FTC told to disclose the data security standards it uses for breach enforcement
Administrative judge rules in favor of LabMD in long-standing dispute
Computerworld - The Federal Trade Commission (FTC) can be compelled to disclose details of the data security standards it uses to pursue enforcement action against companies that suffer data breaches, the agency's chief administrative law judge ruled Thursday.
The decision came in response to a motion filed by LabMD, a now-defunct medical laboratory that has been charged by the FTC with unfair trade practices for exposing sensitive information belonging to 10,000 patients in 2010.
LabMD has accused the FTC of holding it to data security standards that do not exist officially at the federal level. It has maintained that the agency must publicly disclose the data security standards it uses to determine whether a company has reasonable security measures in place.
The FTC argued that it should not be required to disclose the legal or other standards it uses to determine whether a company's data security practices are unfair or not under Section 5 (a) of the FTC Act.
In a six-page ruling, the FTC's chief administrative law judge, Michael Chappell, nixed that argument and held that the Commission can indeed be compelled to disclose the information in the LabMD case.
The judge held that while LabMD may not inquire about the FTC's legal standards or rationale, it has every right to know what data security standards the commission uses when pursuing enforcement action. The FTC's Bureau of Consumer Protection "shall provide deposition testimony as to what data security standards, if any, have been published by the FTC or the Bureau upon which [it] intends to rely on at trial," Chappell ruked.
The decision is a victory for the many groups that are opposed to the FTC's pursuit of companies that have suffered data breaches in recent years.
Groups like the Chamber of Commerce, TechFreedom, the American Hotel and Lodging Association, the National Federation of Independent Businesses, the International Franchise Association and Cause of Action all filed motions supporting LabMD.
The groups have accused the FTC of overstepping its authority in forcing costly consent decrees and settlements from companies that have suffered data breaches in recent years. They have claimed that the FTC's prosecution of breached entities under the unfair trade practices provision of the FTC Act is both unauthorized and illegal.
LabMD is one of two companies that have challenged the FTC lawsuits so far. The company shut down operations a few months ago, citing the cost involved in fighting the FTC complaint. The only other company to challenge the FTC in similar fashion is Wyndham Hotels.
Reed Rubinstein, senior vice president for litigation at Cause of Action, welcomed Thursday's ruling.
"It means we will have an opportunity to speak on the record with the witness from the FTC about the standards they believe were in place" at the time LabMD information was allegedly leaked.
"They have been extremely reticent about disclosing what they believe LabMD did wrong at any particular moment in time. This is an opportunity to obtain a little more specificity" about the FTC's complaint, Reed said.
The FTC did not immediately respond to a request for comment.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is firstname.lastname@example.org.
Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.
- Step Out of the Bull's-Eye Learn about the evolution of targeted attacks, the latest in security intelligence, and strategic steps to keep your business safe.
- Using Cyber Insurance and Cybercrime Data to Limit Your Business Risk This paper examines the challenges of understanding cyber risks, the importance of having the right cyber risk intelligence, and how to use this...
- 5 Tips to Secure Small Business Backdoors in the Enterprise Supply Chain This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Keep Servers Up and Running and Attackers in the Dark An SSL/TLS handshake requires at least 10 times more processing power on a server than on the client. SSL renegotiation attacks can readily... All Cybercrime and Hacking White Papers | Webcasts