Why does it matter?

Transcript

1. In Denmark, 10 digits are used to check who you are.
2. On Monday, the government said
3. someone got access to those digits for 8.8 million people.
4. They're called CPR numbers.
5. Denmark has about 6 million residents.
6. Its population register also keeps the dead and people who moved abroad.
7. All together, it holds about 11 million entries.
8. For 8.8 million of them, someone got access to their CPR numbers,
9. and to names and addresses, except where those were protected.
10. They used the access of a small Danish company
11. that had a legal right to search the register.
12. By law, it could only get data on people it had identified in advance.
13. The unusual activity happened in September.
14. The ministry says that in about 10 days,
15. well over 14 million lookups were tried through that company's access,
16. and 8.8 million returned a record.
17. An unusually large bill to the company is what drew attention, it says.
18. The register became aware on Friday evening, 2 October.
19. The company's access has since been stopped.
20. The register's report to Denmark's data protection authority
21. says the lookups were automated,
22. made to identify valid CPR numbers.
23. Police say it is too early to say who is behind it,
24. or how it was done, and no one has been charged.
25. The minister has said the security around this company's access was not good enough.
26. Why does it matter?
27. Look at the number.
28. The first 6 digits are a birth date: the day,
29. the month, and the last 2 digits of the year.
30. The next 4 are a serial number, and the last of those 4 shows the sex on record.
31. For any one birth date, that's at most 10,000 possible numbers.
32. Anyone who knows when someone was born already has most of their number.
33. Yet authorities and companies have used it,
34. with a name and an address, to confirm identity.
35. On Tuesday, the Danish Resilience Agency urged authorities
36. and businesses to base identity checks on something else,
37. like Denmark's digital ID login.
38. An official at the engineers' union said the number is now mostly good for one thing:
39. telling apart people with the same name, like 7 men called Jens Larsen.
40. She no longer sees it as safe proof of who someone is.
41. Can anyone get a new number?
42. The law allows it in special cases.
43. Under the register's own guidance,
44. fear of future misuse is not enough on its own.
45. Asked whether anyone will get one after this,
46. the minister said it is too early to say.