5 ms·

The BBC is being a good state mouthpiece today - the fact that they're quoting May as saying it doesn't hold previously contentious matters (I.e. Breaking encry

The BBC is being a good state mouthpiece today - the fact that they're quoting May as saying it doesn't hold previously contentious matters (I.e. Breaking encryption) is disingenuous to say the least. No, it's not. The bill will say that "unbreakable" encryption is illegal - which means all encryption, as if it's breakable, well, it's not really encrypted, is it. Source please – I've not seen this language indicated anywhere. they haven't arrested anyone at talktalk, who are tge ones who had such poor infosec that script kiddies could blow them wide open. Instead they're arresting children. Poor information security isn't a crime. Breaking into computer systems is.

rikkus 11y ago
Poor information security is a crime when that information involves personal information. The Data Protection Act requires that personal information is kept secure. Just because no one has been prosecuted yet doesn't mean they couldn't or shouldn't be.
- matthewmacleod 11y ago
  UK law basically says "assess the risk and take appropriate measures." Short of criminal negligence, it's extremely unlikely that anybody will be prosecuted.
  - ptaipale 11y ago
    The Talktalk data leak actually seems like criminal negligence. I don't know the British law, but that level of negligence at least should be criminal.
  - rikkus 11y ago
    "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data." TalkTalk did not take appropriate measures against unauthorised processing.
Natanael_L 11y ago
A bank not locking their vaults would probably be slapped with a few dozen criminal charges in court. Why would that not apply for electronics? If you've committed to protecting the data, you're supposed to make a reasonable effort to actually do so.
anon1385 11y ago
>Source please – I've not seen this language indicated anywhere. http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/11970391/Internet-firms-to-be-banned-from-offering-out-of-reach-communications-under-new-laws.html http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/1... >Poor information security isn't a crime. https://en.wikipedia.org/wiki/Data_Protection_Act_1998 https://en.wikipedia.org/wiki/Data_Protection_Act_1998
- matthewmacleod 11y ago
  Thanks for the source, it's interesting that The Telegraph is the only paper reporting this. IOW, I'll believe it when I see it. The Data Protection Act does not in practice criminalise poor information security – it does criminalise the lack of things like a risk assessment. Short of actual negligence, nobody will be prosecuted due to the hostile actions of a third party. Probably not a bad thing, as it would be obviously ludicrous to do so.
  - pjc50 11y ago
    The actual language in the bill is unclear as it's not been published yet and all we have to go on is competing Home Office press releases.
Silhouette 11y ago
Poor information security isn't a crime. Actually, it can be, for example if it results in data protection violations[1]. However, UK law is slightly unusual in this respect, in that while there are technically criminal offences involved, at present the main ones can't lead to arrest or jail time, only monetary fines. A couple of years ago there was talk of consulting on changing this, though I'm not sure what the situation is following the recent general election. [1] https://www.cps.gov.uk/legal/d_to_g/data_protection/#offences https://www.cps.gov.uk/legal/d_to_g/data_protection/#offence...

rikkus 11y ago

Poor information security is a crime when that information involves personal information. The Data Protection Act requires that personal information is kept secure. Just because no one has been prosecuted yet doesn't mean they couldn't or shouldn't be.

matthewmacleod 11y ago
UK law basically says "assess the risk and take appropriate measures." Short of criminal negligence, it's extremely unlikely that anybody will be prosecuted.
- ptaipale 11y ago
  The Talktalk data leak actually seems like criminal negligence. I don't know the British law, but that level of negligence at least should be criminal.
- rikkus 11y ago
  "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data." TalkTalk did not take appropriate measures against unauthorised processing.

Natanael_L 11y ago

A bank not locking their vaults would probably be slapped with a few dozen criminal charges in court. Why would that not apply for electronics? If you've committed to protecting the data, you're supposed to make a reasonable effort to actually do so.

anon1385 11y ago

>Source please – I've not seen this language indicated anywhere. http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/11970391/Internet-firms-to-be-banned-from-offering-out-of-reach-communications-under-new-laws.html http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/1... >Poor information security isn't a crime. https://en.wikipedia.org/wiki/Data_Protection_Act_1998 https://en.wikipedia.org/wiki/Data_Protection_Act_1998

matthewmacleod 11y ago
Thanks for the source, it's interesting that The Telegraph is the only paper reporting this. IOW, I'll believe it when I see it. The Data Protection Act does not in practice criminalise poor information security – it does criminalise the lack of things like a risk assessment. Short of actual negligence, nobody will be prosecuted due to the hostile actions of a third party. Probably not a bad thing, as it would be obviously ludicrous to do so.
- pjc50 11y ago
  The actual language in the bill is unclear as it's not been published yet and all we have to go on is competing Home Office press releases.

Silhouette 11y ago

Poor information security isn't a crime. Actually, it can be, for example if it results in data protection violations[1]. However, UK law is slightly unusual in this respect, in that while there are technically criminal offences involved, at present the main ones can't lead to arrest or jail time, only monetary fines. A couple of years ago there was talk of consulting on changing this, though I'm not sure what the situation is following the recent general election. [1] https://www.cps.gov.uk/legal/d_to_g/data_protection/#offences https://www.cps.gov.uk/legal/d_to_g/data_protection/#offence...