Slashdot Mirror
Obama Proposes 30-Day Deadline For Disclosing Security Breaches
Following the string of massive data breaches at major corporations, President Obama has called for legislation that would standardize how these incidents are disclosed to the public.
"The Personal Data Notification and Protection Act would demand a single, national standard requiring companies to inform their customers within 30 days of discovering their data has been hacked. In a speech Monday at the Federal Trade Commission, Mr. Obama said that the current patchwork of state laws does not protect Americans and is a burden for companies that do business across the country. The president also proposed the Student Data Privacy Act, which would prohibit technology firms from profiting from information collected in schools as teachers adopt tablets, online services and Internet-connected software. And he will announce voluntary agreements by companies to safeguard home energy data and to provide easy access to credit scores as an “early warning system” for identity theft.
...and pretty common-sense. It will be interesting to see if this gets implemented or not.
He says as ISIS literally gets into the CENTCOM twitter account and posts military personnel's addresses/info, data from the pentagon and other bullshit
I mean come the fuck on
Data apocalypse now
This will be considered 'anti-business' and the Republicans won't let it through Congress, just you watch.
Mr. Hu is not a ninja.
...and where was this nifty idea (and the free college one too, and immigration reform, etc.) during his first two years in office (when the Congress was mostly Dems)?
Why does he even bother to open his mouth now?
This law sounds good, but it doesn't have a prayer:
1: Who enforces it? Will it be as toothless as HIPAA or SOX, where the only person thrown in jail on Sarbanes-Oxley was guy who fished up one too many groupers?
2: If enforced, where is there proof that the hole was discovered, and what date? I'm sure a H-1B will be darn sure to keep mum when he/she actually found the breach in order to not be deported.
3: What is a breach? Is someone duping gold on ClicheQuest considered a breach? A warp hack? What about a web server showing the FTP server's links? The courts can be clogged for years of lawyers deliberating this... and when it comes to technical issues, courts tend to side with what side has the most lawyers.
4: What happens when a breach and trade secrets smack into each other? A court erroring one way, and businesses can have their secret sauce dumped out by clever lawyers. Another way, and every breach can be covered up as a trade secret.
5: Who is going to fund enforcement? The next President may not bother funding this endeavor.
Nice political thing... but this law is actually not going to ever see the books. We will see mandated hardware DRM stacks and health checks to make sure DRM is present on all devices before we see this on the books and actively enforced.
Of all the laws that hasn't been put forth that is most sorely needed in the market, it's a law to prevent private companies from using SSNs for ID numbers, customer identification and credit granting. How many people have had to spend thousands of dollars and years in court trying to get their identities back and repair the damage to their credit because they know a name, DoB, address and SSN?
If Obama, or for that matter any leader at a time when Presidential and Congressional approval ratings are in the basement, were smart, he would
* sit down behind closed doors with leaders of both parties and major caucuses
* get a list of general things almost everyone agrees should pass in some form and for which a consensus bill can probably be reached
* quickly negotiate a broad "consensus bill" for everything in the above list
* quickly get the bills pushed through both houses of Congress, giving the small-minority voices that are against the bills or which favor won't-pass amendments a chance to speak and be heard.
* hold bipartisan signing ceremonies
* ???
* PROFIT in higher approval ratings for both the White House and Congress
Okay, I was kidding about the ???/PROFIT part but those inside the beltway really do need to realize there is a lot that they do agree on and they and America are better off getting the things that need to get done done rather than sticking to their guns just to spite the other party.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Many schools have a system where students submit papers through an online submission system that checks their papers against other papers in a database for plagiarism. Personally I find it incredibly offensive and fought successfully against such a system when I was in undergrad, because it assumes that a student is guilty then runs a check to make sure he isn't.
But regardless of the ethics or morality of the process, it *relies* on the vendor profiting from each submitted paper, in that each submitted paper grows its database of papers. The database is then cross-referenced against new submitted papers to look for plagiarism.
So if companies are prohibited from profiting from the information, it may be tricky to have this business model survive.
Of all the laws that hasn't been put forth that is most sorely needed in the market, it's a law to prevent private companies from using SSNs for ID numbers, customer identification and credit granting. How many people have had to spend thousands of dollars and years in court trying to get their identities back and repair the damage to their credit because they know a name, DoB, address and SSN?
That is technically already law; the problem is there is an executive order that allows for an expanded use, which essentially turned SSN (which was only suppose to be used for Tax and SS benefits and nothing else) into a National ID number, thus leading to the problems you see with it today.
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
prevent private companies from using SSNs for ID numbers, customer identification and credit granting
I'm not sure exactly what that would accomplish. The only reason its a Bad Thing(tm) when someone gets my SSN is precisely because that is the number everyone uses for credit granting. If they instead started using some other unique personal number for that purpose (lets call in UPN for the purposes of this discussion), then it would be the UPN I have to give out all over the place, and it would be the UPN that would be under constant thread of being stolen by identity thieves. The effects would be the same.
the National Security Breach database has been breached. Please try again later.
Sounds like a good idea. Now, let's get the NSA and FBI to fill one of these out.
Say what? I read the whole article without paying any fee, or logging in, or any other nonsense. If you have cookies from NYT, delete them and try again. Better yet don't accept them in the first place.
--
Obama to Call for Laws Covering Data Hacking and Student Privacy
By MICHAEL D. SHEAR and NATASHA SINGERJAN. 11, 2015
WASHINGTON â" President Obama on Monday called for federal legislation intended to force American companies to be more forthcoming when credit card data and other consumer information are lost in an online breach like the kind that hit Sony, Target and Home Depot last year.
The Personal Data Notification and Protection Act would demand a single, national standard requiring companies to inform their customers within 30 days of discovering their data has been hacked. In a speech Monday at the Federal Trade Commission, Mr. Obama said that the current patchwork of state laws does not protect Americans and is a burden for companies that do business across the country.
The president also proposed the Student Data Privacy Act, which would prohibit technology firms from profiting from information collected in schools as teachers adopt tablets, online services and Internet-connected software. And he will announce voluntary agreements by companies to safeguard home energy data and to provide easy access to credit scores as an âoeearly warning systemâ for identity theft.
âoeIf weâ(TM)re going to be connected, then we need to be protected. As Americans, we shouldnâ(TM)t have to forfeit our basic privacy when we go online to do our business,â Mr. Obama said Monday. âoeEach of us as individuals have a sphere of privacy around us that should not be breached, whether by our government, but also by commercial interests.â
Mondayâ(TM)s announcements were part of a weeklong focus on privacy and cybersecurity by Mr. Obama ahead of his State of the Union address next week. White House officials said they expected bipartisan support for the initiatives and did not anticipate fierce opposition from industry or advocacy organizations.
But on Capitol Hill, Mr. Obama faces a Republican-controlled Congress for the first time in his presidency. It remains unclear how quickly his adversaries in the House and the Senate will move to take up the legislation, and whether disputes in other areas could delay its consideration.
Consumer and privacy groups have yet to see details of the presidentâ(TM)s proposals, and some remain concerned that any federal standard could be weaker than the robust state laws passed in recent years. California, for example, recently passed a state law protecting student data.
âoeThe problem is that the effect will likely be to pre-empt the stronger state laws,â said Marc Rotenberg, the president of the Electronic Privacy Information Center, who favors disclosure faster than 30 days. âoeWe want a federal baseline, and leave the states with the freedom to establish stronger standards.â
Chris Calabrese, the senior policy director for the Center for Democracy and Technology, said that his group had not rejected the idea of a federal law, but that it depended on how it was written. âoeThere is a lot of concern in the advocacy community about the possibility of a federal law being watered down,â Mr. Calabrese said.
Corporate data breaches have gained urgency since attacks on Sony Pictures that officials say were done by the North Korean government. Under the proposed law, the discovery of a breach would trigger a âoe30-day shot clockâ that requires notification. The legislation clarifies when breaches must be disclosed and makes it a crime to sell a personâ(TM)s cyberinformation overseas. The Federal Trade Commission would get the power to issue penalties to companies that did not comply.
âoeThereâ(TM)s a crazy quilt patchwork of 48 state laws, and they are in tension with each other,â said Jon Leibowitz, a partner at
I'm not sure exactly what that would accomplish. The only reason its a Bad Thing(tm) when someone gets my SSN is precisely because that is the number everyone uses for credit granting. If they instead started using some other unique personal number for that purpose (lets call in UPN for the purposes of this discussion), then it would be the UPN I have to give out all over the place, and it would be the UPN that would be under constant thread of being stolen by identity thieves. The effects would be the same.
You're right. As long as the UPN is used for both authentication AND authorization, then you are screwed no matter what the number actually is. The trick is to separate the two functions somehow, and will mean a fundamental shift in how things are done.
The problem in the US is that the SSN is used for both authentication and authorization, even though it was only meant for the former.
I am Slashdot. Are you Slashdot as well?
I appreciate the intent, I really do. I reality, it will be very, very difficult to right sensible rules that apply to every situation. Typically, when you think you might have been hacked, there are more questions than answers. You may never known if the intruder took any data.
Most investigations I've been involved in start with noticing something slightly odd - some non-critical machine has a file on it and we're not sure what the file is, or how it got there. It might be the installer for a Microsoft hotfix that an admin downloaded - a perfectly innocent file, just something someone forgot to delete when done, or it might be something a bad guy forgot to delete. (The typical hacker toolkits try to cover their tracks).
You investigate a bit more and find more suspicious stuff, so you become fairly convinced that a bad guy had some level of access to THIS computer. YOU might even know for sure that they had _some_ access to _this_ computer. You can never know for sure that they didn't have access to the entire network, because you can't prove a negative. You _think_ the intrusion was limited to this one machine.
Maybe you see something strange on a machine that has access to customer information. Maybe some typical Windows malware trying to send out spam. If the people running the botnet knew what machine they had infected, they could have gotten customer data. They probably didn't notice, though; they're just running spam botnet. Do you have to contact all of your customers and tell them that your Customer Service Manager's desktop had malware on it?
Typically, you KNOW that sensitive data was taken it starts showing up in public. So at what point do you contact customers?
I think that's a judgement call. It depends on both the likelihood of a leak and the type of data involved - could it do much damage, and is there anything to be done to lessen the damage? I've done it at different times depending on the data. Once, there was a small possibility that a bad guy could have accessed credit card numbers. We were 85% certain there was no bad guy, but we went ahead and called customers anyway. We called and told them "we're pretty sure there is no problem, but please look at your credit card statement and let us know if you see anything out of the ordinary". An example in the other extreme was that a bad guy could probably could have read the PHP source code of a public web site. That was much more likely, but who cares - it's mostly public anyway. I didn't hurry to notify anyone that time.
So, if a company doesn't disclose a breach in 30 days, what happens? They get fined? By the government? Who gets the money? What does a punitive regulation solve? What if the company doesn't themselves find out about the breach for 30 days?