Nevada Businesses Must Start Encrypting E-Mail By Oct. 1st

dtothes writes "Baseline is reporting the state of Nevada has a statute about to go in effect on October 1, 2008 that will force businesses to encrypt all personally identifiable information transmitted over the Internet. They speak with a Nevada legal expert who says the problem is that the statute is written so broadly that the law could potentially open up a ton of unintentional liability and allow for the interpretation of things like password-protected documents to be considered sufficiently encrypted. Quoting: 'Beyond the infrastructure impact, the statute itself looks like Swiss cheese. Bryce K. Earl, a Las Vegas-based attorney, ... has been following the issue closely and believes there are some problems with the statute as it is on the books right now, namely the broad definition of encryption, the lack of coordination with industry standards and the unclear nature of penalties both criminal and civil.'"

Comments

I wonder . . .

[base3]

. . . which Nevada legislator's friend or relative just happens to sell some kind of compliant encryption solution.

Re:I wonder . . .

[Cajun Hell]

But the the best encryption is free and the text of the law doesn't even exclude it. If someone wanted this bill to make money for their friend, they sure screwed up.

How about http web traffic?

[cryfreedomlove]

If I am an ecommerce website, am I now expected to encrypt all http traffic destined for customers I know to be in Nevada?

Re:How about http web traffic?

[SoCalChris]

But from the sounds of this law, simply having a small "Hello fm6" message at the top of the page would require the entire page to be encrypted, not just the login/out and payment screens.