EU calls for greater data-breach transparency

29 Aug 2012

Wider, mandated incident reporting essential to “obtain a true cyber security picture”, say ENISA researchers.

“Large outages and large data breaches receive extensive media coverage, showing the importance of cyber security in society,” it says in a new report . “Many breaches, however, remain undetected and, if detected, are not reported to the authorities and not known to the public.” The result is that there is, “now overall view across the digital society of the incidents, their root causes or their impact for users.”

Key to improved European cyber security, suggests ENISA, is more effective implementation, expansion and enforcement of Article 13a of the Telecommunications Regulatory Directive. This specifies that not only must providers take appropriate measures to manage the risks posed to the security of their networks and services, Member States must also ensure that those providers notify the national regulatory authorities of any significant breach of security or loss of integrity.

ENISA executive director, Professor Udo Helmbrecht, explains, “Incident reporting is essential to obtain a true cyber security picture. The EU’s cyber security strategy is an important step and one of its goals is to extend the scope of reporting provisions like Article 13a beyond the telecommunications sector.”

However, ENISA adds that services provided by business networking site LinkedIn, which had approximately 6.5 million user passwords stolen by hackers earlier this year, and RIM, which reported a “core switch failure” within its Blackberry network infrastructure last year, had not clearly fallen within the scope of the current EU rules. In the report, it urges the European Commission and national authorities to rethink how they interpret the meaning of ‘electronic communication services’ under the laws in order to ensure that gaps are plugged.

"This can be done without necessarily changing the text of existing legislation, such as the telecom regulatory framework, but rather the interpretation of what the services are, because the landscape of electronic communications is continuously changing (from landline telephones and Minitel in the past, to mobile phones, internet and VoIP)," say the report’s authors.

They also touch on issues around security breach reporting, with particular reference to whether there should be standard ways for setting out incident reports and assessing the impact of breaches, as well as whether a new classification system for rating the severity of breaches should be introduced.

As reported previously by IP EXPO Online, new data breach notifications have already been proposed under planned reforms to EU data protection laws. Under the European Commission’s draft General Data Protection Regulation, companies would have to ensure that any personal data processing is done securely and that they notify regulators and any individuals concerned with certain information about any data breach "without delay and, where feasible, not later than 24 hours after having become aware of it". The information should include recommendations over what people can do to "mitigate the possible adverse effects of the personal data breach".