Feeds

Debit-card fraud underscores legal loopholes

Notification issues

Secure remote control for conventional and virtual desktops

Despite the recent epidemic of debit and credit-card fraud and last year's titanic breach at CardSystems Solutions, Congress is considering a bill that will let more companies escape taking responsibility for fraud, consumer advocates charge.

The bill, known as H.R. 3997 or the "Financial Data Protection Act of 2005", would let companies decide when a data breach is significant enough to merit warning their customers. The House Financial Services Committee approved the legislation on Friday.

"It is ironic that after a year in which over 55 million Americans' identities were put at risk through preventable data breaches, the House Financial Services Committee would repeal state laws that have protected consumers from identity theft," Susanna Montezemolo, policy analyst with Consumers Union, the nonprofit publisher of Consumer Reports magazine, said in a statement following the vote.

The federal legislation would supersede the laws passed by states with significantly weaker protection against identity theft. At least 11 states have stronger notification language than the H.R. 3997 and another eight have stronger rules allowing consumers to freeze their credit accounts to prevent fraudulent use, Montezemolo said.

The key flaws in the bill highlighted by consumer advocates include a requirement of a police report verifying an incident of identity fraud before the victim can place a security freeze on their account and so-called trigger language, which allows the company that suffered a breach to make the decision over whether the incident merits disclosure.

"Having trigger language is ridiculous," said the Privacy Rights Clearinghouse's Givens. "If this bill passes and the trigger language remains intact, there will be few, if any, disclosures about data breaches."

H.R. 3997 will next be considered by the full House of Representatives.

Copyright © 2006, SecurityFocus

Correction

The article failed to mention that at least one state's notification law has protections against data thefts that lack names or that obtain the encryption key as well. The state of New York's Information Security Breach and Notification Act (S03492) passed in August 2005 does not contain the loopholes. Thanks to the Emergent Chaos blog for pointing out this error.

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.