Archive for the 'Massachusetts' Category

Does 201 CMR 17 apply to VOIP?

Thursday, May 13th, 2010

Background: looking at going to a Voice Over IP phone system at work. Wondering if Massachusetts’ new law about information security applies.

Why it might not: a potential (MA based) vendor we’re talking to says

We’ve not been asked this before and about 201 CMR 17 Compliance and I don’t particularly think it applies to our VoIP, or VoIP in general

Why it might: Section 17.04 qualifies the applicability of the rule to

Every person that owns or licenses personal information about a resident of the Commonwealth and electronically stores or transmits such information shall include…a security system covering its computers, including any wireless system

Like just about any business, we definitely transmit personal information over our phone system, so I think the technical / legal question is whether an electronic phone system of the type in question is covered under the “its computers” phrase.

Stepping back from the legal to the practical, however, it seems fair to expect reasonable information security from our communications systems, including VOIP. At least in its intent, I think that’s what 201 CMR 17 is after. VOIP is still new enough that I suspect many prospective customers (like us!) aren’t quite sure what constitutes a reasonably secure installation, though we sense that there are all kinds of potential attack vectors not present in POTS.

latest 201 CMR 17 hotness

Friday, January 15th, 2010

You could be excused for having missed the news, but the 201 CMR 17 that was just about to go into effect over a year ago… is now just about to go into effect!

some tidbits:

Fortunately, there doesn’t seem to be anything particularly unreasonable in the requirements, so organizations following good data security procedures shouldn’t have to do much work (if any) to be compliant.

    Looking further into MA regulation 201 CMR 17.00

    Wednesday, October 22nd, 2008

    Thanks to MSCPA, I finally tracked down the Governor’s press release which, at first glance, has a reasonably clear description of the regulation’s intent. Also came across an analysis by Beth Israel’s CIO, a positive blurb from a Maine consultancy, and a brief mention by a MA payroll company.

    As for me, I still need to do my official audit of our procedures vs. those specified by the regulation.

    new Massachusetts personal info requirements

    Thursday, September 25th, 2008

    Networks Unlimited just sent out a note (thanks!) about the Mass Office of Consumer Affairs’ new
    Standards for The Protection of Personal Information of Residents of the Commonwealth, aka 201 CMR 17.00: M.G.L. c. 93H. It outlines the responsibilities of anyone who gathers personal information on Mass residents. At a glance, they look pretty reasonable. From the intro:

    Every person that owns, licenses, stores or maintains personal information about a resident of the Commonwealth shall develop, implement, maintain and monitor a comprehensive, written information security program applicable to any records containing such personal information.

    It’ll be interesting to sit down with this & see how our policies & procedures match up.

    The Word on GrUT ’08

    Monday, June 30th, 2008

    flipboard at GrUT \'08 As promised, I spent yesterday at Organizer’s Collaborative’s Grassroots Use of Technology conference, up in Lowell. I went hoping particularly to pick up tips on donor management and fundraisining tools, and came away with some good leads. It was also fun to reconnect with folks.

    Keynote speakers

    Nick Jehlen of Action Mill shared his approach to social change projects, and how that approach played out for Turn Your Back on Bush, Winter Soldier, and Enough Fear. His basic premise is to take Ghandi’s idea of being the change that you want to see in the world, and bring it to the commons, so that principled actions have a chance to influence others. In addition to having interesting stuff to say, Nick really put together a handsome presentation, so if you get a chance to catch him speak sometime, go for it.

    After lunch, Paul Niwa talked about his Boston Chinatown site, which provides a visualization of the community members’ connectedness. He’s a professor of journalism at Emerson, so his initial goals were mostly based in journalistic concerns, but one of the interesting results of the project is that it may have provided incentive for some people to become more involved in their community, to boost their importance on the visualiztion! It was also interesting how what Paul called his “journalistic arrogance” led him to publish people’s information on the web much more freely than many of us in the nonprofit / activist space would be likely to do.

    Sesssions

    The first breakout session I went to was horrible. No names, to protect the guilty.

    Sura Hart and Katie Winterbottom of Grassroots.org ran a helpful session on SEO. Props to them on running the presentation from Google Apps, on a KDE laptop. As for the content,

    • it was helpful to see specifics about keyword research, and the tradeoffs between keyword popularity in searches and the existing presence for that term on the web
    • will have to think harder about the working of intrasite hrefs
    • hadn’t really thought about using the title attribute on tables, forms, etc.
    • Google Grants sounds like an amazing opportunity.

    Nate Aune of jazkarta had a ton of useful tool suggestions. He started with the constituent database, as that’s at the core of almost any successful organization. His recommendation is salesforce.com now that they’re giving their service away free to nonprofits. This is significant because it’s a best-of-breed solution, with a thriving ecosystem of parters enabled by its comprehensive API.

    From there, Nate went on a whirwind tour of helpful tools. I’ll only note here the ones that I can see looking into in the future:

    Online donations

    • we already use paypal, but I’m not sure if we’re taking advantage of the fact that they give nonprofits a lower fee than for-profits. Also, all processing can be done via their API - no need to send folks to paypal.com’s ugly pages (which we do now…)
    • fundable
    • chipin
    • for nonprofits, google checkout is totally free through next year. Interesting, I wonder what happens then?

    Mass email

    • campaign monitor - we’ve just been giving them a try, so it was nice to hear that jazkarta has good luck with them. However:
    • VerticalResponse is also supposed to be excellent, and is integrated to salesforce.com

    Misc.

    • eventbrite sounds very handy for online ticketing
    • phone.com’s integration of voice mail and email could be very handy

    This Saturday: Grassroots Use of Technology Conference

    Monday, June 23rd, 2008

    On my agenda this weekend is the ‘08 edition of the Grassroots Use of Technology conference, happening up in Lowell. I was a volunteer at the conference back in ‘04 and ‘05, but I’ve been out of town for the last couple.

    This year I’ll be wearing my IT Manager hat & looking to pick people’s brains particularly about mass emailing, online donations, and fundraisining tools.

    Hello, Peak Oil

    Friday, October 19th, 2007

    Thursday was the fifth day in a row crude prices have set new records.

     — ( extremely out-of-context quote from yahoo story on oil futures’ first trip over $90 / barrel )
    Mass Heating Oil prices, October 19 2007

    Heating oil prices not looking so good lately, either.

    It is very difficult to wrap your head around complicated issues like regional climate change policy, but I’m giving it a shot

    Thursday, January 4th, 2007

    I was talking to a friend today about our collective sense of dread over climate change. We know it’s happening; we know it’s probably the biggest problem facing any children we may be lucky enough to have, if not ourselves in a few years; and we know that all kinds of things need to be happening both on personal and societal levels to improve the situation.

    Given that very recent conversation, it’s interesting to observe that trying to get through Environment Northeast’s recently released Climate Change Roadmap for New England and Eastern Canada gets my eyes glazed over in no time at all. I truly believe that this is vitally important stuff, but I’m sure having a hard time wrapping my head around it.

    Part of the problem is that the solutions outlined in this roadmap all require action at a higher level than the individual - legislatures, executives, and other institutions. Not belonging to any such group, it’s a little tough to relate. What I can do, besides the various personal efforts that I will refrain from boring either of my readers with, is nag my elected officials. According to this Globe article, the Patrick administration is on board with the roadmap, so I’m planning to start bugging my elected officials to see what they’ve committed to on this issue.

    As soon as I make it through the roadmap.

    The rest of the upcoming election

    Wednesday, October 25th, 2006

    I have nothing further to add about the high profile portions of the upcoming Massachusetts election. My thoughts about the less widely covered parts:

    Green-Rainbow endorsed Jill Stein for Secretary of State, because the person in charge of state elections ought to show up for his own debates.

    The brand-new Working Families party endorsed Rand Wilson for Auditor. Fascinating interview with Wilson here.

    On a related topic, I’m voting yes on question two. Good discussion in the interview above; an example of how it’s worked in New York here.

    Also voting yes on question three, for these reasons.