New law in Germany: cyber-security All German institutions and businesses that fall into the category of "critical infrastructure" will have to implement new IT security measures , as now defined by the new security legislation that passed a few days ago in the German Bundesrat (i.e. the German parliament).
According to Reuters, over 2,000 water and energy services and utilities, such as telecommunications, healthcare providers, transport companies, as well as financial and insurance companies - that is, all providers of services essential to the daily lives of German citizens, will have to comply with the new legislation or face hefty fines of up to €100,000!
The new lawrequires companies and federal agencies, among other things, to impose a specified minimum in cyber-security standards and to report to the Federal Office for Information Security (BSI)anything related to a hacking attack against their systems.
The legislation also expands the powers of the authorities. The Criminal Investigation Bureau (CIB) will be tasked with investigating various cybercrimes, from data hacking and manipulation to data espionage.
One of the provisions of the law has been heavily debated by data protection supporters. It concerns the one that requires telecommunications to store customers' traffic data for a period of six months back, so that police can use the material in case it is needed within the scope of their investigations. Another obligation placed on telecommunications is to inform customers when abuse occurs on their connection.
