Feeds

Debit-card fraud underscores legal loopholes

Notification issues

Beginner's guide to SSL certificates

Despite the recent epidemic of debit and credit-card fraud and last year's titanic breach at CardSystems Solutions, Congress is considering a bill that will let more companies escape taking responsibility for fraud, consumer advocates charge.

The bill, known as H.R. 3997 or the "Financial Data Protection Act of 2005", would let companies decide when a data breach is significant enough to merit warning their customers. The House Financial Services Committee approved the legislation on Friday.

"It is ironic that after a year in which over 55 million Americans' identities were put at risk through preventable data breaches, the House Financial Services Committee would repeal state laws that have protected consumers from identity theft," Susanna Montezemolo, policy analyst with Consumers Union, the nonprofit publisher of Consumer Reports magazine, said in a statement following the vote.

The federal legislation would supersede the laws passed by states with significantly weaker protection against identity theft. At least 11 states have stronger notification language than the H.R. 3997 and another eight have stronger rules allowing consumers to freeze their credit accounts to prevent fraudulent use, Montezemolo said.

The key flaws in the bill highlighted by consumer advocates include a requirement of a police report verifying an incident of identity fraud before the victim can place a security freeze on their account and so-called trigger language, which allows the company that suffered a breach to make the decision over whether the incident merits disclosure.

"Having trigger language is ridiculous," said the Privacy Rights Clearinghouse's Givens. "If this bill passes and the trigger language remains intact, there will be few, if any, disclosures about data breaches."

H.R. 3997 will next be considered by the full House of Representatives.

Copyright © 2006, SecurityFocus

Correction

The article failed to mention that at least one state's notification law has protections against data thefts that lack names or that obtain the encryption key as well. The state of New York's Information Security Breach and Notification Act (S03492) passed in August 2005 does not contain the loopholes. Thanks to the Emergent Chaos blog for pointing out this error.

Intelligent flash storage arrays

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Business security measures using SSL
Examines the major types of threats to information security that businesses face today and the techniques for mitigating those threats.