ACMA, Copyright, Privacy and other un-newsworthy things…….

Posted on June 25th, 2009 by Drazen Drazic

By SGirl:

Who will I upset this time? Though the support far outweighed the few negative comments. But, I digress…..

It is interesting the information that you can find when you look really hard and spend a bit of time to get results.

As a bit of background, to me, IT security is not just all about technical solutions, hacking and latest marketing terms like the “Cloud”. It is also about management, strategy, compliance (not the dirty version). It’s many areas that for some reason, the media don’t really report nor focus upon (unless your compliance means PCI DSS). It’s the less “sexy” part of the industry, but for much, the parts that hit the coalface of the business.

In Australia, there are things happening that you hear little to nothing about – things that are affecting businesses and compliance considerations now. They aren’t being focused upon and far from hot topics like PCI DSS; “Ooh merchants might start being fined soon and let’s start talking about what PCI DSS is, and means to you and how vendor X is going to help you”! We only hear about what a few decide is “sexy” but for most part and as recent conversations here in this blog and forums have shown, what those individuals are deciding as “interesting” seems not to be what is floating the boats of many in the industry. Drazen Drazic gets most of his news from blogs he says.

Let have a look at a few things:

Businesses getting hit for being not compliant with the SPAM Act

We all know a little about this but the details and stories are rarely if ever covered. The  Australian Communication and Media Authority (ACMA) seems to be taking their job of enforcing the Spam Act pretty seriously.

Take for example one small business: 1 owner. Two staff purchased a list that they bought in good faith (apparently) to send SMS’s advertising health goods. 4 complaints later and a fairly serious investigation by ACMA and they [the business] are down $10,000 plus some fairly big mandatory requirements that they must comply with such having to undergo audits by ACMA for a year – having to demonstrate a training and awareness program and business practices that will prevent them from breaching the Spam Act again. To top it off, their company is publicly named

They are not alone either. http://www.acma.gov.au/WEB/STANDARD/pc=PC_310869 and http://www.acma.gov.au/WEB/STANDARD/pc=PC_100407

Does this not rate as News? Checkout the links. Some of this stuff is quite interesting!

Businesses getting fined for Software Piracy

Under the Copyright Act, copyright breaches can result in fines up to $93,500 and /or up to five years imprisonment for individuals and fines up to $467,500 and/or up to five years imprisonment for companies. Civil penalties can include rewards of damages that are unlimited plus court costs.

Here are just some recent penalties:

- Travel Company $200,000
- Manufacturing Company $200,000
- IT Services Company – $150,000
- Telecommunications Company $100,000
- Training and Employment Company $91,500
- Agricultural Company $60,000.

The Australian Copyright Council publicly lists all cases including business names and penalties:
http://www.copyright.org.au/news/news_items/cases-news

Also on Software Piracy, The Business Software Alliance is a group made up of members of the major software companies that actively champion uncovering software piracy and copyright infringement. They also provide rewards of $5000 to identify businesses that are infringing copyright.

Still not News? Checkout the link. Some interesting reads again!

Privacy and Credit Card Information

In 2007, a complaint was made by an individual who was concerned that a receipt for a payment they received made displayed their full credit card details, including their name, full credit card number, type of card and expiry date. They felt that this compromised the security of their information as any person gaining custody of this receipt would subsequently be provided with sufficient information to complete a credit card transaction charged to their credit card account.

The commissioner upheld that this did not breach the Privacy Act -  which technically is true, but isn’t it so at odds with every principle of the PCI DSS? Depends I suppose on what is simplest to deal with and uphold at the time? Common sense versus “pragmatic” and selective placement in the too-hard basket. (The merchant EFTPOS facility used was provided by a banking institution).

Is this not a strange message to send? Is this not news. (I know it was reported but few “journalists” if any disected and questioned it).

I hope if you’ve made it this far in this post, you have found it interesting. Nothing new here but more so details – cases, case-studies and other things to consider or just general interest different to the day to day things we think about. But as I said, not the easiest information to find on the Net!