Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
There Ought to Be a Law
Even with Congressional shakeup, experts don't expect any fast moves on compliance or computer crime law
3 Min Read
Everybody's talking about profound changes in Congress this week -- everybody except experts in computer security law, that is.
They claim the landmark shift in party control of both houses of Congress may reorder the country's legislative agenda next year, but laws on data breach notification and identity theft probably still won't be at the top of the list.
"I don't see security being on anybody's list for the first 100 days," says Marne Gordan, director of regulatory affairs at Cybertrust. "Even with the Democrats in office, it's still not a sexy issue."
More than a dozen bills have been proposed on the topics of data breach notification and identity fraud during the 109th Congress, which will complete its session next month. So far, none has made it out of committee, and experts don't expect any action before the new Congress convenes.
But legal experts say there remains a strong need for a federal law that would add teeth to a patchwork of state laws that outline a company's responsibility for disclosing potential breaches in data security.
"The country, businesses, and consumers need a law that will set expectation levels across the country regarding what constitutes a data breach and how companies must react," says Chris Pierson, founder of the cybersecurity and cyberliability practice at Lewis and Roca LLP, a Phoenix law firm. "More importantly, they need safe harbor provisions that will entice corporations to add additional layers of protection to better secure data."
So far, computer security legislation has not been a partisan issue, as representatives from both parties have proposed legislation. However, the shift toward the Democrats could favor bills proposed previously by Sen. Dianne Feinstein (D-Calif.) and Sen. Patrick Leahy (D-Vt.), Gordan suggested.
"We won't know for sure until we see the new Congress' legislative agenda, but it doesn't look like things will change radically," Gordan says. "A lot of the committee leadership will stay the same." Democrats and Republicans generally agree that there should be a law on breach notification, but they haven't come up with a unified plan on how to enforce it, she observes.
And what about regulatory compliance issues, such as Sarbanes-Oxley and HIPAA? The new Congress probably will not tighten or loosen the auditing procedure, experts say.
"Many of the agencies that are responsible for enforcement of these laws have not historically been adequately funded, and I hope that changes," Pierson says. "But I do not believe this is necessarily predicated on what political party controls Congress -- it is more linked to budgetary and personnel constraints overall."
And as Congress attempts to gain greater control on spending, there likely will not be much new money for compliance auditing or other law enforcement efforts related to computer security, experts say.
Until enforcement gets tougher, many of the compliance mandates will continue to be paper tigers, Pierson says. "The most notable illustration is HIPAA, which after ten years has seen only one federal criminal prosecution."
Gordan agrees. "At this point, a lot of companies would rather take a chance on paying a penalty than on investing all the time and money required to come into compliance," she notes. "That's not going to change until the punishments get stiffer, and that's probably not going to happen anytime soon."
— Tim Wilson, Site Editor, Dark Reading
About the Author
You May Also Like
More Insights
