As Internet users brace for the next round of digital vandalism, some experts say that it is time ... "What we're seeing is that voluntary efforts are insufficient, and the repercussions are vast," says Michael A. Vatis, former director of the National Infrastructure Protection Center at the Federal Bureau of Investigation. ... One proposal would require public companies to disclose potential computer security risks in SEC filings. [ Ha! ] "There's a reason this kind of thing doesn't happen with automobiles," says Bruce Schneier. A new California law requires disclosure of computer security breaches if they result in unauthorized access to residents' personal information; customers can sue businesses in violation for civil damages. A new Pew survey said 60 percent favor requiring corporations to disclose vulnerability information. "I kind of despair of the government doing anything," said Richard A. Clarke. I can see it now: "This software may contain certain forward-looking statements ... [which] are necessary estimates reflecting the best judgment of jun^h^h^hsenior programmers that rely on a number of assumptions ..." If you are unable to actually solve your problems, you can at least generate a lot of paperwork to document those failures for posterity. From the new employee manual: "All source code must be reviewed by legal ... A financial impact statement must be provided for each entry in the programmer-provided risk assessment ..." Digital Vandalism Spurs a Call for Oversight | 
