Slashdot Log In
Personal Data Exposed! Can Legislation Fix It?
Posted by
ScuttleMonkey
on Mon Apr 23, 2007 12:06 PM
from the ask-and-ye-shall-receive dept.
from the ask-and-ye-shall-receive dept.
rabblerouzer writes "Millions have had their personal information stolen because of lax security and may not even know it because of the patchwork of state laws that fail to mandate timely notification of victims. Boston-based law firm Mintz Levin is seeking feedback on what you would like to see included in draft legislation."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
More laws are the key ... to EVERYTHING (Score:5, Insightful)
I'm sure this is the one. No one will accidentally release anyone's private details when it's illegal.
Why haven't they made getting in a car accident illegal?
Re: (Score:2)
Re: (Score:3, Insightful)
Oh... wait, I think there's been something like that already. Anyone know whether it worked?
Re:More laws are the key ... to EVERYTHING (Score:4, Insightful)
Parent
Re: (Score:3, Interesting)
And look who is writing a draft of those rules: A law firm.
Unfortunately, that's how a lot of laws get written. Law firms, think tanks & lobbying organizations write up their wish list and then sweet talk Congressmen or Senators into submitting it.
This happens at both the Federal and State levels.
Maybe the public representatives (in reality, their staff) should be writing up the rules.
"Oh, but we like this set of rules!"
My response: think of all those laws you didn't like.
Re:More laws are the key ... to EVERYTHING (Score:4, Insightful)
None of the credit agencies seem to be willing to lift a finger to do "the right thing". I guess we're going to have to start suing the credit agencies for defamation or something whenever they associate our identity and credit with a criminal in order for them to take notice, if we're not going to be allowed to make laws to tell the credit agencies to get their act together.
Parent
Re: (Score:3, Insightful)
I'm pretty sure this is what you misunderstand. The "rule of law" doesn't mean that there should be a law to rule every action, inaction, transaction, or interaction in life. "Rule of law" means that governments can only use force according to the law. It stands in contrast to "rule of men" where individual rulers impose their will on the folks who are ruled.
There another concept called "freedom" where individuals are free to act largely without the oversight of a ruler or a
Re: (Score:3, Insightful)
Really? Who is the aggressor? Who is the defrauder?
It seems clear that any law in this case would regulate innocent third parties rather than the aggressor. Hence, the government becomes the aggressor with the innocents, as always, being the victims. Is it really just to harshly punish the folks who disobey this new law? (Mild punishments don't deter.)
Rather than make a new law here, we should repeal a bunch of other laws. Then the government agents who
Re: (Score:3, Insightful)
Re: (Score:2)
"it's about letting the people who are affected know when it inevitably happens"
Re: (Score:2)
Re: (Score:2, Interesting)
Re:More laws are the key ... to EVERYTHING (Score:5, Insightful)
These are the kinds of laws that a rational person can support. It's laws that are meant to protect us from ourselves we have to many of.
In fact, we do not so much need new laws, but clarifications of how existing legal principles apply.
If I park my car and do not set the brake, and it rolls down the hill into your house, the law says I have to pay for the damages to your house. Not you. You get an estimate of, say $2000, and I have to pay that plus a certain amount to compensate your for your inconvenience.
That isn't paternalism, it's common sense.
Now suppose I negligently release private information about you, and that results in your identity being stolen. The damage I've done to you is incalculable. And therein lies the rub. I am not responsible for the criminal misdeeds of others, but I have caused you far more than $2000 of trouble by my negligence. It is the inability to put a dollar amount on that damage that keeps me immune from being sued by you.
If Congress set a standard $1000 damage level for negligent disclosure of private financial data, you could sue me. But you wouldn't have to. If I managed a database of a thousand people, I'd be looking at a cool million in direct liability. It would alter my calculations. I wouldn't be sending your private data home on an unsecured laptop so a temp I've done no background checks on can do a little data entry.
That's the common theme we've seen in "shocking" cases of data mismanagement. It's not shocking at all, it's inevitable. If the cost of mishandled data is zero, then I'll risk exposing you to identity theft for a penny on an account, multiplied by enough accounts and that's real money.
It isn't hard to secure data to the point that the risk of disclosure is negligible. But it's impossible if the cost of disclosure is zero.
Parent
Current Liability Causes Indifference (Score:5, Insightful)
What *I* Would Like to See in Legislation? (Score:5, Funny)
Re:What *I* Would Like to See in Legislation? (Score:4, Insightful)
News just in:- Female IT workers around the world have breathed a collective sigh of relief.
Seriously though, accountability seems to be the key. It feels like (hands up, I'm no expert in this area) that people can get away with some of the shoddiest practices when it comes to safeguarding other peoples' personal data. I don't think it is enough to expect the market (in that serious breach of security and loss of data will cost that organisation customers) to regulate itself. It's like shutting the gate after the horse has bolted. There needs to be something up front - focusing organisations' minds on making sure this does not happen in the first place. I would say that an organisation that handles, for example, credit card data should be made accountable for any losses directly attributable to mishandling that data plus some compensation in lieu of the time required to close the account, order new cards, etc..
Parent
Re: (Score:3, Funny)
All three of them...
Re: (Score:3, Funny)
But the Legislation would never impose this penalty on themselves!
Oh, you mean for the criminals...
That's no problem (Score:3, Insightful)
I felt a great disturbance in the Force... (Score:2)
What would I like in draft legislation? (Score:3, Funny)
Or were you looking for legislation more specific to the whole identity theft issue?
Criminal Identity Theft (Score:5, Interesting)
I'll be writing something to these guys. If you're interested in what I've been dealing with, my story starts here:
http://g27radio.blogspot.com/2007/04/think-youre-
Accountability (Score:5, Interesting)
Recap:
Required disclosure
Jail for those that purposefully avoid disclosure
Large fines for breaches
Re: (Score:2)
If you place huge fines on exposed data, companies will be able to compare the cost of the security measures to the cost of a breach and make a financial decision that will (hopefully) work out best for both the company and the customers/clients/etc.
One can hope, but it would be unwise to hold your breath waiting for big fines. Even if Congressed passed big fines for losing Privacy Act data, it's quite possible most companies would not pay them, even if they were grossly negligent. In response to a big
Re: (Score:3, Interesting)
How about restricting the collection and storage of personal information in the first place? How many companies REALLY need your SSN? How a
Re: (Score:3, Insightful)
Perfect security of data is easy. You destroy it.
especially since the data "needs" to be available to a large portion of the company in order for work to be done.
If the risk of fines is high, they'll find a way to no longer need it.
How about restricting the collection and storage of personal information in the first place? How many companies REALLY need your SSN? How about schools? Do THEY need it? Really? [...] How many web sites want your birth d
Re: (Score:2)
Don't legislate ! (Score:5, Insightful)
-Zero day exploits: crooks will rush to do zero day exploits as an official confirmation will prove they've got good data (so more sophisticated gangs will buy it from them, most fraud happens in the first 24 hours)
-Honeytrap: When identity theft occurs law enforcement agencies may wish to honeytrap the thieves by letting them use the say credit card details & thus tracking them.
-White Noise Defense: smart companies ought have "white noise" dud systems, easily hacked containing white noise data with honeytrap triggers (eg a valid credit card number but one that belongs to say FBI) in it !
- and so on.
But they should be forced to notifiy law enforcement agencies.
If you want data, be responsible OR ELSE (Score:2)
If you store personal data, you're responsible for everything that happens if this data gets stolen. Everything. No matter if you're in any way responsible or whether it has been deemed "correctly" stored. You lose my data, you stand up for all the damage done.
Yes, that includes governmental organisations.
Don't want to be held responsible for losing my data? Don't store it.
Wait a Minute.... (Score:2)
1. How is it that this law firm gets paid for the privilege of drafting our laws? Before anyone hits the reply button, what makes you think this is some kind of pro-bono cause for the law firm? The likelihood this is some kind of charitable effort is miniscule. What makes you think citizens preferences will win over the corporate interests?
This story encapsulates what's wrong with our democracy.
-The Law has been abstracted and complicated to such a degree that the above-average (
Re: (Score:2)
You propose the fall guy remains way-way down the chain of authority and the executive class retains authority, and the salary to reflect that, but no liability.
Instead of name-calling, how about a viable alternative where the chain of authority is clearly defined? Maybe it's just easier to shout-down ideas than it is to come up with some constructive alternatives?
Re: (Score:2)
Change the cost/benefit to discourage hoarding (Score:3, Interesting)
Legislation that provided a penalty for holding inaccurate personal data about someone would strongly discourage people from grabbing personal info just because they can. If bit-rot in personal-info databases had legal consequences, people would be more careful about what they collected, and would take the trouble to verify its integrity. It'd be harder to sell a database like that, too, since the buyer would want the means to keep it up to date. Also, you can bet that every personal-info-storing website would switch to an "opt-in" model about as fast as their lawyers could say "liability risk".
The major downside would be that it would disproportionately hurt small organizations. Sadly, I don't have a solution for that.
Here's what we need, and it'll never happen (Score:3, Insightful)
cause damages? pay them all (Score:2)
some weasel steals your ID and you lose the house you're trying to buy? BigCo buys you a house, free and clear.
can't get that zero-percent car loan? BigCo pays for the car in cash and hands you the keys.
then and only then will companies get serious about how much stuff
Can legislation fix it? (Score:4, Insightful)
The summary and the FA were short on information, but here is my stab at this.
How about we just keep our private information private? The increase in the amount of personal data that is attempted to be acquired by private companies is increasing, and remind me how my giving of my personal data to Pets-R-Us is going to benefit me?
I paid cash for a car, and the people wanted my social security number. Why?
A health club near me wants my social security number to lift weights and stuff. Why?
Oh, and don't get me started with those so-called "Privacy Agreements" that some of these comanies give out to you. All of those end with the clause "we can change our mind at any time w/o notifying you", so how is this any kind of agreement? By signing one of those I am agreeing to nothing.
So, I think that the laws should say that there are 2 kinds of personal information. One kind is something that can clearly identify me. My address, phone number, ssn, name, etc. And none of that should be shared with anyone. Abstract data for marketing reasons is OK. My age, sex, or whatever they can get from me that does not directly tie the information to me is OK.
Corporal punishment (Score:2)
New SSN (Score:5, Informative)
If they absolutly need a national means of identifying people, then it needs to be in a secure manor. My suggestion is to issue everyone an electronic ID card. With all the extra "security" that goes into an id they can afford a small dedicated computer the size of a credit card calculator that only gives a secure ID number. When someone needs to verify your ID, they must request a key from the goverment, similar to a tax ID, but it is the public key for an encryption. They give you their public key, you enter it into your computer wich has your private key, it generates a number, the company sends that number to a goverment computer, it returns the critical information for the person involved. Name and Birthday. If they require more information, they must fill out the goverment forms explaining what information they need, and why; which becomes public record. Set it up so that your computer tells you what the company is, and what information they will be given. Now they have a secure means of identifing you, and you can verify who is requesting the information, and the ID number you give them is only good for that company. They can't use the data to request a new credit card, because the credit card company would be given a different number based on their public key. Set a password on the computer so that it can't be used if stolen, and set provisions where someone can request a new card and private key if it is compromised.
Re: (Score:2)
Yeah, just tie this new number to a SSN so that all the old legacy systems can use either!
All kidding aside, why do we need numbers at all. How about using photographs? How about Fingerprints? How about anything other than something that is EASY clone? Whether or not it is SSN or some other numeric based ID, the problem with the system is the same.
Legislation has never fixed anything. (Score:3, Interesting)
Honest people obey them but criminals do not.
What it will take is to enact a DEATH PENALTY for computer crimes / identity theft.
That's right, strap the bastards down in Ol' Sparky and televise it to the world.
Two or three public executions and the problem will pretty much go away over night.
Do it from another country you say? No problem. Send a Special Forces hit team to kill them in the dark of night.
Seriously though, one day someone is going to get really, really pissed off and they'll go get a pound of flesh from the companies that allowed the data breach to happen. It's only a matter of time.
There are a lot of unhinged people on the edge as it is now.
This has gone on way too long. Enough with the useless laws, let's start up public executions.
Target the credit bureaus (Score:4, Insightful)
I'd rather outlaw the use of your SSN as both username and password. Why are the credit bureaus allowed to let anyone who knows those nine irrevocable digits mess with your credit report?
Re: (Score:2)
You use SSN now for EVERTYHING, from getting hired, to getting credit cards, to buying a house, to getting pulled over for speeding, to requesting tax forms. everything.
Whats worse, if you have an SSN, name, and DOB, a company will believe its really you, and not the guy stealing your identity. Its a large problem.
We either need to create something to replace the SSn that
Restrict the Creditors (Score:2)
We need to make bad creditors pay for identity theft. It is their lax identification/authentication procedures that cause much of the problem.
1) Make creditors pay you triple damages when your identity is stolen.
2) Put an upper limit on interest rates so that creditors can't gouge the honest debtors to pay for the dishonest ones.
The problem isn't disclosure (Score:2)
It is how banks and other institutions carry out identification. Typically, your name, address, and SSN are all that is needed for a criminal to commit fraud.
And typically, the worst you'll have to put up with should your identity be "stolen" is signing an affidavit to that effect. I'm not aware of any case in which someone whose identity was stolen ended up with out of pocket expenses. Typically, the merchant eats the fraud.
The banks, merchants, etc... are the real losers. However, if it was a s
A simple fix I'd like to see ... (Score:3, Interesting)
The only problem is that the alert must be renewed every 90 days. To get a permanent Fraud Alert, you must prove you've already been a victim of identity theft - essentially closing the barn door after the horse has gotten out.
Consumers need to have the right to request a permanent alert without question, and for any reason. I am long past the point in my life where I need instant credit. I can afford to wait long enough for the credit agency to call me if I need to open a new account. Of course, the credit agencies will fight any such measure tooth and nail (the 90 day alert had to be forced upon them by law), but unlike some proposals I've read so far, this one is actually doable with a realistic amount of effort on everyone's part.
Easy answer (Score:2)
"patchwork of state laws"??? (Score:4, Insightful)
I know - let's pass a law to help the victims... (Score:2)
Free the victims from any consequences (Score:2)
Legislation can't fix it (Score:3, Insightful)