The Data Accountability and Trust Act (DATA)

An anonymous reader writes "The U.S. House of Representatives will soon be considering the Data Accountability and Trust Act (DATA). If passed it would require all companies to inform customers of security breaches that affect their personal data. The bill requires consumers to be told if their privacy has been violated because of a breach. Under the proposals, if a breach does occur, a company must notify any customers concerned and the FTC, which can then demand an audit."

Comments

Long Overdue

[TripMaster Monkey]

It's about time a law like this was enacted.

On the average, I tend towards favoring less legislation, rather than more, but the simple fact is since it is not in the companies' best interests to disclose information about security failures, it can't be too much of a shock when they decide not to. This law is necessary to safeguard the information that citizens entrust to these companies, and given how inextricably our society is intertwined with the digital realm in this day and age, it's way overdue.

Re:Long Overdue

[xusr]

I agree wholeheartedly. This is the sort of thing that can and should have legislation attached to it, something that will (if enforced) actually benefit its citizens. Legal overhead is going to increase, but I guess that is the price we pay for increased legal traffic. Now if only there were some realistic decline in petty lawsuits...

you can't legislate morality.

Re:Long Overdue

[drewzhrodague]

It should be implied as interpreted through our Constitution, and amendments, etc. We can't publish sensitive data from a major corporation on the Internet, or we would get sued. It should be easier for class-actions to occur -- what I mean to say, is that it should be the job of the FTC to ensure the validity of businesses, and make sure they aren't raping the populace. That being said, it should be implied, understood, and common practice to prevent big business from doing some of the things that they should be doing in the first place (privacy violations, overcharging, bastardly interest rates, etc).

What I'm expecting of this DATA bill, is that it makes it look like something is being done, but actually shields corporations from being accountable -- just like the CAN SPAM act allows SPAMmers to SPAM, without actually doing anything to stop SPAM. Ballot boxes aren't working so well. What's the next box to use?

Re:Long Overdue

[somersault]

"you can't legislate morality"

it's probably worth a try =p now define morality

Re:Long Overdue

[Anonymous Coward]

Fear not! If the data is "encrypted", they don't have to do anything!

From H.R. 4127

(1) BREACH OF SECURITY- The term `breach of security' means the unauthorized acquisition of data in electronic form containing personal information that establishes a reasonable basis to conclude that there is a significant risk of identity theft to the individual to whom the personal information relates. The encryption of such data, combined with appropriate safeguards of the keys necessary to enable decryption of such data, shall establish a presumption that no such reasonable basis exists. Any such presumption may be rebutted by facts demonstrating that the method of encryption has been or is likely to be compromised.

(4) ENCRYPTION- The term `encryption' means the protection of data in electronic form in storage or in transit using an encryption algorithm implemented within a validated cryptographic module that has been approved by the National Institute of Standards and Technology or another comparable standards body recognized by the Commission, rendering such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data. Such encryption must include appropriate management and safeguards of such keys to protect the integrity of the encryption.

Re:Long Overdue

[amliebsch]

It should be implied as interpreted through our Constitution, and amendments, etc.

What? How? You can't just pretend those documents say something they don't. Well, you shouldn't.

We can't publish sensitive data from a major corporation on the Internet, or we would get sued.

What makes you think that?That being said, it should be implied, understood, and common practice to prevent big business from doing some of the things that they should be doing in the first place (privacy violations, overcharging, bastardly interest rates, etc).

What is the advantage to having regulation be "implied, understood, and common practice" as opposed to clearly spelling it out in statute?

Re:Long Overdue

[TubeSteak]

This is going to lead to a certain amount of data hysteria once it gets passed.

Since most people don't know that shit like this happens on a regular basis, once it starts getting reported regularly, the news media is going to pick up and run with it.

"Your information is unsafe" will become a new media theme, along with "kids shooting up schools", "female teachers sleeping with students" and "pretty white girl goes missing".

BTW - businesses cannot go around redefining "breach" or "personal information", because the bill defines exactly what those are.

If you read the text of the bill they've dodged out on specifying some of the trickier parts by using language like "Not later than 270 days after the date of enactment of this Act" to require the definition of certain aspects of the bill. Very poor idea, as it gives the lobbyists something to aim at weakening.

It's sponsored by a Republican from Florida and co-sponsored by a stack of other R's. Good idea, possibly poor implementation.

Re:Long Overdue

[cayenne8]

I think a MUCH better law, would be to legislate that one's personal data belongs to THEM, and that any company has to ask permission to house such, and MUST request permission to sell personal data or offer it for sale at all.

If you could enforce personal data privacy, a great deal of this industry of gathering and selling personal data would dry up...and therefore there would be less personal data spread all over the spectrum with dubious security protecting it.

Re:Long Overdue

[coleblak]

Reminds me of a quote. I forget from where. "If you have to write down your morals, you've already lost." (paraphrase, been a long time since I read the quote) Morals get thrown by the wayside when it comes to money.

Re:Long Overdue

[JayBlalock]

Since most people don't know that shit like this happens on a regular basis, once it starts getting reported regularly, the news media is going to pick up and run with it.

GOOD!

You say that like it's a bad thing. People NEED to be aware of this.

Re:Long Overdue

[drewzhrodague]

No, seriously, and a good question. Like the GP posted, there shouldn't be more laws, but less. Our government should be a small shop, not the country's largest employer. The same law that prevents me from spying on my neighbor, and collecting information about him, should protect me from privacy abuses from major corporations (times the number of people they do this to). We don't need a special law to prevent this, it should already be in-place. The problem, as I see it, is that it is not enforced, because the corporations have better lawyers -- that should not be allowed -- by default.

Re:Long Overdue

[Hrodvitnir]

Since most people don't know that shit like this happens on a regular basis, once it starts getting reported regularly, the news media is going to pick up and run with it.

Don't worry, after a couple months it will become such a beaten dead horse, everyone will think "Oh, this stuff happens all the time. My chances of having my identity stolen are next to nil." And the notice gets tossed in the trash never to be worried about again.

Re:Long Overdue

[amliebsch]

The same law that prevents me from spying on my neighbor, and collecting information about him

But what law would that be? I am not aware of laws that prohibit you from logging what your neighbor does, or watching him from your property. You can't trespass on his property of course, or steal his garbage - but what law prevents you from tracking all information he allows to flow onto your property?

Re:Long Overdue

[Philip K Dickhead]

What is LOOONNnnggg overdue is the use of "GNU"-style recursive names in government.

How about naming the country USANUS - "the United States Are Not United States"? :-)

Re:Long Overdue

[virtualchoirboy]

The part that scares me the most is:

reasonable basis to conclude that there is a significant risk

Since when is business EVER reasonable about anything?

I wish I could say I was joking, but think about it for a second. Vague language like this leaves it up to each individual company to determine whether or not they want to report. And given the media thrashing from any expected report, you can safely guess (never assume) that my/your definition of reasonable and the corporate definition of reasonable will be separated by a small gap roughly the size of the Pacific Ocean.

Re:Long Overdue

[virtualchoirboy]

You know, looking at my reply, I have to say "ditto" about the word significant too.

I guess the real answer to all of this is BOHICA: Bend Over, Here It Comes Again.

Re:Long Overdue

[tezza]

You said: I think a MUCH better law, would be to legislate that one's personal data belongs to THEM,

Thighter definition is required than what you propose. I admire your sentiment, I really do. But it will never fit into law.

Look at patent law. The idea of "An Invention" is left undefined in the law. And this leads to a lot of scope creep.

If the law was defined as you mentioned, where do you draw the boundary of "Personal Data"?

e.g.:
Eye Colour
Retina Pattern
A fingerprint
A fingerprint and the finger it comes from
Your first name
Your full name

You can bet your last pence that Direct Marketers would start the scope creep to etch away at what would be considered Personal Data, and you will end up with those fuckwits STILL protected by law and still unaccountable.

Re:Long Overdue

[plague3106]

What? How? You can't just pretend those documents say something they don't. Well, you shouldn't.

I believe the 6th amendment's intent is pretty clear, even just going by the wording of it. I also don't think you should read the Constitution or its amendments in a vacuum; you should know the context from which they came about.

Personally I don't know why corporations can override your rights anyway; the government can't take away your right to bear arms, but an apartment building owner can?

What makes you think that?

You don't think Coca Cola would sue if its formula were posted on the web?

What is the advantage to having regulation be "implied, understood, and common practice" as opposed to clearly spelling it out in statute?

What is the advantage to having to spell out every possible thing you can do that is 'wrong'? One advantage to thinking rationally about the purpose or intent of a law is that you don't end up criminalizing everything in your attempt to spell it all out.

Even the most carefully written legislation can be interperated differently by different people. By the way, we currently DO try to spell out everything, and look what its gotten us; so many laws noboday can say for certain they haven't violated one.

Re:Long Overdue

[plague3106]

You can't trespass on his property of course, or steal his garbage

Actually you can take his garbage, once its out for pickup. And if you can't trespass on another's property, why do so many come onto my and leave their trash (deliver menus, polictial flyers, etc).

Re:Long Overdue

[MetricT]

I don't think the government should have to levy fines against violaters. By simply forcing companies to announce security violations, Adam Smith's invisible hand will make poor security a competitive disadvantage to those possesing it.

Re:Long Overdue

[AvitarX]

best post ever!!!

I wish I had mods when it wasn't April 1st

Re:Long Overdue

[_Sharp'r_]

It's sponsored by a Republican from Florida and co-sponsored by a stack of other R's.

Those damn Republicans, trying to protect your private data. What will they think of next?

Re:Long Overdue

[amliebsch]

I believe the 6th amendment's intent is pretty clear, even just going by the wording of it. I also don't think you should read the Constitution or its amendments in a vacuum; you should know the context from which they came about.

In all criminal prosecutions, the accused shall enjoy the right to a speedy and public trial, by an impartial jury of the State and district wherein the crime shall have been committed, which district shall have been previously ascertained by law, and to be informed of the nature and cause of the accusation; to be confronted with the witnesses against him; to have compulsory process for obtaining witnesses in his favor, and to have the Assistance of Counsel for his defence.

OK...and the context was displeasure at having these things done to colonists by the mother country. Honestly, I fail to find any relevance here whatsoever. Be a pal and spell it out for me.

You don't think Coca Cola would sue if its formula were posted on the web?

They could sue the leaker, assuming that s/he was under NDA or held the trade secret under confidence. But once the secret is out, there is little they could do to prevent people from disseminating it. That's why they guard it so carefully. Similarly, if I tell somebody a secret, and they blab it to the press, I can go after my friend but I can't stop it from being published.

What is the advantage to having to spell out every possible thing you can do that is 'wrong'?

There are many advantages, such as the potential to know the law in advance, to reasonably ascertain its limits, to have input into its formation, to promote fairness in application, to prevent unauthorized expansion. and most of all, so that elected representatives can know precisely what it is they are voting for, thus putting power in the hands of elected legislators, not appointed judges. Whether there are in fact too many rules and regulations is a completely separate issue.

Re:Long Overdue

[nadamsieee]

If you really want to test the waters, put up a no-trespassing and a no soliciting sign, and then do the American thing: SUE!!!!

Re:Long Overdue

[Zordak]

You can't just pretend those documents say something they don't.

You've obviously never met Justices Blackmun, Breyer and Marshall.

Re:Long Overdue

[Zordak]

Personally I don't know why corporations can override your rights anyway; the government can't take away your right to bear arms, but an apartment building owner can?

Your state government sure can. The 2nd Amendment has never been applied to States -- only to the federal government. And you can contract away that right in consideration for a place to live. Just like you can sign an NDA and contract away part of your free speech in consideration for a job.

By the way, the Framers of the Constitution were not trying to legislate. They were creating a structure for government. That's why they included a means for passing legislation. They did not think it prudent to deal with every little detail in the Constitution.

Re:Long Overdue

[Shajenko42]

All this will accomplish is making sure that every single contract any company makes with an individual includes the right to do whatever the company wants with all of your personal information.

Re:Long Overdue

[digitalunity]

How is this flamebait? The trademark holders have specifically requested that spam be referred to in lowercase characters to differentiate it from SPAM(R), the spiced ham food product. The parent is correct.

Re:Long Overdue

[Curien]

The hand's already half-tied. Corporations are special treatment from the government in exchange for additional rules and regulations. This is simply the price of government-protected limited liability.

Don't want to follow it? Don't incorporate.

well...

[Foobar of Borg]

It's certainly about time they did something. But, I'm sure loopholes will easily be found as soon as the campaign contributions start rolling in. Also, I assume everyone noticed the acronymn. It reminds me of Gnus Not Unix.

The gov

[KiloByte]

Does this law apply if my privacy is violated due to a breach of law done by a government agency?

Oh, wait...

Re:The gov

[bubbasatan]

Apparently, there was a recent security breach relating to a computer housing data from one of the retirement programs in the state of Georgia. Data was stolen, including names, SSNs, banking info, etc, and the state sent a form letter with applications for retrieving credit scores. Although this isn't quite the same as what you are saying, it is a breach that occurred on the government's watch. Do government agencies have the same notification duties as companies under this new legislation? Who holds government accountable when their data security is inadequate and/or fails?

Across corporate America

[tropicdog]

I predict that the definition of "breach" is being redefined in boardrooms across the land. If it doesn't meet the new definition, they won't have to report it. Same old song and dance.

Re:Across corporate America

[will_die]

They better in order to meet the definition of the bill which is

The term `breach of security' means the unauthorized acquisition of data in electronic form containing personal information that establishes a reasonable basis to conclude that there is a significant risk of identity theft to the individual to whom the personal information relates. The encryption of such data, combined with appropriate safeguards of the keys necessary to enable decryption of such data, shall establish a presumption that no such reasonable basis exists. Any such presumption may be rebutted by facts demonstrating that the method of encryption has been or is likely to be compromised.

The main problem is that this will effect almost every company that does business on the internet using credit card. Since companies that are effected by this in addition to your first and last name only have to have one of the following items:
1) Social Security number.
2) Driver's license number or other State identification number.
3) Financial account number, or credit or debit card number, and any required security code, access code, or password that is necessary to permit access to an individual's financial account.

Since most companies store your credit card number for a period of time to verify purchases and to just make it easy for you to purchase that is a far reaching bill.

Social Security Number

[IflyRC]

So, does this mean Equifax is required by law to tell me someone else is using my social security number?

Re:Social Security Number

[InfiniteWisdom]

Only if they are the place an unauthorized person got your SSN from

wtf

[Thaelon]

How the hell would you know if this law was ever broken if they don't tell anyone?

Re:wtf

[hnile_jablko]

How the hell would you know if this law was ever broken if they don't tell anyone? It will be a slow process. It will begin with letters in the mail, then bad credit reports, followed by repossessing of your things and finally you will be brought to trial for credit card fraud while some fat Russian dude wearing your new armani suit, has s@x with your new Czech super-model girlfriend under an olive tree in your recenlty purchased tuscan vineyard while. Of course, it wont be till some time after Bubba has had his way with you that laws catch up to free you. Tesim sa.

Re:So how much is this going to cost?

[Theatetus]

You work for ChoicePoint or something?

Why the hell do people bristle so much at corporate regulation? A corporation is chartered by the state; it's not like you have some God-given right to run whatever business organization you want in whatever way you want without somebody watching what you do.

FTC?

[saden1]

Why the god damn FTC? They are a worthless bunch idiots, not that congress isn't full of those.

Re:FTC?

[koweja]

Because, incompetent or not, it's their job.

Re:So how much is this going to cost?

[koweja]

Well, what would you prefer? That we rely on companies to admit that they screwed up?

It won't pass.

[Pig Hogger]

Such a law won't pass. It't too anti-business.

Recursion

[jargoone]

Now the government is using recursive acronyms? I thought that the FSF had a patent on that...

Re:Recursion

[koweja]

That's because it's not recursive.

The first word in the name "Data Accountability and Trust Act" is not an acronym.

Exemption...

[Olmy's Jart]

But it's got a gotcha. There's an exemption if they encrypt their data - even if the encryption is lame or broken. If they encrypted their data, they don't have to notify anyone. That's a loophole to drive a world class semi through. And there are fears that it will superceed laws like those in some states, such as California, which have no such exemption.

Re:Exemption...

[Anonymous Brave Guy]

If they took reasonable care to encrypt their data effectively then I wouldn't object to that provision. However, if all they have to do is have their database engineers ROT13 all the names, this sounds like the gotcha where the new act actually improves things for businesses, as an earlier poster predicted.

Re:Exemption...

[mopslik]

There's an exemption if they encrypt their data.

Well there you go, then. Just encrypt your data using ROT-13. Twice.

Re:Exemption...

[Billosaur]

But it's got a gotcha. There's an exemption if they encrypt their data - even if the encryption is lame or broken. If they encrypted their data, they don't have to notify anyone. That's a loophole to drive a world class semi through. And there are fears that it will superceed laws like those in some states, such as California, which have no such exemption.

Even if the encryption isn't lame or broken, it's still data out there on the loose. How long would it take to crack, given all the available information on encryption? There are precious few "uncrackable" encryption schemes and I doubt most major corporations are going to go to those lengths to protect data. From what I've seen behind the scenes, most will use tricks and simple algorithms, figuring it makes the data "mostly" secure.

Re:Exemption...

[p43751]

Now we really need to read the fine print. Would it be enough if we encrypt the disk, or even folder? Thats encryption....

Re:Exemption...

[amliebsch]

There's an exemption if they encrypt their data - even if the encryption is lame or broken.

It doesn't say that! Stop making stuff up.

The term `encryption' means the protection of data in electronic form in storage or in transit using an encryption algorithm implemented within a validated cryptographic module that has been approved by the National Institute of Standards and Technology or another comparable standards body recognized by the Commission, rendering such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data. Such encryption must include appropriate management and safeguards of such keys to protect the integrity of the encryption.

Now perhaps there are encryption algorithms approved by the NIST that you feel are not sufficiently strong - though you haven't given any examples - but to claim that you can use any old encryption algorithm is FUD, pure and simple.

Re:Exemption...

[finkployd]

(4) ENCRYPTION- The term `encryption' means the protection of data in electronic form in storage or in transit using an encryption algorithm implemented within a validated cryptographic module that has been approved by the National Institute of Standards and Technology or another comparable standards body recognized by the Commission, rendering such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data. Such encryption must include appropriate management and safeguards of such keys to protect the integrity of the encryption.

So at least that rules out ROT13 as a bunch of wise-ass replies here propose. However the safeguards they mention regarding protecting the key (a much larger concern that the specific cryptography used imho) require some kind of auditing. Who is going to be doing that? Or are we just going to take a companies word for it that they are following proper security procedures? If that were the case we would not need this law at all would we?

Finkployd

Re:Exemption...

[netruner]

This also fails to address the threat of an inside job. It doesn't matter how well encrypted your data is if the bad guy has the keys.

I think that what needs to happen is for someone to do a complete analysis of why having data hordes is dangerous - is it because it's inherently dangerous for someone to know too much about you or is it because anyone who appears to know too much about you is assumed to "be" you by money lenders, law enforcement, etc?

Re:Exemption...

[Olmy's Jart]

To give you an example... Some examples taken from WiFi for illustration... WPA is suppose to be better than WEP. It uses better hardened cryptography, such as would be approved here. It can use AES (WPA2 mandates support for it) and it uses TKIP. But... WPA-PSK is abysmally weak. Capture 4 packets of the WPA-PSK handshake (which you can force) and you can then do an off-line brute-force attack on the pre-shared key. If that PSK/passphrase is less than, say, about 24 charracters, you can break it. Even though it utilizes better, stronger, cryptography and cryptographic modules, the overall design (for PSK at least) is weak and can be broken easier than WEP (WPA-LEAP is also very VERY bad)! Would it meet the expectation that it could be compromised? It depends on the strength of the passphrase.

My point is that "strong cryptography" is not enough. Strong algorithms can be used but the system can still be quite weak. "Lame or broken" is meant for the broader landscape. WEP used RC4, which is pretty strong (128 bit). But the overall design left it open to XOR attacks and key scheduling attacks and the IV's were a joke. Implementations of a bad design made it even worse. Some idiot vendors left the initialization vectors a constant in their products or used simple IV generation that reused IVs improperly.

So there's two examples of hardened cryptography, AES and RC4, that resulted in weak systems due to the over all design, WEP and WPA-PSK. You can add the Cisco LEAP and WPA-LEAP into that mix, if you wish, but that's not that common.

Not too long ago, a USB key manufacturer had a provision for encrypting the data on the key but then left the key were it could be recovered (a fact that the owner would have been unaware of). The crypto was strong but the implementation was lame. Do you get a "get out of notification free" card just because you didn't know or think the data could be compromised because of some developer who didn't know what he was doing when he implemented the system (even with strong modules)?

What about theft of data from a running system? I've got ways of encrypting my entire laptop with AES 256, including the boot information, using Linux and booting from a USB key. That meets the definitions for recognized strong mudules and algorithms. But, what if someone breaks into the system electronically when the system is running and the drives are "unlocked"? Game over... Do I still get the exemption then? It would seem not, based on the expectation of compromise and the "safeguards", but it's not clear.

The notification should still be required and you can let them know how well you protected their data with encryption and let them judge.

Re:Exemption...

[zaguar]

But... WPA-PSK is abysmally weak

Sorry, but that is pure FUD. WPA-PSK is not "abysmally weak". WEP is "abysmally weak". You cannot, in any reasonable length of time, brute force a WPA-PSK key of length any more than 8 characters, especially if they are numbers, capital letters, symbols etc. Heres a hint, go to this password generator, get a key, and you are safe, despite using the ""abysmally weak" WPA-PSK. Do you want to brute-force that? Your 24 character limit is bogus. Try it yourself, make a WPA passphrase, and try brute-forcing it. Just try. Even a simple password, just letters, will NOT be brute forced.

Re:Exemption...

[Thundersnatch]

Almost all recent encryption software support at least AES-128, so the algorithms are rock-solid. "Tricks and simple algorithms" aren't the problem.

The problem is encryption key management. Where do you store that AES key? Obfusacated in a binary? In your backup scripts using permissions to prevent unauthorized access?

I do best I can and use public-key encryption for encrypting backup data (OpenPGP), with the secret keys escrowed offline. But this doesn't work for "live" data that needs encryption. The secret key (whether symmetric or an RSA/DH/ECC private key) has to be available to the encrypting/decrypting application in some form.

This is one area where a ubiquitous hardware technology like the TPM would actually help protect privacy.

Re:Exemption...

[Olmy's Jart]

Maybe a little more research is in order here...

http://www.linuxjournal.com/article/8312

From that article:

In November 2003, Robert Moskowitz, a senior technical director at ICSA Labs (part of TruSecure) released "Weakness in Passphrase Choice in WPA Interface". In this paper, Moskowitz described a straightforward formula that would reveal the passphrase by performing a dictionary attack against WPA-PSK networks. This weakness is based on the fact that the pairwise master key (PMK) is derived from the combination of the passphrase, SSID, length of the SSID and nonces. The concatenated string of this information is hashed 4,096 times to generate a 256-bit value and combine with nonce values. The information required to create and verify the session key is broadcast with normal traffic and is readily obtainable; the challenge then becomes the reconstruction of the original values. Moskowitz explains that the pairwise transient key (PTK) is a keyed-HMAC function based on the PMK; by capturing the four-way authentication handshake, the attacker has the data required to subject the passphrase to a dictionary attack. According to Moskowitz, "a key generated from a passphrase of less than about 20 characters is unlikely to deter attacks."

Reread that last sentence...

Robert's article can be found here:

http://wifinetnews.com/archives/002452.html

To quote Robert from the above article:

"The PTK is used in the 4-Way handshake to produce a hash of the frames. There is a long history of offline dictionary attacks against hashes. Any of these programs can be altered to use the information in the 4-Way Handshake as input to perform the offline attack. Just about any 8-character string a user may select will be in the dictionary. As the standard states, passphrases longer than 20 characters are needed to start deterring attacks. This is considerably longer than most people will be willing to use.

This offline attack should be easier to execute than the WEP attacks."

End quote. Reread THAT last sentence...

Current optimized attacks on WEP (assuming it's one of the more modern implementations that addresses the key scheduling problem and weak IVs) require something on the order of hundreds of thousands of packets with well distributed IVs. That's several megabytes of data. Then the WEP key can be recovered. There there is also "chop-chop" which is an active (and noisy) attack against WEP performed by generating controlled packet errors. All WEP is also vulnerable to the XOR known-codebook attack, but you have to accumulate over 2Gig of known data (one long packet for each unique IV) to recover the "code book" (the cypher stream). Yes, all of that is doable. I've done it. I'm well aware of the effort you have to go to in order to accomplish this. It all takes a LOT of data. Enough data, and it can be relatively quick to compute. One test I ran, I had over 500,000 "interesting" packets (unique IV) and Aircrack still couldn't break it after 3 hours of run time on a 2.4 GHz processor. Yes, it would eventually break it (but I ran out of time in my talk and I had only started the cracking run 2 hours before my talk began) and once it's broke, it's broke (but so is WPA-PSK). Obviously, if you have an older, or lame, implementation, the attacks against WEP work much much faster.

OTOH... WPA-PSK, you only need the first four packets of the session setup. Because you can cause the access point to "disassociate", you can force the nodes to reauthenticate and get your 4 packets at any time. Then you can brute force the PSK at your leasure. The longer and more complicated the passphrase is, the harder it will be to brute force. But, as Robert and other noted cryptographers had documented, it takes a LONG passphrase. 8 characters or less can be exhaustively broken in mere seconds. I've seen recommendations for passphrases that vary any

Excellent

[wonkavader]

The nice thing about a law like this is not that we'll be informed, but rather that companies will be more cautious with the data, knowing that they'll HAVE to inform us if they screw up.

Less laptops flying coach with 20,000 credit card numbers in an excel spreadsheet on it. (My next door neighbor got a nice paper-mail note from an company that let a laptop get snatched just last week.)

Re:So how much is this going to cost?

[Anonymous Brave Guy]

The problem is, if they're going to have to 'fess up, but then get away with nothing more than a slap on the wrist anyway, then this law is unlikely to do much to improve the security of personal information and the integrity with which it is handled. What they ought to do, IMHO, is enact a law that both requires disclosure and hits the offender with a financial penalty proportionate to the damage caused and the degree to which the offender's negligence caused it.

If a business carelessly loses 1,000 customers' credit card details but then gets hit with a dent to their bottom line of 1,000 x $AVERAGE_COST_PER_CARD_FRAUD + $COSTS_INCURRED_BY_AUDITORS + $SIGNIFICANT_PENALTY_CHARGE, then maybe it will become enough of a priority on the executive radar to do something about it. Similarly, if identity thefts or other more serious consequences arise, the costs of cleaning those up can be incorporated into the penalty; naturally, this should include compensation for the time spent by the affected individuals and any third parties they had to deal with to fix the problem.

At the same time, this approach removes the financial burden of conducting after-disaster audits from the taxpayer, and passes it onto the offending party instead.

Re:Recursive Acronym!

[the chao goes mu]

Actually, shouldn't that recurse in the opposite direction?
DATA=DATA Accountability and Trust Act=DATA Accountability and Trust Act Accountability and Trust Act= DATA Accountability and Trust Act Accountability and Trust Act Accountability and Trust Act etc.

What will be done to water this bill down?

[KarmaOverDogma]

Let us count the ways:

1) amendments
2) exceptions (gov't, big business, telcos)
3) loopholes
4) unclear/incomplete definitions
5) enforcement (is the FCC the best choice?)
6) insert your scenario here

It sounds good, but the devil (as usual) is in the details.

Cyberwar Related

[Bob9113]

We've had all these reports in congress about how unprepared the nation is for cyberwar. This seems like one pretty good market based approach to increasing our preparedness (though others may be necessary). If companies have greater risk exposure for insecure data, they have a greater fiduciary responsibility to secure it. A simple solution that Adam Smith could be proud of.

Definition is everything

[irishxpride]

I'm curious as to what will be defined as "personal data." Email address? What about MRU lists or cookies? Also what's the definition of "notify." Does it count as notification if the company puts a one line blurb at the bottom of it's website? This legislation may be utilitarian in spirit, but I fear the letter of the law will change little. Business as usual...

RECURSIVE?

[Roadmaster]

Did they actually come up with a recursive acronym? is there a geek advising them? there's hope!!! WHEE!!!

DATA is not...

[neildiamond]

DATA = DATA is not an Emulator!

Illegal wire-tapping?

[Durandal64]

The bill requires consumers to be told if their privacy has been violated because of a breach.

So phone companies will be required to notify customers if the NSA illegally wire-taps their line under a Holy Decree -- er, I mean "executive order" from King George?

For those European and UK companies...

[nickh01uk]

Theres a different set of European and UK legislation discussed in an article here. Although there is increasing harmonisation of EU/UK/US legislation on this, there's still a long way to go and its important to know about what is specifically relevant to you.

Nick

Existing medical laws

[PIPBoy3000]

At my organization, we recently passed some policies around the release of medical information. Essentially we're complying with existing laws in Washington, where we have hospitals, so mostly we're being consistent across our organization.

What it means is that if medical information somehow gets outside of our organization without our permission, we need to notify patients. This can get extremely expensive in cases where large amounts of records get lost or stolen. There's an exception in the law that lets us publish ads in major papers instead of sending out letters. I think the barrier is around a million dollars or so before we switch to ads.

Is this a good thing? My son's medical information was on some backup tapes stolen from the back of a car from a different healthcare organization. I personally don't care about it and it's unlikely the information gets used for malicious purposes. The cost for sending all the letters was in the hundreds of thousands of dollars most likely. Costs like that would bankrupt small organizations, though in today's healthcare market, it's becoming the price of doing business.

What'll probably happen is that big organizations will bear the cost of this in stride, while smaller organizations will have yet another risk that might shut them down at any moment.

Re:Existing medical laws

[TubeSteak]

While I agree that this is an expensive cost for small businesses, I disagree that it would "bankrupt small organizations".

Why? Because of insurance. If this bill passed, insurance companies would just start offering up another service as soon as they figured out a risk forumla to calculate the price they're going to set.

Now... in the medical field, insurance is a big cost, but a 'small' (generally defined as less than 500 employees) business should have less to lose & so, less fees to pay for coverage.

Sometimes market forces work.

Re:Existing medical laws

[robertjw]

Costs like that would bankrupt small organizations, though in today's healthcare market, it's becoming the price of doing business.

I think that's the point of this kind of law. It hits both big and small organizations hard when they screw up. Provides some significant incentive to tighten up security policies. Just like your example, why the heck did someone leave backup tapes in a car unattended? Seems like they weren't taking their security very seriously.

Re:Existing medical laws

[ObsessiveMathsFreak]

My son's medical information was on some backup tapes stolen from the back of a car from a different healthcare organization....Costs like that would bankrupt small organizations, though in today's healthcare market, it's becoming the price of doing business.

Any business that allows it backup tapes to be ferried around in the back of a car doesn't deserve to be in business.

Re:So how much is this going to cost?

[Phisbut]

Tax payers get to pay for yet another government audit agency (or group within an agency FTC) that audits companies.

Tax payers pay for a lot more than that...
(speaking as a non-american looking at all those acts and bills)

CAN SPAM : Controlling the Assault of Non-Solicited Pornography And Marketing
DATA : Data Accountability and Trust Act
USA-PATRIOT : Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism
... and I bet you have a lot more ...

Somebody really gets paid by your taxes to come up with ridiculously long names for acts and bills just so the acronym kinda-almost says something? I get a laugh everytime I hear about a new bill or act coming from the states...

Oh great

[MagicM]

Now in addition to PIN Numbers and ATM Machines, we'll have the DATA Act.

From The Bill:

[TubeSteak]

http://thomas.loc.gov/cgi-bin/query/z?c109:H.R.412 7:

Sec 5. (1) ...The encryption of such data, combined with appropriate safeguards of the keys necessary to enable decryption of such data, shall establish a presumption that no such reasonable basis exists. Any such presumption may be rebutted by facts demonstrating that the method of encryption has been or is likely to be compromised

That's a great clause, even though it opens the door to conflicting expert opinions. They absolutely have to include a reporting mechanism into the law, so that there is a timely way to get the issue heard and resolved.

Re:So how much is this going to cost?

[Forseti]

Believe me, if they are required to publicly disclose all breaches, the impact on their reputation and the cost of publishing the disclosure will be punishment enough.

What this law really needs (it may be included, I haven't checked) is a clause that slaps them hard if they choose NOT to disclose.

What's more scary for me...

[laplandsix]

Is slipshod security practices within a company. Sure security breaches are pretty damn scary, but I've worked with some PRETTY big company who had some pretty lousy security practices, and should know better. I recently worked with a HUGE payroll company to outsource my employer's payroll to them. The task fell to me to export all the data from our existing payroll system, perform some data hygene, and send it to this payroll company in delimeted format.

They suggested that I simply attach the .tab files to an email and email them on over. I balked a that suggestion. We've got full names, DOB, SSN, address, tax information, bank account numbers, the WORKS! They wanted me to transmit the files in the clear to their email where who knows how long this info will sit in their outlook inbox, and how MANY people will see it. I made some rather more secure suggestions, but in the end we settled on password protected .zip files hosted on a password protected webpage. Pretty feeble security if you ask me, but WORLDS better than what they wanted.

I guess the point I'm trying to make is most companies don't give a SHIT about your data. They'll play along and act like they do, but implementing proper internal security practices is HARD and EXPENSIVE. This law is a step in the right direction, but it simply isn't enough.

Re:Recursive Acronym!

[amliebsch]

I don't think it counts as recursive, because the "Data" that is in the name of the act is NOT referring to the acronym "DATA," it's referring to the actual word "Data." To be recursive, an acronym must be self-referential, but this one is not.

Mod this bitch down

[Yomer333]

Any way to mod the article summary down as redundant? There's 4 sentences, and 3 of them say the exact same thing.

DATA Breach Timescape

[digitaldc]

PICARD: What's the problem, Mister Data?

Data turns to them.

DATA: I believe I have discovered the cause of the identity theft. There is a hard core data data breach in progress.

They react. Data indicates the phishing email on the screen. They walk up to it...

DATA: It is the flashpoint of a privacy invasion. And it is expanding.

PICARD: Expanding... I thought phishing scams were suspended on this ship?

DATA: We were incorrect. I have determined that email scams are moving forward at an infinitesimal rate.

TROI:Why didn't we notice it before?

DATA: Our initial conclusion was based on our observations of the crew. A data breach moves at a much faster rate. The motion of the email is within my neural detection threshold. Based on its current expansion rate, it will consume the crew's identity in approximately nine hours, seventeen minutes.

PICARD: Is there any way we can stop it?

DATA: It is no longer a question of stopping it, sir. The explosion of phishing email has already occurred -- The fact that it is moving slowly changes nothing.

Picard stares at the screen for a long moment...becoming very thoughtful...

PICARD: Astonishing... to see our identities stolen like this...

Smaller business = smaller cost

[InfiniteWisdom]

A smaller business would have fewer customers and therefore not have to spend as much. Any business where sending a form letter to customers is a prohibitively high cost is probably sick and likely to go under anyway.

Given that it can take up weeks or months to clear up your credit history and potentially costs thousands of dollars if someone uses your information to open fraudulent accounts, I don't think it's unreasonable to ask companies to send a letter when they fail in their legal obligation to protect their customers personal information.

Coming soon to a workstation near you

[PrvtBurrito]

Dear PrvtBurrito,

We recently noticed that your PayPal account was compromised. As required by law we are informing you of this breach. In order to reprocess your new secure account, please log in to PayPal and rectify this situation:

[Click here to update your account]

If you choose to ignore our request, you leave us no choise but to temporaly suspend your account. We ask that you allow at least 72 hours for the case to be investigated and we strongly recommend to verify your account in that time.

Thank you for using PayPal (or whatever service is being spoofed)!

Re:Gee

[voice_of_all_reason]

But only customers? What about all these mega-companies that banks hire to do their clerical work? Technically, we're not their customers, so they'll obviously try to claim that.

Sorry, Mario, but our legal solution is in another castle!

Time for the skepticism!

[millennial]

As a cynical American, I wonder what sort of riders are tacked onto this bill. In an administration where national ID card legislation is tacked onto a military spending bill, I wouldn't be surprised if we're signing ourselves into slavery here...

Infinite recursion!

[colinbrash]

They can't pass that, the acronym will result in infinite recursion and the government will crash!

Re:Infinite recursion!

[markild]

No it won't...

This is the one in question:
DATA = Data Accountability and Trust Act

This is what you're thinking of:
GNU = GNU Is Not Unix = GNU Is Not Unix Is Not Unix.. etc...

The "Data" in DATA is not an acronym..

A start

[Antimatter3009]

This is a step in the right direction, but I'd like to see them held more accountable through stricter penalties. How about fines to fund those audits (make them pay to get audited? I like the irony), or better yet, refund people for all they're going to spend in both time and money when their identity is stolen?

US Dept of Acronaming UDA

[rakerman]

Is it just me, or do these legislators spend more time thinking up clever titles that spell out words than on the actual content of the bills?

Sounds good in theory, but...

[Crazyscottie]

... What's tacked onto it? (No, I didn't RTFA.) This sounds like one of those seemingly innocuous bills that the **AA might push through Congress to once again "promote creativity," a.k.a. give consumers the chokehold.

why the hell? natural cynicism!

[RMH101]

corporate regulation is understandable in light of dicks like Enron, but it's very very expensive for businesses. Boo-hyphen-hoo, you may say. However, if it costs more for a company to operate, they'll charge more. It'll cost you more as a consumer.
It could be argued that Sarbanes Oxley and the raft of other regulation is overkill. You might argue that companies should have some damn sense of what's right and what isn't, without needing to be regulated down to the tiniest level.
Alternately you could argue that you don't trust any company, and would want them to undergo expensive and painful audits - and that you'd be happy as a consumer to pay for that...

Re:why the hell? natural cynicism!

[Theatetus]

You might argue that companies should have some damn sense of what's right and what isn't, without needing to be regulated down to the tiniest level.

You could say the same thing about people, but I don't think it's out of place to say there should be laws against people killing, stealing, defrauding, etc.

Alternately you could argue that you don't trust any company, and would want them to undergo expensive and painful audits - and that you'd be happy as a consumer to pay for that...

Happy? No. Convinced it's clearly the better alternative? Yes.

Re:why the hell? natural cynicism!

[ajs]

The problem is that the options aren't, "get raped by companies or pass laws like S/O or this." There are other options as well. For example, you could work with the companies that will be affected, have them explain their business processes and how oversight will impact them, and then pass very specific, very detailed regulations that constrain businesses in ways that help consumers without constraining them by default in ways that do not help.

One great example with S/O is data retention. It makes sense to say, "you must retain records." However, this leads to a drastic change in business practices, much of which hurts the consumer far more than it helps. It also hurts that the law is relatively vague, and so businesses must cover their asses by applying the law in its broadest possible interpretation (until courts narrow the scope of the law, if they do). In the end, you pay for billions of dollars worth of data retention which could never possibly benefit you while the data retention that WOULD benefit you was already being performed by most companies for other reasons (such as defence against suits).

In short, always start by codifying best existing practice into law where needed, and then step back to see what, if anything, else is needed.

Re:why the hell? natural cynicism!

[ObsessiveMathsFreak]

Alternately you could argue that you don't trust any company, and would want them to undergo expensive and painful audits - and that you'd be happy as a consumer to pay for that...

You mean there are people out there that actually trust, private companies?!!

Private companies are the most untrustworthy entities on planet earth. They exist for one reason and one reason only, making money by whatever means necessary. If your "trust" in them stands in the way, they'll gladly walk all over it. Nay, eagerly. At least Mob bosses and pimps have some kind of reputation to keep together. Private companies have no such scruples.

Re:why the hell? natural cynicism!

[Curien]

You have it exactly backwards. It's the /public/ companies (ie, corporations) that exist purely to increase shareholders' bottom-lines. Private companies exist for whatever purposes their respective proprietors assign to them.

*groan*

[Khammurabi]

The government does get things right from time to time, and this is one of them.

Right now, a disgruntled employee of a banking, credit or other corporation that has possession of your social security number, can sell your info on the street and the company has no liability or mandate forcing them to tell you of the breach once they become aware of it (which they will when 1000+ customers suddenly transfer all their money to an account in Poland). The onus is currently on the customer to notice the problem, report it, and then argue and plead for them to fix it (with the customer thinking this is an isolated incident when it is not). With this law, the customer will no longer have to argue the case, as the company will be forced to reveal the breach and make it right.

If you want to gripe about paying too many taxes, write your senator that you're sick of paying for $500 hammers and $10000 toilet seats. But this law is a keeper and about 30 years late in coming.

Re:*groan*

[plague3106]

If you want to gripe about paying too many taxes, write your senator that you're sick of paying for $500 hammers and $10000 toilet seats.

Or we could cut the military, remove the censoring portion of the FCC, stop wiretapping everyone that a suspect called because of a wrong number and stop handing out money to people who sit on thier ass all day.

Encryption != Absolute Security

[Dareth]

Encrypting your data in bulk is not a bad security measure. However, if the breach does not involve the mass theft of encrypted data files, but rather a break in normal access methods, the encryption does not provide any protection at all.

You still have to deal with "trusted user" abuse as well as protecting the API that allow normal decrypted access to the data.

Imagine being the systems/database admin who has to report a data loss to management.
Management will have a very hard time understanding that data could be lost even though it was encrypted. Will they understand that they will be required to report this loss despite the encryption security measure?

This is similar to a firewall providing security, even though most of the ports are wide open.

Secure Transactions

[Doc Ruby]

I want that law to define "security breach" to include any disclosure of personal info outside the immediate transaction into which the person delivered their info. To apply copyright protection to personal info, licensed for copying by the recipient solely to complete that immediate transaction. People pay for a huge public infrastructure to protect corporate info, including commercialized copyrights. We should have at least the same strength protection on our own info. Until corporations have that strong financial incentive to protect even one person's data, they will of course take the cheaper/profitable course, which exposes people to damage.

Re:So how much is this going to cost?

[Anonymous Brave Guy]

Believe me, if they are required to publicly disclose all breaches, the impact on their reputation and the cost of publishing the disclosure will be punishment enough.

Sorry, but no, I don't believe that.

There have been several cases in the past, mentioned here and elsewhere, of major leaks of personal data. Can you show me a single example where a leaker has compensated the affected individuals or taken significant steps to prevent a recurrence? Has any such offender suffered any significant damage to their bottom line? Not that I know of, certainly.

And WHERE do they have to inform you?

[Opportunist]

Somewhere at the bottom of the EULA that nobody can read? Encrypted in a billion lines of legalese that makes your eyes water and is essentially unreadable to the normal human being?

I'm not even concerned about the various loopholes and excemptions that this bill will most likely have (I have to admit, I did not read it. Nor is it worth the time reading it 'til it's passed for the simple reason that if it COULD present a benefit against spyware in software it WILL be changed). Even without loopholes it's pointless as long as the customer is not informed in a separate EULA-like info field, in laymen's terms, what is going to happen to his PC!

Re:And WHERE do they have to inform you?

[Anonymous Coward]

Where I work, when we were breached, we paper mailed all the inactive (terminated, retired, etc) and emailed the actives at their work email (no yahoo, gmail, etc). It wouldn't be in a EULA, it would be a separate mailing. The California law is the current one that offers the strongest & explicit language about how long they have to contact you and how it's done. Also, a newspaper ad or tv ad has been used before as well when millions are impacted.

Re:It's the customers who are to blame

[SharkJumper]

There are companies that have reported that the standards are so lax that you could rip up a credit card application, tape it back together, mail it in and still get a credit card.

Specifically, companies like this one.

SharkJumper

Re:You could destroy many more lives.

[Anonymous Brave Guy]

While it is important to offer penalties that are felt by the corporations or businesses, you likewise don't want to punish them so much that they go out of business.

I think you misunderstand me. Consider your example:

If a small company, perhaps 50 people, has a database of even just 50,000 credit card numbers stolen, the fines you suggest could easily ruin the company.

In this case, 50,000 lives have been affected, possibly rather seriously, by the negligence of some or all of those 50 people. If serious damage has been done to all 50,000 then I am entirely in favour of that company of 50 people ceasing to exist.

Third Parties

[SWroclawski]

What if your privacy is breached by a third party?

A credit card validation service?

An outsourcing campany?

The consumer is not the "customer", especially in the second case.

Unconstitutional and Unnecessary

[dada21]

The US Congress has no mandate in the Constitution offering them any power over consumer privacy or information. The Interstate Commerce Clause was written to give the Federal government power to regulate the states to prevent them from taxing, tariffing or embarging interstate commerce: it was not meant to regulate commerce in any other way.

This is an unnecessary law. If you make a contract to trade with a party, put in the agreement that you want your information to be private and you want them to notify you of any breach of that agreement. If the company won't do business with you, don't buy from them -- if you want a cheap price, you might be willing to forgo this contract feature.

All my customers have in my contract agreement a stipulation that we both will notify the other in the event of identity or security breach. I don't buy anything from anyone without making sure I am protected -- and basic tort and contract law protects me in this case.

Of course this law has nothing to do with protecting consumers but with increasing Congress' control over individuals and businesses and offering a new layer of deterrence for the average person to go into business. We could replace much of the FTC with more realistic tort regulations rather than creating new laws where none are needed.

In my answer, the lawyers would win in the short run but standard contract agreements would put them on the bankburner. In Congress' solution, the lawyers win all around.

Re:Unconstitutional and Unnecessary

[Ph33r th3 g(O)at]

This is an unnecessary law. If you make a contract to trade with a party, put in the agreement that you want your information to be private and you want them to notify you of any breach of that agreement. If the company won't do business with you, don't buy from them -- if you want a cheap price, you might be willing to forgo this contract feature.

That's nice in theory, but one of the reasons we have government regulation is to help mitigate the asymmetry of power that prevents individuals from ever negotiating contract terms at all with companies that hold their data, much less terms about privacy. This legislation flows from the same river as the FCRA, FDCPA, and FACTA -- it addresses abuses of individual customers (a.k.a. "consumers" or "cattle") by the industry when the market has failed.

Re:Unconstitutional and Unnecessary

[dada21]

it addresses abuses of individual customers (a.k.a. "consumers" or "cattle") by the industry when the market has failed.

I don't believe the market has failed in terms of privacy -- it is the mountain of previous regulations that have given preferential treatment to companies with ties to government. As an entrepreneur myself, I know how bad it is to get into many markets -- it is not competition that scares people off, it is excessive regulations.

Most of the acronyms you listed have their basis in previous regulations that failed, or previous favoritism ("cronyism") that created a maze that prevented competition from entering the market that you say failed. I have no hope in new laws fixing any problems at all, they'll just make things worse so the door is opened for more laws in the future.

Re:Unconstitutional and Unnecessary

[ObsessiveMathsFreak]

This is an unnecessary law. If you make a contract to trade with a party, put in the agreement that you want your information to be private and you want them to notify you of any breach of that agreement.

Wait a second. Why does a company require an express instruction not to sell my data, but can do as it pleases with my data without any approval implied or explicit?

Is it implied that if I do business with a company that every detail of our transaction is forever available for that company to; use, sell, trade, exchange or barter, as it pleases, with any other company or entity that it so chooses, now and for all of time?

Surely, common sense would tell us that this is not implied, and that in fact, it is the exact opposite that is implied in the absence of express contract. Namely, if it is not an expressly agreed upon matter, the paticulars of my dealings with that company are to remain, forever, a private matter between myself and that company.

And if companies choose to abuse their customer's trust by making private dealings public, then it's clear that legislation is needed.

Re:Unconstitutional and Unnecessary

[dada21]

And if companies choose to abuse their customer's trust by making private dealings public, then it's clear that legislation is needed.

I don't see that as the case at all. There is no right to privacy if you openly put information out there. My father told me at a young age to never put anything in writing that I didn't want others to know and use against me. That is true with all my private information.

I don't bank. I don't have credit cards. I don't trade stocks. I am living 100% on a gold hard money standard. I don't worry about my privacy because I have nothing to hide, and I don't care what someone does with my information because there is nothing for them to take. If you give someone information, YOU should be responsible for making sure that they will contract to not disclose it. That is freedom. Putting government in the loop means you hope they'll do things the way you want them to, but historically that never happens: they do things the way their funds suppliers want them to. Against all your wishes and hopes and dreams.

Re:Unconstitutional and Unnecessary

[sirwired]

The US Congress has no mandate in the Constitution offering them any power over consumer privacy or information. The Interstate Commerce Clause was written to give the Federal government power to regulate the states to prevent them from taxing, tariffing or embarging interstate commerce: it was not meant to regulate commerce in any other way.

If the framers merely wanted to keep states from taxing, tariffing or embargoing interstate commerce, why did they just not say: "States shall not have the power to tax, tariff or embargo interstate commerce?" No, instead they explicitly gave the feds the power to do so. The commerce clause is pretty explicit: "Congress shall have the power... to regulate commerce... among the several states." It doesn't say "limit the states' power to regulate interstate commerce", it says "regulate commerce among the states."

While I don't necessarily disagree with your libertarian ranting about the necessity for such a law, it is stupid to declare this proposed law unconstitutional, because it clearly isn't.

SirWired

Re:Unconstitutional and Unnecessary

[Jtheletter]

Dada, let me start by saying that I respect much of what you have to say, I read your gold blog weekly and have you friended and at +5 on slashdot, but I think in this case you're missing something. As you well know, the idea of an unregulated free market only works when all parties involved have full knowledge in a given transaction, in this case most of the people affected are not aware yet that there is a problem. I would argue that it will in fact be a long time before the public perception of this type of financial data security is widely known enough for the market to react. The newer generations that have grown up with text messaging and the internet will be much more aware, but currently a large percentage of people who transact on the net daily do so only at the most surface level - these are the people who don't know how to set up a firewall or virus protection, who don't know how to secure their PC unless MS pushes out a patch to them automagically, the people who think paypal service is 'like a web debit card' and who fall for phishing scams.

As a Libertarian I would like to see less regulation and smaller government but in cases where the damage being done by the illegal activities is moving faster than the market's ability to protect itself something needs to be done to protect people until they become aware enough to do as you said and only contract with companies that have good protections and privacy policies. The fact that the market is still rather unaware of the problem is evident in the current policies of most web-based and web-enabled financial companies. We don't see the protections we'd like because they're not being demanded. It's fine for you or I to say "well then don't use them" but the fact remains that a huge number of people are unaware and will continue to use them. In essence the market is working currently, customers have not perceived a need and as such they are not demanding a solution so businesses will only do as little as they can get away with. Some of the better ones are enacting customer protections but most don't seem to be. Perhaps what we need in this legislation is a time limit for it (I would like to see more of that in general, and w/o the rubber stamp of indefinite extension after the time limit) and a provision that lays out a campaign for public awareness to educate the consumers so that the market can take care of the problem (use the fines collected, not taxes to pay for this, that way the companies pay to solve the problem they help create). You have to remember that unfortunately those of us in the know in the tech world are vastly outnumbered by people who only know enough about a computer to buy from ebay and only care that what they see on the surface works; security, privacy, and many other important issues that are just buried in tiny legalease click-through EULAs are as invisible to them as the hand of commerce. Once people have caught up to the technology the market can work, but I think until then we need to educate and, for the time being, regulate.

Re:Unconstitutional and Unnecessary

[Void Incarnate]

why did they just not say: "States shall not have the power to tax, tariff or embargo interstate commerce?"

Because the Constitution is about dictating Federal, not State, powers, hence the 9th and 10th Amendments. And you're missing the point that in the time of the Framers, as dada has repeatedly stated (no pun intended), "regulate" had a different meaning than it does today.

Re:Unconstitutional and Unnecessary

[sirwired]

as dada has repeatedly stated (no pun intended), "regulate" had a different meaning than it does today

"Regulate" had a different meaning? Really? Says who? I would like to see a source for that, because here is what I came up with from Findlaw:

On the commerce clause: "What is this power? It is the power to regulate; that is, to prescribe the rule by which commerce is to be governed. This power, like all others vested in congress, is complete in itself, may be exercised to its utmost extent, and acknowledges no limitations, other than are prescribed in the constitution . . . If, as has always been understood, the sovereignty of congress, though limited to specified objects, is plenary as to those objects, the power over commerce with foreign nations, and among the several states, is vested in congress as absolutely as it would be in a single government, having in its constitution the same restrictions on the exercise of the power as are found in the constitution of the United States." - Chief Justice Marshall, Gibbons v. Ogden, 1824

There you have it: "to prescribe the rule by which commerce is to be governed." The key word being "rules"... if he meant taxes, he would have said taxes. Certainly the framers knew when to say "taxes" when they wanted to talk about taxes, since they explicitly discuss them in the first clause of Article 1, Section 8.

Also from that quote above: "The power over commerce... is vested in congress as absolutely as it would be in a single government..." The constitution If you can't trust the legendary Justice Marshall (who developed the very concept of judicial review of law in Marbury v. Madison), then who can say what the Constitution says?

Just because the constitution doesn't say what some Libertarians want it to say is no excuse for a poor argument. It is a perfectly valid argument to say that the constitution is wrong, and gives the government too much power, and should be changed; it is a poor argument to say the framers did not mean what they clearly wrote, and Marshall equally clearly backed up.

SirWired

The Bare Minimum

[BoredWolf]

We can safely assume that most of these companies adhere to the minimum computer security system standards. The minimum standards are about as good as not having any security whatsoever. What companies can get away with in terms of liability in identity theft is analogous to getting a girl pregnant, then not being ordered to pay child support because you wore a condom (albeit an expired one). Verily, all this act would do is let a customer know they are the victim of identity theft, with no effective method of recourse. Sure, pull all your business/assets from the company, but some guy already has your information. What is needed is a higher standard of computer security within companies which hold sensitive user information, rather than the FTC auditing a company after the customers are screwed-over. Just some more bureaucratic red tape and more tax dollars spent on the appearance of security... err, I mean, keeping the people safe.

Can't you see the Plot!?!

[lexbaby]

With this the government could attempt to "steal" personal information from private companies. If they're caught, they can say they were "investigating" violations of the DATA Act. If they're not caught, they get all the private info they want.

DATA act . . .

[Ph33r th3 g(O)at]

. . . also known as the "Corporate Eye-Tee Security Empire Builder Full Employment Act of 2006." They'll milk this for departmental budget and fascist network powers just as with SOX, HIPPA, and GLB that came before.

Oh well then

[StaticVector]

So wait, the government does care about our privacy? Hopefully the government feels as strongly about their own data as they do about the data of the companies under them.

Re:So how much is this going to cost?

[Anonymous Brave Guy]

ChoicePoint

They created an entire new division that ONLY deals with privacy and security issues, have institued a number of new policies, ALL employess now go through extensive background checks (causing my team to have to turn down a couple of otherwise good applicants due to irregularities that they couldn't explain) and a $10 million fine at the end of last year.

Sure, but were the various security improvements because of bad PR, or because they didn't want another $10M fine?

hmm

[DextroShadow]

Would they inform people when the government breaches their security?

"Any customers"?

[schnogg]

This sounds woefully ambiguous. I think it would be better stated "any customers directly". We want to help consumers, but we also don't want to cause great harm to businesses who would have to hunt down all records and secondary relationships to customers who weren't directly affected.

Re:You could destroy many more lives.

[plague3106]

If a small company, perhaps 50 people, has a database of even just 50,000 credit card numbers stolen, the fines you suggest could easily ruin the company. That could lead to at least 50 people who are now unemployed, and potentially many more as the effect ripples through the economy.

Its unlikely a buisiness of 50 would have 50,000 credit card numbers. Its also probably not even necessary for them to keep the numbers once they receive their money. Also, the lost of 50 people likely won't have much, if any, effect on the local economy (unless of course there's only 60 people in the town).

you ALL haven't filed your tax return yet?

[spirlman]

obviously you have not filed yet, or you would have noted that:

U.S. Individual Tax Return 2005, Form 1040, Adjusted Gross Income Section, Line 30a clearly states:

"Identity Theft Related Expense, Attach Form 3823"

Bill would be unconstitutional

[TonyXL]

Congress has no authority to regulate this. If a particular state wanted to pass such an act, and they were within their constitutional limits to do so, then fine.

The better option would be for customers to only deal with companies who have a legal agreement to disclose breaches.

Re:Bill would be unconstitutional

[OzPhIsH]

I agree, but certainly they will claim it falls fully under interstate commerce, especially considering much of this data is collected from people from various states across the internet. I'd actually think this would be one of the lesser stretches of the interstate commerce clause.

This is my main concern:

"If passed it would require all companies to inform customers of security breaches that affect their personal data. The bill requires consumers to be told if their privacy has been violated because of a breach. Under the proposals, if a breach does occur, a company must notify any customers concerned and the FTC, which can then demand an audit."

To me this is just a back door for the government to get their grubby little hands on data they couldn't otherwise legally obtain. "Security breach into personal data at Google? Quick, let's demand an audit and get all the information they wouldn't hand over when we asked." To me, automatically allowing the government to have access is just as bad as the original security breach in the first place. Hell, now the government will probably covertly breach the security of private databases (all it takes is a presidential order, we are at war, after all. I'm sure the only justification required would be that information on foreign nations was contained within) and then after evidence of a breach is exposed, the government could just demand a full on data audit.

Government Databases: BAD

[Plugh]

It's nice that consumers would be notified when our ostensibly private data has been spilled by businesses.
But that's chump change compared to the damage that gets caused when government databases' content is lost, or unprotected.

Now, given that:

• Private businesses have a huge motive to avoid losing data -- when they do, customers are free to go elsewhere (and we do!)
• You're not free to "go elsewhere" when your Government loses your data
• Governments are likely to have way more sensitive and intrusive data than private businesses
• You typically know exactly what info, say, the credit card company has about you. You typically have no idea what info the government has about you.
• No database is 100% secure, no data is 100% safe -- especially not from humans with administrative access and plenty of reasons to leak the data
• Which do you trust to get IT right: a make-or-break project for a company, or Yet Another Government Project?

With all the above in mind, surely it makes sense to limit what data the Government collects, and to keep that data compartmentalized in local databases, rather than a nice, juicy, massive, single federal instance? Right!?!?!

Yet, that's exactly what is happening right now, with the "Real-ID" bill. (Here's what Bruce Schneier has to say on that).

Every single U.S. State except one has lined up like crack addicts to accept the federal money to implement Real-ID. That one State is New Hampshire, aka the Free State.

Here's a link to some pretty cool info about how and why the NH House rejected Real-ID:
http://freestateblogs.net/node/306

Re:Government Databases: BAD

[Anonymous Coward]

Actually I heard Montana was refusing to go along also? However I guess if history is any indication NH will get more publicity for whatever she does.

Re:Government Databases: BAD

[Plugh]

The Montana resistance attempt passed the House, but died in the Senate (if FOXNews is to be believed -- YMMV!) The New Hampshire house passed a "resistance" bill. The NH Senate votes on it next week.

Re:Government Databases: BAD

[mvpel]

Montana's opposition to REAL-ID died in the Senate. Hopefully New Hampshire's won't suffer the same fate in the coming days. There's a big push to pressure NH senators about it being led by http://www.nhcaspian.org/ .

That can't be right...

[ultranova]

...it sounds almost reasonable. A bill that would help protect real human beings against corporations ? And it's actually being seriously considered ?

Clearly, the terrorists have kidnapped the real representatives and replaced them with pod people ! There's no other explanation for this.

Type of data

[vshepherd]

Does this only apply to financial data (cc or ss #) ? Or to any data?

Funny, in California this law already exists...

[geekotourist]

let's see:
In California we have a law that requires notification of data privacy breaches. Remember Choicepoint being in the news? That was CA's 'fault.'

In California the law allows people to put a Credit Freeze on their account. Far stronger than a 'fraud alert,' this requires the person to temporarily lift the freeze in order to add new credit. Makes life most difficult for identity thieves. Also makes it harder for new companies (no pre-existing relationship) to offer credit, so the person misses out on those hundreds of "You've Been Approved!" junkmails.

Funny, this new law guts California's law. All these protections will only exist if and after Identity Theft has already happened! Instead of spending, say 15 minutes a month temporarily removing the freeze for business purposes, you'll get to have a freeze during your 200 hours of work trying to repair your ID theft damaged credit. Not just any 200 hours, its 200 hours of talking with bureaucrats and writing real paper letters and constantly scanning to see what your thief has just applied for. And you never truely clean up your record- even if the big 3 agencies have fraud alerts, each store affected will have their own database of how bad you are.

And this 200 hours of brain-breakingly stressful work will all be because you couldn't just freeze your account in the first place. But at least you'll have all those fine offers of credit to read while waiting on hold.

So its funny how the companies that yelled and screamed about California's law- although they comply with it- love this proposed federal law. They ought to love it- they designed it, and are getting the best bespoke law they can buy.

Re:Funny, in California this law already exists...

[krisamico]

I modded this up because I, despite being a California resident, did not know anything at all about consumer-level credit freezing. After some digging, I found that any resident of CA, NV, CO, LA, ME, NC, CT, and identity theft victims from some other states my freeze their files. I think this is great, but I was diappointed to find that there is a significant amount of paperwork and a fee that must be submitted to each credit agency!

This means that you have to submit paperwork and pay a fee to TransUnion, Experian, and Equifax in order to get some protection. I don't think this is either fair or adequate. The problem is that creditors require no express authorization in order to make an inquiry or open a new account on your behalf. Perhaps if we stopped using retarded social security numbers for everything, we wouldn't have these sorts of problems, but what sort of system for authorization could we use instead?

It just seems to me like we are trying to legislate the wrong thing. If a good system for authentication is in place, then the fact that your personal information has made it into the wild would not matter so much.

Re:Funny, in California this law already exists...

[techno-vampire]

Funny, this new law guts California's law.

No it doesn't. California's law is stricter that this new act, and complying with DATA won't protect a company from being proscecuted for not complying with the CA act. Federal law only overrides state when the federal act is stricter.

As an example, let's take minimum wage laws. If Congress raises the federal minimum wage, everybody has to pay at least that much, even in states where the state minimum is lower. However, if you live in a state where the local minimum is already higher, nothing happens because you still have to pay the (higher) state minimum.

Re:Funny, in California this law already exists...

[geekotourist]

You're right in general. My reference is to the Financial Data Protection Act of 2005 passed by the House Financial Services Committee two weeks ago. As this article on HR3997 says:

"The legislation also pre-exempts any state laws mandating breach disclosures to consumers. According the Consumers Union, 11 states currently have stricter notification standards than H.R. 3997, including a California law that has resulted in numerous consumer notifications over lost data tapes and database breaches."

If DATA isn't melded with HR3997, then Californians won't lose the current access to credit freezes. I of course expect the business-friendly version to just fizzle away, now that the consumer-friendly version exists.

What do *we* get when *they* screw up?

[martyb]

If a business carelessly loses 1,000 customers' credit card details but then gets hit with a dent to their bottom line of 1,000 x $AVERAGE_COST_PER_CARD_FRAUD + $COSTS_INCURRED_BY_AUDITORS + $SIGNIFICANT_PENALTY_CHARGE, then maybe it will become enough of a priority on the executive radar to do something about it. Similarly, if identity thefts or other more serious consequences arise, the costs of cleaning those up can be incorporated into the penalty; naturally, this should include compensation for the time spent by the affected individuals and any third parties they had to deal with to fix the problem.

I agree with your thinking in that there should be some kind of penalty based on the number of affected users. I would go one step further and suggest that there should ALSO be a penalty paid to EACH of those customers. I should not have to wait to find out if my identity is/was compromised. Each breach should entitle each customer to a cash payment of, say, $1000.00.

Insurance companies will have an opportunity to provide coverage, companies will have an incentive to obtain coverage, and the insurance companies will have an incentive to provide audits, tools, etc. to help lessen the need for the policies' benefits being paid.

This could appear as reduced rates for following certain best practices. I have had car insurance policies that had a discount for certain anti-theft devices being installed in my car. My homeowner's policy had a discount for cetain smoke detectors.

If a company doesn't want to deal with the hassle of dealing with an insurance company, they should have the option of self-insuring and posting a bond to cover potential losses.

Further, I would like to have a searchable, on-line resource which provided information on which companies had had breaches, the date of the breach, the number of customers affected, and the amount of the fines, penalties. For additional motivation, include who was the president, CEO, CTO, CIO, (and EIEIO :^) at the time. Hmm, add in who was on the board of directors, too. That way, the dumping of one company and the creation of another with the same actors could not be used to hide from the consequences of their [in]actions. (Any suggestions on other info to include?)

Ultimately, this might encourage companies to use data encryption as a matter of course - to the point that it becomes the de-facto norm of how information is stored on a computer. Maybe, with time, to the point where Joe Sixpack's home PC or PDA is secure by default. Given some of the articles and posts I've seen on /., I would like to think that, in some small way, this might help protect citizens from governmental intrusions. Not just in the USA, but set an example that could be followed in other countries around the world.

P.S. What would you do differently if these proposals were in effect and your SOHO computer were compromised? I'm pressed for time right now, but just thinking about this from THAT perspective is already making me re-think how I do things.

Business plan

[The name is Dave. Ja]

...if a breach does occur, a company must notify any customers concerned...

A little alarm bell went off in my head when I read that. Put on your tinfoil hat and come with me down business plan alley ...

1. Start a business; oh, online marketing or something. Doesn't matter, just a shell.
2. Collect "customer" data by whatever means necessary. Email addresses of course, anything else is a bonus.
3. Protect the data as best you can, but at some point, lose ALL the data. I didn't RTWA (whole act) so I don't know if suspected breaches count, but let's say they do. Even better if you don't even have to actually lose any data, just suspect it. Otherwise, you would actually have to cook up some "security breach" or something.
4. Here's the good part - you now have hopefully MILLIONS of customers that you MUST contact BY LAW to alert them to a possible security breach. Sounds like a great opportunity to let your customers know about new improved security products made by "affiliated" companies - they paid me some $$$ and are now fully affiliated.
5. Sell additional ad space on the emails for related items. The emails will have all sorts of official government-sactioned stuff to GUARANTEE that they will be opened and read.
6. Profit !!
7. Try to improve security.
8. Damn those evil haxxorz! They broke in again! Now we have to "notify" all the customers again! Damn!
9. Profit some more...

The DATA protection sounds like a good idea, but I hope there is some protection against this type of scenario. If I can come up with the half-baked idea above, I imagine a bunch of scummy spammers are already frothing at the mouth.

Did any of this happen in California (where a similar law has been operating for 3 years) ?

--
zomg!!1! Custom Ponies!!