as of last summer requires any system containing sensitive personal information to require users to change their passwords every 90 days--and any other system every 180 days.

Because we don't prevent employees in Italy from gaining access to our systems around the world--and because more and more of our support is being done on a worldwide basis--corporate direction came down to adopt these periods on all our systems. What they'll do when other countries start passing contradictory laws, I don't even want to find out.