Slashdot Mirror
Congress Proposes Data Breach Disclosure Bill
segphault writes "A new data breach disclosure bill proposed by Senator Sensenbrenner (the same politician that sponsored the infamous Real ID Act) requires companies to inform federal law enforcement agencies if a database containing information on more than 10,000 citizens is infiltrated by hackers. The punishments for failing to disclose information about data breaches to federal law enforcement agents under this new bill include jail time and massive fines. Although this bill requires disclosure to the government, it does not require companies to inform the victims of data theft. Furthermore, it allows federal law enforcement agencies to prevent companies from voluntarily disclosing information about breaches to the public, even if the companies are required to do so by state laws. This law could potentially allow companies to circumvent and undermine state laws designed to protect consumers from identity theft."
Consider this Ambulance Driver.
Wikileaks, no DNS
max from ytmnd takes "donation" money and funds trips to europe with it.. wonder why he asks for so much donation money?
What if those doing the infiltrating are NSA agents?
ZuluPad, the wiki notepad on crack
Student Information Systems can easily contain over 10,000 student records. So, potentially, the kid who changes his grades could be tried by the fed in the future.
When I read this part of the summary:
The punishments for failing to disclose information about data breaches to federal law enforcement agents under this new bill include jail time and massive fines.
My first thought was, it's about damn time.
Then I realized that they probably weren't talking about the sort of "data breaches to federal law enforcement agents" I was thinking they were.
--MarkusQ
P.S. If you missed my insightful post on the "poll says people want the NSA to spy on them" story there's still time to check it out.
Bills in Congress usually win a few more votes if they add a clause giving state laws precedence, or so I've heard. That might make a difference with a bill like this one.
Um, House Judiciary Committee Chairman James Sensenbrenner is not actually a senator, but a congressman. http://www.house.gov/sensenbrenner/
Twice as crazy as I would be if I was half as crazy as I am.
Sensenbrenner is a member of the House, not the Senate.
>This law could potentially allow companies to circumvent and undermine state laws designed to protect consumers
> from identity theft.
Yeah. It could also give the FBI time to track down the perps before general knowledge of the crime taints the witness pool. It's a pretty common practice at the local level for news organizations to keep quiet about evidence for the same reason.
Look, who gives a flying fuck if the government knows? I certainly don't. In fact, I'd rather they didn't.
This government is getting way to nosy, IMHO. I don't care what the reason is, I'm sick and fucking tired of being saved from myself. Let me smoke my cigarette in my bar, and masturbate the Islamic terrorist porno, leave me ALONE.
Hey old white bastards, how about a law that requires me to be informed when my companies data has been hacked? Or better yet, why don't you worry about things like maintaining roads. Why is it that the NSA knows what sort of hemorrhoid creme I prefer, and when my girlfriend's periods are, but I can't drive down I-20 for more than 3 hours without needing a new wheel alignment for my car?
How about a fucking law that says I get to be informed every single time my personal information is accessed by the government? Every time I turn on the news I seem to be reading about how the Department of Homeland Security is making sure I'm following the latest terror alerts and that I'm not cooperating with al-Qaida via Xbox Live. I mean, Jesus, what the hell.
Even better, the slashdot summary makes it sound like they can circumvent state legislation. Um, my constitutional skills may be a little rusty, but I'm pretty sure that's what the 10th Amendment was all about.
While we're on the subject, what about the 9th Amendment? I'm pretty sure that that one said that we have rights that may not be explicitly mentioned in the Bill of Rights, and thus, we reserve those rights. It seems like America is serving up it's rights like a Shoney's smorgasbord. It's like 8.99 all-you-can-give-away at the Patriot Act Red Lobster. Jesus.
Douglas Adams once said (forgive my horrible paraphrasing, as I don't have my copy of Salmon of Doubt with me) that Australians often say "We're the last place left mate," and it made him nervous because of the confidence with which he said it. Makes me wanna see if they're right, cuz quite frankly I'm sick of this place. It's not just the politicians, it's the people. How can my vote count if I realize for every vote I cast with some knowledge of the issues, there's fifty people are are being exploited by like-minded zealots whose sole purpose is to acquire power, and seek to retain that power.
Madison, in Federalist 9 & 10, argued that mutual self-intrest will keep the 'factions' in line, draw them towards a central, middle ground, and thus make decisions that are best for everyone. The problem seems to be that no all 'factions' are allowed into the game. At this point, I've got to request that I be allowed to collect my chips and move to another table, cuz I think I'm getting screwed, and all I see is more Dick coming. ~a
living in, doesn't it?
I'm going to assume, for my own personal sake, that this is not a unique situation for us, and that others have felt the same during prior portions of history.
I only hope the damage is reversable without a dramatic loss of life.
All your base are belong to Google.
Only in some places, they get away with more than in others.
Wikileaks, no DNS
Will the government be required to disclose computer breaches? Will the public be informed? Who will get the fine or jail time when a computer breach occurs on government computer systems and no one reports it? Maybe this is to help fight the war on terrorism?
4 2259
The Department of Homeland Security, which is charged with setting the government's cyber security agenda, earned a grade of F for the third straight year from the House Government Reform Committee. Other agencies whose failing marks went unchanged from 2004 include the departments of Agriculture, Defense, Energy, State, Health and Human Services, and Veterans Affairs. The House Government Reform Committee is expected to award the federal government an overall grade of D-plus for computer security in 2005, a score that remains virtually unchanged from 2004.
IRS Leaves Taxpayer Data Largely Unprotected: http://it.slashdot.org/article.pl?sid=06/04/07/19
I'm certainly no libertarian - and I hate the way that information about myself and my choices is being traded and used in the marketplace... but this seems like an unfunded mandate by way of criminalizing inaction after the fact. Seems more like a tool so that the government can punish people who embarass them after the fact, rather than an active step to secure this information.
If they want to secure this information, either make it all illegal to use and hold in insecure ways (like on a networked computer), or fund a method of secure use of this information. Punishing the innevitable breach of security in the marketplace after the fact won't change the fact that such breaches are innevitable, and I very much doubt such punishments will improve this particular marketplace.
Ryan Fenton
That way breached don;t affect me.
Any concern that stores even a single record about anyone who is not an employee should be forced to disclose the details to the Feds and to the people whose records were compromised.
The company should then be prevented to store any such records for the next decade. In addition the maximum of 250K should be automatically payable within 15 days to such people.
Failure to pay the amount would result in jail time for the CEO and CTO.
What am i talking? Laws are not made for logical reasons... laws are made in smoke filled backrooms where my senator can compromise my state's water rights for a few more air bases or National Guard bases....
"Doing what i can, with what i have." ~ Burt Gummer
Australia is nice, but it's far from being the "last place left." To pick just one example a tad closer to home, three of the last presidents of Costa Rica are in prison at this very moment.
"Why?" you might ask. "Do they have particularly crooked politicians down there?"
No, not really. Their politicians aren't much different that politicians anywhere. The difference is, they have a rather odd custom regarding the laws. When their politicians break the law they investigate, arrest, try, and eventually convict the ones who do it. In other words, they treat their elected officials just like anybody else.
From what I can tell, as a side benefit, it seems to have a salubrious effect on the rest of the politicians.
--MarkusQ
requires companies to inform federal law enforcement agencies if a database containing information on more than 10,000 citizens is infiltrated by hackers.
If you have enough users, does "cat /etc/passwd" count?
Weaselmancer
rediculous.
That has great potential to do something..........then they get it backwards.
Inform the gov't....why? It's the citizens put at risk when this happens. I want to know about it dammit. That's my information they lost.
Furthermore, it allows federal law enforcement agencies to prevent companies from voluntarily disclosing information about breaches to the public, even if the companies are required to do so by state laws. What? Backwards I tell you.
Don't mind my ranting demeanor. I've been on an ant-gov't rant since I listened to Michael Savage earlier.
That which does not kill me only postpones the inevitable.
Senator Sensenbrenner (the same politician that sponsored the infamous Real ID Act)
This is also the same guy whose immigration bill brought Latinos into the streets in unprecedented numbers to protest.
That's some record this guy is racking up!
What if I do the same thing, and I do get different results?
Data security bills have been kicking around for months now, and House Judiciary is actually running behind the pack. Senate Commerce moved a Smith bill (S. 1408). Senate Judiciary moved bills authored by Chairman Specter (S. 1789) and Senator Sessions (S. 1326). Representative Sterns introduced a bill, H.R. 4127, which was referred jointly to House Energy & Commerce and House Judiciary. Commerce voted it out, but Sensenbrenner has been sitting on it while working on his own bill.
Every one of the above-mentioned proposals is better than the Sensenbrenner bill. While the Sessions draft is almost as bad, it's likely to take a back seat to the Specter bill. Most importantly, all the alternative bills have process. They've had hearings. They've had markups. They've been analyzed by industry, DoJ, privacy advocates and everyone else conceivable. They may actually be going places. The Sensenbrenner bill is not. It looks more like a cheap stunt to get some media, and ensure some say in the final product, than a serious attempt to legislate.
Of course not. If it did, it would be strongly opposed by the corporations, who everyone by now should know are the entities that are really in control of the government today.
<sarcasm type="biting">
Yes, this clearly is government of the people, by the people, and for the people. Makes me proud to be an American!1!!11!
</sarcasm>
Use 'slashdot stuff' in the subject line in any email you send me if you want to get past the spam filter.
Is the telecom companies' (except Qwest!) disclosure of telephone call data to the NSA considered a 'data breach?' Would that have to be disclosed as well? Or would the president simply sign a set aside for that law so that the NSA could ignore it?
Face it; it doesn't matter what laws are in place, the federal government can do whatever it wants. I'm actually to the point now where anytime I hear anyone associated with the government supporting A, or insisting that A is true, that I take it to mean that the government intends to do Not A or that Not A is true.
I don't have a college degree, but I'm going to encourage my children strongly to get their own. Not so that they can get better jobs in the US - so that they can take up legal residence in Canada.
Web 2.0 == Giant Blogspam Circle Jerk
Congress passes laws all of the time that it has no constitutional authority to enact. The states should just flat out ignore these laws and go on their merry way. If the feds try anything, many states have more than enough law enforcement capabilities to overpower federal law enforcement and the loyalty of the guardsmen in the NG is going to be first and foremost with their families and communities.
The states need to start knocking the feds down a few notches on the totem poll through things like not taking mandates, arresting DEA agents on capital murder charges for killing people in no-knock raids and things like that.
Seriously though, it's a shame they'd override the states rights. The only reason most data thefts see the light of day nationally is a California law that makes them do it. If you live in California, the company is required to notify the effected people that their data was mishandled.
If they want to encourage tighter security, seems like bad PR for a whole company is at least as effective as sending some dork to Federal PMITA prison.
I haven't looked up the numbers but I'd bet the penalty for having a stolen database would be worse than actually stealing one.
If 30% are foreigne students, they are not citizens, then the 10000 count is really 7000.
But we dont expect politians to have a brain cell bigger than a turtle.
Come on gen-xers, if your dad is a evil polly, tell him to get a clue.
Liberty freedom are no1, not dicks in suits.
Hey, this could be a good thing. They're probably just making sure that everyone is protected. I mean, why do we need to know? We are the government!
There are already many laws on the books that basically say to the people: you don't have any right to know about (fill_in_the_blank). What's one more? Want to know why you're on a do not fly list? Sorry, can't tell you that. Want your congressman to investigate exactly how far the president's seceret domestic program goes? Sorry, you're not allowed to know that. Want to know why gubmint investigators are snooping around your life? Sorry, can't tell you that. Want to know what crime they are going to charge you with? Sorry, that's none of your business. Want to know why the feel the Constitution doesn't apply anymore? Sorry, none of your business. Want to know exactly who they consider a terrarist? Sorry, you don't need to know that. Want to know if the gubmint has broken into your home looking to plant evidence against you? Sorry, you don't have a right to that information.
Well fuck that. If Americans are willing to cede so much control to the gubmint and don't give a damn enough to see to it that the people who say "trust us" can actually be trustes then they deserve every single damn thing that happens to them, and I count myself among them, unfortunately. Democracy and freedom. Government of the people, for the people and BY the people. It was nice while it lasted. Now, back to a century or 2 of tyrrany I guess.
Before you go, you should know a few things about the place:
Other than that, it's basically a great place for a vacation. I know some people who went down there on vacation in the mid 1980s, and still plan on going back home to the states someday.
--MarkusQ
This law could potentially allow companies to circumvent and undermine state laws designed to protect consumers from identity theft.
I thought Republicans believed in state's rights. Silly me.
All the government needs now is some hackers.
If this means jail time for the "top" several hundred spammers and scammers on counts of identity theft alone, this is only welcome - and actually at least a decade late!
Crime is best fought by apprehending the criminals, not by gag orders on the organisations who happen to have held enabling information in an insecure manner - which would make it even harder for the individuals affected to show they are completely innocent victims rather than crooks.
Step 1: Body Connected to Government goes snooping. Repugnican Corporate\Religeous program out on a spree.
Step 2: Idiots are caught and can't brow beat or threaten their way out of dilemma.
Step 3: Before courts can come into play Government connected body tells Fed about their break in of Database.
Step 4: Fed miraculously shows up with law in hand punishing victimized database for not telling them.
Step 5: Law requires victemized database not tell teh world about Repugnican Corporate\Religeous program.
Solution:
Friends of the earth ask anyone living here to vote. And to never vote for a Republican.
Vote for any politician who improves the democracy at home first.
The biggest problem that I have with federal legislation is that it usually falls short of providing real protection to victims. Big business lobbies Congress to pre-empt existing state laws, such as California's, which do require notification of potential victims. So much for the Republican rhetoric about Federalism (state rights--look it up). This is one place I don't want to see interference from the current Congress.
signature pending slashdot approval
...are they going to protect us from the secret gov't data collection, done without notice or warrants?
"...requires companies to inform federal law enforcement agencies if a database containing information on more than 10,000 citizens is infiltrated by hackers."
I've been hearing recently of the possibility that a huge hacking organization will be hacking into every database and monitoring customers continuously. I think the group is called something like the NSA or CIA or something. But they use some kind of social-engineering attack by repeatedly entering "terrorism" as the password.
Point noted. Obviously you're refering to the most recent case. However two things. One phone numbers belong to the phone company, not the customer. Two most people as part of getting phone service usually sign something that allows them to turn customer info over to the government. e.g. my ISP has that as part of it's TOS. Three, were were you when the FBI was tapping phone lines? Bitching NOW about government intrusions when there was plenty of it in the past is hypocritical. Fourth, apparently no one was troubled about government intrusion when it was the Mafia we were going after.
The above post brought to you by the Costa Rica tourism board.
If they really wished to stop all of these systems being broke into, then they would publish the info.
If you follow all the systems that are currently broken into, you will find that it is nearly always one OS.
Also, DOJ should consider following SK's example of prosecuting companies that show that they did not do all that they could. One interesting effect of that law, is that Windows is being dropped left, right, and sideways in SK and companies are moving quickly to Unix, linux, and mainframes.
"...requires companies to inform federal law enforcement agencies if a database containing information on more than 10,000 citizens is infiltrated by hackers .."
What about _government_ databases that get comprimised? I think the public should be informed whenever one of those get "infiltrated by hackers", especially since the public is the government's primary paying customer.
RFC2119
I wish Americans were allowed to know when there was a breach of their privacy by the government for "terrorism" without having to be notified by reporters.
Maybe a note "Hey, we are wiretapping everyone and recording who you call for data mining"
If you don't vote, you don't matter, so don't waste your time telling me your opinion
Sounded like a good idea from the first sentence or so. And then in typical congressional style, the more you read of the bill the less you like it. Makes you wonder if that's how the bills are written... starting out with a good noble cause, and being slowly, thoroughly perverted by the special interest groups until it's a seething pile of trash to be voted upon.
I work for the Department of Redundancy Department.
Well, after RTFB, I've changed my mind about this *slightly*.
The bill says, in effect, that if any state laws that require public notification might hinder a federal investigation, then the notification would be suspended for 30 days or until it is deemed not to be an impediment to investigation. Of course, such an investgation could drag on for several months or years before the federal investigators deem it safe to notify the public.
Otherwise, I'd say that the bill is, in spirit at least, attempting to get a handle on the problem of identity theft due to stolen SSNs (issued by a government administration). Its debatable, however, if this is the right way to go about solving the problem.
While I understand how this may help in apprehending those involved in identity theft, I don't see this as any real step towards fixing the problem.
Perhaps it would be better for the government to punish businesses who use SSNs for identification purposes (which they are not supposed to be used for), and force them to use some other identification method. Though, short of starting a national ID system (which the gov is bound to foul up big time), I'm not aware of any decent method of tracking individuals IDs reliably.
However, my personal viewpoint is that <flame>the US government has become much to bloated, and is being micromanaged to death by legislation that will only lead to tyranny.</flame>
A few things about this is troubling given the timing.
Why are we, the public, not to be informed about data breaches impacting our personal information? Did the govt. recently discover or predict that companies they hired to mine our data might (or did) have a data breach involving at least 10,000 people?
Just this week, we had the 3rd highest ranking CIA official's home and office raided by the FBI.
And now, this proposed law seems it is specifically designed to prevent companies from disclosing data breaches that are caused by govt. agencies even if the breach is in violation of laws.
What prevents this law from being abused?
If the govt. didn't have so many corruption scandals and if Joe Wilson's wife wasn't "outted", then I'd have no problems whatsoever with them knowing my phone records.
Another thing nobody is talking about in a related issue (govt. keeping phone records) is whether or not those phone records include Jack Abramhoff, Duke Cunningham, or Scooter Libby!
But under the circumstances:
1. do you have confidence the govt. will sufficiently protect your records from data theft? did you ever see the grades received by departments regarding their data security? (think of FEMA not getting even a C-)
2. do you have confidence the govt. will not abuse or misuse your records? this week, it was reported that a govt. official canceled a contract when the company official made a comment about not liking Pres. Bush--what if our phone record shows a call to a friend's house and they have a teenager who calls a bunch of anti-bush groups? Do we automatically get flagged as a bush-basher and will that cause us financial harm by having doors closed on us?
3. do you have any confidence the govt. will treat everyone's record equally? for example, do you think they will keep the phone records of Jack Abramhoff or Duke Cunningham or Scooter Libby and make them available to every law enforcement agency requesting those records? Much more importantly, do you think they'll run data mining programs to make connections and diagrams of those people's "circle of friends" the same way they'd do so with our records?
What are the odds that collecting the phone records of American citizens will improve our security more than preventing the flood of millions of ILLEGAL aliens across our borders? Think about that. They bring up "we're in a state of war" when passing laws that spy on ordinary US citizens but they totally neglect "we're in a state of war" when discussing their failure to secure our borders against MILLIONS of law-breakers coming into our country.
This bill stinks. Companies that lose our records should be required to inform us that the theft happened so we can take preventive action against fraud. There is no good reason for the govt. to prevent companies from informing the public.
It always confused me to think that the party that fought a war against state's rights 150 years ago became obsessed with them some 50 years ago. Apparently we've now come full circle, as the CAN-SPAM act, this act, and probably some others I can't think of / don't know about.
Have you been touched by his noodly appendage?
"allows federal law enforcement agencies to prevent companies from voluntarily disclosing information about breaches to the public"
This is more likely to allow the Feds to keep quiet their OWN thefts of personal data from companies. "Hey Bob, we were auditing Scumco's computers on that fraud case, and we found they keep wicked sweet personal details of their customers". "Great, shoot me a copy, Bill, I'll throw them in the pot. And cc a copy to 'The Decider'."
There's probably enough money between all of us to buy a nice cruise ship, sail into international waters, and make our own good laws! The perfect, sensible country.
What do you guys say? Someone start the wiki to start planning this.
So Sensenbrenner requires corporations to disclose ID leaks to the government - that's to Sensenbrenner. He also requires every American to have a government ID, which can be leaked. Sounds like Sensenbrenner is building his own database to exploit, maybe when he retires, or just runs for reelection again - paid for by bribes from corporate ID leakers.
--
make install -not war
How do you know that a breach occurred? OK, in a few cases there are system logs, but there are bazillions of compromized Windoze machines out there, leaking information all the time. Does every crapware infestation found by Spybot S&D count as a data breach? It probably should.
Oh well, what the hell...
This law could potentially allow companies to circumvent and undermine state laws designed to protect consumers from identity theft. Speaking as someone who works in the security field, this is one of the most ill conceived bills imaginable. Most network management organizations are stretched thin, constantly being beaten up over outages and in no mood to take on additional work. Companies have to have strong economic or criminal penalties to offset this situation or it will not change. The ONLY reason companies are starting to take an interest in security issues now is because of the state laws forcing disclosure and acts such as Sarbannes-Oxley and Graham Leach Bliley that have real teeth in the form of criminal penalties for CEOs. I'd support this sort if legislation is if disclosure was mandatory within a short enough period of time to allow for lawsuits. That is enough pressure to start forcing real attention to security needs. As it is, this looks more like a corporate lobbying effort to reverse the state trends than progress.
[The] summary makes it sound like they can circumvent state legislation. Um, my constitutional skills may be a little rusty, but I'm pretty sure that's what the 10th Amendment was all about.
This is pretty clearly regulation of interstate commerce -- and thus very much constitutional, so the 10th amendment does not apply. If it is constitutional, it trumps state law because of the Supremacy clause.
(FWIW, I agree with your first four paragraphs.)
LandruBek
$META_SIG_JOKE
I heard someone else talking about the same topic (direct election of senators somehow being a problem) the other day - I'm finding myself ignorant on this topic and not understanding.
Can someone please explain how taking the vote for senators out of the hands of people and placing it in the state government will help things? My mind is open on this one. Not slamming the idea, just not understanding how it will help anything.
What is this SK you are speaking of?
Steven King?
Super Kmart?
Saskatchewan?
Scandanavia?
Hard to follow an example when you cannot follow the example, as it makes no sense. SK?