Forgot your password?
Encryption Security Government Privacy News Your Rights Online

New State Laws Could Make Encryption Widespread 155

Posted by kdawson
from the squeamish-ossifrages dept.
New laws that took effect in Nevada on Oct. 1 and will kick in on Jan. 1 in Massachusetts may effectively mandate encryption for companies' hard drives, portable devices, and data transmissions. The laws will be binding on any organization that maintains personal information about residents of the two states. (Washington and Michigan are considering similar legislation.) Nevada's law deals mostly with transmitted information and Massachusetts's emphasizes stored information. Between them the two laws should put more of a dent into lax security practices than widespread laws requiring customer notification of data breaches have done. (Such laws are on the books in 40 states and by one estimate have reduced identity theft by 2%.) Here are a couple of legal takes on the impact of the new laws.
This discussion has been archived. No new comments can be posted.

New State Laws Could Make Encryption Widespread

Comments Filter:
  • by OeLeWaPpErKe (412765) on Friday October 17, 2008 @11:53AM (#25413453) Homepage

    Forcing idiots to encrypt sensitive files will ...

    force idiots to encrypt files (not the ones they should encrypt, obviously) using the password "password" ...


    lose half the data, believing they encrypted it


    send the data to half their family, especially anyone claiming to be a hacker, with the subject line "can you tell me the password for this file", who'll put it online on wikileaks (who'll happily -and proudly- publish extremely private information on anyone they don't like [], laws and privacy be damned)

    Well at least, when the honeymoon's over and it's time for Barack O. to publish his email correspondance he can claim to have "encrypted it" and then send a random string, telling the judge the password has something to do with a very dark hole where apparently many claim the sun does not shine.

  • by i_want_you_to_throw_ (559379) on Friday October 17, 2008 @11:54AM (#25413459) Homepage Journal
    How interesting and ironic that not that long ago (1991) possessing encryption tools was considered as munitions!

    It used to be that Philip Zimmermann was getting hassled for his creation of PGP.

    Boy we've come a long way. Check out the Wikipedia entry on PGP if you can []
  • by sakdoctor (1087155) on Friday October 17, 2008 @11:55AM (#25413485) Homepage

    but clueless users will write the password on a post it note, and probably burn a plaintext CD copy to leave lying around.
    Government agencies will be worse.

  • Only 2% reduction? (Score:5, Insightful)

    by NoNeeeed (157503) <> on Friday October 17, 2008 @11:58AM (#25413565) Homepage

    I'm not surprised it has made so little difference.

    As we know, technical solutions are rarely enough to protect data. Human processes and policies can be much more important.

    Personally I prefer the UK approach, the Data Protection Act []. No doubt it is flawed, and sadly not enforced as rigorously as it should be, but the concept is better. Rather than mandate specific technological approaches, it imposes a set of general requirements on any organisation that holds personal data:

    • Data may only be used for the specific purposes for which it was collected.
    • Data must not be disclosed to other parties without the consent of the individual whom it is about, unless there is legislation or other overriding legitimate reason to share the information (for example, the prevention or detection of crime). It is an offence for Other Parties to obtain this personal data without authorisation.
    • Individuals have a right of access to the information held about them, subject to certain exceptions (for example, information held for the prevention or detection of crime).
    • Personal information may be kept for no longer than is necessary.
    • Personal information may not be transmitted outside the EEA unless the individual whom it is about has consented or adequate protection is in place, for example by the use of a prescribed form of contract to govern the transmission of the data.
    • Subject to some exceptions for organisations that only do very simple processing, and for domestic use, all entities that process personal information must register with the Information Commissioner.
    • Entities holding personal information are required to have adequate security measures in place. Those include technical measures (such as firewalls) and organisational measures (such as staff training).

    The DPA is one of the few generally excellent pieces of legislation in the UK. It's just a shame that the Information Commisioner's Office that enforces it isn't as active as it could be. But it gives you quite a bit of power to take on companies yourself.

  • by Verteiron (224042) on Friday October 17, 2008 @12:02PM (#25413619) Homepage

    Why do I have a sneaking suspicion that specific software will be endorsed and/or required to meet this new requirement? Probably whichever one spends the most money to "demonstrate" its capabilities to the lawmakers by treating them all to free vacations in the Bahamas. How much do you want to bet that a free solution like Truecrypt just won't meet the "standards" set by this new law?

  • Re:nannystate tag? (Score:4, Insightful)

    by jellomizer (103300) on Friday October 17, 2008 @12:03PM (#25413635)

    As many people in the election on both sides has stated There are a lot of small business out there, more that do not focus on IT in general. Excessive restrictions and regulations are just as bad as none. You can't hold the hands of every company. You need to let them mess up from time to time. Encrytion is a good thing however forcing it isn't even for companies. As many of the small business are an employee of one and it is their own personal PC.

  • by CodeBuster (516420) on Friday October 17, 2008 @12:06PM (#25413689)
    It amuses me to see how government always wants to have its cake and eat it too. I agree that widespread use of strong encryption and good security practices is of great benefit to society, but some Senator or law enforcement agency is bound to complain that their ability to wiretap or access encrypted data is being compromised by these better private security measures. Strong encryption and good security are two edged swords, they help us and they help our enemies as well, there is no way around that. Personally, I don't have a problem with that. I would rather live in a society were encryption is used, privacy is paramount, and some criminals and evil doers are a bit harder to catch, not a bad trade-off IMHO. However, there will doubtless be howls of indignation from the law enforcement community, which contains more than its fair share of self-righteous authoritarian pricks, about how criminals are getting away with crimes and going unpunished. I suppose that my response to them would be to make better use of the tools and laws that we already have instead of depending upon ever more egregious invasions of our collective personal privacy and abridgements of our Constitutional rights merely to prevent some drug addict from getting his fix or some high school students from posting pictures of themselves on MySpace or Facebook.
  • Mandate != Reality (Score:4, Insightful)

    by Gothmolly (148874) on Friday October 17, 2008 @12:07PM (#25413699)

    Just because a state mandates something, does not mean it automatically happens. Look at speeding, look at drug laws, look at overtime rules for P/T and F/T employees, look at many other unenforced business regulations.

    This stuff is like when a judge ordered a server's RAM chips removed and stored as evidence, as they were a 'data storage device'. Government typically sucks at anything like this.

  • Re:"nanny state"? (Score:2, Insightful)

    by dlcarrol (712729) on Friday October 17, 2008 @12:08PM (#25413731)
    Yes, it is. The answer is to create penalties for losing personal data just like there could be penalties for losing my car at a mechanic's shop. The answer is not to force every mechanic to build a bank vault around his parking lot, and it is stupid to think that this will do anything except a) make nearly every business a "criminal" with spotty, whimsical enforcement or b) shut things down and so be repealed el fasto
  • Re:"nanny state"? (Score:4, Insightful)

    by Aladrin (926209) on Friday October 17, 2008 @12:09PM (#25413751)

    In a word: Yes.

    Making laws to tell them exactly what to do is stupid. What if there's a better way, and encryption isn't needed? They still have to do the encryption now.

    Other posts have been more reasonable: Harsher penalties for failing to protect the data.

    It might even be different if this was a 100% fix. It's not. Now the thief just needs 1 more step, instead. The password/key. Even without it, it's not impossible to crack encryption. It's just very hard, if done right. (And next to useless if done wrong.)

    So yes, the 'nannystate' tag is accurate.

  • by Aladrin (926209) on Friday October 17, 2008 @12:13PM (#25413807)

    Encrypting something isn't instantaneous, especially if new software has to be researched, bought, and installed. In addition, you're paying 2 employees for the time the system is getting the software installed. This goes for laptops, pc, servers, etc. The downtime for servers is also going to cost money in its own ways.

    If you think dealing with encryption won't waste $50/mo of each employees productivity, you're mistaken. Plus the passwords thing you mentioned... That could do it on average, too.

    No, I think the estimates are low, if anything.

  • by OeLeWaPpErKe (412765) on Friday October 17, 2008 @12:22PM (#25413967) Homepage

    There's only one real question to ask. If someone publishes Obama's email. And there are some private "let's barbecue some white guy" jokes in there, along with an email of some secretary asking to pay a certain bill or not. You know "state business".

    And it would have been published whole ... I have to cover my ears just thinking about it.

    So : it's NOT acceptable behavior. Sending the emails anonymously to the the police and keeping them 100% out of public view would be the very last line I would find tolerable on govt. official's private email addresses. But even that still involves a crime.

  • Re:nannystate tag? (Score:3, Insightful)

    by jandrese (485) <> on Friday October 17, 2008 @12:31PM (#25414079) Homepage Journal
    As long as the restrictions are reasonably commonsense, I don't think small businesses should be exempt. In the end it doesn't matter if my personal information ends up on the black market via a small business or a large business with lax security, either way I'm screwed.

    Simple solutions that would solve 95% of the data leaks (especially the big ones):
    1. Never store customer data on machines that must travel outside of the company. 2. Regardless of #1, all laptops have full disk encryption where possible, and extra safeguards (could be a sticker on the top that says NO PERSONAL DATA) against storing such data on those machines otherwise.

    Getting people to practice proper database security is harder, and may not be practical to legislate. I'm not sure. Still, the vast majority of publicized personal information thefts have been the result of stolen laptops with personal information left unencrypted. It is simply not acceptable to carry around unencrypted personal data like that, no matter how small your company is, not with effective and cheap disk encryptors available.
  • Re:Legacy Systems? (Score:5, Insightful)

    by Beryllium Sphere(tm) (193358) on Friday October 17, 2008 @12:36PM (#25414147) Homepage Journal

    >Also I could see huge problems later on when the only IT guy who knows the key is fired, hit by the obligatory train, or quits.

    If you're covered by the credit card industry's Data Security Standard, you're already required to use encryption and you're required to use it competently, with a key management infrastructure.

    Corporate crypto deployments have been using some form of key escrow for many years. Availability is as much part of security as confidentiality is.

  • Re:nannystate tag? (Score:3, Insightful)

    by Just Some Guy (3352) <> on Friday October 17, 2008 @12:43PM (#25414249) Homepage Journal

    You can't hold the hands of every company. You need to let them mess up from time to time. Encrytion is a good thing however forcing it isn't even for companies.

    Lead reduction is a good thing however forcing it isn't even for companies.

    Proper document shredding is a good thing however forcing it isn't even for companies.

    Proper hazardous waste disposal is a good thing however forcing it isn't even for companies.

    There are a lot of things that are inconvenient that we, as a society, have decided that our citizens must do. In each of the above cases, including yours, the regulations exist to enforce real, tangible protections. These aren't hypothetical problems that only give legislators something to gripe about, but actual problems that would otherwise directly affect other parties.

    As many of the small business are an employee of one and it is their own personal PC.

    Install TrueCrypt and be done with it. This isn't something for a small business to panic over.

  • by russotto (537200) on Friday October 17, 2008 @12:55PM (#25414451) Journal

    Any lawyers reading want to comment on Massachusetts's attempt to impose this regulation on any business (even one without a presence in Massachusetts) storing information about Massachusetts residents? My take on this is that they are WAY overstepping the boundaries of what state laws can do, but IANAL.

  • by Timothy Brownawell (627747) <> on Friday October 17, 2008 @01:01PM (#25414529) Homepage Journal

    If you think dealing with encryption won't waste $50/mo of each employees productivity, you're mistaken.

    My work laptop has full-disc encryption. The only time I notice is when it asks for a boot password or when I have to change the password every couple months. This is completely negligible compared to, say, the time to boot Windows and open all the horribly bloated (and network-aware, so they also take time to connect to the server) applications I have to use.

  • Re:"nanny state"? (Score:3, Insightful)

    by CSMatt (1175471) on Friday October 17, 2008 @01:20PM (#25414817)

    No amount of fines in the world will get my personal data back. Once it's out there, it cannot be retracted. At least if the mechanic loses my car I can sue and use the money to invest in a new car. No one can use the car to impersonate me or make copies of the car to allow others to do the same. The car is just an object. It way have sentimental value, but I can ultimately live without that particular car. Personal data breaches, however, can adversely affect people for life. Data can be copied and distributed infinitely, and a lot of the time it can't be as easily replaced or changed. Trying to sue the company for a breach when that won't stop the data from spreading is about as effective as the RIAA/MPAA's prosecution of those who leak music/movies.

  • Encryption is good for protecting trade secrets, but useless for protecting social security numbers. Thieves who want to steal credit card or social security numbers can choose from tens of thousands of possible targets, at least one of which will be insecure. We need to stop pretending that social security numbers are useful as identification or authentication, because using an SSN to identify yourself requires disclosing it. We need to switch to a system of public-key cryptography, and put the blame for identity theft where it belongs: on the banks, who somehow decided that a few readily-discoverable numbers and a few easily-forged documents were all that's needed to take a loan in your name.

  • by Gonarat (177568) * on Friday October 17, 2008 @01:44PM (#25415141)

    Encrypting laptops won't stop an employee from selling the laptop and data if that is what they want to do. All they have to do is give the purchaser the password when they sell the machine. All the purchaser needs to do is fire up the laptop and enter the password to get the data. Our work laptops are encrypted, and all i have to do at home to use the machine is enter my logon password twice -- once for access to the encrypted partition of the hard drive, and once to log on to Windows XP. I don't even have to be online to use the machine (unless I need to access systems at work, then I have to connect via VPN).

    What laptop encryption WILL do is protect any sensitive information if the laptop is stolen. Without the password, the hard drive can still be formatted and the machine used and/or sold, but the data will not be accessed or sold. Of course, all bets are off if the password is on a sticky, written on the laptop, or kept on a business card in the bag. Too many times strong passwords are required without teaching users how to create one that can be remembered. A strong password written on a post-it note and stuck to the lappy is worse than useless.

  • by plover (150551) * on Friday October 17, 2008 @05:52PM (#25418911) Homepage Journal

    but clueless users will write the password on a post it note, and probably burn a plaintext CD copy to leave lying around. Government agencies will be worse.

    And you know what? That's better than nothing. It's another layer.

    Sure, we all think about "stolen laptops" when we think about these data losses, but that's not always true. Think about a remote hacking attack. Let's say a bad guy connects to the machine and starts sucking up a ZIP files labeled "Customer_Credit_Cards_2007-2008.ZIP". And the password is written down and stuck to the screen. The bad guy is on a network, can't see that password, and the file is just as unencryptable to him as it would be without the sticky note to you.

    I'm just saying that you can still get some protection even from bad practices. If that stops 50% of the attackers, well, that's 50% more than we're stopping today. Is it watertight? No. Is it enough? No. Is it better? Yes.

The most delightful day after the one on which you buy a cottage in the country is the one on which you resell it. -- J. Brecheux