Government Technology

Incomplete Data Breach Reporting Makes Tracking Hacks Tough, Organization Says

January 20, 2010 By

Cyber-security's always a hot topic because people always worry about keeping data safe, but concerned parties may be missing out on the whole story when it comes to how many, or how few, data breaches happen at any given time.

The Identity Theft Resource Center (ITRC), an organization that collects information about data breaches from media sources and government notification lists, publishes data breach reports and researches IT security in public- and private-sector entities. But according to Linda Foley, who founded the center with her husband Jay Foley, it's difficult to provide a clear picture of how secure the cyber-world is because breached organizations aren't upfront enough when they've been breached and how badly.

"Breached entities, No. 1, are afraid of the consequences. They're afraid that their reputation will be damaged, of fines they might incur, of the repercussions of a trust issue," she said.

The ITRC issued a press release on Jan. 8, 2010, titled, Data Breaches: The Insanity Continues, citing the lack of a single data breach list requiring mandatory public reporting. Foley feels that this might change if the law intervened and forced organizations to step up.

"It takes law enforcement response. It takes the response of someone sitting there and saying, 'What are you going to do about it?'" she said.

The ITRC's 2009 Data Breach Report recorded more than 222 million potentially compromised records last year in 498 breaches, but in more than 52 percent of the breaches, the victimized organizations didn't disclose how many records were affected. So that 222 million? That only accounts for the breaches people wanted to talk about in public.

The insanity in this case is how difficult it is to count breaches in these circumstances. But of the data the ITRC has, breaches in the business sector number at 205 of 498 reported breaches in 2009, 41.2 percent. That's a larger concentration than in 2008, when business breaches numbered at 241 of 657 breaches, 36.7 percent. Government and military breaches constituted 90 of 498 breaches in 2009, for 18.1 percent. That's a smaller concentration than the 2008 figure, when that sector had 110 out of 657 for 16.7 percent.

Foley said many of the breaches can be reduced with better encryption and redaction, and she's hopeful that upcoming legislation can make better breach reporting required by law. S. 139, which was introduced by Sen. Dianne Feinstein, D-Calif., would required federal agencies and people involved in interstate commerce to disclose breaches of data containing personally identifiable information. The bill has passed through committee and is on the legislative calendar.


| More


Add Your Comment

You are solely responsible for the content of your comments. We reserve the right to remove comments that are considered profane, vulgar, obscene, factually inaccurate, off-topic, or considered a personal attack.

In Our Library

White Papers | Exclusives Reports | Webinar Archives | Best Practices and Case Studies
Improving Emergency Response with Digital Communications
Saginaw County, Mich., increases interoperability, communication and collaboration with a digital voice and data network, as well as modern computer-aided dispatch.
Reduce Talk Time in Your Support Center by 40%
As the amount of information available to citizens and employees grows each year, so do customer expectations for efficient service. Contextual Knowledge makes information easy to find, dropping resolution times and skyrocketing satisfaction.
Emerging Technology Adoption in Local Government
In a recent survey conducted by Government Technology, 125 local government leaders shared their challenges, benefits and priorities when adopting emerging technologies such as cloud, mobility and IP. Read how your jurisdiction’s adoption of technology compares to your peers.
View All

Featured Papers