National security implications of weak hotel databases

Stephen,

As you imply, current standards and methods appear to be inneffective and I'd suggest virtually pointless.

I can't escape the conclusion that most of that data shouldn't be there in the first place.

I am regularly offered databases of 'customers', ranging from millions of consumer credit applications through to psychologist's treatment and billing records.

The task of securing all that data in the wild is not worth attempting. Pointless. A fantasy not worh promoting. Most of it is already gone.

Better to not need it in the first place (in the doctor's consulting rooms and hotels too).

The recent decision to re-issue Puerto Rico's birth certificates in response to their attractivenes to organised gangs of dodgy visa providers illustrates other risk. They had mass thefts of birth certificates from schools. When was the last time you had to provide an original or copy of a birth certificate for your child to play a sport for instance? Wouldn't original be more reliable? (Did you pay by card? Where is that stuff kept coach? Can't I prove young Harry Jr is 12 some other way? Do you need to know the name of his birth father?)

Obviously original wouldn't be better unless a little thought was put into the process which might not include the use of cards or paper. Otherwise we face almost infinite risk and an unaceptable limit to efficiency in every exchange of trust.

Simply remove the data from the processes and the stolen ID centered data theft issue will vanish with the un-needed and useless data.

New methods of transacting and identity are required. I'm thinking.

It's not even the large multinational chain you need to worry about.

If you consider even a medium size hotel could have 5,000 visitors per annum, especially in a tourist area. I recall staying at a boutique hotel in Oxford for my daughters graduation, and was interested to note that the Hotel Reservation, Booking, Invoicing system was all Excel-based, and yet the Reception was of course un-manned after 11pm and you just let yourself in, and given the turnover of staff the Password was there on a Post-It - all you needed to do was help yourself at 3am.