Banking Law

Businesses Blow Off Information Security Breaches?

The Wall Street Journal's Business Technology blog had an eye-opening post the other day about the rapid pace of data breaches, and, more surprising, the alleged reason for the increase in breaches.

U.S. businesses reached an ignominious milestone in August, when the number of data breaches disclosed publicly for the first eight months of 2008 already surpassed the total number of disclosed breaches for all of last year.

There were 449 publicly disclosed security breaches as of Aug. 22, compared with a 446 total in 2007, according to Identity Theft Resource Center, a San Diego nonprofit organization for victims of identity theft. The reasons why businesses struggle keeping customer or employee data secure are many: Cyber criminals are adopting more sophisticated techniques for breaking into businesses; businesses are creating, storing, and sharing more data than ever before; and employees don?t understand the value of the data that they work with or the myriad ways the data could fall into the wrong hands.

[...]

The real reason that data breaches are on the rise is that businesses don?t have a real incentive to invest more than the minimum required in security, says Bruce Schneier, chief security technology officer at BT Group.

?For the most part a company doesn?t lose its data, they lose your data,? Schneier tells the Business Technology Blog. Consequently, the entity responsible for the breach isn?t the party that is harmed by it. Victims are upset, but they are more likely to learn about the fraud that is committed in their name?not the breach where a criminal obtained the data. They are often powerless to punish the business that exposed the record because they can?t link the fraud to a cause, says Schneier.

All those state laws that require businesses to notify customers of data breaches (44 states, according to the Business Technology Blog) aren't causing a corresponding decrease in data breaches because, a Carnegie Mellon University study concludes. There are various reasons for that.

There are potential loopholes: Sometimes only businesses in certain industries must disclose a breach; or the breach may only have to be disclosed if a business suspects that the information will be used to commit fraud. Also, aside from potentially negative publicity, businesses are rarely penalized for a breach as long as it is disclosed.

The penalties provided under state law are also, in many cases, less than the cost to fully investigate and report. Thus, according to some studies, many breaches are not being reported, notwithstanding the requirements of the law.

The article does not address whether banks were included within the studies. Given the information security requirements of the federal banking agencies, which include a requirement that banks who suffer a breach notify their primary regulator, and also notify the affected customers where the misuse of customer information has occurred or is reasonably possible, I'd doubt that they were included. On the other hand, a "loophole" that requires notification where the information has been or likely will be misused seems reasonable. This "risk-based" approach is part of the federal scheme for banks, and prevents needlessly causing expense and alarming customers.

I agree that if businesses are blowing off their legal responsibilities, they ought to suffer sufficient penalties to give them an incentive to comply. However, those legal responsibilities ought not to impose an obligation to notify customers of a breach that is not likely to cause the customer any harm. Not only does that require the needless expenditure of time and money, but it runs the risk of creating a "Chicken Little" syndrome where customers start ignoring notices of data breaches. You know, just as most of do when we receive those annual privacy notices that few of us open, much less read.

Full post as published by Bank Lawyers Blog on September 11, 2008 (boomark / email).