NORFOLK, Va. –
Between April and May of this year, the Naval Criminal Investigative Service Norfolk Field Office has received reporting that military members have allowed cigarette marketers in the Norfolk and Virginia Beach areas to scan their Common Access Cards, or CACs, in order to receive free cigarettes. The reporting indicates that Camel Cigarettes, a subsidiary of R.J. Reynolds Tobacco Company, has marketing teams consisting of up to four to five individuals who promote their cigarettes outside of bars and night clubs in the areas on Friday and Saturday nights.
In order to receive two free packs of cigarettes, the marketing team requires the consumer scan an identification card to verify their age and to record information for future mailings. According to the reporting, the marketers can scan driver's licenses and CACs. The reporting indicates that military members have presented their CACs to these marketers at various locations including Peabody's Night club, located at 209 21st St. in Virginia Beach, and recently at the Nazef Hookah Lounge, located at 7734 Hampton Blvd. in Norfolk.
Presenting CACs to be scanned without proper authorization or security measures could compromise the sensitive PKI certificates and PII information embedded in the CAC. Additionally, presenting a CAC to a private vendor could also compromise a service member's date of birth and social security number, which is clearly displayed on CACs and could potentially lead to identity theft. In response to the reporting, NCIS contacted the Virginia Department of Alcoholic Beverage Control who advised that they were aware of cigarette marketers in the area and recommend that cigarette companies utilize ID scanning technology to verify the age of the consumers.
As this new ID scanning technology presents potential operational security and identity theft issues, NCIS recommends the Navy region re-enforce the need for DOD personnel to protect the sensitive information on their CACs, specifically to advise all DOD personnel in the area to refrain from providing their CAC to anyone outside of a government facility.
Editor's note: For more information on CACs, visit http://www.cac.mil/CardInfoSecurity.html.