Four laws Congress needs to pass now to boost computer security
545413
For Congress to do anything that helps protect consumers and the critical Internet infrastructure as a whole, it must pass laws that require proactive processes to protect computers, not that tell people how to deal with the resulting mess, writes columnist Ira Winkler.
625671
A bill introduced in the US Senate on Tuesday aims to strengthen security requirements for all private databases accessible online that may hold personal information. Reintroducing language that had been stalled since 2005, if passed, the bill could hold IT managers accountable and responsible for security breaches where personal information is pilfered.
358672
DECEMBER 07, 2004 (REUTERS) - Computer security experts, including former government officials, urged the Bush administration today to devote more effort to strengthening defenses against viruses, hackers and other online threats.
766912
Although Congress has tackled a number of tech-related bills this year, a number of measures have yet to be acted on.
621621
Organizations and law enforcement agencies fighting spyware are making progress, but new tools in an antispyware bill stalled in the U.S. Congress could improve the efforts, a member of the U.S. Federal Trade Commission said Monday.One of the spyware bills passed by the House of Representatives earlier this year, the Spy Act, would give the FTC authority to impose civil fines on companies that distribute spyware to consumers&#39; computers. The bill, along with the Internet Spyware Prevention (or I-SPY) Act, have&#160;stalled in the Senate&#160;since passing the House in May and June.The FTC has the authority to collect profits from spyware operations and collect money for consumer redress, but it lacks the authority to impose other fines, as it does when going after spammers, said Commissioner Jon Leibowitz, speaking at a spyware forum in Washington, D.C.Assigning a dollar figure to consumer harm is tricky in many spyware cases, especially when the spyware delivers pop-up advertisements to computers, Leibowitz said. It&#39;s sometimes difficult to get courts to assign large consumer damages to pop-up cases, he said.In some cases, spyware damages are assessed by judges &quot;who don&#39;t even use computers,&quot; said Dave Koehler, with the FTC&#39;s Bureau of Consumer Protection.The Spy Act would allow the FTC to fine spyware vendors up to $3 million for hijacking computers, delivering unwanted adware, and other violations, and $1 million for collecting personal data without permission, in addition to going after the vendor&#39;s profits and seeking consumer redress.Additional authority to impose civil fines would give the FTC &quot;an enormous deterrent,&quot; Leibowitz said.&quot;Right now, companies know that the worst they can do is lose their profits,&quot; he added. &quot;They&#39;re not going to get fined on top of that.&quot;The FTC has brought several spyware actions against companies. In February, the agency settled&#160;a case against adware distributor DirectRevenue. In that case, DirectRevenue settled for $1.5 million, based on its profits, but the founders of the company had received more than $20 million in venture-capital funding, Leibowitz said.While participants in the spyware forum said there continue to be many challenges, including a growing trend of foreign spyware vendors, the cost of spyware to U.S. consumers seems to be falling. Consumer Reports estimated that spyware cost U.S. consumers $2.6 billion in 2006, but only $1.7 billion in 2007, noted Ari Schwartz, deputy director of the Center for Democracy and Technology, a supporter of StopBadware.org, a consumer-protection effort aimed at spyware and other malicious code.The drop in the cost of spyware can be attributed to a number of factors, Schwartz said. Antispyware technology is getting better, the FTC has taken action against spyware vendors, and StopBadware.org has distributed a&#160;list of malicious Web sites, he said. In addition, some states have taken action against spyware, and cybersecurity groups&#39; public education programs seem to be working, he said.But Ron Teixeira, executive director of the National Cyber Security Alliance (NCSA), noted that consumers may know more about spyware, but they aren&#39;t always acting on their knowledge. A survey released by the NCSA and McAfee earlier this month found 78 percent of respondents&#39; computers didn&#39;t have all three of what the NCSA calls the &quot;core protection&quot; software: anti-virus, antispyware, and firewall.&quot;We&#39;re not seeing a huge increase in the actual behavior change,&quot; he said.
185521
U.K. prosecutors have received guidance on interpreting amendments to a&#160;computer crime law&#160;that introduce stronger penalties for computer hacking.A six-page document published on Monday by the Crown Prosecution Service (CPS) gives prosecutors pointers for handling offenses under soon-to-change provisions of the Computer Misuse Act (CMA) of 1990.The amendments were passed into law in November 2006 but have not yet come into force. The changes are designed to strengthen the government&#39;s ability to prosecute and punish hackers, and increase penalties for accessing systems without authorization.Computer security professionals have expressed concern&#160;about the drafting of the changes, however.The most-discussed change, contained in Section 3A of the CMA, makes it illegal for someone to create an application that is &quot;likely&quot; to be used for hacking. But the precise definition of &quot;likely&quot; has prompted fears the law could potentially target those undertaking activities such as penetration testing.According to the CPS document, prosecutors should look at what an application does and who its creator thought would use it. Conditions to consider would be whether the hacking tool was given to a &quot;closed and vetted list of IT security professionals or was posted openly,&quot; CPS said.Prosecutors should also find out whether the tool has a legitimate purpose, if it has a large installation base and whether it&#39;s commercially sold.Some applications will &quot;have a dual use, and prosecutors need to ascertain that the subject has a criminal intent,&quot; CPS said. Possession of a program is not enough to prosecute, it said.Computer security researchers &quot;might find some comfort in this guidance&quot; since criminal intent must be demonstrated, said Struan Robertson, senior associate with law firm Pinsent Masons.The guidance is generally acceptable, wrote Richard Clayton, a computer scientist at the University of Cambridge, on his blog. But using the criterion of whether a hacking program is available for sale ignores the fact that much software is free, Clayton said.On another issue, the document also clarifies what constitutes unauthorized access to a computer, a crime under Section 1 of the amended CMA. The defendant must know that the intended access wasn&#39;t permitted, and prosecutors must show that the person intended to improperly access information from the computer.&#160;
437961
Leading security software vendor PC Tools is pleased to see House  passage of the Internet Spyware (I-Spy) Prevention Act of 2007,  providing the justice system with greater power and resources to  prosecute cyber criminals. "We need to give these criminals more than a  slap on the wrist.
185253
(InfoWorld) - Members of the U.S. Congress introduced a flurry of new technology-related bills this week, including two bills that would require companies with data breaches to notify affected customers. Senators Patrick Leahy, a Vermont Democrat, and Bernie Sanders, a Vermont independent, introduced the Personal Data Privacy and Security Act. In addition to requiring data breach notification, the bill would also require data brokers to disclose what information they hold on individuals. The bill would allow individuals to correct information held by data brokers, and it would require companies that have databases with personal information on more than 10,000 U.S. residents to implement data privacy and security programs. Representatives Bobby Rush, a Illinois Democrat, and Cliff Stearns, a Florida Republican, introduced the Data Accountability and Trust Act this week. Their bill, with 24 co-sponsors, authorizes the U.S. Federal Trade Commission (FTC) to draw up data privacy requirements for businesses, including requirements that they have vulnerability assessments and policies for disposing of obsolete data. After a company reports a data breach, the FTC would conduct an audit of its security practices, and, like the Leahy-Sanders bill, the bill would require data brokers to disclose the information they hold on individuals and allow individuals to correct wrong information. Organizations have lost 100 million personal records belonging to U.S. residents in data breaches since 2005, Leahy said in a speech on the Senate floor. Leahy, chairman of the Senate Judiciary Committee, singled outÂ data breaches at the U.S. Department of Veterans AffairsÂ last May andÂ retailer The TJX Companies,Â announced in January, in his speech. "These data security breaches are compelling examples of why we need strong federal data privacy and security laws to protect Americansâ personal data and to address the ills of lax data security," he said. "In the information age, any company that wants to be trusted by the public must earn that trust by vigilantly protecting the databases they use and maintain." Members of Congress introduced about a dozen bills requiring data breach notification after a series of breaches in early 2005, but legislation stalled largely over committee jurisdictional wrangling. About 30 states have passed breach notification laws, most of them since 2005. The Cyber Security Industry Alliance, a trade group of IT security vendors, in January called on Congress to pass a comprehensive data protection bill, including breach notification. But some groups, including conservative think tank the Progress and Freedom Foundation, have questioned the need for a breach notification law, saying the cost to businesses may far outweigh the benefits to consumers. Other tech-related bills introduced this week: -- Two bills allowing the FTC toÂ investigate the practice of pretexting, when an investigator assumes a false identity to gain access to a person's telephone records. President George Bush signed a bill creating penalties for pretexting in January, but the two new bills would give the FTC the authority to investigate and prosecute pretexters. Many lawmakers became interested in the issue afterÂ Hewlett-Packard disclosedÂ in September that investigators it had hired used pretexting in an attempt to gain access to board members' and reporters' phone records. -- A bill targeted at spyware by establishing criminal penalties for a number of actions. The bill would prohibit keystroke logging, taking control of a computer without the user's consent, diverting Web browsers, using computers to create botnets and modifying a computer users' browser and security settings without permission. Two spyware bills passed the House of Representatives by overwhelming majorities in March 2005, but the Senate didn't act on them. Â
738930
(InfoWorld) - The Cyber Security Industry Alliance has given the U.S. government D grades on its cybersecurity efforts in 2006, and renewed its call for the U.S. Congress to pass a comprehensive data protection law in 2007. The CSIA, a trade group representing cybersecurity vendors, gave the U.S. government D grades in three areas: security of sensitive information, security and reliability of critical infrastructure, and federal government information assurance. "Government needs to take these issues very seriously," said Liz Gasster, the CSIA's acting executive director and general counsel. Among the problems in 2006: The U.S. Department ofÂ Veterans Affairs reported a data breach involving the personal information of 26.5 million military veterans and family members. Other agencies also reported multiple lost laptops containing personal information. The CSIA called on agencies to notify citizens of data breaches. After a rash of reported data breaches in early 2005, members of Congress introduced multiple bills requiring companies with data breaches to notify affected consumers. ButÂ a breach-notification law failed to pass, partly because of jurisdictional fights between multiple congressional committees. A comprehensive data security bill should include breach notification, but also a requirement that all organizations holding sensitive data -- including private companies, government agencies, nonprofits, and educational institutions -- use reasonable security standards, Gasster said. The U.S. Federal Trade Commission has taken action against several companies, but a comprehensive law would give the FTC or another agency broad jurisdiction to investigate data breaches, she said. The CSIA is optimistic a comprehensive data breach law will pass in the next year, even though it stalled in the last Congress, Gasster added. Major data breaches continue to happen, and consumers will increase the pressure on Congress to act, she predicted. In mid-January, retailerÂ TJX Companies Inc. reported a massive data breach. "Consumers just are not going to put up with is," Gasster said. Here's how the CSIA generated its government cybersecurity grades: -- Security of sensitive information, grade D: Congress ratified the Council of Europe Convention on Cyber Crime, allowing the U.S. to work with other signatories on cybersecurity investigations, but failed to pass a comprehensive law to protect sensitive personal information. -- Security and resiliency of the critical information infrastructure, grade D: The Department of Homeland Security appointed an assistant secretary for cybersecurity and telecommunications and implemented some cybersecurity program, but it hasnât offered a clear agenda for its top cybersecurity research and development priorities or established a survivable emergency coordination network to handle a large-scale cybersecurity disaster. -- Federal information assurance, grade D: Government continues to offer a "mixed bag of successes and failures," the CSIA said, with progress within the White House Office of Management and Budget's enforcement of cybersecurity directives and implementation of U.S. President George Bush's Homeland Security Presidential Directive 12, requiring agencies to start issuing smart identification cards. But the government needs to do a better job in several areas, including security issues with telecommuting and releasing information on the cost of cyberattacks, the CSIA said. In addition to a comprehensive data protection bill, CSIA called for the U.S. government to strengthen the power of agency chief information officers and called on agencies to increase testing of cybersecurity controls.
307979
U.S. retailers and police called on  Congress on Thursday to require online auction sites such as  eBay to post the serial numbers of items for sale to help crack  down on gangs of professional shoplifters.
358671
Hackers who secretly install  "spyware" on others' computers and Internet users who copy  movies and music without permission could face up to three  years in prison under bills that advanced in Congress on  Wednesday.
142016
Officials from cybersecurity company tells the U.S. Congress that a data breach notification bill with reasonable security practice requirements would protect Americans.
692980
Companies, governments, and individuals are increasingly vulnerable to Internet attacks by terrorists and hackers.
663773
TechWeb - The Senate asks consumers and companies to work together and protect themselves from the dangers of the Internet.
367587
The U.S. House of Representatives on  Thursday unanimously passed a second bill targeting  perpetrators of computer "spyware" that hides in users'  computers and monitors their activities.
694564
New bills introduced in Congress this week target the privacy fallout from data breaches as well as the problems of pretexting and spyware.
605240
Hackers who secretly install "spyware" on others' computers and Internet users who copy movies and music without permission could face up to three years in prison under bills that advanced in Congress on Wednesday.