Absolutely is my understanding. At one time this may have been the only way much security was being done, rather than designing from a intial secure state.
it would be a good step--that, and dumping the spyware they plant in new systems to track customer preferences
Spyware has drawn great attention to the "intrusion" aspect, without actually intruding on too many. A very close eye was being kept on it, and as soon as it was recognized there was actually illicit activity going on, Congress has immediately stepped it and will apparently act. Let's hope it's a complete and thorough bill. More legislation is unfortunate, but IT is one of the few if only place it can still be justified.