Mass. bill would make retailers pay for data leaks
544797
Massachusetts lawmakers are about to  consider a bill that would require retailers to pay for losses  when hackers and thieves breach their security systems to steal  consumers' credit card and other financial information, the  Wall Street Journal reported on Thursday.
587844
New federal regulations that could result in fines of up to $1 million a day for utilities that suffer blackouts are prompting an increase in IT spending, particularly on cybersecurity technology.
142016
Officials from cybersecurity company tells the U.S. Congress that a data breach notification bill with reasonable security practice requirements would protect Americans.
183494
Two lawmakers have introduced legislation that would prohibit broadband providers from blocking or impairing Web content from competitors.Reps. Ed Markey, a Massachusetts Democrat, and Chip Pickering, a Mississippi Republican, introduced the Internet Freedom Preservation Act Wednesday. The bill says it is U.S. policy to &quot;guard against unreasonable discriminatory favoritism for, or degredation of, content by network operators based upon its source, ownership, or destination on the Internet.&quot;The bill would also require the U.S. Federal Communications Commission to open a proceeding on broadband services and consumer rights. The FCC would be required to investigate whether broadband providers have adhered to its August 2005 policy that providers should refrain from blocking or interfering with Web content.&quot;The open architecture nature of the Internet ... has ensured the Internet&#39;s place as the greatest level playing field ever created,&quot; Markey said as he introduced the bill. &quot;The goal of this bipartisan legislation is to assure consumers, content providers, and high-tech innovators that the historic, open architecture nature of the Internet will be preserved and fostered. [The bill] is designed to assess and promote Internet freedom for consumers and content providers.&quot;A group of advocacy groups, as well as Google and Amazon.com, praised the bill, saying it is needed as recent news report have suggested Comcast is slowing its customer access to high-bandwidth applications such as BitTorrent. Comcast on Tuesday filed a document with the FCC defending&#160;its practice of engaging in &quot;network management.&quot;Petitions by advocacy group Free Press and online video distributor Vuze to have the FCC prohibit Comcast&#39;s traffic throttling &quot;raise important issues about the ability of broadband network operators to engage in reasonable network management to ensure that their customers can enjoy a positive broadband experience,&quot; Comcast said in its FCC filing. &quot;Network management is best left to the sound, good-faith judgment of the engineers and proprietors who run and own the networks and who are best able to remedy customer service issues promptly, rather than to regulation.&quot;The FCC has no prohibitions against Comcast&#39;s behavior, the company argued. &quot;Free Press mistakenly relies on the [2005 FCC] Internet Policy Statement as creating rules the commission can enforce,&quot; Comcast said.But representatives of the Open Internet Coalition, including Free Press and Public Knowledge, praised the new Markey legislation, saying it would remove doubt about U.S. policy on blocking or slowing Web content.In the last six months, Comcast and other broadband and mobile-phone providers have repeatedly tried to block content on their networks, said Markham Erickson, the Open Internet Coalition&#39;s executive director. Erickson called Comcast&#39;s Tuesday FCC filing &quot;remarkable.&quot;&quot;It appears to declare war on Internet users, policy makers, and even the FCC,&quot; he said. &quot;It essentially says that the FCC has no legal ability to protect consumers from discriminatory behavior.&quot;The Comcast filing called Free Press&#39; complaints about its network management &quot;inflammatory hyperbole.&quot; Asked about Erickson&#39;s comments on the filing, Comcast spokeswoman Sean Fitzmaurice denied that the company was saying the FCC had no authority to regulate net neutrality.The Markey bill is not as specific as past net neutrality bills that failed in a Republican-controlled Congress in 2006, but it would set a standard in federal law, said Gigi Sohn, president of Public Knowledge. &quot;It&#39;s the right bill at the right time,&quot; she said.Without prohibitions against blocking or slowing Web content, broadband providers could sign deals with some content providers and shut out new Internet-based companies, added Richard Whitt, Google&#39;s Washington telecom and media counsel.&quot;Keeping the on-ramps to the Web free of undue discrimination is not about Google, it&#39;s about the next Google,&quot; Whitt said.Comcast declined to comment on the Markey bill. But Hands Off the Internet, an advocacy group with members including broadband providers AT&amp;T and Qwest, said it could support an FCC study of net neutrality.&quot;There&#39;s no question that a reasoned examination of the facts will demonstrate the folly of net neutrality,&quot; the group said in a statement, &quot;However, we are concerned that an effort to seek public input is intended to be a stalking horse for federal Internet regulation. The continued push by special interests to regulate Internet neutrality undercuts the best hope Net users have for faster, more affordable broadband.&quot;
575206
Stop & Shop, a Massachusetts-based grocery chain, said that pin pads used in several of its stores in Rhode Island and Massachusetts were tampered with, endangering the payment card data of some of its customers.
174087
When data breach investigator Bryan Sartin gets a call to check into an incident involving customer records loss at a retailer, he knows that the situation most likely involves information that has been lifted from a company's point-of-sale systems.
185253
(InfoWorld) - Members of the U.S. Congress introduced a flurry of new technology-related bills this week, including two bills that would require companies with data breaches to notify affected customers. Senators Patrick Leahy, a Vermont Democrat, and Bernie Sanders, a Vermont independent, introduced the Personal Data Privacy and Security Act. In addition to requiring data breach notification, the bill would also require data brokers to disclose what information they hold on individuals. The bill would allow individuals to correct information held by data brokers, and it would require companies that have databases with personal information on more than 10,000 U.S. residents to implement data privacy and security programs. Representatives Bobby Rush, a Illinois Democrat, and Cliff Stearns, a Florida Republican, introduced the Data Accountability and Trust Act this week. Their bill, with 24 co-sponsors, authorizes the U.S. Federal Trade Commission (FTC) to draw up data privacy requirements for businesses, including requirements that they have vulnerability assessments and policies for disposing of obsolete data. After a company reports a data breach, the FTC would conduct an audit of its security practices, and, like the Leahy-Sanders bill, the bill would require data brokers to disclose the information they hold on individuals and allow individuals to correct wrong information. Organizations have lost 100 million personal records belonging to U.S. residents in data breaches since 2005, Leahy said in a speech on the Senate floor. Leahy, chairman of the Senate Judiciary Committee, singled outÂ data breaches at the U.S. Department of Veterans AffairsÂ last May andÂ retailer The TJX Companies,Â announced in January, in his speech. "These data security breaches are compelling examples of why we need strong federal data privacy and security laws to protect Americansâ personal data and to address the ills of lax data security," he said. "In the information age, any company that wants to be trusted by the public must earn that trust by vigilantly protecting the databases they use and maintain." Members of Congress introduced about a dozen bills requiring data breach notification after a series of breaches in early 2005, but legislation stalled largely over committee jurisdictional wrangling. About 30 states have passed breach notification laws, most of them since 2005. The Cyber Security Industry Alliance, a trade group of IT security vendors, in January called on Congress to pass a comprehensive data protection bill, including breach notification. But some groups, including conservative think tank the Progress and Freedom Foundation, have questioned the need for a breach notification law, saying the cost to businesses may far outweigh the benefits to consumers. Other tech-related bills introduced this week: -- Two bills allowing the FTC toÂ investigate the practice of pretexting, when an investigator assumes a false identity to gain access to a person's telephone records. President George Bush signed a bill creating penalties for pretexting in January, but the two new bills would give the FTC the authority to investigate and prosecute pretexters. Many lawmakers became interested in the issue afterÂ Hewlett-Packard disclosedÂ in September that investigators it had hired used pretexting in an attempt to gain access to board members' and reporters' phone records. -- A bill targeted at spyware by establishing criminal penalties for a number of actions. The bill would prohibit keystroke logging, taking control of a computer without the user's consent, diverting Web browsers, using computers to create botnets and modifying a computer users' browser and security settings without permission. Two spyware bills passed the House of Representatives by overwhelming majorities in March 2005, but the Senate didn't act on them. Â
650605
Massachusetts consumers soon will have access to information long kept confidential by the healthcare industry: The prices individual hospitals are paid by insurers for performing specific procedures - data state officials hope will encourage comparison shopping and reduce medical costs.
748206
Blue Cross &amp; Blue Shield of Massachusetts plans to spend about $50 million to electronically link doctors, hospitals, and other healthcare providers in three Massachusetts communities, allowing them to share and access patients' medical records.
242869
Leaks in the Big Dig highway tunnel system under downtown Boston are more widespread than officials have acknowledged, and a new state report suggests tens of millions of dollars
616464
More and more resellers of used computer equipment are charging to erase data that may still be left on hard drives.
720185
(InfoWorld) - As more details emerge about the recently disclosed security breach at TJX Companies, lawmakers in Massachusetts are considering new laws that would put the onus for paying for such breaches on retailers and merchants, rather than banks and credit unions, the Wall Street Journal reported Thursday. In Massachusetts, Attorney General Martha Coakley is hoping to force significant changes to the manner in which companies are allowed to collect, store, and protect sensitive consumer data. "[Coakley] is looking at a number of issues and working with the legislature to see what types of measures we can implement to better protect consumers," said Melissa Sherman, Coakley's press secretary. But security and privacy experts agree that new laws, in themselves, won't prevent a repeat of the data breach experienced by TJX, which continues to increase in scope. And that the hack of that retailer's network should provide a chilling lesson to businesses that are failing to adequately safeguard their sensitive information. As illustrated by the retailer's continued discovery of new incidents of IT systems intrusion, enterprises that don't have sufficient security tools in place will have a hard time simply piecing together the details of what has happened when their data is attacked, industry watchers observed. On Feb. 21, Framingham, Mass.-based TJX announced that it had discovered a new set of IT systems intrusions that exposed the personally identifiable information of an undetermined number of its customers. Company officials said that in addition to the IT systems break-ins TJX detailed in January 2007 -- which occurred during 2003 and between May and December 2006 -- it now believes that intruders also infiltrated its databases repeatedly during 2005. TJX offered no further details regarding the nature or volume of the information that was accessed by outsiders during the newly reported intrusions, and said that the firm only recently discovered the additional incidents, which started in July 2005 and continued over a period of time that the company classified only as "subsequent dates," in a statement. The fact that TJX -- which has already been publicly chided by MasterCard International, among others, for failing to meet established data security standards -- is still unraveling the exact details of the attack serves as testament to the notion that ill-prepared businesses will struggle just to understand how and when they've been penetrated, experts said. "The scary thing is that we are learning that this type of situation is not uncommon. It's like someone broke into your house by picking the lock and only took items you wouldn't notice were missing," said Richard Mogull, an analyst with Gartner, in Stamford, Conn. "Companies such as retailers are collecting tons of information and not securing it properly, and if they don't have sufficient monitoring technology in place, which most firms do not, it's surprising that they can figure out what has happened at all," he said. Makers of security software designed to help companies fight such data loss contend that IT executives, when they first try out one of the programs, are typically shocked to find out where all their sensitive data is located and how it is being handled by employees and business partners. "Most people are really surprised by what they see. We were even shocked when we turned on the ILP technology for the first time," said Devin Redmond, director of security products at San Diego-based Websense, which acquired information leakage prevention (ILP) specialist PortAuthority Technologies for $90 million in December 2006. "It is amazing to see how much data is moving around the network and being used in ways that existing security policies don't cover," Redmond said. "For companies who haven't addressed the problem that are attacked, the biggest challenge is simply figuring out where your sensitive data might reside to begin with, and what was done to it." Privacy watchdogs said that many businesses, specifically retailers such as TJX, have been aggregating vast amounts of sensitive consumer data for years with little regard for its security. Because businesses struggle just to understand the parameters of such an attack, there is little hope that large companies will soon be able or willing to more intelligently defend their data, said Lillie Coney, associate director at the Electronic Privacy Information Center (EPIC) in Washington, DC. -- even when faced with glaring examples of what can go wrong. "Incidents like the one experienced by TJX provide the best argument for not holding onto large amounts of sensitive information, but there's no evidence yet that these events have pushed other companies to improve their own data security efforts," Coney said. "This is exactly the situation that the criminals want; they can move in and steal the data and it's hard to tell what they made off with, which lets them keep doing business longer." One of the major problems in convincing companies to invest in technologies to defend information from internal and external threats, experts said, is that security workers still have a hard time justifying the cost of expensive new tools to senior executives, who want to know why the systems they've already installed aren't enough. Making a case for how a data breach could affect a company's bottom line should be simple, but many business leaders are unwilling to dip into their coffers for new IT defense systems, EPIC's Coney contends. "If you consider the problem in terms of risk analysis and the potential cost of an incident that exposes sensitive information, including the damage to a company's reputation, it shouldn't be a hard case to make," Coney said. "But getting companies to think like that is still a challenge, as the IT workers don't have a way to position the issue from a bottom-line standpoint; eventually someone will make a case for liability with one of these breaches, and that's when people will really get it." Research company, Ponemon Institute, based in Elk Rapids, Mich., estimates that information losses cost U.S. companies an average of $182 per compromised record in 2006. However, other industry watchers, including Gartner's Mogull said there's no real way to quantify the long-term damage done to a firm's reputation by a TJX-like event. The analyst said that such incidents are causing many enterprises to reconsider their data protection policies and look into new security technologies, but few companies are taking a comprehensive approach to addressing the problem of information security and are instead focused on potential return on investment (ROI) -- a serious mistake, he said. "Companies are trying to do ROI analysis to decide what they need to spend or what they'll lose in an incident, but that's a silly way to do it. The estimates that are out there for the cost of a breach are mostly worthless because they can't take into account the long-term effect," Mogull said. "What they really need to do is find where the data is and how it is being used in their business and try to create smarter policies," he said. "Trying to piece things together after an attack has already happened clearly isn't going to cut it."
698727
Massachusetts lawmakers are considering a bill that would make companies liable when hackers breach their security systems and steal credit card data and other precious information, state officials said on Thursday.
659234
(InfoWorld) - When the U.S. Congress adjourned in the early morning hours Saturday, it left a number of technology-related bills unfinished, including two bills addressingÂ fraudulent access to personal telephone records. Despite pressure from members of the House of Representatives Energy and Commerce Committee, the full House failed to act on the Prevention of Fraudulent Access to Phone Records Act. The law would have allowed the U.S. Federal Trade Commission to seek civil penalties against businesses that obtain personal data under false pretenses. The committee has been looking into privacy concerns related to so-called pretexting since early this year, but the issue came to a head last month, whenÂ Hewlett-Packard revealedÂ it had used questionable investigative techniques in the surveillance of board members, employees, and reporters. With pretexting, private investigators or identity thieves pretend to be customers of mobile phone carriers or other companies in order to gain access to personal records such as call logs. Congress still has more time to act on the pretexting legislation or six related bills this year, however. After a month-plus break allowing lawmakers to focus on the Nov. 7 election, Congress will return for a lame-duck session Nov. 9. Democrats last week complained that the House Republican leadership had held up the pretexting legislation, but Representative Joe Barton, a Texas Republican and Energy and Commerce chairman, said he'd continue to push for the legislation. Congress alsoÂ failed to pass a wide-ranging broadband billÂ that would replace local franchise rules with a national system for telecom providers launching Internet Protocol-based television services in competition with cable TV. And although U.S. President George Bush called on Congress to pass legislation authorizing a controversial National Security Agency (NSA)Â surveillance program, two bills making it easier for the government to conduct surveillance without court-ordered warrants also stalled. One piece of Internet-related legislation did pass early Saturday. The Senate passed a bill providing money for seaport security, and added to the bill was a provision prohibiting U.S. banks and credit-card companies from processing payments to online gambling sites. A group of professional poker players had asked Congress to reject the bill, but a group of House Republicans pushed for the legislation, saying offshore gambling sites were breaking U.S. gambling-control laws. Bush had called for legislation to authorize the NSA program, which has listened in on the electronic communications of U.S. residents without court-ordered warrants, as a way to head off multiple lawsuits targeting the program. He has argued the program is necessary to help keep U.S. residents safe from terrorism. The HouseÂ passed one surveillance bill, but the Senate failed to act. The House bill would allow federal law enforcement officials to spy on U.S. residents for up to 90 days without a court order in the period after a terrorist attack. The Center for Democracy and Technology (CDT), a civil liberties and privacy advocacy group, said it was happy to see the surveillance and broadband bills stall. Republicans supporting the surveillance bill were pushing it as a way to show they were focused on national security during the last weeks of the congressional campaign, said Nancy Libin, a staff counsel at CDT. "Now that they've gone home, I'm not sure what kind of priority it will be when they come back," she said. Several civil liberties groups had opposed the broadband bill as it lacked protections for so-called net neutrality. Net neutrality advocates want a law that would prohibit broadband providers from blocking or slowing service to Web sites offering competing content, and they have successfully halted the Senate version of the broadband bill, despiteÂ heavy lobbying from large broadband providers.
278077
Legislators, regulators and the phone industry are all considering ways to clamp down on unauthorized releases of phone records like those in the Hewlett-Packard case.
192477
(InfoWorld) - Two U.S. representatives have introduced a law that would give the U.S. Federal Trade Commission the authority to investigate and prosecute imposters who gain access to other people's private telephone records. The bill, introduced Wednesday by Representatives Jay Inslee, a Washington Democrat, and Marsha Blackburn, a Tennessee Republican, comes in addition to a bill signed into law by President George Bush in January criminalizing the phone records scheme known as pretexting. The new pretexting bill is important because the FTC has more expertise and interest in prosecuting identity theft cases than many local prosecutors, a spokeswoman for Inslee said. Ken Springer, the founder and president of Corporate Resolutions, a private investigations firm, applauded the pretexting legislation. State prosecutors have been targeting similar tactics to get personal bank records for about 10 years, and reputable private investigations firms haven't used pretexting for many years, he said. "You've got to play by the rules," said Springer, a former special agent with the Federal Bureau of Investigation. "It's not a grey area. You can't use it." Although corporate customers may demand that private investigators use all means necessary, Springer tells clients they should consider that the details of their investigations could wind up in the media. "The risk-reward [balance] is something they should consider," he said. After a pretexting scandal at Hewlett-Packard in late 2006, "corporate America got the message," he said. Still, the new pretexting bill can give customers faith that their records are protected, he said. Inslee and Blackburn introduced a similar bill in January 2006, but it didn't come up for a vote on the floor of the House of Representatives. Their Consumer Telephone Records Protection Act would make it illegal for anyone to knowingly obtain confidential phone records by making false or fraudulent statements to a telephone company or to knowingly sell or receive confidential phone records knowing such information was obtained fraudulently. The bill would also require telephone companies to notify customers when their phone records fall into the wrong hands. In January, Bush signed a law making pretexting illegal, punishable with up to 10 years in prison and fines. Fines and prison sentences would increase if the violations involve more than 50 telephone customers. Congress began investigating pretexting in early 2006 after media reports and a complaint from privacy advocacy group the Electronic Privacy Information Center showed that several companies were selling private phone records online for less than $100. Then in September, HP revealed that investigators it hired had used pretexting to try to discover the source of board leaks.Â California prosecutors charged former HP board Chairwoman Patricia Dunn, former HP legal counsel Kevin Hunsaker, and three investigators with feloniesÂ late last year.
507647
Rewards could be offered to people who inform on companies or individuals defrauding the government.