The #DataInsecurity Digest | Issue 64

March 20, 2018/by

Facebook data leak prompts renewed calls for privacy legislation

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s Note: Facebook’s data leak (let’s not call it a “breach”) is top of mind this week, with data on at least 50 million users being misused by Cambridge Analytica, reportedly to the benefit of the 2016 Trump presidential campaign. The leak is prompting renewed calls from advocates and Congress to enact more regulation on digital media platforms like Facebook. The Equifax saga continues, with a senior company executive indicted on insider trading charges for dumping his stock shortly before the breach’s news hit the papers. Finally, those who argue you should never pay a ransomware scammer were supported this week by findings that less than half of those who do pay are able to actually recover their data. Remember to back up early, and back up often, folks!

And now, on to the clips!

—————–

Private Facebook data leaked, reportedly benefiting Trump’s 2016 campaign. Cambridge Analytica, a conservative voter profiling firm “harvested private information from the Facebook profiles of more than 50 million users without their permission,” through an app created by a Russian-American academic. The leak is the largest in the social network’s history, allowing the company “to exploit the private social media activity of a huge swath of the American electorate, developing techniques that underpinned its work on President Trump’s campaign in 2016.” (Source: New York Times)

NCL’s Greenberg: Facebook leak “a wake-up call.” The leak of data on millions of Facebook users to political data analytics firm Cambridge Analytica is generating significant concern from privacy advocates, including NCL. “This is a wake-up call,” said Sally Greenberg, NCL’s executive director. “‘The number of apps who want to use your Facebook log-in is endless. We all run into it.’” (Source: San Francisco Chronicle)

Congress takes aim at Facebook. Outrage from Facebook’s massive leak came from both sides of the aisle. On Monday, Sens. Amy Klobuchar (D-MN) and John Kennedy (R-LA), members of the Senate Judiciary Committee, wrote to chairman Chuck Grassley (R-IA) requesting a hearing with social media companies’ CEOs, including Facebook’s Mark Zuckerberg. Sen. Mark Warner (D-VA), the ranking member of the Senate Intelligence Committee warned “These tech platforms …. need to be more forthcoming or Washington is going to start imposing rules and regulations that may not fit.” (Source: ABC News)

Former Equifax executive charged with insider trading. Jun Ying, former chief information officer of a U.S. business unit of Equifax, was charged last week with insider trading. Ying sold his stock prior to the public disclosure of the company’s massive breach, saving himself from an estimated $117,000 in losses. Richard Best, director of the SEC’s Atlanta regional office, said, “Ying used confidential information to conclude that his company had suffered a massive data breach, and he dumped his stock before the news went public.” (Source: Washington Post)

Tillerson’s departure could be a good thing for cyber at State Department. Former Secretary of State Rex Tillerson’s firing last week could be a positive in at least one area: cybersecurity. According to Christopher Painter, former State Department cybersecurity coordinator, the arrival of CIA Director Mike Pompeo at State could lead to a greater focus on cyber threats. “I don’t think the cyber issue was ever a passion for Tillerson; I don’t think this was ever a personal priority for him,” Painter said. “My sense – and all of this is speculative because it’s hard to predict – my sense is that Pompeo because of his background in the CIA and others will have a better appreciation of the security parts of the portfolio.” (Source: POLITICO)

Pennsylvania AG sues Uber for failing to notify consumers of its data breach. Pennsylvania Attorney General Josh Shapiro has filed a lawsuit against Uber after it took more than 12 months to notify PA residents of the data breach. “Instead of notifying impacted consumers of the breach within a reasonable amount of time, Uber hid the incident for over a year — and actually paid the hackers to delete the data and stay quiet.” @alfredwkng notes that “[u]nder Pennsylvania law, Shapiro can sue for $1,000 for each violation. That means the attorney general’s office could seek $13.5 million from Uber.” (Source: CNet)

Quick hit: Yahoo data breach victims allowed access to the courts. Last week, a court rejected Verizon’s bid to have many of Yahoo’s data breach victims’ claims dismissed. (Source: Reuters)

Despite SEC Guidance to report data breaches, few companies do so. In 2017, there were nearly 5,000 cyber attacks on American businesses. Yet, only 24 companies reported a breach to the SEC. While the SEC has investigated late data breach disclosures, it “has yet to bring an enforcement action against a company that failed to disclose an incident.” @craignewman notes that at least part of the hesitation to report a breach could be explained by wanting to avoid undermining an ongoing investigation. (Source: New York Times)

Less than half of ransomware victims who pay get data back. A new study from security firm CyberEdge underscores why it is so critical to maintain up-to-date, offline backups. The firm found that less than half (49.4 percent) of ransomware victims who paid a ransom were able to recover their data. “It’s like flipping a coin twice consecutively – once to determine if your organization will be victimized by ransomware, and then, if you decide to pay the ransom, flip it again to determine if you’ll get your data back.” (Source: The Register)

Dessert: Girl Scouts can now earn a cybersecurity badge. Want some Samoas with your two-factor authentication? Girl Scouts can now earn a cybersecurity badge while they learn the basics of computer networks, cyber attacks, and online safety. (Source: NBC News)

Events

March 27-28 – IAPP Global Privacy Summit, Washington, DC
Starting this weekend, privacy experts and regulators will gather at the IAPP’s Global privacy summit in Washington to discuss and learn about the most pressing issues of the day.

National Consumers League
Published March 22, 2018

Unfinished Business: The Fair Labor Standards Act, 80 Years Later

March 19, 2018/by

Panelists suggest updates for nation’s basic minimum wage, overtime law

By Mark Gruenberg, People’s World

March 29, 2018

This article originally ran here.

Washington—For 80 years, the nation’s basic minimum wage and overtime pay law, the Fair Labor Standards Act, has lifted wages and given most workers a guaranteed floor for earning a living. But the FLSA still has holes and needs some updating to include workers originally excluded because of race, panelists at a daylong seminar on the act said.

The session, sponsored by the pro-worker National Consumers League and the progressive lawyers group, the American Constitution Society, first focused on how FDR and his Labor Secretary, Frances Perkins, got the legislation through a balky Congress in 1938.

And they covered its subsequent expansions to various worker groups and how strong enforcement, especially in the early years, drew lines in the sand employers could not cross in the firms’ attempts to exploit workers.

The latest such advance came the week before, Consumers League Executive Director Sally Greenberg noted, when Reps. Rosa DeLauro, D-Conn., and Katherine Clark, D-Mass., forced GOP Trump administration Labor Secretary Alex Acosta to accept a ban – written into the FLSA — on bosses’ theft of tipped workers’ wages.

The $2.13 hourly federal tipped minimum wage, like the $7.25 hourly regular federal minimum wage, is part of the FLSA.

But “every single day FLSA rules and worker protections are being attacked,” Greenberg warned. Just the day before the March 28 meeting, “a law was being floated in the New Hampshire legislature to lower the age of young workers in dangerous occupations,” she noted. Curbs on child labor are part of the FLSA.

So is overtime pay for toiling more than 40 hours a week. And the same money bill for the government for the rest of this fiscal year that helped the tipped workers exempted minor league baseball players from overtime pay. Major league baseball owners lobbied for that.

All this didn’t stop the panelists from offering ways to further improve the FLSA. They included:

Include groups still banned from FLSA’s minimum wage and overtime pay coverage due to racism. The largest groups are home health care workers, domestic workers and farm workers. All were banned because FDR needed support from Southern Democratic senators to pass the law over a threatened filibuster and GOP opposition. The Southern Dems demanded exclusion of both groups because they were – and many still are – African-American or Hispanic-named.

“This was all very much about keeping the South in line” for the votes, said University of Nevada-Las Vegas law professor Ruben Garcia. When the law first passed, minus those two groups, the minimum wage provisions covered 11 million people, but 300,000 “were exempted,” added Kirstin Downey, Perkins’s biographer.

“Farm workers were added to the minimum wage in 1966, but excluded from overtime pay,” pointed out Bruce Goldstein, president of Farmworker Justice. “So at dairy farms, which produce year-round, workers labor 90 hours a week” with no overtime compensation. The California legislature “recently passed a law mandating a higher minimum wage and overtime pay for farmworkers,” he added.

The domestic workers are still “mostly women of color and immigrant women” said American Constitution Society President Caroline Frederickson.

Make sure the law’s minimum wage and overtime pay provisions remain “a floor, not a ceiling,” said AFL-CIO General Counsel Lynn Rhinehart. Somewhat surprising the packed room, she pointed out the American Federation of Labor – pre-merger – opposed the minimum wage, though not overtime pay and the 40-hour week. “No thank you, we can get it through collective bargaining” was the attitude, she said.

The more radical Congress of Industrial Organizations (CIO) unions, led by legendary Mine Workers President John L. Lewis, backed both. “Don’t call it a minimum fair wage. We’ll bargain for that,” Rhinehart quoted Lewis as adding.

Keep FLSA’s provision letting states and cities rise above the federal minimums. “In the last 20-30 years, we’ve seen an explosion of activism” by the states and cities to do that, Rhinehart noted. But GOP-run states are striking back against their Democratic-run large cities with “pre-emption” laws, taking away the cities’ rights to go beyond the federal minimums. The latest such pre-emptions, she said, were in Missouri and Alabama. A Minnesota effort failed when Democratic pro-worker Gov. Mark Dayton vetoed it.

Add paid sick leave and vacation time. “It must not be left to states and employers,” said Garcia. Though he did not say so, DeLauro has been pushing paid sick and family leave in Congress for more than a decade. The GOP-run Congress has deep-sixed her bill.

Figure out what to do about the “gig economy” and the whole problem of misclassifying workers as “independent contractors,” whom the FLSA does not cover. Rhinehart said the gigs, though a small part of the overall economy, are rapidly growing.

Federal data show an increasing share of the U.S. workforce are “independent contractors,” many of them deliberately misclassified by firms who can then get away with not paying overtime, the minimum wage or workers comp. They’re barred from organizing unions, too.

Reverse the incentive in the recent GOP-passed tax cut to turn employees into “independent contractors. “The default setting should always be ‘employee,’” eligible for coverage, said David Weil, the Democratic Obama administration’s Wage and Hour Division director. Wage and Hour enforces the FLSA. One suggestion later, to create a third class of workers – with some but not all the rights of “employees” under the FLSA, fell flat.

Add restaurant workers, said Saru Jayaraman, president of labor-backed Restaurant Opportunities Center, which marshaled the opposition to the Trump Labor Department’s management tip theft.

“We’re the fastest-growing large industry, with 12 million people, and the lowest-paid,” she said. Restaurants and other low-paying sectors are growing so quickly that “we’re getting very close to the time when one of two working Americans can’t afford to eat, let alone go out to a restaurant.” As for tipping, rich Americans imported the custom from 1800s Europe. Europe has since abandoned tipping.

Expand overtime pay eligibility. That’s what the Obama’s DOL did by both doubling the income ceiling – to $47,476 yearly — under which any worker must be eligible for overtime and expanding the definition of who can get it, said Economic Policy Institute Policy Director Heidi Shierholz. Business got federal courts to toss out that action and Trump’s DOL has revoked it. That only worsens “the rigged economy,” she said.

Since an FLSA legislative overhaul is unlikely, look for other ways to make employers really pay if they break it.

Benika Moore, Labor Bureau Chief for New York State Attorney General Eric Schneiderman, says her office targets repeat violators or those with multiple violations – and then charges them under laws with higher fines and/or jail time. The trials and settlements return more money to the injured workers, she added. “We go after repeat wage fraud and other illegality and also use those laws to get around the ‘independent contractor’ problem,” Moore said. That applies to the “gig” firms, too, she noted.

Such “proactive enforcement” could help “change the culture” of corporations, Weil said.

Virginia law professor Richard Schragger urged states to use their purchasing power to enforce wage and hour laws. “As progressives, we usually look to the federal government. We should shift to the states and localities,” he said. He admitted a big roadblock is legislative gerrymandering, taking away power from minorities, workers and progressives. “This is a political fight, not a legal fight,” he said.

Legalize private class action suits under FLSA and make them opt-out, not opt-in, said veteran pro-worker attorney Joseph Sellers. He also suggested increasing penalties against law-breaking firms to “double a worker’s losses” and removing the law’s present ban on such suits when DOL takes over the case. “And we should pass the Equal Pay Act, with compensatory damages for violators,” Sellers said. DeLauro has been pushing that, unsuccessfully, too, in the past GOP-run Congresses.

Schragger also suggested cities and their suburbs should join into metropolitan regions to together enact higher wage and hour, overtime and other standards.

The Seattle area is already doing that, said David Rolf, president of Service Employees Local 775 in Washington State. “Politics is ultimately about who gets what. To get change you have to build power, which is what we did in Seattle-Tacoma,” he said.

The #DataInsecurity Digest | Issue 63

March 4, 2018/by

FTC calls for reforms to smartphone security update policies; White House AWOL on addressing Russian hacking

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s Note: The FTC was extra busy making news in the data security front last week. First, the agency released new data that shows that consumers lost more money this year than last year to scams. Most notably, the FTC flagged identity theft as the second most prominent type of scam. Research from NCL has shown that being affected by data breaches correlates to increased risk of identity fraud. The FTC also called for phone manufacturers to be more transparent by clearly disclosing the minimum guaranteed support period for their devices so as to minimize the number of consumers using phones that are no longer receiving security updates. Finally, outgoing Acting Chairman Ohlhausen, in remarks delivered at PrivacyCon, quantified injury from breaches and other privacy violations.

In non-FTC news, new reports found that Russia hacked into seven state’s election systems prior to the 2016 election. Russia also garnered headlines for getting caught hacking the Olympics. In spite of this drumbeat of Russian-related hacking news, NSA Director Mike Rogers admitted in a Senate hearing that he has not yet been ordered by President Trump to stop Russia from interfering in the next election. There was a bit of good news, as well, with Visa reporting that the transition to chip-based debit and credit cards has led to a precipitous drop in payment card fraud.

And now, on to the clips!

—————–

FTC: Consumer fraud losses increased $63 million in 2017. Last week, the FTC released its annual Consumer Sentinel Data Book. The report analyzes millions of consumer complaints submitted to the FTC and other organizations and is considered a leading indicator of the state of fraud. Identity theft was the second biggest category, making up nearly 14 percent of all consumer complaints. Credit card fraud was the most common type of identity theft reported by consumers. Tax fraud was the second most common type of identity, despite falling by 46 percent from 2016. All three types of fraud often rely on consumer info gleaned from data breaches. (Source: Federal Trade Commission)

FTC mobile security report cites steps needed to protect cell phones from hacking. Acting Director of the FTC’s Bureau of Consumer Protection Tom Pahl commented “that more needs to be done to make it easier for consumers to ensure their devices are secure.” Among the recommendations, the FTC advised manufacturers to “consider adopting and disclosing minimum guaranteed support periods for their devices and notifying consumers when support is about to end.” (Source: Federal Trade Commission)

FTC’s Ohlhausen addresses data breach injury at PrivacyCon. Outgoing FTC Acting Chairman Maureen Ohlhausen devoted a big chunk of her remarks at last week’s PrivacyCon conference to a perennial issue in addressing data breaches: how to define injury. “The takeaway is clear: consumers can suffer injury from privacy and data security incidents and that injury isn’t limited to loss of money,” said Ohlhausen.”[N]ot everything that can be measured matters, and not everything that matters can be measured. But we ought to measure the things we can and think hard about how to objectively and consistently evaluate the things we cannot. After all, if we cannot measure – or even estimate – the injury we are trying to address, how can we tell if we are directing government action effectively?” (Source: Federal Trade Commission)

2.4 million additional Americans affected by Equifax breach. The new breach victims only had their “names and a partial driver’s license number stolen by the attackers, unlike the original 145.5 million Americans who had their Social Security numbers impacted.” Equifax’s latest revelation brings its total number of victims up to 147.9 million. (Source: Associated Press)

Point-of-sale fraud drops 70 percent for retailers that use chip readers. While only “59 percent of US storefronts have terminals that accept chip cards, fraud has dropped 70 percent from September 2015 to December 2017 for those retailers that have completed the chip upgrade[.]” (Source: Ars Technica)

Despite ongoing efforts by Russia to interfere in upcoming election, Trump has not ordered NSA to stop Russia. In last week’s Senate Armed Services Committee hearing, NSA Director Mike Rogers said that “[n]obody’s … directly asked me,” when questioned on whether the agency has been directed to address the threat of Russian hackers targeting the U.S. election system. He elaborated by stating: “I’ve certainly provided my opinion in ongoing discussions.” @martinmatishak reports that Mike Rogers’ “comments echoed ones he, and the other intelligence leaders, made earlier this month to the Senate Intelligence Committee.” (Source: Politico)

Russia compromised seven state election systems prior to the 2016 election. Systems in Alaska, Arizona, California, Florida, Illinois, Texas, and Wisconsin were compromised by Russian-backed covert operatives prior to the 2016 election. While no votes were altered, “[t]he officials say systems in the seven states were compromised in a variety of ways, with some breaches more serious than others, from entry into state websites to penetration of actual voter registration databases.” (Source: NBC News)

SEC: Selling shares before a breach is disclosed is a no-no. New guidance from the Securities and Exchange Commission will prohibit directors and officers from selling company shares after a breach is discovered, but before it has been disclosed to the public. The guidance also reinforces prior guidance by stating “that all companies must inform investors in a timely fashion of all material cybersecurity risks.” (Source: Bank Info Security)

Russia hacked the Olympics. U.S. intelligence officials have confirmed that “Russian spies hacked several hundred computers used by authorities at the 2018 Winter Olympic Games in South Korea …They did so while trying to make it appear as though the intrusion was conducted by North Korea, what is known as a ‘false-flag’ operation.” (Source: Washington Post)

Events

March 25-26 – IAPP Global Privacy Summit, Washington, DC
Later this month, privacy experts and regulators will gather at the IAPP’s Global privacy summit in Washington to discuss and learn about the most pressing issues of the day.

National Consumers League
Published March 8, 2018

The #DataInsecurity Digest | Issue 62

February 21, 2018/by

Data security takes top billing at FTC Commissioners’ confirmation hearing

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s Note: Data security was a frequent topic of discussion at a confirmation hearing for a slate of new FTC commissioners. Incoming chairman Joe Simons expressed concern over the FTC’s inability to fine companies that mismanage consumers’ data and reiterated the agency’s long-standing call for Congress to grant it civil penalty authority.

The Equifax data breach is thought to be even more expansive than previously thought. Investigators are now saying that tax identification numbers, as well as additional drivers licence information, may also have been compromised. The latest revelation is fueling fears of the potential for widespread tax identity theft as tax season shifts into high gear. A new report from Sen. Elizabeth Warren that the Equifax breach also compromised passport numbers is being disputed by the company. Finally, the House Financial Services committee’s forthcoming data breach “discussion draft” bill is giving consumer advocates heartburn due to the bill’s expected preemption of state data breach bills.

And now, on to the clips!

—————–

FTC Chairman nominee requests civil penalty authority in nomination hearing. In his confirmation hearing, Joe Simons commented that “[o]ne of the things that I‘m extremely concerned about is whether the FTC has sufficient authority regarding data breaches.” @dibartz reports that Simons asked “lawmakers to consider giving the agency the authority to fine companies.” (Source: Reuters)

Equifax data breach more damaging than originally thought; may serve as catalyst for tax identity fraud. Investigators already knew that 145 million Americans had their Social Security numbers, birthdays, driver’s license numbers, and addresses compromised. Now, however, the trove of compromised data is thought to also include tax ID numbers and driver’s license states and issuing dates. @davidzmorris reports: “The additional data could make it even easier for hackers to open credit lines or otherwise exploit victim’s identities. The theft of tax ID numbers is particularly concerning, since it may increase the risk of fraudulent tax filings.” (Source: Fortune)

Equifax breach allegedly compromised passport information too. Last week, Sen. Elizabeth Warren’s (D-MA) office issued a report that found that “Equifax failed to disclose the fact that the hackers gained access to consumers’ passport numbers.” Equifax is disputing the accusation. (Source: Wall Street Journal)

With state primaries less than a month away, efforts to secure elections continue to lag. @fbajak reports that while “14 states and three local election agencies have so far asked for detailed vulnerability assessments offered by the Department of Homeland Security… only five of the two-week examinations are complete…” Further complicating things, “fewer than half of the estimated 50 senior state elections officials who requested federal security clearances have received them, DHS says. That can hinder information sharing designed to help states deal with election disruptions.” (Source: Associated Press)

Quick hit: White House estimates that malicious cyber activity cost the United States between $57 and $109 billion in 2016 alone. (Source: Reuters)

Winter Olympics hacked. “On Feb. 9, the official Winter Olympics website went down for several hours, causing a disruption to ticket sales and downloads during the opening ceremony. Localized Wi-Fi networks surrounding the games in South Korea also reportedly became temporarily unavailable in the preceding hours…” Investigators believe that “hackers compromised the main IT service provider for the Winter Olympic Games months before last week’s highly publicized cyberattack.” (Source: Cyber Scoop)

House Financial Service committee looks into data breach notification requirements. With a discussion draft of a data breach notification bill due out shortly, few details have been provided by lawmakers. “[Rep. Blaine] Luetkemeyer, who said Americans are clamoring for prompt notification, gave no indication what time limits could be placed in the bill for businesses to tell consumers their information had been stolen,” writes @tedknutsondc. Consumer advocates including @edmpirg warned that the forthcoming bill will most likely help wrongdoers, not consumers, by preempting state action. (Source: Fortune)

Report watch: Federal contractors have significantly worse data security that the agencies they serve. In a new report, @bitsight gave 50 percent of federal contractors a grade below a C for protective technology and also found that the security performance of federal agencies is significantly better than the contractors they hire. (Source: Bitsight)

Events

February 28, 2018 – Privacy Con 2018, Washington, DC
In February, the FTC will host its third Privacy Con, convening a broad array of academics, researchers, consumer advocates, government officials, and industry representatives to address the privacy implications of emerging technologies.

National Consumers League
Published February 22, 2018

The #DataInsecurity Digest | Issue 61

February 7, 2018/by

2017 found to be worst year ever for data breaches

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s Note: Just because cybersecurity did not receive a mention in President Trump’s State of the Union, did not mean that data breaches were not garnering headlines in recent weeks. 2017 was found to be the worst year for data breaches ever by the Online Trust Alliance. Nearly half of American organizations were breached in the past 12 months, up from 24 percent in 2016, according to Thales. Other big news this week comes from our colleagues at Consumer Reports, who published the first reviews of smart TVs using the organization’s new Digital Standard for privacy and security. CR’s tests found that leading smart TVs have significant security vulnerabilities that could allow hackers to change channels, raise volumes, or play disturbing YouTube content.

All this comes with fallout from the Meltdown and Spectre vulnerabilities continuing to brew, with many key cybersecurity vacancies remaining in the Trump Administration, and with reports of the new CFPB director abandoning the agency’s investigation of the Equifax mega-breach.

And now, on to the clips!

—————–

2017 declared the worst year for data breaches ever. The Online Trust Alliance released its annual report, finding that ransomware incidents doubled from 2016 to 2017 and cost consumers and businesses $5 billion. “Surprising no one, 2017 marked another ‘worst year ever’ in personal data breaches and cyber incidents around the world.” The report also found that 93 percent of data breaches could have been avoided. (Source: Online Trust Alliance)

Number of breached organizations nearly doubled in 12 months. A survey conducted by Thales found that, in the last 12 months, 46 percent of U.S. organizations experienced a breach. This is a significant increase from the 24 percent of organizations that were breached in 2016. (Source: Thales)

Lawmakers take aim at Uber. On Tuesday, “Democrats and Republicans alike needled the ride-hailing company for withholding information even as it faced a federal investigation for its privacy and security practices.” Ranking Member Bill Nelson (D-FL) cautioned against current legislative efforts to weaken data security: “better for Congress to pass no bill than to pass a bill that provides less protections to consumers compared to the status quo.” (Source: The Hill)

Smart TVs vulnerable to hacking. In the first use of its new Digital Standard for privacy and security, our colleagues at Consumer Reports have published the findings of their tests on leading “smart” TVs. The results weren’t pretty, particularly for TVs using the Roku platform: “Roku devices have a totally unsecured remote control API enabled by default,” said Eason Goodale, [CR partner] Disconnect’s lead engineer. “This means that even extremely unsophisticated hackers can take control of Rokus. It’s less of a locked door and more of a see-through curtain next to a neon ‘We’re open!’ sign.” (Source: Consumer Reports)

Consumers Union: Report underscores need for Congress to act on data security. Consumers Union, the advocacy arm of Consumer Reports, used the findings of the magazine’s connected TV report to press for Congressional action on data security standards. “Congress needs to pass data security standards for connected products, and federal regulators need to step up and hold companies accountable for the privacy, security and safety of these products,” said CU’s @JustinBrookman. “For years, consumers have had their behavior tracked when they’re online or using their smartphones. But I don’t think a lot of people expect their television to be watching what they do.” (Source: Consumers Union)

More than $1 million stolen from U.S. ATMs. “Jackpotting”–the hijacking of ATMs by hackers to spit out cash much like a slot machine–has long been a problem for European banks. Last week however, the problem arrived in the United States with a half-dozen incidents. “The spate of attacks represented the first widespread jackpotting activity in the United States,” said Matthew O‘Neill, a special agent for the Secret Service. “Previous campaigns have been spotted in parts of Europe and Latin America in recent years. It was just a matter of time until it hit our shores.” (Source: Reuters)

Researchers have found 139 different types of malware designed to exploit Meltdown and Spectre. This is a significant increase from reports in January, when researchers found 77 malware samples. @EduardKovacs reports that, “while a majority of the samples appear to be in the testing phase, we could soon start seeing attacks.” (Source: Security Week)

Quick hit: Intel working “around the clock” to solve Spectre and Meltdown security flaws. Intel informed investors in a quarterly earnings call that it plans to “release updated chips later this year to provide a long-term solution.” (Source: Washington Post)

Acting CFPB director believed to be canceling Equifax investigation. @PatrickMRucker is reporting that acting director Mick Mulvaney is pulling back an investigation into Equifax’s behavior, which led to 143 million Americans having their most personal data compromised. Mulvaney “has not ordered subpoenas against Equifax or sought sworn testimony from executives, routine steps when launching a full-scale probe. Meanwhile the CFPB has shelved plans for on-the-ground tests of how Equifax protects data, an idea backed by Cordray.” (Source: Reuters)

Fitness trackers give away locations of secret U.S. military bases. It was recently revealed that, back in November, a social network for athletes called Strava released a heat map showing every run ever uploaded to its network. The map was “detailed enough that it potentially gives away extremely sensitive information… . In locations like Afghanistan, Djibouti and Syria, the users of Strava seem to be almost exclusively foreign military personnel, meaning that bases stand out brightly.” (Source: The Guardian)

After one year in office, many key cybersecurity posts remain unfilled by Trump. “About one-third of agency chief information security officers hold their jobs on an acting basis. The same is true for the federal chief information officer, the federal chief information security officer and the two top posts in the Homeland Security Department’s cybersecurity and infrastructure protection division, which is substantially responsible for the civilian government’s cybersecurity.” According to former officials, the vacancies are damaging “efforts to upgrade the government’s aging IT infrastructure and could endanger national security.” (Source: NextGov)

Japan grapples with fallout from a $534 million cyberheist. Authorities in Japan are investigating the cryptocurrency trading company Coincheck after “hackers stole 58 billion yen ($534 million) of NEM coins, among the most popular digital currencies in the world.” (Source: Reuters)

Events

National Consumers League
Published February 8, 2018

The #DataInsecurity Digest | Issue 60

January 24, 2018/by

Issue 60 | January 25, 2018

Federal shutdown impact on state election systems’ much-needed repairs; continued fallout from Spectre, Meltdown

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s Note: Preparations for securing election systems were an underreported casualty of the federal government shutdown, delaying much-needed fixes to critical systems in advance of the 2018 mid-term elections. Fallout from the Spectre and Meltdown discoveries continued this week, with some experts predicting both a weaponization of the vulnerabilities in the coming days and that Spectre-related bugs will continue to surface over the next five years. A leaked Pentagon security document, which is still awaiting President Trump’s approval, would change U.S. policy to allow for the use of nuclear weapons to retaliate against severe cyber attacks.

And now, on to the clips!

—————–

Government shutdown slows election infrastructure security efforts. Although the government was only shut down for 60 hours, DHS was forced to “suspend the weekly digital scans it was conducting of states’ election systems to suss out flaws.” In addition, “the Election Assistance Commission canceled two important meetings this week, with the agency’s small staff mostly furloughed, raising the prospect that new voting security guidelines might be delayed. With the 2018 primary season less than two months away, digital security advocates said such moves were troubling… EAC officials are now working to reschedule the axed meetings ‘as quickly as we can.’” However, as a former DHS official told @MorningCybersec, “Any interruption in that process is a setback.” (Source: Politico)

Spectre fallout may continue for years. “We’ll see Spectre-related bugs for the next five years,” commented John Michener, the chief scientist at the security consulting firm Casaba Security. As a side effect of fixing a majority of the vulnerabilities, “millions of Windows PCs and servers around the world, even those that are just a few years old, could get noticeably more sluggish—as much as 20 percent slower in some cases.” (Source: Wired)

Spectre and Meltdown-related attacks are on the horizon. @drpizza comments that “it can’t be long now before real-world attacks use [the vulnerabilities] to locate sensitive data or break out of sandboxes. The race is truly on, and it’s by no means guaranteed that the buggy drivers and microcode will be fixed before malicious hackers start exploiting Meltdown.” (Source: Ars Technica)

Quick hit: Meltdown patches are destabilizing industrial control systems. @jleyden reports that the Meltdown patches are “accompanied by even more irksome stability problems on some systems.” One update, for instance, “caused systems to become unbootable.” (Source: The Register)

Pentagon suggests using nuclear weapons to respond to cyber attacks. Last week, @SangerNYT and @WilliamJBroad reported that “a newly drafted United States nuclear strategy that has been sent to President Trump for approval would permit the use of nuclear weapons to respond to a wide range of devastating but non-nuclear attacks on American infrastructure, including what current and former government officials described as the most crippling kind of cyberattacks.” (Source: New York Times)

Uber shows us just how fine the line between a bug bounty program reward and a ransom payout can be. @nicoleperlroth and @MikeIsaac provided a glimpse of the exchanges between Uber and its hacker by publishing email threads. While Uber treated the hacker as a participant of its bug bounty program and “thanked the hacker for helping the company fix the oversight. In two emails, Preacher’s (the hacker’s nickname) motivations appeared to veer closer toward blackmail. In one, he demanded ‘high compensation’ for his findings. After Mr. Fletcher said the company’s maximum bounty was $10,000, Preacher said he and his team would only accept ‘six digits.’” (Source: New York Times)

Morning Consult poll: 67 percent of Americans are concerned about driverless cars’ cybersecurity. The uneasiness over the cybersecurity of driverless cars is also shared by Senator Ed Markey (D-MA). “If we are to imagine a world where massive 18-wheelers carrying hazardous materials and minivans full of children can drive themselves, it shouldn’t be a stretch of the imagination to envision that these vehicles may be targets of cyberattacks and safety vulnerabilities.” (Source: Morning Consult)

Aetna pays $17.1 million to settle data breach suit. @DougOlenick reports that “the deal will resolve the claims made by Aetna customers in 23 states who were notified by the company that their HIV prescription notifications were sent in envelopes with a clear address window, possibly enabling an unauthorised party to view the contents, according to a Tripwire report.” (Source: SC Media)

Events

National Consumers League
Published January 25, 2018

The #DataInsecurity Digest | Issue 59

January 10, 2018/by

Issue 59 | January 11, 2018

#DataInsecurity Digest: Discovery of major vulnerabilities ushers in 2018

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s Note: Happy New Year and welcome to the first #DataInsecurity Digest of 2018! The year started off with a bang as news of critical vulnerabilities in nearly every electronic device shook the data security world. The vulnerabilities, known as Spectre and Meltdown, have no easy repair/patch available, though no attacks exploiting the vulnerabilities have yet been reported. Nonetheless, we expect the news to serve as a catalyst for litigation in the coming months. As if this were not enough, compromised personal data of Florida Medicaid recipients and DHS employees also made headlines, along with the revelation that Romanian hackers were able to disable Washington, DC security cameras for days prior to the inauguration of President Trump in January 2017.

And now, on to the clips!

—————–

Spectre/Meltdown: Majority of world’s computers may be compromised. Security researchers have discovered two massive security flaws in Intel, AMD, and ARM-based processors called Meltdown and Spectre. The security vulnerabilities “could allow hackers to steal the entire memory contents of computers, including mobile devices, personal computers and servers running in so-called cloud computer networks…There is no easy fix for Spectre, which could require redesigning the processors, according to researchers. As for Meltdown, the software patch needed to fix the issue could slow down computers by as much as 30 percent.” Paul Kocher, a key researcher who helped discover the vulnerabilities, commented that “we’ve really screwed up… There’s been this desire from the industry to be as fast as possible and secure at the same time. Spectre shows that you cannot have both.” (Source: New York Times)

The flaw will affect almost a decade worth of Intel computer chips. @HowellONeill reports that “the fix requires a fundamental redesign of the operating system kernel, the software that manages a machine’s resources. It’s meant to be nearly all-powerful and all-secure. This flaw renders it plainly vulnerable across platforms.” (Source: Cyber Scoop)

Apple users are victims too. Apple informed users that while “there are no known exploits impacting customers at this time,” all iPhones, iPads, and Mac computers are affected by the recently disclosed processor flaws. (Source: CNN)

At least three class action lawsuits have been filed against Intel. Class action suits in California, Oregon, and Indiana are expected to be followed by others in the coming days. “All three cite the security vulnerability and Intel’s delay in public disclosure from when it was first notified by researchers of the flaws in June. … The plaintiffs also cite the alleged computer slowdown that will be caused by the fixes needed to address the security concerns…” (Source: The Guardian)

Intel CEO sold off most of his stock after learning of massive security flaw. Intel CEO Brian Krzanich, “sold the majority of his company stock in November, several months after the company was alerted to the flaws…” but before the failure was made public. “Krzanich sold off all but 250,000 of his Intel shares—the minimum number he’s required to hold per his employee agreement.” (Source: Quartz)

Hackers took over DC surveillance cameras prior to inauguration. A recently unsealed criminal complaint revealed that, just prior to President Trump’s inauguration, Romanian hackers took over two-thirds of the District of Columbia’s outdoor surveillance cameras. The attack “affected 123 of the DC police department’s 187 outdoor surveillance cameras, leaving them unable to record for several days.” (Source: Washington Post)

Breach du jour: 30,000 Florida Medicaid records. The breach came about due to a malicious phishing email attack. As a result of the breach, “hackers may have partly or fully accessed the enrollees’ full names, Medicaid ID numbers, birthdates, addresses, diagnoses, medical conditions and Social Security numbers.” (Source: Associated Press)

Breach du jour part deux: 247,000 Homeland Security Department employees and non-employees. Last week, authorities confirmed previous reports that DHS suffered a data breach in 2014. They did not detail what personal information was compromised in the breach but revealed that the “personal information on 247,167 Homeland Security employees as well as…” an undisclosed number of “…non-employees who were subjects, witnesses or complainants in inspector general investigations between 2002 and 2014,” had been compromised as well. (Source: Next Gov)

Opinion: The end of Net Neutrality could worsen data security. @TonyAtESET contemplates how the end of net neutrality “could put many devices and their users’ critical data at risk.” (Source: We Live Security)

Events

National Consumers League
Published January 11, 2018

Health Advisory Council Dec. 2017 meeting minutes

December 15, 2017/by

Discussion Highlights:
Fireside Chat between FDA Commissioner Scott Gottlieb and NCL Executive Director Sally Greenberg

Q: How does the FDA balance facilitating the timely review and approval of new drugs and medical technologies while ensuring their safety and effectiveness?

A: Commissioner Gottlieb explained that it is possible to get products to market more quickly while ensuring their safety and efficacy. Saying “it’s not a zero sum game,” Dr. Gottlieb noted that FDA can make the product review process more timely and efficient without sacrificing safety and effectiveness. FDA is focused on ensuring scientifically rigorous product reviews.

Q: A major area of focus for you as Commissioner has been encouraging competition in order to lower drug costs. What are some of the FDA’s initiatives to spur competition in the marketplace?

A: Commissioner Gottlieb stated that he supports market-based pricing in order to encourage innovation. However, he recognized that it is important to preserve the careful balance struck by the Hatch-Waxman Act between access and innovation. Dr. Gottlieb expressed concern that some innovator companies have been gaming the system in order to deliberately slow down the public availability of generic drugs. In order to spur competition in the marketplace, FDA is taking a number of actions, including improving the efficiency of FDA’s generic drug review process so that more generics can be approved during the first review cycle; prioritizing review of ANDAs for those drugs that do not currently have an approved ANDA; and developing new guidances on drug-device combinations and the development of generic versions of complex drugs.

Q: We know that in an effort to save money, many consumers search online for cheaper drugs, making themselves vulnerable to counterfeit drugs being sold by rogue online pharmacies. A few months ago, FDA cracked down on hundreds of these websites, particularly those that are selling opioids through the U.S. Postal Service to U.S. consumers. Could you talk a bit about this operation and FDA’s efforts to protect consumers from counterfeit drugs?

A: Commissioner Gottlieb referenced Operation Pangea X, in which FDA, in partnership with international regulatory and law enforcement agencies, recently took action against more than 500 websites that illegally sell potentially dangerous, unapproved versions of prescription medicines, including opioids, antibiotics, and injectable epinephrine products to American consumers. To combat counterfeit drugs, FDA’s criminal investigators are policing the dark web. In addition, FDA has recently stepped up its inspections of International Mail Facilities, devoting 3 times as many FTEs and inspecting 4 times as many packages. However, Dr. Gottlieb expressed frustration that FDA is not able to pull and test every suspicious package to prove it is illicit, so a certain amount of counterfeit drugs do make it through. Dr. Gottlieb called for legislative changes to FDA’s seizure authority to allow the agency to seize and test a suspicious package and then be able to destroy all of the same packages without having to test every single one.

Q: In August, NCL facilitated a meeting for advocates including WomenAgainstAlzheimer’s and AARP with Dr. Woodcock and other CDER staff to discuss the state of the Alzheimer’s drug pipeline and ways to encourage the development of Alzheimer’s treatments. NCL was pleased to hear your remarks on the topic indicating that FDA would be clarifying the guidance for the development of safe and effective Alzheimer’s treatments. Can you elaborate on that as well as steps FDA can take to encourage the development of drugs for diseases that currently have no treatments?

A: Dr. Gottlieb explained that as a science-based organization, FDA is committed to modernizing its review processes and helping sponsors to lower the costs of drug development. FDA plans to issue a guidance for the development of safe and effective Alzheimer’s treatments. Dr. Gottlieb also explained how advocates can help the FDA to develop guidances in specific disease areas. For example, the ALS Association developed a guidance on ALS drug development that it shared with the FDA. Because the guidance was so good, FDA was able to use it to form the basis for its own ALS guidance, which it issued sooner than would otherwise have been possible.

Q: Can you comment on cosmetics reform?

A: Dr. Gottlieb explained that when he was Deputy Commissioner of the FDA, there was a proposal to eliminate the FDA’s cosmetics program. Rather than abolishing the Office of Cosmetics, however, Dr. Gottlieb decided to increase the number of FTEs in the Office from 10 to 20, which is about where it stands today. Recognizing that cosmetics are now more complex and carry more risk, Dr. Gottlieb acknowledged that FDA could use more resources and tools to ensure that cosmetics are safe and properly labeled. However, he stressed that OTC monograph reform is a higher priority for the agency. He doesn’t want to see the cosmetics legislation prevent OTC reform from moving forward in Congress. Dr. Gottlieb foresees a longer timeline for cosmetics legislation to pass.

Q: Is FDA open to receiving the input of independent pharmacies into the agency’s implementation of the compounding guidance?

A: Commissioner Gottlieb noted that the compounding guidance is designed to address those compounders who are inappropriately manufacturing drugs. He explained that FDA has been considering how much leeway it is able to give to pharmacies, and plans to issue a policy in early January that will be more accommodating.

Q: How has your experience as a cancer survivor influenced you as a policy maker and as a physician?

A: Commissioner Gottlieb was very candid about his experience as a cancer patient. As a physician, he was fortunate to have self-diagnosed lymphoma very early when he had a 90% – 95% chance of a complete cure. Investigating all the treatment options available to him, Dr. Gottlieb chose ABVD chemotherapy and Rituxan, and was able to avoid radiation, which would have increased the chance of developing a second cancer. Despite the high likelihood of a complete cure, Dr. Gottlieb said that uncertainty was the hardest part for him. This experience changed how he talked to his patients.

Health Advisory Council Newsletter | 2017 Q4

December 13, 2017/by

Health Advisory Council Newsletter Winter 2017

Welcome to the Q4 issue of the Health Advisory Council Newsletter. This quarter, NCL and Council Members have been active on many fronts. Please see our policy updates, new Q&A’s with Pfizer and the American Society of Health-System Pharmacists, Member updates, and more.

Let’s keep the conversation going in 2018!
We hope you will renew your Health Advisory Council membership for 2018 as NCL continues to convene diverse members of the healthcare community to share perspectives and insights, identify common interests, and support NCL’s work in health-related consumer education and advocacy. Thanks to your support in 2017, we were able to work and advocate on a variety of important health issues. We look forward to continuing the conversation with you and others in 2018!

ICYMI: Meeting with special guest FDA Commissioner Scott Gottlieb

On December 6, 2017 NCL hosted its end-of-year Health Advisory Council meeting and holiday reception featuring a fireside chat with NCL Executive Director Sally Greenberg and FDA Commissioner Scott Gottlieb. Topics of discussion included making the FDA product review cycle more efficient; preserving the balance between innovation and competition struck by the Hatch-Waxman Act; FDA’s actions to combat counterfeit drugs; steps FDA can take to encourage the development of drugs for Alzheimer’s and other diseases that currently have no treatments; and how Commissioner Gottlieb’s experience as a cancer patient influenced him as a policymaker and a physician. In addition to the discussion with the Commissioner, the meeting also included a report on NCL’s health programs and activities, as well as the opportunity for Members to network with each other and share updates on their initiatives and priorities.

Minutes are available here.

NCL health policy at work

Counterfeit drugs

NCL is pleased to announce our Counterfeit Drugs Consumer Education Project that we plan to launch in 2018. Working together, NCL’s Health and Fraud teams will develop consumer education content to be housed at NCL’s Fraud.org. The content will focus on the following elements:

Examining the threat and sharing real life situations related to the online purchase of unsafe counterfeit medications;
Redirecting consumers to safe purchasing websites;
Educating consumers on smart purchasing practices and highlighting opportunities for cost savings, including practical tools, tips, and websites; and
Providing a channel for consumers to access enforcement bodies such as the FDA, MedWatch, and other appropriate resources, in order for them to report their personal medication concern to the proper authorities.

NCL expresses its appreciation to Eli Lilly for its initial grant as the first founding member in support of this project, and is looking for additional partners. Please contact NCL’s Senior Director of Development Lee Granados at leeg@nclnet.org about how your organization can join this resource-rich platform to educate consumers on making smart decisions.

Click here for more NCL health policy updates.

Member spotlight

Get to know Health Advisory Council Members – Pfizer and American Society of Health-System Pharmacists – with new Q&A’s.

Updates on Member programs

Get the latest updates on programs, policy, and initiatives from our Members, including Astellas, Duke University, USP, and many more.

We want to hear from you!

If you have time-sensitive information and updates you’d like to share with the Health Advisory Council in between NCL’s quarterly newsletters, please contact Karin Bolte (karinb@nclnet.org) or Janay Johnson (janayj@nclnet.org), and we will be happy to forward your materials to the Council membership. We also encourage you to contact us with your ideas and suggestions for Council activities.

_______________

National Consumers League
Published December 19, 2017

Health Advisory Council Member Updates | Winter 2017

December 13, 2017/by

Alliance for Aging Research
The Alliance for Aging Research has released a number of new educational resources including:

A Spanish version of Taking a Closer Look at AMD was released this Fall. The film gives an overview of this leading cause of vision loss in the U.S., including risk factors, symptoms, diagnosis, treatment options, and the role of nutrition and lifestyle in protecting eyesight. It also addresses some of the challenges of living with AMD and encourages those diagnosed with the disease to take control of their sight. The film can be viewed on YouTube and downloaded from Vimeo for use off-line.

Expanding on the Our Best Shot campaign, the Alliance has added new resources to educate older adults about the importance of vaccination. In 2016, the Alliance released a workshop kit with all of the resources necessary for community leaders to put on an educational workshop. This also included a take home Quick Guide to Vaccination for participants, and an educational animated film. This year, the film was translated into Spanish, as was the Quick Guide, and additional resources (Truth About Vaccines and Medicare Wellness Wisdom) help debunk common myths and misconceptions and educate older adults about preventive services available through Medicare—including vaccines.

Last February, the Alliance and 29 other partner organizations helped establish the first-ever National Heart Valve Disease Awareness Day. The campaign reached millions of Americans through social media, a Hill briefing, a Twitter Chat, and more. This year’s campaign will continue to reach out through traditional and social media, and will provide resources for hospitals and heart centers hosting Valve Disease Day events. To learn more and become a partner visit www.ValveDiseaseDay.org.

Additional Alliance initiatives include a pocket film on the importance of volunteering for a clinical trial; information on the safe use, storage, and disposal of OTC pain medications; and an upcoming White Paper on mental health in older adults.

AMAG Pharmaceuticals
In recent months, AMAG Pharmaceuticals launched Intrarosa™ (prasterone), the first and only FDA-approved, local non-estrogen product for the treatment of moderate to severe dyspareunia (pain during intercourse), a symptom of vulvar and vaginal atrophy (VVA), due to menopause. Nearly 32 million women (approximately half of all post-menopausal women in the United States) suffer from symptoms of VVA and, of those women, between 10-13 million are suffering from moderate to severe dyspareunia. AMAG has also continued to work closely with leading organizations in the women’s health space – including NCL – to consider the most effective ways to bring down barriers to better outcomes in women’s sexual health and with organizations in other key health areas — such as maternal and child health, stem cell preservation, anemia, and oncology – to help educate patients and providers on unmet needs and solutions in areas specific to our products.

America’s Health Insurance Plans
The Modern Medicaid Alliance continues to work with its partners like NCL to educate policymakers and the public about the value of Medicaid across the country. This summer, the Alliance unveiled the Medicaid Solutions series, highlighting innovative approaches organizations are taking to increase quality, efficiency, and affordability for people covered by Medicaid. The series focuses on how distinct populations are benefiting from Medicaid, including school children, newborns, and those with disabilities.

The Alliance also launched the MMA Medicaid Dashboard – an interactive online tool and database that tracks national and state level data, local program details, statistics, and public polling on Medicaid. The Dashboard is a valuable resource that creates a “one stop shop” for Medicaid data.

This fall, MMA has been busy promoting and advocating on the value of the Children’s Health Insurance Program (CHIP).The Alliance released a fact sheet to help bring individuals up to speed on the program, and continues to advocate for reauthorization through all social media channels.

In addition to CHIP, AHIP has been actively promoting Open Enrollment, and educating consumers on the value of private health insurance.

American Society of Health-System Pharmacists
The American Society of Health-System Pharmacists (ASHP) has been working to address the opioid crisis and drug shortages that could adversely affect patients, including the current acute shortage of small-volume parenteral solutions.

Association for Accessible Medicines
The Association for Accessible Medicines (AAM) and its Biosimilars Council applauded CMS’s recent decision to revise its current biosimilars reimbursement policy in Medicare Part B, as part of the Revisions to Payment Policies under the Physician Fee Schedule and Other Revisions to Part B for CY 2018 final rule. Led by the Council, a variety of stakeholders have been urging the agency to provide each non-interchangeable biosimilar with a unique billing code and payment rate. A recent report by The Moran Company finds providing separate codes would save the federal government $11.4 billion over the next 10 years.

AAM and the Biosimilars Council are also working with stakeholders to urge Congress to include biosimilars in the Medicare Part D Coverage Gap Discount Program. Biosimilars present a significant opportunity for patient and program savings in the Medicare Part D program. However, under current law, patients in the Part D coverage gap face significant barriers to access for biosimilar options, and may actually be forced into using higher priced biologics. The result: patients paying higher out-of-pocket costs for lower-cost medicines, and physicians having fewer alternatives to prescribing higher priced medicines. Congress should amend the Part D program so that it treats biosimilars and brand biologics equally, so that patients will not be forced into paying for higher-cost treatments. This change would also lower Part D program spending and provide the federal government with at least $1 billion in savings over ten years.

Astellas
Astellas has been focused on implementation of the 21^st Century Cures Act and promoting regenerative medicine and the appropriate use of real world evidence.

Consumer Healthcare Products Association (CHPA) Educational Foundation
Reminding Parents and Caregivers about Candy Confusion during Halloween

Working with the Centers for Disease Control and Prevention (CDC) and Dr. Dan Budnitz, the Up and Away campaign leveraged Halloween to promote the importance of safe medicine storage and reminding parents about how easily children can confuse medicine for candy. Working with healthcare provider spokespersons, as well as state poison control center representatives, the campaign conducted an earned media pitch to national and local media markets, resulting in 23 hits in Seattle, Atlanta, Tallahassee, Eastern Washington State, and Miami. The efforts secured solid broadcast, online, and radio coverage to 645,000 TV viewers, 24,000 readers, and 2,500 radio listeners.

Council for Affordable Health Coverage
The Council for Affordable Health Coverage (CAHC) hosted a national summit on healthcare costs entitled, “The Price of Good Health” on November 1, 2017 at the Newseum in Washington, D.C with speakers including Senator Bill Cassidy (R-LA), Congressman John Larson (D-CT), Acting HHS Secretary Eric Hargan, Aetna CEO Mark Bertolini, and others. A repository of videos, pictures, and other materials from the event is available on CAHC’s website here, and CAHC President Joel White’s blog on the takeaways from the conference and next steps for CAHC can be read here.

More recently, CAHC sent a “holiday wish list” to Members of Congress and staff, urging action on a bold set of legislative priorities before the end of the year. The agenda includes a reauthorization of the Children’s Health Insurance Program (CHIP), market stabilization measures like the Alexander-Murray compromise bill, and reforms to improve prescription drug access and medication adherence like those championed in CAHC’s Prescriptions for Affordability initiative and CAHC’s medication adherence campaign, Prescriptions for a Healthy America (P4HA) (click here to read our white paper on the need for an adherence-specific safe harbor to the anti-kickback statute).

P4HA has also been advocating to improve data sharing in order to promote medication adherence. Language included in the Senate-passed CHRONIC Care Act could help, by breaking down silos in a patient’s continuum of care that allow medication mismanagement to fester unseen. Specifically, the provision of the bill — mirrored in a standalone House bill authored by Rep. Lynn Jenkins (R-KS) — would improve care coordination by establishing a process for Medicare to share information about hospitalizations or physician office visits with Part D prescription drug plans. This gives providers a better opportunity to recognize those most at risk of medication nonadherence and intervene before it is too late.

Duke University

Duke-Margolis Center for Health Policy
The Duke-Margolis Center for Health Policy works to improve health and the value of health care by developing and implementing evidence-based policy solutions locally, nationally, and globally. On December 12, 2017, the Duke-Margolis Center hosted a briefing entitled ”FDA’s New Regulatory Framework for Tobacco and Nicotine: the Role of Medicinal Nicotine,” which featured a keynote address by FDA Commissioner Scott Gottlieb, followed by a panel discussion. The event brought together regulators, public health and addiction experts, and advocacy groups to discuss the FDA’s regulatory approach to medicinal nicotine in more depth, and highlight the key outstanding scientific and policy questions that will need to be addressed to support the development and appropriate use of innovative nicotine replacement therapies.

Medication Adherence Alliance
Duke’s Medication Adherence Alliance works closely with NCL’s Script Your Future campaign, supporting patient engagement and enhancing patient-provider communication to improve medication adherence.

FDA Office of Women’s Health
FDA’s Office of Women’s Health is working on a number of initiatives, including its Diverse Women in Clinical Trials Initiative; College Women’s Campaign; Medicine & Pregnancy education campaign; and women and dependence, focusing on opioids and tobacco use.

Healthcare Distribution Alliance
The Healthcare Distribution Alliance has been focused on implementation of the Drug Quality and Security Act (DQSA) as well as efforts to address the opioid crisis and prescription drug abuse and misuse.

Johnson & Johnson
On November 30, 2017, Johnson & Johnson announced that its Janssen Pharmaceutical Companies together with a consortium of global partners have initiated the first efficacy study for an investigational mosaic HIV-1 preventive vaccine. The Bill & Melinda Gates Foundation and National Institutes of Health are joining forces with Johnson & Johnson to advance the potential prevention option, which is designed to be a “global vaccine” that could prevent a wide range of viral strains responsible for the HIV pandemic.

Momenta Pharmaceuticals
Momenta applauds the recent CMS decision to revise reimbursement policy under Medicare Part B for non-interchangeable biosimilars. CMS recognized in its new policy that non-interchangeable biosimilars are not substitutable at the pharmacy for one another or the reference product. As such they should have separate reimbursement codes to allow for more predictable reimbursement to providers. This facilitates the use of biosimilars, and more importantly, access to affordable medicines by patients.

Mylan
On December 1, 2017, Mylan announced FDA’s approval of Mylan’s Ogivri™ (trastuzumab-dkst), a biosimilar to Herceptin® (trastuzumab), co-developed with Biocon. Ogivri has been approved for all indications included in the label of the reference product, Herceptin, including for the treatment of HER2-overexpressing breast cancer and metastatic stomach cancer (gastric or gastroesophageal junction adenocarcinoma). Mylan CEO Heather Bresch commented: “The approval of Ogivri represents a monumental achievement for Mylan to increase patient access to biosimilars and deliver significant savings to the U.S. healthcare system.”

National Alliance for Caregiving
Join the National Alliance for Caregiving for the 12th Annual National Conference of Caregiver Advocates — The Aging Network’s Largest Non-Elder Stakeholder. The meeting will be hosted in partnership with the American Society on Aging at the Aging in America Conference, on Monday, March 26, 2018 in San Francisco. Presentation topics include: Building Capacity to Support Caregivers Across the Lifespan; Caregiver Friendly Communities; The 21st Century Workforce in a 21st Century Workplace; Mapping the Caregiver Journey; and Workshop: Next Steps for Caregiver Advocacy. For more information, go to http://www.caregiving.org/coalitions/annual-conference/.

National Community Pharmacists Association
The National Community Pharmacists Association (NCPA) is committed to high-quality pharmacist care and to restoring, maintaining, and promoting the health and well-being of the public. NCPA has a particular interest in the Medicare Part D rule proposal, which includes a RFI about providing manufacturer rebates and pharmacy price concessions to the price of a drug at the point of sale. Comments are due to CMS by Jan. 16, 2018.

National Council on Patient Information and Education
An estimated 15% of high school seniors have misused some type of prescription drug, and about one in four young adults aged 18 to 20 report using these medications non-medically at least once in their lives. This means many students are coming to college campuses with exposure to the misuse of prescription drugs or they may experiment at some point during their college career. The FDA’s Office of Women’s Health and NCPIE have teamed up to share educational resources to help college students incorporate safe medicine use into their busy campus life – especially during times of high stress like midterms and final exams. The packet of free medication safety resources includes materials on making healthy medication choices, using medication safely, avoiding the dangers of medication misuse, and a link to NCPIE’s “toolkit” for America’s college campuses, Taking Action to Prevent and Address Prescription Drug Abuse. A new blog, “3 Tips for Safe Medication Use on Campus,” provides tips students can use to make healthy decisions about medication use. Campuses are encouraged to share the blog in their newsletters, on their web page, and on social media. Find the blog and other resources at www.fda.gov/collegewomen.

During NCPIE’s “Talk About Your Medicines” Month (TAYMM) in October, NCPIE partnered with NCPIE Board Member Healthline on a bold social media campaign, #DontMix. The campaign seeks to educate millennials about the potential risks of mixing alcohol and medications. The social media campaign, its companion #DontMix website and news articles – Most Consumers Unaware of Dangers in Mixing Alcohol and Common Drugs and Don’t Mix: Parenting, Pills, and Pinot helped drive awareness of NCPIE’s “Think Before You Drink” TAYMM messages. The #DontMix campaign combines witty, funny, and poignant posts with often hilarious graphics to make its point. For example, socks and sandals don’t mix, cliffs and selfies don’t mix, and neither do alcohol and medications. NCPIE members were notified each week during October with a particular #DontMix graphic and theme that they could share with their members and stakeholders on social media. The graphics which have garnered over 1.3 million views thus far – can also be viewed on the GIPHY DONTMIX Channel.

Network for Excellence in Health Innovation
The Network for Excellent in Health Innovation (NEHI) is dedicated to identifying innovations that improve the quality and lower the costs of health care. Priority issues include medication adherence and evidence-based decision-making, among others.

Pharmaceutical Research and Manufacturers of America (PhRMA)
On November 9, 2017 PhRMA partnered with The Atlantic on Vaccines and Immunity: Examining Modern Medicine, an event that brought together a number of stakeholders to examine the tremendous public health impact of vaccines, dissect challenges facing researchers in driving vaccine innovation, and explore ways to communicate the safety and benefits of vaccines to the public.

PhRMA also released a new report on the impact and value of vaccines, the unique challenges of developing these medicines, and the long-term promise they hold in both preventing and treating disease. The report was released alongside an update to PhRMA’s Medicines in Development series, illustrating the industry’s commitment to vaccines research with over 260 medicines in clinical development across a variety of therapeutic areas, including infectious diseases, cancer, and Alzheimer’s. The new resources can be found here.

USP
On October 23, 2017, USP convened a roundtable of experts from healthcare provider groups, research organizations, patient advocacy groups, government agencies, industry representatives, and others to explore strategies to curb the opioid crisis using public standards. The four approaches being considered are:

Recommendations for effectively and safely storing and disposing of opioid prescriptions in order to help prevent misuse, including how this information should be communicated;

Clear prescription label information to ensure patients understand that a prescribed drug is an opioid and can be addictive;

Easy-to-follow instructions for using naloxone, so that first responders and others (including family, friends, and others who may not be trained healthcare providers) can quickly understand when and how to administer this life-saving antidote; and

New standards for healthcare providers to counsel patients about appropriate use of prescription opioids and how to avoid misuse.

In follow-up to the roundtable, USP will release a report to help inform the USP Healthcare Quality and Safety Expert Committee to develop new, or revise existing, standards related to the opioid crisis. All proposed new or revised standards will be open to public comment for 90 days and USP welcomes additional discussions with a broad base of interested parties.