64 thousand Swedish identities were hijacked in 2013. Population of Sweden is today around 9,5 million. This means that the crime of identity fraud impacted around 0,8 percent of the Swedish population.

“So what, that’s nothing?” You are thinking….

Nevertheless this is almost 1 in a 100 of Swedish residents who have been a victim to identity fraud in 2013 alone. Hence Sweden is not exempt from the growing trend of identity fraud globally.

However in Sweden it’s going to increase exponentially if Swedish law is not changed. What we can expect is that subsequent years will welcome an influx of fresh victims; that could be you if you are one of the 9.5 million residents or/and citizens of Sweden, your friends, or even your children.

Identity fraud in Sweden will increase exponentially if Swedish law is not changed!

identity-theftFirst a little history on how we got to where we are. Sweden is one of the few countries globally that is organized enough to have implemented a comprehensive personal identity numbering scheme. It was first introduced in 1947 and was probably the first of its kind globally that included every Swedish resident. Unfortunately, the fact that Swedish identities are organized with the use of a uniform identifier, i.e. YYMMDD-xxxx (YYMMDD = date of birth) makes their personal id much more vulnerable to hacking and fraud than a more random generated id. It is easy for an identity fraudster to work out a Swedish identity number using some simple data mining techniques.

For those of you that want a quick summary of how the Swedish ID number is created… here we go..

1. The personal identity number consists of 10 digits and a hyphen.
2. The first six correspond to the person’s birthday, in YYMMDD form.
3. They are followed by a hyphen.
4. The seventh through ninth are a serial number.
5. An odd ninth number is assigned to males, and an even ninth number is assigned to females.
7. The tenth digit is a checksum which was introduced in 1967 when the system was computerised.

Up to 1990, the seventh and eighth digits were correlated with the county where the bearer of the number was born or (if born before 1947) where he/she had been living, according to tax records, on January 1, 1947, with a special code (usually 9 as 7th digit) for immigrants.

To get the last 4 digits, easiest is to call the Swedish Tax Authority and ask, they are very helpful, since the personal identity number is public information

But what does it really mean to have your identity stolen, or hijacked as more often referred to in Swedish popular press? So here is how a Swedish identity could be stolen starting with a name to find the personal id number:

  1. Google the name of the victim, from here the fraudster will find date of birth (ratsit.sebirthdays.se), home address on a cute map, and other information (hitta.se);
  2. To get the last 4 digits the fraudster can ring up the Swedish Tax Authority direct and ask them, it is after all public information, and they are very helpful.
  3. Now the identity thief can go online and order a fraudulent ID card and/or a fake passport using the stolen personal id number. Hence since the personal number is a vital specific identification number to identify an individual is correct but the photo on the ID card or passport is that of the fraudster.
  4. He/she is ready to go on a spending spree at the victim’s expense! If they have no access to the victim’s credit/debit card, they could buy electronic goods on credit with a small down payment (avbetalning). The victim, get to foot the rest of the bill.
  5. A shop assistant when checking the id card, would feel that the details are correct and process the transaction.

And this is just the beginning of the nightmare for the victim. The fraudster can take out additional loans in their name, buy a car, a house, and default on payments in their name. The victim will be blacklisted by credit companies. Cleaning up this mess will not be easy. It will take a lot of energy and time to clear their name. The victim can forget about trying to get a loan or any type of credit at this time.

I guess after all this excitement that the victim will want to remove their personal information from the public domain? Sorry but there is more bad news. It’s quite impossible! Swedish residents have no legal right to protect their personal identifying information in Sweden. In fact credit reporting agencies have permission from the Data Inspectorate (Datainspektionen) to publish your personal information. They get something called an utgivningsbevis that gives them exemption from Personalupplysningslagen (PuL), that costs a couple of thousand Swedish kronor. On the date of this publication there were 913 companies that have been granted an utgivningsbevis. So in Sweden the Personal Identifying Information (PII) of data subjects is public information. Although the data subjects do have some say over the integrity of PII that is published, this is driven by the Kreditupplysningslagen. The Credit Information Act (Kreditupplysningslagen) are required to make changes in their database to correct faults, but the data subjects have no right to be omitted from the register unless they have a ‘protected identity’. Hence all residents in Sweden who are over the age of 16 are included and public.

All of this is despite the Personal Data Law (PuL) that is here to protect personal information of Swedish residents and citizens. In fact in this context the PuL is impotent. The Swedish codification of the European Union Directive on Data Protection just does not work. The source of the problem is that the Personal Data Act (PuL) does not apply if its application is in contrary to the Fundamental Law on Freedom of Expression (1991).

So what this means is that the Fundamental Law on Freedom of Expression is being abused by companies making money from the identities of Swedish subjects. It is a Mad Hatters Party for 931 companies abusing this right at the cost of Swedish citizens/residents!

As a Swedish citizen, I have nothing against companies making money from identities so long as:

  1. I’ve given active consent to this;
  2. I have the choice to have it removed;
  3. and if I have permitted my personal information to be used commercially, I should also be a beneficiary from sharing my personal information.

To summarise. If you are a Swedish citizen/resident your personal information is public information and is being exploited commercially. This exploitation makes you vulnerable to identity theft. You have no control over who publishes your personal information.

It is about time this problem was fixed don’t you think?

Further reading

http://www.datainspektionen.se/press/nyheter/2014/datainspektionen-kan-inte-ingripa-mot-sajt-som-hanger-ut-domda/

http://www.riksdagen.se/en/How-the-Riksdag-works/Democracy/The-Constitution/The-Fundamental-Law-on-Freedom-of-Expression/

http://www.radioochtv.se/en/Licensing/Internet/

http://sverigesradio.se/sida/avsnitt/404038?programid=2778&playchannel=132

I know it’s been a bit quiet here lately, but I’ve been testing LinkedIn publications service. I’ve published 5 articles, and its quite okay. The tools are a quite rudimentary, so the finished result is not quite the same quality as with WordPress. You have the potential to reach a wider audience. BUT, after much deliberation I prefer my privacy blog. It is more satisfying, I get my faithful followers returning day after day. Also it feels more like I have control. I can at least take a backup onto my Mac.

The problem with WordPress is more difficult to Comment if you don’t have an account. I need to check this out.

Okay, so I’m back :-)

IDripping Tap love what UK is doing to keep alive the data retention directive that died an untimely death recently with DRIP ;-)

Some debate that it ‘extends’ the powers of RIPA. UK government officials claim it is just to cover the loss of the EU data retention requirements temporarily until they think of some new that is more manageable. Read what Panopticon blog is saying and decide for yourself?

imagesI am amazed at how little publicity there was on Daniel Eks, founder of Spotify that had his identity stolen. The identity fraudster purchased goods of nearly 1 million kronor in his name and has now been indicted to 2 years in prison. A small price to pay for 1 million kronor don’t you think?

I have talked a lot on how easy it is to steal someone’s identity in Sweden, so this should come as no surprise I would expect to virtualshadows blog followers ;-)

Love it… a mad-hatters party and Google invited themselves ;-)

mad_hatter_teaparty[1]

The Swedish press is now starting to discuss the problems with the law that gives easy access to the id numbers of Swedish residents. There is documented the background concerning this problem here.

The RTBF (Right to be forgotten) is a hot topic following the Spanish ruling against Google. The fact is that European Google must first evaluate and remove if considered reasonable search results that threaten the requester’s right to personal privacy. It is claimed to be a blow to Freedom of Speech. Google has already received 70,000 requests and receives on average 1000 requests each day! In U.K. claims are being made that it is in conflict with s.32 of the Data Protection Act 1998.

There is a good write-up on discussions following the ruling at: Debate Write-Up: Rewriting History.

Christopher Graham the Information Commissioner gives a good explanation of what it really means, but unfortunately it is lost in the panicked crys of other participants in the debate.

It is very straight-forward: There is claimed to be a the conflict between the Freedom of Speech and Personal Privacy, i.e. in this case the RTBF. However there is not, it is as Graham states:

1) There are two types of parties here: a) the data controller, and b) the journalist;
2) The ruling pertains to the data controller the RTBF, not journalists, so in UK for example, this does not impact s.32 of the Data Protection Act;
3) Just that the search results are not returned by the search engine of the data controller, does not mean that the data does not exist. It is just that is is not searchable;
4) This information pertaining to an individual is still on the website of the newspapers, and should be searchable directly on the website.

So this cannot be likened to ‘burning of books’ or ‘re-writing history’ as in George Orwell’s 1984. It basically means that if, for example an individual defrauded the Inland Revenue 10 years ago:

    – If you search for this person by name, it will not return this name in the result.
    – However if you search for ‘Inland Revenue fraud’ it could return this person’s name in one of the related articles.

What I see is that the main challenge is from a technical perspective. At the moment the onus is on the data controllers to receive requests, to decide if the requester has a valid request for removal from their search engines. However, I believe that this should be done as default by websites of newspapers. This could be difficult because on a technical level it is only possible, that I am aware of today, to exclude whole webpages from Google, not names or specific words.

Follow

Get every new post delivered to your Inbox.

Join 161 other followers