Monday, October 27, 2008

Encryption Software: Is It Worth It?

Do you ever hesitate when making an online purchase because you do not feel comfortable giving out your personal information over the internet? Most people would answer “yes” to this question…and rightly so. When entering personal data online, you cannot be sure that your information is kept confidential. Because identity theft is a common and destructive crime, many states are enforcing new laws that require businesses to refurbish the way they protect consumer data, by installing encryption software on computers.

Nevada was the first of several states to implement the new law, which took place this month. There are a few scenarios described in the article explaining the importance of these laws. For example, a well-known Las Vegas-based hair stylist, who works mostly with celebrities on movie sets and travels frequently, must conduct most of her business through email; most of the emails (containing payment information, credit card numbers, and bank-account information) are stored on her iPhone. Because of this new law, the hair-stylist now uses email-encryption software, requiring her clients to enter a password in order to read her messages and respond. Some find it irritating that they must jump through so many hoops just to read and respond to messages, but I find it entirely necessary. This software is significant because much of today’s newest technology is compacted in small devices (i.e. laptops, handhelds, pda’s) making it easier for outsiders to confiscate and hack into. I think many people would agree that this would be a lot more irritating than entering in a few passwords.

Unfortunately, due to the new privacy laws, companies will be required to spend up to a few hundred thousand dollars to purchase encryption software. Although it is costly, I believe that the software is entirely worth it, because it is preventing potentially larger costs. If a client’s personal information is lost or stolen from a company or personal computer, the company could easily be to blame, which would result in some sort of negligence law suit filed against the company or person responsible for the computer. These damages could be significantly greater than the amount of money spent to install protective software.

Before these new privacy laws came into play, there were notification laws that required businesses only to notify people if their personal information was lost or stolen. I do not find notification laws to be useful because they are only relevant after information is lost or stolen, when much of the damage could already be done. This claim is proven by a recent study at Carnegie Mellon University, stating that notification laws result in only a two percent reduction of identity theft. In contrast, the newly established privacy laws make it very difficult for outsiders to acquire any private information because everything will be encrypted and only visible after entering a password protected site. I think that the privacy laws are necessary and long overdue. Some people do not even think twice when entering personal and financial information online, even though it could be freely circulating the internet, or just left in a personal inbox, stored on someone’s iPhone. It is essential that more and more states adopt privacy laws. In return, states will have fewer negligent law suits on their hands because they will be equipped with protective technology reducing infringement; there will be lower identity theft rates; and most importantly, consumers will have much more privacy on the internet.

This article can be found at: http://online.wsj.com/article/SB122411532152538495.html

No comments: