allowed by telecoms providers to withhold numbers or display numbers, there’s not a lot the victim can do. But the information is flowing through the telecoms companies. They make money from these calls. In effect they are abetting fraud and harassment by doing this. Let’s see them forced to take some responsibility.

Are individuals being targeted on the basis of ‘protected characteristics’? Look at the age profiles. Ask people who have hit 50 or 60 or 70. Ask people who have started getting a state pension. Age is a recognised trigger for increasing volumes of scam calls. The fraudsters assume that older people are easier to intimidate into parting with information and money, and sometimes they are right. It may be the targeting of people who grew up in more innocent times and who, by retiring, are predictably likely to be at home at times to suit scammers. It may be people who are vulnerable through bereavement, particularly if the late spouse took responsibility for financial matters. It is more common for elderly people to be confused, through dementia or medication, so less resistive to scams. It sure as hell means that these scammers are targeting people on the basis of the protected characteristic of age.

Of course the people doing all this cannot help but be fully aware that they are following a course of conduct which amounts to harassment. It takes little intelligent thought to recognise the conduct as unreasonable. In fact it takes a highly determined effort at self-deception to find even the flimsiest framework which shows the conduct as anything other than deceptive, dishonest, unreasonable, and intimidating.

They know all of this when they buy data without checking it has been legally obtained so the defence of legitimate trade does not apply. They know it when they sell the data on illegitimately. They know it when they autodial. They know it when they phone TPS registered numbers. They know it when they write and approve scripts full of lies. They know it when they train their staff.

They? The Board of Directors, obviously, and also those in senior management who promote and collude with harassing behaviour. That covers operational management and strategic decision making. It covers HR when they set targets which depend on harassment producing results. It covers those who accept financial reports based on results obtained by harassment. It covers auditors who turn a blind eye to the way a company generates its profits. It covers those businesses which provide outsourced outbound calling services and pretend that they have no responsibility for the legitimacy of the data they use for calling. They are all executing or colluding with institutionalised practices of harassment.

There is of course Data Protection legislation, but that is too weak to be useful, more so since it relies on civil prosecution by the victim, and the harassment is executed in a way which prevents the victim from getting access to the necessary proof.

Under Protection From Harassment legislation, a perpetrator can be imprisoned for up to 6 months and fined up to £5000. The legislation for punishment exists. The cases exist to prosecute. The data is available to prosecute. Yet there has yet to be a prosecution. Not a single politician has risen from their backside to ask why there have been no prosecutions.

The DeliveryDemon, like a lot of people, is pretty quick to recognise scammers and tell them where to go. They are still a bloody nuisance and their calls are still harassment. She would dearly love to hear just one actual or prospective MP actually stand up and ask – loudly – for action to be taken using the ample legislation which is already in place.

Yes, let’s see the Action Fraud database being used to collect details of these harassers. And Data Protection reports. And Ofcom reports. And TPS reports. All the data collection mechanisms exist. Let’s see a campaign encouraging the victims to report their harassers. Let’s see some pressure on the telecoms companies to take responsibility for ensuring that their networks are not used for harassment. And let’s see the data being used for prosecutions.

We have seen a few prosecutions in other sectors for blatant criminal activity. Doing the same to the decision makers in nuisance cold calling organisations just might prompt an improvement in their behaviour.

Delivering Complexity at the Expense of Security

The DeliveryDemon is frequently flabbergasted by the sheer stupidity demonstrated by so many financial institutions when it comes to security. They obstinately pretend that imposing complexity on account access equates to security, in the face of all evidence to the contrary. At the same time they refuse to acknowledge that their own processes are often staggeringly insecure.

Some time ago after a trip abroad, the DeliveryDemon had a phone message claiming her credit card had been compromised, and asking her to ring the issuer on an unidentifiable number. It clearly sounded like a scam which needed to be reported to the issuer. So the DeliveryDemon phoned the switchboard and asked to be put through to the person who had left the message. She was unsurprised when the switchboard had never heard of this person, and asked to be put through to the security and fraud department – where she found herself talking to the person who had left the suspect message.

So how many security mistakes was that?

• Leaving a message about a card compromise on a landline answering machine without knowing who might pick it up
• Asking the cardholder to ring a number which could belong to any scammer
• Creating a situation designed to justify a request for secure information, using a process riddled with fundamental security flaws
• Preventing a customer from carrying out basic security checks by using a name not recognised by the switchboard.

But the biggest mistake of all was the fact that some time afterwards the DeliveryDemon had to deal with the identical flawed process. Needless to say, the DeliveryDemon had complained to the card issuer on the first occasion, yet the organisatioj had taken no notice of the complaint and had continued knowingly to operate processes which were fundamentally insecure.

This type of stupidity is remarkably common in the financial services sector, and a couple of very similar examples are described in an earlier post .

https://deliverydemon.wordpress.com/2012/04/02/delivering-poor-banking-security/

The other side of this refusal to operate secure processes is a determined effort to create barriers to prevent a customer from accessing their own funds. This goes hand in hand with lengthy and inequitable Ts and Cs which attempt to absolve banks from any responsibility whatsoever. The DeliveryDemon recently encountered this while opening a very basic bank account. This ‘simple’ account required no less than EIGHT authentication factors, including providing answers to some remarkably stupid questions.

• A memorable number? Seriously? Numbers are not intrinsically memorable. Those which are memorable usually relate to public domain information, which is hardly secure.
• Details of various third parties? Public domain again. It is also questionable in data protection terms whether a bank should be asking for information about third parties who have nothing to do with the account.
• Favourite TV programs, newspapers, historical person, sleb, town? Get a life! This sort of preference is transient and likely to be forgotten months or years down the line when it is eventually needed in order to deal with some call centre drone who is not empowered to think beyond the mindless detail on the screen in front of them.

This sort of pseudo security is not just stupid in its own right, it is creating a situation where complexity makes life difficult for the customer, while being used as an excuse for financial institutions to try to avoid their own responsibilities.

Put these so-called security processes in the context of today’s digital native. Basic security advice is not to use the same details in multiple places, since compromise of one account can lead to compromise elsewhere. Typically, an account asks for 4 pieces of information, even when no financial transactions are involved. Try counting them up. Even without an intricate lifestyle the following range of accounts is pretty commonplace.

• Mortgage
• Mortgage-related insurance
• Life insurance
• Health insurance
• Current account
• Savings account
• Debit card
• Credit card
• ISA
• Pension
• E-mail account
• Work e-mail account
• Mobile account
• Landline / broadband account
• Car insurance
• Car radio code
• Electricity account
• Gas account
• Water account
• Council tax account
• Supermarket account
• Amazon account
• i-Tunes account
• Comparison site accounts – up to half a dozen
• Social media accounts – another half a dozen
• Technology support arrangements – say 3
• Travel accounts for commuters – another couple
• Online information sources such as newspapers, news sites and the like – say 3.

All of these want a login ID and a password, plus several additional pieces of information for ‘security’ should you be unable to log in. Security guidance suggest that unique information should be used for each situation, and that the information should not be written down in a recognisable format, even when months or years may elapse between accesses to the account.

Put this into the context of the real world. Current security guidance expects the individual to memorise in excess of 172 unique pieces of information, and to relate each piece of information to one of 43 or more situations. Current practice is for Ts and Cs to forbid keeping written records of passwords in any useful format. This is complete nonsense, not security.

So what’s the answer? There are organisations which can be used to store multiple passwords, but these then become a single point of failure should the access password be compromised or the organisation’s own security be breached. It’s not clear whether this sort of password storage is acceptable under access Ts and Cs either.  Even if banks start to give some form of approval to these organisations, it could be withdrawn, leaving the customer with the option of dealing with multiple password holders or changing to a new one. If a security breach underlies the reason for change, that would mean working through every single account to change access details. In some circumstances that may mean the delay of going through the account provider to replace codes which they do not allow the customer to change.

The current security situation is clearly unsatisfactory, ineffective,  and unfair to the customer. The DeliveryDemon thinks it is time that organisations which are responsible for security got together with both security and usability experts to come up with a solution which is designed to protect the customer’s interests, not a solution based on allowing financial institutions to avoid responsibility.

Delivering Poor Banking Security

The DeliveryDemon has the rather naive expectation that banks who are entrusted with our money should operate reasonably secure procedures. Hang your heads in shame RBS and Barclays.

The DeliveryDemon has had cause to complain to both banks recently. In each case the complaint was about their processes, not anything specific to the account. In both cases an idiot from their customer ‘service’ team phoned up and demanded to know secure account access details before they would consider listening to the complaint. Do they really think it is sensible for someone to give out account password information to a random caller?

RBS, there is no need to access my account in order to hear that it does not constitute ‘faster payment’ if you take details of a payment on Friday and can’t process it till Tuesday unless the I ring again on Monday.

In fact there is no need for your customer ‘service’ to access my account at all. The default action should NEVER be to access the customer account. Basic security is that this should only be done if the customer raises a matter specific to the account, i.e. if there is a genuine need to access the account.

Banks are piling on nuisance value processes to make it more difficult for the customer to access their own money, all in the name of security. It’s about time they got their own house in order, introduced secure internal processes and gave their customer contact staff some basic security training.

Delivering Support for Scammers at Taxpayers’ Expense

The DeliveryDemon has been analysing the lifecycle of the common bureaucratic organisation. It is very obvious that bodies set up to deal with offences against consumers very quickly morph into something very different and much less useful. Being a bureaucratic organisation, they discourage individual responsibility in favour of box ticking and remote decision making. They quickly avoid dealing with the individual consumer, preferring to collect statistics via paperwork and cosy chats with representative organisations. This of course leaves the individual consumer dealing with layers of obfuscating bureaucracy on top of the original problem. And of course, all this bureaucracy is being paid for by the taxpayer.

These thoughts were prompted by the DeliveryDemon’s recent dealings with phone scammers. It’s common knowledge that these cold callers represent companies who profit from the sale of dubious products. They are known to target the elderly and vulnerable, timing calls for when these people are most likely to be home. The scammers frequently try to give the impression of legitimacy by using wording which conveys the impression that they are some sort of government body, and that they have the callee’s details from some official source. Recent scams include solar heating and payment protection insurance claims.

The DeliveryDemon registered with the Telephone Preference Service a long time ago, but this doesn’t stop the calls. First they exclude ‘market research’. Of course this is handing a ‘get out of jail free’ card to the scammers. All they have to do is ask a few questions to claim they are carrying out market research. Each time the DeliveryDemon looks at the TPS website, the list of things they don’t cover has grown longer, but TPS is still being touted as the best way to avoid scam calls.

The DirectGov website is promoting a new bureaucratic setup which enables simultaneous signup to TPS and MPS which supposedly stops junk mail. Guess what! The signup site brings up a warning message – ‘The security certificate presented by this website has expired or is not yet valid. Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.’

A mere few months ago, the DeliveryDemon became aware of the National Fraud Authority’s Action Fraud line 0300 123 2040. At the time the DeliveryDemon’s household was being plagued by multiple daily autodial calls from the solar heating scammers. After a couple of calls to Action Fraud, the scammers stopped calling. Great. But in a few short months it appears that Action Fraud has been quick to take the path of bureaucratic decline. The DeliveryDemon received a series of calls from PPI Claims scammers implying they had something to do with the Ministry of Justice and that they had some knowledge of a claim the DeliveryDemon was entitled to make. So the DeliveryDemon traced the callers and reported them to Action Fraud, only to be told that this was probably just their sales line. So that’s OK then? No it’s NOT. A dishonest sales line is a scam, that is and attempt to use deception to part the callee from cash. In other words it’s attempted fraud. The DeliveryDemon is nothing if not persistent and eventually Action Fraud grudgingly agreed to record the scam details for their records, but announced that TPS and the Information Commissioner were the correct complaint route.

The ICO does give advice on dealing with scam callers. ‘If you receive an automated marketing call or live marketing call which you think breaches the Regulations you should write to or email the organisation concerned (remembering to keep a copy of all correspondence). Tell them about the problem and allow them time to put things right. If you continue to receive marketing calls despite registering with TPS, or asking the organisation to stop, we may be able to help.’

Seriously, the ICO will only consider dealing with a complaint once the callee has actively engaged with the scammers. In other words, the caller has to provide the scammer with sufficient information to allow the scammer to validate the nature of the number they have been calling – and, like email address lists, phone lists can be sold for more if it has been validated that there’s a real private individual at the end of the line. This is common knowledge for anyone advising on personal security matters.

So that’s four taxpayer funded organisations all claiming to deal with phone scams, and all getting less and less effective, dropping responsibilities and passing the buck. The StayPrivate one has sprung into existence in a time of so-called austerity, and appears to bring no benefits to the table. What’s the point of politician’s airy persiflage when cutbacks in extravagance are promised on one hand, and money tossed away with the other? The DeliveryDemon despairs!

Surprise, surprise – Risk Management

The DeliveryDemon was interested to see some risk management being discussed in the US Treasury.

The US bank bailout includes the setting up of a public-private partnership to buy up toxic assets. As this Reuters article http://tinyurl.com/carurp explains:

• The cost risk to taxpayers outweighs the potential for benefits
• Conflicts of interest have been identified and recognised as a source of risk
• The scheme is inherently vulnerable to fraud, money laundering and other forms of abuse
• The ‘public’ element of the public-private partnership dilutes the risk for the private element, increasing the likelihood of a high risk approach to managing the overall funds

What is surprising is that these risks are being so publicly and simply stated. The early days of most public-private partnerships are normally wreathed in a mist of bonhomie as each party strives to protect and enhance its relationship with the other party. Reservations are rarely made public.

The DeliveryDemon will be interested to see how strongly this risk management and transparency is followed through. And whether the UK takes a lead from the US when it comes to acknowledging and managing the risks associated with the UK government’s bank bailouts.