CyberSecurity Institute

The bills differ in several ways, including varying requirements about when a breached company should notify customers and whether consumers should be able to freeze their credit reports following a breach. Beyond the confusion about the differences in the bills, five congressional committees have claimed jurisdiction over some of the data breach bills.

Two data breach notification bills have passed through Senate committees and are awaiting action on the Senate floor, and two other bills are awaiting action on the House floor.

Dianne Feinstein, a California Democrat and early advocate for a national data breach notification law, said he’s still hopeful a law will get through Congress this year, but others are less optimistic.

Both the House and the Senate have targeted Oct. 6 to adjourn for the year, giving lawmakers about a month to campaign for the November general elections.

http://www2.csoonline.com/blog_view.html?CID=20859

The record indicates that TTPs are available to provide a variety of services for CALEA compliance to carriers, including processing requests for intercepts, conducting electronic surveillance, and delivering relevant information to LEAs. Fifth, the Order restricts the availability of compliance extensions under CALEA section 107(c) to equipment, facilities and services deployed prior to October 25, 1998 and clarifies the role and scope of CALEA section 109(b), under which carriers may be reimbursed for their CALEA compliance costs. Seventh, the Order concludes that carriers are responsible for CALEA development and implementation costs for post-January 1, 1995 equipment and facilities, and declines to adopt a national surcharge to recover CALEA costs. -FCC-

http://www.itu.int/osg/spu/newslog/FCC+Adopts+Order+To+Enable+Law+Enforcement+Access+To+Broadband+And+VoIP+Providers.aspx

Guidelines for this directive include:
· There should be an incentive for providers to contribute to the overall security of interconnected networks rather than protecting merely their own resources.
· Providers need to be more proactive and monitor their networks for risks of security breaches. Providers could also be asked to report which networks they monitor.
· This includes guidance to consumers as well as guidance to the provider’s staff, in particular with regard to incident response and emergency planning.
· The need for contact details for email abuse and security violations should also be stressed.

Providers in Europe are more concerned about spam emails that their customers receive than they are concerned with spam that their customers send.

http://www.enisa.eu.int/doc/pdf/deliverables/enisa_security_spam.pdf