February 14, 2006 5:29 PM PST
Judge: Firm not negligent in failure to encrypt data
- Related Stories
-
Bots may get cloak of encryption
November 14, 2005 -
Ellison: Encryption is key to data protection
September 23, 2005 -
Researchers: Digital encryption standard flawed
February 16, 2005 -
Saluting the data encryption legacy
September 27, 2004 -
High hopes for unscrambling the vote
June 8, 2004 -
Quantum encryption inches closer to reality
May 3, 2004 -
VoIP provider to block eavesdroppers
March 30, 2004 -
Former FBI chief takes on encryption
October 14, 2002
Stacy Lawton Guin, a customer of Brazos Higher Education Service, sued the corporation on the grounds that encryption should be used as a routine security precaution.
But U.S. District Judge Richard Kyle in Minnesota dismissed the case last week, saying Brazos had a written security policy and other "proper safeguards" for customers' information and that it acted "with reasonable care" even without encrypting the database.
ID fraud help
Identity fraud isn't that likely to happen to you, but it does occur. CNET News.com has compiled a resource center with background information, statistics, and tips. A recent debit-card theft case has also drawn attention, and in response we've created a list of frequently-asked questions. Security protection is also being discussed at this week's RSA Conference.
The case arose as a result of a burglary at the Silver Spring, Md., home of John Wright, a Brazos financial analyst who worked remotely and analyzed loan portfolios. During that September 2004 burglary, a laptop with personal information about Brazos customers was stolen.
Brazos hired a private investigative firm, Global Options, to recover the laptop, but this was unsuccessful. The judge noted that there was no evidence that the database on the stolen laptop was used for identity fraud. After the theft, Brazos contacted approximately 550,000 of its customers to let them know of the situation and to suggest they place a security alert on their credit bureau files.
Even though he had not actually been harmed as a result of the theft, Guin argued, Brazos was required by the Gramm-Leach-Bliley Act to encrypt personal information and limit its disclosure. The 1999 law requires financial service companies "to protect the security and confidentiality of customers' nonpublic personal information."
Judge Kyle disagreed, saying that the house was in a relatively low-crime neighborhood and that the law does not specifically mandate encryption. "The GLB Act does not prohibit someone from working with sensitive data on a laptop computer in a home office," Kyle wrote. "Despite Guin's persistent argument that any nonpublic personal information stored on a laptop computer should be encrypted, the GLB Act does not contain any such requirement."
See more CNET content tagged:
Gramm-Leach-Bliley Act,
identity fraud,
personal information,
Judge,
laptop computer
some basic security precautions such as encryption. If I
understand correctly, this judge is saying that since no harm was
done, the company did no wrong. This is negligence at it's best.
What about online? Is there a low crime network that you shouldn't have your stuff safeguarded?
The judge mentions the factors as being, one, a low crime-rate neighborhood, and, two, no specificity in the law, itself, requiring encryption.
So what twisted logic gives you the idea that 'what he's saying" is about actual damages as a prerequisite to going to Court there buddy? Misconstruing arcane laegalese is one thing, but fabrication is something else, no?
Security is never absolute. The fact that something bad happened does not, itself, imply negligence. The fact that further safeguards could have been taken that would have protected against a specific threat does not, itself, imply negligence.