Hannaford case reversal

Some interesting developments for those who have been following the rulings in the Hannaford breach case - the judge had ruled that since cardholders were not affected economically because credit cards were stolen (banks will cover any losses to cardholders), they dont have a civil case against Hannaford.

However, the judge recently reversed himself and asked the Maine supreme court whether "inconvenience" that the cardholders went through should be compensated... Interesting fork and one that could have strong impact to the retailers if the Maine Supreme Court indeed thinks so..

The bottom line is whether retailers should take more care of data entrusted to them - while the judge had a very narrow view of "loss" to the consumer, the defense believes that they have a shot in making cardholder rights heard...

Should be interesting to see the developments..

SB-20: A California refresh!

The updated California breach law, SB-20, is finally on the Governator's table. It has been a while coming and is most interesting since it finesses the grand-daddy of all breach laws, SB-1386. For more information, check out Ariel Silverstone's blog. There is a very good analysis of the new law.

I like the use of the work "unencrypted" in the new law - implies that even if data was encrypted but the keys were lying around, you cant claim immunity :) Contrast this language with something like "plain" or "open"...

I think this is a good step forward, especially around the notification, use of plain language etc. I would have liked it to be more focused on remedies and "get-out-of-jail" by using encryption (the MA law is one such).

New HIPAA breach laws taking effect

More rules and more rules... The HHS has issued final guidelines on breach notification requirements for organizations under the HIPAA law. They take effect Sept 23rd... Just in time for the G20 summit?

Maybe not. However, the reality is that organizations are having to now deal with a bevy of such requirements and the bigger problem is not in complying with basic standards, but ensuring the lowest common denominator (or in this case the strictest rules) are being met...

The new Missouri breach law

Looks like we have state number 45 - Missouri passed a new breach law recently and will be applicable by the end of August. Nothing earth shattering in the new law - follows pretty much the standard ones.

the interesting part is they decided not to go the Nevada and Massachusetts way and look at prescribing a solution - i.e. encryption. Does this mean there is less perceived value in what MA law is? Or are legislators are unwilling to go the extra step to enforce protection for fear of pushback?

Data protection commissioner?

Never thought a country would have an Information and Data Protection Commissioner - but looks like Malta is taking charge of their data. Interesting article on new laws, expansion of powers, and parliamentary discussions!

Data breaches and gas prices..

Seems like the growth rate is the same - IRTC (Identity Theft Resource Center) just released some interesting stats. Apparently number of breaches in the first half of 2008 have risen 69% over the same period in 2007. Maybe gas prices have increased a bit more, but not by much...

Also other interesting nuggets -

• Almost 40% have not disclosed the number of records breached.
• Theft, either internal or external, have been the primary reason for the breach.

Wonder why we are not hearing this on the presidential campaign? A unified and national policy approach to this epidemic would be welcome (as would lower gas prices!)

To believe or not - new research from Ponemon

New research from Ponemon on consumer behavious post breach breach - apparently over 31% of those surveyed terminated ties with an organization that had a breach.

Not sure to fully believe it when consumers say such stuff (I did not mean the Ponemon research itself:)) - I think consumers say what they think is the right thing to say. I think folks are still lukewarm when it comes identities getting stolen, card numbers being breached. There is not yet enough pain directly resulting from this.

However, I do hope this is true though - high time we took such breach information more seriously.

The insider threat - jobs at risk!

Looks like Her Majesty's Revenue & Customs does not take lightly to employees peeking at sensitive data - they have disciplined around 600 employees.

Lots of questions come up - intentional breach, stupid mistakes etc. If the data were protected with the right policies and access controls would this have been prevented?

My Dad always said when I leave stuff in my car seat - "Don't tempt folks. Even if they are not thieves, the sight of something valuable can turn people". I started believing this after my car was broken into and it turned out to be a neighbor kid.

I firmly believe that taking temptation away (in this case not having access to data you should not) is a great strategy. Insider threats are more troubling, since this is targeted at the most sensitive and valuable data - while the outsider threat depends a lot on luck to get to this.

Laptop = Cinderella, USB = Drizella? I.e. did the USB beat the rap?

Interesting article by Rich Mogull on how to protect USB keys. He seemed to have covered most of the ways one can protect data - I myself like to glue-gun approach! Just kidding, I am all for productivity while being secure.

However, this made me think of breach notification laws. As Rich pointed out and as I blogged about earlier, the sizes of USB keys are getting huge! I have one on my desk now at 8GB and a portable USB hard drive for 250GB! I presume that when one loses their laptops they have as big a chance of losing on of these hard drives or USB keys. And no one is as concerned, since they dont have to notify anyoneif they lose a USB key....

So answer me this - did the USB key and portable hard drive sneak past the breach notification lawmakers? Is the laptop, the Cinderella of the family that the lawmakers hate so much? And did the USB, Drizella, (which apparently is the stepsister's name according to Disney :)) get away?

And finally, is this analogy a really bad one? :)

CA breach notification law 2.0?...

More new laws! Recent news implies that California might enhance the current laws about data breach notification. They want to clear up how companies notify the affected parties - apparently there is too much jargon and legalese. Which leaves most folks not knowing what hapenned, how it hapenned and how they are affected.

We have talked about this on our blog - just saw that Tom Olzak also picks this one up.. I don't think this is making anything more stringent in terms of disclosure - it just lays down some ground rules on communication clarity. I am all for more clarity - had a tough time figuring out the nuances of a few disclosure letters myself!

Best practices - notification of a breach

CSO magazine has a facinating article on notifying stakeholders of a breach. They compare and contrast two styles of letters to customers - interesting stuff. How does one provide details without overwhelming the reader who may not understand everything? Does one mention steps beign taken, other breaches in the industry?

I wonder how many folks within the company (as well as lawyers, PR folks) might be involved in this task? I assume this increases the visibility of data breaches across the company - mainly because of the number of senior folks involved. Bit late though, now that the horse has left the barn...

Data-breach laws and business concerns

Seems like data-breach laws are getting expansive - California law now requires notification of leaked medical information.

Others, such as Massachusetts, are having a harder time convincing businesses. I do understand the challenge small businesses have - some of the security solutions they need to implement can be expensive. Howeever, the solution is not just technology. Better processes and compensating controls for small organizations will go a long way in reducing threats.

All this brings into focus the need for a national, standardized law. Our CEO, Patrick McGregor had some interesting points to make on this subject in this SC Magazine article.