Slashdot Mirror
Losing Personal Info On A Laptop Could Get You Charged
E5Rebel writes "The UK's data protection watchdog has called for legislation that would punish corporate or government officials with access to the public's personal data ... who lose it. Unencrypted laptops with this personal information which are lost or stolen will see their owners facing criminal charges. 'HM Revenue and Customs is among the organisations that have recently suffered high profile data security breaches as a result of laptops being lost or stolen. The HMRC laptop containing taxpayer data was encrypted - but other organisations have often failed to encrypt their machines.'"
Might make these idiots think before going out on a piss-up on the way home and taking the laptop with them, then losing it. Legislation like this - which actually takes people's privacy seriously and does something about it - is something we could use more of. And I don't normally hear myself clamouring for new law...
:|
I'm all for hardening our security systems in order to both prevent these types of accidents in the first place and to minimize the impact of such accidents in their inevitable occurences. I can't think of any reason a laptop would need to carry that sort of data, much less have it contained on the hard disk in an unencrypted filesystem.
But what I can't fathom is the animal-like need for vengeance against the poor government employees who lost the data as the result of one of these accidents. Unless we can show that the person was deliberately taking the information off-line and then staging the theft, how can we possibly in good conscience ruin this person's life just because he forgot a rule. These aren't the Queen's guards, we're talking about. These are people who work for the government (take that in any way you want).
Why are we not holding banks liable for having a system that encourages identity theft by making it as easy as stealing a laptop? Or holding wallet makers responsible for not securing wallets with anything stronger than a clasp? The reason is because we realize that there are limits to the abilities of these companies that can't be stretched much further. Government employees are mentally stretched to their breaking points. How dare we threaten them with jail time when we can't expect any more from them in the first place?
Might as well squeeze blood from a stone.
I tend not to worry too much about my personal data, but I understand why some people do. If somebody is stupid enough to loose (or get stolen) a computer with other people's data in it, s/he should have to face the consecuences. I guess at some point anybody who is given other people's personal data should have signed something, taking responsibility of their acts.
I'm not saying the punishment should be high, but just as killing someone by not being careful enough is homicide, I think this same idea should be applied in this case.
In any case, if the loss of data has been purely accidental, with no lack of carefulness by the perpetrator, there should be no punishment at all.
Tis women makes us love, Tis Love that makes us sad, Tis sadness makes us drink, And drinking makes us mad.
In the modern world, people really need to learn more about data hygiene and security. If criminal charges are what it takes for large organizations and also the general public to become more serious about the routine security of information, then perhaps this is not such a bad thing.
A couple of examples ;
My wife wanted to use my credit card (she doesn't have one) to pay the fees for a educational conference. The conference organisers had a system for collecting payment ; just email all your credit card details (in plaintext) to the secretary! She looked a bit surprised when I refused. When I explained that it would be like writing my card information on a postcard, with a postal service composed of, well, anyone, who would be at liberty to take "photocopies" of the postcard anywhere along it's journey, she was a little more understanding. (I made her telephone the person concerned instead). Perhaps if the iconography of email programs was more "postcardy" instead of "envelopy", this would happen less.
Our office VPN is secured at the concentrator by two-factor authentication. Each user is issued an RSA SecureID token. Last year, they issed the PIN correctly ; the administrator pushes a button and says "NOW" and you remember the first four digits the token is showing - and then you are only person who knows it. This year, they preset them all and mailed them out. Email, that is. In plaintext. This undermines the basic security of the system ; anyone who gains access to those emails now has a list of PINs, most people clip them to the same lanyard as their security pass, identifying the token user. Or even easier, they can do what I did, walk into the office, say "Hi there, can I have my new token...." only to be waved towards the table where they ALL sat, in named envelopes, without my ID even being checked. And this is from people who are supposed to know about information security.
Hopefully the stick of criminal penalties will be wielded diffidently. But people have to shift their perceptions ; data on paper is treated with reverence and locked in a safe, when the data on the computer is left lying around for literally anyone to get hold of. Perhaps this attitude comes from the ease with which computers generate the data in the first place ; it feels cheap and thus "disposable". Which seems silly to a person who knows that a properly managed digital signature is MUCH more secure and reliable than its paper equivalent, but is counter-intuitive to anyone else who still thinks the gold standard is a notary.
How do they propose to enforce this. I would bet damn near 100% of data breaches are self reported by the losing party. If you are suddenly going to face criminal charges I bet it will be a damn rare case where thefts actually get reported. So the statistics will show that data loss is at an alltime low and yet people will actually be at MORE risk due to the fact that companies that would have previously reported the incident and paid the couple hundred thousand for identity protection for a year or two will now keep things quite. Beyond which I also know from published studies that lost information devices have resulted in basically no known identity theft but lack of shredding (dumpster diving) and unsecured databases have led to a heck of a lot of cases.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Wouldn't due diligence specifically exclude using windows?
It's one thing to leave the notebook running on your passenger seat and another one having it taken from you at gunpoint. What I'd expect to happen is this:
1) Create sensible security rules that should keep the data safe, even when on a notebook. Current notebooks are fairly easy to secure to the point where theft of the notebook doesn't mean theft of data. That includes, but is not limited to, choosing secure hardware and software, limiting laptop use to work, reducing user rights to the minimum for operation.
2) Train people and give them a fairly heavy "or else" to follow those rules.
3) If they follow the rules and still have their notebook stolen, no problem. If they're careless, throw the briefcase at them.
What I want to see is the government as a whole to react to the threat. Not finding a scapegoat to take the blame, sack him and go on with the same shit.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Here we go again, as mentioned, we are trying to enact laws that punish the wrong person(s). The fact that they have personal data on a laptop that is not physically secured is a sign that the organization that they work for is corrupt or inept. Please please please let's look at how such incidents happen, then punish the culpable, not simply state that the bag man is going to hang.
I believe that you will find that in more than 90% of such cases, the end user was following the given policies for the data they were using. We ALREADY have laws for how that data is to be treated. Breaches of those laws must be processed before we look for new laws. I cannot cite any specific regulations, but financial institutions and basic corporations now have legal requirements on how to treat privacy information. SarBox law in the US, and I'm sure that the UK has similar regulations. The fact that the information is getting 'lost' to someone in the public is not indication of criminal activity, but lax processes in the organization for which they work. Laptop theft is rampant, some would say, because they are easy to take. Often because the theft is easy, and done by someone who has no idea what is on the laptop hard drive.
So, lets just have guidance on how to process the legal side of such breeches. Find out what safeguards were in place, if they were being used, if the end user was obviously ignoring them etc. There is seldom need for new laws, simply better processes or guidelines for using what currently exists. Remember, tax evasion was used to get some mobsters? Misuse of government equipment? How about dereliction of duty? There are tons of ways to punish someone without creating new laws. I sometimes think that people would enact a law to prohibit large turds if it would stop the problems with the outdated treatment plants. Look at all the silly laws that are still on the books. Do we really need a new law that will be useless in 5 years?
Politicians and the Internet.... oil and water.
Support NYCountryLawyer RIAA vs People
If a PC (or laptop, or a server)that holds confidential data is audited and shown to be vulnerable to external attack, then this is just as negligent as leaving unprotected data open to theft and should be treated in the same way.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
Agreed. It's not that people don't think about it; I work in IT, and we think about it all the time. But it's very difficult to actually enforce meaningful security if nobody understands the point of it. It simply gets seen as a hassle imposed by IT because they're control freaks trying to make themselves look important to the rest of the organisation. The top management doesn't care; all they hear is the hassle it's causing their Executive Directors when IT won't let them log on to the VPN while they're at the airport because they left their RSA token at home.
Unfortunately, if you set up good security and the users don't understand it, they'll circumvent it: the private key used to unlock the laptop's encrypted drive will be stored on a USB stick with the laptop, along with a sticky note with the user's password and their RSA SecureID token. So not only do people resent you when you try improve security standards, but they actively seek to undermine it. Even a single crappy password like "Wednesday1" is better than having everything you need to access sensitive data neatly packed with the laptop.
Therefore, to get proper security, everyone needs at least an intermediate level understanding of computer security. That's a massive undertaking for most organisations, where people's main job function isn't anything to do with computers. Most people don't want to understand computers at all, they just want to use them. Kind of like telephones: most people don't even consider for a moment if their phone is secure or not, and have no interest in learning how the call they make from their office phone gets from their desk to the other side of the country.
Really, before you even have a shot at putting in place meaningful, consistent security, you need a long-term commitment from all levels of management to establish and maintain strong security and train the staff to use it properly, even when it causes inconveniences. Given how much trouble we have getting people to use the records management system properly, this actually seems like a very high mountain to climb.
The possibility of being embarrassed because of data theft isn't anywhere near a strong enough motivation for most organisations. Therefore, legislation like this is probably a good move -- though I think it should apply to any organisation that collects personal information, government or not. But you have to start somewhere.
Furthermore, it shouldn't require actually losing data before there's a possibility of punishment. One should be able to report agencies and companies that aren't taking their duty of care seriously, and report them. Otherwise it's still easier for a lot of organisations to say "it won't happen to us" and only pay lip-service to information security. So, if your bank is using dubious client-side "security", report them!
There'd be a lot of short-term pain, but long term gain. It might even slow down the pace at which computers take over the world, and maybe us folk that program and administrate them can catch the fuck up with what users are expecting from it all.
Why are we not holding banks liable for having a system that encourages identity theft by making it as easy as stealing a laptop? Or holding wallet makers responsible for not securing wallets with anything stronger than a clasp? The reason is because we realize that there are limits to the abilities of these companies that can't be stretched much further. Government employees are mentally stretched to their breaking points. How dare we threaten them with jail time when we can't expect any more from them in the first place?
Perhaps they should have thought of that before legally compelling me to disclose sensitive private data that could be used to ruin my life if it was abused or fell into the wrong hands?
If the situation is reversed, and a member of the public fails to follow procedures that have been shown to be too complicated for the average citizen to get right, the government has no trouble with imposing instant fines instead of allowing people to fix honest mistakes.
I have absolutely no sympathy for the government here. They make the rules. No-one is forcing them to make laws like this, and no-one is forcing anyone to work for departments with lax security. If you make a pact with the devil, expect to go to hell.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Ok... hypothetical (but realistic) situation:
What about if your job calls for you to take a laptop that you don't necessarily "want", but it's now part of your job (as a travelling salesman, a consultant, or whatever)? And what if the lunkheads who image that laptop don't bother to put any encryption or other data protection software on it? And you're not allowed to add any "unauthorized software" to help protect yourself?
Guess what? Your employer has made you the IT equivalent of a soft target.
Under the above scenario, it seems enormously unfair to become subject to criminal charges due to the negligence of your employer. Easy for all you critics to say "go get another job"... while that certainly would be the ultimate solution, that's hard to do in an economy where consolidation and right-sizing still rule the day.
The problem with socialism is that they always run out of other people's money. - Margaret Thatcher
Physically losing a laptop, is not in itself a crime. The negligence aspect of containing confidential data on an unsecured device is what turns stupidity into an offence.
Securing and encrypting the drive is a job for the organisation's IT infrastructure team, not the end employee. Given that government officials are generally not the most tech-savvy people around, it seems crazy to punish them for something that should already be pre-installed on their machine when they receive it.