Researchers Say Notification Laws Not Lowering ID Theft IDG News Service (06/05/08) McMillan, Robert
as it appeared in the June 16, 2008edition of ACM TechNews.
The adoption of data breach notification laws by all but seven U.S. states has done little to stem the tide of identity theft, according to a state-by-state analysis by Carnegie Mellon University researchers of data provided by the U.S. Federal Trade Commission. The analysis, which covered ID theft complaints submitted to the FTC between 2002 and 2006, looked for a change in the rate of reported ID thefts before and after data breach ordinances were enacted. Though Carnegie Mellon Ph.D student Sasha Romanosky says the laws had no statistically significant effect on ID theft rates, other factors, such as state populations, gross domestic product, and fraud rate, did have a noticeable impact. Breach notification letters are often disregarded by consumers, and Romanosky thinks security firms' data protection efforts are still insufficient. "In so many of these cases, the breaches occur because of ridiculous security practices," he says. Gartner analyst Avivah Litan says the incompleteness of the reports to the FTC makes drawing definite conclusions from the data difficult, but she notes that many companies have responded to tighter laws and regulations by devoting more attention to compliance than security, which is frequently inadequate for shielding customers from ID theft. In a paper to be presented at Dartmouth College's Information Security Economics conference, the Carnegie Mellon researchers recommend the adoption by the federal government of a unified breach law designed to "reduce conflict between states laws and lower the barrier for compliance." Click Here to View Full Article
