Tuesday, October 28, 2008
POLK COUNTY -- Cities in Polk County cities are creating a new protocol to prevent theft of personal and sensitive information.
Municipalities must adopt written procedures that detect and respond to possible signals of identity theft -- referred to in the plans as "red flags." Examples include more than one utility account sharing the same address or reports by credit agencies of frozen accounts.
The policies are in accordance with the federal Fair and Accurate Credit Transaction Act of 2003 and Oregon Senate Bill 583, passed last year.
The programs must be adopted by Nov. 1, though some cities will continue to fine tune details of their plans afterward.
Jerry Wyatt, the city manager of Dallas, said at the Oct. 20 council meeting that the new program will protect personal information used in utility billing, at the Dallas Aquatic Center and the library.
Dallas received a wake-up call last December. Wyatt said employee information was transmitted over the Internet unsecured, and the state, which monitors transactions, informed the city the information may have been in danger. Wyatt said procedures were changed and employees were notified. No information was stolen.
"We learned our lesson," Wyatt said. "We worked with our IT department in those internal controls. If we transfer data or send information then we (make sure) it's secured."
Because of this event, Wyatt said the city is already following state protocol.
"It was something we were already focusing on," Wyatt said. "It (just) pushed us to a Nov. 1 deadline."
Independence and Monmouth adopted prevention programs on Oct. 14 and 21, respectively.
Between its water, sewer and electric utilities, Monmouth has nearly 5,700 accounts. Most of those include a customer's social security number, driver's license number and general contact information.
The program will be mostly practical in nature as opposed to new technology, Monmouth Finance Director Mark Dunmire said.
Current customer data will be stored in lockable cabinets and there will be limited access of old account files in storage, he said. Individuals calling in for account balances will be asked to provide additional information to verify they are who they say they are, he said.
One significant change will be a requirement that individuals applying for power service provide social security numbers or other identification that could assist in the late payment collection process.
Dunmire said Monmouth has allowed people in special cases -- such as students attending Western Oregon University from abroad -- to hold utility accounts in the past without providing that data.
Dunmire said it would take a couple of months to fully develop and implement the program and that there would be little cost associated with it.
"I don't think it will make a huge difference to a (customer) interacting with us," Dunmire said. "For me and other employees, there will be some work, but it's not a complete radical change from how we're doing things ... just details about making sure we safeguard information in an active way."