Nevada is set to start enforcing compliance with a law governing how businesses operating in the state can transmit personally identifiable information (PII). The law (see article here, or see the actual statute here) was passed last year, and it goes into effect October 1st. It requires the use of encryption (or something that might faintly resemble data encryption) when PII is transmitted.

Like a lot of the state legislation dealing with privacy and security, it has a few problems....Nevada's law applies to all PII transmitted electronically except via facsimile. I'm not familiar with the state of the art in sniffing and hacking facsimile transmissions, but I'm guessing it isn't rocket science. The definition of encryption in the statute is bears no resemblence to any other definition I have ever read, and it opens the door to many different security controls potentially being permissable under the definition. See the definition at the end of the article, which should give cryptographers a lot of heartburn. You could use a simple letter substitution and have it pass for encryption using their definition. Well intended, but poorly executed in my book.

The proliferation of state laws dealing with privacy and security continues, and it raises some interesting bigger picture questions to think about...

  • Keeping track of the vario
    us state's individual regulations and requirements is becoming a real quagmire, as they are diverging in terms of what comprises PII, what the organization needs to do in terms of breach notification, and what controls must be put in place.
  • State compliance regulations like this are all bark and no bite- it's not like Nevada is going to have an enforcement group running around checking to make sure that every business that deals with PII is using encryption (as they define it). I guess if you had a breach, that fact that you might not have been using encryption might open you up from a liability standpoint.
  • Are state legislatures really equipped to define best practices for securing access to PII? The answer is pretty clearly no.
It seems to me that we really need a federal law that is carefully constructued in this area.

Jim

NRS 205.4742 "Encryption" defined. "Encryption" means the use of any protective or disruptive measure, including, without limitation, cryptography, enciphering, encoding or a computer contaminant, to:

1. Prevent, impede, delay or disrupt access to any data, information, image, program, signal or sound;

2. Cause or make any data, information, image, program, signal or sound unintelligible or unusable; or

3. Prevent, impede, delay or disrupt the normal operation or use of any component, device, equipment, system or network.