Feeds

Debit-card fraud underscores legal loopholes

Notification issues

3 Big data security analytics techniques

Despite the recent epidemic of debit and credit-card fraud and last year's titanic breach at CardSystems Solutions, Congress is considering a bill that will let more companies escape taking responsibility for fraud, consumer advocates charge.

The bill, known as H.R. 3997 or the "Financial Data Protection Act of 2005", would let companies decide when a data breach is significant enough to merit warning their customers. The House Financial Services Committee approved the legislation on Friday.

"It is ironic that after a year in which over 55 million Americans' identities were put at risk through preventable data breaches, the House Financial Services Committee would repeal state laws that have protected consumers from identity theft," Susanna Montezemolo, policy analyst with Consumers Union, the nonprofit publisher of Consumer Reports magazine, said in a statement following the vote.

The federal legislation would supersede the laws passed by states with significantly weaker protection against identity theft. At least 11 states have stronger notification language than the H.R. 3997 and another eight have stronger rules allowing consumers to freeze their credit accounts to prevent fraudulent use, Montezemolo said.

The key flaws in the bill highlighted by consumer advocates include a requirement of a police report verifying an incident of identity fraud before the victim can place a security freeze on their account and so-called trigger language, which allows the company that suffered a breach to make the decision over whether the incident merits disclosure.

"Having trigger language is ridiculous," said the Privacy Rights Clearinghouse's Givens. "If this bill passes and the trigger language remains intact, there will be few, if any, disclosures about data breaches."

H.R. 3997 will next be considered by the full House of Representatives.

Copyright © 2006, SecurityFocus

Correction

The article failed to mention that at least one state's notification law has protections against data thefts that lack names or that obtain the encryption key as well. The state of New York's Information Security Breach and Notification Act (S03492) passed in August 2005 does not contain the loopholes. Thanks to the Emergent Chaos blog for pointing out this error.

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.