11 ms·

Obama to beef up laws on privacy and data breaches

60 points by escapologybb 12y ago

tempodox 12y ago
> One will require companies to let customers know within 30 days if their personal information went astray in a data breach. What, we will know when the NSA grabbed our data, then? Too good to be true...
- DINKDINK 12y ago
  The laws absolutely scream to be mocked.
  - glaslong 12y ago
    I'm sure they'll come up with some great alternative interpretations of the wording. "In this case, no 'personal' information was lost at all, because after 30 days, all of the data had been effectively made public." - NSA
- rayiner 12y ago
  The law is aimed at commercial loss and identity theft stemming from data breaches. Whatever you think of the NSA, there's not a high risk its going to start selling data it collects on the black market for use in identity theft.
  - Spearchucker 12y ago
    And when the NSA acquires, for example, German data and gives it to an American competitor? That satisfies the commercial loss objective, from an American point of view.
    - wavefunction 12y ago
      They are also alleged to give information to established players so they can fend off upstarts. The NSA is a threat to Americans just as much as anyone else.
      - tptacek 12y ago
        Which established players did NSA give competitive information to?
  - rockyleal 12y ago
    How is that distinction relevant? I want my data not to be with NSA as much as I want it not to be with hackers or marketers. In some ways, even moreso.
    - sanderjd 12y ago
      It's relevant because the vast majority of people living in the U.S. are far more comfortable with the NSA having this data than hackers. Policies are rarely made for outliers, and in this case, you are an outlier.
      - cryoshon 12y ago
        I'd rather have a hacker have 100% of my info than the NSA. A hacker can steal my identity and drain my bank account.I can survive that, and I can defend myself by being careful. The NSA can arrange to have me blackmailed, my reputation destroyed, or even killed, and they are confirmed to do this to people in an industrial fashion.
        sanderjd 12y ago
        Whether I agree with you or not, my point is merely that your position is vastly in the minority. People broadly trust the NSA more than random hackers.
  - tessierashpool 12y ago
    I think this is only true in the short term. Enormous stretches of the Russian and Eastern European mafias are made up of ex-KGB who went into business for themselves when the Soviet Union fell. Imagine the private criminal opportunities that will become available to the NSA after 20 years of Moore's Law and bulk data collection.
  - swombat 12y ago
    Whatever you think of the NSA, there's not a high risk its going to start selling data it collects on the black market for use in identity theft. That's a big assumption considering you're talking about an agency which openly flaunts the law or lobbies it out of existence as needed (thereby showing very little respect for the rule of law) and whose individual agents have shown very variable levels of judgement in the use of those systems (e.g. the LOVEINT stuff). On the contrary, I think that once that data is in the possession of a large amorphous non-accountable organisation with relatively few checks and balances, it is inevitable that said data will end up on the black market. Why wouldn't it? There's money to be made.
    - rayiner 12y ago
      This sort of slippery slope argument is precisely why I'm so anal-retentive about pointing out that the NSA programs that have been revealed thus far seem designed with a careful attention to toeing the line of various well-established legal precedents. You may not like Smith v. Maryland, but there's a big difference between the NSA following an interpretation of the law you don't like, and flouting the law entirely. And that difference is wholly salient to the question of whether the NSA would engage in conduct that's obviously illegal, such as selling private information on the black market.
      - swombat 12y ago
        Let me quote from today's article by Cory Doctorow: ( http://boingboing.net/2015/01/13/what-david-cameron-just-propos.html http://boingboing.net/2015/01/13/what-david-cameron-just-pro... ) > If your Whatsapp or Google Hangouts has a deliberately introduced flaw in it, then foreign spies, criminals, crooked police (like those who fed sensitive information to the tabloids who were implicated in the hacking scandal -- and like the high-level police who secretly worked for organised crime for years), and criminals will eventually discover this vulnerability. The police, the NSA, etc, cannot be trusted not to misuse information which they obtain. In fact, you can quite reliably trust them to misuse that information, if history is any guide (and it is). Whether the misuse will include actually boldly grabbing some private information that's currently valuable and selling it on Evolution or Silkroute 3 or whatever, is a purely academic question. If the information is on NSA servers, and is valuable, and someone at the NSA knows about it, it probably will be misused in some way.
- higherpurpose 12y ago
  I think this is to wash away the NSA stuff while making it look like Obama cares about your privacy - even though this law only applies to private companies, not himself/the government. If he really cared about privacy he'd at least try to reform the ECPA.
coldcode 12y ago
Obama isn't able to beef up much with Congress voting on the laws first. That might prove difficult given the current makeup of Congress.
- drzaiusapelord 12y ago
  Congress doesn't seem to be shy about passing national security legislation. That often trumps partisan politics. I think we've entered the age where we can no longer ignore our national IT infrastructure shortcomings. As someone who has had more than a few sysadmin jobs, and at a couple places you've heard of, its incredible how little security matters, how poorly software is written, how few developers can write secure code, and how management can force IT to make boneheaded implementations that bite everyone in the ass later. I would love to see a HIPAA-type regulation for all businesses, encryption everywhere, force change of default credentials, etc. The wild west days of the internet need to come to an end.
  - vasquez 12y ago
    No thanks. I can see this kind of legislation turning any online presence into a horribly expensive bureaucratic nightmare while accomplishing fuck-all security-wise. (At best.. Given current governments' track record, any privacy act would be all about stomping on people's privacy.) I'd rather not be subjected to (and pay for) more security theater, or see every small business out there drown in a paper mill suitable for the fortune 500s. We are already liable for any gross misconduct.
    - drzaiusapelord 12y ago
      Do you honestly think patient information would be safer without HIPAA? Do you honestly think the EU privacy laws that we don't have in the US aren't doing anything? Its incredible how the anti-regulation types think everything is fine and that no regulation has ever worked.
      - shaftoe 12y ago
Dirlewanger 12y ago
More placebos. >Another will attempt to give people more control over what can be done with the data companies gather about them. Key word is attempt. One can be sure Google and friends will be lobbying hard for no such control, and if something does perchance pass, it won't be for years whatever it is is implemented and will be purposely difficult to reach.
returnofdjedi 12y ago
Okay,guys,any solutions to the current scenario?
Arnor 12y ago
This conversation is important. It's a bit disappointing that we see legislation instead of dialogue. The initiatives here sound kind of knee-jerk and rather difficult to enforce. Companies should be held accountable for the data they collect and how it is used. Most TOS are unconscionable. I'm sure some of the folks here read the entire TOS of every web service they use, but I've never met a person in real life who does. I think a framework for TOS that is basically just a check box "Do you collect: A, B, C" "Do you distribute: X, Y, Z" could be really useful. There could be some pretty cool strategies between web sites and browsers to help users determine what the site is doing and whether they want to proceed. This is a time for a dialogue that builds a working framework, not a burst of legislation that pacifies the public and accomplishes at best a couple of short term goals.
- returnofdjedi 12y ago
  For that we would need all companies to come together and accept a new legislation.I don't see that happenning soon?
  - Arnor 12y ago
    Which part requires everyone agreeing? Building a working framework or having a dialogue?
    - returnofdjedi 12y ago
      I think maybe the important question is people having a lack of faith in these stuff.You can't have faith when all you see is everytime the same thing repeating one way or the another.
- dragonwriter 12y ago
  > It's a bit disappointing that we see legislation instead of dialogue. Legislative proposals are part of dialogue. You can talk all day about generalities and get nowhere, having specific proposals to discuss -- and either criticize or propose alternatives to -- is what moves the dialogue forward.
maerF0x0 12y ago
This is the grand dichotomy of government ethics. Its ok to enforce rules on others, but not themselves. They uphold neither privacy, nor attack data breaches from the NSA, for example.
closetnerd 12y ago
I'm quite certain that all my consumer rights are sufficiently protected by the actual bill of rights. Moreover, my concern is that these laws will give government even more oversight into the management of user data, and therefore the data itself, in order to enforce the laws.
- Zikes 12y ago
  Yep, plenty of laws in place already. It's the enforcing of those laws that's currently lacking, and I don't see this fixing that at all.
bsimpson 12y ago
> Obama to beef up laws on privacy and data breaches I hate headlines like this. The President is a figurehead. He can't really do anything (shy of directing federal agencies not to enforce certain laws) without Congressional action.
- diminoten 12y ago
  Executive orders beg to differ. Admittedly, the next guy can just come in and get rid of those orders, but it's not like he can't do anything. It's also powerful if the President says, "All federal agencies are no longer allowed to use Google or Microsoft until they comply with these new privacy standards."
wtbob 12y ago
The actual headline is more accurate: 'Barack Obama calls for stronger data privacy laws' (at the time that I'm writing this it is 'Obama to beef up laws on privacy and data breaches'). The President of the United States is not able to 'beef up' federal laws; he can execute the ones that exist and call for new ones to be passed.

60 points by escapologybb 12y ago

> One will require companies to let customers know within 30 days if their personal information went astray in a data breach. What, we will know when the NSA grabbed our data, then? Too good to be true...

DINKDINK 12y ago
The laws absolutely scream to be mocked.
- glaslong 12y ago
  I'm sure they'll come up with some great alternative interpretations of the wording. "In this case, no 'personal' information was lost at all, because after 30 days, all of the data had been effectively made public." - NSA
rayiner 12y ago
The law is aimed at commercial loss and identity theft stemming from data breaches. Whatever you think of the NSA, there's not a high risk its going to start selling data it collects on the black market for use in identity theft.
- Spearchucker 12y ago
  And when the NSA acquires, for example, German data and gives it to an American competitor? That satisfies the commercial loss objective, from an American point of view.
  - wavefunction 12y ago
    They are also alleged to give information to established players so they can fend off upstarts. The NSA is a threat to Americans just as much as anyone else.
    - tptacek 12y ago
      Which established players did NSA give competitive information to?
- rockyleal 12y ago
  How is that distinction relevant? I want my data not to be with NSA as much as I want it not to be with hackers or marketers. In some ways, even moreso.
  - sanderjd 12y ago
    It's relevant because the vast majority of people living in the U.S. are far more comfortable with the NSA having this data than hackers. Policies are rarely made for outliers, and in this case, you are an outlier.
    - cryoshon 12y ago
      I'd rather have a hacker have 100% of my info than the NSA. A hacker can steal my identity and drain my bank account.I can survive that, and I can defend myself by being careful. The NSA can arrange to have me blackmailed, my reputation destroyed, or even killed, and they are confirmed to do this to people in an industrial fashion.
      - sanderjd 12y ago
        Whether I agree with you or not, my point is merely that your position is vastly in the minority. People broadly trust the NSA more than random hackers.
- tessierashpool 12y ago
  I think this is only true in the short term. Enormous stretches of the Russian and Eastern European mafias are made up of ex-KGB who went into business for themselves when the Soviet Union fell. Imagine the private criminal opportunities that will become available to the NSA after 20 years of Moore's Law and bulk data collection.
- swombat 12y ago
  Whatever you think of the NSA, there's not a high risk its going to start selling data it collects on the black market for use in identity theft. That's a big assumption considering you're talking about an agency which openly flaunts the law or lobbies it out of existence as needed (thereby showing very little respect for the rule of law) and whose individual agents have shown very variable levels of judgement in the use of those systems (e.g. the LOVEINT stuff). On the contrary, I think that once that data is in the possession of a large amorphous non-accountable organisation with relatively few checks and balances, it is inevitable that said data will end up on the black market. Why wouldn't it? There's money to be made.
  - rayiner 12y ago
    This sort of slippery slope argument is precisely why I'm so anal-retentive about pointing out that the NSA programs that have been revealed thus far seem designed with a careful attention to toeing the line of various well-established legal precedents. You may not like Smith v. Maryland, but there's a big difference between the NSA following an interpretation of the law you don't like, and flouting the law entirely. And that difference is wholly salient to the question of whether the NSA would engage in conduct that's obviously illegal, such as selling private information on the black market.
    - swombat 12y ago
      Let me quote from today's article by Cory Doctorow: ( http://boingboing.net/2015/01/13/what-david-cameron-just-propos.html http://boingboing.net/2015/01/13/what-david-cameron-just-pro... ) > If your Whatsapp or Google Hangouts has a deliberately introduced flaw in it, then foreign spies, criminals, crooked police (like those who fed sensitive information to the tabloids who were implicated in the hacking scandal -- and like the high-level police who secretly worked for organised crime for years), and criminals will eventually discover this vulnerability. The police, the NSA, etc, cannot be trusted not to misuse information which they obtain. In fact, you can quite reliably trust them to misuse that information, if history is any guide (and it is). Whether the misuse will include actually boldly grabbing some private information that's currently valuable and selling it on Evolution or Silkroute 3 or whatever, is a purely academic question. If the information is on NSA servers, and is valuable, and someone at the NSA knows about it, it probably will be misused in some way.
higherpurpose 12y ago
I think this is to wash away the NSA stuff while making it look like Obama cares about your privacy - even though this law only applies to private companies, not himself/the government. If he really cared about privacy he'd at least try to reform the ECPA.

coldcode 12y ago

Obama isn't able to beef up much with Congress voting on the laws first. That might prove difficult given the current makeup of Congress.

drzaiusapelord 12y ago
Congress doesn't seem to be shy about passing national security legislation. That often trumps partisan politics. I think we've entered the age where we can no longer ignore our national IT infrastructure shortcomings. As someone who has had more than a few sysadmin jobs, and at a couple places you've heard of, its incredible how little security matters, how poorly software is written, how few developers can write secure code, and how management can force IT to make boneheaded implementations that bite everyone in the ass later. I would love to see a HIPAA-type regulation for all businesses, encryption everywhere, force change of default credentials, etc. The wild west days of the internet need to come to an end.
- vasquez 12y ago
  No thanks. I can see this kind of legislation turning any online presence into a horribly expensive bureaucratic nightmare while accomplishing fuck-all security-wise. (At best.. Given current governments' track record, any privacy act would be all about stomping on people's privacy.) I'd rather not be subjected to (and pay for) more security theater, or see every small business out there drown in a paper mill suitable for the fortune 500s. We are already liable for any gross misconduct.
  - drzaiusapelord 12y ago
    Do you honestly think patient information would be safer without HIPAA? Do you honestly think the EU privacy laws that we don't have in the US aren't doing anything? Its incredible how the anti-regulation types think everything is fine and that no regulation has ever worked.
    - shaftoe 12y ago

Dirlewanger 12y ago

More placebos. >Another will attempt to give people more control over what can be done with the data companies gather about them. Key word is attempt. One can be sure Google and friends will be lobbying hard for no such control, and if something does perchance pass, it won't be for years whatever it is is implemented and will be purposely difficult to reach.

returnofdjedi 12y ago

Okay,guys,any solutions to the current scenario?

Arnor 12y ago

This conversation is important. It's a bit disappointing that we see legislation instead of dialogue. The initiatives here sound kind of knee-jerk and rather difficult to enforce. Companies should be held accountable for the data they collect and how it is used. Most TOS are unconscionable. I'm sure some of the folks here read the entire TOS of every web service they use, but I've never met a person in real life who does. I think a framework for TOS that is basically just a check box "Do you collect: A, B, C" "Do you distribute: X, Y, Z" could be really useful. There could be some pretty cool strategies between web sites and browsers to help users determine what the site is doing and whether they want to proceed. This is a time for a dialogue that builds a working framework, not a burst of legislation that pacifies the public and accomplishes at best a couple of short term goals.

returnofdjedi 12y ago
For that we would need all companies to come together and accept a new legislation.I don't see that happenning soon?
- Arnor 12y ago
  Which part requires everyone agreeing? Building a working framework or having a dialogue?
  - returnofdjedi 12y ago
    I think maybe the important question is people having a lack of faith in these stuff.You can't have faith when all you see is everytime the same thing repeating one way or the another.
dragonwriter 12y ago
> It's a bit disappointing that we see legislation instead of dialogue. Legislative proposals are part of dialogue. You can talk all day about generalities and get nowhere, having specific proposals to discuss -- and either criticize or propose alternatives to -- is what moves the dialogue forward.

maerF0x0 12y ago

This is the grand dichotomy of government ethics. Its ok to enforce rules on others, but not themselves. They uphold neither privacy, nor attack data breaches from the NSA, for example.

closetnerd 12y ago

I'm quite certain that all my consumer rights are sufficiently protected by the actual bill of rights. Moreover, my concern is that these laws will give government even more oversight into the management of user data, and therefore the data itself, in order to enforce the laws.

Zikes 12y ago
Yep, plenty of laws in place already. It's the enforcing of those laws that's currently lacking, and I don't see this fixing that at all.

bsimpson 12y ago

> Obama to beef up laws on privacy and data breaches I hate headlines like this. The President is a figurehead. He can't really do anything (shy of directing federal agencies not to enforce certain laws) without Congressional action.

diminoten 12y ago
Executive orders beg to differ. Admittedly, the next guy can just come in and get rid of those orders, but it's not like he can't do anything. It's also powerful if the President says, "All federal agencies are no longer allowed to use Google or Microsoft until they comply with these new privacy standards."

wtbob 12y ago

The actual headline is more accurate: 'Barack Obama calls for stronger data privacy laws' (at the time that I'm writing this it is 'Obama to beef up laws on privacy and data breaches'). The President of the United States is not able to 'beef up' federal laws; he can execute the ones that exist and call for new ones to be passed.