FTC: data leaked to P2P networks.

• Position: DATA SECURITY - Federal Trade Commission - Peer to peer networking

[ILLUSTRATION OMITTED]

Employees at more than 100 U.S. companies and agencies are regularly leaking vast amounts of private customer and employee data via peer-to-peer (P2P), file-sharing networks, according to the Federal Trade Commission (FTC).

While the FTC did not release names of the organizations or the P2P networks, FTC Chairman Jon Leibowitz said, "Companies and institutions of all sizes are vulnerable to serious P2P-related breaches, placing consumers' sensitive information at risk." He said the FTC found health-related information, financial records, and drivers' license and Social Security numbers, which is the kind of information that could lead to identity theft.

The FTC sent the notice letters to public and private businesses, schools, and other government agencies, urging them to review their security practices and, if appropriate, the practices of contractors and vendors, to ensure they are reasonable, appropriate, and in compliance with the law. The letters state, "It is your responsibility to protect such information from unauthorized access, including taking steps to control the use of P2P software on your own networks and those of your service providers."

The FTC also recommended that the entities identify affected customers and employees and consider whether to notify them that their information is available on P2P networks. Many businesses may be required by state or federal law to notify breach victims.

"Companies should take a hard look at their systems to ensure that there are no unauthorized P2P file-sharing programs and that authorized programs are properly configured and secure," Leibowitz said. "Just as important, companies that distribute P2P programs, for their part...