Rare Legal Fight Takes On Credit Card Company Security Standards and Fines

A small celebrity-friendly restaurant in Utah is finally doing what many merchants have only dreamed of doing for a long time — taking on a part of the payment card industry’s powerful but flawed system for securing card data by fining merchants for failing to secure their data.

Stephen and Theodora “Cissy” McComb, owners of Cisero’s Ristorante and Nightclub in Park City, Utah, have filed a lawsuit against U.S. Bank claiming that the financial institution, which used to process the restaurant’s credit and debit card transactions, wrongfully seized money from the McCombs’ merchant bank account.

U.S. Bank seized about $10,000 from the McCombs’ account to pay $90,000 in fines that Visa and MasterCard imposed after alleging that Cisero’s had failed to secure its network and suffered a data breach that resulted in fraudulent charges on customer bank cards. U.S. Bank sued the McCombs to obtain the remaining balance on the fines, saying a contract the McCombs signed with the bank makes them liable for such fines.

But in their countersuit against U.S. Bank (.pdf), the McCombs allege that the bank, and the payment card industry (PCI) in general, force merchants to sign one-sided contracts that are based on information that arbitrarily changes without notice, and that they impose random fines on merchants without providing proof of a breach or of fraudulent losses and without allowing merchants a meaningful opportunity to dispute claims before money is seized.

It’s the first known case to challenge the heart of the self-regulated PCI security standards — a system that requires businesses accepting credit and debit card payments to implement a series of technological steps to secure data. The controversial system, imposed on merchants by credit card companies like Visa and MasterCard, has been called a “near scam” by a spokesman for the National Retail Federation and others who say it’s designed less to secure card data than to profit credit card companies while giving them executive powers of punishment through a mandated compliance system that has no oversight.

“It’s just like Visa and MasterCard are governments,” said Stephen Cannon, an attorney representing the McCombs. “Where do they get the authority to execute a system of fines and penalties against merchants? That’s a very important issue in this case.”

Legal experts say the case raises a number of broad questions that could have implications for enforcing contracts that many other merchants have signed with banks and card processors.

“All it takes is for one case to drive a truck through a provision of the contract, and all other contracts written like this one are suddenly put into question,” says Andrea Matwyshyn, a law and business ethics professor at the University of Pennsylvania’s Wharton School.

Cisero’s is a popular Italian eatery frequented by locals as well as celebrities who come to Park City each year for the Sundance Film Festival. Actors Russell Crowe, Sandra Bullock and Sundance founder Robert Redford have all eaten there, the owners told Bloomberg recently.

The issue began for Cisero’s in March 2008, when Visa notified U.S. Bank that Cisero’s network might have been compromised after cards used at the restaurant were apparently used for fraudulent transactions elsewhere. U.S. Bank, and its Georgia-based affiliate Elavon, process the bank card transactions that customers make at Cisero’s.

In the wake of the alleged breach, Cisero’s, per rules imposed by the payment card industry, was required to hire a forensic investigations firm — from a list of six firms approved by Visa and MasterCard — to determine if a breach had occurred and if the restaurant was in compliance with the so-called PCI security standards that were adopted by the Payment Card Industry Council in 2005.

The McCombs hired two firms, Cybertrust and Cadence Assurance. Both examined Cisero’s point-of-sale system (POS) and servers and found “no concrete evidence that the POS server suffered a security breach which led to the compromise of cardholder data” and no evidence that insiders had installed skimmers on card readers to collect account data. Cadence in fact determined that no evidence existed that payment card data of any kind was improperly taken from Cisero’s systems.

The audits, however, did find that the POS system the restaurant used — a system made by Micros — was storing customer account numbers as they were read from the magnetic stripe on bank cards.

Since storage of card data is a violation of the PCI security standards, Visa and MasterCard imposed fines on U.S. Bank and Elavon. Under the PCI system, the banks and card processors that process transactions for merchants are fined, not the merchants and retailers themselves. But those banks and card processors have separate agreements with merchants and retailers that indemnify them against any such fines, forcing the merchants and retailers to pay them instead of the banks and processors — an arrangement that gives merchants little power in challenging fines.

Visa determined that the total cost of the liability for Cisero’s noncompliance was $1.33 million, but ultimately set the fine at $55,000, without explaining how it reached these figures, the McCombs claim. MasterCard stated that although it could have imposed a fine of up to $100,000 for the violation of storing card data, it decided to impose a fine of only $15,000.

The fines increased after card issuers came forward claiming they suffered losses from the alleged breach. Under recovery programs run by Visa and MasterCard, card issuers that have suffered losses due to data breaches can recover these losses from the bank of the merchant accused of being the source of the breach. So after RBS Citizens Bank and Chase claimed they had suffered $13,849 in losses from fraudulent charges to their customer’s accounts as a result of the alleged breach of Cisero’s network, MasterCard added that to the fine, for a total of about $90,000.

But instead of simply notifying the McCombs about the fines and giving them an opportunity to dispute the claims of Visa and MasterCard, U.S. Bank and Elavon simply “helped themselves” to about $10,000 from the McCombs’ U.S. Bank account. The McCombs refused to pay the remainder of the fines and closed their bank account before any more money could be siphoned.

In 2010, Elavon sued to obtain about $82,600, the remainder of the fines. The McCombs countersued, accusing U.S. Bank of wrongfully seizing their money without providing any proof that a breach occurred or that fraud losses claimed to have been suffered by RBS and Chase were even connected to cards that Cisero’s had processed. They accuse Visa and MasterCard of levying “punitive” fines on them that have no relation to actual losses suffered.

To determine the source of a breach, Visa uses a “common point of purchase” method that traces where cards involved in fraud were used in order to find the most likely place where they were stolen. But according to the Cadence forensic report of Cisero’s servers, most of the fraudulent activity reported by RBS and Chase involved credit card numbers that were not found on Cisero’s point-of-sale system, suggesting they might never have been used at Cisero’s. Yet the McCombs were not given a chance to dispute this before the money was seized from their account.

“At no time has Elavon, U.S. Bank, Visa, MasterCard or any other entity proven that a data breach occurred at Cisero’s, that issues actually suffered fraud losses, or that any such losses were caused by a data breach at Cisero’s,” the McCombs’ complaint reads. “Notwithstanding these facts, neither U.S. Bank nor Elavon ever gave Cisero’s an opportunity to present evidence in its defense before Visa and MasterCard assessed the fines.”

Visa and MasterCard did not immediately respond to a call for comment.

The McCombs also charge that U.S. Bank had a duty to ensure that they were properly notified about the PCI security standards when they were first instituted and had a duty to ensure that Cisero’s met those standards. Instead, they say, the standards only went into effect four years after they signed their contract with U.S. Bank and were incorporated into that contract indirectly, without explicit notice of the new rules. The McCombs say the bank only made reference to the rules via a web site address that appeared on six printed bank statements sent to the McCombs between 2005 and 2007. Since the McCombs did their banking online, they never noticed the reference and only learned of the rules when they were told they might have violated them.

The McCombs assert that the PCI system is less a system for securing customer card data than a system for raking in profits for the card companies via fines and penalties. Visa and MasterCard impose fines on merchants even when there is no fraud loss at all, simply because the fines “are profitable to them,” the McCombs say.

Furthermore, there is no recourse and no process available for merchants to challenge fines, they say in their complaint. Although the acquiring bank, such as U.S. Bank, can appeal the fines in writing with supporting material, the banks have no incentive to do so, since they are indemnified from liability in their contracts with merchants and simply pass the fines onto the merchants. Banks also have to pay a nonrefundable fee of $5,000 to file an appeal, giving them even less reason to do so.

Matwyshyn says the system of fining merchants could prove to be a problem for the payment card industry if the court views them as punitive in this case.

“In general, contract law does not like punitive damages being included in contracts,” she says. “If you argue that these fines are punitive and unrelated to actual losses suffered, courts could deem your contact to be overreaching and conclude that its intent is to punish rather than to compensate harm.”

Matwyshyn also says the fact that merchants are liable for a third-party agreement their banks make with Visa and MasterCard is also problematic because it disempowers merchants and prevents them from being able to “negotiate the kinds of balanced provisions we would expect to see between two parties to a contract.”

SEBI bars 7 companies from capital market for violation of IPO norms

SEBI on Wednesday barred seven companies, their directors, merchant bankers and other related entities from participating in the securities market till further order for not complying with the disclosure norms in their IPO prospectus

Cracking whip against seven firms for not complying with the disclosure norms in their initial public offer (IPO) prospectus, the Securities and Exchange Board of India (SEBI) on Wednesday barred the companies, their directors, merchant bankers and other related entities from participating in the securities market till further order, reports PTI.

The merchant bankers who have been prohibited from participating securities market include “PNB Investment Services, the book running lead manager of IPO of Taksheel Solutions and Almondz Global Securities (PG Electroplast and Bhartiya Global Infomedia)”. Their CEOs too have been barred from participating in the capital market till further order.

“...by not complying with the regulatory obligation of making the disclosures, the company and its directors had not provided the vital information which is detrimental to the interest of investors in securities market,” SEBI order against Taksheel Solutions said.

It said that proceeds of IPO invested by the company in the Indiabulls Mutual Fund-Liquid Fund (amounting to Rs5 crore) be deposited in an escrow account, till further directions.

“Taksheel Solutions is prohibited from raising any further capital, in any manner whatsoever, till further directions,” it added.

Similar orders were passed against the other six firms.

The market regulator has asked them to deposit the proceeds from the IPOs in escrow bank accounts and also call back the IPO proceeds to their cash credit accounts.

Talking about the importance of lead book running mangers in an IPO, SEBI said if the merchant banker fails to act diligently and comply strictly with the letter and spirit of the regulations, the investors are put to grave danger, which may not be in the interest of the capital market.

“This is precisely what has happened in this (Taksheel) particular issue where lack of adequate and independent due diligence by the merchant banker has resulted into shenanigans on the part of the company and its promoters/directors,” the SEBI order said.

In its order against Tijaria Polypipes, SEBI said “the fraudulent, abusive, manipulative and illegal activities committed by the company Tijaria Polypipes and certain entities/persons to the detriment of the genuine investors and adversely affecting the integrity of securities market...SEBI as a regulator should immediately intervene...to stop further harm to investors...”

The other companies against which orders were passed, include, Bhartiya Global Infomedia, RDB Rasayans, Brooks Laboratories and PG Electroplast. Similar order too has been passed against Onelife Capital Advisors.

Small Business Owners Now Making Accepting Credit Cards A Priority

Today's customers have high demands when it comes to convenience and a lot of local small business owners are quickly discovering that the old methods of doing business are no longer appropriate in many areas.

Today's customers have high demands when it comes to convenience and a lot of local small business owners are quickly discovering that the old methods of doing business are no longer appropriate in many areas. Today's entrepreneurs can get set up and started doing business so quickly that businesses which do not adapt to the current commercial environment are going to be beat out fairly rapidly by competition that is willing to cater to the demands of today's customers. For those that want to be able to get the right type of customer into their business today, the type that is ready to do business right away, being able to process credit and debit cards is an absolute must. There really is no other way to explain the rising popularity of merchant accounts among today's small business owners. The fact that these are so easy to obtain via a service such as Pay Pal definitely makes it a great deal easier for many business owners who are looking to accept these cards without needing to pay extreme fees in the process. Since there is so much business to be done for those who accept such cards, more and more companies are coming to the idea that finding the right set up is worth it.

USBSwiper is one of the most popular names among small business owners looking to scan credit and debit cards. With a wide variety of swiping machines available that can be hooked up to a laptop PC for easy payment processing, the company is able to offer a total solution for businesses and make having a low cost, hassle free merchant account through a service like Pay Pal something they are more than willing to do. When the average business owner considers just how many sales they could miss if they are not able to process these cards they quickly see exactly why it is a good idea to look for a solution that fits their needs. Since portable technology such as this makes everything so much simpler on the business owner, it is often going to be their first choice for card processing. That allows them to deliver products and services straight to a customer's home if need be and even print up professional receipts on the spot.

Shop safe for the holidays and after

Whether you're still doing some last-minute shopping for the holidays or looking forward to after-holiday bargains, the FBI has tips to keep shoppers safe.

If you are buying goods online, be wary of buying items that are sold on auction sites or through classified ads. Scammers sometimes will collect credit card numbers, bank account numbers or other financial information directly from the buyer, and then they will turn around and use that information to make their own purchases. If you are purchasing online, check the seller's rating or reviews. Be cautious if the seller has a high rating, but few total feedback postings and/or all the feedback was posted about the same time and date.

If you are giving gift cards, make sure you purchase them directly from a reputable merchant. If you buy a gift card from a third-party website or auction site, it is possible the card was stolen or obtained fraudulently. The merchant will likely deactivate the card, and you are out your money.

A scammer may send you an email or text indicating there is a problem with your credit card, bank account, or other merchant account. It will ask you to follow a link to a spoofed site that looks like the merchant's site to update your personal information. Don't do it! No reputable merchant will, unsolicited, ask you for your account number, password or PIN. When in doubt, call the merchant or bank's published customer service number.

There are plenty of holiday deals from legitimate merchants, but if the deal is really "too good to be true" - watch out. Fraudsters often use the hot items of the season to lure bargain hunters into providing credit card information.

Scam artists are known to use pressure, guilt, and the threat of an "emergency situation" to create a sense of urgency. Don't act impulsively. For instance, if someone calls to tell you your credit card has been stolen and you must give him your PIN so he can deactivate it, hang up and call your bank directly.

Consumers should be wary of opening attachments, even if you think you recognize the sender. Run a virus scan before opening any attachments, including pictures.

Buyers and sellers can both be caught in this scam, usually involving online goods. For buyers, they pay for an item but never receive it. For sellers, they send an item, but the payment ends up being fraudulent, and they are out the cash. Always use a reputable online retailer and a reputable money transfer service.

Many people like to make year-end charitable contributions for tax purposes. Do not respond to unsolicited emails or texts, and do not give personal information to someone who contacts you via email or text. Make your contributions directly to known, legitimate organizations instead of relying on someone you do not know to make the donations for you.

Consumers' use of social media tools, including texting and networking sites, can also be targets for scammers. Just because you received the link or information from a "friend" on a social networking site does not mean it is any more reliable or trustworthy.

Crowded parking lots are a prime target for scammers staging auto accidents. The perpetrators stage accidents in vehicles or on foot and claim medical injuries and auto damages against the victim's insurance. An example is the victim is backing out of a parking place in a crowded shopping center and the perpetrator is "hit" either while walking or in their vehicle.

Anger mounts as MF Global clients see $3 billion still stuck

While authorities have touted the fact that they are returning 60 percent of the collateral and cash that had been frozen in the wake of the broker's October 31 bankruptcy, a closer look shows that in fact only about 40 percent of customers' total funds have been authorized for release so far.

The remainder, more than $3 billion, ostensibly remains on hand to cover a shortfall originally estimated by MF Global to regulators at just $600 million.

Because the bankruptcy trustee, regulators and exchanges have made no comment on the missing funds in weeks -- and have given no information as to how much cash they are retaining -- customers are left guessing exactly how much might end up in the creditors' process of the bankruptcy.

After weeks of intense lobbying by customers and exchanges, trustee James Giddens last week won court approval to release another $520 million in funds from MF Global accounts that contained only cash as of October 31.

But that has still left thousands of customers in an uproar. Clients who had a mix of cash and trading positions have yet to see a dime of their excess funds, they say. The trustee is planning a third cash transfer to cover these clients, but no timing for that tranche has been announced.

"The whole process is a mess," said Jason Skole, a private investor who had invested $200,000 at the start of this year in a small hedge fund who traded through MF Global.

"Those who had just cash positions will get some of their money. All I've got is 60 percent of the small amount of collateral I had backing trades," he said. He says around $185,000 of his money is still frozen at the bankrupt firm.

Giddens said late last week that they were working on a third bulk transfer to "true up" the value of distributions so that all former customers get the total 60 percent of their net equity, but they weren't yet confident enough in MF Global's bookkeeping and cash on hand to go beyond that.

"We've seen enough (money) to make the 60 percent distributions but we can't distribute money we don't have," Giddens' spokesman Kent Jarrell told Reuters on Sunday.

"As soon as we identify assets under our control, we are trying to distribute them. And we can't get ahead of that because then we can run out of assets.... We have to find the assets and we have to make sure we have to control those assets. It's a time consuming, complex task and we have hundreds of people working on it on our end now."

CME Group referred all questions to the trustee.

The tale of the customer's funds goes like this. On October 31, exchange operator CME Group estimated in a court filing that there was a "requirement" of some $5.5 billion in segregated customer funds -- including, presumably, the missing funds that could not be immediately located.

Over the following weeks, while authorities poured over sloppy and haphazard records, the trustee identified two pools of money that could be partly returned to customers.

The first was $2.5 billion in collateral that was being used as margin to cover existing trades. Those trading positions were transferred to new brokers along with 60 percent of the value of the collateral, or about $1.55 billion.

The second was $869 million that was left in MF Global accounts that contained nothing but cash -- either because customers had liquidated all their trades before October 31, or because they simply had no positions open as it failed. The bankruptcy court ruled last week that those account holders would also get back 60 percent, or about $520 million.

Those two pools of funds only account for about $3.4 billion of the original total $5.5 billion. The customers whose accounts hold that remaining $2-plus billion have never been explicitly identified, or told when they will get their funds.

"We have the $520 million to do distribution of cash accounts. And we knew we had the assets to distribute on the first one around. Now we also feel confident we have enough to true up. What we don't know is what we'll have beyond that," said Jarrell.

It's clear that some cash is being held back in order to cover the missing money that regulators say MF Global may have taken from customer accounts, an unprecedented violation of one of the fundamental tenets of commodity brokers.

Nickel and dimed

When Bank of America announced recently it would begin charging most of its customers a $5 monthly fee for using their debit cards, banks everywhere saw opportunity.A cashier swipes a debit card at Shakespeare’s Pizza in Columbia.

“Let’s just put it this way: When the news went out about Bank of America, our call center lit up,” said Mary Wilkerson, Boone County National Bank’s director of marketing. “Switching a bank account can be cumbersome, so you’ve got to be pretty mad to go to all that trouble.”

That’s just one example of how new rules capping the fees big banks can charge merchants when a customer swipes a debit card are shaking up markets across the country. Largely unnoticed by consumers, businesses that take payment via debit card are charged a fee by the bank that issued it. New rules, which took effect Oct. 1, cap the fees big banks can charge merchants at 21 cents, plus a few more pennies for some fraud-prevention costs. That’s nearly half the industry average of 44 cents per swipe that banks charged businesses before.

“Twenty cents doesn’t seem like a lot, but you multiply that by millions, and it’s a lot of money,” said Bill Ratliff of the Missouri Bankers Association.

As a result, large institutions such as Bank of America and Regions Financial Corp. announced they planned new monthly debit card fees to offset the nearly $7 billion the industry says it will lose because of the new regulations. Large retail chains, which fought a long lobbying battle with the banks over the rules created by the Dodd-Frank financial reform law passed last year, expect a boost to their revenue stream, and smaller merchants hope to see lower costs as well.

And although the rules were written to only affect banks with $10 billion or more in assets, local community banks say that eventually they will have to lower the debit fees they charge merchants to stay competitive.

“If Wal-Mart cuts off our cards, we’ll be adjusting our rates,” said Dave Putnam, First State Community Bank’s Columbia president. “We can’t have our customers not being able to use our cards.”

As debit card use has soared over the past several years, the banking industry has seen merchant swipe fees rise to more than $20 billion, the Wall Street Journal reported. That’s up from about $11 billion in 2006. The merchant fees associated with debit card use gave banks a hefty revenue stream to offset the costs of checking accounts, and banks big and small have cashed in.

“It has become an increasingly larger portion of our income because of the increasing acceptance and use of debit cards,” Putnam said. “That’s really what has allowed us to offer free checking.”

The rules were added into the Dodd-Frank bill by Illinois Democratic Sen. Dick Durbin. Proponents of the measure argued that the merchant charges were well above the banks’ costs to provide the service. But the banks fought the rules with some success. The rules originally were scheduled to take effect this summer and cap fees at 12 cents per swipe, but the Federal Reserve, in charge of writing the regulations, raised the cap to 21 cents and pushed back the start date.

Still, banks aren’t happy about the new rules. Commerce Bank, which is large enough to be affected immediately, will lose about 50 percent of the revenue associated with its debit cards and will have to make up for it somewhere, said Chief Financial Officer Charles Kim.

In the second quarter of 2011, Commerce Bank’s holding company, Commerce Bancshares Inc., reported $15.7 million in revenue from all debit card fees in its quarterly filing with the Securities and Exchange Commission. It anticipated the new rules would shave $7 million off debit card revenue in the last quarter of 2011.

“Typically, when the government gets involved in setting prices, it’s not a very productive situation,” Kim said. “This particular fee and the amendment to the Dodd-Frank Act has nothing to do with subprime lending; it has nothing to do with the financial crisis at all. It’s just retailers taking advantage of the fact that the banks were down and no one in Washington was thinking very favorably of them.”

Commerce Bank has no plans for a new debit card fee charged to account holders, and it is still evaluating how to cut costs and find other sources of revenue, Kim said. But Kim said the rules have put the bank “under a lot of pressure,” and it, like the rest of the industry, will be re-evaluating services that customers have become accustomed to getting for free.

“There is no question that the economics of the free checking account that you saw in the late ’90s and the last decade, those economics are dramatically changed,” he said. “And it’s unlikely that accounts will be free the same way that they were there for a number of years.”

Whether consumers will look to dodge any new fees associated with debit and checking services is up in the air. Ratliff referenced an American Bankers Association survey from this summer that found 71 percent of bank customers avoid any sort of account fees at all.

Tengda Chin, a University of Missouri student and a Bank of America customer for three years, said he plans to try to avoid the planned $5 monthly fee by not using his debit card for purchases. But the benefits of banking with a large national chain will keep him with the bank.

“I don’t want to switch banks because” Bank of America “has the most ATMs in the country,” Chin said. “If I switch to a local bank here, that’s a lot of inconvenience.”

In the short term, smaller banks hope to pick up a few customers disgruntled with new fees. While Boone County National Bank sees an opportunity with the new rules, Wilkerson said that eventually it, too, might have to change its account fee structure if it is forced to lower its fees to par with big banks.

“While we can be excited about the fact that these big guys are charging fees, we can’t get too excited about it because we don’t know what’s in our future,” she said.

First State Community Bank plans to keep its fees down as long as possible and try to pick up market share, Putnam said. But he estimated that small banks could begin to see pressure to lower their debit card fees within 12 to 18 months, and that will make them look for other ways to make up for that money.

“I’m hoping we don’t get to that point where community banks aren’t able to offer free or reduced checking accounts for consumers with smaller balances, but it might get to that point,” he said.

For their part, merchants aren’t even sure whether they will see the intended benefit. Jackie Maxwell, the general manager of MFA Oil’s Break Time convenience store chain, said in an email that other fees associated with cards have already started rising. Fees paid to banks and credit card companies for payment processing cost the chain almost as much as the salaries of its hourly sales clerks, she said.

If new bank fees change consumer behavior more to credit or cash payment, it could be harder to predict the effect on retailers. But Maxwell said Break Time is expecting some savings from the new card rules. For instance, she wrote, a $1 cup of coffee purchased with a debit card costs the store 35 cents in fees, which sometimes results in a net loss on the transaction.

In gasoline sales, where margins are lower for retailers, companies are already making pump equipment with two pricing screens — one for cash and one for credit, Maxwell said.

“If” Mastercard “and Visa raise their costs significantly as a result of the loss in debit card revenue, it would be more likely that customers will see two-tiered pricing in the marketplace,” she wrote.

Smaller merchants are happy with the rules change, but Osama Yanis, who owns the Coffee Zone on Ninth Street, said the main beneficiaries will be big chains such as Wal-Mart and McDonald’s.

“It may make a difference, a little difference,” he said. “It depends on what bank” customers “route their money to.”

Harry Patel, a co-owner of Eagle Liquor on Business Loop 70 and Columbia Liquor on Providence Road, said he pays $700 to $800 a month in debit and credit card fees. In 2006 and 2007, he was paying around $500 to $600 a month in such fees. The new debit card fees still are too high, he said, because banks are just taking money directly from a customer’s bank account rather than advancing the money like a credit card. “You’re not taking any risk on debit cards,” Patel said.

Although the debit rule change might help, it’s the credit card fees that are highest and hit his business the hardest. That’s the form of payment his customers are increasingly using, and he expects fees for credit card processing to go up soon.

“It’s become one of the highest costs a retailer has to deal with — credit card processing,” said David Overfelt, president of the Missouri Retailers Association. “Consumers think they aren’t paying for it. Yeah, they are paying for it.”

Although Overfelt pushed for the debit rules along with other retailing associations, he thinks the money that was flowing to the banks will just be made up somewhere else.

“These are major profit centers,” Overfelt said. “And it’s a major profit center the public’s going to pay for one way or another.”

NASA Inspector General Concludes Agency Computers Vulnerable to Cyber-Attacks

There are few large-scale computer systems today that don't – at some point – experience attacks or attempted attacks from hackers. Chances are, if you have a credit card or ATM card, at some point, a merchant has informed you of a breach in their system (and stored personal data) that required you to change your credit card and perhaps take advantage of free credit monitoring service paid for by the merchant.

But let's face it, not all computer networks are created equal. While a breach in T.J. Maxx's network might be inconvenient for many, it's unlikely to get anyone killed. So you'd think critical government agencies, for example, would take better care.

Apparently not.

NASA's inspector general concluded this week that computer servers used by the space agency to control spacecraft were vulnerable to cyber-attack through the Internet, reported AFP.

Sweet, huh?

"We found that computer servers on NASA's agency-wide mission network had high-risk vulnerabilities that were exploitable from the Internet," NASA inspector general Paul Martin said in a report that concluded an audit of NASA's network security. "Specifically, six computer servers associated with IT assets that control spacecraft and contain critical data had vulnerabilities that would allow a remote attacker to take control of or render them unavailable," said the report.

Apparently, a malicious hacker who managed to penetrate the network could use compromised computers to exploit other weaknesses and "severely degrade or cripple NASA's operations."

The inspector general's audit of NASA's computer security reportedly found system-wide holes such as network servers that revealed encryption keys (oops!) encrypted passwords, and user account information.

"These data are sensitive and provide attackers additional ways to gain unauthorized access to NASA networks," the report said.

The inspector general warned that "until NASA addresses these critical deficiencies and improves its IT security practices, the agency is vulnerable to computer incidents that could have a severe to catastrophic effect on agency assets, operations, and personnel."

You'd think they'd be onto this already. In 2009, hackers infected a computer system that supports one of NASA's mission networks. "Due to the inadequate security configurations on the system, the infection caused the computer system to make over 3,000 unauthorized connections to domestic and international Internet Protocol (IP) addresses including addresses in China, the Netherlands, Saudi Arabia, and Estonia," recalled the report.

Also in 2009, hackers stole 22 gigabytes of export-restricted data from a computer system at the Jet Propulsion Laboratory (JPL), a federally funded NASA research and development center in Pasadena, California.

The inspector general recommended that NASA immediately act to mitigate risks on Internet-accessible computers on its mission networks and carry out an agency-wide IT security risk assessment.