Windows 8 adoption slows; boost sought with update

Windows 8's user share growth slowed significantly in July, hinting at further trouble for the struggling operating system, new statistics from an analytics company show.

The operating system's user share grew by the smallest month-over-month amount since its launch in October 2012, said Web measurement vendor Net Applications. At the end of July, Windows 8 accounted for 5.9 percent of all systems running Windows, an increase of three-tenths of a percentage point compared to June.

From November 2012 through July 2013, Windows 8's user share grew by an average of six-tenths of a point each month, with lows in February and April of five-tenths and a high in June of nine-tenths of a percentage point.

July's increase was about a third of June's.

The slowdown is most likely tied to the continuing problems of the personal computer industry, which has seen five consecutive quarters of contracting shipments. The consumer side of PC sales has been especially hard hit, as customers opt instead for tablets in lieu of new PCs, either letting their current machines age even more or forgoing purchases entirely.

By IDC's estimates, PC shipments fell 11 percent in the second quarter compared to the same period the year before. Consumer sales have tanked even more, as businesses accounted for the majority of purchases.

Windows 8 has been hit particularly hard by the downturn in consumer computer sales, since enterprises have been hesitant to migrate, leaving only individuals and very small businesses willing to take the plunge and run the radically-changed OS.

Microsoft hopes to turn around Windows 8's fortunes with the free Windows 8.1 upgrade, planned for launch this year. Windows 8.1 is to hit "release to manufacturing," or RTM, a Microsoft label for a finished product, later this month.

Meanwhile, Windows XP—the operating system slated for retirement in April 2014—continued to resist elimination: XP's July user share was 40.6 percent, the same as in June.

Net Applications measures operating system share by tracking unique visitors to some 40,000 websites operated by its customers.

National policy sought to alert consumers of data breaches

Members of a Congressional subcommittee last week heard an essentially unanimous call from a panel of witnesses for a national data-breach notification standard to replace the wide-ranging laws currently on the books in 48 states.

The disagreement, such as it was, came in the form of how such a law should be tailored, but witnesses and lawmakers alike expressed broad support for a national law to replace what Rep. Lee Terry (R-Nebraska), the chairman of the Energy and Commerce Committee's subcommittee on commerce, manufacturing and trade, called the "patchwork of state and territory-specific statutes."

The word "patchwork" was uttered often as witnesses described the compliance burden of adhering to the notification requirements prescribed by the various states, which can include different triggers for sending out a notice of a breach, such as inconsistent definitions for personally identifiable information. California, which was the first state to mandate consumer notification, has expanded to require businesses report certain levels of breach to the state attorney general. A report of 2012's security failures was recently released.

"While many businesses have managed to adapt to these various laws, a properly defined data breach notification standard would go a long way to guide organizations on how to address cyber threats in their risk management policies," said Kevin Richards, senior vice president for federal government affairs with the trade group TechAmerica.

"It also would help prevent breaches and give guidance on how best to respond if an organization should fall victim to a breach caused by an attack," Richards added. "It would be particularly helpful for smaller businesses, many of whom cannot afford teams of lawyers to navigate 48 breach standards should something bad actually happen."

TechAmerica advocates for a uniform, risk-based approach to data breach notifications that would preempt state laws. Central to that system would be a common definition of the types of data compromised—names, addresses, Social Security numbers, and so on—that would trigger the notification requirement. Richards also warned lawmakers against writing into law specific approaches to mitigating data breaches, urging that any bill be "technology neutral."

Jeff Greene, senior policy counsel for cybersecurity and identity with Symantec, offers the estimate that 93 million identities were exposed last year as a result of data breaches, while cybercrime accounted for $110 billion in consumer losses.

"The cost of these breaches is real," Greene says.

The hearing was timely. That morning, reports began appearing that the hacktivist group Anonymous had accessed the email accounts of thousands of Capitol Hill staffers.

Adding to the complexity of overlapping state laws is the question of applicability. Debbie Matties, vice president of privacy with CTIA, a trade group representing the wireless industry, explained how telecom providers in particular struggle with compliance when a breach occurs, which could affect subscribers on a family plan who are often in different states.

"Most data breaches impact consumers in multiple states, just like the breach that happened here in the House. And electronic data is rarely segmented by state, so under current law, the question becomes, which state law should apply? The state in which the consumer resides? The state in which the breach occurred? Or the state in which the vulnerability existed and was exploited?" Matties said.

Lawmakers considered whether a federal data-breach notification standard should come in a larger bill that would address companies' defensive data-security posture as well as the provisions stipulating how they communicate with their customers in the event of a breach.

That approach would couple the notification provision with the more contentious debate over cybersecurity legislation, which has been simmering within several committees in both chambers for several years.

Several witnesses suggested that a data-breach bill should include an exemption from any notification requirement in cases when the company had encrypted the data so that it would be unusable for the hacker.