• Is someone snooping your health records? New rule will tell you who

    Federal Register

    An example of an access report record from the proposed rule.

    Ever wonder if someone at the doctor’s office or hospital has been snooping through your health care records? A new federal health care rule could tell you.

    Health care patients will have a broad new tool to keep their personal information under wraps if a proposed Department of Health and Human Services rule is adopted.  The update to federal health care privacy laws proposed on Tuesday by the Department of Health and Human Services would give patients the right to see the name of any person who accessed their electronic health records, and what he or she did with them. The so-called "access report" would be available from some health care providers as soon as Jan. 1, 2013.  It would function much like a free credit report -- consumers would have the right to ask for one such report for free every year.


     The change comes as scrutiny over hackers and data leaks is at an all-time high, following high-profile electronic attacks on Lockheed Martin, Sony and the security firm RSA. 

    Protection of health care information is seen as particularly critical, but efforts to keep it safe have often fallen short. In the past two years, health care providers have leaked personal information belonging to nearly 8 million patients; many of the leaks are listed on this government Web site.

    Earlier this year, Massachusetts General Hospital was fined $1 million for a serious data leak. Meanwhile, the inspector general for the Department of Health and Human Services issued a report this month detailing dozens of security vulnerabilities at large hospitals around the country.

    The proposed new "access report" right stems from a provision included in the 2009 stimulus package passed by Congress in an attempt to jump start the economy. That legislation included $30 billion to encourage development of electronic health care records, a provision called the Health Information Technology for Economic and Clinical Health (HITECH). To alleviate concerns about the security of online health records, Congress instructed the Health and Human Services Office of Civil Rights (OCR) to beef up consumer disclosure rights included in the Health Information Portability and Accountability Act (HIPAA).

    Access report requests would apply to electronic records only; paper records would be excluded.

    “This proposed rule represents an important step in our continued efforts to promote accountability across the health care system, ensuring that providers properly safeguard private health information,” OCR Director Georgina Verdugo said in a statement. “We need to protect peoples’ rights so that they know how their health information has been used or disclosed.”

    It's unclear how industry groups will react to the change. A spokeswoman for the American Hospitals Association said the organization did not have a comment "since we are still in the process of reviewing the changes."

    In the proposed rule, however, the Health and Human Services Department said most providers opposed the change, saying it would be costly to implement and provide little consumer benefit.

    Tena Friery, a HIPAA expert with the Privacy Rights Clearinghouse advocacy organization, disagreed. She said the potential to identify a specific person who accessed a health record would be a tremendous deterrent to would-be snoops. 

    "It's a good thing because there have been a lot of problems with access to health care records. … That kind of thing really has to stop," Friery said. "Anything that sheds light on these practices is going to make hospitals more aware and make them take security more seriously than they have so far."

    The law might be particularly welcomed by celebrities trying to keep their hospital visits out of the news. It could also be warmly received by those trying hard to persuade skeptical health consumers that electronic health records are safe. 

    "Electronic records are much more vulnerable to widespread access than paper locked in a cabinet,” Friery said.  “There needs to be confidence in the system for it to work," Giving consumers the right to know precisely who accessed their personal information could help win them over, she said.

    The rule won't help in that regard, however, if consumers don't know about it -- and there's obvious precedent for that. HIPAA's privacy and security rules already grant consumers a more narrow "accounting of disclosures," which essentially gives them the right to know when their information is shared with third parties.  The trouble is, virtually no one has exercised that right, according to health care providers who offered comments to the Department of Health and Human Services about the new rule.  About 90 providers said they had received fewer than 20 requests since the initial HIPAA "Privacy Rule" took effect in 2003, and another 30 told the agency they'd never received a request. (The accounting of disclosures right will remain in place with minor adjustments.)

    Still, the existence of a process for getting a detailed access report is fundamental to preserving patient rights -- and Friery said it might inspire similar changes in other privacy-related industries.

    "Credit reports are a good example of where things don't work well.  They are full of all kinds of vague statements about who accessed your information.  We really do need to know more," she said.

    The Department of Health and Human Services will accept comments on the proposed rule through August 1, and then consider its permanent adoption.

    The full text of the proposed rule can be read here.

    Follow Bob Sullivan on Facebook by clicking here. 

  • Efforts to undermine new consumer agency amateurish, dangerous

    SAUL LOEB / AFP/Getty Images

    Elizabeth Warren testifies before the US House Committee on Oversight this week.

    Just how many cities will burn to the ground before we decide it's OK to enforce some building codes?

    In case anyone hasn't noticed, the U.S. is stuck in the worst economic downturn in 80 years.  Why this happened is important: It wasn't caused by a debilitating depletion of raw materials, a devastating natural disaster or even a slow, steady decline in competitiveness. No, the recession’s cause is entirely artificial -- runaway bank greed, irresponsible decisions by plenty of people who should have known better and, most important, by the deflation of a financial bubble and its massive fallout.

    It seems incredible to argue that, after all this, nothing should change.  And yet, that's the feeling you get from opponents of Elizabeth Warren, who have made it their cause celebre to dismantle the most tangible effort since 2008 to stop the financial madness.  A handful of bills have been proposed that would defang the new Consumer Financial Protection Bureau, or turn it into a commission so temporary director Warren can't be in charge. We'll get to these in a moment, but suffice to say the legislative efforts are very thinly veiled attempts to close the agency before it opens.

    This week's very public childish exchange between Republican Rep. Patrick McHenry, R-N.C., and Warren over a scheduling disagreement was a rare, unscripted moment in congressional hearings.  If you haven't watched it, you should. McHenry wanted the hearing to continue; Warren said she has other commitments that were scheduled around the agreed-upon time, and instead offered to submit other answers later in writing.  McHenry said there was no agreed upon time, telling Warren she is "making this up." The meeting devolved from there.

    The spat provides a window into how Washington, D.C., really works and Congress’ lack of urgency in working to rescue our nation's economy and prevent another meltdown. McHenry was engaging in one of the oldest tricks in the book -- the equivalent of arguing about the size of the negotiating table during peace talks. He might as well be yelling about the best way to rearrange the deck chairs on the Titanic.

    The spat didn’t end there. McHenry’s staff issued a press release after the hearing saying Warren showed a "blatant sense of entitlement," and the incident proved she has "disregard for congressional oversight."

    If you've never been to a hearing in the halls of Congress, it's important to note that most verbal testimony is delivered in nearly empty rooms, to nearly empty member seats –  that can be hard to see on TV, given the magic of television. Submitted written comments, placed into the record, occur at every hearing. In other words, the hearings themselves are a charade.

    The charade within the charade that McHenry orchestrated was simply an attempt to make Warren look bad, to appeal to those who robotically hate every new government initiative, no matter what. A quick glance at McHenry's Facebook page might suggest his effort to make Warren look bad backfired on him.

    The incident does provide yet another occasion to re-examine the idea that a new regulator is needed to keep banks from misbehaving and to protect consumers. It's very hard to argue against the notion that whatever we had in place before 2008 didn't work very well. Was the problem the rules, or the rules enforcers?  There's plenty of debate about that, but I can tell you that those who designed the Consumer Financial Protection Board believed chiefly that bank regulators we had were too cozy with banks, and a fresh start with a new agency was needed.  The Dodd-Frank financial reform law passed by Congress contains few new rules for credit card issuers and mortgage originators; mainly it just tells them there's a new sheriff in town.

    Beneath all the rhetoric, the real argument is about the sheriff.  Warren has been one of the very few voices in Washington, of either party, who speaks openly about bank abuses.  A career lawyer and Harvard academic who has never held elected office, she has no history of political donors to please, no favors to pay back, no sweetheart mortgage deals we know about and, apparently, no skeletons in her closet other than an apparent fastidiousness about sticking to schedules.  She's just the kind of person banks fear.

    I've known Elizabeth Warren professionally for a long time. We first met after she published her breakthrough book, “The Two-Income Trap,” long before the financial meltdown that thrust her into the role as the nation's top consumer protector. Anyone with curiosity about what's really happening now should at least read some excerpts of the book.  In it, Warren lays out a compelling argument that most families now need two incomes – usually husband and wife -- to afford a house in a safe neighborhood with good schools. A generation ago, one income was sufficient. The stress this change has placed on American families is immense, and no political party should call itself family-friendly without taking on this immense, fundamental social upheaval. 

    Not long after, I attended a more typical, boring congressional hearing about bankruptcy. Warren testified, and I watched. During a break, a gang of former Harvard law school students surprised her with a visit.  She hugged them like a grandmother would. 

    In 2008, she was kind enough to take the time do a peer review of my book, “Gotcha Capitalism,” even as she exploded on the national scene as the public face of financial reform aimed at helping consumers.

    Of course, being nice and writing a book say nothing about your ability to run a large government bureaucracy. We don't yet know if a Warren-led Consumer Financial Protection Bureau would be effective.  But we know exactly how things worked in the past. Anyone who wants to try that again is insane. If there is a better person to head the agency, no one has said his or her name out loud yet.

    Republicans have introduced several pieces of legislation designed to “reform” the Consumer Financial Protection Bureau before it officially opens for business on July 21; one might hope they would be as active in attempts to reform Wall Street and the banking industry, but let's examine the specifics of these efforts.

    Rep. Spencer Bachus, R-Ala., has introduced a bill that calls for the biggest change: The bureau would be run not by a director, but by a five-person commission. Anyone who's worked in corporate America knows full well that the best way to kill an idea is to appoint a committee to study it; that's the strategy here.  Anyone who thinks D.C. commissions work well should look at the long line of successes that have emerged from the FCC or other federal commissions.

    Bachus is fond of saying that the new bureau might be "the most powerful agency ever created," which shows a gift of hyperbole that even the National Enquirer could love.  The financial reform bill holds that any decision the bureau makes can be overturned by the new 10-member Financial Oversight Stability Council, which is made up of top banking regulators such as the Federal Reserve and the Office of the Comptroller of the Currency.

    Rep. Sean Duffy, R-Wis., introduced a bill that would make it easier for the Financial Oversight Stability Council to reverse decisions made by the new consumer agency.  At the moment, stopping a new bureau rule requires two-thirds of the 10-member council to vote that a new rule threatens the safety and soundness of the banking system. Duffy's law changes that to a simple majority. Here's the problem: Such a law tips the balance of power bank into the hands of the same regulators who had it before 2008. They didn't do a bang-up job of determining safety and soundness then.

    Finally, Rep. Shelley Moore Capito, R-W.V., introduced a bill that would open the door to delaying the formal opening of the agency indefinitely.  As we all know, nothing happens -- particularly in D.C. -- without a deadline.  When Congress passed financial reform, it set July 21, 2011, as the date when a director should be in place and the transfer of regulatory power would take effect.  Capito's bill would stop the power transfer if a permanent director has not been confirmed in the Senate.  Republicans have already said they'd block Warren's confirmation if she were appointed.  That kabuki dance would lead to an indefinite delay in the opening of the new consumer agency.

    All three bills were passed by the House Financial Services Committee earlier this month. The full House may pass them, but the bills stand little or no chance in the Democrat-controlled Senate, would face a certain presidential veto and would never win a veto-proof majority. In short, they are legislative non-starters.  They are great conversation starters, however, for legislators hoping to woo donations from financial companies. The Center for Responsive Politics reports that banks and their political action committees gave $19 million in political donations to federal candidates, committees, and parties in 2010.

    I can't predict the future; I can't say the new consumer agency will prevent the next financial meltdown, or if it will even prevent a single consumer from being deceived by a bank.  I can say it’s time to stop blocking progress. No doubt, the agency will require some adjustments after it begins its work, and Congress would do well to actively oversee it. It can pass laws to fine-tune it -- or dismantle it -- at any time.  It seems foolish to "reform" the agency before it’s even open for business.  Legislators should let Elizabeth Warren begin her job, and fire her if they don’t like results. The agency’s chief role should be to clarify mortgage application forms, step in when outrageous new bank fees appear and to act on consumer complaints when they arise. It’s amazing how threatening that work sounds to some people.

    After a string of bad fires, you force builders to use safer materials and install sprinklers, and you hire inspectors to make sure the work gets done. That's just how the world evolves.  Getting in the way of that process will just send us spinning in circles, and I don't think anyone wants 2008 again.

    Follow Bob Sullivan on Facebook by clicking here. 

    Comments begin below. Comment anonymously by sending an e-mail to BobSullivan@feedback.msnbc.com

  • That famous space shuttle photo: When is sharing stealing?

    Jonathan D. Woods / msnbc.com

    Stefanie Gordon displays the image she shot from an airplane of Space Shuttle Endeavour's final launch on Monday in New York City.

    Short on sleep and worried about the recent loss of her job, Stefanie Gordon boarded a Delta flight from New York to Palm Beach at 6:30 a.m. on May 16. Still miffed after a late-night Yankees loss to the Red Sox, she took a photo out the window of her airplane seat with an iPhone, tweeted it to friends when she landed, then headed off to spend the day with her father.

    By the time she was sitting in the passenger seat of his car, her iPhone was practically buzzing out of her lap, teeming with messages of congratulation and requests for interviews. Gordon's now-famous photo of the space shuttle Endeavour soaring through the clouds got her an overwhelming amount of attention -- her 15 minutes of fame, Internet style. It also landed her smack in the middle of an ethical and legal debate that may be as important as the future of the Internet itself.

    Gordon's photo has been viewed nearly 1 million times, and shown by media TV, Web and print news outlets around the world. She was paid by precisely five news organizations. 

    In a world where social media users, bloggers and even some professional journalists are increasingly comfortable simply copying the work of others and republishing it, can intellectual property rights survive? Can original content survive? And what should the world do when an amateur photographer takes a newsworthy photo and shares it on a social network?

    To be sure, Stefanie did not seek this fight, and doesn't feel too compelled to be its poster child, either.


     "I never even thought about what could happen,” she said. “To me, it's just a picture. I tweeted and put my phone away. ... I had four hours of sleep and wasn't thinking. I was trying to spend time with my dad. I've never been a person who feels like I need to make money off of everything.  I just put it out there for people to see."

    (See the original msnbc.com photoblog post of Gordon's photo.)

    Still, she is the latest in a long line of characters made larger-than-life by the Internet's virus-like network effects.  The last victim -- or recipient, depending on your point of view -- of Internet fame borne of an accidentally famous photograph was Janis Krum. He landed, quite literally, in the middle of the digital rights debate in 2009, when a passenger aircraft made an unexpected landing in the Hudson River.  He took exactly one picture with his iPhone, instantly tweeted it from the ferry he was on a few feet from the plane, and went to help passengers off the floating aircraft.  He earned virtually nothing from his famous photo, which was copied and used by both commercial and private publications around the world. The confusion surrounding Gordon's photo felt very familiar to him.

    "It's kind of crazy that after two years there is still nothing in place to deal with this issue,” Krum said. “It's still the wild, wild West right now.”  In some ways, it seems more socially acceptable to take advantage of a naïve rights holder. “Organizations say, ‘Well, it’s a regular person we don't even have to compensate them.’ They do things they wouldn’t do with a professional photographer," Krum said.

    One face of Internet culture dating back to the advent of Napster holds that everything electronic should be free, and there's no harm in copying digital content. It's second nature for people who use social networks to copy and paste photographs or other media, and there's probably no changing that.  On the other hand, commercial outlets that sell a product using images and videos should feel compelled to pay for content they use.  Gordon and Krum’s stories show that reality is far more complicated.

    The law, however, is not. The mere act of taking a photograph means the photographer holds the copyright for that picture. Sharing it on a social media site does nothing to limit or reduce that fundamental right, according to digital rights expert Mary Luria. 

    Stefanie Gordon

    The Stefanie Gordon iPhone photo that started it all.

    "Unless (you) post the photo with a message that says, 'please copy this and pass it along,' the photographer holds the copyright," said Luria, a partner in Davis & Gilbert in New York.  

    Misuse of content isn't new, she points out -- famous photos have been copied without credit for 150 years -- but the Internet has made it easy and, in some circles, normal.

    "The culture of the Internet is this concept of sharing everything. That things belong to us, not to a person," she said. "And they are surprised when someone says, 'You've taken this, it's mine."

    Not everyone thinks that way.  The Associated Press paid for a license to use Gordon's photo, and to send it to all its members. (Msnbc.com also paid Gordon for the right to use her photo on the website and on television.) Many other outlets asked for her permission to republish, which she granted without charging a fee.  But there were plenty of other outlets that used her photo -- and Krum's before it -- without obtaining permission. Some even used it without giving credit.

    When that happens, it's up to the rights holder -- the photographer -- to file a copyright claim and demand payment.  That's a bit backward, Krum says.

    “There's definitely an ethics issue here," Krum said.  "You have to police them, because they won't do it themselves."

    The legal questions begin immediately upon taking the photo.  Professionals are well-schooled in controlling the distribution of images, but amateurs often aren't.  Even if their legal rights remain, it's often incredibly hard to shove the cat back in the bag after a photo has been tweeted to the world and passed around. Carolyn Wright, who operates PhotoAttorney.com, says a few moments of "What if that happened to me?" reflection now can save a lot of heartache later. 

    Like Gordon, it's quite possible that someone could take a photo and not realize its inherent value right away, she said.

    "Gordon immediately tweeted it, and that just lets the gate open these days. It'll spread like wildfire," she said.  "If people can just take a moment and recognize that they have something of value…  I tell people, 'If you happen to take a picture of Elvis at McDonald’s, think about what would be the value of that."

    Amateurs probably wouldn’t consider this in the middle of such excitement, but it is possible to sell more valuable exclusive rights to a news outlet, or to find an agency to do the bidding for you. The days when Newsweek and Time magazine would fight over the rights to a photo with six-figure checks are dwindling, but there is still value in exploring value ahead of publication to social media.

    Asserting rights after the fact is trickier, but still possible.

    The process will sound familiar to anyone who's followed the complicated issues around music and movie piracy.  A photo rights holder must send a cease-and-desist notice, then send a bill. A small cottage industry  has evolved of lawyers who file rights claims for photographers, Luria said.

    "You don't want to sue everyone who has the photo on their site. That would be very costly," she said. Payments are limited to the amount the violating site normally pays for similar photos, which could be a few dollars.

    On the other hand, firms that appropriate an image and use it for purely commercial purposes -- say, an advertisement by an airline -- could face a large lawsuit.

    Photographers who want to exert their rights will have a much easier time if they file paperwork with the U.S. Copyright Office. They have 90 days to do so, and the rights are retroactive to first publication. That means someone like Gordon could decide to pursue legal action for up to three months after her 15 minutes of fame subside.

    "The law, it’s accommodating to the fact that you might not think to file with the copyright office in the middle of such an event," Luria said.

    Photographers often protect their rights a second way: by placing watermarks on images they publish, often including their website or phone number. These watermarks can be easily removed, but doing so can land the remover in a heap of legal trouble.  The photographer can sue under the Digital Millennium Copyright Act for such a removal, and claim damages of up $25,000 per incident.

    U.S. law does carve out exceptions for news publications under extremely newsworthy circumstances, what's often called "Fair Use." If a piece of digital media itself becomes news, U.S. outlets can publish it under the theory that it is protected First Amendment speech.

    Fair Use is the subject of widespread debate, however, and its application is wildly subjective.  Luria, for example, said that in situations where news publications have no alternative access to an important image in a breaking news situation, they would be protected by fair use.

    But Wright said she didn't believe courts would see the rarity of an image as a "fair use" exception from copyright law.

    Meanwhile, retaining copyright doesn't mean retaining all rights. A particularly vexing problem facing users of services like Twitpic involves the ever-changing fine print in the sites' terms of service agreements.  Both Gordon and Krum used Twitpic to share their photos.  Currently, Twitpics' terms of service informs users that the firm has the right to resell any images loaded by original rights holders onto its servers. In other words, Gordon has the right to sell her Space Shuttle picture, but TwitPic does now, too.

    "They take a non-exclusive license when you upload the image," Wright said.  "Just by using the outlet, you give them that right."

    Danny Sullivan, a search engine and social media expert, says it's inevitable that amateur users will increasingly find themselves in possession of powerful, newsworthy photos. He thinks it’s up to the photo services to fix the current mess.

    "I think the problem is that photo-sharing services don’t allow you to easily provide copyright information,” said Sullivan, who operates SearchEngineLand.com. “If somebody comes across a photo they think is newsworthy, there is nothing there which indicates you need to license the photo. Right now we're in this vacuum."

    He thinks photo sharing services could offer users simple options like, "Would you be interested in selling images?" -- and could even act as agents for consumers.

    They could also help solve a practical problem that Gordon faced. When an amateur is suddenly in the middle of a news swarm, they become nearly impossible to contact, as a flood of Tweets and e-mail act as a kind of denial of service attack.  Gordon had to turn off some Twitter notifications after her follower ranks swelled from 1800 to 5,000 overnight. A photo sharing site could help funnel the requests, and provide reliable contact information for media outlets.

    Of course, without social media and the viral effect, there wouldn't be any need for an ethical discussion. Gordon would have merely shown the photo to her father and a few friends, and it would have quickly faded into a curiosity. So Wright, of PhotoAttorney.com, doesn't offer hard-and-fast advice to suddenly famous shooters. 

    "It's damned if you do damned if you don't," she said.  "If you don't share your work online, then no one knows to license it."

    Krum may not have gotten rich off his Hudson landing picture, but he did turn it into a new career.  He was a casual photographer working on tech start-ups when he snapped that picture, but today he’s a social media consultant.

    “I was kind of pushed into this realm after the photo, and I kind of embraced it,” he said. “It’s a great conversation starter.”

    Gordon realizes she probably missed out on the opportunity to earn some good cash with her photo, but she is remarkably positive about it.

    "There's more good than bad here," she said. "Through Twitter, I was able to make some amazing connections." Connections that, she hopes, will soon lead her to a new job in events planning or sports marketing. 

    RED TAPE WRESTLING TIPS

    Gordon has one simple piece of advice for the next person who finds themselves in her spot: Get advice.

    "If you know anybody who specializes in these kinds of things -- a journalist, a lawyer, a friend in PR -- if they have the one minute to do it, call them and ask for advice," she said. When you are in the middle of a media crush, it's nearly impossible to understand what's going on, and to make good decisions, she said.

    Even after a photo has been published, it's not too late to file with the U.S. Copyright Office (you have 90 days -- see below).

    After the photo has been published online, it's up to you to watch for infringers.  Software can help. A free tool called TinEye looks for digital signatures of images -- a sort of alert service for pictures -- and will report if a picture is being used.

    Links to Carolyn Wright resources:
    Right way to register a photo copyright
    Help, I've been infringed
    What's the fuss about “fair use”

     

    Follow Bob Sullivan on Facebook by clicking here. 

    Comments begin below. Comment anonymously by sending an e-mail to BobSullivan@feedback.msnbc.com

  • IRS snafu leaves taxpayers, refunds in limbo for months

    It's perhaps the very definition of Red Tape. Four years ago, Congress decided that the IRS should get into the banking business, authorizing it to give out no-interest loans to first-time homebuyers. That put the agency in the position of both collecting loan payments and issuing tax refunds to the roughly 1 million taxpayers who took advantage of the program.

    This year, the odd arrangement overwhelmed IRS systems, and an unspecified number of taxpayers have been forced to wait four months or more for their tax refunds. In fact, many are still waiting.

    "This is frustrating for taxpayers, and it's frustrating for us," said IRS spokesman Terry Lemons. "We deeply apologize."

    Making matters worse, taxpayers caught up in the vortex say they've been promised delivery dates for their refunds repeatedly, only to be disappointed or to discover their returns have been placed back into "error" status.

    One of those taxpayers who's been tantalized by repeated promises of a refund check is Tia Littlejohn, who lives in Maryland just outside Washington, D.C. She and her husband are planning to use their expected $6,800 refund to pay for in vitro fertilization. She's had to postpone the procedure twice because promised tax refund dates have come and gone without payment.

    "At this point, I may have to just cancel it," she said. "It's really affecting our household. It's very stressful."

    Her litany of hope and disappointment is typical.

    "Our return was processed February 19 with a refund date of March 4. Well, March 4 came and went. Since then we have been waiting, every other week we have a different error code and the date of a possible direct deposit," she said. "On April 27 they told me they told me my return was done and 'out of error.' Last week they told me I should receive it May 20. Then (Wednesday) I looked and it's gone back into error again."

    Lemons said the IRS has devoted a lot of extra labor toward solving the problem and began manually processing the returns after the problem was discovered in February. The number of victims has been whittled to "a few thousand taxpayers," he said.

    More on the First Time Homebuyer tax credit

    That's cold comfort to people who have been waiting months for thousands of dollars. A Facebook group devoted to taxpayers caught up in the mess now has more than 3,000 members; they write daily about their mind-numbing frustrations. Many are now being told their returns won't arrive until mid-June.

    "I had a date, and a second date ... and now I'm back at 1201 (error). My advocate said that it's just sitting there. WTF IRS?" Jannae Leonard Powell wrote Thursday.

    The Facebook page has become a support group for some, a place where taxpayers share tips on the best time to call , the best number to call and how to reach the most helpful phone agents. Littlejohn said many in the group have received frequent rude treatment, so they just hang up repeatedly until a "nice" agent answers.

    "Some are very nice, but some are very nasty and basically say, 'I don't know what else to tell you. You are just going have to wait,'" she said.

    All the taxpayers involved in the glitch took advantage of a one-time, misnamed First Time Homebuyer  tax “credit” offered during the 2008 tax year, a program that turned out to be a meager effort by Congress to prop up the then-imploding housing market. Homebuyers who took advantage didn't actually receive a credit — they were granted what was essentially an interest-free loan of up to $7,500, to be paid back in $500 increments starting in 2010. Subsequent versions of the program granted homebuyers an outright tax credit, so the 2008 users already have something to moan about.

    Lemons said IRS systems weren't set up to handle the many variables that ultimately came from the program, such as how to calculate repayment of the loans if buyers got divorced, or ended up in foreclosure. One particularly vexing and unexpected problem: Many taxpayers are paying more than the minimum $500 annual payment in an effort to pay off the loan early.

    "That has complicated matters," he said. "These are well-intentioned homeowners, but our initial programming was that payments would be spread out equally over 15 years."  Programmers of complex systems will understand this as a typical problem of "unexpected input."

    Stephanie Vega used the tax break loan to buy a house in  2008 and accommodate her growing family shortly after she had twins. The family bought a foreclosure property that needed major cosmetic repair at the time — and still does. They planned to use this year's refund to repair their master bathroom, which has been essentially unusable since the purchase.

    "When I called at the end of March, they said they were going to get everyone who was affected by this their money by April 5th," Vega said. "That came and went, and obviously no money. … They all contradict what the one before them say. You just don't know who to believe."

    Vega, like many of the other taxpayers, has been assigned an agent in the IRS Taxpayer Advocate's Office, but she said that hasn't helped much.

    "Normally, I am not a pushy person, and so usually I just sit back and wait. I don't like to be a pain or a bother, but we are needing our money now," Vega said. "I just feel like the complete lack of communication, along with the IRS seemingly just sweeping this problem under the rug, is so unfair and unjust."

    Amy Royer, 37, had to wait more than three months, but she just received her $4,700 refund last Friday. Even so, she still feels angry about her interactions with the IRS.

    "The whole thing was a pretty bad experience," she said. "Most of the frustration came because of the inconsistency, the different stories we got about the status of our refunds. It was a fiasco, really."

    Royer had also planned to use her refund to take care of a medical procedure. Because she was promised a refund on March 8, she went ahead with sinus surgery on March 1 and paid with credit, assuming the refund money would arrive and cover the bill. The refund's tardiness caused her to pay high interest and set her blood boiling.

    "The whole time, I was saying, 'I would have a different feeling about things if we were getting real answers,'" she said. "It's our money, not their money."

    With the problem having shrunk to a few thousand taxpayers, it might be hard to understand why the IRS hasn't been able to manually overcome its computer issues and issue refunds. Lemons said that the agency is trying but that the problem arose at the worst possible time.

    "This time of year, we have tens of millions of tax returns coming in. It's all hitting at the busiest time of year," he said. "Our people have been hustling for weeks to get this thing squared away, but the bottom line is there are people who have not gotten refunds yet, and we deeply apologize."

    RED TAPE WRESTLING TIPS

    Many consumers enjoy the rush of a large tax refund check and use their regular payroll deductions as a kind of forced savings plan. That's a bad idea.

    This Red Tape tale is a good reminder to all that now is a good time to double-check your regular payroll deduction. There is no good reason to overpay federal taxes during the year in order to build up a large tax refund. That amounts to no-interest loan to the government, and you are better off keeping that money throughout the year and putting it in the bank yourself. Obviously, it's better for you to receive the interest, rather than Uncle Sam. But perhaps more important, in an economy where even Standard & Poor's is beginning to doubt Washington's ability to pay its bills and where the federal government faces threatened work shutdowns annually, it's bad to trust your money to the whim of Uncle Sam. In the past, state governments have delayed issuing refunds to help close budget gaps — it's not unthinkable that Congress could try that someday.

    If you received a large refund this year, that's nothing to celebrate. You should adjust your payroll withholding accordingly, ASAP.

    Follow Bob Sullivan on Facebook by clicking here. 

    Comments begin below. Comment anonymously by sending an e-mail to BobSullivan@feedback.msnbc.com

  • Verizon Wireless customers targeted in nearly invisible Trojan horse scam

    Verizon Wireless customers who tried to pay their bills online last week may have been hit by an ingenious, almost undetectable hacker attack aimed at stealing their identities.

    Consumers whose computers were infected with the SpyEye Trojan horse program would have been redirected to a Web site controlled by criminals after they logged into Verizon Wireless' website, according to Israel-based security firm Trusteer. Then they were presented with a form that appeared to be from Verizon, but tricked users into entering a detailed series of personal information, including their Social Security number and credit card information.

    "The attack is transparent to Verizon customers since the malware waits for the user to log on and access their billing page, and only then injects an authentic-looking replica Web page that requests this information," said Amit Klein, Trusteer's CEO. "Since the user has logged on and has navigated to the familiar billing page they have no reason to suspect this request for payment information is fraudulent."

    SpyEye is a copycat of the powerful Zeus Trojan horse that has been successfully used in massive electronic banking heists, including a series of thefts the FBI warned about recently that hit U.S. companies and sent millions of dollars to six Chinese cities

    The attacks occurred between May 7 and May 13, Trusteer said.

    Verizon confirmed the attack late Wednesday night, but said it didn't impact its systems — only consumers who failed to secure their own computers were hit.

    "No Verizon systems or networks were breached," said Verizon spokesman Bill Kula in an email to msnbc.com. "Customer data was protected unless their PC was not protected by anti-virus software with current definitions. We encourage all customers to use anti-virus software and keep their ant-virus definitions current."

    Verizon said at least one other "major communications company" was targeted by the SpyEye attack, but declined to identify the firm.

    It also noted that consumers who were infected with the Trojan horse, but didn't log in to Verizon or that other firm, were not impacted.

    "(Computer criminals) typically just go after anyone they can infect," Kula said. "We have no indication it is more than this. The bogus page will only launch when they try to go to our billing site. There could be many other people infected who are not our customers, and thus will not see the bogus page launch."

    Trusteer said it had reason to believe at least some consumers had fallen for the scam, but couldn't say how many.

    Hackers have taken to increasingly sophisticated malicious software that lies in wait until consumers — or businesses — are particularly vulnerable, such as immediately after logging on to a financial website. It's a troubling trend, Klein said.

    "While this attack is not technically new, it continues a financial malware trend we have been tracking in recent weeks: a shift away from stealing usernames and passwords to stealing payment and credit card data," he wrote in a blog post. "There's no easy answer, since most endpoints used to enter payment and credit card data are outside the control of the merchants who process the transactions."

    Follow Bob Sullivan on Facebook by clicking here. 

    Comments begin below. Comment anonymously by sending an e-mail to BobSullivan@feedback.msnbc.com

     

  • An online bank scam worthy of a spy novel

    One moment of weakness -- a single click on a bogus e-mail link or website -- has cost many U.S. companies nearly $1 million apiece, the FBI said.  And it has transported them into a world of international intrigue worthy of a spy novel, connecting them to a crime ring linked to six Chinese port cities near the Russian border.

    In a sternly worded warning that included a remarkable level of detail for an FBI press release, the agency is warning U.S. businesses and banks to be wary of wire transfers headed to Chinese cities of Raohe, Fuyuan, Jixi City, Xunke, Tongjiang and Dongning. 

    It's unclear if the stolen funds remained in China or were transported elsewhere, and U.S. security firms are currently debating the significance of the notice. But the high-dollar value of the thefts, combined with their high-profile destination -- any government cybercrime warning that involves China raises eyebrows -- has attracted unusual attention in the banking community.

    Transactions headed to those Chinese cities should be "heavily scrutinized, especially for clients that have no prior transaction history with companies in the Heilongjiang province," the FBI said.


    Wire transfers -- often in the $900,000 range -- were repeatedly sent from U.S. firms to legitimate Chinese trading companies in Heilongjiang. Sending the money through international trade firms -- which are believed to be victims, also -- helped minimize suspicion.  In a release dated April 26, the FBI said criminals had recently attempted to steal $20 million and got away with $11 million, a staggering success rate.

    Online criminals have shifted their focus away from consumer accounts and onto larger business accounts, experts say.  Commercial accounts have larger balances, involve more frequent transactions and the destinations for payment are much more varied, making hacker theft much harder to detect. 

    "These are small- and medium-sized businesses at the heart of the economic recovery who are devastated by this. In many cases banks do chose to share in losses, but it's still devastating," said Terry Austin, CEO of Guardian Analytics, which provides security to banks. He said his firm detected several attempted transactions that fit the scenario laid out by the FBI, including the Chinese destination cities. "This notion that banks and credit unions are under relentless attack -- this is just one more example of the size and boldness of attacks -- is a story that needs to keep getting told."

    Even if China is merely an intermediary step in the heists, it's significant that the FBI chose to call out Chinese cities in its release, said Avivah Litan, a bank security analyst for Gartner.

    "I have never seen a fraud alert with this much specificity," Litan said.  "It makes you think. There is definitely a Chinese connection, though we don’t really know what it is.” 

    She speculated that the criminals could be behind other well-publicized computer break-ins that have been blamed on Chinese hackers.

    “You would think it could be the same spies for the Chinese government who have been wreaking havoc, and they need to pay for their efforts. Usually bad guys rob accounts to fund other activities. But that's just speculation,” she said. “It also strikes a familiar chord since perpetrators originating in China are rumored to be behind the recent spate of (advanced persistent threat) attacks against security companies like RSA Security and others, some of which I hear have not been publicly disclosed. It makes you wonder if our intelligence and law enforcement agencies are closing in on loosely organized criminal Chinese rings that perpetrate various types of fraud for financial and political gain, and if the same rings are involved in multiple activities.

    The highly-skilled hackers in the FBI warning managed to control computers on both ends of the transactions -- hijacking computers than can access small business accounts on the U.S. side, and also computers in China that can access accounts belonging to legitimate trading firms there.  That helped them cleverly cloak their activities. It also might be the reason the FBI called out Chinese cities by name, said Mickey Boodaei, CEO of Israel-based Trusteer, a security firm.

    "The main reason the FBI issued a release was because they had actionable intelligence about how to ID these transactions and block them and wanted to reach a wide audience of banks and online bankers and let them know they should be really careful," he said.

    The criminals were smart enough to rotate destinations for the money quickly in an effort to further evade suspicion, the FBI said. So there's no reason to believe hackers haven't already moved on to other cities.  All experts interviewed for this story said they thought the $11 million value of this specific heist represented just the tip of the iceberg. Litan said she believed it's a $1 billion global problem.

    "This is just a very common occurrence now at banks, with criminals robbing small business accounts and moving the money offshore," she said.

    In each case, the FBI said, the money was sent to one of three Chinese banks: “Agricultural Bank of China, the Industrial and Commercial Bank of China, (or) the Bank of China.”    

    Guardian Analytics’ monitoring software, which Austin says spotted and stopped fraudulent transactions headed to those six Chinese cities, offer a rare detailed glimpse into how the criminals operated. 

    The target "could be a construction company, a real estate company, a school, a church. Any business that has a commercial account that it uses that to pay suppliers and vendors," he said.

    An employee inside the firm who has the ability to wire funds through those accounts is targeted with an attack. Once he or she takes the bait -- perhaps laid through a booby-trapped e-mail, or an infected website -- the criminals gain access to a computer and an account at the firm authorized to wire money. 

    In some cases, the theft involves simply logging into an online merchant account and initiating a wire transfer.  But even companies with far more sophisticated security protections have been victimized, Austin said.  Some firms require dual authorization for a financial transfer, or at least a phone call for verification. The criminals are smart enough to arrange for a bypass approval, or to reroute the approval phone calls to numbers they control, he said.  They even spent weeks observing an account to find out when the balance is highest and watch transaction patterns so criminal wire transfers won't raise alarm bells, Austin said.

    "They often go through a multi-step setup before the crime," he said.

    If the bank requires two-factor authentication – perhaps the entering of a code from a token along with a password -- the criminals lie in wait until the employee logs in to the bank account, and then make their move by "hijacking the session," Austin said.

    The criminals go to impressive lengths to hide their tracks.  After a session is hijacked, according to the FBI, they send the legitimate user to a fake webpage saying the bank website is under maintenance.

    "While the user is experiencing logon issues, malicious actors initiate the unauthorized transfers to commercial accounts held at intermediary banks typically located in New York. Account funds are then transferred to the Chinese economic and trade company bank account," the FBI said.

    Even after the transaction, the criminals continue to cover their tracks -- sometimes, doing the virtual equivalent of swapping out a security camera video, said Boodaei, the Trusteer executive.  They have the ability to temporarily intercept all communication between the customer and the bank, and make the stolen funds undetectable.

    "One feature we've seen is that they can show the target firm their what looks like the correct balance, before the theft, so unless you have another way of checking your balance you won't be able to identify that something suspicious has happened," he said.  "It's part of the way they fly under the radar. ... They are studying victims very carefully, and adjust their attacks based on each firm."

    In one case, according to the FBI, the criminals wiped the hard drive of the computer used in the attack to prevent the firm’s technology department from investigating.

    Behind many of the attacks, according to the FBI, is a notorious Trojan horse program called Zeus, which could be the most lucrative piece of malware ever created.  The software, designed specifically for stealing money from banks, is so powerful that its author was once able to command $3,000 to $4,000 for its sale, according to security firm SecureWorks.

    The anonymous author even baked piracy protection into the software, to ensure that criminal users paid up. 

    Zeus now comes in many forms, but its widespread infection rate makes it a powerful tool for cyber-criminals.  Security firm RSA recently claimed that 88 percent of Fortune 500 companies have at least one workstation infected with Zeus; Boodaei said that 1 in 200 computers on the Internet are infected.

    "The infection rate is usually lower with enterprises than with consumers, but I would guess that any firm with more than 1,000 desktops should expect at least one Zeus infection, if not many more," he said. 

    To show how creative criminals have become with Zeus -- and how powerful the software is -- Trusteer recently described an elaborate Zeus attack that tricks consumers into buying fake investments from a make-believe investment house.  Zeus-infected PCs will substitute banner ads on real news Web sites, including Forbes.com, CNN.com, and ESPN.com, with ads for their investment vehicle, which promise large returns. Clicking on the ad reveals a webpage named URSInvestment.com, in which the news site appears to legitimize the investment.  Ultimately, consumers are asked to wire minimum investments of $1,000, $5,000, or $10,000 to the firm to open an account.

    "With attack code already developed to the point where it can convincingly mimic real websites and trusted brands, it appears criminal groups are bulking up investments in marketing communications to make their scams harder to differentiate from legitimate business offers presented to web users," wrote Trusteer's Amit Klein in a blog post describing the attack.

    Whether the criminals are in China, or simply using Chinese firms to help wring money out of the banking system, Austin said it's important for companies to know how common these kinds of attacks have become.

    "Remember this is one event being reported on with one specific set of circumstances," said Austin. "There is very little risk if they fail. There is no retribution, none of the typical risks associated with robbing a bank. We're seeing that play out with more and more frequency."

    Follow Bob Sullivan on Facebook by clicking here. 

    Comments begin below. Comment anonymously by sending an e-mail to BobSullivan@feedback.msnbc.com

  • Facebook flaw leaked millions of user account access tokens

    Advertisers and other third parties had the potential to gain unauthorized access to many Facebook user accounts and profile information because of a software flaw, Symantec Corp. said Tuesday night.

    Hundreds of thousands of third party applications leaked user account access tokens to advertisers and others during the past several years, Symantec said.  In April alone, when the flaw was found, about 100,000 applications were enabling the leakage, according to the company.

    Facebook was advised of the flaw and fixed it, according to Symantec, but some of the leaked access codes -- called tokens -- might still be stored on log files or in applications, and could be exploited.

    "Concerned Facebook users can change their Facebook passwords to invalidate leaked access tokens," Symantec wrote in a blog post describing the situation. "We estimate that over the years, hundreds of thousands of applications may have inadvertently leaked millions of access tokens to third parties."

    The tokens act like "spare keys," allowing third-party applications to perform certain functions on behalf of users without requiring them to log in each time. When third-party apps are installed, users selectively grant them permission to access profile data. In certain situations, a token can be passed by Facebook to these third-party applications "potentially on purpose and unfortunately very commonly by accident" in the referrer field of Web-based data requests. That data, in turn, can be shared with other third parties.

    In other words, the spare key gets around.

    That would enable third parties to gain unauthorized access to profiles, photographs, and chats, and also enable a malicious attacker to post messages and mine personal information, Symantec said.

    Facebook acknowledged the flaw, but told the Wall Street Journal that it had not been exploited by anyone. 

    "We've conducted a thorough investigation which revealed no evidence of this issue resulting in a user's private information being shared with unauthorized third parties," the firm said, according to the Journal.  No explanation of the investigation was shared.

    The incident is not the first time Facebook has been accused of leaking critical data to third parties.  Last fall, the Wall Street Journal found that many popular apps were transmitting Facebook user ID information to third parties, regardless of user privacy settings.

    The token leakage incident is just the latest reminder that Facebook holds a treasure trove of information about half a billion people, leaving the firm atop a mountain of private data.  The safety and security of so much information stored in one place is inherently suspect.  

    "The repercussions of this access token leakage are seen far and wide," wrote Nishant Doshi, who discovered the flaw with Candid Wueest, in his blog post about the incident.

    Follow Bob Sullivan on Facebook by clicking here. 

  • In college kid v. big companies, small claims court key to big satisfaction

    Christopher Akinyemi

    Christopher Akinyemi hates feeling like a company has taken advantage of him. Like the rest of us, he gets angry at what seems like a constant stream of broken products, ignored warranties, screwed up reservations, endless phone calls and unwanted email.  But unlike most of us, the 22-year-old college student in Indiana puts his anger to good use.

    He takes the culprits to small claims court.

    He's filed a dozen cases in the past few years, and wins nearly all the time.  In 10 of the 12 cases, he said, companies have settled and sent cold, hard cash rather than a team of lawyers to fight him in court.

    "I've stood up for the average Joe since I was 18. I put my foot down," said Akinyemi. "I have a heart for justice in business. ... I'm on a mission to show you don't have to pay a lawyer $225 an hour to get your voice heard."

    For a trivial court fee -- usually $76 in Indiana -- Akinyemi often gets himself settlement checks of $500 or more. He also gets something most of us rarely taste: satisfaction.

    In recent months, he's obtained settlements from companies like Lending Tree, Priceline, Dell, and Hewlett Packard. He's also served as the lead plaintiff in a class-action lawsuit against JP Morgan Chase -- that case was dismissed -- and has taken Bank of America, Hilton Hotels, and Sprint to court since he began his legal flourish in 2009.

    "A lot of people, when they have a problem, wait on the phone and then ask to talk to a supervisor, and they just don't get anywhere. They ask to go higher, but they still are left hanging," he said. “I just try to change things one case at a time. People don’t forget me.”

    Akinyemi took Hewlett Packard to court last year alleging repeated problems with a notebook computer he'd purchased. After several attempts to get the machine fixed or replaced, Akinyemi sued H-P for $1,300, plus $76 in court costs.

    In June of last year, H-P agreed to pay Akinyemi $688 to settle the case, according to court documents he provided to msnbc.com. A Hewlett Packard spokesman declined to comment.

    The H-P settlement also includes a "no future business" agreement, something Akinyemi is getting used to.  Most of his small claims settlements include such a provision, a rather blunt tool by corporations to rid themselves of troublesome consumers.

    "I have one with Bank of America. That means for the rest of my life I can't ever do business with them, even if I live to be 100 years old," said Akinyemi. At this rate, Akinyemi may soon run out of businesses he can work with.

    He sued Priceline earlier this year for $1,076, claiming the company booked a reservation for him with a rental car company that was not honored.

    "I went through hell and high water trying to get that fixed," he said. There were dozens of phone calls between him, Priceline, and the rental company, but he couldn't get satisfaction until he filed suit.  His case was bolstered by extensive telephone call records.

    "I'm very vigilant in these situations," he said.

    In April, Priceline agreed to pay him $219 to settle the case, according to a document he provided. 

    Priceline spokesman Brian Ek declined to comment about the situation.

    The case Akinyemi filed against Lending Tree earlier this year is much more straightforward. He claimed that Lending Tree repeatedly sent him spam. He sued Lending tree for $3,000 -- $500 each for six unwanted messages he documented, the amount allowed under Indiana's spam law.  On April 19, Lending Tree agreed to pay him $500.

    Lending Tree said it couldn't comment on the litigation, or on an individual consumer.

    He also sued Dell Inc. earlier this year for trouble he was having with a Dell Studio XPS laptop he purchased two years.  In April, Dell agreed to pay him $376.

    Akinyemi has lost two cases, but figures an 80 percent success rate is pretty good.  What's the secret to his success? The small claims court justice system gives him something all of us want when we're trying to get satisfaction from a big company -- a person on the other end of the phone who is empowered to solve the problem.

    "When I talk to their attorneys, I try to have a conversation with them.  I'll say, 'You know you've done wrong.  Instead of paying your attorneys $225 to drive to the courthouse, why don't you talk to me right now and settle this?' They usually want to work with me," he said. 

    The settlement amounts aren't enormous -- they won't pay for law school, which Akinyemi hopes to attend when he finishes his degree at Indiana Purdue University in Ft. Wayne in the fall.  But they do make a point -- and they often at least pay for his time and frustration.

    "My mission isn't just to get a settlement check," he said.  "It's to make these companies do right by people. It's a principle."

    Akinyemi got a taste for the ups and downs of the justice system in 2009, when he was accused of assault in Noble County, Ind.  All charges related to the incident were later dropped, his case dismissed, and his $5,000 bail money returned, but his reputation was damaged.

    "A $10,000 retainer (legal fee) ... is what it cost me to prove my innocence, yet I never even got an apology from anyone," he said. 

    At that point, Akinyemi had already signed on as the lead plaintiff in a case against JP Morgan Chase regarding a $100 coupon the firm had mailed to prospective new customers.  Akinyemi alleged that JP Morgan didn't honor the coupons unless consumers followed a list of unclear requirements -- including setting up direct deposit as part of the new account. Days after filing the case, JP Morgan deposited $100 in Akinyemi's account.  The lawsuit was dismissed -- a dismissal affirmed by an appeals court in May of 2009 -- because the court found Akinyemi had suffered no damages.

    He did, however, get a feeling of satisfaction from using the legal system to get the attention of corporate America.  He was soon studying the ins and outs of small claims court, and began filing cases there whenever he felt mistreated by a company.

    "My message to people is that no matter what your age, you don't have to be intimidated," he said.  "In my state, it costs just $76 to file in small claims court, and I know in some places, like California, it's even cheaper.  It's worth every penny, and you get justice. Every consumer should know how to use small claims court."

    RED TAPE WRESTLING TIPS
    It's easier than you think to file small claims court cases -- in some states, you can file them online. That means if your case settles, you never even have to go to court. Here's a good state-by-state list of resources, including how and where to file.

    And here's a very simple set of advice on filing successful cases. In short: Be prepared, be polite and be reasonable.  That'll get you far.

                                COMMENTS BEGIN BELOW
    NOTE: Red Tape comments are aggressively moderated. Readers desire a thoughtful discussion of the issues, and that's what we aim for.  Comments that include inappropriate language, personal attacks on others, or are off-topic will be hidden, and writers risk a ban. To comment, anonymously, E-mail BobSullivan@feedback.msnbc.com.  Your comment will be reviewed and posted by msnbc.com, noting the anonymity request.


    Follow Bob Sullivan on Facebook by clicking here.
     

  • Digging through dirty details of those gadget buy-back programs

    Buying a gadget is beginning to resemble buying a car. You walk into a retailer and as you pull out your wallet, you are pelted with all manner of service plans, extended warranties, and other tack-ons that can double the price.

    The similarity should come as no surprise. Car dealers and electronics retailers both sell products on razor thin margins. Their survival depends on finding a few suckers every day who are willing to overpay for an extended warranty.

    The latest brainchild of cash-hungry electronics retailers is the guaranteed trade-in, with clever names like Best Buy’s “Future Proof Your Technology.” For a relatively small up-front fee, retailers promise to buy back the gadget at a specified price, providing consumers some measure of comfort that they won’t waste their money on ever-upgrading gadgets. The programs tap into perhaps the greatest frustration of tech consumers -- everything they buy is outdated almost immediately, meaning there is never a good time to buy. I call this the Cost of Keeping Up, or COKU, because it drives you cuckoo.  These programs are cleverly crafted to overcome this psychological obstacle to buying a gadget right now.

    It must be going well. Best Buy, which launched its version of the program in January, recently announced it will expand its buy back offerings to a variety of new product categories in May.

    On the surface, buy back guarantees could offer some value to consumers who perpetually like having the newest thing, much like car leases. You buy an $1,000 laptop, pay $70 extra for the buy-back plan, and in 11 1/2 months you bring it back and get $400 toward a new machine.  Sounds like you are spending $70 today to get $400 a year from now.  What could be wrong with that?

    As in many financial arrangements, things are not quite what they seem. Think of this as one big mathematics equation, all gently tilted in the retailer’s favor. For example, you may end up paying sales tax three separate times on the same money if you use a buy-back program.

    If you read a lawsuit that’s been filed against Best Buy by the first company to offer buy- back plans – California-based Tech Forward – you’ll get a whiff of just how systematic the effort is to separate you from your money. 

    Tech Forward offers private label versions of buy-back programs for retailers like WalMart and Radio Shack. It says Best Buy copied its program after initially inviting the company to run a pilot last year. In its lawsuit, Tech Forward asserts that its main intellectual property is years of research into what the firm calls the "exercise rate,” defined as “the percentage of plan holders who actually send in their devices and qualify for a store credit.”  

    In English, that means the number of consumers who pay for the program and get nothing in return.  In order for buy-back programs to be profitable, they require a certain percentage of consumers to pay for nothing.

    The lawsuit also claims that Tech Forward has years of experience(PDF) and a database full of “information on how to profitably influence exercise rate behavior for specific devices.”

    I’m always opposed to consumers entering into complex financial arrangements with companies, which  almost always have the upper hand. They make the rules, they often bend the rules, and you often have better things to do than send in a flurry of letters in triplicate to assert your rights. Of course, there are a few superconsumers who can play the game and win. In this case, an anal-retentive record keeper who plans on buying the latest iPad literally the moment it’s released every year for the next five years might do well in these programs. If you’re not one of those technofreaks, I highly recommend you look elsewhere.

    Why? Here are a few different ways to think about buy-back programs:

    As an insurance product.  Buy-back programs essentially guarantee you a resale value, meaning they act as insurance against loss of value.  As with all insurance programs, they are impossible to really evaluate until there's a substantial number of claims, and we can see how consumer-friendly the claims process is. I can tell you that Best Buy's program includes a mountain of fine print that could turn your good deal into a bad deal very quickly.  The company's provider and underwriter, Chartis Warranty Guard, reserves the right to inspect returned gadgets, something it calls “acceptance testing.”  They are then graded into one of three tiers – “good,” “poor” or “substantially impaired.”  Bring back that laptop 11 1/2 months after purchase in poor condition, and you get only $200.  Bring it back substantially impaired, and you get nothing.  On the surface, that's reasonable, of course.  But guess who makes the determination? Guess what the appeals process is?  Guess who has no leverage in the negotiation?

    Tech Forward has the exact same return inspection strategy. Again, the firm might be magnanimous. Or it might not be.  If you disagree with their decision, you must take your case to binding arbitration before the Better Business Bureau – you will have no option to sue the firm, as that right is waived by signing the terms and conditions.

    As a costly loyalty program.  Remember, you don't get money for your item. If you sign up for a buy-back program at a store, you get a gift card to the store. That means you won't be able to shop around for a new laptop at other places, you'll be forced to buy from Best Buy, Radio Shack, Walmart, or wherever you originally spent the money.  You'll be forced to pay that store’s prices, which might not be the lowest.  With items stuck in Minimum Advertised Price land, and never fluctuate in price, such as Apple's iPad, this is less of a concern. Still, it's never a good idea to give up your free agency as a consumer. What if you have a dispute and want to take your business elsewhere? Why are you paying them to be loyal? 

    NOTE: It is possible to buy a buy-back program directly from Tech Forward, which will issue you a check when you make a claim – that’s an advantage.

    As punishment for the detail disinclined: To get your bounty, you need to have the original receipt and all the other original stuff that came with the gadget -- power cords, manuals, etc.  If anything is missing, your gift card is reduced by the replacement cost of the missing items. If the item gets damaged in shipping, you’re on the hook. If you never quite make it to the UPS store, you’re out of luck.  For those of you that have every receipt from the past two years stored in a safe deposit box, God bless.  The rest of us mere mortals must add into the calculation of the program’s worth the odds that something will go missing before your return date. Those odds lower the value of the program.  So does timing.  Miss the 12-month cut off by one day?  You get $300 instead of $400.  Miss the 24-month anniversary by one day?  You might get nothing. Tech Forward gives users a 30-day grace period, but assesses a late fee of 20 percent of the claim amount. In other words, that $200 payout becomes a $160 payout – (and remember, you probably paid around $40 in the first place for the protection, Tech Forward’s going rate for a $1,000 laptop right now).

    Just as 10 percent of so of gift cards go unredeemed, Best Buy and Tech Forward know some people will screw up and miss out on their payouts entirely. As the lawsuit shows, the firms believe they can even influence those outcomes.  That tilts the math in their favor.

    Triple the sales tax, and maybe income tax -- Other surprises in the fine print might deeply reduce the value of your return.  The gadget return transaction is actually defined as a sale and a transfer of ownership in the contract.  That means sales tax might apply.  Best Buy’s contract, for example, contains this ominous provision: “All sales tax liabilities for your sale of the device (to us) are solely your responsibility.”

    Sales tax rules vary by state. According to Tech Forward, California residents who sell fewer than two personal items per year can be exempt from the tax. Others have to pay.

    Best Buy, in response to an inquiry from msnbc.com, said “most customers will not pay sales tax on the proceeds,” but didn’t elaborate or explain why it includes the sale tax provision in its contracts. The company did say some consumers might have to pay income tax on the buy-back benefits.

    (Tech Forward did not immediately respond to a request for comment)

    While the tax may vary, the only thing that can be said for certain is: You have the tax liability, and they don’t. This means it’s possible you'll be paying sales tax twice on the same transaction – once when you buy the gadget and again when you return it. And, when you use that gift card, you'll have to pay tax on any purchase you make with it, so it's hardly a stretch to say you could be triple-taxed on buy-back purchases.

    To illustrate:

    6/1/2011 – You buy a $1,000 laptop and pay $80 in sales tax.

    5/31/2012 – You return the laptop and get a $400 gift card. You pay $32 in sales tax for that sale.

    5/31/2012 – You buy another $1,000 laptop, paying $80 in sales tax -- $32 of that for using the $400 gift card. 

    TOTAL -- $144 in sales tax

    As a way to really confuse your mobile phone purchase – Best Buy executive George Sherman recently said that buy-back programs were most popular among cell phone buyers. It’s really hard to make the numbers make sense with most phone purchases, because they come with two-year service obligations. Fulfill that two-year contract, and you can’t get a dime back from the insurance.  Return the phone early, and any buy-back payment you receive will be reduced by the early termination fee you’d have to pay.  Again, this is calculus that most consumers shouldn’t even attempt.

    As a great way to give your data to someone else – Best Buy’s contract states expressly that consumers are responsible for cleaning their data off the returned gadget. Most of us are terrible at that.  Forensic experts will tell you the only real way to accomplish a complete wipe – given that deleted data can be restored -- is to take a hammer to your hard drive. But that would void other parts of the buy-back contract.

    Tech Forward says it will do its best to delete your data from gadgets you turn in: “We intend to erase all information on the device using U.S. Department of Defense-grade software overwrite, magnetic degaussing, and/or physically drilling holes in a hard drive before reselling or recycling the device,” the firm says on its website.  But of course, it shoves liability for any lost or stolen information back on the consumer.

    To get lost in other fine print – Tech Forward says it will process payments as quickly as possible, but reserves the right to take 60 days to make a payment.  If you are returning a laptop computer with the intention of upgrading to a new machine – that’s the idea, after all --  you could be without a computer for two months.  That is potentially an inconvenient benefit.

    As part as source of confusion at the point of sale– At the risk of repeating myself, I hate complicated, multi-layered deals. I love simple, neat transactions.  Buy a laptop computer today at Best Buy, and the salesman will hound you into buying an extended warranty, a service plan, buy-back protection and perhaps a pack of gum.  Buy the service plan, and you’ll get half-off the buy-back plan, etc., etc.  Judging by prices offered on Tech Forward’s website, Best Buy’s buy-back prices are excessive anyway.  Just don’t engage in the conversation.  Know what you’re getting for what you’re spending.  If you can’t help but consider this option, you owe it to yourself to visit TechForward’s website to get a quote for comparison purposes before you go shopping.

                               COMMENTS BEGIN BELOW
    NOTE: Red Tape comments are aggressively moderated. Readers desire a thoughtful discussion of the issues, and that's what we aim for.  Comments that include inappropriate language, personal attacks on others, or are off-topic will be hidden, and writers risk a ban.

    TO COMMENT ANONYMOUSLY: E-mail BobSullivan@feedback.msnbc.com.  Your comment will be reviewed and posted by msnbc.com, noting the anonymity request.


    Follow Bob Sullivan on Facebook by clicking here.
     

  • Could a leasing company use your laptop to spy on you?

    A young couple in Wyoming claim that images of them were secretly snapped by a rented laptop's webcam, prompting them to file a lawsuit. NBC's Janet Shamlian reports.

    People who advocate for privacy in the digital age spend a lot of conjuring up hypothetical situations to illustrate how technology could be misused to violate basic human rights.

    They won't have to tax their imagination so much anymore. A new lawsuit suggests consumers who rent computers may be suffering the most dramatic kind of privacy violation.

    Crystal and Brian Byrd, of Casper, Wyo, told TODAY's Janet Shamlian on Thursday that a company that sold them a rent-to-own computer spied on them, using the laptop's Webcam to take pictures of them in their home. The spying came to light when someone who worked at the firm came to their house and tried to repossess the machine.

    The couple is now suing Aaron's, a nationwide chain that rents furniture and other equipment, and the franchisee that rented the machine to them, Aspen Way Enterprises.  A note on the Aaron’s Web site says, "We’re taking this allegation very seriously. We are conducting a thorough investigation and diligently reaching out to our customers to address any of their concerns."

    The couple's lawsuit alleges that pop-up boxes regularly appeared on the rented machine, claiming they needed to "register" software.  Each time that happened, the suit claims, a Webcam image of them was taken without their knowledge, and transmitted to a firm that managed tracking software for the rental company.

    The lawsuit further alleges that law enforcement investigators have been told that other Aaron's customers have been similarly tracked and seeks class action status. 

    Hardware tracking software has been defended in the past as a tool for helping rental companies recover stolen items. The software is chiefly used to ensure lease terms are honored, and allows the rental firm to remotely disable rented machines or put time limits on their use. 

    Brian Byrd, along with his wife Crystal, discusses the spyware they discovered on a rent-to-own laptop, claiming the company  "invaded our house and watched us" after we paid a "ridiculous amount" of money for the computer.

    Designerware LLC, which is also named in the suit for selling the tracking tools to Aspen Way Enterprises, says it encourages rental firms to get signatures from consumers declaring they know they might be tracked.  

    But contract or not, there isn't a person in America who thinks that their rented equipment could do this:

    "I was completely taken aback by all this, to know that they were taking pictures of all  us with webcam in our home, I totally felt invaded," Crystal Byrd told NBC News. "I have used (the computer) in my bra and underwear. I spent a few times checking my grades for school and I'm ready to get into the shower and I'm in my bra and underwear not thinking that anyone is watching me."

    The lawsuit crystalizes the central issue in the ongoing debate about privacy: Powerful software is easy to use, and also very easy to abuse.

    It's common for computer rental firms to place so-called "bricking software" on hardware they lease, said Mark Rasch, former head of the Department of Justice Computer Crime Unit.  If a renter doesn't pay the bill, the computer can be remotely disabled.

    Software powerful enough to remotely control a computer, however, necessarily comes with all sorts of other capabilities -- such as remotely turning on a Web cam.

    "When you have this kind of powerful software, there is an enormous temptation to use it,” said Rasch, now an executive at CyberSecurity and Privacy Consulting in Virginia. “There is often little employee training, and little appreciation of the legality involved." 

    Without gaining express consent of those who are tracked, this kind of remote monitoring would clearly violate federal wiretap laws, the Electronic Communications Privacy Act and probably fraud laws, Rasch said. He stressed that consumers would have to provide "informed consent," which couldn’t be obtained by fine print hidden in a rental agreement.

    "It's hard to invade someone's privacy more than taking pictures inside their home," he said.  

    WHAT YOU SHOULD KNOW

    Even if the Byrd family's situation turns out to be the result of a rogue employee misbehaving, he or she will undoubtedly not be the last one.

    Consumers should know that when computers are rented, it's possible that remote control software is installed and that software could be used to invade your privacy.

    What to look for in the fine print: Designerware told NBC News that it recommends an addendum be added to all lease agreements. It reads, in part: "While you are renting, the computer you are renting has security, locking and tracking software installed on it. If at any time you fail to make your rental/renewal payment, your computer may be locked down and/or electronically tracked and monitored." Language like that is a sure sign that the firm you've rented from has installed powerful software on your machine.

    What to do: No one spites a rental company's right to get paid or recover its equipment. But even a broken rental agreement doesn't force a consumer to forgo his or her right to privacy at home.  If you have any reason to believe tracking software has been placed on a computer in your home, it makes sense to disable the Web cam when not in use. A gently placed piece of electrical tape or a band-aid will do the trick.

    It's much harder to disable other monitoring components -- keylogger software or programs that "phone home" with IP addresses and locations, for example. Doing so would likely be a violation of the lease terms. Still, it's a good idea to install your own anti-virus software to make sure no unauthorized spy programs are on your machine.

    Finally, awareness is key: Understand that a computer leasing company armed with tracking software can learn your whereabouts whenever you are connected to the Internet, and has the ability to know what you are typing and what websites you visit. Behave accordingly. That might mean avoiding laptop leasing agreements altogether.