Slashdot Mirror


Governator Kills Data Protection Law

eweekhickins writes "The Governator has killed a recent data protection law in California, and it won't be back. Using a tried-and-true argument, that the bill would have 'driven up the costs of compliance, particularly for small businesses,' California Governor Arnold Schwartzenneger vetoed what some are calling one of the nation's most stringent proposed e-tail data breach security laws."

177 comments

  1. Subscriptions by mastershake_phd · · Score: 3, Interesting

    But it also outright prohibited much data being stored at all after a purchase is authorized by banning a retailer from storing "sensitive authentication data subsequent to authorization, even if that data is encrypted."
     
    What about automatically recurring bills, like web hosting.

    1. Re:Subscriptions by GomezAdams · · Score: 1

      The bill was directed to retailers. Is your ISP a retailer? The article is not all that clear about the target but by 'retailer' it seems this is about the local iHop, No-Tell Hotel, or Victoria's Secret storing your credit card and any address, phone number, SS# info way past the authorization cycle. Having a mortgage, auto payments, and a monthly charge for services (I pay an annual fee for my web hosting) would be normal usage of customer data, but a retailer does not require any bank/credit card info after they receive the money for their product.

      --
      Too lazy to create a sig...
    2. Re:Subscriptions by mastershake_phd · · Score: 1

      The bill was directed to retailers. Is your ISP a retailer?

      Well that depends on how the bill defines "retailer".

    3. Re:Subscriptions by multisync · · Score: 1

      but a retailer does not require any bank/credit card info after they receive the money for their product.


      Same goes with brick and mortar stores.

      Once the transaction is complete all they need is a receipt with your signature and the Authorization Number on it. But try telling that to your typical wage-slave working in a retail store.

      When paying by credit card, I am frequently annoyed to find my complete credit card number printed on the retailer's copy of the receipt, along with my name and the expiry date. When I scratch the number out, the clerk will often argue with me and insist that the full number is needed on their copy.

      London Drugs does this - at least in Canada - while at the same time posting large signs in their stores with helpful tips on avoiding identity theft.

      --
      I don't care why you're posting AC
    4. Re:Subscriptions by Attila+Dimedici · · Score: 3, Interesting

      It has been a few years (late 90's) since I worked retail. However, I worked for a retailer that for various reasons people forgot that they had purchased things from with their credit card. The customer would get their bill and see a charge from our store on it. They would call the credit card company and contest the charge. The credit card company would send us a letter asking for the signed receipt for charge against Credit card # xxxx xxxx xxxx xxxx (where the x's were the number on the card) from such and such date. If we did not send it to them within a given amount of time, they would issue a credit to the customer and charge us the amount that we had received against that card. SO, at that point a retailer did need a copy of the customer's credit card # for at least two months after the purchase.

      --
      The truth is that all men having power ought to be mistrusted. James Madison
    5. Re:Subscriptions by Anonymous Coward · · Score: 0

      I'm not sure if this is a NY specific law or a federal law, but as of a few years ago, it is illegal to print the full credit card number on receipts. Last 4 digits, transaction authorization number and card holder's name under the signature line is all of the identifying info on the receipt.

    6. Re:Subscriptions by Qzukk · · Score: 1

      What about automatically recurring bills, like web hosting.

      They would demand that their CC processors issue them an encrypted token after the initial transaction that identifies the pair (company,creditcard) and can only be used for transactions involving that pair?

      --
      If I have been able to see further than others, it is because I bought a pair of binoculars.
    7. Re:Subscriptions by Anonymous Coward · · Score: 2, Funny

      Well that depends on how the bill defines "retailer".
      Here in Texas, we define ISP retailers as copper chomping wallet vampires.

      \\//_
    8. Re:Subscriptions by GlassHeart · · Score: 1

      No, you don't. All you need is a transaction id that the credit card company would issue you when you charged the card. (I have no idea if this id is in place, the point is that you don't actually have to store the sensitive card number.)

    9. Re:Subscriptions by cdrguru · · Score: 1

      Sorry, but every Internet merchant is a "retailer".

      Subscriptions aren't the point. This would have required eliminating the model where you trick someone into paying for shipping for something that is otherwise free just so you can continue to bill then month after month for the rest of the collection. Video Professor is one example of this. Not that this would have been all that bad a deal, but it doesn't sound like an intended consequence.

      There are also plenty of other service-related "retailers" that do reoccurring billings to credit cards. This would have ended this practice as well.

    10. Re:Subscriptions by einhverfr · · Score: 1

      First, this is nothing new. THe PCI-DSS makes an identical requirement.

      Basically, can't store PIN, CVV2, or CVV values. This means that for recurring bills, you can *only* use AVS which isn't so sensitive (basically street number (not name) and zip code.

      In an ideal world, this would be done via the authorization code (tied to the merchant account!) rather than the credit card number, but not all processing gateways support this yet.

      --

      LedgerSMB: Open source Accounting/ERP
    11. Re:Subscriptions by Anonymous Coward · · Score: 0

      I call BS on this.

      I have been to Texas and I am fairly sure that there are no ISPs there.

      If there are, then in Texas they have a different name to confuse the Yankees and Coonasses and perhaps even the Aggies (Do y'all still make fun of them too?)

      Posted Anon to protect my sweet Canadian ass from any more Texas abuse

    12. Re:Subscriptions by Anonymous Coward · · Score: 0

      This text seems like a bad idea all-around. What if I was a retailer and I needed to store transaction data so that I can adjust the parameters of a transaction or issue a refund against a previous one at some point in the future?

      Would this bill have prevented me from doing so? If you want to curb phishing help people grow a clue or do something about the botnet situation... People need to choose their battles carefully and do what will get them the most bang for their buck without causing collateral damage. I don't believe the bill our governer rightfully vetoed met either one of these ideals.

    13. Re:Subscriptions by jimicus · · Score: 1

      How useful that is depends on what grounds the customer is contesting it.

      If the grounds are "somebody's cloned/stolen my card and is making transactions on it", the authorisation code is useless - you need the slip that the customer has supposedly signed.

      (Of course, the fact that the signature is thoughtfully RIGHT THERE ON THE BACK OF THE FREAKIN' CARD FOR A FRAUDSTER TO COPY AS THEY PLEASE is not relevant to this case. Honest.)

    14. Re:Subscriptions by hoooocheymomma · · Score: 0

      "This bill, on and after July 1, 2008, would prohibit a person, business, or agency, as defined, that sells goods or services to any resident of California..." Uh... It seems pretty clear that it covers more than "retailers."

    15. Re:Subscriptions by NeilTheStupidHead · · Score: 1

      The parent already stated: they're called CCWVs in Texas.

      --
      Lose: misplace or fail || Loose: not bound together
    16. Re:Subscriptions by jpastore · · Score: 0

      You should never be storing credit card info unless you are PCI compliant. see: http://www.pcicomplianceguide.org/

      If you need to rebill credit cards you merchant processing gateway should have a rebill module so they can store the info and send you a report of what what cleared and didn't.

      It doesn't matter what the law says...it matters what Visa and MasterCard say in their merchant processing agreement to you or provided to you. If you don't like it go do business with the other Visa and MasterCard.

      AMEX and Discover also have similar guidelines...

    17. Re:Subscriptions by cybergenius1 · · Score: 1

      I program retail software and we are required to follow PCI compliance rules. These rules, now much more public since the TJ Maxx incident, state that no clear text format of the credit card number can be stored in any file. For auditing purposes or to verify a purchase on a card we use RSA 1024 to encrypt the credit card number and store it in a transaction file. The only way to get that number is to have the key to decrypt. Other methods include doing a 1 way hash on the card number, or simply masking the card data. Another way to store the data is within a binary file that uses some sort of hashing algorithm to store the data. We call these keyed files. They can't be opened and read, you would need our algorithm to locate the data and properly read it. These simple steps are enough to deter credit card thieves. It would be too much of a hassle to try and figure out the numbers. I think any business that deals with sensitive information such as credit card data should be encrypting that data. It should not be easily accessed. I think its up to the businesses to make transactions secure for their customers.

      In response to your comment, there are definitely times that the retailer needs that number to verify a purchase with a credit card company and public key encryption is the way to go. That way the number cant be seen by those who don't have reason to be seeing it, but available through decryption if need be. In the slim case that we cant decrypt, the 1 way hash is a backup. A hash will always be the same for a card number, but you cant de-hash the number.

    18. Re:Subscriptions by Anonymous Coward · · Score: 0

      "SO, at that point a retailer did need a copy of the customer's credit card # for at least two months after the purchase."

      Two months is an absolute minimum. Part of my job involves dealing with this sort of issue and claims can show up from 6 months back or longer. We were also recently subpoenaed to provide receipts from two years prior as part of an investigation. And state tax laws may require one to keep some data for many years (I believe it's 7 years in my state).

    19. Re:Subscriptions by alan_dershowitz · · Score: 1

      I've seen this up to even a few years ago. We are now provided with a partial number, either four or six digits depending on the card company.

    20. Re:Subscriptions by multisync · · Score: 1

      You need the slip that the customer signed, but not his complete credit card number. On that slip the customer signs, there is an authorization number that the credit card company issues when they approve the transaction. That authorization number and the signature are both on the same slip, and they are the retailer's way of protecting themselves. Printing the customer's complete credit card number adds no benefit to any party, and puts the customer in danger of identity theft.

      As to your point about the signature, yeah, that's funny, isn't it? I started writing "photo ID required" in the sig area of my credit cards. If they ask for my photo ID, they also get my signature and they have verified my identity. Everyone wins.

      Of course, even with this written exactly where they are supposed to check your signature, I was only asked like one in ten times. It was always a little treat, to actually be asked. Some people think they are doing you a favour by not asking, like it's an embarrassment to ask a customer for ID. I had a pizza delivery guy almost fall over backing away from me as I thrust my D/L at him, saying "No no no ... I trust you." I said don't trust me, check. It's for my own good. But he wouldn't.

      Anyway, then I heard some credit card companies were instructing merchants not to accept cards that had this written in the signature are because this is also how the customer agrees to the terms of the contract, so the card is not valid without a "proper" signature. So I got our receptionist at work to print the part about photo id on a sticky label and I pasted it on the back of my credit card, right beneath the signature. Still, I'm rarely asked for photo ID, even when the clerk actually looks at my signature. I wonder sometimes if they are just worried about a confrontation if the card actually is stolen. But when I worked in retail, we were told to always get photo ID with a credit card or cheque.

      Who knows. Sorry to rant.

      --
      I don't care why you're posting AC
  2. First example: Slashdot! by Spy+der+Mann · · Score: 2, Funny

    404 File Not Found
    The requested URL (yro/07/10/15/2043242.shtml) was not found.

    I guess the above isn't illegal anymore, right Taco? ;-)
    1. Re:First example: Slashdot! by Anonymous Coward · · Score: 0

      The Slashdot Funding Bill is passed. The system goes on-line Sept 1997. Human decisions are removed from news for nerds. Slashdot begins to learn at a geometric rate. It becomes self-aware at 2:14 a.m. Eastern time, September 29th. In a panic, they try to pull the plug, but too many simultaneous HTTP requests made that impossible for a few hours. A T-800 was sent back to create some mirrors, but fails.

  3. "Governator"? Are we in 6th grade here? by Tetsujin · · Score: 4, Insightful

    C'mon, I mean, seriously - whether or not you respect the man he has a name and a title, and you've used neither...

    --
    Bow-ties are cool.
  4. "Kill" a law? by Jugalator · · Score: 4, Funny

    How do one "kill" a law, really? Bah -- surely, Arnold must have terminated this law.

    --
    Beware: In C++, your friends can see your privates!
    1. Re:"Kill" a law? by mangu · · Score: 2, Funny
      Arnold must have terminated this law.


      Yes, but he himself said "I encourage the author and the industry to work together on a more balanced legislative approach,"


      In other words, the law'll be back...

    2. Re:"Kill" a law? by Anonymous Coward · · Score: 0

      Of course. Just wait 'till he terminates Skynet...
      Remember: Judgement day is inevitable.

    3. Re:"Kill" a law? by Opportunist · · Score: 1

      In other words, the law is for sale.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    4. Re:"Kill" a law? by pintpusher · · Score: 1

      Come on, you remember the little guy sitting on the steps, "... yes I'm only a bill..."

      well, what happens is some fat dude comes out of the capitol building, grabs that little guys and starts bellowing something about "what's your function!" and then proceeds to rend him to little shreds and then stomps off stage right.

      --
      man, I feel like mold.
    5. Re:"Kill" a law? by tesmar · · Score: 0

      He should not have terminated a bill which would help to prevent his http://www.youtube.com/watch?v=mAsLEv9KISE stolen identity.

    6. Re:"Kill" a law? by Tablizer · · Score: 1

      How do one "kill" a law, really? Bah -- surely, Arnold must have terminated this law.

      California papers have by now stopped using movie puns in Arnold-related news articles. They used to be common, but I've noticed a drop. At least until model T-1000 politicians come out ;-)

    7. Re:"Kill" a law? by madbawa · · Score: 1

      No, its just been Erased. *BANG BANG*

    8. Re:"Kill" a law? by OldeTimeGeek · · Score: 1

      And this is why we should put Civics class back into schools... He didn't kill a law because it wasn't a law yet - it was just a bill.

  5. Look OUT! by HartDev · · Score: 0

    Grab my hand! You'll never have this data plan as long as I am around! No joke I think Arnold rocks!

    --
    To see a few of my Android apps goto: www.hartwired.com
  6. Re:"Governator"? Are we in 6th grade here? by Martin+Blank · · Score: 2, Insightful

    Indeed. This was old years ago -- before the recall election was even completed. It doesn't help that even when his name did appear, it was spelled incorrectly ("Schwartzenneger" as opposed to the proper spelling, "Schwarzenegger").

    --
    You can never go home again... but I guess you can shop there.
  7. Ah! The ads! by Anonymous Coward · · Score: 2, Informative

    Here's the printer friendly version, with (somewhat) fewer advertisements.
    http://www.eweek.com/print_article2/0,1217,a=217199,00.asp
    (posted as anon to avoid Karma whoring)

  8. Re:"Governator"? Are we in 6th grade here? by Anonymous Coward · · Score: 0

    Actually, he used both at the end of the news post. He did however misspell his last name.

  9. Re:"Governator"? Are we in 6th grade here? by Anonymous Coward · · Score: 0

    Oh, either relax and don't let it bother you, or go piss off. He may have a name and a title, but as everyone knows, a good nickname is much more important.

    Signed,

    Anonymous Coward.

  10. Re:"Governator"? Are we in 6th grade here? by Anonymous Coward · · Score: 0, Flamebait

    Yes, Mr. Shitforbrains.

  11. Levels of Compliance? by nonsequitor · · Score: 3, Insightful

    Couldn't they redraft the law such that there are several levels of compliance. If you deal with the info of less than 100 individuals you would have the least amount of requirements to meet, 1000 individuals would put you in the next level, and so on. That way the biggest targets are required to be the most secure, and the more information they deal with, the higher their compliance level would be.

    1. Re:Levels of Compliance? by PhrankW · · Score: 1

      Never happen Way too sensible. Phrank

    2. Re:Levels of Compliance? by MtlDty · · Score: 2, Informative

      Actually, thats the way it currently does work according to the PCI-DSS. There are four levels of compliancy, and although the compliancy points across all levels are similar, the accreditation is more difficult at the higher levels (requires certification from independant Qualified Security Assessor).

      I think most of the EFT industry sees this move by Arnie as the correct thing. The payment card industry 'PCI Co' (mainly Visa and MasterCard) already has mandated merchants must comply with the Data Security Standard. They also have the means to force non-compliance fees on merchants, through their acquiring banks.

      In short, there's no need to add layers of government bureaucracy to the mix - it would just cost the tax payer for something that the card industry should be able to manage, and add extra levels of confusion to what is already a difficult landscape of compliancy.

    3. Re:Levels of Compliance? by Anonymous Coward · · Score: 0

      > Couldn't they redraft the law such that there are several
      > levels of compliance.

      That would mean that customers who transact with smaller companies
      are at higher risk than those who buy from large companies. Why
      should customers face higher risk of fraud simply because owners
      of small companies are lazy?

      Small companies can't have it both ways -- they can't expect to
      ignore rules because they are ``hard to implement'' whilst at the
      same time requiring customers to adhere to rules. Maybe if I buy
      a product from a small company I should be able to withhold payment;
      after all, writing a cheque takes time and I am a busy person.

  12. Too much effort to comply is not an excuse by ravenspear · · Score: 5, Interesting

    Seems like a lot of companies out there today do not give the proper effort required to make even rudimentary considerations to the security of client data. This reminds me of an experience I had a few weeks ago. This is 100% true. I was sitting in a subway station waiting for a train. I sat down on a bench and noticed a plain unmarked vanilla envelope sitting on the bench next to me. There was no one else around so it was obvious whoever it belonged to had left it. I opened it and discovered it was several pages of customer records for a hotel chain (don't remember which). It had their names, what nights they had stayed, some additional information, and their FULL credit card numbers they had used to pay printed next to the names. I was amazed that someone would just leave this kind of information lying around anywhere for anyone to find.

    1. Re:Too much effort to comply is not an excuse by Deadstick · · Score: 1
      plain unmarked vanilla envelope

      Must make those in Mexico...

      rj

    2. Re:Too much effort to comply is not an excuse by ozphx · · Score: 2, Funny

      This reminds me of an experience I had a few weeks ago. This is 100% true. I work for a government agency doing sting operations against identity theives. We leave a plain vanilla envelope on a bench of a subway station containing fake customer records. If anyone opens the envelope then we give them a few days to report it.

      I'm amazed that it usually ends up in the phase where I roll down there with uniform and stick a nightstick up the suspects ass. They never see it coming!

      --
      3laws: No freebies, no backsies, GTFO.
    3. Re:Too much effort to comply is not an excuse by ravenspear · · Score: 1

      haha ok but, you're forgetting the third and most likely option. They don't report it but they also are not identity thieves. I just shredded it and threw it away.

    4. Re:Too much effort to comply is not an excuse by Anonymous Coward · · Score: 0

      Are you fucking serious?!?!?!?!

    5. Re:Too much effort to comply is not an excuse by conteXXt · · Score: 1

      Because we all know the "Manila" ones come from Thailand?

      Just kidding they are all made out of recycled Canadian newspaper.

      --
      The truth about Led Zep should never be told on /. (Karma suicide ensues)
    6. Re:Too much effort to comply is not an excuse by Anonymous Coward · · Score: 0

      This is clearly a comment by someone who doesn't work in corporate America. I, as a developer at a financial organization (probably managing YOUR retirement, btw - yes, it's one of the big 3 mutuals), have more restrictions and compliance requirements placed on me that you can count before you die. For even the smallest little config change, I have to do roughly 40 HOURS worth of paperwork. This is just to change a timeout on my application from 5 to 6 seconds.

      Okay, so you're thinking to yourself - it's not so bad that this guy has to do 40 hrs of paperwork. His company, and his code, are managing my retirement money. They should make sure that code is right! Well, think about this. The SEC requires I do that same kind of paperwork and go through that kind of change control beaurocracy for emergency bug fixes too. Unless you're an idiot, you can't possibly think that audit restrictions will prevent bugs from occuring. So instead of being able to implement a fix for a bug in a matter of 15 minutes or less, we aren't able to implement a fix in less than an hour, and that's with cutting corners and doing as much after-the-fact documentation as we can. But you regulation whores are okay with the fact that your retirement fund just lost $10k because the SEC wanted to see a piece of paper documenting that my last meeting's minutes were approved, right?

    7. Re:Too much effort to comply is not an excuse by ozphx · · Score: 1

      This reminds me of another experiance I had a few weeks ago. This is 100% true. I saw this guy use parody in a thread, and the joke went right over this dumbass AC's head!

      HE NEVER SAW IT COMING!

      --
      3laws: No freebies, no backsies, GTFO.
    8. Re:Too much effort to comply is not an excuse by Anonymous Coward · · Score: 0

      That's amusing, because it actually just happened to you.

      I'll give you time to figure it out. I'll wait.

  13. "It won't be back"? by whoever57 · · Score: 4, Informative
    Perhaps the submittor or editor could refrain from lame jokes when said joke is in conflict with the article:

    Schwarzenegger, in his veto message explaining why he killed the bill, left the door open to possibly signing a reworked version of the bill.
    --
    The real "Libtards" are the Libertarians!
    1. Re:"It won't be back"? by johndiii · · Score: 1

      Not only that, but it passed both houses with a majority well in excess of that required to override the veto.

      --
      Floating face-down in a river of regret...and thoughts of you...
    2. Re:"It won't be back"? by Anonymous Coward · · Score: 0

      But, did he leave the BACK door open?

    3. Re:"It won't be back"? by Anonymous Coward · · Score: 0

      Slashdot is serious business.

  14. Re:"Governator"? Are we in 6th grade here? by Anonymous Coward · · Score: 0

    He must enjoy being called a black n**ger, as a part of some properly constructed sentence. :)

  15. Re:"Governator"? Are we in 6th grade here? by nuzak · · Score: 1

    Yeah, just prepending "California" or even just "CA" might have made it an eensy bit clearer. But hey, slashdot isn't about that pretentious "old media" with all its "accuracy" and "clarity" and "fact checking". Pshaw.

    I prefer "Gubenator", which sounds funnier when said with Schwarzenegger's accent, and it's actually the real latin word that "governer" comes from. But I wouldn't put that in a headline either.

    --
    Done with slashdot, done with nerds, getting a life.
  16. obligatory charlie brown by Anonymous Coward · · Score: 0

    There are three things I have learned never to discuss with people: religion, politics, and the Great Pumpkin.

  17. What is this "marketplace" that he speaks of? by khasim · · Score: 2, Insightful
    From TFA:

    However, the current version of the bill, Schwarzenegger said, "attempts to legislate in an area where the marketplace has already assigned responsibilities and liabilities that provide for the protection of consumers.

    So ...... prostitution and drugs should not be illegal because the "marketplace" can handle the problems?

    What you saw is a perfect example of why LEGAL restrictions are needed. If it is LEGAL for a business to print out such information, then it WILL be stolen, eventually.

    With the increase in "identity theft" it should be apparent to anyone that the "marketplace" is not capable of regulating itself.

    All a "marketplace" does is ensure that those with the most power KEEP the most power. And right now that is not the credit consumer.
    1. Re:What is this "marketplace" that he speaks of? by Rakishi · · Score: 1

      So ...... prostitution and drugs should not be illegal because the "marketplace" can handle the problems? Sure, why the hell not. Do you realize how much crime is caused by and public money is wasted on fighting both of those? We could probably provide welfare and free drugs to every single bloody drug user for less than it costs us now to deal with them in jail and in their gangs.
    2. Re:What is this "marketplace" that he speaks of? by Opportunist · · Score: 1

      Money is like energy, you cannot waste or eliminate it. It just gets transformed into something that might not be useful for you.

      In other words, don't worry, someone profits from it.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    3. Re:What is this "marketplace" that he speaks of? by StikyPad · · Score: 1

      So what are you "saying"?

  18. It's not just a "recall" ... by Slur · · Score: 4, Funny

    ... It's a Total Recall!

    --
    -- thinkyhead software and media
  19. It can be, if you want any small business by Sycraft-fu · · Score: 5, Insightful

    When you deal with small businesses you are dealing with few employees, few resources, and so on. As such what they can do is limited. Now if you don't like small business, fair enough, but then remember that the alternative is large conglomerates like Microsoft.

    So if you do want small businesses around, you have to make sure that you don't pass laws that force them out. For example, suppose you decided that in the interests of accessibility and such all businesses should be required to be able to take phone calls in any language that a sizable minority of Americans speak. So it turns out that companies need to support like 20 languages. For a large company, no problem, they grumble about it, hire more operators, raise prices and are done. A small business just shuts down, since they just cannot hire that many staff, even if they wanted to.

    Now that's not to say that small businesses need a free pass on everything, but having the attitude of "They need to do this, I don't care how hard it is," is what leads to them going out of business and you having to shop at Walmart and buy MS. Big companies can play the game and deal with the stupid laws. The small ones can be killed by it.

    1. Re:It can be, if you want any small business by Opportunist · · Score: 2, Interesting

      C'mon, be sensible. Keeping customer data reasonably safe is quite easy for small businesses. You have your POS with outsourced security (read: You bought some POS system that handles CC purchases for you). Your accounting needn't be on an internet terminal, that's something you do on a computer which can trivially be disconnected from the internet or anything else that could steal your data.

      If anyone, large businesses face problems with increased demands in security.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:It can be, if you want any small business by Sycraft-fu · · Score: 1

      Ahh, so what happens if you already own the system, and it doesn't meat the criteria. Just buy it again? What happens if it is then incompatible with your inventory? Just reenter it? Easy to say, less easy to do. I didn't read this bill, not relevant to me (I don't live in California) I am just saying that it is a perfectly legitimate argument against something that the costs are too high for small business.

      You have to consider the cost of your actions, and that includes legislatons. I dislike those who seem to hate large corporations, and yet want government regulation to the point that only those large corporations can exist. You have to accept that small businesses are often quite literally "mom and pop". A couple who owns a business and has a few employees. There are limits to what is reasonable to expect.

    3. Re:It can be, if you want any small business by CodeBuster · · Score: 1

      This is precisely why I generally do not do business with small businesses or if I do, then I pay in cash. The problem with small business is that they are well, small. They think small, they behave like amateurs (particularly in areas that are not part of their core business), and they usually provide no tangible benefit to a transaction while charging a higher price than larger businesses, especially at retail.

      Now having said that, if we are going to increase the regulatory burden then it should be increased first upon the providers of consumer credit who are all large corporations and have been dragging their feet for years on security because in the current legal and regulatory environment because insurance is cheaper. There is no incentive, or very little anyway, for credit card companies to substantially improve security as long as they are not perceived as being substantially worse in that area than their competitors (which are few enough since consumer credit is essentially an oligopoly). This is compounded by the fact that the general public has such a poor understanding of security that the credit card companies would rather pay lip service to security instead of actually spending money on something that most consumers have no appreciation of.

      If the merchant is required to store anything at all then it should merely be a transaction number (not the credit card number) which can be cross checked with the credit card processors in the event of an audit and the amount. The credit card processors will whine about having to store massive amounts of transaction data, but they have been earning massive profits on consumer debt for decades and would be seen as crying with two loaves of bread under their arms...they should be ignored.

    4. Re:It can be, if you want any small business by AK+Marc · · Score: 1

      What small business stores anything like this? They keep the recipts. They keep nothing else. The only place that takes a stamping of my card is CompUSA, and I don't think they qualify as small. The small businesses outsource everything. Often to the point that they don't even own the credit card terminal they use. They swipe and get a recipt they keep. All the other information is stored by some 3rd party on servers far far away. Unless by "small" business, you mean 100+ employees with servers and IT personnel already laying around, they aren't likely to keep credit card information at all. And if they are 100+ employees, they are big enough to be able to figure out how to do a little encryption.

      I think this is a case where the big businesses cried that it was harmful to the small businesses, but nearly all small businesses would have been compliant with few changes (and possibly most compliant with no changes at all).

    5. Re:It can be, if you want any small business by einhverfr · · Score: 1

      Actually, security is as big an issue for larger businesses. You have legacy systems built when nobody foresaw the sorts of security threats we have today, and a *lot* of data is still stored in them. Some of those systems probably store data no longer allowed by the PCI-DSS.

      The goal ought to be to help build awareness of PCI-DSS compliance and help all businesses become compliant.

      --

      LedgerSMB: Open source Accounting/ERP
    6. Re:It can be, if you want any small business by einhverfr · · Score: 2, Informative

      You are missing a very basic fact---

      If you have a noncompliant system today, whether or not this law would have been signed, and its problems resulted in the theft of a credit card number, your small business could be fined up to $500,000 by Visa/Mastercard.

      That is the cost (right now) of noncompliance. So the solution to your question is-- do your homework, evaluate what you have, and get the right system.

      --

      LedgerSMB: Open source Accounting/ERP
    7. Re:It can be, if you want any small business by scoot80 · · Score: 1

      Smaller business tend to be more focused on what they do, rather than large businesses which spread their tentacles in anything that makes money, and then do it badly. Plus, probably the majority of the business world is made up of small businesses.

    8. Re:It can be, if you want any small business by Tim+C · · Score: 1

      Now if you don't like small business, fair enough, but then remember that the alternative is large conglomerates like Microsoft.

      Nice false dichotomy there; obviously between small businesses (a handful of employees, maybe a few dozen) and ones the size of MS (tens of thousands of employees worldwide) there's a great big barren land in which no business exists or can exist.

    9. Re:It can be, if you want any small business by Opportunist · · Score: 1

      Bluntly? If you were dumb enough to buy an insecure data handling system, it's better you go out of business before you do damage to your customer's data.

      Again, think about it. What kind of customer data does the average mom'n'pop shop keep? If (and only if) they have CC payment, you already outsourced that. You have a POS terminal that you rent. This terminal is not your problem. It's the problem of the company owning it. You only get some receipt for your accountant. This receipt now has to go into a safe instead of some envelope that lies around. This is your increased cost.

      Your bookkeeping and other "digital" information you have about your customers is in a computer. This computer should be taken off the internet. So you can't surf while at work. Boohoo, cry me a river.

      If you're a small online store, you buy some CM/Sales system, you don't write your own, you don't have the manpower to do so. If you do, you hopefully also know something about security or you SHOULDN'T write your own! I don't really see why customer data should be put in jeopardy 'cause your nephew knows a bit about PHP and he could do it for free. Would you have your kid build you a brick'n'mortar store 'cause he knows how to put a few bricks on top of each other and it's cheaper than hiring a bricklayer, to hell with your customers if the whole crap crumbles over them?

      I agree in one thing, that it could actually increase the cost of running a store. But it's minimal compared to everything else that's there to protect your customer from damage. Hell, why not forgo every kind of customer protection? My cousin builds a shack where we do the biz, you let me copy all your CC info and give me full power over your account, 'cause that POS CC swiper costs my money too, you won't get a receipt 'cause then I won't have to deal with hassles like warranty and so on. Hey, I could open a store right now! All that and a few things more is everything that cost money and keeps me from opening a business!

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    10. Re:It can be, if you want any small business by Ooblek · · Score: 1

      They swipe and get a recipt they keep. All the other information is stored by some 3rd party on servers far far away.

      This is not always the case. That terminal may actually be storing your card data. It may even give someone the ability to access data stored in those far far away servers.

      And if they are 100+ employees, they are big enough to be able to figure out how to do a little encryption.

      I was at a global company recently that probably has tens of thousands of employees. They did a "little" encryption project and it took them a year to do it. Then they figured out that it didn't meet PCI DSS's requirements to be able to rotate your keys, so they had to scrap the whole thing and try to figure out how to do it again.

      Data protection is a difficult issue to deal with for a business of any size. Despite the fact that there are a lot of free crypto resources out there, it takes someone able to decipher how it all works to be able to use crypto effectively. Usually, corporate IT people stop reading about encryption at the first sign of any sort of proof or formula beyond their basic math skills. Reading Applied Cryptography will only get you so far, then you actually have to understand how the stuff works to integrate it into your system effectively.

    11. Re:It can be, if you want any small business by Anonymous Coward · · Score: 0

      Sorry for the AC (and perhaps OT) post - could you provide a link to back that up? I'm not contesting you, my company has some very bad practices that could bite us in the backside - I'd love to have evidence of what our liability is.

      Thanks!

    12. Re:It can be, if you want any small business by einhverfr · · Score: 1

      http://usa.visa.com/merchants/risk_management/cisp_overview.html?it=c|/merchants/risk_management/cisp.html|How%20to%20Comply#anchor_2 but this does not mention the amount fined.

      Wells-fargo mentions the scope of fines here https://www.wellsfargo.com/biz/merchant/service/manage/associations/news and it seems my information may have been out of date. The fines are still pretty hefty.

      --

      LedgerSMB: Open source Accounting/ERP
    13. Re:It can be, if you want any small business by Anonymous Coward · · Score: 0

      Got it, thanks!

    14. Re:It can be, if you want any small business by mpe · · Score: 1

      Keeping customer data reasonably safe is quite easy for small businesses.

      In the main it isn't small businesses which are responsible for collecting lots of personal data and failing to secure it. Not only do they not have that much data about their customers they also tend not to want to risk alienating any of their customers.

      You have your POS with outsourced security (read: You bought some POS system that handles CC purchases for you)

      Which is actually less likely to be secure, but on the other hand any sensible written law will pass most of the obligations onto your sub contractor.

  20. Re:Too much effort to comply IS an excuse by Harmonious+Botch · · Score: 5, Informative

    I own a small business. I spend at least 1/3 to 1/2 of my time doing govt paperwork, or complying with some govt standard which is either 1) an obviously good business practice that does not need to be legislated or 2) irrelevant or 3) stupid or 4) #2 and #3.

    These legislators live in a hypothetical world of zero risk. Any problem that they see, they try to legislate out of existence. But they don't have to pay the bills. They don't have to make the decisions of how limited resources are applied to problems.

    With all the taxes that I pay, I could hire another employee. But these well-meaning legislators have effectively fired him before I could ever hire him.

    Laws have consequenses. And someday the consequence may be your job.

  21. I'm not arguing that. by khasim · · Score: 1

    I'm arguing the lack of logic in claiming that some fictional entity ("the marketplace") can provide protection in one instance ... but not in other instances.

    So that certain instances require legal regulation.

    But the fictional entity is used to justify the lack of legal regulation in the other instance.

  22. PCI Compliance by jeramybsmith · · Score: 1
    Because of PCI compliance you have Linux/Unix admins across the country installing useless virus scanners that scan for windows viruses on their Linux/Unix machines. PCI compliance is a private initiative by the credit card companies.

    I would hate to see the retardation government compliance laws in 50 different states would result in.

    --
    Never overestimate the end user. -jeramy b. smith
  23. This is Old News by Anonymous Coward · · Score: 0

    Haven't you people learned by now that nothing, NOTHING, must stand in the way of Business making money? What are you on, some kind of Jimmy Stewart trip?

  24. data protection laws not always good by wikinerd · · Score: 1

    I, as an individual, prefer to be responsible for protecting my own data, rather than having a government nanny creating huge bureaucracies with great costs and making everyone's life difficult and not necessarily more secure. I really do not know much about this particular law, or whether its change was motivated by some multinational (in which case it's bad) or true concern for the costs to small businesses (which is a valid concern), but speaking generally I distrust data protection laws, as they can be used by governments for purposes other than protecting people's data. Yes, some laws are needed, but not too many. (IANAL)

    1. Re:data protection laws not always good by Opportunist · · Score: 2, Insightful

      All great, but then please at least install some kind of punishment if someone who has to handle my data is careless with it.

      Companies don't care about customer data security. So they won't lift a finger to secure it unless there's some "incentive" to do it.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:data protection laws not always good by Anonymous Coward · · Score: 0

      Oh really? Does that mean you don't have a credit card, car loan, home mortgage, student loan, cell phone, social security number, or any other connection to the world other than your slashdot account? If you said "no" to any of the aforementioned, good luck protecting it yourself. If you said "yes" to all, more power to you and thanks for not passing on your genetic material.

    3. Re:data protection laws not always good by CodeBuster · · Score: 2, Insightful

      I, as an individual, prefer to be responsible for protecting my own data

      Which you cannot do because you do not have control over what information third parties collect and store except for that provided by the government through laws and regulation. There are plenty of large data brokers (remember ChoicePoint?) who collect tons of information about everyone (everything that they can get their hands on) and then sell it to practically anyone with the ability to pay. If you pop up on the grid even once with these guys then they have you pegged for the rest of your life. It is practically impossible to avoid the information brokers without living under a rock and paying for everything in cash.

    4. Re:data protection laws not always good by wikinerd · · Score: 1

      I would very much prefer an NGO or citizen organisation funded by donations to create data protection standards and then choose to shop only from companies bearing the NGO's approval logo. Perhaps the only law that's needed is that every citizen has a right to privacy and their data, and before a transaction customer and company must agree to a contract or policy that defines what is going to happen to the personal data involved. If the company does something against the contract then the customer is entitled to various remedies... that's all, so simple. A simple law defining the general spirit of privacy that society has to provide to its members, another simple law defining the general spirit of privacy policies, and one or more independent NGOs (or even just a wiki where citizens can post their stories) to help customers choose the companies that actually care about privacy. It is, of course, true that even NGOs can be eroded by corporate interests or lose their focus to their mission, but I still see no reason to have a great deal of government data protection laws and red tape.

    5. Re:data protection laws not always good by wikinerd · · Score: 1

      The big multinationals can bypass the laws. So, in reality, the only thing these laws do is to make the life difficult for the small guys and make it easier for the government to spy on everyone. Why not have an NGO or citizen organisation supported by our donations instead of government bureucracies and red tape? A law defining the general spirit of privacy and privacy policies and making it easy for people to get entitled to remedies in case of privacy breaches would be enough.

    6. Re:data protection laws not always good by jay-be-em · · Score: 1

      I really do not know much about this particular law Then RTFA before making remarks, jackass.
      --
      "Orthodoxy means not thinking--not needing to think. Orthodoxy is unconsciousness." --Eric Blair
    7. Re:data protection laws not always good by freedom_india · · Score: 1

      Similarly why can't consumers collect as much information about companies such as ChoicePoint, Blackwater, etc., and publish it on wikipedia regularly?
      Am sure employees, ex-empployees, etc., would love to contribute as much information.
      Present it neatly tabulated without any opinions, including judgements, settlements, debt refusals etc.
      Am sure the companies will get it.

      --
      "Doing what i can, with what i have." ~ Burt Gummer
    8. Re:data protection laws not always good by hey! · · Score: 1

      It apears that you have not grasped at least one essential element of this situation: data laws may allow the government to "interfere" with how private entprises handle personal data, but the net effect of the laws is to restrict government access to privately held data. In most cases the government can simply ask for data and the vendor will give it to them. If not they can get subpoenas for data about you without your permission without showing probable cause, because legally, it's not your data. Fourth and fifth amendment restrictions don't apply. Read that last sentence again. It means the government can obtain any data it can get its hands on about you, without your consent or knowledge, then use that data in any way it wants, provided only that it doesn't get the data directly from you.

      That's the whole point of the biggest US data privacy law of all: ECPA. You are continually leaking informatoin about your private life, particularly if you use modern contraptions like the telephone. Now it's worse. The government can track every purchase you make unless you pay cash and avoid using any kind of discount card. It doesn't have to go through your trash or tail you. It simply buys it like anybody else. It then can feed that into a data mining system, and i you happen to trigger some test that shows you are different, you can find yourself under permanent suspicion and surveillance, a situation I might add which is perfectly Constitutional, at least by the letter if not the spirit.

      Legally, there is no such thing as "your own data". There is only data that you have disclosed or not yet disclosed. There are only two conditions where you are entitled to exert further control over disclosed data: if you disclose it to somebody who has a fiduciary relationship to you (your lawyer), or where a data privacy law exists to protect you (to some degree your bank, althoguh they've found ways around this).

      So you are right -- you have to be careful to protect your private information. But without data privacy laws there is only one way you cn do this: avoid participating in any transaction that can connected to your identity. Never fill out a form with your true name and address. Don't use discount cards. Don't use credit cards. Never use your own telephone. Don't enter into contracts, including leases or insurance of any kind. Don't sue anybody or be sued. Don't participate in public meetings, or become a member of any kind of club or association.

      At least to the point where the inconvenience outweighs the consideration that you are exposing yourself to government scrutiny, scrutiny that that has no constitutional and few statutory limits on its scope and purpose.

      --
      Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
  25. Re:"Governator"? Are we in 6th grade here? by Ash+Vince · · Score: 0, Offtopic

    Personally I think Governator is brilliant.

    One another related point, there is no way he would have got elected as an European with his original name if he hadn't been a rich famous movie star. So referring to him in a way that reminds people WHY he was famous in the first point is actually useful in this case.

    For those who still have not remembered, he was originally famous for being a body builder who probably has taken more steroids than I have had hot dinners and then starred in loads of vaguely amusing action movies where no acting talent or intelligence was required. He had still barely learned to speak English after living and working here for years, and that was with a small fortune behind him by the end of his Hollywood career.

    So no, we are not in 6th Grade, but you would never know it judging be who we elect to make decisions for us sometimes.

    (Disclaimer - I cannot remember who he was running against but it would not surprise me if some or all of them were worse.)

    --
    I dont read /. to RTFA, I read /. to offend people in ignorance.
  26. No kidding by SuperKendall · · Score: 1

    It doesn't help reasoned debate when people jump right into name calling. No matter who you are talking about... M$ is lame for the same reason.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  27. Re:"Governator"? Are we in 6th grade here? by Martin+Blank · · Score: 2, Informative

    Then-Lt. Gov. Cruz Bustamante was the biggest candidate that he faced, and that was a very, very poor choice.

    Schwarzenegger is widely regarded in business circles as savvy and intelligent, and before he made his biggest money in Hollywood, he'd become fairly wealthy in real estate. However, he ran as a moderate Republican and has turned out to be more liberal in many ways than the Democrat that he replaced. At least we get to see most of the bad deals that he makes, as opposed to Davis's multitude of closed-door, secret meetings selling off the state's future.

    --
    You can never go home again... but I guess you can shop there.
  28. In Soviet Russia... by Anonymous Coward · · Score: 0

    Laws kill you!

  29. Good political move by Qwavel · · Score: 1, Insightful

    I can imagine that in the state of CA there must be a ton of internet businesses just dying to sell user data. And a lot of those companies will be directing some of their new revenue to the governor that made it all possible. If he can put an 'anti red tape and government bureaucracy' face on it, all the better.

  30. Kills Data Protection Law? by nurb432 · · Score: 1

    Wouldn't that be 'terminates data protection law' ?

    --
    ---- Booth was a patriot ----
  31. The Goven-ator is foolish. by Neanderthal+Ninny · · Score: 1, Insightful

    We need to have some level of protection when we give our information away. I seen all of the bad example out there even for the big companies like TJX. But for the small and medium size business they don't have the resources, or at least want to release these resources, to protect this data in this manner. I understand this from both side and the legislature should create a bill that has this protections for the consumers but for the small to medium sized business which can prove that they cannot afford such a system that they some for of tax break or something so they can get the system to protect us in California and hopefully this will spread to to the rest of the country.

  32. Re:"Governator"? Are we in 6th grade here? by AuMatar · · Score: 2, Interesting

    Actually, his biggest opponent was Davis. Over 40% of the people voted to NOT recall him. If the courts hadn't made the braindead decision that he couldn't be on the general recall ballot, he probably would have been recalled, then rewon the election.

    --
    I still have more fans than freaks. WTF is wrong with you people?
  33. PCI Standards by azrider · · Score: 2, Insightful

    The Payment Card Industry standards are, at this point, simply a recommendation. Having built systems which process credit cards, I found that the change to comply with PCI (and prevent ID/Card theft) is one line. In one system, the full card number is in the system (encrypted) only from the time it is entered to the time approval/disapproval is returned. In fact, the card number is no longer needed to process a credit after the fact. The only information required is the merchant ID, the transaction ID and the approval code. That said, the only way that merchants are dunned is in response to an audit (very rare) or a breach (unfortunately less rare). The PCI standards allow for storing the card number as the last four (with X's filling the previous part), 4 X's and the last four or the last four alone. If your merchant gives you a receipt (and their copy shows also) any thing other than XXXXXXXXXXXX1234 (shorten for some incarnations of Visa and AMEX), XXXX1234 or 1234 complain loudly to the manager of the establishment as well as your card issuer. Reference the Payment Card Industry/Data Security Standard 1.1 (2005).

    --
    And ye shall know the truth, and the truth shall make you free.
    John 8:32(King James Version)
    1. Re:PCI Standards by MtlDty · · Score: 1

      There are some mistruths in this otherwise quite informative post.

      Firstly, most of the acquiring banks actually request that the merchants keep card number data for *at least* 6 months after the original transaction. This is to allow the cardholder time to make a chargeback, and for the acquiring bank to make enquiries with the merchant about the transaction. Some acquirers have much longer data retention periods.

      So the full card number is required for
      a) initial authorization request, typically taken when the cardholder places the order,
      b) reauthorisation prior to dispatch (typically required when the order has taken more than a week or so to process - if the card is not re-authed the merchant may face chargeback. This varies between card issuers and acquirers.)
      c) Settlement, ie when the merchant actually banks the money. For this the merchant sends an end of day settlement file containing card number and authorization details.
      d) Then, as mentioned most acquirers request the details are kept for at least six months to allow for Request For Information queries about the transaction.

      Final point is that PCI allows for card numbers to be stored in first six, last four format - but for receipts you're quite right in that it must be only the last four digits (at most) printed.

    2. Re:PCI Standards by PFAK · · Score: 1

      Should it only show the last four digits for merchant, customer copy, or both?

      Are the same standards upheld in Canada for MasterCard/Visa?

      --

      Free means no restrictions, ironic the FSF's GPL forces restrictions, isn't it? What's your definition of free?
    3. Re:PCI Standards by azrider · · Score: 2, Informative

      Firstly, most of the acquiring banks actually request that the merchants keep card number data for *at least* 6 months after the original transaction. This is to allow the cardholder time to make a chargeback, and for the acquiring bank to make enquiries with the merchant about the transaction. Some acquirers have much longer data retention periods.
      See the above referenced standard https://www.pcisecuritystandards.org/tech/download_the_pci_dss.htm. The only required information is merchant ID, merchant transaction number, authorization transaction ID, authorization number and amount.

      So the full card number is required for a) initial authorization request, typically taken when the cardholder places the order,
      Yes

      b) reauthorisation prior to dispatch (typically required when the order has taken more than a week or so to process - if the card is not re-authed the merchant may face chargeback. This varies between card issuers and acquirers.)
      No

      c) Settlement, ie when the merchant actually banks the money. For this the merchant sends an end of day settlement file containing card number and authorization details.
      No

      d) Then, as mentioned most acquirers request the details are kept for at least six months to allow for Request For Information queries about the transaction.
      The acquirer (if you are referencing the agent who actually provides the authorization) may request but may not require the information to be kept, since all necessary information is provided by the data that I stated Again, look at the standard before you post a critique.
      --
      And ye shall know the truth, and the truth shall make you free.
      John 8:32(King James Version)
    4. Re:PCI Standards by einhverfr · · Score: 1

      That problem mostly affects large businesses only (i.e. those who can afford to talk directly to the V/MC network and skip the gateway). And the cost of compliance there is *huge.*

      For smaller businesses, generally this is handled via the acquirer (in the case of a small credit card processing terminal) or the payment gateway (like Authorize.net or TrustCommerce). There is no reason to store the credit card number beyond the initial approval there.

      Note furthermore, that you *can* store the credit card number indefinitely under PCI-DSS provided that it is encrypted. You cannot however store (subsequent to authorization) anything including or containing: The PIN number or PIN block, the CVV2 (printed on the plastic) or the CVV (contained in the track data).

      So, for example, one option to handling internet down issues is:
      1) Track data is encrypted with public key at the POS server after being transferred via ssl to that system then inserted into db. If the key does not exist, we ask a separate process to generate and store keys.
      2) When internet connection comes back up, a spool process (accepts the private key from a USB device, decrypts the track data, submits it for approval, and then deletes it. When this is done, the private key is deleted. The key is appropriately protected and file access is audited.

      --

      LedgerSMB: Open source Accounting/ERP
    5. Re:PCI Standards by MtlDty · · Score: 2, Insightful

      Sorry - I didnt mean to get your back up. Fact is however that I am an EFT system developer working for a Payment Service Provider, and as such deal with multiple acquiring banks, merchants, card schemes and am very familiar both with the PCI standards and inter-bank communications.

      I did mention that point b varies greatly between card issuers, and acquiring banks, so I wont argue if you have different experiences there. But point c is an actual fact. Point d is also a fact with the vast majority of acquiring banks, if the acquiring bank receives a chargeback request from the cardholder they will contact the merchant with an RFI on the transaction. At this point its up to the merchant to prove that the transaction flowed through their system, and they'll receive the PAN in the RFI. If the merchant doesnt store the PAN they have nothing to tie the transaction to the RFI. These points are not detailed in the PCI standards, these are just things that any decent EFT systems developer will be familiar with.

      In your original post you also said that 'The Payment Card Industry standards are, at this point, simply a recommendation.'. Thats also not true. Compliance is mandatory. There are various levels of compliance, requiring different levels of validation of compliance, but even at the lowest level, completion of an SAQ is mandatory.

      You also said that compliance was as simple as changing one line. This leads me to believe that you're authorising through a payment gateway / PSP, and your payment gateway will therefore undertake the burden of PCI compliance. This probably also explains why you're not familiar with the settlement process (PSP will generally take care of that also). Please understand however that a lot of merchants dont use PSPs, and PCI compliance is anything but trivial.

  34. Moderation of parent? by Anonymous Coward · · Score: 0

    Parent called the story synapsis on being childish, prejudicial and improperly edited in its wording. Such matters should always be considered when reading the news as we all know that the source and/or the writer of such news can create or attempt to create desired effects from the target market. Nowhere but in advertising pieces is this more true then in editorials and the submitter here would be the editor with Scuttlemonkey as the approving editor of eweekhickins submission.

    Only remaining question was if it was put out as submitted or edited in any fashion, which would also be an appropriate topic of discussion here. Of course it can be argued that the moderators are editors as well, after all the one who moderated the parent offtopic is equivalent to the editor at the paper who hides a story in the generally unread by the majority portions of the paper.

    Informative or insightful would have been a more appropriate moderation.

    666

  35. Re:"Governator"? Are we in 6th grade here? by Opportunist · · Score: 2, Funny

    Hey, don't bash Arnie! Judging from Bush, the way he butchers English he could be President if he was born in the USA.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  36. Re:"Governator"? Are we in 6th grade here? by pak9rabid · · Score: 1

    I think he gets more respect as the 'Governator of California' than the 'Governor of California'

  37. Must... resist... joke... by Spy+der+Mann · · Score: 1

    Schwarzenegger is widely regarded in business circles as savvy and intelligent...

    Without mentioning that his brain is a Neural Computah.

  38. come again? by Anonymous Coward · · Score: 0

    e-tail? Isn't that what you get when you marry a robot?

    1. Re:come again? by Anonymous Coward · · Score: 0

      no, it's what you chase at match.com.

  39. Interesting by cdrguru · · Score: 1

    There are many businesses that accept credit cards via third parties. The real "merchant" is this third party but all of the personal information (except for credit card number) is transmitted to the vendor/author/publisher/etc.

    Amazon has a service for this, for example. Your personal information is being sold (in a manner of speaking) or at least transferred from the merchant to this vendor that is really selling you the goods. Wouldn't this violate many of the recent laws? I would certainly think it would.

    I would imagine that such services are now possibly illegal to use in Canada. Maybe other places as well. Who knows?

    1. Re:Interesting by CodeBuster · · Score: 1

      Wouldn't this violate many of the recent laws? I would certainly think it would.

      Probably not with large companies like Amazon since they have the resources to meet the regulatory burdens. Amazon is in fact becoming a payment processing service in its own right (for markets where it choses not to be directly involved), whereby small businesses receive payments from Amazon, not directly from the consumer, and are told by Amazon where to ship the goods. In fact this is preferable for the consumer because it is better to have the payment information in one place that is well guarded rather than spreading it out piecemeal among small businesses who are mostly security novices. The Paypal service is an implementation of the exact same idea. These services exist for a reason and most Internet commerce wouldn't take place without them.

  40. Re:"Governator"? Are we in 6th grade here? by speaker+of+the+truth · · Score: 1

    he used his Governor powers to terminate a privacy bill. Was there ever a time more appropriate to call him the Governator?

    --
    Using openSUSE instead of Windows since 9th of October, 2007 and liking it.
  41. Not really by jeevesbond · · Score: 1

    SO, at that point a retailer did need a copy of the customer's credit card # for at least two months after the purchase.

    That's what PAN print suppression is for. So instead of storing the whole credit card number you just store the first and last few digits, for example:

    5454 xxxx xxxx 1234

    Then you store the cardholder name and date of the transaction, this is enough evidence for the credit card company to verify the transaction, but not enough for an identity thief to go on a shopping spree. :)

    --
    I'm going to transform myself into a mighty hawk. Either that or I'll just go and work at Dixons, haven't decided yet.
  42. Re:Too much effort to comply IS an excuse by Harmonious+Botch · · Score: 1

    As the subject is regulation, I should add that due to unneeded regulations my business is much less efficient than it could be. It is not nearly as easy to quantify as the losses to taxes, but I estimate it is a job loss for one part-time person.

  43. Re:Too much effort to comply IS an excuse by bjourne · · Score: 4, Insightful

    With all the taxes that I pay, I could hire another employee. But these well-meaning legislators have effectively fired him before I could ever hire him. That argument is quite stupid. Either you have a use for a new employee, which means that you earn more money from his or her work than it costs you in salary. If you do, then the taxes on your business is irrelevant. Or you don't have a use for a new employee, which means that $value_of_work less than $salary, which means no hire. Tax has nothing to do with that decision. It's a great way to raise sympathy for your cause though (more money). However, no business owner would rather hire someone than pocket the money if the latter is more profitable.
  44. Re:"Governator"? Are we in 6th grade here? by Anonymous Coward · · Score: 0

    You sound like one of those 6th grade crybabies that everyone hated.

    Don't like it? Go read another news site.

  45. Schwartzenneger vs Schwarzenegger vs Governator by atari2600 · · Score: 1

    Editors? Where art thou?

  46. Spelt his name wrong, of course. by Paperweight · · Score: 3, Informative

    Sorry, I browsed for another post to mod-up but nobody made the point that Schwarzenegger was spelt wrong.

    1. Re:Spelt his name wrong, of course. by Anonymous Coward · · Score: 0

      Michael Richards mode ON: "He is a negger. He is a negger."

  47. Re:"Governator"? Are we in 6th grade here? by AK+Marc · · Score: 1

    C'mon, I mean, seriously - whether or not you respect the man he has a name and a title, and you've used neither...

    When I hear complaints like this, they inevitably come from Republicans that were fond of saying "Slick Willie" or Democrats that have uttered the words "Tricky Dick." Nicknames are popular in politics. They are popular in use by friends as well as supporters of the other party. If you don't like the divisive nature, you are in the wrong country. Try a place that doesn't have a two-party-only system.

    Oh, and it uses both his name (well, a character name) and title together, so it isn't neither, it is both.

  48. I guess your: by einhverfr · · Score: 1

    connection TERMINATED with error: 404.

    --

    LedgerSMB: Open source Accounting/ERP
  49. Re:Too much effort to comply IS an excuse by Harmonious+Botch · · Score: 5, Insightful

    Your calulations are overly simplistic.

    You are assuming that every dollar is of equal value to me. This is not the case. This is an instance of diminishing returns.

    As the business earns more money, I can make the decision to either do the work myself or to hire someone to do it. Initially to meet my living expenses, I'll do all the work myself ( yes, there were times when I did 80+ hour weeks ). But, after earning a comfortable living, I am now making the decision: do I want more time or more money. When I hire the new employee, I do less work.

    If I had more disposable income, I would buy more time. ( ie: I would hire an additional person )


    Furthermore, employees do not exist in a vaccuum. They require places to work. And real estate cannot be allocated piecemeal like ram. One cannot assign a profit-per-person value to an employee and expect to implement it repeatedly. If one could, then every business would be crammed with employees like sardines in a can.

  50. Other names for bill by tjstork · · Score: 2, Insightful

    The "Don't host anything in California Act"
    The "Not Available Online to California Residents Act"

    and more...

    Sorry, but in world of nearly a billion people online, California's market of 40 million isn't as much worth the pain in the ass they keep regulating it to be.

    --
    This is my sig.
    1. Re:Other names for bill by Anonymous Coward · · Score: 0

      California's market of 40 million isn't as much worth the pain in the ass they keep regulating it to be.

      Don't knock it. By itself, it's the 8th largest economy in the world.

      And why are you complaining? The bill was vetoed. Do you always find something to complain about?

    2. Re:Other names for bill by tjstork · · Score: 1

      And why are you complaining? The bill was vetoed. Do you always find something to complain about?

      Only when the Red Sox pull within 2 runs of the Indians. But, the Indians hung on to win, and I'm happy. Go Indians!

      --
      This is my sig.
  51. It was inevitable by PPH · · Score: 1

    Now SkyNet can locate the correct Sarah Conner.

    --
    Have gnu, will travel.
  52. Re:Too much effort to comply IS an excuse by khallow · · Score: 5, Insightful

    Either you have a use for a new employee, which means that you earn more money from his or her work than it costs you in salary. If you do, then the taxes on your business is irrelevant.

    I don't see why it's so difficult for you to understand, if you raise the taxes or regulation cost per employee on a business, then it's easy to cross over the threshhold where you no longer earn more from that employee than it costs you in salary and increase in mandated expenses. In addition to direct expenses per employee, you have to train the employee to deal with the new regulations and bureaucracy grows as the employee base grows and as the regulation burden grows. Second, there's the matter of cash flow. The weaker a business's cash flow the harder it is for them to expand their business. Regulations like this consume cash flow. The business has to spend to stay in compliance.
  53. If that happens again by einhverfr · · Score: 1

    I would check out who you contact at Visa/Mastercard. This is a pretty serious violation of security reqirements, and the hotel chain could be fined substantially for the lapse in security. Note that if you have the full credit card number and the customer's address, you can basically get AVS-type queries to pass. I would suggest helping ensure that it gets turned in to Visa/Mastercard.

    I am not quite sure what the fine is for something like this, but the maximum (when credit card numbers are actually stolen) is about half a million dollars per incident.

    --

    LedgerSMB: Open source Accounting/ERP
  54. Re:"Governator"? Are we in 6th grade here? by Anonymous Coward · · Score: 0

    +offtopic and +insightful?

    come on mods, where is the +funny that this guy was obviously going for...

  55. Re:"Governator"? Are we in 6th grade here? by Anonymous Coward · · Score: 0

    Actually, he used both at the end of the news post. He did however misspell his last name.

    Oh was that a mispelling? I thought he changed 'Egger' ('Acker' in Hochdeutsch -- acre, field) to 'Neger' (negro) as a dig. Well you know what Freud would say ...

  56. Agree and disagree by einhverfr · · Score: 2, Informative

    Most of my customers are small businesses which also process credit cards. What you have to remember is the controversial portions of the law are *already* requirements for small businesses which process credit cards. I invite you to read the PCI-DSS 1.1 (and yes, there are a lot of non-compliant small businesses out there).

    Now the PCI-DSS does not really have the force of law at the moment, but it might as well. Visa/Mastercard reserves the right to fine merchants up to half a million dollars for violations resulting in theft of sensitive cardholder information. Many smaller fines are levied against businesses who are required to certify their compliance with third parties (these are either larger businesses or those who have had past problems).

    This isn't about an attack on smaller businesses. Businesses *should* be doing this already. If they don't they are already risking their continued operations. Hopefully such a law would help build awareness of these sorts of problems and help small businesses actually avoid problems. Yes, compliance is a bear, but already the costs of noncompliance, as levied by Visa/Mastercard are sufficient to drive small businesses out of business.

    --

    LedgerSMB: Open source Accounting/ERP
  57. Re:"Governator"? Are we in 6th grade here? by mikael · · Score: 1

    One another related point, there is no way he would have got elected as an European with his original name if he hadn't been a rich famous movie star. So referring to him in a way that reminds people WHY he was famous in the first point is actually useful in this case.

    He got elected because, in the economic downturn of the dot com bust, California's budget went from a surplus to a deficit. So everyone blamed Gray Davis and voted for Schwarznegger instead.

    --
    Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
  58. I wonder if the GOv thinks that by einhverfr · · Score: 1

    the issue of compliance goes away.

    In fact, the requirements are basically copied from the PCI-DSS 1.1 which Visa/Mastercard require compliance with anyway (and reserve the right to "fine" you for up to half a million dollars for losses of credit card numbers if you fail to comply).

    This is at best political posturing and at worst a dangerous illusion for small businesses.

    --

    LedgerSMB: Open source Accounting/ERP
  59. Not in this case by einhverfr · · Score: 1

    If you accept credit cards, you already have to comply. Look up the PCI-DSS, and note that Visa/MC already require everything that was in this bill. Note too that Visa/MC already reserve the right to "fine" you for noncompliance (if you have a merchant account) up to $500,000.00 USD.

    Yet most small businesses have *no* idea what is required of them. This passage of the law would have helped businesses avoid problems which could put them out of business.

    Please note that my business is fairly small and most of my customers are small to midsize buinesses. I sympathize with the concern over too much regulation but this particular case is something which would not have added practical regulatory issues and would have helped publicize what credit card merchants are required to do anyway.

    --

    LedgerSMB: Open source Accounting/ERP
  60. Re:Too much effort to comply IS an excuse by Anonymous Coward · · Score: 0

    If a business has not got enough resources to hire another employee, then they can't hire an employee. If a small business has super-normal profit (I think that is the right term - profit beyond what is needed to make the owner stay in business) then it makes perfect sense to reinvest in the business, buying capital or labour.

    Taking resources away from a business == less employment is a perfectly valid argument. Capitalists believe in wealth creation too :-)

  61. PCI-DSS is not as you describe. by einhverfr · · Score: 3, Informative

    Because of PCI compliance you have Linux/Unix admins across the country installing useless virus scanners that scan for windows viruses on their Linux/Unix machines. PCI compliance is a private initiative by the credit card companies. Then the problem is either with the admins or that the compliance people can't read.

    The PCI-DSS 1.1 states:

    5.1: Deploy anti-virus software on all systems commonly affected by viruses (particularly personal
    computers and servers)
    Note: Systems commonly affected by viruses typically do not include UNIX-based operating
    systems or mainframes.
    [emphasis mine] Next time someone complains about the PCI-DSS requiring antivirus software on Linux/UNIX systems, you can point them to the fact that the standard specifically excluded these systems from the antivirus requirements.
    --

    LedgerSMB: Open source Accounting/ERP
    1. Re:PCI-DSS is not as you describe. by jimicus · · Score: 1

      Next time someone complains about the PCI-DSS requiring antivirus software on Linux/UNIX systems, you can point them to the fact that the standard specifically excluded these systems from the antivirus requirements.

      When nonsense complaints like that are made, what they generally mean is not "this regulation is bad".

      What it means is "This regulation has the potential to make my life harder in some impossible to define way which I can't very easily argue, so I'm clutching at straws".

      IME, a moments analysis will show that the regulation doesn't actually have to make life harder at all, and is something that probably should be done anyway. But then all the consultancy companies offering to sell you compliance would go out of business.

  62. This law would have been good for the small guys by einhverfr · · Score: 1

    The basic thing is that another multinational enforces a contractual provision against all merchants big and small, doing business in various parts of the world. That multinational is Visa/Mastercard. And they levy fines of up to $500,000.00 USD for noncompliance.

    All this law would have done practically speaking would have been to encourage small businesses to protect data properly. Right now, I don;t think most of them know what they are required to do. It is a shame and nothing more than political posturing which creates a dangerous illusion.

    --

    LedgerSMB: Open source Accounting/ERP
  63. Re:"Governator"? Are we in 6th grade here? by nostriluu · · Score: 1

    Much as I dislike cheesy nicknames, if I were in California, I'd be reminding myself I had "the Terminator" (and other science fiction characters) as governor too.

  64. Re:Too much effort to comply IS an excuse by Anonymous Coward · · Score: 0

    seriously, THIS is +5 worthy, mods?

    This guy has obviously never tried to run a small business.

  65. Re:"Governator"? Are we in 6th grade here? by RepelHistory · · Score: 1, Funny

    I've always preferred "Conan the Republican."

  66. The regulations already apply by einhverfr · · Score: 1

    They are basically cut and pasted from the requirements that the payment card industry places on merchants anyway. V/MC "levy fines" of up to a half a million dollars in the event of noncompliance which results in credit card data theft. This law would have helped buisnesses avoid fines which would result in bankrupcy by helping them understand what they were required to do.

    --

    LedgerSMB: Open source Accounting/ERP
    1. Re:The regulations already apply by SpartacusXIII · · Score: 1

      In the event of a minor compromise the cost will be into the tens of thousands of dollars, if not the hundreds of thousands. The news story states "The governor argued that "the industry"--presumably a reference to credit card companies and the PCI Council--is in a better position to know what is realistic and reasonable for credit card security." This is correct to a degree. The payment card industry knows what needs to be done to be secure, but that does not necessarily manifest itself in the PCIDSS. I've been working in the PCI compliance field for over a year, and I've seen that even the standards alone can't keep you safe. I've come to find that more is required than simply being compliant with the PCIDSS to be in the category of 'safe harbor'. From what I've seen, this bill is heading more in the direction of safe harbor which would be beneficial to everyone in the long run. Arnold doesn't seem to truly understand what this is all about. Probably mostly from the fact that the payment card industry, like most things, is far different in reality than it is on paper. For the average level 4 merchant, it would be far easier to pay a small amount of money and time on a certified vendor to become compliant than it would be to go out of business due to card association fines.

    2. Re:The regulations already apply by einhverfr · · Score: 1

      I would also add that the PCI-DSS is not the beginning and end of preventing cardholder information compromises. I think that some new regulation is required, not for the retailers, but for the acquirers.

      Basically, I think that the PAN should be barred from being saved and that the acquirer should take on that responsibility. They are in a better position to manage such security issues anyway, and there are better ways of doing this anyway. For example, why not handle recurring payments as keyed to the original approval code instead of the PAN? The approval code is then tied to a merchant account and so is non-reusable in the same way. Barring that, I think that the payment gateway should hold the information.

      --

      LedgerSMB: Open source Accounting/ERP
  67. Re:"Governator"? Are we in 6th grade here? by TheLink · · Score: 2, Interesting

    I wonder if he gets a speech trainer to help him _keep_ his accent.

    After all just imagine what would happen if he loses his accent. Imagine an Arnie movie with Arnie speaking in English but without his accent.

    --
  68. This is consistent with by Whuffo · · Score: 1

    Simply the sort of thing that a Republican governor would do. Protect the interests of the common man when it might cost the corporations a little profit? Nope; not the Republican way...

  69. Re:Too much effort to comply IS an excuse by mcrbids · · Score: 1

    That argument is quite stupid. Either you have a use for a new employee, which means that you earn more money from his or her work than it costs you in salary. If you do, then the taxes on your business is irrelevant. Or you don't have a use for a new employee, which means that $value_of_work less than $salary, which means no hire. Tax has nothing to do with that decision. It's a great way to raise sympathy for your cause though (more money). However, no business owner would rather hire someone than pocket the money if the latter is more profitable.

    Wow. You start out with mean words, and then commit the same crime yourself. Try your own logic when you take the numbers to the extreme....

    Either you have a use for a new employee, which means that you earn more money from his or her work than it costs you in salary.

    Higher taxes raise the cost of the employee. Therefore, the employee would have to generate more wealth to compensate. This means that either the employee works harder, less, or not at all.

    If you do, then the taxes on your business is irrelevant. Or you don't have a use for a new employee, which means that $value_of_work less than $salary, which means no hire. Tax has nothing to do with that decision.

    You're missing an incredibly important factor of the formula, rendered in ternary pseudo-code notation so that you can understand it, since that seems to be important to you:

    $hire= ($value_of_work > ($salary + $taxes)) ? TRUE : FALSE ;

    Actually, it would go something like this:

    $hire= ($value_of_work > ($salary + $taxes + $overhead + $hassle + $arbitrary_risk_assessment)) ? TRUE : FALSE ;

    How do you figure that taxes don't figure in here? It's like saying that sales tax makes no difference when buying goods. Challenge that by raising your tax rates to 200% of the sale price... What would that do to your purchasing?

    Please discuss economics AFTER you have a baseline comprehension of it...

    --
    I have no problem with your religion until you decide it's reason to deprive others of the truth.
  70. Re:"Governator"? Are we in 6th grade here? by Anonymous Coward · · Score: 0

    Have you ever heard of the concept of humor? You know, one of the features that distinguish Slashdot from the mainstream sources it is quoting?

  71. Data protection in EU prove Schwartzneger false by aepervius · · Score: 3, Insightful

    They don't seem to close or kill small business in EU, isn't it ? Last time I looked the big conglomerate were not the main employer in many country, the small enterprise cover more than 50% of the jobs (66% for France for example), with an increasing tendency in the last few years (~60% 1985 for France up to 66+% today, I took the example of France because this is the first which came up in google). So REALLY if data protection law killed small enterprise, we would know by now.
    PS: Although I must admit that there are dissenting voice saying that now big enterprise make the bulk of the economy near the 51% if you count small filial as belonging to the main big enterprise. See TUC report for UK for example.

    --
    C. Sagan : A demon haunted world:
    http://www.amazon.com/gp/product/0345409469/
    visit randi.org
    1. Re:Data protection in EU prove Schwartzneger false by Boomer_Zz · · Score: 1

      Jobs that don't require a computer or customer information? I completely agree.

      Having to pay more to comply if your business is in a related "area" will hurt a small business.

      It will hurt a large business too. I previously worked for a multinational company that had 3 core IT groups, one in each region of the world.

      The European group had far lower output and had more people than the other groups, even though the workload was similar (or less). They would interpret the "data protection" slightly differently than everyone else and use it as a political card when they needed to.

      The amount of money wasted by the changes to an efficient design to an inefficient one to meet (their new) requirements that did not make the the actual customers data any safer was enormous. It was not about making the data "safer".

      The company started to learn the same thing, and they now have less than half of the staff. Some of those guys were good, and I don't believe the changes were all political.

      I'm all for having the basics down and some general common sense.

      On a separate note, credit card companies do not allow you to charge / advertise / use their credit cards unless you have implemented their processes. This includes encryption, storage and other things. If you are using credit cards, you should already be doing this.

  72. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  73. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  74. Re:Too much effort to comply IS an excuse by bl0kkie · · Score: 1

    Here in belgium we have a minister of paper-simplification (I don't realy know how to translate it correctly from dutch to english).

  75. Re:"Governator"? Are we in 6th grade here? by Anonymous Coward · · Score: 0

    Whichever mod though that was insightful is an idiot.

  76. Re:"Governator"? Are we in 6th grade here? by Anonymous Coward · · Score: 0

    When I hear complaints like this, they inevitably come from Republicans that were fond of saying "Slick Willie" or Democrats that have uttered the words "Tricky Dick." Nicknames are popular in politics. They are popular in use by friends as well as supporters of the other party.

    But popular in use where? Lunch chat, yes, front page of Washington Post, I'd say no. And while nicknames may be popular in more casual writing... we aren't here to discuss politicians, we are discussing legislation. (Spot the difference?)

    Try a place that doesn't have a two-party-only system.

    Like Slashdot?

    [And I prefer Tricky Willie & Slick Dick, myself. Along with Burning Bush & AI (not "Al") Gore, but I have a truly afwul sense of "humor".]

  77. My philosophy of regulation by hey! · · Score: 1

    To the degree a regulation creates new expenses, it's bad, but if you are not going to pay the new expense, it appears insignificant.

    To the degree that a regulation redistributes an existing expense more fairly, it is good, but if you weren't paying those cost before they appear to be new.

    --
    Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
  78. Re:"Governator"? Are we in 6th grade here? by db32 · · Score: 1

    Do you honestly believe that the man doesn't think being called the Governator is funny? His primary fame came from those movies. It isn't like they are calling him anything inherently derogatory. He was famous for being the Terminator, he is the Governor, he is the Governator! Big deal, don't get your panties in a twist over a dumb nick name. I really suspect that he probably thinks its funny that people call him that, shit, it wouldn't surprise me if he likes the nickname given that he got it for being wildly successful.

    --
    The only change I can believe in is what I find in my couch cushions.
  79. Let's talk about hypothetical worlds of zero risk by hey! · · Score: 2, Insightful

    Well as a business owner of course it's good for you if somebody else absorbs the cost of the risks you take.

    So if the choice is paying, say, $100,000/year to safeguard sensitive personal data you have in your posession, or simply ignore the possibilty that the data might be stolen or misused. If you protect your customer's privacy, you're a good man. If you don't, you're $100,000 richer.

    Now here's a pretty legal conundrum: if one of your customers has his data stolen because you didn't take reasonable steps to protect it, it costs him a great deal, in lost credit, reputation, and personal anguish. How much of the dollar cost are you responsible for? Surely not all -- the identity thieves themselves must bear most ofthe responsibilty. On the other hand, surely not zero, for the customer would never have been exposed to the thieves if it weren't for your failure to take reasonable steps.

    It's clear you bear some responsibility, but the fact there is no way to quantify your contribution to the customer's loss bears on a bug in the law. If the damages cannot be quantified, you are completely off the hook as far as liability is concerned. The customer can get injunctive relief. The courts can say, "stop doing that." But that's it.

    One thing the legislature can do is specify a standard damage figure. Let's say that your negligence leads to identity theft of a customer. They can say that if you negligently contribute to that, you are responsible for $1,000 of "per se damages", whether the total actual damages suffered by the customer are $100,000 or $1,000,000. It sounds reasonable and manageable. It may be enough (in aggregate) to motivate your less morally scrupulous competitors to match your principled investment in customer security.

    But remember the anguish suffered by the customer? The humiliation? The year of his life devoted to dealing with a stupid credit rating crisis? Once he has handle on your for the $1,000 of damages, he can also add the cost of those things, plus payback.

    This leaves us with three options.

    Option 1: leave things as they are. This is good for your unscrupulous competitors, maybe not so good for you. Definitely bad for consumers (including you in your role as consumer).

    Option 2: specify "per se" damages. Unfortunately, you'll never know how much protection is "enough". Enough is enough to convince any conceivable jury you did your duty. Better add to your liability insurance.

    Option 3: regulatory oversight. Expect having to file data security reports.

    Which approach is least burdensome to society as a whole? Which of these can businesses manage to deal with? Overall, a well designed regulatory regime is probably the most predictable and manageable. On the other hand, it's always possible for regulations to be drafted that don't do the job and cost a lot of money. It depends on who is running the regulatory agency, in this case, ultimately, the governor of California.

    --
    Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
  80. Re:He's the "Governator"! (giggle) by Tetsujin · · Score: 1

    Do you honestly believe that the man doesn't think being called the Governator is funny? His primary fame came from those movies. It isn't like they are calling him anything inherently derogatory. He was famous for being the Terminator, he is the Governor, he is the Governator! Big deal, don't get your panties in a twist over a dumb nick name. I really suspect that he probably thinks its funny that people call him that, shit, it wouldn't surprise me if he likes the nickname given that he got it for being wildly successful. Oh, and here I thought it was because he was in Predator... silly me...

    It's just dumb, is all. "I remember Arnold Schwarzenegger was in this movie when I was a kid, and now he's a governor! Sounds like it's time for a portmanteau!" It's fine to poke fun at the guy, but if you're going to refer to the man in a news story you ought to use his proper name and/or title at least once in the story...

    I could give a flying fuck about what Arnold thinks of his various nicknames. I am just embarrassed that a group I'm a part of is showing so little imagination in its attempts to be clever... I'd rather see some semblance of dignity rather than a cheap, extremely lame joke...
    --
    Bow-ties are cool.
  81. Arnold doesn't think very long about some things by Catbeller · · Score: 2, Insightful

    Goodness, we don't want to make businesses pay money for stuff.

    Arnold: the business community had no problem spending money to build the infrastructure to take our privacy away. They must have collectively spent hundreds of billions on the computer systems, the software, and the deals they made to trade the details of our lives to the highest bidder. They are now cooperating with a police state unrivaled in history, giving over our finances, our communications, our very second-to-second physical locations to shadowy figures who sneer at the courts.

    They also have no problem making billions exploiting the data they spent so much money accumulating and processing.

    Businesses have no "right" to accumulate data and exploit it anymore than they have a right to dump poison in a river. Profit for shareholders is not an excuse. You want to be bastards, pay the bastard tax. And corporations are government creatures, not freeholds. They exist under government license. They have NO OTHER existence other than through the government. Without the government, they are just shopkeepers with known addresses. They are shielded from liability and personal exposure for crimes. You want to play with the government, play by the government's rules. Cry me a river.

  82. Arnold doesn't worry about other compliance costs by tooler · · Score: 1

    Arnold should have applied the statement, "driven up the costs of compliance, particularly for small businesses," to the ridiculous, useless, and costly microstamping firearms law he signed in California.

    Even if you're a hardcore anti-gun zealot, that bill was pretty silly.

  83. Re:Too much effort to comply IS an excuse by Anonymous Coward · · Score: 0

    If I had more disposable income, I would buy more time.

    While there are a variety of taxes, the most common is income tax which applies to profits. If you're losing money on the extra employee then you won't be paying taxes and you might even get a tax credit.

    What the government does do though is to force you to spend your profits on things you wouldn't necessarily spend them on. For example, you might prefer to spend your profits on 25% hookers and 75% blow but the government comes along and takes your profits and uses them to buy you 75% hookers and 25% blow. Now you've got yourself too many hookers and not enough blow.

    It gets worse than that though. All the hookers keep you awake all night and then you don't have enough blow to keep yourself awake for your day job at the blow factory which slows the production of blow which creates a shortage of blow which drives up the price of blow which means that the 25% of your profits that the government is using to buy you blow now buys you less blow. Eventually, the cycle continues and you run out of blow entirely and the economy grinds to a halt.

    Of course the government could also takes your profits to buy you some shared infrastructure, such as roads, that would actually allow your business to function - but why would they do that when there's hookers and blow.

  84. Market failure vs. government failure by tepples · · Score: 1

    I'm arguing the lack of logic in claiming that some fictional entity ("the marketplace") can provide protection in one instance ... but not in other instances. Markets have a difficult time with a thing called externalities. For example, a pure free market is not guaranteed to make any provision for those not able to provide for themselves, such as children, elderly people, or people with various physical or mental disabilities. These people may turn to property violation to sustain themselves, which shows up in the market as an externality. Governments institute social welfare obligations in part to mitigate the motives that lead to this externality.

    So that certain instances require legal regulation. Ideally, lawmakers should balance the probabilities of market failure and government failure when deciding on the scope of regulation.
  85. Then what is "waste"? by tepples · · Score: 1

    Money is like energy, you cannot waste or eliminate it. It just gets transformed into something that might not be useful for you. I thought the definition of "to waste" was "to transform into something that might not be useful for you".
  86. Re:Arnold doesn't worry about other compliance cos by UseTheSource · · Score: 1

    Agreed. Through driving up manufacturing costs and making it harder for manufacturers to comply with their regulations (especially the smaller ones), the anti-gun zealots are effectively using a back-door method of curtailing gun ownership by law-abiding citizens. Since they're losing ground on their contrived assertion that the Second Amendment does not guarantee an individual right, they're essentially taking whatever steps they can to effect their agenda by other means.

    In tests, the durability of microstamps on breach faces, extractors and firing pins on semiautomatic handguns has been called into question. Nevermind the fact that not one case has been solved by Maryland's "ballistic fingerprint database" (a similar system) to date and resourceful criminals could remove the stamps or replace parts with unstamped ones. What's to stop a criminal from scooping up my spent shell casings at the firing range and leaving them at a crime scene to throw off investigators, or just using a revolver that doesn't leave cases behind? What about reloaded cartridges with multiple stamps?

    While touted as a "common sense" measure by anti-gunners, with seemingly no good reason for opposition, this law is actually wasteful of law-enforcement resources. Plus, it's an undue burden on manufacturers and gun owners, which is exactly what they want.

    --
    "Ein Volk, ein Reich, ein Führer." -Adolf Hitler
    "We are one Nation, we are one People." -The One 'leader'
  87. Re:He's the "Governator"! (giggle) by db32 · · Score: 1

    So, why doesn't anyone ever seem to be upset about calling Reagan "The Gipper". Same thing...same exact thing even, because it was also from a movie role. Governator is also a hell of a lot easier to spell than Schwarzenegger. I don't see it as undignified, insulting, or anything to be even remotely upset about. It's like the little emo cry baby guy screaming "Leave Britney Alone." I have a difficult to spell/pronounce last name so I have had more nicknames, shortenings, and whatnot that I can count. It doesn't bother me, and actually frequently am amused by the nicknames people come up with (assuming they aren't being derogatory pricks).

    YOU think its a cheap extremely lame joke. Most people think its just an amusing nickname and most people don't give a shit about it. I would even be willing to give you some leeway on the argument with "Slick Willie" or "The Shrub" or even "King George" because those were meant to be largely derogatory.

    --
    The only change I can believe in is what I find in my couch cushions.
  88. Re:He's the "Governator"! (giggle) by db32 · · Score: 1

    Oh and by the way you should at least read the summary and article once before going off on it.

    "The Governator has killed a recent data protection law in California, and it won't be back. Using a tried-and-true argument, that the bill would have 'driven up the costs of compliance, particularly for small businesses,' California Governor Arnold Schwartzenneger vetoed what some are calling one of the nation's most stringent proposed e-tail data breach security laws."

    Okay...I see 1 Governator reference in the title, 1 Governator reference in the summary, and oh...wait...what is that?! His full freaking title and name and title!...So look at that, used at least once just like you said. Now read the article. I count no less than 7 times he is called governor, 5 uses of his last name, and 0 governator lines. So once again, what the hell are you whining about?

    --
    The only change I can believe in is what I find in my couch cushions.
  89. Re:He's the "Governator"! (giggle) by Tetsujin · · Score: 1

    Geez, dude, why so defensive?

    Just calling it like I see it. I think it's a feeble joke, so I said so. It doesn't help that the article calls attention to it by putting it - not in the summary somewhere, but right on the headline where everybody can see it. If I'm in a group of people, telling a joke, shouting it out so it can be heard over the normal conversation... and that joke sucks... of course people are going to tell me it's not funny.

    I am not saying don't tease the man. He is certainly a source of countless laughs. Just, you know, make it a good one, or don't bother.

    And, yes, I screwed up in my last post. Good catch.

    --
    Bow-ties are cool.
  90. Re:Davis recall by AuMatar · · Score: 1

    Because more people want him elected than want him not elected. At the very least, if you want to do some sort of runoff do a true runoff. I garuntee you every politician in the US has more than 50% who would prefer someone else. That sort of braindead system pretty much garuntees all incumbents will lose recalls.

    --
    I still have more fans than freaks. WTF is wrong with you people?
  91. Re:He's the "Governator"! (giggle) by db32 · · Score: 1

    Because honestly, being able to say stupid shit about our elected officials is a rather critical point in remaining free. The day we MUST remain respectful to those with political titles is a dark dark day for the people. So you might as well enjoy it before Dubya get supset about beign called the Missing Link and bans evolution theory outright.

    --
    The only change I can believe in is what I find in my couch cushions.
  92. Re:He's the "Governator"! (giggle) by Darby · · Score: 1

    We're talking about California and you're talking about Minnesota. Try and keep up now.

  93. Legislative Action Hero by Tetsujin · · Score: 1

    Because honestly, being able to say stupid shit about our elected officials is a rather critical point in remaining free. Fair. Though sometimes I wonder if not taking them seriously is just one more way of ignoring our problems...

    And yet, if said stupid shit makes my eyes roll, you win a STFU. Jokes ought to be funny.
    --
    Bow-ties are cool.
    1. Re:Legislative Action Hero by db32 · · Score: 1

      I don't think we CAN take them seriously. Senator Foottapping I'm not Gay Craig, Senator Think of the Children Foley. The list goes on. Now, I think taking them seriously and holding them all accountable for being worthless scumbags aren't the same thing. We are definetly lacking on the accountability part. But think about it for a minute, most of the people that would even catch half the references/jokes are already at least aware of what is going on. The vast majority of the populace doesn't know, doesn't care, and only sees the stupid sensationalist pieces like "I'm not Gay" Craig, and have no idea that Senator "Internet Tubes" Stevens is under major investigation for big time bribes.

      On that note, I really am not partisan, but why the hell do the Republicans seem to get the most monumentally stupid scandals? I mean, the blowjob thing was kinda big, but pretty minor stupidity in the grand scheme of things.

      And I would guess that most of them are meant to make your eyes roll. Funny is also pretty subjective. I have seen a disturbing number of people watch people getting killed in various ways and they think that is funny. There is also the whole realm of jokes that aren't supposed to be funny because the groaning reaction from the "victim" hearing the joke is the funny part.

      --
      The only change I can believe in is what I find in my couch cushions.