DataGate Post-Mortem: Protection Questions Linger
July 25 Follow-up Post: “Data-Theft Communication Follow-up”
____________________________________________
With the release of the Inspector General’s report (PDF) and the Governor’s reaction statement, we’re supposed to believe DataGate has been taken care of.
Mr. Ilovar, the intern whom the governor said wouldn’t be scapegoated, has nonetheless been fired, as have a few others. Governor Strickland has issued an Executive Order (PDF) mandating better controls and encryption. A program and procedures to protect those whose personal information is now “out there” is in place.
(I don’t have a problem with the Ilovar firing, because leaving the data device in the car instead of taking it inside where he lived probably was a firing offense. But the governor had to know that the data was not where it should have been from the very beginning, so his initial vote of confidence and subsequent about-face [without Old Media comment, naturally] are a bit hard to handle.)
So the underlying sentiment appears to be, “Let’s move on, shall we?”
Not so fast, people.
I have reviewed the three documents originally posted at Right Angle Blog. RAB has allowed me to post them at BizzyBlog, and I have done so in this separate post that contains all three docs (the letter from the state, the Debix Registration Form, and the Debix Agreement; 7/25 update — added two separate docs at the bottom, the Debix Activation Page and Debix’s Home Page). I do NOT have a scan of the envelope an affected person would receive; if anyone has one, I would appreciate it if they could e-mail it to me.
I think the documents raise at least these issues:
- How likely is it that those who receive the letter from the state or visit Debix’s web site will think that the whole thing is just another clever phishing expedition designed to fool people into giving up their private and personal information?
- Assuming those who receive the letter believe that the communication is legitimate, will they understand what needs to be done to become eligible for the year of protection?
- In tone, has the State and Debix, its selected protection service vendor, been discouraging, encouraging, or neutral in describing the service and the importance of signing up for it? In other words, based on what has been conveyed, will those affected feel as if they should sign up for the protection, or that it’s either too much trouble to bother with or a waste of time?
- Is Debix being allowed to capitalize unreasonably on the business the state has dropped in its lap to promote its consumer-paid protection services to those affected?
Though I don’t have the time at the moment to detail it out, I believe the answers to all four questions are less than satisfactory. I will get to those details later tonight or tomorrow morning. In the meantime, feel free to send e-mails or to comment (remember, comments are moderated, so they won’t appear until I’m back late this evening).










