Privacy laws stymie Va. Tech panel
559408
When Virginia Tech gunman Seung-Hui Cho committed suicide, he not only foreclosed any opportunity for officials to question him about his killing spree, but also ensured that his mental health records will remain secret &#151; at least until a court says otherwise.
684167
When a Department of Veterans Affairs laptop computer was stolen in May, putting the sensitive personal information of millions of veterans at risk, VA officials sought to quell concerns by providing a toll-free number to call.
640724
IT managers were urged by security experts to develop careful policies about how employee-owned devices are used in the workplace.
525912
This week's top-level spying spat hits on a legal gray area that may require new laws to resolve.
220167
Relatives of student gunman who killed 32 on Virginia Tech campus turned over his mental health records to a gubernatorial panel investigating the shootings.
405129
Eight years after Virginia began requiring its employees to ask permission before looking at sexually explicit material online, state workers whose duties may take them into the seamier side of the Internet are coping with the law, although many don't know it exists. -washingtonpost.com
370903
Civil liberties advocates urged a White House privacy board Tuesday to aggressively review the government's warrantless surveillance program, even as they questioned whether it has the power to do so.
483736
No one in the business world wants to be held responsible for a breach of sensitive corporate information, but gaining the level of support necessary to allow DLP (data leakage prevention) technology to work effectively remains tricky, customers and vendors confirm.Unlike traditional security technologies that have operated largely within the confines of IT departments and network management teams, DLP projects must include participation from almost every corner of the organizational chart to succeed, according to experts who have worked with the tools.From all the different business units that need access to protected information to human resources departments tasked with following up on potential violations to the highest levels of business management, the issue of data leakage is so pervasive that nearly everyone in a company needs to be involved on some level for critical content to stay under wraps.For DLP technology to have its intended effect, every employee needs to be continually educated about company policies that must be policed aggressively and attached to real consequences for violators, customers said. Simply throwing products at the problem won't work, they claim, because DLP is as much about building policies as it is about embedding IT controls."We have HIPPA considerations to uphold, we don't want to be in newspaper, and we don't want to be embarrassed in today's world for having exposed data accidentally or otherwise -- but it's not an overnight process," said Charles Hibnick, chief systems security architect at AvMed, a large HMO in Florida. "Even though we've been working with compliance regulations for years, embracing DLP is still a cultural change that demands involvement from a lot of people to work."As part of its effort to roll out its DLP program around technology provided by Palisade Systems, AvMed was forced to create a corporate steering committee that included everyone from C-level executives to its HR and compliance officials and even its external legal counsel.If a business is attempting to create a system where employees are expected to follow specific data-handling rules and be held accountable to real penalties when they have violations, all of those parties must be involved, Hibnick contends. "We in IT had to hook up with HR and compliance to make sure that our plans specifically included a review of how the DLP product would be used and ensure that they were buying into the process," he said. "Then the HR director had to communicate with our external counsel to make sure that we were within our appropriate boundaries with everything that we wanted to do and then run it all by the board."Once the plan had been established and the technology's use was approved, one of AvMed's most visible business vice presidents authored a letter to all of the company's employees informing them of the new policies and how they might be punished for multiple infractions, such as sending out sensitive data repeatedly in unencrypted e-mails.The letter was received by employees with some level of concern over "big brother" type monitoring of their work, but making its policies and penalties clear has been key to AvMed's success in keeping its data better protected, Hibnick maintains."You'll always get feedback from users, but when you have senior executives including the CIO saying this work needs to get done, you're not going to get a lot of kickback," he said. "I'd say the two most important pieces of doing this right are aligning the right team to drive it from the top down and making sure that everyone reads that letter and understands the role they play in helping us protect the data."DLP's cooperation requirement in the real world Since getting its system up-and-running and ensuring that employees knew what was happening over one year ago, the company has experienced only a dozen or so incidents that forced it to warn individual users or send reports to those workers' department heads, the IT leader said.Even vendor representatives, such as Palisade Chief Executive Kurt Shedenhelm, concede that the challenging politics of a DLP project often outweigh the technical issues that come into play when working out all the complex data-handling rules that his company's systems are employed to enforce.Some companies struggle to achieve the right level of executive buy-in to force business unit leaders to play ball, while others don't go to great enough lengths to ensure that workers have been sufficiently re-trained to understand new policies, he said. "This issue of internal politics, of who is responsible for protecting the data, who is responsible for educating the end-user, and who is ultimately responsible for enforcement, that's actually the hard part," Shedenhelm said. "In a lot of companies, I think you might find that it's hard to get the business units, HR, and IT people that need to be involved on the same page, but you can't really do DLP without that."In some companies, especially large enterprises, multiple DLP projects may only be put under the domain of IT security and compliance teams, making it harder for those groups to keep their efforts in step without overwhelming end-users.From the issues relating to which business units ultimately maintain responsibility for specific sets of data and who is tasked with enforcing policies, things can get too complex very quickly, he said. "In larger enterprises, where you often have multiple projects looking at DLP from perspectives of intellectual property, compliance, and customer data and information spanning multiple business units, that's where you run into problems," said Shedenhelm. "One of the biggest issues we see is with trouble discerning who is ultimately responsible for handling violations; sadly, in some cases, people clearly don't want to know if violations are occurring on the business side, because then they will be forced to respond."Other experts agreed that the size of an organization often plays directly into its ability to make DLP work with issues of enforcement standing as central disputes.A tug-of-war can break out between security teams tasked with enforcing DLP and those business unit that want unfettered access to data to help do their jobs, according to some industry players. "That's one of the big problems with DLP in general -- organizations are often quite hesitant in enforcing policies, especially when it comes to any notion of blocking secure content and getting in the way of the business," said Uzi Yair, CEO of DLP vendor GTB Technologies. "Businesses want people to be able do their work and don't want interference, but on the other hand, they know they need to weigh that against any loss, which could cost an organization a lot of money these days," he said. "I think it's always going to be about this tradeoff, enforcement versus the fear of slowing down business opportunities, but people need to understand that they all play a certain role."
668259
By CINDY CLAYTON  BY CINDY CLAYTON  THE VIRGINIAN-PILOT  CHESAPEAKE - Two board members disclosed Friday that they a re among about 250 school system employees who learned last week that their personal information has been stolen.
199315
A service intended to help innocent travelers get off the No Fly List instead sent their personal information unencrypted to a Virginia company. Following a Wired News report, a congressman asks the TSA to explain itself. By Ryan Singel.
758978
The report released yesterday by the Virginia Tech Review Panel is one of four investigations into the April 16 shootings. Here's the status of the others:
653983
By Vicky Eckenrode< Morris News Service  ATLANTA - A state senator wants parents to have monitoring privileges and the ability to restrict the access of their children to social networking  Web sites such as MySpace.com and Facebook.com.  Sen.
427531
Virginia lawmakers are considering a futuristic plan to embed computer chips in driver's licenses, making the cards harder to counterfeit by criminals or terrorists and placing the state at the forefront of a national debate about trade-offs between security and privacy.
20721
As the Federal Trade Commission wraps up deliberations on whether to approve the $3.1 billion deal, consumer advocates argue privacy issues must be front and center.
273748
By Michael Sluss, The Roanoke Times, Va.  Jun. 21--RICHMOND -- Two hardware failures in the state's central computer system forced Department of Motor Vehicles offices to close early Wednesday and created problems for other government agencies.
676213
The Bush administration's new privacy guidelines fail to protect the rights of Americans, and the board created to guarantee those rights lacks the independence to do the job, civil libertarians told the White House privacy board yesterday at its first public forum.
615522
The Veterans Affairs worker faulted for losing veterans&#039; personal information had permission to access millions of Social Security numbers on a laptop from home, agency documents obtained by The Associated Press show.