Privacy and security risks of overseas outsourcing [priv]

[Declan McCullagh <declan () well com>]

---

Date: Thu, 19 Feb 2004 14:08:07 -0500
From: David Solomonoff <dsolomon () nycap rr com>
To: declan () well com
Subject: Outsourcing, privacy and security

Declan,

I am sending a letter I wrote to the Inman News, http://www.inman.com/,
a real estate industry newsletter, regarding an article on
oursourcing. Some of the assertions regarding privacy and security
strike me as either ingenuous or dangerously naive. I have also included
the original article, which is only available online to nonsubscribers for 
a brief time.

     ****

"Mortgage lenders ship jobs to India," by Jessica Swesey, contained 
reassurances
about the security of sensitive data which are either disingenuous or 
dangerously
naive. Steve Kropper, founder of Domania, which provides customer acquisition
and retention technologies to banks, mortgage lenders and real estate agents
asserts, "data can be viewed in an offshore environment, but it can't be 
stored." He
is also cited, but not quoted as asserting that "because lenders that have
outsourced customer service don't store customer data in overseas locations ...
Customer service workers generally use computers that don't have storage 
devices
and are required to keep their desks free of pen and paper," according to Ms.
Swesey.

This shows a very poor understanding of computer security in a modern, highly
networked environment. There is a huge and very complex infrastructure
connecting the offshore backoffice operation and the domestic corporate 
office --
with many points for potential security breaches along the way.

Security expert and privacy expert Lauren Weinstein recently discussed the 
privacy
and security issues in a recent article, "Outsourced and Out of Control,"
http://www.pfir.org/outsourced-cacm, in which he observed that, "Many 
outsourced
jobs involve countries where significant privacy laws do not exist; even if 
those
laws are improved of ... effective enforcement would still appear to be highly
problematic. Customer service outsourcing can give risky access to data ....
Recently, a Pakistani subcontract worker threatened to post U.S. patients' 
medical
data on the Web if claimed back pay was not forthcoming."

Weinstein further points out that, "There are even moves to outsource computer
system administration ... often in countries with poor (if any) computer 
security
laws, creating the possibility of massive abuse of domestic systems by distant
persons who could be difficult or impossible to effectively prosecute."

In addition, the software that is used for these operations may have been
developed in an insecure environment. In a similar case, "The U.S. General
Accounting Office noted the possibility of malicious changes to code since
significant U.S. air traffic control system Y2K work had been subcontracted 
outside
the U.S. without mandated background checks," he notes.

If these implausible assurances about computer security and privacy determine
outsourcing strategies, the resulting litigation by customers and resulting 
loss of
reputation may ultimately eclipse any short term savings.

David Solomonoff
dsolomon () nycap rr com


****

Mortgage lenders ship jobs to India
Greenpoint, Countrywide to open overseas call centers
Tuesday, February 17, 2004

By Jessica Swesey
Inman News

Mortgage lenders are jumping on the
outsourcing-to-India bandwagon. But they're keeping
their plans and actions under wraps in the politically
charged debate over how foreign outsourcing affects
workers in the United States.

IGate Global Solutions, a global technology and
operations firm, last month announced a deal with
Greenpoint Mortgage that will involve "relocating
certain services to India."

"Operations will commence shortly and be housed in
iGate's new 14-acre campus situated in Whitefield,
Bangalore," iGate said in a statement.

But Greenpoint won't discuss the details or answer
questions about its outsourcing strategy.

Sending jobs to India is a touchy subject for American
workers. Indeed, Presidential candidate Sen. John
Kerry has even started to use the issue as a soapbox
to reach out to voters.

Lenders are looking to India to stay competitive as
the mortgage refinance market tightens and creates
fiercer competition for business.

Call centers in India present an opportunity to cut
costs and beef up customer service and retention,
according to Steve Kropper, founder of Domania, which
provides customer acquisition and retention
technologies to banks, mortgage lenders and real
estate agents.

"One of the few countries in the world where you have
a comparative advantage in the phone costs and where
people speak English well is India," he said.

Telephone-based customer service in the United States
historically is of poor quality because companies
won't pay much for such unskilled positions and
skilled workers abandon such jobs for better-paid
opportunities. Whether a call center in India provides
better quality service may be debatable, but there's
no question that it's cheaper because labor costs are
lower overseas.

Lenders spend about $1,350 in sales and marketing
costs to obtain one retail mortgage customer, or about
$600 through a more direct channel, Kropper said. A
combination of U.S. and offshore sales and marketing
cuts that customer acquisition cost to just $400.

Countrywide Financial Corp. also reportedly is setting
up call centers in India. American Banker recently
reported the lender plans to open a 250-person call
center in that country by the end of next year with
the aim of cutting at least $8 million in costs
annually.

The company didn't respond to repeated requests for
more information about its plans.

Consumer advocates wonder whether borrowers will ever
pocket any of the savings.

"My guess is one would see cost control first as
opposed to cost savings," Kropper said.

Consumer privacy isn't a major concern because lenders
that have outsourced customer service don't store
customer data in overseas locations, Kropper said.
Customer service workers generally use computers that
don't have storage devices and are required to keep
their desks free of pen and paper.

"The data can be viewed in an offshore environment,
but it can't be stored," he said.

Kropper believes outbound calling for borrower leads
can be performed in India as well as post-loan closing
customer services. But he doesn't think the whole
mortgage lending process will migrate overseas because
while some functions work well in an outsourcing
situation, others work better in the United States.

Outsourcing parts of the mortgage transaction isn't a
new practice among lenders. Many already outsource
credit, mortgage insurance and appraisal services to
third-party vendors. Two-thirds of mortgage loans come
from channels other than direct lending, according to
Kropper.

It's easy to see why lenders keep quiet about their
outsourcing plans, given the backlash over shipping
U.S. jobs to India. Even so, some experts say the
public fear of outsourcing is misplaced.

Bruce Bartlett, a senior fellow for the National
Center for Policy Analysis, believes outsourcing's
benefits greatly outweigh its costs. He thinks
outsourcing is far less a threat to U.S. workers than
they first imagine it is.

"There is not a one-for-one relationship between jobs
lost here and those gained elsewhere from
outsourcing," Bartlett wrote in an article NCPA
published in December.

At some point though, investors will want to know the
details of a public company's cost-cutting strategies.

Copyright 2004 Inman News

--
David Solomonoff
dsolomon () nycap rr com
_______________________________________________
Politech mailing list
Archived at http://www.politechbot.com/
Moderated by Declan McCullagh (http://www.mccullagh.org/)