Specter-Leahy Data Security Bill

<p>If I were more informed on the matter, i would offer my analysis or opinion, but at this point I am not, however i think this email fwdd by a [l:http://fen.net|coworker (Fen)] seems pretty on point.</p> <p>From Fen:<br /> <cite><br /> I've included some of my commentary on the bottom, sent earlier to the Identity Commons Developers list.<br /> </cite><br /> ——– Original Message ——–<br /> Date: Thu, 30 Jun 2005 01:13:55 -0400 From: Declan McCullagh [Politech] Preliminary analysis of new Specter-Leahy data security bill: opinions? [priv]</p> <p>It's worth taking a close look at the new Specter-Leahy security breach bill — introduced Wednesday — because it's the most comprehensive so far and the leading candidate to be enacted into law this year. It's even, at least in theory, going to be voted on in the Senate Judiciary committee on Thursday: <a href="http://judiciary.senate.gov/meeting_notice.cfm?id=1555" title="http://judiciary.senate.gov/meeting_notice.cfm?id=1555">http://judiciary.senate.gov/meeting_notice.cfm?id=1555</a></p> <p>The sections dealing with government use of databases seem generally useful (though some loopholes exist, like the requirement that a database is "primarily" of Americans before its use is covered — look for the FBI to start inserting random Mexican names to get around the "primarily" requirement). So let's look at the private sector components.</p> <p>Bear with me as we get a little technical here…</p> <p>Title III of the bill erects a complex regulatory scheme around any "data broker." That's defined as a "business entity" that it's in the regular business of "collecting, transmitting, or otherwise providing personally identifiable information" of 5,000 or more people that are not "customers" or "employees." Business entity is defined as any organization, including a sole proprietorship, that's in the business of making money, or a non-profit group that isn't.</p> <p>Well, Politech is a sole proprietorship — I have some Google text ads on politechbot.com that make a princely $10-$15 or so a month. If they made more I wouldn't complain. And I'm pleased to say that the list includes over 5,000 subscribers.</p> <p>Do I "collect[]" personal information? 18 USC 1028(d)(7) defines that as "any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual." Mailman gives subscribers the option of typing in their name, and obviously I have everyone's email addresses. 18 USC 1028(d)(7)(C) explicitly includes any "unique electronic identification number, address, or routing code" so that seems to cover e-mail.</p> <p>So that makes me a highly-regulated "data broker" unless I can skate on some other technicality. Again, I'm arguably in the business of regularly "collecting" information from people are aren't "customers" — you don't buy anything from me. Let's assume I can't escape the rule and continue this walk-through.</p> <p>If I am indeed a data broker, what must I do?</p> <p>* "Clearly and accurately" disclose all relevant "personal electronic records" (maintained for disclosure to third parties) about an individual if he or she asks me. * "Develop and publish" a set of "procedures for correcting inaccurate information." * Offer to "investigate" "free of charge" any discrepancies. * Provide an opportunity to insert a "100 word" notice of any dispute.</p> <p>If I don't, I can be sued and fined $1,000-$2,000 per violation per day.</p> <p>Title IV of the bill is far more exhausting. Any "business entity" (that term again) including a sole proprietorship that collects, accesses, transmits, stores, or disposes of personal info in digital form on over 10,000 U.S. persons must create a "data privacy and security program."</p> <p>Well, there are over 10,000 Politech subscribers, and that's an even broader definition (no requirement that it be limited to non-customers or that the involvement be regular). So I'm likely covered. If that happens, I must:</p> <p>* "Implement a comprehensive personal data privacy and security program" * Create a "risk assessment" to "identify reasonably foreseeable" vulnerabilities * "Assess the likelihood" of security breaches * "Assess the sufficiency" of my policies to protect against them * Protect information by encrypting it * Publish the "terms of such program" * Do "regular testing of key controls" to test security * Select only superior "service providers" after doing "due diligence" * Regularly "monitor, evaluate, and adjust" my security policies</p> <p>If I don't, I can be fined up to $10,000 a day per violation.</p> <p>Oh, and there's Title IV Subtitle B. It's pretty much the same definition, and requires me to:</p> <p>* In the case of a security breach of the Politech subscriber list, I must notify the U.S. Secret Service and the state attorney general. * And I must notify individual subscribers * And I must notify consumer reporting agencies * For individual subscribers, I must notify via physical mail to home address, or if I can't, via telephone call to your home. There's no provision for e-mail contact. But if I don't follow that procedures I violate the law. * I also must post this notice publicly on the Web and notify "major media outlets"</p> <p>If I don't follow those rules, I can be fined up to $10,000 a day per violation — and if I "willfully" conceal the security breach, I can be fined something like $250,000 and be imprisoned for up to five years.</p> <p>I recognize that senators Specter and Leahy are trying to target ChoicePoint and Acxiom and so on. But their bill, as written, does not appear to be written to include just those data warehouses. And given that they've had months and (presumably) very bright people drafting it, that makes me worried.</p> <p>In fact, the definitions could cover, for instance, news organizations (many news sites arguably provide personal information on thousands of people, and People magazine's Web site certainly does). How about popular blogs that have thousands of registered users? Search engines? Google's phone number finding service? Libraries? Email service providers? Alumni organizations for schools? Charities, like Golden Gate National Parks Association? What about universities, especially in terms of all the applications they get? Sweepstakes companies? I wonder if probable supporters of this bill — like the ACLU and EPIC — would enjoy having to follow all these complicated procedures (with the penalty of fines or prison terms if they don't).</p> <p>I admit this is just my preliminary reading, but my sense is that these requirements will end up being another version of Sarbanes-Oxley, with the same destructive, wealth-eroding implications: <a href="http://www.politechbot.com/2005/06/16/richard-rahn-on/" title="http://www.politechbot.com/2005/06/16/richard-rahn-on/">http://www.politechbot.com/2005/06/16/richard-rahn-on/</a></p> <p>Perhaps I'm wrong. I'd welcome responses (and "don't worry, trust prosecutors' discretion" is not a useful one). If I'm right, how much harm will be done in the name of "protecting privacy?"</p> <p>-Declan</p> <p>—</p> <p>News article: <a href="http://news.com.com/2100-7348_3-5769156.html" title="http://news.com.com/2100-7348_3-5769156.html">http://news.com.com/2100-7348_3-5769156.html</a></p> <p>Text of legislation (Leahy's floor statement is below): <a href="http://i.i.com.com/cnwk.1d/pdf/ne/2005/Specter-Leahy.pdf" title="http://i.i.com.com/cnwk.1d/pdf/ne/2005/Specter-Leahy.pdf">http://i.i.com.com/cnwk.1d/pdf/ne/2005/Specter-Leahy.pdf</a></p> <p>Additional background material: <a href="http://www.politechbot.com/docs/leahy.floor.statement.062905.txt" title="http://www.politechbot.com/docs/leahy.floor.statement.062905.txt">http://www.politechbot.com/docs/leahy.floor.statement.062905.txt</a> <a href="http://www.politechbot.com/docs/specter.leahy.sections.062905.doc" title="http://www.politechbot.com/docs/specter.leahy.sections.062905.doc">http://www.politechbot.com/docs/specter.leahy.sections.062905.doc</a> <a href="http://www.politechbot.com/docs/specter.leahy.summary.062905.doc" title="http://www.politechbot.com/docs/specter.leahy.summary.062905.doc">http://www.politechbot.com/docs/specter.leahy.summary.062905.doc</a> _______________________________________________ Politech mailing list Archived at <a href="http://www.politechbot.com/" title="http://www.politechbot.com/">http://www.politechbot.com/</a> Moderated by Declan McCullagh (<a href="http://www.mccullagh.org/" title="http://www.mccullagh.org/">http://www.mccullagh.org/</a>)</p> <p>Fen's Identity-broker focused commentary:</p> <p>I am reminded here of how the government of Holland dealt with increasing pollution from some of their largest businesses. They didn't want to create new laws, as they understood the difficulties of enforcement (not to mention that they just didn't like creating new laws). So they voted to provide government funds to simply advertise the level of pollution being created by each company highlighting what the company was doing to correct the problem. The skies quickly got clearer.</p> <p>It's too bad that the U.S. government doesn't see an opportunity here for them to be a reputation broker, a "privacy seal" that people can check before doing business with a company. One of the goals of OpenPrivacy is to allow any sort of organization with any sort of privacy practices – or not – to interact with the system. The key was that the system itself was designed to make interactions open (even if not traceable) so that users would have a clear view into how orgs handled their data and could then make informed decisions as to who they chose to trust. And there could be many "reputation brokers" each with its own reputation, so you could even have help in making such decisions.</p> <p>But to build such a system on a national scale would require tens of millions of dollars – maybe even a billion – invested into open technologies that no one could benefit from *directly* – only indirectly by providing quality services. And that appears not to be the government's business.</p>