FTC Warns Of P2P File -sharing Risk
The U.S. Federal Trade Commission has notified almost 100 organizations that personal information, has been shared from the organizations computer networks and is available on peer-to-peer (P2P) file-sharing networks to any users.
The information includes sensitive data about customers and/or employees, FTC said.
The agency also has opened non-public investigations of other companies whose customer or employee information has been exposed on P2P networks. To help businesses manage the security risks presented by file-sharing software, the FTC is releasing new education materials that present the risks and recommend ways to manage them.
Peer-to-peer technology can be used in many ways, such as to play games, make online telephone calls, and, through P2P file-sharing software, share music, video, and documents. But when P2P file-sharing software is not configured properly, files not intended for sharing may be accessible to anyone on the P2P network.
"Unfortunately, companies and institutions of all sizes are vulnerable to serious P2P-related breaches, placing consumers sensitive information at risk. For example, we found health-related information, financial records, and drivers license and social security numbers--the kind of information that could lead to identity theft," said FTC Chairman Jon Leibowitz. "Companies should take a hard look at their systems to ensure that there are no unauthorized P2P file-sharing programs and that authorized programs are properly configured and secure. Just as important, companies that distribute P2P programs, for their part, should ensure that their software design does not contribute to inadvertent file sharing."
The FTC enforces laws that require companies in various industries to take reasonable and appropriate security measures to protect sensitive personal information, including the Gramm-Leach-Bliley Act and Section 5 of the FTC Act. Failure to prevent such information from being shared to a P2P network may violate such laws.
FTC said that the notices had gone to both private and public entities, including schools and local governments, and the entities contacted ranged in size from businesses with as few as eight employees to publicly held corporations employing tens of thousands. In the notification letters, the FTC urged the entities to review their security practices and, if appropriate, the practices of contractors and vendors, to ensure that they are reasonable, appropriate, and in compliance with the law. The letters state, "It is your responsibility to protect such information from unauthorized access, including taking steps to control the use of P2P software on your own networks and those of your service providers."
The FTC also recommended that the entities identify affected customers and employees and consider whether to notify them that their information is available on P2P networks. Many states and federal regulatory agencies have laws or guidelines about businesses notification responsibilities in these circumstances.
"For the millions of men and women working in film, television, music, software and other creative industries, P2P networks have become a serious threat to their livelihoods by serving as a major platform for illegal trafficking in stolen copyrighted material," said Daniel Mandil, General Counsel & Chief Content Protection Officer for the MPAA. "Today the FTC is also sending out a strong warning that using P2P networks increases the risk that sensitive personal information will fall into the hands of identity thieves. The dangers are real both for business and home users of P2P networks, and we welcome the FTCs efforts to spread the word about the risks."
The fact that a company received a letter does not mean that the company necessarily violated any law enforced by the Commission. Letters went to companies under FTC jurisdiction, as well as entities such as banks and public agencies over which the agency does not have jurisdiction.
FTC issued a new business education brochure titled Peer-to-Peer File Sharing: A Guide for Business designed to assist businesses and others as they consider whether to allow file-sharing technologies on their networks, and explain how to safeguard sensitive information on their systems, and other security recommendations. This information is available at www.ftc.gov/bcp/edu/pubs/business/idtheft/bus46.shtm. Tips for consumers about computer security and P2P can be found at www.onguardonline.gov/topics/p2p-security.aspx.
The agency also has opened non-public investigations of other companies whose customer or employee information has been exposed on P2P networks. To help businesses manage the security risks presented by file-sharing software, the FTC is releasing new education materials that present the risks and recommend ways to manage them.
Peer-to-peer technology can be used in many ways, such as to play games, make online telephone calls, and, through P2P file-sharing software, share music, video, and documents. But when P2P file-sharing software is not configured properly, files not intended for sharing may be accessible to anyone on the P2P network.
"Unfortunately, companies and institutions of all sizes are vulnerable to serious P2P-related breaches, placing consumers sensitive information at risk. For example, we found health-related information, financial records, and drivers license and social security numbers--the kind of information that could lead to identity theft," said FTC Chairman Jon Leibowitz. "Companies should take a hard look at their systems to ensure that there are no unauthorized P2P file-sharing programs and that authorized programs are properly configured and secure. Just as important, companies that distribute P2P programs, for their part, should ensure that their software design does not contribute to inadvertent file sharing."
The FTC enforces laws that require companies in various industries to take reasonable and appropriate security measures to protect sensitive personal information, including the Gramm-Leach-Bliley Act and Section 5 of the FTC Act. Failure to prevent such information from being shared to a P2P network may violate such laws.
FTC said that the notices had gone to both private and public entities, including schools and local governments, and the entities contacted ranged in size from businesses with as few as eight employees to publicly held corporations employing tens of thousands. In the notification letters, the FTC urged the entities to review their security practices and, if appropriate, the practices of contractors and vendors, to ensure that they are reasonable, appropriate, and in compliance with the law. The letters state, "It is your responsibility to protect such information from unauthorized access, including taking steps to control the use of P2P software on your own networks and those of your service providers."
The FTC also recommended that the entities identify affected customers and employees and consider whether to notify them that their information is available on P2P networks. Many states and federal regulatory agencies have laws or guidelines about businesses notification responsibilities in these circumstances.
"For the millions of men and women working in film, television, music, software and other creative industries, P2P networks have become a serious threat to their livelihoods by serving as a major platform for illegal trafficking in stolen copyrighted material," said Daniel Mandil, General Counsel & Chief Content Protection Officer for the MPAA. "Today the FTC is also sending out a strong warning that using P2P networks increases the risk that sensitive personal information will fall into the hands of identity thieves. The dangers are real both for business and home users of P2P networks, and we welcome the FTCs efforts to spread the word about the risks."
The fact that a company received a letter does not mean that the company necessarily violated any law enforced by the Commission. Letters went to companies under FTC jurisdiction, as well as entities such as banks and public agencies over which the agency does not have jurisdiction.
FTC issued a new business education brochure titled Peer-to-Peer File Sharing: A Guide for Business designed to assist businesses and others as they consider whether to allow file-sharing technologies on their networks, and explain how to safeguard sensitive information on their systems, and other security recommendations. This information is available at www.ftc.gov/bcp/edu/pubs/business/idtheft/bus46.shtm. Tips for consumers about computer security and P2P can be found at www.onguardonline.gov/topics/p2p-security.aspx.
