Small banks slam New York's proposed cyber rules

Some banks believe that the proposed regulation doesn't take into account the different circumstances and risk profile of smaller community institutions.

Community bank groups and other financial industry associations expressed deep concern Monday with new cybersecurity regulations proposed by the New York State Department of Financial Services, telling a committee of state lawmakers that they were inconsistent with federal rules and put an unfair burden on smaller institutions.

“There’s a bit of a one-size-fits-all approach” in the rule, said Laura Mazzara, senior vice president and chief risk officer for Pioneer Bank. She gave evidence on behalf of the Independent Bankers Association of New York State to a hearing of the Standing Committee on Banks considering the new regulations.

The association believes that the proposed regulation doesn’t take into account the different circumstances and risk profile of smaller community banks, she said.

“We are completely in support of the underlying objectives,” she said, “We hold … information security … in very very high regard … it really is a cornerstone of what we do to ensure trust from our customers.”

The rules, released for public comment in September, are scheduled to go into effect Jan 1. They will be the first effort by any state’s bank regulators to produce rules setting minimum cybersecurity standards, but being in New York, will have outsized national and international effects. The state is home to outposts of — and therefore can regulate — every major financial institution in the world.

“We also have some concerns that center around competitive disadvantage for New York State-chartered community banks,” she added.

She said Pioneer was also regulated at the federal level by the Federal Deposit Insurance Corporation. “We’re concerned that this regulation will create a disparity between the standard that we’re expected to meet on the federal side and the standard in this new proposed regulation,” she said.

Some observers said they believed the criticism was so severe that the state Department of Financial Services should reconsider the planned rules.

“The takeaway from today’s hearing was loud and clear — the DFS cyber regulation is not ready for prime time,” said Craig Newman, head of the privacy and data security practice at law firm Patterson Belknap. “Industry groups expressed major concerns about the proposed regulation, calling it over-broad, inflexible and bad for business in New York, especially as it impacts smaller institutions and those with limited resources.”

Newman said DFS should “take a step back and consider a delay in implementation.”

“No regulation is going to get the support of each and every industry player,” he said, “but the sentiment voiced has been overwhelmingly negative. A slight delay in the effective date would provide a bit of breathing room for the industry and DFS to at least attempt to reach more common ground.”

SCOTUS tosses one of two injunctions against Trump USPS mail-in ballot rules

The 6-3 decision dismisses one lawsuit brought by states, saying they have no standing to sue because the disputed sections “neither requires nor forbids anything of anyone outside…

Postal Service moves to finalize mail ballot regs before SCOTUS ruling

FCC pushes new rules to crack down on robocallers, foreign call centers

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure