U.K. commissioner blames CEOs for data breaches
301690
"How can laptops holding details of customer accounts be used away from the office without strong encryption?" Richard Thomas scolds.
687434
Europe's top data protection official criticized plans for air passenger records like those gathered by U.S. authorities.
693907
Data on 37 million Brits mislaid Last year was the worst ever for data losses in the UK, with almost 37 million people having their private data compromised.â¦
259113
U.S. congressional subcommittee investigating cybersecurity at the DHS attacked the agency's CIO for lack of leadership.
683223
The nation's top securities watchdog yesterday mounted a forceful defense of the government's ongoing crackdown on corporate fraud, amid industry complaints that authorities are overreaching in their drive to police misconduct on Wall Street.
679082
Experts are concerned that data may not being properly protected by the IRS and that a massive data loss by the agency, similar to the one last month by the U.K.'s Revenue and Customs office, could disrupt the nation's banking system.
448646
Disclosures by Hewlett-Packard Co. chief executive Mark V. Hurd that he failed to read a report addressed to him about the company's spying investigation are prompting governance experts to ask why the company board yesterday handed Hurd more responsibility.
663322
(InfoWorld) - In an advance copy of his Congressional testimony released by a House Subcommittee on Wednesday, Hewlett-Packard chief executive officer (CEO) Mark Hurd blamed the scandal that has besieged his company on "a rogue investigation" that got out of hand. "How did such an abuse of privacy occur in a company renowned for its privacy? The end came to justify the means," Hurd wrote. "The investigation team became so focused on finding the source of the leaks that they lost sight of the privacy of reporters and others. They lost sight of the values HP has always represented." Former HP Chairman Patricia Dunn , forced to resign Sept. 21 because ofÂ the scandal,Â defended in her testimony her decision to investigate the leaks of confidential board discussions to the news media. Both are among several witnesses expected at a hearing before the Oversight and Investigations Subcommittee of the House Energy and Commerce Committee on Thursday in Washington. The committee is looking into the practice of "pretexting," or using false pretenses to gain access to confidential records. Investigators hired by HP to find the source of leaks engaged in pretexting to get hold of the phone records of directors, HP employees and reporters who cover the Palo Alto, California, technology company. Although much of the criticism of the scandal surrounds the tactics used by the investigators, Dunn wrote in her testimony that equal consideration should be given to the leaks from within the company that damaged HP. HP's board was notorious for its leaks to news media and that such disclosures made it difficult for the board to deal with important issues candidly, she wrote. "I wish fervently that none of this had ever happened," Dunn wrote in her testimony. "But boards have an unquestionable obligation to take steps to prevent [leaks]. That certain steps taken during the investigation went well beyond what was appropriate does not undermine the importance of the board's mission in this matter."ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
533205
With the EU crafting new laws governing how data collectors such as Google protect users' personal data, lawmakers there are clashing with US business leaders over how far that protection can and should extend.
648691
Information commissioner lectures public bodies to take digital privacy 'far more seriously'
367998
(InfoWorld) - Most large data breaches don't appear to lead to identity theft, and proposals that would require companies to notify customers of most breaches may lead to increased costs without significant benefits, says a report from a U.S. government agency released Thursday. The report, from the U.S. Government Accountability Office (GAO), said only four of the 24 largest data breaches between January 2000 and June 2005 appear to have resulted in identity fraud. Wide-ranging data breach notification laws that would require nearly all breaches to be reported could lead to notifications that "present little or no risk, perhaps leading consumers to disregard notices altogether," the report said. While a breach notification law would have several benefits, a law that requires notification for nearly all breaches could also create significant costs for businesses, the report added. The U.S. Congress is currently considering several breach notification bills, including some that would require notification for nearly all breaches. Instead, Congress may want to consider a notification rule based on the potential for the risk of ID theft, the report said. The U.S. President's Identity Theft Task Force has recommended a national standard for determining when government agencies and private companies should report breaches, the report pointed out. A risk-based standard "could avoid undue burden on organizations and unnecessary and counterproductive notifications of breaches that present little risk," the report said. A data breach law would create costs for businesses, including the cost of developing incident response plans and notifying customers, the report said. While it's difficult to determine costs, a Ponemon Institute study in 2006 found that 31 companies with breaches incurred an average cost of $1.4 million per breach for notifying customers, staffing call centers, paying legal fees, and other expenses, the report said. The GAO researched 24 large data breaches reported in the media between 2000 and 2005, and found that 18 of them had no ID theft or fraud identified. Three of the breaches, at CardSystems Solutions, DSW, and CD Universe, had reports of fraud associated with existing customer accounts. And a breach at ChoicePoint had reports of unauthorized new accounts opened. In the remaining two breaches, GAO was unable to determine if there had been ID fraud. It's difficult to track ID theft resulting from data breaches, the report said. In some cases, thieves don't attempt to use the data until a year or more after the breach, the report said. A breach notification law could be beneficial because it would encourage organizations to improve data security, the report said. "Care is needed in defining appropriate criteria for data breaches that merit notification," the report said. "Because breaches vary in the risk they present, and because most breaches have not resulted in detected incidents of identity theft, a notification that is risk based appears appropriate." Alan Paller, director of research at the SANS Institute, a security research and training company in Maryland, praised the report, saying some in Congress have focused too much on data breaches. Some lawmakers have "dropped the ball on the far more important area of attack-based defenses," he said. The report is important because it gives Congress more information about data breaches, added Thomas Lenard, senior fellow and acting president at the Progress and Freedom Foundation, a conservative think tank. "Itâs very good to have more data on this issue," he said. "[The report] reinforces my view that we should only adopt new regulations in this area if it can be shown that their benefits are greater than their costs."
147798
Companies disclosed a flurry of new security breaches, highlighting the need for IT managers to focus more on securing their data -- not just their corporate networks.
251253
(InfoWorld) - Executives from the financial data transfer company Swift and the president of the European Central Bank (ECB) faced tough questions in a European Parliament committee meeting Wednesday, about the illegal sharing of private data with U.S. authorities. ECB chief Jean-Claude Trichet denied that the bank should have stepped in to prevent the breach of European data protection laws, saying that the bank could only advise the Society for Worldwide Interbank Financial Telecommunication SCRL (Swift). "We have no judicial competence in the field of data protection," he said. Swift's Chief Financial Officer Francis van Bever explained that the company has two information storage facilities, one in the U.S. and the other in Holland. Each facility holds identical data: they serve as back-ups for each other in case one were to crash. "Each facility is subject to local laws," Van Bever said. "We were obliged to respond to the subpoena from the U.S. authorities." European law is unclear, he said, adding that after getting external legal advice in Belgium, Swift concluded that transferring the data to the U.S. authorities would be legal. "We didn't check with local data protection authorities because we thought what we were doing was legal," he said. U.S. agencies ordered Swift to share millions of pieces of information about people and companies from around the world in the wake of the terrorist attacks on Sept. 11, 2001. The information was deemed essential in tracing the financing of terrorism, and Swift complied with the order. However, European data protection laws forbid transfers of European citizens' personal data outside the E.U. if the country receiving the data has aÂ weaker data protection regimeÂ than Europe's. The U.S. is considered such a country under European laws. In June the New York Times revealed that Swift has been sharing the data with U.S. authorities for years, sparking investigations in Europe into how the European laws could so easily have been breached. Last week, Belgium's privacy commission concluded a two-month investigation, accusing Swift of breaking Belgian and Europe-wide data protection laws. However, it stopped short of proposing fines for the company, which it agreed was caught between conflicting legal requirements on each side of the Atlantic. Many European parliamentarians drew a parallel between the Swift case and the ongoing attempts to strike a data sharing agreement that would allow the U.S. authorities access to personal data about passengers flying to the U.S.. They were unimpressed by what more than one member of the European parliament referred to as "buck-passing" when it came to handing out responsibility for the data protection breach. Trichet tried to move the debate beyond casting blame by suggesting ways of avoiding similar problems in future. "This problem is ongoing," he said. "The system we have in place is imperfect. It is very important to clarify the situation and work out what to do about such data transfers across the Atlantic." He added that any agreement between the E.U. and the U.S. should then form the basis for a global solution, because the problem is worldwide. "We need a global legal framework for situations like this," Trichet said. Swift's van Bever agreed. "We would welcome such clarification," he said, adding that the double taxation treaty could be a role model. The treaty is signed by many countries around the world and is designed to prevent people being taxed twice on the same income by different tax authorities.
290817
Either stupid or ignorant, fumes security researcher A leading security expert has criticised the UK government for ignoring recommendations on tackling cybercrime from peers.â¦
178885
Shouldn't be added as an afterthought Government needs to make privacy and data protection principles a core component of its IT specifications, according to the assistant information commissioner.â¦
668423
During an RSA keynote, Symantec CEO John Thompson said companies need to take responsibility for maintaining customer confidence.
244272
A major mobile phone service provider and the UK's largest catalog-shopping service have both been criticized by that government's Information Commissioner's Office for privacy violations affecting employees and consumers. Critics charge that the ICO is all hat and very few cattle.