Category: Regulations

If the bill is passed into law, those convicted of unauthorized access to a computer could face up to a two-year prison sentence, up from six months.

“Over the last 18 months there have been a lot of high-profile DoS attacks which have in turn been accompanied by extortion requests against U.K. online bookmakers,” the spokeswoman said. Of 200 companies that participated in the survey, 90%reported they had experienced unauthorized access to their networks, while 89 percent had been victims of data theft.

http://www.computerworld.com/securitytopics/security/story/0,10801,108133,00.html

However, the directive has been criticised for not putting the question of who pays the cost of retaining data into law, instead relying on informal negotiations between individual ISPs, telcos and the Home Office. “No mention is made of costs. The directive says ‘Article 10 — Costs. Deleted’,” said Internet expert Clive Feather, speaking at the Internet Service Providers Association (ISPA) Annual Parliamentary Advisory Forum in Westminster.

Italian ISP Tiscali also believes this is a serious issue if the law is to work. “There is a concern that the directive makes no provision for reimbursement to ISPs for extended data retention,” said Emeric Miszti, Security and AUP Officer at Tiscali. “Data retention is not simply about disk drives. The development, management, and security costs must be taken into account.” .

This is a view shared by the police who will be expected to pay part of the cost. “There should be recognition of the cost of data retrieval, and also the cost of the mechanism and process of data retention,” said Jim Gamble, Deputy Director General, National Crime Squad. “We pay a portion of the cost of recovery, and believe industry should have reasonable recompense.”

Feather also raised other concerns about the wording of the directive says that it still “contains nonsense”. “It includes provision for the retention of the date and time for ‘log in’ and ‘log off’ an Internet email service, but most email programs connect to the email server every five minutes. The directive doesn’t ask for the time mail is sent and received. It doesn’t ask for the sender of received emails,” said Clive Feather. The directive also does not specify exactly what an Internet service provider is, said Feather, leaving companies and organisations from universities to Internet cafes in a legal limbo. Feather also reckons that the legislation is not keeping up-to-date with current developments and pointed to the omission in the legislation of emerging technology such as Internet telephony and instant messaging.

Tiscali’s Miszti said he was concerned that the security of emerging technology had not been given sufficient consideration: “With more unsecured Wi-Fi networks and Internet cafes, there are more opportunities for crime that are not targeted by the directive. Why should criminals sign up for an ADSL account when they know they’re being monitored?”

A concern for ISPs is that this legislation will open the door for more far reaching legislation that will force them to retain entire data communications, including data packets. “It’s not as bad as we feared. Not every single data packet has to be retained — yet,” said Clive Feather.

Questions were also raised about the human rights implications of storing large amounts of communications data. The Earl of Erroll, President of the E-business Regulatory Alliance, an organisation that examines legal and regulatory issues in Brussels and Westminster, asked: “Is the directive necessary, legal, and balanced? Will it protect citizens from unnecessary access to confidential information?” The Home Secretary, Charles Clarke, gave an assurance that human rights legislation would be conformed to.

http://news.zdnet.co.uk/business/legal/0,39020651,39246970,00.htm

For companies that do business nationally or in various states, the smorgasbord of state laws poses a growing problem, because the measures often specify different triggers for notifications and set varying requirements on what needs to be disclosed, to whom and when, said Kirk Herath, chief privacy officer at Nationwide Mutual Insurance Co. in Columbus, Ohio.

In addition, some states require companies to provide credit-monitoring services to affected customers, whereas others don’t, Herath said.

http://www.networkworld.com/news/2006/010606-data-breaches-law.html

In March, DSW found that credit, debit and checking account numbers of customers in 25 states had been stolen by hackers breaking into the company’s database. In its complaint, the FTC charged that DSW unnecessarily held on to sensitive customer data it no longer needed and stored the information in multiple files, increasing the risks to consumers.

Some DSW customers have reported fraudulent charges to their accounts, and others with checking accounts have asked the company to pay the cost of closing accounts and ordering new checks, the FTC said. DSW noted that when the theft was discovered, it took immediate steps to notify customers and put in measures to prevent future thefts.

http://www.latimes.com/technology/la-fi-dsw2dec02,1,733532.story?coll=la-headlines-technology&ctrack=1&cset=true

[Microsoft’s senior vice president and general counsel Brad] Smith described four core principles that Microsoft believes should be the foundation of any federal legislation on data privacy:

– Create a baseline standard across all organizations and industries for offline and online data collection and storage. This federal standard should pre-empt state laws and, as much as possible, be consistent with privacy laws around the world.
– Increase transparency regarding the collection, use and disclosure of personal information. This would include a range of notification and access functions, such as simplified, consumer-friendly privacy notices and features that permit individuals to access and manage their personal information collected online.
-Provide meaningful levels of control over the use and disclosure of personal information. This approach should balance a requirement for organizations to obtain individuals’ consent before using and disclosing information with the need to make the requirements flexible for businesses, while avoiding bombarding consumers with excessive and unnecessary levels of choice.
-Ensure a minimum level of security for personal information in storage and transit. A federal standard should require organizations to take reasonable steps to secure and protect critical data against unauthorized access, use, disclosure modification and loss of personal information.

http://www.itu.int/osg/spu/newslog/Microsoft+Calls+For+US+National+Privacy+Law.aspx