‘Incompetent’ FCC Fiddles With Data Breach Rules – Source: securityboulevard.com

The FCC is telling telcos to tell them about data breaches. And to tell customers. And … errr … that’s it. No hefty fines, no must-do-better, no nothing.

Commission head Jessica Rosenworcel (pictured) is putting a brave face on it. In today’s SB Blogwatch, we resign ourselves to more of the same.

Your humble blogwatcher curated these bloggy bits for your enter­tainment. Not to mention: Don’t Tell Texas.

“Criminals”

Along with requiring that attacks are reported to the FCC within seven days of a telco discovering them, the same deadline now exists to report any data leaks to the FBI and US Secret Service. [It] also eliminates the mandatory seven-day waiting period for reporting break-ins to consumers: The FCC now “requires carriers to notify customers of breaches of covered data without unreasonable delay … and in no case more than 30 days following reasonable determination of a breach.”

…

The FCC has additionally extended the scope of data exposure types that telecom customers must be notified of: … Starting now, names, government ID numbers, data used for authentication purposes, email addresses/passwords and biometric data is all included in the FCC’s reporting requirements. Dissociated data, if linkable to an individual using other data criminals accessed during a break-in, has to be reported as well. [It] also expands the FCC’s definition of “breach” to include “inadvertent access, use or disclosure of customer information.”

“Scammers and phishers”

In this Order, the Commission adopts several proposals … to modernize its data breach requirements. … The Commission finds that these changes will better protect consumers … and harmonize its rules with new approaches to protecting the public already deployed by the Commission’s partners in Federal and State government. … These rules fall comfortably within the Commission’s statutory authority.

…

Carriers possess proprietary information of customers, … which customers have an interest in protecting from public exposure. … The Commission believes that the unauthorized exposure of sensitive personal information that the carrier has received from the customer … or about the customer … such as social security numbers or financial records, is reasonably likely to pose risk of customer harm. … Consumers expect that they will be notified of substantial breaches that endanger their privacy.

…

Any exposure of customer data can risk harming consumers, regardless of whether the exposure was intentional. … Inadvertent exposure of customer information can result in the loss and misuse of sensitive information by scammers and phishers, and trigger a need to inform the affected individuals so that they can take appropriate steps.

Yeah, that’ll teach them. Now they have to tell you when they utterly fail to protect you.

…

Such a tough FCC. I will say that Jessica Rosenworcel is an angel compared to Ajit “Screw Consumers” … Pai. I miss that guy like a hemorrhoid. I’m sure he’s enjoying his job as a partner at the private-equity firm … where he is now seeking to [exploit] failures he was largely responsible for.

…

It’s amazing. The FCC seems to be either very bad at their job or completely 0wn3d by the revolving door of private industry.

They’ll just pay the fine. Telcos are … always willing to waste customer money paying fines instead of playing by rules.

…

Expect the next discovered breach to be reported a few months after it happens, as said telco looks for a big news story to try to hide the event under.

I just assume that it is just constantly being stolen from everyone who collects it at this point: … If your information can be stolen from a company like Equifax … I don’t have a lot of faith in corporate data security.

There is one answer to if telco have leaked everyone’s data: … Yes. Maybe some care how many times—if so: Many.

…

The FCC is … full of incompetent jacket fillers. They … allow number spoofing, which is literally enabling criminals to pretend to be anyone.

One major problem is that PII/Personal info is uselessly broad. Legislation like this would be much more useful if it had clear rules or fines for various levels of PII.

For example, getting your social security number stolen is significantly worse than a stolen e-mail address or phone number. All the notifications about e-mail being “stolen” are just noise.

Hello $USER,

We regret to inform you that your personal info has once again been stolen during the last 29 days. All of your data was compromised, and we are working hard to ensure the next notification 29 days from now will not be sent out.

This mandatory notification has been sent as per the FCC mandates.

Regards, $TELCO.

Recent Articles By Author