[Politech] Privacy and security risks of overseas outsourcing [priv]

From: Declan McCullagh (declan@private)
Date: Sun Feb 22 2004 - 21:08:47 PST

  • Next message: Declan McCullagh: "[Politech] Paid anti-MS lobbyist Ken Starr urges antitrust crackdown"

    ---
    
    Date: Thu, 19 Feb 2004 14:08:07 -0500
    From: David Solomonoff <dsolomon@private>
    To: declan@private
    Subject: Outsourcing, privacy and security
    
    Declan,
    
    I am sending a letter I wrote to the Inman News, http://www.inman.com/,
    a real estate industry newsletter, regarding an article on
    oursourcing. Some of the assertions regarding privacy and security
    strike me as either ingenuous or dangerously naive. I have also included
    the original article, which is only available online to nonsubscribers for 
    a brief time.
    
          ****
    
    "Mortgage lenders ship jobs to India," by Jessica Swesey, contained 
    reassurances
    about the security of sensitive data which are either disingenuous or 
    dangerously
    naive. Steve Kropper, founder of Domania, which provides customer acquisition
    and retention technologies to banks, mortgage lenders and real estate agents
    asserts, "data can be viewed in an offshore environment, but it can't be 
    stored." He
    is also cited, but not quoted as asserting that "because lenders that have
    outsourced customer service don't store customer data in overseas locations ...
    Customer service workers generally use computers that don't have storage 
    devices
    and are required to keep their desks free of pen and paper," according to Ms.
    Swesey.
    
    This shows a very poor understanding of computer security in a modern, highly
    networked environment. There is a huge and very complex infrastructure
    connecting the offshore backoffice operation and the domestic corporate 
    office --
    with many points for potential security breaches along the way.
    
    Security expert and privacy expert Lauren Weinstein recently discussed the 
    privacy
    and security issues in a recent article, "Outsourced and Out of Control,"
    http://www.pfir.org/outsourced-cacm, in which he observed that, "Many 
    outsourced
    jobs involve countries where significant privacy laws do not exist; even if 
    those
    laws are improved of ... effective enforcement would still appear to be highly
    problematic. Customer service outsourcing can give risky access to data ....
    Recently, a Pakistani subcontract worker threatened to post U.S. patients' 
    medical
    data on the Web if claimed back pay was not forthcoming."
    
    Weinstein further points out that, "There are even moves to outsource computer
    system administration ... often in countries with poor (if any) computer 
    security
    laws, creating the possibility of massive abuse of domestic systems by distant
    persons who could be difficult or impossible to effectively prosecute."
    
    In addition, the software that is used for these operations may have been
    developed in an insecure environment. In a similar case, "The U.S. General
    Accounting Office noted the possibility of malicious changes to code since
    significant U.S. air traffic control system Y2K work had been subcontracted 
    outside
    the U.S. without mandated background checks," he notes.
    
    If these implausible assurances about computer security and privacy determine
    outsourcing strategies, the resulting litigation by customers and resulting 
    loss of
    reputation may ultimately eclipse any short term savings.
    
    David Solomonoff
    dsolomon@private
    
    
    ****
    
    Mortgage lenders ship jobs to India
    Greenpoint, Countrywide to open overseas call centers
    Tuesday, February 17, 2004
    
    By Jessica Swesey
    Inman News
    
    Mortgage lenders are jumping on the
    outsourcing-to-India bandwagon. But they're keeping
    their plans and actions under wraps in the politically
    charged debate over how foreign outsourcing affects
    workers in the United States.
    
    IGate Global Solutions, a global technology and
    operations firm, last month announced a deal with
    Greenpoint Mortgage that will involve "relocating
    certain services to India."
    
    "Operations will commence shortly and be housed in
    iGate's new 14-acre campus situated in Whitefield,
    Bangalore," iGate said in a statement.
    
    But Greenpoint won't discuss the details or answer
    questions about its outsourcing strategy.
    
    Sending jobs to India is a touchy subject for American
    workers. Indeed, Presidential candidate Sen. John
    Kerry has even started to use the issue as a soapbox
    to reach out to voters.
    
    Lenders are looking to India to stay competitive as
    the mortgage refinance market tightens and creates
    fiercer competition for business.
    
    Call centers in India present an opportunity to cut
    costs and beef up customer service and retention,
    according to Steve Kropper, founder of Domania, which
    provides customer acquisition and retention
    technologies to banks, mortgage lenders and real
    estate agents.
    
    "One of the few countries in the world where you have
    a comparative advantage in the phone costs and where
    people speak English well is India," he said.
    
    Telephone-based customer service in the United States
    historically is of poor quality because companies
    won't pay much for such unskilled positions and
    skilled workers abandon such jobs for better-paid
    opportunities. Whether a call center in India provides
    better quality service may be debatable, but there's
    no question that it's cheaper because labor costs are
    lower overseas.
    
    Lenders spend about $1,350 in sales and marketing
    costs to obtain one retail mortgage customer, or about
    $600 through a more direct channel, Kropper said. A
    combination of U.S. and offshore sales and marketing
    cuts that customer acquisition cost to just $400.
    
    Countrywide Financial Corp. also reportedly is setting
    up call centers in India. American Banker recently
    reported the lender plans to open a 250-person call
    center in that country by the end of next year with
    the aim of cutting at least $8 million in costs
    annually.
    
    The company didn't respond to repeated requests for
    more information about its plans.
    
    Consumer advocates wonder whether borrowers will ever
    pocket any of the savings.
    
    "My guess is one would see cost control first as
    opposed to cost savings," Kropper said.
    
    Consumer privacy isn't a major concern because lenders
    that have outsourced customer service don't store
    customer data in overseas locations, Kropper said.
    Customer service workers generally use computers that
    don't have storage devices and are required to keep
    their desks free of pen and paper.
    
    "The data can be viewed in an offshore environment,
    but it can't be stored," he said.
    
    Kropper believes outbound calling for borrower leads
    can be performed in India as well as post-loan closing
    customer services. But he doesn't think the whole
    mortgage lending process will migrate overseas because
    while some functions work well in an outsourcing
    situation, others work better in the United States.
    
    Outsourcing parts of the mortgage transaction isn't a
    new practice among lenders. Many already outsource
    credit, mortgage insurance and appraisal services to
    third-party vendors. Two-thirds of mortgage loans come
    from channels other than direct lending, according to
    Kropper.
    
    It's easy to see why lenders keep quiet about their
    outsourcing plans, given the backlash over shipping
    U.S. jobs to India. Even so, some experts say the
    public fear of outsourcing is misplaced.
    
    Bruce Bartlett, a senior fellow for the National
    Center for Policy Analysis, believes outsourcing's
    benefits greatly outweigh its costs. He thinks
    outsourcing is far less a threat to U.S. workers than
    they first imagine it is.
    
    "There is not a one-for-one relationship between jobs
    lost here and those gained elsewhere from
    outsourcing," Bartlett wrote in an article NCPA
    published in December.
    
    At some point though, investors will want to know the
    details of a public company's cost-cutting strategies.
    
    Copyright 2004 Inman News
    
    -- 
    David Solomonoff
    dsolomon@private
    _______________________________________________
    Politech mailing list
    Archived at http://www.politechbot.com/
    Moderated by Declan McCullagh (http://www.mccullagh.org/)
    



    This archive was generated by hypermail 2b30 : Sun Feb 22 2004 - 21:57:49 PST