Jaikumar Vijayan of Computerworld was able to see a redacted copy of a letter (Civil Investigative Demand) sent by the FTC to some of the organizations who were found to be leaking information via P2P networks:
It showed the agency is seeking information, dating back to mid-2007, on a wide-range of technology and process-related topics.
For instance, the FTC is asking for detailed information on the types of personal information being collected by the company, the purpose for which it is being used, and how the data is collected, shared and stored.
The letter seeks “detailed descriptions” on how the company compiles, maintains and stores personal information, as well as “high-level diagrams setting out the flow paths” of personal information from source to the point of use.
The company is also required to identify by name, location and operating system every computer that is used to collect and store personal information. In addition, it is required to provide a “narrative” or a blueprint that describes network components in minute detail, down to individual firewalls and routers, and even database tables and field names containing personal data.
The FTC is also requiring any information the company has about its knowledge of the data leaks. The details sought include who knew about the breaches, when, what attempts the company made to inform affected individuals, and why P2P software was allowed to be installed on a company system.
Read more on Computerworld.
Since these are “non-public” investigations, I’m not sure how much we’ll eventually find out, but these investigations and any actions may become a ‘cautionary tale’ for entities that still allow P2P on their networks or allow employees to transfer data to be taken home and used on computers that may have P2P software on them.