Comments on: Judge: Firm not negligent in failure to encrypt data

Federal court throws out suit attacking student loan provider for failing to encrypt customer database subsequently stolen.

[caxaca51]

It's a policy the company should enforce

Any sensitive data that is allowed to be mobile should undergo
some basic security precautions such as encryption. If I
understand correctly, this judge is saying that since no harm was
done, the company did no wrong. This is negligence at it's best.

[declan00]

actually not negligence

To be a little lawgeekish here, the tort of negligence requires actual harm, not speculative harm.

So it's more like the judge is saying "Sorry, the law does not provide you with a way to cash in by suing this company when you haven't been able to demonstrate harm. If you don't like it, change the law. But otherwise you're out of luck."

[duerra]

WTH? A *laptop*

Maybe I missed something, but what the h*ll is half a million records of personal data doing on somebody's *laptop*? That sounds pretty negligent to me.

[baswwe]

Is there a low crime network online?

"Judge Kyle disagreed, saying that the house was in a relatively low-crime neighborhood and that the law does not specifically mandate encryption."

What about online? Is there a low crime network that you shouldn't have your stuff safeguarded?

How do you figure?

"So it's more like the judge is saying..."

The judge mentions the factors as being, one, a low crime-rate neighborhood, and, two, no specificity in the law, itself, requiring encryption.

So what twisted logic gives you the idea that 'what he's saying" is about actual damages as a prerequisite to going to Court there buddy? Misconstruing arcane laegalese is one thing, but fabrication is something else, no?

[booboo1243]

A desktop would have been better?

Desktop machines get stolen, too. Note that the laptop wasn't being used as a mobile machine, but as a remote machine. It was being used in a physical location thought to be secure.

Security is never absolute. The fact that something bad happened does not, itself, imply negligence. The fact that further safeguards could have been taken that would have protected against a specific threat does not, itself, imply negligence.

[skobryan]

Firm not negligent in failure to encrypt

Well, if this is how the Judge sees it then I guess the banking and healthcare regulators better re-write the audit programs and save everyone the time audits cost to companies. Wow, the judge totally missed the point on this one!