Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

There Ought to Be a Law

Even with Congressional shakeup, experts don't expect any fast moves on compliance or computer crime law

Everybody's talking about profound changes in Congress this week -- everybody except experts in computer security law, that is.

They claim the landmark shift in party control of both houses of Congress may reorder the country's legislative agenda next year, but laws on data breach notification and identity theft probably still won't be at the top of the list.

"I don't see security being on anybody's list for the first 100 days," says Marne Gordan, director of regulatory affairs at Cybertrust. "Even with the Democrats in office, it's still not a sexy issue."

More than a dozen bills have been proposed on the topics of data breach notification and identity fraud during the 109th Congress, which will complete its session next month. So far, none has made it out of committee, and experts don't expect any action before the new Congress convenes.

But legal experts say there remains a strong need for a federal law that would add teeth to a patchwork of state laws that outline a company's responsibility for disclosing potential breaches in data security.

"The country, businesses, and consumers need a law that will set expectation levels across the country regarding what constitutes a data breach and how companies must react," says Chris Pierson, founder of the cybersecurity and cyberliability practice at Lewis and Roca LLP, a Phoenix law firm. "More importantly, they need safe harbor provisions that will entice corporations to add additional layers of protection to better secure data."

So far, computer security legislation has not been a partisan issue, as representatives from both parties have proposed legislation. However, the shift toward the Democrats could favor bills proposed previously by Sen. Dianne Feinstein (D-Calif.) and Sen. Patrick Leahy (D-Vt.), Gordan suggested.

"We won't know for sure until we see the new Congress' legislative agenda, but it doesn't look like things will change radically," Gordan says. "A lot of the committee leadership will stay the same." Democrats and Republicans generally agree that there should be a law on breach notification, but they haven't come up with a unified plan on how to enforce it, she observes.

  • And what about regulatory compliance issues, such as Sarbanes-Oxley and HIPAA? The new Congress probably will not tighten or loosen the auditing procedure, experts say.

    "Many of the agencies that are responsible for enforcement of these laws have not historically been adequately funded, and I hope that changes," Pierson says. "But I do not believe this is necessarily predicated on what political party controls Congress -- it is more linked to budgetary and personnel constraints overall."

    And as Congress attempts to gain greater control on spending, there likely will not be much new money for compliance auditing or other law enforcement efforts related to computer security, experts say.

    Until enforcement gets tougher, many of the compliance mandates will continue to be paper tigers, Pierson says. "The most notable illustration is HIPAA, which after ten years has seen only one federal criminal prosecution."

    Gordan agrees. "At this point, a lot of companies would rather take a chance on paying a penalty than on investing all the time and money required to come into compliance," she notes. "That's not going to change until the punishments get stiffer, and that's probably not going to happen anytime soon."

    — Tim Wilson, Site Editor, Dark Reading

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Attackers Leave Stolen Credentials Searchable on Google
    Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
    How to Better Secure Your Microsoft 365 Environment
    Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win an Amazon Gift Card! Click Here
    Latest Comment: We need more votes, check the obituaries.
    Current Issue
    2020: The Year in Security
    Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
    Flash Poll
    Assessing Cybersecurity Risk in Today's Enterprises
    Assessing Cybersecurity Risk in Today's Enterprises
    COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2021-1070
    PUBLISHED: 2021-01-26
    NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, L4T versions prior to 32.5, contains a vulnerability in the apply_binaries.sh script used to install NVIDIA components into the root file system image, in which improper access control is applied, which may lead to an un...
    CVE-2021-1071
    PUBLISHED: 2021-01-26
    NVIDIA Tegra kernel in Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, all L4T versions prior to r32.5, contains a vulnerability in the INA3221 driver in which improper access control may lead to unauthorized users gaining access to system power usage data, which may lead to...
    CVE-2020-23774
    PUBLISHED: 2021-01-26
    A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed.
    CVE-2020-23776
    PUBLISHED: 2021-01-26
    A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' value to cause the server to send the request.
    CVE-2021-3309
    PUBLISHED: 2021-01-26
    packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,