Slashdot Mirror

← Back to Stories (view on slashdot.org)

Senate Introduces Strong Privacy Bill

Posted by samzenpus on from the protect-yourself-at-all-times dept.

amigoro writes "US Senators introduced a bill that better protects the privacy of citizens' personal information in the face of data security breaches across the country. Key features of the bipartisan legislation include increasing criminal penalties for identity theft involving electronic personal data and making it a crime to intentionally or willfully conceal a security breach involving personal data."

20 of 176 comments (clear)

  1. A little late isn't it? by AltGrendel · · Score: 3, Insightful

    I thought that horse was already out of the barn.

    --
    The simple truth is that interstellar distances will not fit into the human imagination

    - Douglas Adams

    1. Re:A little late isn't it? by mr_matticus · · Score: 5, Insightful

      A few horses are out of the barn, but that doesn't mean someone shouldn't close the gate to keep the rest in.

    2. Re:A little late isn't it? by mfh · · Score: 4, Funny

      I thought that horse was already out of the barn.

      I'm sorry to inform you, sir, that your horse had to be sent to the glue factory. Please sign here.
      --
      The dangers of knowledge trigger emotional distress in human beings.
    3. Re:A little late isn't it? by TheMeuge · · Score: 4, Insightful

      I am just wondering when there will be a bipartisan legislative effort to institute mandatory minimums for violation of the constitution by congress or the executive.

  2. Fix it the right way by Anonymous Coward · · Score: 5, Insightful

    Why isn't it fixed the right way? If the use of Social Security numbers by non-government agencies was ended then much of this would fix itself. Each company would likely pick a different number/id for each individual and it would partition the information. Then, stealing a single number wouldn't give you access to an entire individual.

    1. Re:Fix it the right way by mwilliamson · · Score: 4, Insightful

      The SSN should be only considered as a gov't assigned userid. The government should now issue everyone in the USA a password and provide a government sponsored pluggable authentication system anyone could use for their company. Those using this system to authenticate customers would fund it. Password reset would be available at SSN offices only with verified photo ID. Lets end this bullshit once and for all and empower the end user to protect their identify credentials via at least a password, maybe even a RSA dongle.

    2. Re:Fix it the right way by Silver+Sloth · · Score: 3, Insightful

      Err... We Brits have exactly that. If you hack one of my bank accounts you haven't hacked them all. There is no reason for any one of my credit cards to know, or have anything in common, with any of my other credit cards. It works fine for us, we're not confused, credit report agencies work as well here as they do anywhere, and tax avoidance isn't a particular problem

      I am not a number, I am a free man!

      And long may it remain that way.

      --
      init 11 - for when you need that edge.
    3. Re:Fix it the right way by nasor · · Score: 5, Insightful

      A much better solution would be for companies to simply stop pretending that knowing a social security number somehow magically proves that you are who you claim to be.

  3. Won't Stop Hackers, Might Scare Hackees by gbulmash · · Score: 5, Interesting

    I think the more important aspect is the increased penalties for willfully concealing a security breach. Increasing criminal penalties is of varying value. One of the reasons criminals commit crimes is because they think they won't get caught, so whether they risk 2 years in jail or 4 isn't going to matter that much to them.

    But increasing penalties for willfully covering up a data breach may have more effect. As we've seen, bigger breaches cannot be kept secret for long. There are too many ways for them to be ferreted out. Furthermore, the people who would be in a position to conceal a data breach are often people who are more afraid of jail than those who willfully commit crimes like identity theft.

    Of course, what I'd really like to see is a death penalty for spammers.

    - Greg

    --
    Start a happiness pandemic
  4. So what are the implications by o'reor · · Score: 3, Insightful

    concerning whistleblowers who want to draw attention on possible security breaches inside a company, and who've been hit on hard both by corporations and justice every time it happened so far ?

    --
    In Soviet Russia, our new overlords are belong to all your base.
  5. I hope the secondary effects ... by Ihlosi · · Score: 3, Interesting
    ... are better than what is in the actual legislation.



    Key features of the bipartisan legislation include increasing criminal penalties for identity theft involving electronic personal data and ...



    Great. Increase the penalties. That's not really going to deter the criminals, they operate on the thought that they don't get caught.

    ... making it a crime to intentionally or willfully conceal a security breach involving personal data.



    Also great. How about prohibiting the collection and storage of data that is not necessary for business transactions in the first place ?



    One can just hope that companies will think a little more about what and how much data they collect and store.

  6. Would not pass. by EveryNickIsTaken · · Score: 4, Insightful

    The bill would increase oversight of government programs to collect personal information on citizens. I wouldn't expect this bill to move anywhere right now, with the 2008 presidential candidates starting to gear up. Nobody wants to vote for a bill that would "Let the terrorists win."

  7. Make It Cost Prohibitive To Store Too Much PD by Anonymous Coward · · Score: 5, Interesting

    A fundemental personal privacy/personal data concept that should be the basis of all laws governing how businesses and governments handle and are responsible for personal data should be liability for PD loss/leakage is directly proportional to the amount of PD per individual.

    For example, your company leaks:

    1) Addresses
    2) SSN
    3) Email addresses

    That will give you three times the liability of a company that leaks:

    1) Address

    Make it financially worthwhile for companies to store the absolute minimum PD necessary to operate their business and to create the incentive to delete all unnecessary data at the earliest opportunity.

    With storage so cheap and the liability for companies or governments essentially divorced from the actual damage done to personal privacy breaches there is absolutely no reason for any company to store every bit of PD about you on their(insecure) systems.

  8. Enforcement, not new laws by imag0 · · Score: 5, Insightful

    I happen to deal with a lot of regulated information (PHI with HIPPA, PCI in some environments as well). One thing that always astonishes me is not that security breaches happen (we're human, things happen), but that there is little to no reported repercussions from those losses.

    It's one thing to have a security breach, but it's another one just to announce it, issue new cards to everyone and keep on working like nothing happened.

    I think the best thing would be that the gov steps up to the plate and actually *enforce* the current laws and not spend our time and taxpayer money to create a new raft of laws that will end up never getting enforced in the first place.

    Cheers,

    imag0

  9. Just an empty gesture by 140Mandak262Jamuna · · Score: 3, Insightful

    Nothing will come out of Senate to increase privacy. Remember CAN-SPAM act and how it stamped out all the spam emails? This bill will protect privacy exactly the same way. If you think this bill will improve privacy, contact me. I have 22 million dollars stuck in a bank in Nigeria. Help me get it out I will give you 33% of it. Please dont be greedy and steal all that 22 million dollars from me. OK?

    --
    sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
  10. Re:wait a minute, I'm confused by gbulmash · · Score: 5, Insightful

    Isn't this the Republicans domain, increasing privacy?

    Are you being sarcastic?

    The Republicans have always positioned themselves as champions of law and order, and their favorite tool for it is intelligence gathering. Things like the Patriot Act as well as the warrantless wiretapping controversy just prove that out.

    Both parties like to pick and choose which civil liberties they defend and which ones they attack in the name of fighting crime. While the Republicans are big on intelligence gathering at the expense of our right to privacy, the Democrats are big on gun control at the expense of our right to bear arms.

    --
    Start a happiness pandemic
  11. A few horses are but OMG Ponies!!! by Anonymous Coward · · Score: 5, Informative

    This doesn't do a lot for privacy. It still permits widespread snooping, selling of information by commercial entities, etc.

    It does nothing for example to the recent FBI snooping case:
    http://yro.slashdot.org/article.pl?sid=07/01/30/15 8227

    Where the FBI has been found to capturing all an ISP's traffic, then filtering as needed to match the warrants they had. (The argument for that is bogus, if the FBI can do the filtering then the ISP could do the filtering. It's some sort of game to remove the 'minimization' requirement for search warrants.)

    Nothing to stop logging of everything you do. Nothing to stop AOL or Google collecting search information, which as we found can be used to identify individuals:
    http://news.com.com/2100-1030_3-6102793.html

    The gate isn't closed, they're proposing to part close it. Better than nothing, but only a little better.

  12. I don't want a new privacy law... by caudron · · Score: 4, Interesting

    ...I want a new Privacy Amendment.

    Seriously, Privacy is a right (according to SCOTUS) but currently the right is in limbo. The limits and effects are mercurial and need to be codified.

    Also, I'm far more worried about breaches of privacy by the government than by ID thieves. Shore up my Right to Privacy properly and I'll feel a little better about things. Adding sentencing recommendations to ID theft cases is like hate crime statutes. I'm not /opposed/ to an extra small smackdown for certain crimes (maybe...I admit to some uncertainty here) but I'd rather have a RIGHT to tell the phone company to play a game of Hide and Go Fsck Yourself when they ask for my SSN, for instance. Bonus points if I can get the right to do the same to the US Government when they don't /actually/ need it.

    Tom Caudron
    http://tom.digitalelite.com/

    --
    -Tom
    1. Re:I don't want a new privacy law... by elrous0 · · Score: 3, Funny
      It's a sad day when the Attorney General of the United States can get up in public and openly proclaim that U.S. citizens don't have a right of Habeas Corpus. Forget the corporations, protect me from *HIM*!

      -Eric

      --
      SJW: Someone who has run out of real oppression, and has to fake it.
  13. Re:That's a myth. by homer_ca · · Score: 4, Insightful

    The myth of social mobility in the US is the relief valve that prevents violent revolution. We know rags to riches stories happen, but it's so rare that it very probably won't happen to you. Still, we see stories all the time, whether it's entertainers, athletes, lottery winners, or someone who got lucky with a small time business deal. As long as people think there's a chance for themselves, that the game isn't rigged, they won't turn against the system. I've seen my share of rags to riches stories since I went to some good schools growing up. There were a lot of smart kids from poor or ordinary families who got a chance from financial aid and merit scholarships to join the elites. There were even more smart kids from upper middle class and rich families who were already elite.

    So next time someone points to a rags to riches story to show that hard work pays, get ready to call bullshit. If you're smart, talented and hard-working, you'll probably end up a little better than an average guy, but you won't get rich without a lot of luck. We may not have a rigid caste system or a formal system of hereditary nobles, but don't pretend that privilege doesn't exist.