The recent rash of identity thefts has businesses and government agencies exploring new options for locking down resources and setting policies to prevent easy pilfering.

The problem - the Federal Trade Commission logged 635,000 consumer complaints for fraud and identity theft last year, with 61% for fraud and 39% for identity theft - is reaching critical mass. A growing number of organizations have come forward in the past month or so to acknowledge massive theft of the personal data they hold. SAIC, Bank of America, George Mason University, Boston College, Retail Ventures, the Las Vegas Department of Motor Vehicles and LexisNexis all confessed to security breaches, both high- and low-tech. ChoicePoint, after admitting it unwittingly sold personal data to those involved in identity theft, triggered public outrage and a Capitol Hill inquiry.

"We need to convene a national conference of industry and law enforcement to talk openly about this and what tools are available at our disposal," says Greg Garcia, vice president of information security at Washington, D.C., trade group Information Technology Association of America, which backs the idea of a national law applicable to all "data custodians."

In response the Federal Reserve, in cooperation with other regulatory agencies, last week issued rules that require banks to adopt a risk-based response program to address incidents of unauthorized access to the customer information they electronically hold.

The new rules are contained in an advisory titled "Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice." Jointly issued by the federal government's primary regulatory agencies for banks - which include the Federal Reserve and the Federal Deposit Insurance Corp. - the requirements meet data-privacy and protection guidelines called for in the Gramm-Leach-Bliley Act passed by Congress in 1999.

The rules make clear that banks - though not stock brokers, credit unions, insurance companies or investment firms - must notify customers "as soon as possible" by e-mail or written letter of "an incident of unauthorized access to sensitive customer information," defined as Social Security numbers, accounts and the other detail, according to sources at the Federal Reserve.