Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Emailing SSN info
From: <bart2k () hushmail com>
Date: Thu, 18 Mar 2004 14:23:25 -0800

First off review the Institutes Privacy Policy I'm sure you have one.

Then ask "Higher" management why they are password protecting a zip file
(worthless secure).

Finally make a recommendation to speak with the vendor who is getting
the data and ask what secure methods of transport they support 
<maybe SecureFTP ;)> Also ask about encryption PGP, 3DES, whatever you
like but make sure it's an encryption process (not some lame password
protect crap).

Your CD option is fine but only if the data is first encrypted (rumor
has it that shipped mail gets lost sometimes).

That's my 00000010 cents worth.


On Thu, 18 Mar 2004 12:44:56 -0800 Tony Gettig <GettigAM () kalamazoo k12 mi us>
wrote:
Hi all,

I work for a school district in the USA. Higher management wants
to
email a zipped data export (presumbably password protected) to a
vendor
that includes the Social Security Number for employees. I have advised
them against this. Shipping a CDROM overnight would be more secure,
IMO.


Now they want to know if there are any laws pertaining to the emailing
of SSN info. (Why they are asking me and not an attorney, I am not
sure...though I AM going to tell them to speak to an attorney too.)


Can any one point me to a website or cite specific US (or even state)
laws regarding this? Even a reply telling me why this is a bad idea
would be great. If I am wrong, I am glad to hear that too. Thanks
in
advance!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html





Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]