(a) 
Fulfilling Requirements of the Red Flags Rule.
Under the red flags rule, every financial institution and creditor is required to establish an identity theft prevention program tailored to its size, complexity, and the nature of its operation. Each program must contain reasonable policies and procedures to:
(1) 
Identify relevant red flags for new and existing covered accounts and incorporate those red flags into the program;
(2) 
Detect red flags that have been incorporated into the program;
(3) 
Respond appropriately to any red flags that are detected to prevent and mitigate identity theft; and
(4) 
Ensure the program is updated periodically, to reflect changes in risks to customers or to the safety and soundness of the creditor from identity theft.
(b) 
Red flags rule definitions used in this program.
(1) 
The red flags rule defines identity theft as “fraud committed using the identifying information of another person” and a red flag as “a pattern, practice, or specific activity that indicates the possible existence of identity theft.”
(2) 
According to the rule, a city is a creditor subject to the rule requirements. The rule defines creditors “to include finance companies, automobile dealers, mortgage brokers, utility companies, and telecommunications companies. Where nonprofit and government entities defer payment for goods or services, they, too, are to be considered creditors.”
(3) 
City accounts held by customers of the city used mostly for personal, family, or household purposes, and that involve multiple payments or transactions are covered by the rule. Under the rule, a covered account is:
(A) 
Any account the city offers or maintains primarily for personal, family or household purposes, that involves multiple payments or transactions; and
(B) 
Any other account the city offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the city from identity theft.
(4) 
Identifying information is defined under the rule as “any name or number that may be used, alone or in conjunction with any other information, to identify a specific person,” including: name, address, telephone number, Social Security number, date of birth, government issued driver’s license or identification number, employer or taxpayer identification number, unique electronic identification number, computer’s internet protocol address, or routing code.”
(Ordinance 1224 adopted 8/4/09)
The city evaluated the effectiveness of its current procedures in identifying, detecting, and responding to identity theft. The city also identified the areas most susceptible to identify theft:
(1) 
New accounts opened in person.
(2) 
Account information accessed in person.
(3) 
Identity theft occurred in the past from someone falsely opening a city account.
(Ordinance 1224 adopted 8/4/09)
In order to identify relevant red flags, the city considers the types of accounts that it offers and maintains, the methods it provides to open its accounts, and the methods it provides to access its accounts. The city identifies the following red flags, in each of the listed categories:
(1) 
Suspicious Documents.
(A) 
Identification document or card that appears to be forged, altered or inauthentic;
(B) 
Identification document or card on which a person’s photograph or physical description is not consistent with the person presenting the document;
(C) 
Other document with information that is not consistent with existing customer information (such as if a person’s signature on a check appears forged); and
(D) 
Application for service that appears to have been altered or forged.
(2) 
Suspicious Personal Identifying Information.
(A) 
Identifying information presented that is inconsistent with other information the customer provides;
(B) 
Identifying information presented that is inconsistent with other sources of information;
(C) 
Identifying information that is inconsistent with information on the customer’s file/account;
(D) 
Identifying information presented that is the same as information shown on other applications or accounts;
(E) 
Identifying information presented that is consistent with fraudulent activity (such as an invalid phone number or fictitious billing address);
(F) 
Identification presented that is the same as one given by another customer; and
(G) 
A person fails to provide complete personal identifying information on an application when reminded to do so (however, by law, Social Security numbers must not be required).
(3) 
Suspicious Account Activity or Unusual Use of Account.
(A) 
Change of address for an account followed by a request to change the account holder’s name;
(B) 
Mail sent to the account holder is repeatedly returned as undeliverable;
(C) 
Notice to the city that a customer is not receiving mail sent by the city;
(D) 
Notice to the city that an account has unauthorized activity; and
(E) 
Breach in the city’s computer system security.
(4) 
Alerts from Others.
Notice to the city from a customer, identity theft victim, law enforcement or other person that it has opened or is maintaining a fraudulent account for a person engaged in identity theft.
(Ordinance 1224 adopted 8/4/09)
(a) 
New Accounts.
In order to detect any of the red flags identified above associated with the opening of a new account, city personnel shall take the following steps to obtain and verify the identity of the person opening the account:
(1) 
Require certain identifying information such as name, residential or business address, principal place of business for an entity, valid driver’s license or other state issued identification;
(2) 
Verify the customer’s identity (for instance, review a driver’s license or other identification card);
(3) 
Review documentation showing the existence of a business entity; and
(4) 
Independently contact the customer.
(b) 
Existing Accounts.
In order to detect any of the red flags identified above for an existing account, city personnel shall take the following steps to monitor transactions with an account:
(1) 
Verify the identification of customers if they request information (in person, via telephone, via facsimile, via email);
(2) 
Verify the validity of requests to change billing addresses; and
(3) 
Verify changes in banking information given for billing and payment purposes.
(Ordinance 1224 adopted 8/4/09)
In the event city personnel detect any identified red flags, such personnel shall take one or more of the following steps, depending on the degree of risk posed by the red flag:
(1) 
Prevent and Mitigate.
(A) 
Continue to monitor an account for evidence of identity theft;
(B) 
Contact the customer and/or property owner;
(C) 
Change any passwords or other security devices that permit access to accounts;
(D) 
Not open a new account;
(E) 
Close an existing account;
(F) 
Reopen an account with a new number;
(G) 
Notify the program administrator for determination of the appropriate step(s) to take;
(H) 
Notify law enforcement; or
(I) 
Determine that no response is warranted under the particular circumstances.
(2) 
Protect Customer Identifying Information.
In order to further prevent the likelihood of identity theft occurring with respect to city accounts, the city shall take the following steps with respect to its internal operating procedures to protect customer identifying information:
(A) 
Only specially identified employees with a legitimate need shall have access to secured areas/cabinets.
(B) 
Files containing personally identifiable information shall be kept in a locked area/cabinet except when an employee is working on the file.
(C) 
Employees shall not leave sensitive papers out on their desks when they are away from their workstations.
(D) 
Access to off-site storage facilities shall be limited to employees with a legitimate business need.
(E) 
Visitors who must enter areas where sensitive files are kept shall be escorted by an employee of the city/department.
(F) 
No visitor shall be given any entry codes or allowed unescorted access to the office.
(G) 
Access to sensitive information shall be controlled using strong passwords. Employees shall choose passwords with a mix of letters, numbers, and characters. Usernames and passwords shall be different. Passwords shall be changed every 90 days.
(H) 
Individual passwords shall not be shared; system passwords shall not be posted near workstations.
(I) 
Password-activated screensavers shall be used to lock employee computers after a period of inactivity.
(J) 
When installing new software, vendor-supplied default passwords shall be changed to a more secure strong password.
(K) 
Sensitive information that is sent to third parties over public networks shall be encrypted.
(L) 
Anti-virus programs shall be run on individual computers and on servers daily.
(M) 
Personal identification information shall not be sent via email.
(N) 
When sensitive data is received or transmitted, secure connections shall be used.
(O) 
Laptop users shall not store sensitive information on their laptops.
(P) 
The computer network shall have a firewall where the laptop user’s network connects to the internet.
(Q) 
Any wireless network in use shall be secured.
(R) 
Before employees are hired who will have access to sensitive data, references and background checks will be performed.
(S) 
New employees shall sign an agreement to follow the company’s confidentiality and security standards for handling sensitive data.
(T) 
Access to customer’s personal identity information shall be limited to employees with a need to know.
(U) 
When an employee leaves or transfers to another department, access to systems and sensitive information shall be immediately disabled.
(V) 
Employees shall be trained on identifying and responding to red flags.
(W) 
Employees shall be alert to attempts at phone phishing.
(X) 
Employees shall be required to notify the program administrator immediately if there is a potential security breach.
(Y) 
Employees who violate security policy shall be subjected to discipline, up to and including dismissal.
(Z) 
Service providers shall notify the employee of any security incidents they experience, even if the incidents may not have led to an actual compromise of the city’s data.
(AA) 
Paper records shall be shredded before being placed into the trash.
(BB) 
Any data storage media shall be disposed of by shredding, punching holes in, or incineration.
(Ordinance 1224 adopted 8/4/09)
The program administrator shall periodically review and update this program to reflect changes in risks to customers and the soundness of the city from identity theft. In doing so, the program administrator shall consider the city’s experiences with identity theft situations, changes in identity theft methods, changes in identity theft detection and prevention methods, and changes in the city’s business arrangements with other entities. After considering these factors, the program administrator shall determine whether changes to the program, including the listing of red flags, are warranted. If warranted, the program administrator shall update the program or present the city council with his or her recommended changes; and the city council will make a determination of whether to accept, modify, or reject those changes to the program.
(Ordinance 1224 adopted 8/4/09)
(a) 
Oversight.
Responsibility for developing, implementing, and updating this program shall lie with an identity theft committee for the city, headed by a program administrator. The program administrator shall be responsible for the program administration, for ensuring appropriate training of city staff on the program, for reviewing any staff reports regarding the detection of red flags and the steps for preventing and mitigating identity theft, for determining which steps of prevention and mitigation should be taken in particular circumstances, and for considering periodic changes to the program.
(b) 
Staff Training and Reports.
City staff responsible for implementing the program shall be trained either by or under the direction of the program administrator in the detection of red flags and the responsive steps to be taken when a red flag is detected.
(c) 
Service Provider Arrangements.
In the event the city engages a service provider to perform an activity in connection with one or more accounts, the city shall take the following steps to ensure the service provider performs its activity in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft.
(1) 
Require, by contract, that service providers have such policies and procedures in place; and
(2) 
Require, by contract, that service providers review the city’s program and report any red flags to the program administrator.
(Ordinance 1224 adopted 8/4/09)