Yes, TJ Maxx should "go." Straight to jail. Do not pass "GO." Do not collect $200.
The ever-growing hacking and identity theft scandal at one of Massachusetts largest retailers, TJX, parent of TJ Maxx, has given impetus to a bill introduced by Rep. Michael Costello in the Massachusetts legislature that, according to The Wall Street Journal (paid subscription required), "would make any company, be it retailer, bank or data processor,
financially liable if it is the operator of the system that is hacked." While many states (not including Massachusetts, incidentally) have passed laws that require a business whose system is compromised to notify consumers that their personal information has been accessed, this is the first state law that would assess financial responsibility to the business whose system's security is breached.
The bill is being supported by credit card banks, who have taken the brunt of TJX's systems breach, and previous breaches of other retailers' information security systems. Among those costs have been the cost of re-issuing credit cards, freezing, closing and reopening accounts, and fraud charges. According to an article in last month's The American Banker (paid subscription required), the Massachusetts Bankers Association played an important role in drafting Rep. Costello's bill. Because they've been picking up the tab, credit card banks have had an incentive to make their own information security systems more robust. As The Wall Street Journal notes, banks "have instituted an assortment of computer-security systems, including encryption, to thwart thieves." Of course, it also helps that information security measures are required of banks by safety and soundness guidelines. Now, banks want the same "incentive" (i.e., financial exposure imposed by law) to motivate retailers to stop slacking off when it comes to information security measures and when it also comes to stepping up to the table with cash when those measures are circumvented.
The response of retailers has not been, shall we say, exactly ecstatic.
Jon B. Hurst, the president of another Boston
trade group, the Retailers Association of Massachusetts, said retailers
already cover some of the costs related to breaches. “Fraudulent
activity is part of the reason why we have what is, in many peoples’
opinion, outrageously high interchange fees,” he said.
Mallory Duncan, the general counsel for the National Retail
Federation, said the card associations’ Payment Card Industry data
security standard already puts a large financial burden on retailers,
even when there are no breaches.
The bill could actually make the payment system less secure by
taking banks off the hook, Mr. Duncan said. “Carried to its logical
extreme, this gives … [banks] incentives not to carry out their
responsibility and monitor for fraud.”
He said he does not know of any state that requires retailers to pay banks’ costs for data breaches.
The "outrageous interchange fees" is a non-starter. Consumers and the legislators they elect don't care about that esoteric argument. It's tough to "follow the money" when all the outraged voter cares about is that TJX allowed their personal information to be stolen and their credit card information to be used fraudulently. The consumers' concern for nuance extends only to the following extent: "I see a sturdy live oak right over yonder. Let's get us a rope and hang him."
Mr. Duncan's "logical extension" might be supportable on Planet Mongo, but here on the third rock from the sun, we all recognize that the incentive for banks to maintain consumer and customer data securely is because they are required to do so by law. Now, banks are simply asking to level the playing field, Mr. Duncan. Being a logical extension kind of guy, you should see the justice of that point, eh?
Spin meisters: a tiresome lot.
Other "experts," such as Avivah Litan, a consultant ("Hide the kids and the silverware!") with Gartner, Inc., was quoted by the American Banker as stating that she's "never seen the government step in like that...It's a collective responsibility." "Collective"? What are you doing, channeling the spirit of Karl Marx? Well, don't cry for Maxx, Av-va-vi-vah, but you need to stop watching reruns of Lost and venture back to the real world. The "responsibility" for a retailer's information security system is the retailers. When its breached and information is stolen, it ought to be the retailer's responsibility to make the other damaged parties whole. In your world, it may "take a village," but in the world of civil litigation, it's dog-eat-cat, and every villager for himself. Moreover, in this field, the private sector remedy, to assign liability to the party most responsible for the loss-the retailer whose system was breached-via private contractual remedies, is broken.
Back to The Wall Street Journal:
Among those who would benefit the most from a
statutory law would be small-to-medium-size banks that don't handle the
transaction volumes of their much bigger national counterparts. When
they have sued retailers to recoup their losses, they have failed.
After a security breach in 2004 at BJ's Wholesale Club Inc. in Natick, Mass., the Pennsylvania State Employees Credit Union
asked a federal court to order the retailer to pay $100,000 -- the
financial institution's tab to cancel and reissue 235,000 Visa credit
cards. But a federal judge threw out the case arguing that the credit
union wasn't a party to a private contract between Visa International
Inc., BJ's and its processing bank, Fifth Third Corp., which outlines who is liable for fraud.
Two other banks -- TD Banknorth Inc., of Portland, Me., and Sovereign Bank of Philadelphia -- also sued and lost their case against BJ's on similar grounds.
Some of the private contracts do require retailers to
reimburse the credit-card-issuing bank for losses when financial data
of customers are breached and their cards are compromised. But banks
say that the recovery process is so cumbersome that it is nearly
impossible for them to recover their full losses.
MasterCard Inc. has had such written agreements for
years and Visa USA Inc. began incorporating a similar policy late last
year. "Under that process banks end up recovering $1 a card on
average," says Bruce Spitzer, spokesman for the Massachusetts Bankers
Association. Card-replacement costs range from $5 to $20 per card.
"That's why we're pushing for a state law," he says. Visa says under
its new process, banks should be able to recoup their losses in about
seven months.
7 months? You think credit card fees are high now, retailers?
I would agree that legislation always should be a last resort where an adequate private sector remedy is available. However, I would also agree that a failure to take responsibility for your failures results in all kinds of unpleasant consequences, including the intervention of that body to which Daniel Webster referred when he said "When the legislature is in session, no man's property is safe."Nevertheless, this is what you get when you don't voluntarily adopt the security measures that other businesses, such as the banks you groan and moan about, adopt, and, when those measures don't work, you try to avoid accountability. Some schoolyard bully comes along and beats you like a rug, and you cry like a baby.
Of course, it might also have been better had not the Attorney General of Massachusetts decided to initiate a vendetta for personal reasons public policy considerations.
Massachusetts's new attorney general, Martha Coakley, herself a victim
of credit-card fraud earlier this year, is leading a civil
investigation involving as many as 30 states, into the security breach
at TJX.
Bend over and grab your ankles, TJX. This is going to hurt you a lot more than it's going to hurt me. And when you receive a stroke, I want to hear you shout, "Thank you mam! May I have another?"
For retailers who sell in more than one state (like, say, TJ Maxx) it might also be preferable to have one national standard for liability for information security breaches. That way, you only have to look one way for the Greyhound Bus that's about to flatten you, and not 50 ways.
Enter Barney Frank. According to a recent article from CNET News:
Congress may be eyeing similar legislation on a national scale. U.S.
House of Representatives Financial Services Committee Chairman Barney
Frank (D-Mass.) has said he supports the concept. However, it is
unclear what sort of language will end up in a new data-security bill
Frank is drafting, said a committee aide who asked not to be named.
A spokesman for Christopher Dodd (D-Conn.), the chairman of the Senate
Banking Committee, was less certain where that chamber may be headed.
Dodd "intends to work with his colleagues on the committee and in the
Senate to further examine current risks to financial data, and also
examine what steps Congress can take to better protect the data and
consumers," spokesman Marvin Fast said.
Well, that was underwhelming. Then again, whenever Barney Frank "eyes" something, that "something" ought to become just a wee bit uneasy. I know I would, but maybe that's just me.
A final point: I hope bankers realize that when the bill says "any commercial entity," that means banks. While this Massachusetts law might help some credit card banks avoid losses when a retailer's systems are breached, those same banks, and all other banks, have to understand that this bill, and others like it, will also impose liability on them when their systems are breached. If you want to stick it to retailers (and let's be honest, who doesn't), be prepared for the same law to put the hammer down on your head when you deserve it. No one, least of all retailers, will want to hear you whine about it if that happens.
On the other hand, you can always cry on the shoulder of your local bank lawyer, especially when the meter's running.