Slashdot Mirror
Wyndham Settlement: No Fine, But More Power To the FTC (csoonline.com)
itwbennett writes: Earlier this month, Wyndham settled a lawsuit with the FTC over weak security practices that resulted in 3 major data breaches in 2008 and 2009 that compromised the credit card information of more than 619,000 customers and led to more than $10.6 million in fraudulent charges. But all the settlement requires Wyndham to do 'is what any company that handles credit card data is supposed to have been doing for more than a decade, under the Payment Card Industry Data Security Standard (PCI DSS),' writes Taylor Armerding. There was no fine and it seemed as though Wyndham had 'dodged a bullet', says Armerding, But things are not always as they seem. Because the PCI DSS is not a government standard and is not a law 'the case was not about fines for noncompliance, which the FTC doesn't even have the authority to impose,' says Armerding. 'It was instead about power – the authority of the FTC to charge Wyndham with 'unfair and deceptive' practices because of its security flaws.'
The FTC's case is simply a nuisance suite for Wyndham. While I'm annoyed at Wyndham for their lax practices, I'm also annoyed, perhaps more annoyed, by the recent efforts of government agencies to exceed their authority and essentially establish laws of their own where they have no such power.
Lax practices? How about the lax standards for validating charge cards imposed by Visa? Mag stripes are not secure, they've never been secure, and the only thing Visa ever did about it was to make the merchants responsible for adding un-standardized security to protect their weak systems.
Wyndham was first a victim of expensive but ineffective data protection rules imposed by PCI, then a victim of hackers when those rules failed to protect them. The FTC should be investigating PCI like the FBI's been investigating FIFA, and for mostly the same reasons.
PCI sets many standards; very, very few businesses obey them all, and there is essentially zero penalty for non-compliance. For instance: while Christmas shopping, did every store you visited require the use of a card with a chip? The cutoff date for requiring that at any retailer was back in October.
Wyndham has a responsibility to its customers, so the government should punish such breaches of care. The fact the law doesn't say "Use plan 9" is a good thing, it allows agencies like the FTC to set flexible targets and stretch goals. It also forces businesses to demonstrate they care; with a certain percentage of man-hours and dollars invested in security, or an industry-supported policy like PCI-DSS. The real purpose of industry-supported policies is avoidance of written-in-stone legislation, allowing businesses to bend the rules whenever enforcement is expensive. But bending the rules everyday is not regulation and, in particular, not self-regulation, so Wyndham should also be punished for its repeated breaches of its own policy.
The government is not delivering punishment, it is making Wyndham deliver its promise to customers and exercise its duty of care via the FTC. Wyndham would be foolish to complain about such light-handed treatment. Given the inability of the US government to demand good behaviour from corporations and its repeated unwillingness to prosecute blatant fraud, there is ample opportunity for Wyndham to 'water-down' its promise to the government.
He answered the previous poster's question precisely. He wasn't talking to you and NO ONE asked for your worthless verbal diarrhoea.
Please. PLEASE! STFU and FOAD cock gobbler.