Slashdot Log In
New State Laws Could Make Encryption Widespread
Posted by
kdawson
on Fri Oct 17, 2008 10:44 AM
from the squeamish-ossifrages dept.
from the squeamish-ossifrages dept.
New laws that took effect in Nevada on Oct. 1 and will kick in on Jan. 1 in Massachusetts may effectively mandate encryption for companies' hard drives, portable devices, and data transmissions. The laws will be binding on any organization that maintains personal information about residents of the two states. (Washington and Michigan are considering similar legislation.) Nevada's law deals mostly with transmitted information and Massachusetts's emphasizes stored information. Between them the two laws should put more of a dent into lax security practices than widespread laws requiring customer notification of data breaches have done. (Such laws are on the books in 40 states and by one estimate have reduced identity theft by 2%.) Here are a couple of legal takes on the impact of the new laws.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Okay whew (Score:4, Funny)
Only laptops. I was worried that we would have to encrypt our entire database.
Re:Okay whew (Score:4, Interesting)
Identity theft causes a breakdown in the system that allows a few very rich to wield excessive and arbitrary power while the majority struggles to meet their needs while surrounded by plenty.
I'm not rich. I don't expect to be rich, I don't desire to be rich. To be rich is to stand on the neck of your fellow man and steal his share, and to spend each day ensuring that the exploitation isn't disrupted.
I hope we see more identity theft. This system shouldn't exist, and the sooner it shatters due to its own inherent nature, the happier I will be.
I've got an idea for a much better law. All data must be placed on public servers, like Wikileaks, where anyone can examine it at any time. Anyone attempting to conceal information under any circumstances is guilty of conspiracy and treason. That would make it pretty hard to steal someones identity; you'd be caught for sure.
Parent
mofo.com? (Score:2, Funny)
What kind of n00b do you think I am? Like I'm really going to click through a link to mofo.com [mofo.com].
Jesus.
Re:mofo.com? (Score:5, Informative)
Morrison & Foerster [wikipedia.org] is a internationally recognized and prestigious law firm established in 1883, that has been going by the nickname MoFo since 1973. More on the linked wikipedia article for those still interested or skeptical.
Parent
How exactly will this work ? (Score:5, Insightful)
Forcing idiots to encrypt sensitive files will ...
force idiots to encrypt files (not the ones they should encrypt, obviously) using the password "password" ...
and
lose half the data, believing they encrypted it
and
send the data to half their family, especially anyone claiming to be a hacker, with the subject line "can you tell me the password for this file", who'll put it online on wikileaks (who'll happily -and proudly- publish extremely private information on anyone they don't like [wikileaks.org], laws and privacy be damned)
Well at least, when the honeymoon's over and it's time for Barack O. to publish his email correspondance he can claim to have "encrypted it" and then send a random string, telling the judge the password has something to do with a very dark hole where apparently many claim the sun does not shine.
Re: (Score:3, Insightful)
There's only one real question to ask. If someone publishes Obama's email. And there are some private "let's barbecue some white guy" jokes in there, along with an email of some secretary asking to pay a certain bill or not. You know "state business".
And it would have been published whole ... I have to cover my ears just thinking about it.
So : it's NOT acceptable behavior. Sending the emails anonymously to the the police and keeping them 100% out of public view would be the very last line I would find toler
Ironic... or just interesting (Score:5, Insightful)
It used to be that Philip Zimmermann was getting hassled for his creation of PGP.
Boy we've come a long way. Check out the Wikipedia entry on PGP if you can [wikipedia.org]
Re: (Score:3, Informative)
Apologies for replying to my own post, but I found the list in this PDF document [rsa.com]:
Cuba, Iran, Iraq, Libya, North Korea, Serbia, Sudan, Syria, and Talisman-controlled (sic) (Taliban-controlled?) areas of Afghanistan as of January 2000.
(Although there are nine -- counting "Talisman-controlled areas of Afghanistan" -- listed, not 7.)
-- Glenn
Company laptops will be enctypted... (Score:5, Insightful)
but clueless users will write the password on a post it note, and probably burn a plaintext CD copy to leave lying around.
Government agencies will be worse.
Re:Company laptops will be enctypted... (Score:5, Insightful)
but clueless users will write the password on a post it note, and probably burn a plaintext CD copy to leave lying around. Government agencies will be worse.
And you know what? That's better than nothing. It's another layer.
Sure, we all think about "stolen laptops" when we think about these data losses, but that's not always true. Think about a remote hacking attack. Let's say a bad guy connects to the machine and starts sucking up a ZIP files labeled "Customer_Credit_Cards_2007-2008.ZIP". And the password is written down and stuck to the screen. The bad guy is on a network, can't see that password, and the file is just as unencryptable to him as it would be without the sticky note to you.
I'm just saying that you can still get some protection even from bad practices. If that stops 50% of the attackers, well, that's 50% more than we're stopping today. Is it watertight? No. Is it enough? No. Is it better? Yes.
Parent
Re: (Score:3, Insightful)
Encrypting laptops won't stop an employee from selling the laptop and data if that is what they want to do. All they have to do is give the purchaser the password when they sell the machine. All the purchaser needs to do is fire up the laptop and enter the password to get the data. Our work laptops are encrypted, and all i have to do at home to use the machine is enter my logon password twice -- once for access to the encrypted partition of the hard drive, and once to log on to Windows XP. I don't even
Re: (Score:3, Informative)
You do realize that it is the "low level employees" who do most of the work, right?
nannystate tag? (Score:2)
Re:nannystate tag? (Score:4, Insightful)
As many people in the election on both sides has stated There are a lot of small business out there, more that do not focus on IT in general. Excessive restrictions and regulations are just as bad as none. You can't hold the hands of every company. You need to let them mess up from time to time. Encrytion is a good thing however forcing it isn't even for companies. As many of the small business are an employee of one and it is their own personal PC.
Parent
Re: (Score:3, Interesting)
a laptop is stolen weekly with 10000 credit card numbers on it. Yet the companies only respond to it when it affects their bottom line. This has to be law as it will take another decade before most companies even think about it.
Re: (Score:3, Insightful)
Simple solutions that would solve 95% of the data leaks (especially the big ones):
1. Never store customer data on machines that must travel outside of the company. 2. Regardless of #1, all laptops have full disk encryption where poss
Re:nannystate tag? (Score:4, Informative)
It's not just personal data on the laptop.
I work for a fairly small company, and while we don't have any person data off our server, and in fact don't really have any personal data beyond names, addresses and email accounts...
Which is why, of course, we have Truecrypt with boot-time encryption on all laptops, so that if they get stolen we don't have to run around like chickens with our heads cut off trying to figure out every single login that needs to be changed.
For those people worried about forgetting password: Burn three or four TrueCrypt 'recovery CD' and write the password on them. In fact, write the password everywhere...just don't carry it around in the laptop bag.
Seriously, half these 'data thefts' are random laptop thieves stealing random laptop that just happen to include absurdly dangerous amounts of data on them. They aren't targeted attacks, and the thief is probably wiping them before boot. But companies have to act like they have all your data because said companies are morons who can't spend a tiny amount of time setting up free software that would stop that from happening.
People often worry about computer security in entirely the wrong direction, worrying about changing internal company-only passwords every month, and then completely ignoring actual outside risks like someone snatching a laptop bag off someone's arm.
Parent
Re: (Score:3, Insightful)
You can't hold the hands of every company. You need to let them mess up from time to time. Encrytion is a good thing however forcing it isn't even for companies.
Lead reduction is a good thing however forcing it isn't even for companies.
Proper document shredding is a good thing however forcing it isn't even for companies.
Proper hazardous waste disposal is a good thing however forcing it isn't even for companies.
There are a lot of things that are inconvenient that we, as a society, have decided that our citizens must do. In each of the above cases, including yours, the regulations exist to enforce real, tangible protections. These aren't hypothetical problems that
What happens if someone is crossing the US border? (Score:2, Interesting)
Or if they are in the UK.
Let's say that this (good) idea is properly implemented (rather then just pretend implemented), and all the laptops have full disk encryption in place.
Now someone with one of these laptops travels outside the US, and then flies back in and is asked to boot up the laptop. They will do so of course, and then, suddenly, there is no point to having the encryption, at that point. Sure it's still useful for cases where the laptop gets left on a train or something (assuming that they also
Oh Lord (Score:3, Interesting)
Here comes the flood of complaints that their systems are slow, not responsive or too busy.
We have gunfights with our encryption client almost on a daily basis, being a resource hog and all that.
"nanny state"? (Score:3, Interesting)
Re:"nanny state"? (Score:4, Insightful)
In a word: Yes.
Making laws to tell them exactly what to do is stupid. What if there's a better way, and encryption isn't needed? They still have to do the encryption now.
Other posts have been more reasonable: Harsher penalties for failing to protect the data.
It might even be different if this was a 100% fix. It's not. Now the thief just needs 1 more step, instead. The password/key. Even without it, it's not impossible to crack encryption. It's just very hard, if done right. (And next to useless if done wrong.)
So yes, the 'nannystate' tag is accurate.
Parent
Re: (Score:3, Insightful)
No amount of fines in the world will get my personal data back. Once it's out there, it cannot be retracted. At least if the mechanic loses my car I can sue and use the money to invest in a new car. No one can use the car to impersonate me or make copies of the car to allow others to do the same. The car is just an object. It way have sentimental value, but I can ultimately live without that particular car. Personal data breaches, however, can adversely affect people for life. Data can be copied and
Only 2% reduction? (Score:5, Insightful)
I'm not surprised it has made so little difference.
As we know, technical solutions are rarely enough to protect data. Human processes and policies can be much more important.
Personally I prefer the UK approach, the Data Protection Act [wikipedia.org]. No doubt it is flawed, and sadly not enforced as rigorously as it should be, but the concept is better. Rather than mandate specific technological approaches, it imposes a set of general requirements on any organisation that holds personal data:
The DPA is one of the few generally excellent pieces of legislation in the UK. It's just a shame that the Information Commisioner's Office that enforces it isn't as active as it could be. But it gives you quite a bit of power to take on companies yourself.
Re: (Score:3, Informative)
Ironic that it is just the local implementation of the 1995 EC data protection directive...
Why so expensive (Score:4, Interesting)
It sounds to me like all you need to do is encrypt the hard drive and require a password, but if so, why so much? It seems $300 per person is probably on the expensive end for the software, but I'll let that one slide. However, $50 per person per month just to maintain the system? What is this cost for? What is there to maintain? The only thing I can think of is dealing with forgotten passwords, which will require restoring the system and losing whatever was on the laptop and not backed up. $600 per employee per year seems high for this.
Re:Why so expensive (Score:4, Insightful)
Encrypting something isn't instantaneous, especially if new software has to be researched, bought, and installed. In addition, you're paying 2 employees for the time the system is getting the software installed. This goes for laptops, pc, servers, etc. The downtime for servers is also going to cost money in its own ways.
If you think dealing with encryption won't waste $50/mo of each employees productivity, you're mistaken. Plus the passwords thing you mentioned... That could do it on average, too.
No, I think the estimates are low, if anything.
Parent
Re: (Score:3, Insightful)
If you think dealing with encryption won't waste $50/mo of each employees productivity, you're mistaken.
My work laptop has full-disc encryption. The only time I notice is when it asks for a boot password or when I have to change the password every couple months. This is completely negligible compared to, say, the time to boot Windows and open all the horribly bloated (and network-aware, so they also take time to connect to the server) applications I have to use.
Re: (Score:3, Informative)
What magical encryption do you have that doesn't slow the system at all?
It's not the encryption, it's having a system with a processor made in the last 5 years. Spinning plates of rust are already insanely slow, adding symmetric encryption on top of that won't make a difference.
Re:Why so expensive (Score:4, Informative)
Right. Especially for laptops, which tend to have slower hard drives in the first place.
I installed TrueCrypt on my moderately old laptop, an Intel 1.6Ghz, and the only speed different I notice is that, for some reason, hibernation and unhibernation is twice as slow. I suspect this is some sort of bug. Other than that, I forget it's there except when I boot up.
TrueCrypt, by default, uses AES, which was designed for speed on modern processors. (Or, rather, was designed to use exactly the mathematical operations that CPU manufacturers optimize for in order to make games run faster, so as CPUs keep speeding those operations up AES gets faster.)
Ha, I just checked to see if that hibernation thing is a bug, and it turns out that not only is it, but it's been fixed in 6.0 and I should just upgrade instead of whining about it.
Parent
Re: (Score:3, Interesting)
Someone here must have been through an enterprise-wide encryption rollout. What did yours cost?
Corruption opportunity (Score:5, Insightful)
Why do I have a sneaking suspicion that specific software will be endorsed and/or required to meet this new requirement? Probably whichever one spends the most money to "demonstrate" its capabilities to the lawmakers by treating them all to free vacations in the Bahamas. How much do you want to bet that a free solution like Truecrypt just won't meet the "standards" set by this new law?
Re: (Score:3, Informative)
I suspect that they'll just spec FIPS 140-2 [nist.gov] certification for the crypto app.
Corporate interest (Score:4, Interesting)
I wonder if Massachusetts concern about encrypting stored data has anything to do with EMC being headquartered in the state. Considering that EMC owns RSA (the company), a law like this would probably benefit EMC. Also, Massachusetts is home to TJX, famous for having had a major data breach.
[Note: I work for EMC, but have no inside knowledge related to this topic.]
Umm Good? (Score:2)
Seriously, its about damn time that states required companies with our personal data to do something smart with it. Yes I don't like business being forced to act at the whim of a government but in this case, with so much of our data out there and being transmitted to third parties controls are important.
Law Enforcement will Complain (Score:5, Insightful)
Mandate != Reality (Score:4, Insightful)
Just because a state mandates something, does not mean it automatically happens. Look at speeding, look at drug laws, look at overtime rules for P/T and F/T employees, look at many other unenforced business regulations.
This stuff is like when a judge ordered a server's RAM chips removed and stored as evidence, as they were a 'data storage device'. Government typically sucks at anything like this.
Am I the only one... (Score:3, Funny)
Massachusetts long arm (Score:3, Insightful)
Any lawyers reading want to comment on Massachusetts's attempt to impose this regulation on any business (even one without a presence in Massachusetts) storing information about Massachusetts residents? My take on this is that they are WAY overstepping the boundaries of what state laws can do, but IANAL.
Protecting SSNs won't stop identity theft (Score:5, Insightful)
Encryption is good for protecting trade secrets, but useless for protecting social security numbers. Thieves who want to steal credit card or social security numbers can choose from tens of thousands of possible targets, at least one of which will be insecure. We need to stop pretending that social security numbers are useful as identification or authentication, because using an SSN to identify yourself requires disclosing it. We need to switch to a system of public-key cryptography, and put the blame for identity theft where it belongs: on the banks, who somehow decided that a few readily-discoverable numbers and a few easily-forged documents were all that's needed to take a loan in your name.
minimal effort (Score:3, Interesting)
I wonder if people will simply ROT13 [wikipedia.org] their data for cheap token compliance.
win98 (Score:3, Informative)
Problem for medical practices (Score:3, Interesting)
We also have one practice running a dedicated system for ophthalmologists that is so old it doesn't understand networks. Users are connected via serial port expansion units. Makes it a pain when they have multiple sites and the telco says "We're dropping support for those 56k dedicated lines you've been using for 15 years."
Re:Legacy Systems? (Score:5, Informative)
It seems like the Democrats are doing the same thing the republicans did after 9/11. Just as after 9/11 the Republicans pushed Security to an extremist state, Democrats are using the financial crisis to push down all those heave regulations down our mouth...
BS, this is state level law, not Congress, way to troll. Besides these laws were passed way before the meltdown, these are their enactment dates.
Parent
Re:Legacy Systems? (Score:5, Insightful)
>Also I could see huge problems later on when the only IT guy who knows the key is fired, hit by the obligatory train, or quits.
If you're covered by the credit card industry's Data Security Standard, you're already required to use encryption and you're required to use it competently, with a key management infrastructure.
Corporate crypto deployments have been using some form of key escrow for many years. Availability is as much part of security as confidentiality is.
Parent
Re:Legacy Systems? (Score:4, Informative)
You'd probably have trouble on AS/400 unless they've done a version that copes with all the nasty EBCDIC issues porting to that platform (and the fact that it doesn't use directories in any meaningful sense, and what there is of its filesystem is completely alien to the average PC user).
There are lots of those in operational use that have been doing mundane work for years.. and nobody is going to change them in a hurry, because replacement is very expensive and you don't get a better system at the end of it.
Hell, I'd hesitate to compile OpenSSL on quite mainstream OSs like HPUX (although probably someone has already gone through the pain of doing it I'm sure).
Parent
Re:Bad news (Score:4, Interesting)
I don't know about free. Anything but free. This is government admiting they expect widespread monitoring of communications. For example, in the case of the UK, that means all business data will be scanned along with peoples emails, so it makes sense that governments and companies with international offices, are going to be worried their internal email documents are going to be intercepted.
Parent
Re: (Score:3, Funny)
click-click
click
<password><enter>
Damn, that was cryptic. Oh, wait.
TrueCrypt file volume. I now have a nice safe drive U:
Full disk encryption just prompts you for the password or smartcard+PIN at boot time.
Re: (Score:3, Interesting)
openssl des3 -d -salt -in file.des3 -out file.txt -k horsefeathers
Your password can be read in /proc; top will gladly do the work for me. Don't ever give the password as part of the command line.
And you're wrong, using crypto isn't hard. I use then full-disk encryption Ubuntu has spoon-fed me. When I boot, I enter "hunter2" at the password prompt. That's it.
Re:You Un-American *tards! (Score:4, Funny)
Millenium Development Goals :
Yes, you're right, that is un-American.
Parent