Mass. Data Security Law Says "Thou Shalt Encrypt" 510
emeraldd writes with this snippet from SQL Magazine summarizing what he calls a "rather scary" new data protection law from Massachusetts: "Here are the basics of the new law. If you have personally identifiable information (PII) about a Massachusetts resident, such as a first and last name, then you have to encrypt that data on the wire and as it's persisted. Sending PII over HTTP instead of HTTPS? That's a big no-no. Storing the name of a customer in SQL Server without the data being encrypted? No way, Jose. You'll get a fine of $5,000 per breach or lost record. If you have a database that contains 1,000 names of Massachusetts residents and lose it without the data being encrypted, that's $5,000,000. Yikes.'"
Doesn't sound so bad (Score:5, Insightful)
That's pretty much already corporate policy at the last two major places I've worked for a few years now. It would be nice if the government starts treating that data the same way.
In fact, it would also be nice to mandate encryption and signatures for email so there will be no more unsolicited spam. And finally it would be great if no one was allowed to open up a line of credit without my cryptographic signature so I wouldn't have to protect my SSN, birthdate, and mother's maiden name like it was some sort of safety deposit box combination.
Re: (Score:2)
Second that. Sound surprisingly reasonable. Hope that more states and countries follow.
!Micro-management (Score:5, Interesting)
I think the /. article sub-header "some-serious-micromanagement dept" is incorrect. "Micromanagement" would be to specify a particular technical approach. The law [mass.gov](220kB PDF) doesn't even mention https. So, I think the legislation's level of detail appropriate: "just do it." The author of the FA seems to think this'll sell a lot of SQL Server upgrades, and if SQL Server is what someone is running to persist data, I suppose so.
Re:!Micro-management (Score:5, Funny)
Does rot13 encryption suffice?
Re:!Micro-management (Score:5, Funny)
Just do it twice to be sure.
THIS IS A FARCE (Score:5, Insightful)
Encryption in transit is great. Encryption of backup tapes is great. Encryption of end-user systems which store the data is great.
But encryption of live servers and databases is a farce. Encryption without key management is itself a farce, and a servers which require keys to operate necessarily lack key management. Furthermore, server encryption is absurd because it can only protects against physical theft of the servers, not against hacking.
The only case in which server encryption would do a bit of good is if the datacenter has no physical security, and every time a system boots, someone has to walk over to it and type a 20+ character random password.
Yes, I work in IT security. Yes, I think encryption is great, but NOT ON SERVERS.
Re:THIS IS A FARCE (Score:5, Insightful)
No, it also protects the rest of us against idiots who sell old hard drives on ebay.
Re: (Score:3, Insightful)
1) corporations typically don't resell old hard drives that were once in servers. Many of them get returned at lease end, the rest are of little value as used components having run constantly for 4-8 years under load.
2) Most server HDDs don't go in computers. We use almost exclusively FC and SCSI disks, and a lot of SAS now as well. These drives are 10K or 15K, make a shit load of noise, and
3) RAID controllers obfuscate the data. You'd need a near complete RAID set to be able to reconstitute the data af
Re: (Score:3, Insightful)
It's not even possible. The example the article gave of a thousand users is cute, as in, "awwwww that's so cute". I am pretty sure a lot of people in the real world are dealing with databases with +2 million records. Personally, I have dealt with over 250 million records.
One of the biggest failures people make just starting out is not planning to scale. That's why some low end database products grind to a halt getting above even 50k records.
There is
Re:THIS IS A FARCE (Score:5, Insightful)
Encryption in transit is great. Encryption of backup tapes is great. Encryption of end-user systems which store the data is great.
But encryption of live servers and databases is a farce. Encryption without key management is itself a farce, and a servers which require keys to operate necessarily lack key management. Furthermore, server encryption is absurd because it can only protects against physical theft of the servers, not against hacking.
The only case in which server encryption would do a bit of good is if the datacenter has no physical security, and every time a system boots, someone has to walk over to it and type a 20+ character random password.
Yes, I work in IT security. Yes, I think encryption is great, but NOT ON SERVERS.
Agreed. I'm a MySQL guru (among other things), and I can't see keeping names and email addresses encrypted in the database on the server. Credit card numbers and other sensitive foreign account numbers? Absolutely. But what they are asking for is a joke. And what? The entire world would have to change how it stores things on its servers just to appease Massachusetts? Gee, if every territory starts lubbing its own rules about how the world should handle data of its residents/citizens, you can just kiss the Internet good-bye.
What this all means though is that the small startup/merchant/mom-and-pop Internet operations will find it more and more expensive to swim in these waters infested with little fiefdoms everywhere with delusions of hegemony.
Then again, it's always dangerous when politicians -- especially local ones -- try to legislate anything on the global Internet. Some years back some idiot New Hampshire legislature tried to impose a tax on -- are you sitting down? -- email. Can you believe it?
Re:THIS IS A FARCE (Score:5, Insightful)
I agree 100% with you. Encrypting is very important, but more important is UNDERSTANDING what encryption is. This guys think if you magically apply DSA/Elgamal over your data, then it's secure. It's the same kind of delusion that development companies have with DRM. They added an if() somewhere on their code that checks a stupid key, and they believe that keeps them safe. It doesn't matter how much you encrypt your data, if you are going to access it eventually in an automated way, that is not going to protect you in any way. Encrypting the data and hardcoding the key on your app means nothing.
Also, keeping certain information encrypted on the DB is just crazy. Doing a complex JOIN with multiple tables and a few LIKEs when you have a table with 200 million records is complex and resource intensive enough, adding encryption in every motherfucking field to that is only adding insult to injury.
I manage a pretty complex setup of distributed asterisk servers, with replicating SQL DBs across 3 countries. CC data is only stored on the US server, and the key to decrypt them is not on the server, it's stored securely on another workstation, encrypted with yet another 4096 DSA/Elgamal key that I only have on yet another location. I only enter it once a month for billing purposes, and it only stays in RAM as long as the server is processing the monthly payments. I am a conscious coders, and I take privacy and security very seriously, but this law is just ridiculous.
Re: (Score:3, Insightful)
What this all means though is that the small startup/merchant/mom-and-pop Internet operations will find it more and more expensive to swim in these waters infested with little fiefdoms everywhere with delusions of hegemony.
What, you thought this law was passed for some purpose other than that? Laws like this serve two purposes: One, to be able to put a sound bite into ads and two is to help big companies keep small competitors out of the field.
I couldn't disagree more (Score:5, Insightful)
I'm sorry, but I strongly disagree with your position on almost every count.
Firstly, your point about different territories with different rules is fundamentally flawed. Many places — all of Europe, for example — already have stronger data protection laws than most of the US. This causes no earth-shattering problem with compliance. Large companies keep the data they can't legally export within their European offices. Smaller companies just outsource things like payment collection to services that guarantee any personal data will be processed securely and not transferred outside of EU borders. They were going to outsource it anyway, so the only people who lose out are services that want to handle sensitive information but can't make the same guarantees as others about security, whose flawed business model just became obsolete.
Secondly, I think you (and several other DB admins and such in this Slashdot discussion) are far, far too casual about this subject. In my country, we have had a string of mismanagement or outright leaks of sensitive personal data in recent months. The number of people who have wound up losing money or suffering long-term hassle just to set their records straight is absurd, and rising every day. A $5,000 fine per leak is nothing compared to the hassle and indirect costs of someone suffering identity theft, even if they get everything put right in the end and recover their direct losses. To one side, it's several months of hell to get your identity back. To the other, it's a mere business expense, a footnote on page 172 of the annual financial statement.
In my not so humble opinion, both business and governments need to learn this lesson, and I have absolutely nothing against sending a business to the wall if it collects personal information but fails to secure it properly. We have allowed more-or-less unrestricted collection of personal data for a few years, easily long enough for the industry to gets its act together. The result has just been organisations hoarding personal information about people for reasons that are entirely self-serving, pretty much all of whom could just die and make the world a better place anyway, and the string of screw-ups I mentioned before from many organisations that do have a legitimate reason to hold that sort of data.
It is time for organisations that think this is OK to be taught otherwise, and frankly these fines are on the light side. I would have preferred an additional statutory duty of care with unlimited liability to cover the cost of putting right any damage done to an individual following a leak. Go ahead and reevaluate your security protocols and whether it is really impossible to do these things or just inconvenient/expensive, when the other side of the inequality you're testing looks like an 8 on its side instead of a $10 per person class action settlement.
Re:I couldn't disagree more (Score:4, Interesting)
I'm sorry, but I strongly disagree with your position on almost every count.
Firstly, your point about different territories with different rules is fundamentally flawed. Many places — all of Europe, for example — already have stronger data protection laws than most of the US. This causes no earth-shattering problem with compliance. Large companies keep the data they can't legally export within their European offices. Smaller companies just outsource things like payment collection to services that guarantee any personal data will be processed securely and not transferred outside of EU borders. They were going to outsource it anyway, so the only people who lose out are services that want to handle sensitive information but can't make the same guarantees as others about security, whose flawed business model just became obsolete.
While I don't disagree with your post, I wonder just how many large European businesses you've worked for. I'm a consultant in this field, and have quite a few clients who are multinational. While a minority make efforts to stay in compliance with such data privacy laws, such as by keeping PII in the country of origin, a vast majority have no idea where their PII is stored or transmitted. They think data privacy doesn't really apply to them because they don't keep credit cards, and they don't understand the nature of Safe Harbor agreements or what, exactly, is covered therein.
Data privacy is important, and probably needs to be legislated at some level, but don't go telling people that simply because it's the law here, companies actually comply with it.
Re: (Score:3, Informative)
You don't understand the law. The law defines Personal information as: "a Massachusetts resident's first name and last name or first initial and last name in combination with any one or more of the following data
Dunning–Kruger effect (Score:3, Funny)
The Dunning–Kruger effect is a cognitive bias in which "people reach erroneous conclusions and make unfortunate choices but their incompetence robs them of the metacognitive ability to realize it."[1] The unskilled therefore suffer from illusory superiority, rating their own ability as above average, much higher than in actuality; by contrast, the highly skilled underrate their abilities, suffering from illusory inferiority. This leads to a perverse result where less competent people will rate their own ability higher than more competent people. It also explains why actual competence may weaken self-confidence because competent individuals falsely assume that others have an equivalent understanding. "Thus, the miscalibration of the incompetent stems from an error about the self, whereas the miscalibration of the highly competent stems from an error about others."[1] “ In the modern world the stupid are cocksure while the intelligent are full of doubt. ” — Bertrand Russell[2][3]
Interesting reference. However, you hardly know anything about me, so perhaps you have fallen prey to the Dunning-Kruger effect yourself. :-)
But while we're on the subject, let me continue.
Re:THIS IS A FARCE (Score:5, Informative)
But encryption of live servers and databases is a farce. Encryption without key management is itself a farce, and a servers which require keys to operate necessarily lack key management. Furthermore, server encryption is absurd because it can only protects against physical theft of the servers, not against hacking.
I'm not a lawyer and I didn't read the entire law that was passed (grain of salt, etc.), but from my layman interpretation nothing in here says that you have to encrypt data on your live servers.
The penalties are assigned based on breaches, that is, if someone hacks into your server and steals Massachusetts residents' records, you owe $5k for each non-encrypted record that was stolen (as well as notify the person and the state). Also if you have employees taking un-encrypted data off site on laptops that get stolen, similar penalties apply if the laptop was stolen.
Make sure your servers are secure, up to date, and fire walled, encrypt roaming laptops and you'll be fine.
If my understanding is correct, I think this is a great law. If more states implement it, we won't have companies leaving sensitive data on laptops that get stolen because of a careless contractor/employee.
The damages to a company would be so real and enormous that they will have to implement stringent security protocols, or one breach can very possibly take them out of business.
Read the law: no broad mandate (Score:5, Informative)
eihab seems to have it right.
IANAL, either, but I did read the whole law and there is no broad encryption mandate as the SQL Mag author claimed.
The encryption-related sections of the law that I can find (17.04 (3) & (5)) actually mandate:
In other words, if you send data over public networks, or wirelessly, or store it on laptops, you should encrypt it. Excuse me for not getting excited about this.
Law: 201 CMR 17.00 reg [mass.gov]
FAQ: 201 CMR 17 faqs [mass.gov]
The whole thing seems pretty sensible overall.
Re: (Score:3, Interesting)
Here's a kicker - this law apparently does not apply to the politicians themselves. From the FAQ at http://www.mass.gov/Eoca/docs/idtheft/201CMR17faqs.pdf [mass.gov]
Does 201 CMR 17.00 apply to municipalities?
No. 201 CMR 17.01 specifically excludes from the definition of “person” any “agency, executive office, department, board, commission, bureau, division or authority of the Commonwealth, or any of its branches, or any political subdivision thereof.” Consequently, the regulation does not app
Re: (Score:3, Informative)
Update to my above post - apparently the government's security is covered by different-but-similar pieces of legislation, and not being a US resident I'm not about to go wading through it to find out where they've hidden the inevitable loopholes.
Re: (Score:3, Insightful)
Re:THIS IS A FARCE (Score:5, Informative)
Ask the author of the article where he got that notion from.
That phrase does not appear in the law [mass.gov] nor in Massachusetts FAQ [mass.gov].
Nor does anything like it, except in reference to
Re: (Score:2, Offtopic)
Stupid law. It means, for example, that you can no longer keep an email in unencrypted form.
Hey. on the other hand - maybe this will help kill off facebook.
Re:Doesn't sound so bad (Score:4, Informative)
Stupid law. It means, for example, that you can no longer keep an email in unencrypted form.
This is why you should never ask Slashdotters for legal advice. Not only are they not lawyers, they overestimate their psychic abilities, and are willing to interpret a law based on a third-hand summary.
Neither TFA (actually a blog by somebody who's using this kerfuffle to encourage people to move to Microsoft SQL server) or the original Information Week article are specific as to who this law applies to. I found the text of the law online:
http://www.mass.gov/Eoca/docs/idtheft/201CMR1700reg.pdf [mass.gov]
Remarkably readable for legislation. It applies to anybody who "receives, stores, maintains, processes, or otherwise has access to personal information in connection with the provision of goods or services or in connection with employment." So your email is OK.
Despite what TFA says, I don't see anything that would require anybody to encrypt their databases. The encrypted transmission requirement is there, but it isn't as if SSL is rocket science. But the biggest misinformation in TFA is what has to be protected. Somebody's first and last name isn't sensitive unless it's transmitted or stored "in combination with any one or more of the following data elements that relate to such resident: (a) Social Security number; (b) driver's license number or state-issued identification card number; or (c) financial account number, or credit or debit card number". It then goes on to say that any information that's in the public record is not sensitive and does not need to be protected.
All in all, a pretty reasonable law that merely mandates practices that are already standard at many companies — including Facebook.
Re: (Score:2)
In fact, it would also be nice to mandate encryption and signatures for email so there will be no more unsolicited spam.
Spammers would just sign their ads. And besides, how would Joe User enter the strongly connected part of the PGP web of trust without flying to a Major City(tm) for a key signing party?
amen! (Score:3, Funny)
Yes, a completely reasonable law, that just outlawed facebook. :) sounds like progress to me!
Re:Doesn't sound so bad (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Do you mean an OS upgrade? Since your encrypted volume is separate and backed
up I fail to see the hardship.
The OS corrupting your data - due to a virus or bug - is more pain because you may not
notice the corruption until recovering from backups means losing some of the latest data.
Warning: Microsoft EFS can cause data loss. (Score:5, Informative)
TrueCrypt [truecrypt.org] is reliable, reputable, fast, free, open source, and works on Windows, Mac OS X, and Linux. The TrueCrypt documentation is very good, but not perfect. TrueCrypt can make an encrypted drive letter or encrypt and entire partition, even the boot partition.
Only open source encryption should be accepted, since the U.S. government has decided it can force executives of corporations to work in secret to help gather data from or about users. If software is not open source, there may be hidden methods of decryption.
Maybe EFS is fixed now. (Score:3, Informative)
For a discussion of the issues, read page 5 of this PDF file from Elcomsoft, which I just found: Advantages and disadvantages of EFS [elcomsoft.com].
Elcomsoft is a famous [wikipedia.org] Russian company. Quote from Wikipedia: "On July 16, 2001, Dmitry Sklyarov, a Russian citizen employed by ElcomSoft who was at the time visiting the United States for DEF CON, was
Re:Doesn't sound so bad (Score:5, Funny)
On the other hand, disgruntled admins now have not only their old rm / -f weapon of mass destruction, but the ultimate superweapon of doom.
Corporate risk management will now become a nightmare, when 2.5 million names in a database equal 12.5 billion USD in damages if leaked. All these names fit in a 128mb USB stick. Uncompressed. A LZMA2 7z file will probably be around 30mb. 12.5 billion USD in damages caused in 0.5 seconds over a T1 by one admin gone rogue.
I fully expect admins now to have tenure for life. They will probably never be fired anymore, only taken behind the barn and shot.
Re: (Score:2)
"Covered businesses range from neighborhood dry cleaners to Fortune 100 companies, but the law stipulates that the program be appropriate to the size and resources of the business."
It seems like they really do mean just about everyone. Within a year we'll start seeing stories about how part-time small business people doing exactly what you described are the new source of major data breaches, because their Excel files and whatnot are being stolen via trojans and viruses. And the data security industry will
Re: (Score:3, Insightful)
It seems like they really do mean just about everyone. Within a year we'll start seeing stories about how part-time small business people doing exactly what you described are the new source of major data breaches, because their Excel files and whatnot are being stolen via trojans and viruses
What is a neighborhood dry cleaner doing storing my credit card information and/or social security number in an Excel file anyway?
Re:Doesn't sound so bad (Score:5, Informative)
They are more likely storing your name and phone number so they can call you when your trousers are ready for pickup. Since that's Personally Identifiable Information, they will apparently have to encrypt that.
No, it isn't, and no, they won't. PII is defined in the law. You've read the law, right? It does not include your phone number, or even your address. It's your social security number, driver's license number, credit card number, or bank account number. And your dry cleaner shouldn't be keeping that information.
That could be quite a burden on small businesses like dry cleaners, and plumbers whose wives make up the invoices and send them out at the end of the month.
First, plumbers may have husbands who send out invoices for them.
Second, if those small plumbing businesses are storing customers' social security numbers, drivers license numbers, credit card numbers, or bank account numbers, then they damn well should be encrypting that data.
Re: (Score:3, Informative)
> Actually, I read the article that was referenced in the summary, and the article that was
> referenced in that article. Neither one said anything like what you just posted.
As usual on most topics, the articles are more or less complete bullshit. The text of the law (all 4 pages of it) is at http://www.mass.gov/Eoca/docs/idtheft/201CMR1700reg.pdf [mass.gov] and the definition you want is on page 2 under "Personal information" in the alphabetical list of definitions.
What I find scary, really, is that any time I
Re: (Score:3, Informative)
Install Truecrypt; set up on system drive.
It's fairly shockingly idiot proof for a free and supposedly strong encryption solution.
Or Bitlocker if you have Ultimate, maybe.
Or VileFault [nsa.org] if you must use a Mac.
Re: (Score:3, Insightful)
There are free encryption tools out there. The "headache" would probably be for IT, because Encryption means if you didnt back it up you lost it. If you forgot the PW, you lost it, if that person leaves and doesnt give you the PW, you can sue them, but you lost it.
One thing I have noted in my "small business" IT jobs, if you dont take IT seriously and stick them in a windowless room in the basement like you would a janitor, you will not succeed
Re: (Score:2)
There are free encryption tools out there.
The last time I checked, SSL certificates that chain back to a CA in all the major browsers weren't free.
Re: (Score:2, Insightful)
Yeah, it's way less damaging when your personal information is stolen from a small business.
Re: (Score:2, Offtopic)
Ya this seems like a massive headache for small buisnesses.
One example I can think of: I know a woman who sells cakes and has her own website.
People email orders to her.
Not payment information, just name and delivery address+order.
But a name and address is personally identifiable. Does that mean she has to get some kind of encrypted mailserver of her own?
How about if she replies to them?
That's sending that name and address in the clear.(just like how it was sent to her of course)
And how about social network
Re:Doesn't sound so bad (Score:4, Informative)
> People email orders to her.
> Not payment information, just name and delivery address+order.
^^^^^^
> But a name and address is personally identifiable. Does that mean she h
No it does not. Read the text of the law, it will relieve your anxiety!
Re: (Score:3, Informative)
It's one thing for anyone who's core business is on-line selling, let alone a corporation. But don't think like them. Suppose you run a local used bookstore that's willing to ship books to customers out of the area, or are a musician who is happy to supplement performance income by selling that self-recorded CD? You handle the orders with paypal, but have you really encrypted that customer list you used to keep in a notebook but is now in Excel? Have you even thought of it?
Does that customer list include the customer's social security numbers? How about their drivers license numbers? No, obviously not, and if your bookstore collects that information, you should be on the hook.
What about their credit card information? Now, you're into the PII stuff, and you should encrypt it. Or don't store it - what are you doing with it anyway? You handle orders through Paypal, as you said, which means that you should never be seeing their credit card information.
Finally, how about their a
About fucking time. (Score:5, Insightful)
Now maybe if they actually enforce it businesses will get the idea that they should protect the data.
Re: (Score:3, Informative)
Actually, that's already been upheld in federal courts. States DO have the right to collect taxes for cross-state purchases for their residents, and CAN regulate business transactions with their residents. This is a nominal extension of that power, and quite likely completely legal. Enforcing it directly outside their boarders (ex. inspecting corporations, or mandating standards)? Likely no, but this regulation does not do that. This is a fine levied on data breech, and that CAN be collected across sta
Thanks for the math! (Score:3, Funny)
It would have been very difficult for us to figure out how much the fine would be if you lost the records of 1000 people.
It would have been nicer though if you gave us another example. How much would the fine have been for losing records of 2000 people?
Re: (Score:2, Funny)
I'm sure you could get a discount for large quantities.
What's so scary about this? (Score:5, Insightful)
What is so scary about this?
With a high cost of PII, there is now an economic incentive for companies to actually give a rats ass. It's the same kind of incentive that is used to make sure companies don't just dump toxic chemicals in kindergarten sandboxes.
Re:What's so scary about this? (Score:4, Insightful)
I understand the need of encrypting credit card numbers, etc, but too much is too much.
In Sweden it is illegal to publish any information about who the owner of a vehicle is, for example. Yet, it is perfectly legal to send a SMS to the traffic authorities to get the same info. Go figure.
Re:What's so scary about this? (Score:4, Informative)
No, this law is not "too much". Slashdot makes it look like "too much" because the article summary is incomplete and misleading.
This law only applies to certain databases that should have been encrypted anyway.
This'll get shot down (Score:2)
If you're a company that doesn't do business within the boundaries of the state, they'll have a damned hard time justifying why you're beholden to their laws.
Re: (Score:2)
Re: (Score:2)
But if you're in California, and a resident of Mass buys something from you while they're on vacation in CA, and you store any PII in your sales database, why the hell would you be subject to MA law?
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
The thing is, I'm not a resident of MA and MA has no rights to enforce any laws where I live, as I'm outside their jurisdiction.
Last time I checked, if I do happen to do business with a MA resident, MA still has 0 rights regarding any such business as it would be interstate commerce, which is solely controlled by the federal gov per the Constitution.
However, I do agree that companies need to be held to stricter standards regarding personal information and probably should be handled by the feds sooner than l
Phone book (Score:3, Interesting)
I hope the phone company has deep pockets, because the phone book is full of first and last names and, last time I checked, it was totally unencrypted!
Re:Phone book (Score:5, Informative)
A little googling finds the text of the law [mass.gov]:
Personal information, a Massachusetts resident's first name and last name or first initial and
last name in combination with any one or more of the following data elements that relate to
such resident: (a) Social Security number; (b) driver's license number or state-issued
identification card number; or (c) financial account number, or credit or debit card number,
with or without any required security code, access code, personal identification number or
password, that would permit access to a resident’s financial account; provided, however, that
“Personal information” shall not include information that is lawfully obtained from publicly
available information, or from federal, state or local government records lawfully made
available to the general public.
So it looks like phone companies are safe.
Re: (Score:2, Funny)
You mean Slashdot posted an incorrect and sensationalist summary? Say it ain't so!
A pain to implement, but.. (Score:4, Insightful)
This seens pretty sensible. Given how many people are hurt by these things, this seems like a reasonable standard for future industry practice, and the fines hammer home the idea to the companies that "oops, sorry!" isn't the level of seriousness these things should be given. I imagine most of the time these breaches are against the privacy promises the companies make anyhow.
The only downside is that the fine is kind of daunting for people who would like to enter a relevant market, although .. perhaps it's analogous to car manufacturers being liable for poor design of their products - when they fail, it can be a big deal.
Definition of PII from the text of the law (Score:5, Informative)
"""
Personal information, a Massachusetts resident's first name and last name or first initial and last name in combination with any one or more of the following data elements that relate to such resident: (a) Social Security number; (b) driver's license number or state-issued identification card number; or (c) financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password, that would permit access to a resident’s financial account; provided, however, that “Personal information” shall not include information that is lawfully obtained from publicly available information, or from federal, state or local government records lawfully made available to the general public.
"""
So this doesn't apply to places like slashdot and facebook. Only places that should be securing your data in the first place.
Re: (Score:2)
Given the exception at the end, I would guess that it also means you don't have to encrypt the names, just the account numbers, which is what any e-commerce package worth its salt (pun not intended) does anyway.
Re: (Score:2, Funny)
Re:Definition of PII from the text of the law (Score:5, Interesting)
So this doesn't apply to places like slashdot and facebook.
Or, indeed, to 95%+ of small ecommerce businesses. As a consultant, I've always recommended to my clients that they hand off processing credit cards (for example) to one of the services that'll do it securely without them ever seeing the card number, in order to avoid any responsibility for looking after the data.
It's about time (Score:4, Insightful)
Not really (Score:5, Informative)
Storing the name of a customer in SQL Server without the data being encrypted? No way, Jose
Summary and article fail.
Sorry to disappoint all the SQL consultants out there, but the law (as passed) says NOTHING about requiring encryption of data at rest.
Earlier versions of the bill had the requirement for at-rest encryption, but that was lobbied out.
The only time it mentions encryption is for data in-flight over public networks, wireless access, and laptops/"other portable devices".
Everything else states "reasonable security precautions" (aka: access control/passwords).
But don't take my word for it read it [mass.gov] yourself. (it's only 4 pages)
(3)Encryption of all transmitted records and files containing personal information that will
travel across public networks, and encryption of all data containing personal information to be
transmitted wirelessly.
[...]
(5) Encryption of all personal information stored on laptops or other portable devices;
- Mass CMR1700 (the only occurrences of the word "encrypt")
Scarier not to (Score:5, Insightful)
On the other hand, it's not clear what to do about the classic perimeter problem. Sooner or later, somewhere, the encrypted data has to be processed or presented in plaintext. The key and the data have to be brought together. Now we've converted the problem of securing the data to the problem of securing the key - probably many keys in practice - and the systems on which those keys reside - probably many systems.
Re: (Score:2)
It's scarier to contemplate that such information is so often exposed as a matter of routine carelessness.
Yeah, the last 10 security breaches each caused the end of the world. It's super scary.
Except when.... (Score:2)
Good plan....except when the state or local governments fail to do it.....then what? Going to fine themselves?
It's a good idea in theory...except....enforcing it might be hard.
Look at californias hands free cell phone law. I can count, daily, two digit numbers of people who are not following it....and where is the enforcement???
So you can't... (Score:2)
So you can't even send them an email, huh? Harsh!
Probably only applicable to Mass due to interstate (Score:2, Interesting)
This will ultimately probably only end up affect Mass businesses or people with presence in Mass directly. Otherwise this kind of requirement has the potential to impact interstate commerce which states expressly do not have the authority to legislate.
I'm all for requirements to protect data, however it is usually not a good idea to legislate how to accomplish that. When that happens then the industry's ability to innovate is legislated away.
Re:Probably only applicable to Mass due to interst (Score:5, Informative)
This will ultimately probably only end up affect Mass businesses or people with presence in Mass directly. Otherwise this kind of requirement has the potential to impact interstate commerce which states expressly do not have the authority to legislate.
Nope, this is only affecting in-state commerce with Massachusetts residents. And the states are absolutely allowed to pass laws that affect out-of-state businesses when they do business in the state. The only constitutional prohibitions on that are when the law is protectionist - imposes additional cost on out-of-state businesses that in-state business don't have to pay. Here, because the law applies equally to in-staters and out-of-staters, it isn't protectionist and isn't unconstitutional.
Comment removed (Score:3, Funny)
Re: (Score:3, Funny)
Does rot26 count as encryption?
Xor( Xor( NO ) )
Storage of encryption key? (Score:4, Interesting)
Any specifics for encryption key storage? How bout another column in the DB? That seems a likely implementation, very convenient and all that. Or we could just hardcode it to something memorable "password".
Any specifics for encryption scheme? I've heard ROT-13 is fast, but XOR is faster.
Re:Storage of encryption key? (Score:5, Funny)
What about email (Score:2)
So, if a Mass. residents sends me (or my business) an email, what does that mean?
The message will generally contain the sender's name and email address. It is sent in the clear over SMTP, and will generally be stored as plain text on the server as either flat files or perhaps some database until the message is picked up via IMAP, POP or some proprietary protocol. It is then likely to be stored, indefinitely, in plain text on the client machine.
It looks to me like someone did not think this through. (Unfo
Re: (Score:2)
I stand corrected. As another post indicates, this only applies to SSN, credit card numbers or state-issued IDs (driver's licenses.)
Actually, this does not sound too bad. The article, on the other hand looks like a piece of FUD to get users to update their MSSQL software
Re: (Score:2)
Slashdot isn't solely at fault here. The article referenced makes the same error:
What about IPSec? (Score:3, Informative)
Even if you're using IPSec?
It is about time (Score:2)
Re: (Score:2)
I am not wild about regs
Me neither, but you can't deny there are two big things that orient the behavior of companies and large groups of people. Profits, and laws.
I've read text SSN's out of college's for 30 years (Score:2)
I've been able to read cleartext SSN's out of college's for the past 30 years without ANY authorization, so all I can say is that this is better late than never.
The only refinement I can think of that would improve it is that any MIS/IT/CIO Director who authorizes any form of non-encrypted storage of this type of information should also have to pay a personal fine of $500 per record.
Funny how when its your own money that's on the line your perspective changes.
About time (Score:2)
Where I last worked, we routinely dealt with issues like this as well(legal field - chain of evidence and all). It's high time that the computer industry took security concerns as a serious matter. And, no, they really don't. I have a friend who worked in the field working with security for major fortune 500 companies and the state of the security was a complete joke. And the threats are a dozen times worse than the public imagines. Yet they do nothing until there's a problem.
Well, hitting them in the
Slashdot DoS (Score:2)
Bah, wasn't that easy. So lets just close Facebook, which fine should be enough to pay USA debt.
Well, that means jobs (Score:2)
Looks like an example of a smart regulation (Score:4, Interesting)
I'm glad to hear that at least one state is starting to implement a reasonable law. Between corporations too cheap to pay for systems that implement even a hint of real security, and perhaps a few lazy developers, we have a mess on our hands. I don't really understand the "yikes" exclamations in TFA. At least now there are some consequences for being so sloppy with your and my data.
My approach to coding web apps is that we are playing theater in the round -- playing to at least three audiences at once. In any pool of users, you have Group-1) probably 98% of users in various states of computer illiteracy for whom you need a very well thought-out UI that gets them through the app with no errors (and good recovery *when* they make errors, you have Group-2) 2% users that have a clue and want things really streamlined, and you have Group-3) a half-dozen bunches of malicious crackers.
All three groups are always present, and you cannot ignore any of them. Ignore Group-1, and you'll pretty much have no audience. Ignore Group-2, and you drive off the 'experts' to whom much of Group-1 looks for advice, and you'll consequently lose not only Group-2 but also a lot of Group-1. Ignore Group-3 and you'll get cracked and mess up a lot pf people's lives by losing their data, and/or you'll get embarrassed.
Unfortunately, too many buyers and devs of software ignore Group-3 because of costs, and the "it'll never happen to us" attitude. They need this kind of stick to nudge them towards doing the right thing.
I come from a very libertarian perspective, and I hate excess regulation, but I'm smart enough to know that the magic Market alone does not fix everything; it needs some smart regulation to prevent excesses or omissions, and appears to this is an example of such good regulation (presuming that they haven't screwed up the details).
TFA got a very important detail wrong (Score:5, Informative)
Incorrect. The author either did not do any research at all, or got the definition of PII horribly wrong as far as this law is concerned. The directive that sets the standard based on the law [mass.gov] states:
It is abundantly clear that a person's first and last name alone does not constitute PII, SSN, financial account number or some other not so public information is also required.
Interestate Commerce (Score:2, Insightful)
~Article I, section 8, clause 3, United States
Read the law yourself, four pages pdf (Score:3, Informative)
Personal Information Definition (Score:3, Insightful)
From the law, personal information is defined as:
Personal information, a Massachusetts resident's first name and last name or first initial and last name in combination with any one or more of the following data elements that relate to such resident: (a) Social Security number; (b) driver's license number or state-issued identification card number; or (c) financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password, that would permit access to a resident’s financial account; provided, however, that “Personal information” shall not include information that is lawfully obtained from publicly available information, or from federal, state or local government records lawfully made available to the general public.
So just a first+last name isn't enough to incur the wrath of the law. It has to be that, plus SSN, Lic Number, or financial account number.
But from how I read that, it has to be the First name, Last name, Plus one of those. Does that mean I can store a list of social security numbers plus last names completely unencrypted and be off free? Odd
Microsoft FUD (Score:4, Informative)
Yes, this really *IS* Microsoft FUD. Note how they fail to mention that it's social security, credit card info, etc that has to be encrypted, not their NAME or address for example. Also note how at the end of TFA they suggest you follow a link for your indoctrination on the encryption features of SQL Server 2008.
Once you realize that it's just the usual credit card and banking related info that must be handled securely, you realize that the law is quite reasonable (though perhaps unenforceable outside of MA).
This seems practical and pragmatic (Score:5, Funny)
How about we link to someone who's not an MS shill (Score:4, Informative)
Like this [informationweek.com]?
It doesn't say JUST the name. (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
And then when they do "cause distress" to a user who sues for massive damages, people like you are going to cry and whine about tort reform and frivolous lawsuits.
It's just more efficient to set up "best practices" in a sufficiently general way so that the standards can be met freely; welcome to reality. It's either this; the status quo; or a massive "coffee burn"-type lawsuit.
No, they don't (Score:5, Informative)
The FAQ for the law: http://www.mass.gov/Eoca/docs/idtheft/201CMR17faqs.pdf [mass.gov]
Please note, this FAQ contains personally identifiable information - First and last names, job titles, address of employment, phone and fax number, of Governor Deval L. Patrick, Lieutenant Governor Timothyt P. Murray, Secretary of Housing and Economic Development Gregory Bialecki, and Undersecretary Barbara Anthony. It was obtained by http - NOT https, as required by the law.
The only reason THEY can get away with it is because ... guess what ... government agencies are excluded. "Do as I say, not as I do."
Cripes, dude. You link to the full text of the law, but apparently never read past the URL.
First, that is NOT personally identifiable information. As has been said in many posts, and as is listed in your links:
[Definition of] Personal information, a Massachusetts resident's first name and last name or first initial and last name in combination with any one or more of the following data elements that relate to such resident:
(a) Social Security number;
(b) driver's license number or state-issued identification card number; or
(c) financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password, that would permit access to a resident’s financial account;
See? You found names, job titles, addresses, and phone numbers, but no personal information listed in the law.
Second, what's the very next farking sentence in the definition?
provided, however, that “Personal information” shall not include information that is lawfully obtained from publicly available information, or from federal, state or local government records lawfully made available to the general public.
See that? Government agencies are not excluded from the law... rather, information lawfully obtained from government agencies are not personal information, which means that people who use it - like you - are not violating the law.
The shocking part is the amount of effort you went to to find the text, the FAQ, and the compliance checklist, plus creating two Slashdot posts about it, and yet you never actually read any of it.
Re:"Standard practice"... if you're an asshole (Score:4, Informative)
How would your example be covered by the law:
http://www.mass.gov/Eoca/docs/idtheft/201CMR1700reg.pdf
Personal information, [is defined as] a Massachusetts resident's first name and last name or first initial and
last name in combination with any one or more of the following data elements that relate to
such resident: (a) Social Security number; (b) driver's license number or state-issued
identification card number; or (c) financial account number, or credit or debit card number,
with or without any required security code, access code, personal identification number or
password, that would permit access to a resident’s financial account; provided, however, that
“Personal information” shall not include information that is lawfully obtained from publicly
available information, or from federal, state or local government records lawfully made
available to the general public.
so basically you'd be in the clear. Names and addresses are in the phone book / government public records. If your list contained the names and SSN of the members, then you'd be violating the law, which is still slightly silly as SSN *are not* supposed to be personal identifiers, but that's the world we've wound up with.
Re: (Score:3, Informative)
Agreed. I just read 201 CMR 17.00 (it's 4 pages,and really not that scary: http://www.mass.gov/Eoca/docs/idtheft/201CMR1700reg.pdf [mass.gov] )
Two really important points; encryption on disk means if it's on a portable device such as a laptop, not on a server in a secure location. Encryption in transfer means if it's going over a public network (such as the Internet) - in theory, it wouldn't even cover traffic within a corporate LAN.