CAUCE

Omnibus Cybersecurity Bill May Not Go Where Original Authors Intended

Image via Wikipedia

In an interview with GovInfoSecurity, Sen. Thomas Carper said that the U.S. Senate is considering attaching cybersecurity legislation to a defense authorizations bill.  Though clearly a ploy to be able to say "we did something about those evil hackers" before the elections, CAUCE applauds the attempt.  There can be no doubt that the United States (and many other countries) sorely needs better laws to deal with these threats.

Further, Senate Majority Leader Harry Reid has asked that the cybersecurity bills currently in front of various committees be combined into one single, omnibus bill, which would presumably then be attached to the defense authorizations bill.  Here's where we start to get worried.

Each of the bills we've seen (and we surely haven't seen them all yet) have some good points, and some...let's just call them unintended consequences.  In every case it's obvious that the authors' intentions were good, but they needed some expert advice from people who understand the technical and legal realities of the internet today.

One such expert, a long-time CAUCE supporter who asked to remain anonymous, shares his review of one of those bills: S. 3742, the "Data Security and Breach Notification Act of 2010."  You can read the original and check its current status here.

Please note that this is not legal advice.  Our expert is not a lawyer, I'm not a lawyer, and CAUCE did not consult with any lawyers before publishing this article.

Our expert says it's going to be difficult to construct a single good omnibus cybersecurity bill. The bigger and more complicated it gets, the less likely it is that anyone will actually read the bill before voting on it — particularly when they're in a hurry to go home and win an election.

He highlights a few specific items which could be troublesome for just about anyone running a mail server, a web site, or other online services which collect or transit any information:

• Page 2, Section 2 (a)(2)(A): More or less everyone's going to need to have personally identifiable information (PII) security policies
• Page 3, Section 2 (a)(2)(B): ... and an information security officer
• Page 3, Section 2 (a)(2)(C): ... and a process for monitoring for PII breaches
• Page 3, Section 2 (a)(2)(D): ... and a process for mitigating PII vulnerabilities
• Page 3, Section 2 (a)(2)(E): ... and a process for securely deleting electronic records containing PII
• Page 4, Section 2 (a)(2)(F): ... and a process for securely destroying paper and other non-electronic records containing PII
• Page 4, Section 2 (b): If you're an "information broker" (which would include nearly anyone who collects information and shares it with anyone else), you have additional obligations, including needing to submit policies to the FTC, needing to provide consumer access to information, tracking access to information maintained by the broker, etc.
• Page 13, Section 3 (a)(1): Requires notification solely to US citizens and residents in the event of a breach. Of course, that presumes you know the nationality/immigration status of those whose PII data you hold (hmm, I don't think *anyone* I know does, except for HR departments with regard to their own employees). If I were a covered entity, I'd be strongly inclined to begin soliciting that information from everyone I get PII data from, although of course that may trigger a whole different set of issues, particularly in areas where immigration related issues are a hot button topic.
• Page 14, Section 3 (b)(2): Notification by a service provider triggers reporting requirements. This is going to make LOTS of friends for service providers, given the affirmative notification and credit protection obligations that customers accrue after being notified.
• Page 19, Section 3 (d)(2)(A): Alternative notification is available for incidents involving LESS than 1,000 individuals. This is goofy.
  Normally alternative notification is allowed as an option when the number of covered individuals is very LARGE not very small. For example, some state laws permit alternative notification in cases where costs of providing notice would exceed a quarter million dollars, the affected class of consumers to be notified exceeds 350,000, or the notifying party doesn't have sufficient contact information to provide notice.
  There's language on page 22 of the draft bill that may allow regulatory additions to expand when substitute notification is permissible, but the basics for when substitute notification should be permissible should be part of the core statute, not an after-the-fact, maybe-yes, maybe-no regulatory add on by the agency.
• Page 25, Section 3 (d)(2)(B): imposes compliance burdens on entities for a year before technical compliance guidance is available. Enforcement of the act should be held until the guidance envisioned by 3(d)(2)(B) is available, and realistically it will take probably an additional period after that for sites to deploy the recommended technology (new projects don't happen over night).
• Page 26, Section 3 (h): Potentially requires notification in polyglot languages. This can be a huge administrative PITA -- consider the "simple" case of the EU, where there are "only" 23 official languages (Bulgarian, Czech, Danish, Dutch, English, Estonian, Finnish, French, German, Greek, Hungarian, Irish, Italian, Latvian, Lithuanian, Maltese, Polish, Portugese, Romanian, Slovak, Slovene, Spanish and Swedish, plus (semi-official) Catalan, Galician, and Basque).
  This section could be potentially exceptionally burdensome if the FCC suddenly mandates that sites provide notification in multiple foreign languages (I could see an argument for requiring Spanish as well as English, but there are some communities in the United States where other languages are also very common).
• Page 28, Section 4 (b)(1): It seems unnecessarially combative to define all data security incidents as "unfair or deceptive acts or practices." Data security incidents are not typically something which a covered entity intentionally does, neither are such breaches typically "unfair" or "deceptive" in the same way that some TV or Internet huckster's "miracle" product or pyramid sales scheme might be.

The most persuasive argument in the other direction is probably that currently most states already have their own PII breach notification laws, and it can be a pain to try to stay in compliance with 46 different PII information security and breach notification statutes. So again, the intention is clearly good, but in practice...it needs some careful review.

So there are the results from one bill, examined by one expert.  He's one of the best minds in the cybersecurity community, yet he may still have missed something.  With legislation as important as this, smushing it all together and rushing to attach it to something unrelated is simply a bad idea.  This is a topic which requires careful thought, from multiple people who really do know what they're doing — and who can explain it to the Congressional staffers who will write the resulting bill, and then to the Senators and Representatives who will collectively make the decision.

Once that education has occurred, it should quickly become evident that while some of these bills do overlap, others do not.  Some will disagree.  Some simply contain bad ideas.  All of this has to be worked out.  Then, finally, it might make sense to combine them — not now, and not just because they all have the prefix "cyber" in the title somewhere.

 

Related articles by Zemanta

• Cybersecurity Tensions Between Public, Private Sector (informationweek.com)
• Former acting cybersecurity czar provides legislative summary of bills in 111th Congress (securityarchitecture.com)
• New Data Breach Legislation (thesecuritypub.com)
• Cybersecurity Regulations Pass House (informationweek.com)
• Federal Computer Week: Congress just doesn't see cybersecurity's sex appeal (boxofmeat.net)
• Omnibus bills subvert our legislative process (theglobeandmail.com)
• Ad trade group spent $250,000 lobbying in 2Q (seattletimes.nwsource.com)
• ID Thefts Go Unreported Despite Notification Laws (informationweek.com)

Email User Safety At Risk - MAAWG Consumer Survey 2010

The 2010 version of the now-annual Messaging Anti-abuse Working Group (MAAWG) ‘Email Security Awareness and Usage Report’ was released yesterday. While un-belied by the title, the vernacular name might get a bit more attention: ‘The MAAWG Consumer Email Survey”.

The key findings of this comprehensive study can be found here, and the full report downloaded here.

Consumers were surveyed in North America and across Europe with a variety of questions from computer expertise and savvy, to their preferences of email.

Many of the findings are both shocking and disturbing; despite efforts to the educate, consumers are well unaware of the consequences of their actions, and a painful percentage continue to click on spam, knowingly, instead of deleting it immediately. Such actions has, of course, lead to the gargantuan increase in botnet presence on the ‘net and zombie’d computers continue to steal millions of bits of personal and confidential business information as a result.

Clearly, a concerted effort to heighten consumer awareness of the very real dangers on the net is needed; involving all stakeholders, marketers, receiving sites, government, and NGO consumer advocacy groups. The resources are out there, for example StopSpamHere.ca and Onguardonline.gov (more resources below), but do not appear to be used, or sage advice heeded.

Equally striking are the findings about the email consumers actually want and care about. it has long been CAUCE's contention that email is about personal communication. The survey's respondents from across the world agree.

On page 14 of the full report consumers state their preferences for various types of email; clearly one-to-one communications is still the cock of the walk when it comes to the type of email we all like to receive, messages from friends and family were ranked as ‘extremely or very important’ to 82% of respondents.

Strikingly, marketing email was only rated similarly by 15% of those surveyed; however, 32% did view such mail as ‘somewhat important’.

Graphic courtesy of MAAWG.org,reproduced with permission

This seemingly speaks to some fundamental issues that the marketing community must deal with if they are to better themselves in the eyes of consumers, irrelevant content and over-mailing are serious issues that enlightened marketers are working hard to deal with, but much more can be done, industry-wide to address them.

Other End-user oriented Resources (please help promote them!)
StaySafeOnline.org
StopBadware.org

T'is the Season for Apartment Rental Scam Spams - Consumer Alert

Summer tends to be moving time here in Montreal, as it is elsewhere. This year, I have decided to move, and thought it would be an opportune time to share a warning about some scams that are related to this seemingly harmless activity.

First off is the 'Too good to be true' Craigslist posting (or Kijiji, or any other public listings site!). Last time I moved, I went searching on CL for a new place, as so many do. I found a nice listing, and emailed the purported landlord. I got an email back from someone claiming to be on missionary work in Africa, and if I would just send him or her some money, the place was mine; I could pick up the key when the cheque cleared.

I researched a bit further, and found that what the scammers had done was re-post a previous listing on CL from a few weeks past, dropping the price enough to make the offer seem great, but yet remain credible. A call to the landlord and an email to Craigslist Abuse had the listing and a few others taken down.

Scam two: Advance Fee Fraud - I am now subletting my place, and today, a very nice lady ostensibly in Benin is offering to send me money to reserve my flat, sight unseen. No doubt, it will be a cheque, which I would deposit. Then, complications will arise, she will ask for her money back, less a fee for the hassle. The cheque would take some time to clear, but by then, the money would be safely in the hands of the scammers.

Bottom line: Never rent an apartment or house from someone who isn't present to show you around, and pay with a cheque noting the address, and the date of the first month of rental. Here in Quebec, we have government issued lease forms available everywhere, always use them, and make sure the person renting has the authority to do so. Otherwise, come moving day, you may find yourself without a place to live.

Never pay out money from cheques you receive before your bank has had time to clear the payment, and are 100% willing to state the transaction is legitimate. Otherwise, you will find yourself on the hook for the money.

As always, the old saw 'if it seems too good to be true, it probably is' applies. Remain skeptical, especially in your online dealings.

Neil Schwartzman
Executive Director, CAUCE

The (Possible) Future of International Spam Laws

by J.D. Falk

After more than a decade of fits and starts, fear and doubt, lies and lobbying, legislative attention towards spam now seems to arrive in regular waves.

Our friend Dennis Dayman reports on deliverability.com that a new law has taken effect in Israel, requiring (in short) opt-in — and so according to the International Herald Tribune, Israeli marketers were rushing to re-confirm questionable subscriptions before the deadline this past Monday. In Canada, Internet law expert Michael Geist lambasted his government for continuing to fail to pass any anti-spam legislation, four years after he and the National Task Force on Spam — which also included our own Neil Schwartzman — strongly urged them to take immediate action. And this week at the Internet Governance Forum in Hyderabad, I've heard representatives from more than a dozen governments from all over the world discussing not whether "cyber crime" legislation is necessary, but rather how it should be formulated to fit their local legal standards and culture.

Facebook Vs. Adam Guerbuez And Atlantis Blue Capital

Facebook won an immense judgement against Montreal, Canada spammer and phisher Adam Guerbuez.

Guerbuez has a storied history, having been found arrested for uttering threats in 1997, charged with murder in 2000, faced marjuana charges in 2004 and perhaps most interestingly his online presence which began in 2003, he interviewed in the Montreal Mirror about his bum-fighting (homeless people paid to beat one another) websites crazypricks.com and bumvision.com. Currently he runs ballervision.com

Facebook's lawyers submitted this affidavit to the court outlining the character of Mr. Guerbuez, including his involvement with Neo-Nazi groups, and his criminal past.

CAUCE has been quoted today in the aftermath

NewsFactor Network

CTV

CAUCE President John levine also has some commentary on his personal blog
The Globe and Mail quotes Federal Task Force on Spam member Michael Geist regarding the lack of Canadian spam law and enforcement.

The Montreal Gazette makes note of Guerbuez' notorious past

Mr. Guerbuez's personal blog refutes any notoriety.

Virginia Court Overturns anti-spam law

On Friday the Virginia Supreme Court threw out the state's anti-spam law, and with it the 2004 conviction of large-scale spammer Jeremy Jaynes, on the grounds of First Amendment overbreadth. While not disagreeing that Jaynes was guilty as charged and convicted, they found that the law could place too great a burden on non-commercial speech. CAUCE president John Levine commented in this blog entry.

While CAUCE is dismayed at this outcome, we see little practical effect beyond this single case. This case predates the Federal CAN SPAM law, which does not have the First Amendment issues of the Virginia law, which would clearly apply if Jaynes were to do the same things today he did in 2003. Nor do the other state anti-spam laws have similar overbreadth issues. CAUCE believes that it is possible to create more effective anti-spam laws than the weak CAN SPAM without running afoul of First Amendment issues and will continue to work to help pass them.

ACLU, Anti-Spam Laws, and the First Amendment

by J.D. Falk

In an article published by the Technology Liberation Front, Cato Institute adjunct scholar Tim Lee dissects a recent argument by the American Civil Liberties Union regarding free speech & anti-spam laws.

It's been interesting to watch the ACLU wrestle with anti-spam legislation. Their entire purpose is to work through the legal system to protect our civil rights, as defined in the First Amendment -- which is why I've been a card-carrying member since before I was old enough to vote -- so of course they're going to push back against any perceived abridgment of the right to free speech, including anonymous speech.

Yet as Tim Lee argues, the amount of speech afforded to spammers before they run afoul of the Virginia statue is enormous: "someone may (a) send out an unlimited number of emails using a real email address, (b) send out 9999 emails per day (99,999 per month, 999,999 per year) while falsifying email headers, or (c) send out an unlimited number of emails with falsified addresses to people who have previously consented to receive them." In order to violate this Virginia statute, you have to be very bad. In order to violate CAN-SPAM & get even more federal attention, you have to be even worse.

Anyone with a real need for free, anonymous speech will have a myriad of other, simpler, and very likely cheaper avenues available to them -- including, unfortunately, sending 9999 forged, unsolicited emails each & every day.

US Senate Approves Bill to Dramatically Improve Cyber-Crime Laws

The Washington Post reports that the U.S. Senate has passed legislation that would allow law enforcement to go after a much larger percentage of modern online crime. Specifically, it will:

• remove the requirement that each affected individual must have suffered at least $5,000 in damages
• "make it a felony to install spyware or keystroke-monitoring programs on 10 or more computers regardless of the amount of damage caused"
• give identity theft victims the ability to seek restitution
• criminalize attempts to extort companies by threatening to publish stolen information

These provisions were added to an unrelated bill, the Former Vice President Protection Act, which must next be voted on by the House of Representatives before it becomes law. CAUCE is very pleased that the Senate has taken this action to protect people living within the United States, and particularly support the provisions adding a private right of action against the criminals who prey upon all of us daily.

Eddie Davidson

When doing a job that you love it is natural enough to immerse oneself, to become somewhat myopic, about the relative importance and meaning of one's work, but every once in a while context is thrust forward, rending fantasy and reverie aside, leaving one faced with a reality of what really matters.

Such are the sad events surrounding the murder-suicide that ended convicted spammer Eddie Davidson's life today. For further details on the situation, please follow this link.

CAUCE extends our sympathies to the friends and families of the victims of this needless tragedy.

Changes to the CAUCE North America Leadership

It is with regret that we note that CAUCE founder Scott Hazen Mueller has resigned his position as President of CAUCE North America. We are happy to note Scott will maintain his position on the iCAUCE (international CAUCE) board, as well as the CAUCE North America board in the position of Founder and Director, emeritus.

As well, while John Levine plans to move to England in the early fall, he has agreed to remain on the executive board and he will become President effective immediately.

Lastly, Dennis Dayman has graciously accepted the position of Secretary-Treasurer and was confirmed as such by unanimous vote. Congratulations, Dennis, and thank you Scott for your years of service.