Forgot your password?
typodupeerror
Security EU Privacy

New EU Rules Require ISPs, Telcos To Come Clean Within 24 Hours of Data Breaches 70

Posted by Unknown Lamer
from the be-quick-or-be-dead dept.
hypnosec writes "Under new EU regulations ISPs and Telcos serving European customers will have to come clean within 24 hours in case of a security or data breach that leads to theft, loss, or compromise of data. Companies will have to disclose the nature and size of the breach within the first 24 hours. Whenever it's not possible to submit such data, they must provide 'initial information' within the stipulated time and full details within three days. Under the new terms the affected organizations will be required to reveal information such as information that has been compromised and the steps that have been taken or will be taken to resolve the situation. If the breach 'is likely to adversely affect' personal information or privacy, affected businesses and consumers will be notified of the breach."
This discussion has been archived. No new comments can be posted.

New EU Rules Require ISPs, Telcos To Come Clean Within 24 Hours of Data Breaches

Comments Filter:
  • NSA too? (Score:5, Interesting)

    by hawguy (1600213) on Tuesday June 25, 2013 @12:12AM (#44098127)

    Does this mean the alleged NSA taps on major internet links that monitor all traffic would have to be reported as breaches too if an EU ISP discovers (or knowingly installs) one?

    • Re:NSA too? (Score:4, Funny)

      by Anonymous Coward on Tuesday June 25, 2013 @01:10AM (#44098305)

      Does this mean the alleged NSA taps on major internet links that monitor all traffic would have to be reported as breaches too if an EU ISP discovers (or knowingly installs) one?

      Yes.

      it's part of why nsa wanted soooo much to keep it secret. plenty of companies have to stop using american hosting if they technically know that the US servers are compromised.

    • by MrDoh! (71235)
      My first thoughts too. Surely with everything being snooped on, we never have a 'non data breached' moment?
      • by Joce640k (829181)

        "Breach" implies access without permission.

        The NSA has government-mandated permission so their access doesn't fall under this law.

    • by Anonymous Coward

      Traffic monitoring is not the same as a data breach. A data breach is data being accessed without authorization - usually in a database-style scenario - internet traffic is viewable for every intermediate router and therefore confidentiality cannot be ensured in the first place, without appropriate security protocols. Similarly (nearly?) every ISP monitors their network for unusual behavior and traffic patterns (when is there a lot of activity? where should additional hardware be deployed?), which would the

    • by six025 (714064)

      Does this mean the alleged NSA taps on major internet links that monitor all traffic would have to be reported as breaches too if an EU ISP discovers (or knowingly installs) one?

      If you RTFA you would find out:

      There are a few exceptions though – companies will not be required to pass on the data in cases where there are "justified national security reasons", companies like Facebook and Google who fall under Data Protection Direction, companies that take steps such as encryption of data.

      • by Rockoon (1252108)

        There are a few exceptions though – companies will not be required to pass on the data in cases where there are "justified national security reasons", companies like Facebook and Google who fall under Data Protection Directive, companies that take steps such as encryption of data.

        This reminds me of the Data Retention Directive, passed in what... 2006?

        First they require you to keep all data... then they require you to protect the data they made you keep.

        Here is a thought: The best way to let me protect my data is to let me delete it.

      • by Anonymous Coward

        companies will not be required to pass on the data in cases where there are "justified national security reasons"

        What national security reasons are there for retaining the average persons internet traffic?

        • Re:NSA too? (Score:4, Insightful)

          by scarboni888 (1122993) on Tuesday June 25, 2013 @07:45AM (#44099205)

          I got it this one's easy.

          Today's 'average person' may be tomorrow's protestor. Heck that person might actually start turning into someone that other proletariat start listening too. And if their message is in any way threatening to those that gain from the power of the national security apparatus then said apparatus can dig in to so-called 'average person's' past communications to dig up the dirt on them, discredit them, jail them if necessary, and to thereby to retain their power without threat.

          See how easy that is?

          You're welcome.

    • by Camael (1048726)

      For good measure, again No.

      From the last paragraph of TFA [paritynews.com] :-

      There are a few exceptions though – companies will not be required to pass on the data in cases where there are "justified national security reasons"

      This provision is likely useless against the NSA.

  • by Anonymous Coward

    It's just too easy for US companies to "pretend nothing happened".

    • by mlts (1038732) * on Tuesday June 25, 2013 @12:25AM (#44098173)

      I wonder how this law is to be enforced. If nothing is ever told that the breach happened (and logs "expired" pertaining to the breach), then only the party that did the intrusion would really have proof it ever happened.

      General system logs don't have all the eDiscovery rules that E-mail do, and I sort of dread to have to keep every syslog/event log from every single machine for x amount of time, because an intruder can easily just trash the log archive server unless the logs were written something like WORM tape, or EMC's SAN that does WORM volumes.

      In any case, this law is a start, and I wish similar laws would reach across the pond too. However, my fear is that even successful breaches will be classified as "attempts" and never reported... and if they are, it will be one person who gets the blame for failing to report it, they get sacked, and life goes on.

      • by labnet (457441)

        I was wondering the same thing.
        Are the majority of breaches only discovered when some external party says. 'Lulz I gotz ur data'?

      • by pokoteng (2729771)

        It just means any whistleblower or hackers themselves can report the findings into public. Companies are pretty much forced to hand in any reports of breaches; they can't keep quiet about it because otherwise the penalties will be even more severe after the day's over.

        This is a good move. It'll finally keep people/companies on their toes instead of try to hide their flaws.

      • I wonder how this law is to be enforced. If nothing is ever told that the breach happened (and logs "expired" pertaining to the breach), then only the party that did the intrusion would really have proof it ever happened.

        That a company does it's best to hide that their systems where breached doesn't mean that it will never come out.
        If lists of passwords appear online, or if somebody abuses customer data that was only ever disclosed to that company, they will be in deep sh*t if it comes out that they knew about the breach and did not follow the law.

      • by AmiMoJo (196126) *

        Most countries have laws requiring any company that handles personal data to take reasonable steps to protect it. That means intrusion prevention and detection. If they don't they are breaching the law anyway, so saying "we didn't know" isn't a valid excuse.

      • ...I sometimes encounter data breaches from companies I do business with, simply because I use a unique e-mail address for each business. (name_businessname@domain). As soon as I start receiving spam on the e-mail, I have pretty much irrefutable proof that a leak exists at that company; the only condition being that I must make sure that that e-mail address is never communicated to anyone else.
        Of course, "proof" for a court of law could require a bit more, but I think that needs to be established as jurisp
      • by hairyfeet (841228)

        Nice to see I'm not the only one to be scratching their head and thinking about how that is supposed to work. But after watching the laws passed with regard to the Internet? Honestly I just think these bozos passing these laws have zero fricking clue as to how this shit actually WORKS. It would be like some government mandate to "back up the Internet"...okay,how?

        They make these laws and mandates without asking a single grunt who actually does this for a living "Can we do this, and what would be the cost

      • by oranGoo (961287)
        The legislation is intended for Telcos and ISPs according to the excerpt. AFAIK they already have legislation on log retention.

        So you have couple of easily detectable cases:
        * Missing logs or other log anomalies and no reported breach - bad and easy to check
        * Logs with breach activity and no reported breach - bad and possible to check

        So the worst case is actually if someone manages to reconstruct the logs, however I would say that would not be so easy these days with redundant and complex systems that lo

  • Hmm.
    Europe is more about freedom than the US.
    All the right wing congressmen prancing about, but they claim to disavow surveillance.

    I'm just a trouble maker finding holes in the wall...

    rats seem to like peanutbutter more than cheese, but there's lots of that...
    • by Anonymous Coward

      Europe has its own freedom problems. Both sides do different things well. While it's great to ignore all the negatives to make statements like this, remember that one side isn't necessarily better than the other.

  • Does dropping trou for an intelligence agency (foreign or domestic) count as a "breach"? Or is that just "business as usual"?
  • by Anonymous Coward

    This should be for all internet service providers of some scale.. I mean telcos have a lot of communications metadata, but breaching that is not actually something I need to know QUICKLY. What I need to know stores and places with my credit cards and shared accounts are stored. "Do I need to reset passwords" is basically the main question.

  • by Fastolfe (1470) on Tuesday June 25, 2013 @01:21AM (#44098339)

    Do they really expect every massive, multi-part intrusion to be investigated to completion so that a full report can be made after only 72 hours? What am I missing?

    • by Anonymous Coward

      There's no full report required, just the immediate discovery and notification thereof. "Breach detected, your password may be stolen, please change it now". It's about giving people the ability to take measures ASAP.

      • by Fastolfe (1470)

        That's not how I read it, but that would make more sense, I suppose. I'm thinking of situations where you have a multi-pronged attack, and one prong accesses one set of sensitive data, and the other prong accesses another. One access may be discovered, the clock starts, and 72 hours later they may not even be far enough into their forensics to find out about the other prong of the attack. But if you're defining each as its own "breach", even though it's part of the same larger complex attack, I suppose i

  • by Anonymous Coward

    Suppose ISPs (and that includes telcos) were required to only provide connections, an no other products: they simply provided a wire and a router for a monthly bill. They could have no data at all about you aside from how to bill you. Now suppose they perform competitive bidding to provide service to a separably maintained database of customers (or multiple such databases if you dislike centralization) which handled billing. Then the ISPs don't even have your billing information, and in the case of wireless

    • Now suppose they perform competitive bidding to provide service to a separably maintained database of customers (or multiple such databases if you dislike centralization) which handled billing.

      So... instead of having to hack the database of all service providers an attacker would only have to hack one (or a small number of) database(s) to get the data of all consumers?
      No that's progress.

  • by Anonymous Coward on Tuesday June 25, 2013 @01:57AM (#44098421)

    EU Privacy directive is still law, EU Right to Privacy is still written directly into UK law. RIPA does not trump the fundamental rights and it didn't give them permission :
    http://www.legislation.gov.uk/ukpga/2000/23/section/1

    "(4)Where the United Kingdom is a party to an international agreement which—
    (a)relates to the provision of mutual assistance in connection with, or in the form of, the interception of communications,
    (b)requires the issue of a warrant, order or equivalent instrument in cases in which assistance is given, and
    (c)is designated for the purposes of this subsection by an order made by the Secretary of State,
    it shall be the duty of the Secretary of State to secure that no request for assistance in accordance with the agreement is made on behalf of a person in the United Kingdom to the competent authorities of a country or territory outside the United Kingdom except with lawful authority."

    You didn't have a UK court order, so you didn't have lawful authority to intercept UK comms. It was done illegally. You cannot transcribe a mass surveillance directive FISA warrant into UK law and pretend it gives you UK lawful authority. FISA law does not apply to UK, a FISA warrant does not count as lawful authority. If it did, then American law would count as lawful authority over any UK law.

    Without even getting into whether a US law that violates the 4th Amendment is lawful authority or not. It is not lawful in the UK. It is not lawful under RIPA.

    So the companies who assisted in this, need to come forward and report what they did as a data breach. Because that is what it is. Parliament rules UK, not GCHQ, not NSA.

    In particular Vodafone is buying Deuschland Kabel and Vodafone network in Greece was spied on in 2004, so the Germans need to ensure their network is secure from extra-legal surveillance before allowing that to go ahead. Answers are needed.

    • Full credit to this article at the London School of Economics and Politic Science [lse.ac.uk] .

      It is clear that FISA allows the US to target ‘persons reasonably believed to be located outside the United States to acquire foreign intelligence information’. Arguably, when intelligence already in the hands of an agency such as the NSA is handed over to the GCHQ, there is little, if any, legal regulation or oversight in that situation as the RIPA applies only when the GCHQ gathers the data itself. If the data i

      • I forgot to add that while I'm sympathetic to your point of view, it appears that from a purely legal point of view, the authorities appear to have ensured that their actions are clothed with a fig-leaf of legality. Whether their actions have any moral justifications is an entirely different matter.

        What is particularly repugnant is that these overly broad surveillance powers may have already been used to target civil liberty groups [guardian.co.uk] in the UK. I would think that it is a clear abuse of power to spy on parties

  • by Anonymous Coward

    Am I missing something here..? Why ISPs and telcos?

    If its important enough to set up new legislation/regulation then shouldn't this apply to _any_ corporations?
    Shouldn't Amazon, eBay and your banks be similarly accountable? I know if be a lot more angry if my bank exposed my personal and financial details than my ISP.

  • Does this mean that companies have to report the breach after it actually occurs or when they "notice/detect" that it occurred.
    Keep in mind there can be a significant gap between when something happens, it is noticed, and when it is "officially" reported by the company.

I'm a Lisp variable -- bind me!

Working...