Slashdot Mirror
Gridlock In Action: Retailers Demand New Regulations To Protect Consumers
chicksdaddy writes: How bad is the gridlock in Washington D.C.? So bad that the nation's retailers are calling for federal legislation on cyber security and data protection to protect consumer information — even though they would bear the brunt of whatever legislation is passed. The Security Ledger notes that groups representing many of the nation's retailers sent a letter (PDF) to Congressional leaders last week urging them to pass federal data protection legislation that sets clear rules for businesses serving consumers.
"The recent spate of news stories about data security incidents raises concerns for all American consumers and for the businesses with which they frequently interact," the letter reads. "A single federal law applying to all breached entities would ensure clear, concise and consistent notices to all affected consumers regardless of where they live or where the breach occurs."
Retailers would likely bear the brunt of a new federal data protection law. The motivation for pushing for one anyway may be simplicity. Currently, there are 47 different state-based security breach notification laws, as well as laws in the District of Columbia and Guam. There is broad, bi-partisan agreement on the need for a data breach and consumer protection law. However, small differences of opinion on its scope and provisions, exacerbated by political gridlock in Congress since 2010 have combined to stay the federal government's hand. Meanwhile, reader schwit1 points out that banks are now starting to demand that retailers pay for all the financial damage their security breaches cause.
"The recent spate of news stories about data security incidents raises concerns for all American consumers and for the businesses with which they frequently interact," the letter reads. "A single federal law applying to all breached entities would ensure clear, concise and consistent notices to all affected consumers regardless of where they live or where the breach occurs."
Retailers would likely bear the brunt of a new federal data protection law. The motivation for pushing for one anyway may be simplicity. Currently, there are 47 different state-based security breach notification laws, as well as laws in the District of Columbia and Guam. There is broad, bi-partisan agreement on the need for a data breach and consumer protection law. However, small differences of opinion on its scope and provisions, exacerbated by political gridlock in Congress since 2010 have combined to stay the federal government's hand. Meanwhile, reader schwit1 points out that banks are now starting to demand that retailers pay for all the financial damage their security breaches cause.
I think this is just CYA. The government will set a minimum standard of security which the retailers will set as their default level and that way when a breach happens they can say, well we followed the government mandates, we should not be sued. This is not for the customers, it is for the retailers.
In reality they should be securing their systems to the best of their ability.
When you cant win, ad hominem.
What's this got to do with traffic problems?
>> gridlock...nation's retailers
Er...lobbiest fails to do job, so panic?
>> they would bear the brunt of whatever legislation is passed....there are 47 different state-based security breach notification laws
In other words, they want a single Federal law to replace all the state laws, which would do two things: 1) allow them to concentrate their efforts on watering down the federal law 2) take the ability for people to collect damages against it out of state courts and 3) reduce their notification costs because they would only do the bare minimum required by the federal law (e.g., filing it in a basement drawer marked with "beware the leopard"). I see no "brunt" here. (IANAL)
Translation: Please pass a law that dictates the minimum effort we are required to put forward so we can barely meet that very low bar and not get sued. As it is, we have to actually pay attention to security and update constantly. If you pass a law, it will be out of date in about 3 months... but hey! At least we can't get sued. And that's all that really matters.
So you'd rather have it so there are no Federal consequences for being a sloppy, lazy, bug-infested easy target?
Sometimes regulation protect all of us, not just corporations. This could be one of those.
OK, I have a non-regulated approach to fighting breaches: If your company is stupid enough to get breached, the banks and card issuers must block you from doing credit and debit card business again -- ever. Good luck with cash-only.
Is that too cold-hearted for you? You'd rather have that instead of rules and consequences for data breaches?
The "Civilized World" jumped the shark ca. 1973.
This isn't (just) about trying to dodge liability by having defined standards to meet.
The big retailers are all spending shitloads of money on security because they have to. Now they want regulations that require everyone else to do the same.
A few million each year for security compliance is nothing to Target or Walmart. It is a dagger in the heart of their local and regional competition.
See that "Preview" button?
Yeah, no, no they don't.
Which is why the Republicans have been de-regulating, because when corporations can do anything they want, that protects corporate interests.
Regulations protect us from corporations.
Lost at C:>. Found at C.
Sounds to me like the default outcome down this path is that the banks start forcing the retailers to eat the losses rather than covering it themselves. Which would mostly work for me - let the people responsible for allowing the breach pay for the privilege of being sloppy. In that context federal regulations would likely indemnify them against damages if they employed the legal minimum of protections, or at least make sure that all their competitors are footing a comparable bill so that the cost of security doesn't put them at a competitive disadvantage.
Sure, we'll get some incremental protection via the regulations, but nothing compared to what the retailers are likely to get.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
The banks are not the point of contact for the consumer ... the retailer is. Banks AND retailers want the retailer to bear the cost so the retailer can pass it on to the consumer.
Consumers, in one form or another, will be responsible for breaches.
It little behooves the best of us to comment on the rest of us.
Gridlock? Yes, the democrat Senate has prevented many bipartisan House bills from passing. It will be good to see the Senate in the hands of the GOP. Hopefully Obama won't continue the gridlock by vetoing bills.
FOUR LEGS GOOD TWO LEGS BAD
I can't understand people who think reality is simple.
Consumers don't properly appreciate cyber security. Nor do stockholders. This makes it difficult to justify the expense of proper security. But if it is a legal requirement, then you can do it.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Ted Cruz is a fine American. Get used to him, he will be leading this great nation.
If they are negligent, and you are harmed, you sue. Is this concept so difficult? With regulations, you still may be harmed, but they are protected from negligence, and you are unable to sue. Easier to pay off a few polticos than millions of victims, no?
Because really, who wants to deal with 47 different state laws when you can just have one federal law? At the very least, it would save their legal departments a lot of headaches.
Just turn NFC back on while you wait for CurrentC to get off the ground and be tested sometime next year. It's already on your registers, and some of the NFC vendors have high-grade security that sharply reduces the risk of credit card breaches.
Yo moron, they're trying to reduce their liability not protect the consumer. FTA: "Currently, there are 47 different state-based security breach notification laws, as well as laws in the District of Columbia and Guam." Do you understand now?
If we make the lenders liable for all the damage caused by them. We don't even need any new laws for this. The lender has all the right to be very lax and extend credit to any Tom Dick or Harry. But if they are going to report to credit reporting agencies about default or missed payments, they have to prove that the credit was extended to the correct person. If they mistakenly report missed payments on the victim of identity thefts, the banks should be fully liable for all the damage caused to the innocent party.
The banks are the worst. They extend credit without checking. They destroyed the cheap Point-of-sale pin encoded debit/ATM transactions by conflating it with credit transactions. Merchants who used to pay a flat fees of 25 cents or so per transactions are being saddled with 2%.
The financial sector has gone from less than 5% of S&P500 index to 15% of the index. From all the economic activity going on in the country the banks rake in more than 50% of the profits. Companies that take the risk and actually make products make much less money than the the banks.
The banks have grown too big to fail, too big to jail.
All the talk about government must be small misses a crucial point. The moment the government becomes smaller than the most powerful person, that person would drown the government in a bath tub. The courts have ruled corporations are people. Now corporations are actively drowning the government in a bathtub. The banks are at the forefront. If we don't realize and and reign in the banks, we are doomed.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
LMOL - do you know where regulations come from? They come from corporate lobbyists. Corporations write legislation that Congress passes. These "regulations" reduce the liability to Corporations. They do not protect consumers! Check out ALEC sometime.
Except it's not consumer protection. It's corporate protection. Try taking our head out of your ass sometime.
The gridlock has been so bad that the American public has voted to fix it. Yay!
LMOL - only in your tiny little mind.
Wow, such a simplistic and reductionist world view you have.
Yes, laws which are written on behalf of corporate lobbyists are designed to game the system to give corporations the most freedom. This means you should stop the process of corporate lobbyists, because they don't help anybody except corporations.
But, environmental laws, consumer protection laws, banking laws, laws designed to stop insider trading ... these are all intended to prevent corporations from being able to do anything they please without consequence. Those laws are the kind of things some people want to repeal under the notion that anything which prevents a company from acting like assholes is unfair.
So, if you say "all government regulations are bad", it's as stupid and meaningless as if you say "all government regulations are good".
One political end of the spectrum wants to pass laws to limit the amount of crap companies can do. Another end of the political spectrum wants it to be "anything goes" for corporations.
The latter of those two? They're the people behind your ALEC, and the people who would do away with any form of environmental and consumer protection. These are the people who want you to have an oligarchy in which humans are secondary to corporate profits.
Anybody who says "it should be ok to pollute, and to make toxic products because the free market will regulate itself and people will make good choices" is lying to you. Because it won't happen that way.
Lost at C:>. Found at C.
The cost of fraud and security is built in to the interchange rates that make up the bulk of card-present fees from Visa et al. By and large, the retailers already cover those costs. If specific retailer-focussed fines are put in place they should be accompanied by a drop in interchange rates (not going to hold my breath here). Also, by reducing cost-sharing and increasing self-insurance, that's another way of squeezing out smaller merchants (who can't begin to cover those costs) in favor of the larger ones (who don't need external underwriting to do so).
You're special forces then? That's great! I just love your olympics!
The problem is that the technology to make the breaches meaningless has existed for decades now but the banks refuse to implement anything like it. The banks are the ones that have foisted the fundamentally flawed system on the retaiolers and now expect them to spend bucketloads of cash on shoring it all up.
As long as they are allowed to continue pushing the costs off onto merchants and consumers, the problems will continue.
For example, if credit cards were smart cards and consumers carried a cheap dumb card terminal with them, they could cryptographically sign transaction records which retailers could submit once. It wouldn't actually matter at that point if each and every such record was copied as soon as it was made or even if the POS terminal was actively infected at the time. The records could only cause the purchase amount to transfer from customer to merchant once.
Now that the Rs are in power, it's time to Obama to lean in and take one (or ten) for the team. Everything that's good, come out against it; everything that's bad, say you support it. The Rs will slavishly oppose and BAM! Progress.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
> and Guam
"Oh no! Someone took the credit card receipts from the grocery's trash! Well, according to Guam law, we must notify consumers."
(Opens window). "Hey, Frank! Charlie took your credit card receipt! Oh, and Paul, get your damned chickens off the runway!"
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Which is the exact opposite of what merchants are trying to do with their shitty CurrentC.
They don't want security, they want protection from liability. They probably want to move that liability onto the consumer.
The summary claims that the retailers would bear the brunt of the legislation. The opposite is true. The letter is written by retailers, asking for increased regulation of cloud providers and banks. The letter is specifically calls out Apple and J.P. Morgan as the causes of recent data breaches. It complains that the retailers are responsible for notifying their customers of breaches, but they aren't the only link in the chain.
Or maybe not. Along with such regulations usually comes immunity from liability lawsuits.
That sounds like fun. Unfortunately, instead, they just hand the money to their corporate cronies.
Just because something is called "consumer protection" doesn't actually make it "consumer protection".
That addresses a completely different attack vector, and I agree that the banks should be stepping up there. However, when Mom&Pop Co. has their credit card database stolen and I get hit with a bunch of fraudulent charges, yes - they should be at least partly liable.
Granted though - regulations requiring the banks to offer actual secure transactions would likely be a far more appropriate response: In a free market Mom&Pop would simply and easily reduce their liability by refusing to use insecure banking technology, but in a country where essentially no banks offer such technology their choice is only between accepting the insecurity or passing up the sales opportunity.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
there are 47 different state-based security breach notification laws
These retailers should be careful what they wish for. One of the main problems with health insurance used to be that every state had its own set of laws and licensing. Now that the feds took over the regulation of it they not only require everyone buy it but also dictate coverage levels, like it or not.
Yes, but likely in part because the last few years have made it apparent that banks will never be held accountable for the laws they break.
> FEMA homo training camps that is like boyscout camp but with somewhat less homoeroticism, right?
Well played sir, Well played!
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Except it's not consumer protection. It's corporate protection. Try taking our head out of your ass sometime.
Speaking of, it's pretty plain to see you have a sore one. It can be pretty tough at those Focus on the Family rallies.
No humor gene, it would appear.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
That sounds like fun. Unfortunately, instead, they just hand the money to their corporate cronies.
Just because something is called "consumer protection" doesn't actually make it "consumer protection".
Should I send a Whoosh with my posts these days?
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
No. Should I?
... of why libertarians are wrong about the role of governments.
Free markets are nothing that comes about naturally. It is the governments that create the regulatory framework that allows for free markets to function.
Business hurt when governments fail in this most important job.
Wrong, the reason we don't have EMV in the US is the retailers didn't want to pony up the cash to upgrade their POS systems. The banks finally put their foot down about 18 months ago and set a deadline that shifts the liability for non-EMV transactions to the retailer starting 9/2015.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Too bad they went from a totally broken system to a half broken system when they could have gone to a functional system.
Then there's the matter of the tech being decades old. They had the option to introduce it through attrition so the cost would be part of the normal upgrade cycle.
In cryptography old is good as long as the cypher strength is still sufficient to thwart expected attacks. The only weakness in EMV I'm aware of is a man in the middle attack against chip-n-pin where you can send a pin not required signal to the terminal if you can get between the card and the terminal. Since most US banks will be doing chip and signature, not chip and pin that's moot. If you're aware of another attack on EMV then please enlighten me.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Here we see people clamoring for government regulation of tech issues after numerous stories on that same government's lack of understanding of tech issues. Really?
If the banks charge the retailer that suffered the breach for the damages resulting from the breach, then only the offenders suffer rather than making everyone suffer under onerous and ill-conceived regulations. Not to mention that charging for the damages from a breach means the punishment will actually fit the crime. Further, punishing a single guilty retailer for a breach means the customers can go to another retailer that is not having to raise prices to cover a breach fine, which is even more incentive for a company to protect against a breach in the first place.
And all this takes place without the need for 2000 pages of regulation that nobody will be able to understand and no risk of unintended consequences resulting from it that nobody can fix because of the same gridlock the article summary complains about.
It's like that scene in Kill Bill where Budd's manager tells him that "fucking with your cash is the only thing you kids seem to understand."
Web and mail order (that is, card not present transactions in general).
A proper public key signature card benefits from being old (well understood) and having a sufficient key strength. It could even be used to sign a recurring charge authorization.
He's a Cuban-Canadian ineligible for Presidency.
Learn to love Alaska
>I sincerely hope you die a traumatic death at the hands of a greedy corporation who doesn't care about your safety.
That would be awesome.
And I sincerely hope that you live a long, happy, and healthy life.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.