Double Eleven is coming, and it will usher in a "big explosion" in the number of express delivery. Nowadays, express delivery has played an indispensable role in people's lives, but express delivery sheets printed with personal information such as consumers' names, addresses, and telephone numbers are being sold in bulk. In this gray industry, express delivery sheets are called "materials", and some buyers and sellers frequently change contact information to avoid being reported, and use social tools with better confidentiality.
Last year, the national express delivery business volume completed 83.3 billion pieces, and the national annual express delivery business volume will soon exceed the 100 billion piece mark. Huge amounts of privacy information, where to go?
The courier face list ranges from 1.5 to 5 yuan, and buyers and sellers are very vigilant
In the tieba related to express delivery, there are a large number of buyers and sellers of express face sheet information. In this industry, there is already a mature set of network black words. The purchase of face sheet information, called "receiving" and "receiving vegetables", printed with the user's personal information of the face sheet is bought and sold at will. There is also a "chain of contempt" in different face sheets, real-time, same-day face lists are better than historical face sheets, and consumer goods such as mother and baby, skin care, women's clothing, and alcohol are more popular. Noodle sheets that do not classify are called "mixtures". The face sheet of delivery is divided into two forms: face sheet photo and document. In order to avoid the discovery of the platform, buyers and sellers also like to use initials and homophones to replace the word "face sheet", such as: KD (express face sheet), MD (face sheet), "face to face", "face bearer" and so on.
On October 26, a landlord named "Pattern" posted that the strength of the dish, direct docking of the first-hand studio, real-time, historical, large, classification priority. On October 25, a netizen named "Collecting Noodles from Time to Time" said: Find express delivery salesmen, receiving drivers, cloud warehouse bosses, cloud warehouse staff, cloud warehouse management, a large number of face D, history, private chat.
There are also many sellers who advertise in Tieba Bar. On October 24, netizens "Lemon Nine 1213" said that there are high-quality women's clothing (face sheet) documents, and private chats are wanted. This industry is also full of mutual pits of "own people". Someone posted the seller's account and shared his experience of being cheated on selling materials: "This person is a liar. More than a thousand (noodle sheets), yesterday only 500 can be used, I said it is a mixture. Someone commented: "Why don't you look for me?" "This guy is in our group too."
The reporter added several buyers who "received" as couriers.
"Have something to lose?"
"Send a sample to see how many can be in a day?"
"Five dollars a piece."
"Mother and baby, makeup."
"What platform? When? Do you know the name of the store? ”
From these buyers, the reporter learned that the receiving price varies, some 1.5 yuan, some 4 yuan, some 5 yuan. Regardless of the price, almost all buyers ask to see the sample first because it is "tested". Many buyers will directly put forward the requirements of the category, among which the face sheets of maternal and infant, beauty, liquor and other categories are the most "sought-after". There are also sellers who only want a single photo of the day, not a text. The reporter noted that the two parties who buy and sell the face sheet information are often very cautious, and they prefer to use the social platform "bat" for trading. The reporter adds the seller through the bat, and the other party often initiates the "two-way withdrawal of chat history" function after passing the verification, which can clear all chat records in an instant. In addition, if you want to preserve evidence by taking screenshots, a "You took a screenshot" prompt will appear on the chat page. In fact, after the reporter took a screenshot, the other party withdrew all the messages.
Sellers sell user information in real time, and female consumer groups are regarded as "good cheats"
In a group of buyers, after 5 p.m., sellers who sell real-time, same-day face orders will be particularly active. At this time, the courier will generally start to collect the package, the electronic face sheet information is stored on the work computer or printed out and pasted on the package, and the leaked user information also begins to circulate layer by layer in the underground market. This means that the user's information is sold on the same day.
The reporter obtained a copy of the face sheet from a seller who specialized in selling liquor express face sheets. In the text, the user's name, specific address, telephone number, courier number, and the name of the purchased product are readily available. The seller told reporters that the face list is a customer who buys wine, and can directly use the single number to query to test whether the face list is true. The reporter randomly selected a customer's order number for inquiry, and indeed can query the dynamics of the order.
Advertising harassment, telecommunications fraud... What the outgoing courier bill number will be used for is unsettling. The courier number not only involves personal information, the purchase of goods categories leaks the user's consumer demand, and criminals pay close attention to the consumer groups of mothers and babies and beauty products, which is worrying. According to "industry insiders", the "conversion rate" of maternal and infant noodle lists is high, which is "good deception" to put it bluntly.
The "invisible face sheet" cannot cure the leakage of express delivery information
In a case pronounced by the Nanshan District People's Court of Shenzhen in July 2016, it was shown that a courier employee colluded with others to steal more than 100,000 pieces of personal information from customers in half a year from the second half of 2014 to about July 2015 by downloading software in batches.
In October 2019, a logistics company in Shanghai found that someone was peddling its company's express delivery data on telegram, and the company's employees tried to buy 36 pieces of data from each other, and the comparison found that the data was real and valid.
A courier face sheet contains the vast majority of the user's private information, how to ensure security?
Not long ago, as a special event of the 2021 National Cyber Security Publicity Week, the Delivery Industry Cyber Security Summit was held in Shanghai, where express logistics companies gathered. At the summit, Song Zhuoya, senior director of the Information Security Center of Debon Company, said that at present, criminals are clearly marking and selling personal privacy information on the "dark web", causing losses of hundreds of billions of yuan per year, and the delivery industry is the hardest hit area.
Zeng Bihan, director of logistics technology digital business of Cainiao Company, said: "We look forward to the recipient's real mobile phone number being converted into a virtual mobile phone number (which can be called and texted) printed on the face sheet through technical means to protect the privacy and security of the recipient." ”
Fu Mingming, chief information security officer of ZTO, believes that in the face of these security challenges and risks, ZTO is exploring "zero trust" solutions, that is, "continuous verification, never trust".
However, from the current investigation, the information leakage of the express delivery face sheet is still a long way to go, and the user's information is still "naked".
Some express delivery companies have also made many attempts, such as the introduction of "invisible face sheets", and the sender information on the express face sheet is replaced by a number. But this is only the "first lock", and insiders in the express delivery industry who can enter the system can still obtain user information. In fact, most personal information breaches occur within the enterprise. Previously, a courier company found through internal investigation that front-line outlet personnel sold customer personal information to a courier of the same company for 2 years, a total of more than 4,000 pieces. There is also a courier company of a number of customers received fraudulent calls, after the company's investigation, a company's employee in a month in a large number of query customer records up to more than 20,000, and many times used other people's accounts to query information.
Lawyer: Couriers sell user information, and enterprises may face administrative penalties
Regarding the issue of privacy leakage, Peng Zhen, member of the Standing Committee of the Consumer Rights and Interests Protection Committee of Hunan Province and head of the legal group, told reporters that leaking and selling users' express delivery information infringes on the personal information rights and privacy rights of users/consumers, and violates the "Personal Information Protection Law", "Consumer Rights and Interests Protection Law", "Criminal Law", "Postal Law", "Interim Regulations on Express Delivery" and other laws and administrative regulations.
Peng Zhen said that if the sale of user express delivery information is an insider in the express delivery industry, such as couriers, cloud warehouse administrators, etc., the express delivery company should immediately take remedial measures and report to the postal administration, and consumers should stop infringing, eliminate the impact, apologize, and compensate for losses, in addition to the above responsibilities, they may also face administrative penalties, and if they constitute a crime, they will bear criminal liability. Article 69 of the Personal Information Protection Law stipulates that where the handling of personal information infringes upon the rights and interests of personal information and causes damages, and the personal information processor cannot prove that he is not at fault, he shall bear tort liability such as damages. The liability for damages provided for in the preceding paragraph shall be determined on the basis of the losses suffered by the individual as a result or the benefits obtained by the personal information processor as a result; where the losses suffered by the individual as a result and the benefits obtained by the personal information processor as a result are difficult to determine, the amount of compensation shall be determined on the basis of the actual circumstances. The Interim Regulations on Express Delivery stipulate that enterprises engaged in express delivery business shall establish a management system for express waybills and electronic data, properly keep electronic data such as user information, periodically destroy express delivery waybills, and adopt effective technical means to ensure the security of user information.
Xiaoxiang Morning News reporter Li Shu