Obama to beef up laws on privacy and data breaches
bbc.co.uk
bbc.co.uk
What, we will know when the NSA grabbed our data, then? Too good to be true...
"In this case, no 'personal' information was lost at all, because after 30 days, all of the data had been effectively made public." - NSA
The NSA is a threat to Americans just as much as anyone else.
A hacker can steal my identity and drain my bank account.I can survive that, and I can defend myself by being careful.
The NSA can arrange to have me blackmailed, my reputation destroyed, or even killed, and they are confirmed to do this to people in an industrial fashion.
Imagine the private criminal opportunities that will become available to the NSA after 20 years of Moore's Law and bulk data collection.
That's a big assumption considering you're talking about an agency which openly flaunts the law or lobbies it out of existence as needed (thereby showing very little respect for the rule of law) and whose individual agents have shown very variable levels of judgement in the use of those systems (e.g. the LOVEINT stuff).
On the contrary, I think that once that data is in the possession of a large amorphous non-accountable organisation with relatively few checks and balances, it is inevitable that said data will end up on the black market. Why wouldn't it? There's money to be made.
> If your Whatsapp or Google Hangouts has a deliberately introduced flaw in it, then foreign spies, criminals, crooked police (like those who fed sensitive information to the tabloids who were implicated in the hacking scandal -- and like the high-level police who secretly worked for organised crime for years), and criminals will eventually discover this vulnerability.
The police, the NSA, etc, cannot be trusted not to misuse information which they obtain. In fact, you can quite reliably trust them to misuse that information, if history is any guide (and it is).
Whether the misuse will include actually boldly grabbing some private information that's currently valuable and selling it on Evolution or Silkroute 3 or whatever, is a purely academic question. If the information is on NSA servers, and is valuable, and someone at the NSA knows about it, it probably will be misused in some way.
If he really cared about privacy he'd at least try to reform the ECPA.
I think we've entered the age where we can no longer ignore our national IT infrastructure shortcomings. As someone who has had more than a few sysadmin jobs, and at a couple places you've heard of, its incredible how little security matters, how poorly software is written, how few developers can write secure code, and how management can force IT to make boneheaded implementations that bite everyone in the ass later.
I would love to see a HIPAA-type regulation for all businesses, encryption everywhere, force change of default credentials, etc. The wild west days of the internet need to come to an end.
I'd rather not be subjected to (and pay for) more security theater, or see every small business out there drown in a paper mill suitable for the fortune 500s.
We are already liable for any gross misconduct.
Do you honestly think the EU privacy laws that we don't have in the US aren't doing anything?
Its incredible how the anti-regulation types think everything is fine and that no regulation has ever worked.
Regulation is a weapon to be used by powerful interests to bash competitors. For example, utilities love regulation as it gives them a de-factor monopoly and predictable income.
The medical industry widely ignores HIPAA in a holistic way. Ask any practice you visit about their handling of medical records, IT security practices, etc. Heck, ask them if they still use Windows XP.
This is kind of nonsense argument, because most utilities are monopolies by design. The idea is to give utilities a predictable income stream in return for agreeing to abide by certain public interest policies.
Models of efficiency, they are not, to the point that their inefficiency severely hinders their ability to serve "the public interest." They also tend to use their size to squash any potential competitors in their space (see power companies with private solar and the telecom industry versus VOIP).
Again, that's by design. The public authority sets rates at some fixed cost plus reasonable rate of return on capital. The idea is to encourage potentially very expensive capital investment without the perceived danger of subjecting a critical utility to the ups and downs of market pricing.
And utilities act to squash competitors because lack of competition is the whole quid-pro-quo of being a utility. Utilities don't make Twitter-like 30% margins with double-digit growth. The reason private capital is willing to sink money into them is that they get their consistent 10-15% return on a regular basis. Competitors not only upset the arrangement, they can quickly jeopardize that margin.
I'm not defending regulated utilities. I think they're mostly a bad idea, but judging by the discussions around here where people talk about the wonderfulness of water utilities, lots of people are on board with sanctioned monopolies with guaranteed rates of return. But the flaws you're pointing to aren't "abuses of regulation"--they're a conscious bargain between municipalities and utilities.
Quite possibly; the privacy and security portions of HIPAA were included to mitigate the risks associated with the push for electronic systems and standardized data that were more central to HIPAA -- and the enhanced privacy and security features added later in amendments to HIPAA were furthering that in the context of increased standardization and automation that was being promoted in the same legislation; without HIPAA, you might not have as much formal protection of patient data, but you also might have a lot less data in forms that were easy to compromise en masse in the first place.
(Of course, that would also have consequences for administrative efficiency and quality of care, and without HIPAA and the related subsequent acts that included those patient protections as mitigations to potential negative effects of their primary functions, the US might have the least efficient health care system in the developed world by an even larger margin than it currently does, which, even if HIPAA does net some increased risk to patient information, might not be worth the cost.)
One of the sources of a push for federal standards is frustration with multiple conflicting state standards doing the same thing.
If sweeping regulations do come along, I hope there's a strong push for them to be loose or amiable enough to avoid these problems. For now, though, I'm skeptical.
The best argument I've heard, that I agree with in a way, is that we should first focus on fixing our broken pre-college school system. I don't see why we couldn't do both at the same time but if we're forced to pick one or the other I'd agree that that is probably of greater importance. Though that's a separate debate :)
Just remember that I don't have kids in school nor in college, and taking my money to pay for more unfireable teachers is not "fixing".
I could also argue that if 4 year colleges have even in part become so expensive because of all the subsidized money available that bringing subsidized money to the community college will have an "unexpected result" so expected that one could hardly call it "unexpected" anymore.
Why else would he be floating proposals he knows can never pass, except to be winning cheap gains from the suckers who don't see it for what it is? A president proposing a huge program like free college for everyone without controlling Congress is basically talking to a wall.
Obama is trying to help the Democratic party with its stagnant voter base problem. The people who would regularly vote Democrat have moved far to the left of the Democratic mainline and are tired of seeing nothing come out of the Democratic party, meaning that they no longer have any motivation to vote for Democrats-- not to say they are voting for Republicans either.
Sure, you're going to say Obamacare came out of the Democracts-- but the left leaning segment of the Democratic base didn't want Obamacare, they wanted single payer, and Obamacare fell horrendously short of that. This election was a wakeup call for the Democrats, and indicated to them that they have lost their base to the more radical members of their party like Elizabeth Warren.
Thus, we see the Democrats attempt to show people that they still have big ideas, because they are incapable of showing people that they have big actions.
But good legislation does not just magically appear in Congress. Many government programs got a big boost from the President "calling for them"--national parks, for example, or the moon landings. These were not new ideas when Roosevelt or Kennedy spoke about them, but speaking about them helped generate the public momentum for Congress to act.
The U.S. was the first nation in the world to provide free, publicly funded education through high school. It was implemented locally, but it was an idea that was discussed and promoted nationally. The idea of free education is a powerful one in the U.S. culture.
And many community colleges are already heavily funded by state and local governments; making them totally free might not be as big a step as it seems on paper.
Policy change can be sudden and radical, but durable shifts in political priorities often start with legislative proposals, which build support for the idea in the public consciousness, which translate into pressure on elected politicians, which turn into policies -- maybe not this year, and maybe not until after several election cycles.
But if you never propose anything that won't pass today, you never move things in the direction you prefer.
I hate headlines like this. The President is a figurehead. He can't really do anything (shy of directing federal agencies not to enforce certain laws) without Congressional action.
Admittedly, the next guy can just come in and get rid of those orders, but it's not like he can't do anything.
It's also powerful if the President says, "All federal agencies are no longer allowed to use Google or Microsoft until they comply with these new privacy standards."
>Another will attempt to give people more control over what can be done with the data companies gather about them.
Key word is attempt. One can be sure Google and friends will be lobbying hard for no such control, and if something does perchance pass, it won't be for years whatever it is is implemented and will be purposely difficult to reach.
Companies should be held accountable for the data they collect and how it is used. Most TOS are unconscionable. I'm sure some of the folks here read the entire TOS of every web service they use, but I've never met a person in real life who does. I think a framework for TOS that is basically just a check box "Do you collect: A, B, C" "Do you distribute: X, Y, Z" could be really useful. There could be some pretty cool strategies between web sites and browsers to help users determine what the site is doing and whether they want to proceed.
This is a time for a dialogue that builds a working framework, not a burst of legislation that pacifies the public and accomplishes at best a couple of short term goals.
Legislative proposals are part of dialogue. You can talk all day about generalities and get nowhere, having specific proposals to discuss -- and either criticize or propose alternatives to -- is what moves the dialogue forward.
If you read even the news articles on this particular proposal you'd see that's not the case:
(1) There are people who are simply set against regulation, (2) There are people who believe regulation is necessary, and favor the status quo of state-by-state regulation without federal regulation, (3) There are people who believe regulation is necessary, see value in federal regulation, but are concerned that federal regulation may be counterproductive if it fails to be as good as some of the existing state regulations and preempts them, (4) There are people who believe regulation is necessary, but that patchwork state-by-state regulation is itself counterproductive, so that it is important that consistent regulation be adopted at the federal level.
And there are fairly sophisticated arguments for all those positions.
> I think that a long drawn-out discussion among professionals would be more effective (if slower than) sound-byte politics.
This proposal is one of the products of the decades-long drawn-out discussion among professionals (and others) that have been going on about this issue (which has intensified in the last 1-2 decades with the growth of online commerce, but started long before that.)
The President of the United States is not able to 'beef up' federal laws; he can execute the ones that exist and call for new ones to be passed.
Moreover, my concern is that these laws will give government even more oversight into the management of user data, and therefore the data itself, in order to enforce the laws.
It's the enforcing of those laws that's currently lacking, and I don't see this fixing that at all.