2016 | Q1 Newsletter | Q & A with Health Advisory Council Members
Leily Saadat-Lajevardi
Senior Manager, OTC Appropriate Use, Johnson & Johnson Consumer Inc., McNeil Consumer Healthcare Division
Q. What is your role?
A. I manage our over-the-counter (OTC) medicine appropriate use efforts and initiatives. The mission of our group is to empower consumers to make the best choices for their OTC self-care by providing them with the necessary information and tools.
Q. Tell us about some of your current initiatives
A. We have several appropriate use initiatives, some that are internally led by Johnson & Johnson Consumer Inc. while others are led by external partners such as NCL. An example of an internal initiative that we launched in Q4 2015 is Every Label Every Time. This initiative is designed to educate consumers about the appropriate use of OTC medicines and the importance of reading and following all medication labels. The campaign highlights recent findings from a new survey of more than 2000 U.S. consumers such as the finding that only one in five consumers re-read the label of an OTC medicine they have used before.
An example of a current external initiative is the LifeSmarts program through our NCL partnership. Johnson & Johnson Consumer Inc. is a supporter of the development of the “Health and Safety” section of LifeSmarts U. As a healthcare company, we believe in the importance of educating future medicators and young adults about the responsible use of medicine.
Q. What is Johnson & Johnson Consumer Inc. doing to change the way people think about and approach healthcare?
A. Some consumers believe that OTC medicines are completely safe and can do no harm. OTCs are safe when used as directed, but if they are not used according to the label, they can cause harm. Our goal is to provide at-risk consumers with a “wake-up call” to choose and use OTCs appropriately so that they and their loved ones can get effective relief safely.
Q. What do you value about membership in NCL’s Health Advisory Council?
A. I value the exchange of ideas and dialogue between the Council members. In the future, I hope there will be more opportunities for partnering with Council members on appropriate use initiatives.
Q. Tell us about some of your partnerships.
A. Research shows that children begin to self-medicate around 11 years old. Unfortunately, when not equipped with the knowledge and information to make safe choices, adolescents may end up doing more harm than good. In 2014 alone, 140,000 cases of medicine exposures reported to poison centers involved children ages 6 to 19.
With this need in mind, Johnson & Johnson Consumer Inc. has supported the development of a free, evidence-based educational program for 5th and 6th graders, focused on medicine safety. The objective is to build a more responsible future medicating population and to build a healthy respect for all medicines, including OTCs, by teaching adolescents at an early age.
The program, “OTC Medicine Safety,” was developed and refined with the help of an expert panel, qualitative testing with teachers and students, and quantitative testing with over 1,200 students. In its fifth year, the program includes comprehensive resources for teachers, school nurses, community leaders, and parents – all of which play a critical role in helping tweens learn about responsible OTC medicine use and storage. All resources are completely free and available online.
Nelufar Mohajeri
Director, Global Stakeholder Engagement, U.S. Pharmacopeial Convention (USP)
Q. Tell us about your work at USP.
A. USP’s mission is to improve global health through the development of public standards and related programs that help ensure the quality, safety, and benefit of medicines and foods. For almost 200 years, USP has developed an extensive network of stakeholders and partners that engage with us to advance USP’s work of setting quality standards for medicines, foods and dietary supplements.
My work at USP focuses on how USP collaborates and engages with a diverse community of stakeholder organizations to impact the public health landscape in the U.S. and abroad. These stakeholders include academic institutions and associations, consumer organizations, governmental bodies, non-governmental bodies, manufacturers, trade associations and professional and scientific associations.
Our interactions with these stakeholders gain in complexity as we engage them in our functions at USP –developing quality standards, advocating for patient safety and safe medication use or promoting global public health, for example – and learn how to find the intersects in mission with these organizations and how to walk shoulder to shoulder as partners to advance policies, agendas, and activities.
Q. What do you love about your job?
A. I have been at USP more than seven years, and there are three distinct areas that fuel my passion for the organization. USP was founded by scientists and practitioners who were passionate about ensuring the quality of medicines for their patients. That passion continues today with a community of more than 1,000 experts who work closely with nearly 1,000 USP scientists and staff to ensure the quality and safety of medicines, dietary supplements and food ingredients in the U.S. and many other countries.
A second remarkable aspect of USP are programs that are little known to the public, but have tremendous impact on global health, such as the Promoting the Quality of Medicines program, a collaboration with the U.S. Agency for International Development (USAID) to build regulatory capacity in many countries. Through this program, USP is working with health authorities and collaborators worldwide to address supply chain issues as well as counterfeit and substandard medicines that plague so many nations.
Another little known program is the Dietary Supplements Verification program, which is a voluntary program for manufacturers of dietary supplements and dietary supplements ingredients to verify the quality of their products.
The third aspect of USP that inspires me is the diversity of staff. At USP, you will find staff representing many different nations. This diversity adds a unique nuance to the collaborative manner in which we work so that different perspectives inform our discussions, our work and our learnings.
Q. What is USP’s role in the public health sector?
A. Scientifically based, public quality standards, like those published in the U.S. Pharmacopeia-National Formulary (USP-NF), have helped ensure the quality and consistency of drugs and drug ingredients sold in the United States for almost two centuries.
Uniform public standards, such as USP’s, make it clear to everyone in industry and regulatory bodies what quality is expected of ingredients and products and what test methods are appropriate to determine whether that quality exists.
Although our standards are referenced in U.S. law, we are not part of government. Our standards are established by experts coming from diverse backgrounds – industry, regulatory agencies, academia and practitioner groups. USP’s experts and staff develop quality standards that provide a uniform point of reference for regulators, manufacturers and consumers.
Q. What public health initiatives is USP currently working on?
A. One example is the work we have developed on prescription container labeling. According to the Institute of Medicine (IOM), 77 million Americans have limited health literacy, and a majority of Americans have difficulty understanding and using health information and services. In 2007, USP started working on a standardized prescription container label with experts in patient safety, health literacy, pharmacy, medicine, human factors research and labeling technology. The goal of the standard (now called General Chapter <17>) was to organize labels in a patient-friendly way, using explicit language to describe dosages and intervals; improve readability with clear formatting; and address those with visual impairments and those with limited English comprehension.
At its 2012 annual meeting, the National Association of Boards of Pharmacy passed a resolution supporting state boards in requiring a standardized prescription container label. As with other healthcare quality standards, enforcement of General Chapter <17> is the decision of individual state boards of pharmacy, which may choose to adopt it into their regulations.
Another public health initiative USP has been engaged in for the past several years is promoting quality standards for dietary supplements. Approximately half of the American population consumes vitamins, minerals or other dietary supplements as part of their health regimen. Yet, because the regulations on dietary supplements are different than those for medicines (dietary supplements are regulated as foods), the quality and safety of these products is often put into question, with frequent reports of products connected to patient harm.
In 2001, USP started its USP Verified program for dietary supplements, which guarantees consumers of these products that what’s on their labels is inside the bottle; that the ingredients are present in the right potency and amount; that the products don’t contain harmful levels of contaminants; and that the products were made according to FDA and USP guidelines, using good manufacturing practices.
The program is voluntary for manufacturers, but we believe that choosing a product with the “USP Verified” Mark on the label provides consumers with an added assurance that the supplement recommended by their physician is of high quality.
Q. What do you value about USP’s participation in the Health Advisory Council?
A. USP’s engagement with the National Consumers League (NCL) and its Health Advisory Council is an important aspect of my work. NCL is a critical organization in the healthcare landscape because of its important work in representing consumer perspectives. Being at NCL’s table is important for USP because it gives us the opportunity to raise awareness of quality medicines, dietary supplements and food ingredients directly to patients and consumers.
The #DataInsecurity Digest | Issue 20
/byIssue 20 | May 10, 2016
By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud
Subscribe here. Tell us what you think.
Editor’s Note: It was another “banner” week for data breaches, with hundreds of millions of compromised email account credentials discovered in a trove made available by a Russian hacker. While the bulk of the cache were for Mail.ru accounts, tens of millions corresponded to Gmail, Yahoo!, and Hotmail accounts. And if that wasn’t enough, we’re hearing about tens of millions of other accounts from online dating services Zoosk and Fling.com, and virtual pet community Neopets being leaked. If you missed World Password Day last week, hopefully this news is the kick in the pants you need to get serious about enabling multi-factor authentication and stop reusing those passwords. But don’t take our word for it, Betty White says MFA is good for you too!
In other data security news, we missed the publication of the bellwether Verizon Data Breach Investigations Report last issue, but never fear! We have the TL:DR version for you in this, our 20th edition of the #DataInsecurity Digest. Finally, don’t forget to read my USA Today piece on the link between the rise in unwanted software infections and identity fraud risk!
And now, on to the clips!
—————–
Should the FTC take a closer look at unwanted software problem? You may have noticed a familiar byline in USA Today last week. *smile* The link between unwanted software — the source of many of those annoying pop-ups consumers see online — and identity fraud is something consumer groups urged the FTC to investigate earlier this year. I write: “…the greatest danger of unwanted software is that it often disables security updates to computer operating systems, Web browsers or other essential software like anti-virus tools. This leaves consumers’ computers especially vulnerable to malware infections, dramatically raising the risk of fraud such as identity theft.” (Source: USA Today)
272.3 million compromised email credentials discovered on cyber black market. Milwaukee-based @holdsecurity, has identified more than 272 million unique compromised email accounts on an online Russian black market, including tens of millions of Gmail, Yahoo!, and Hotmail accounts. The firm, which has played a role in uncovering breaches at JPMorgan, Adobe, and elsewhere, identified the credentials as part of a cache of 1.1 billion records on offer from a Russian hacker. @auchard has the story for Reuters: “Such large-scale data breaches can be used to engineer further break-ins or phishing attacks by reaching the universe of contacts tied to each compromised account, multiplying the risks of financial theft or reputational damage across the web. … Hackers know users cling to favourite passwords, resisting admonitions to change credentials regularly and make them more complex. It’s why attackers reuse old passwords found on one account to try to break into other accounts of the same user.” (Source: Reuters)
Even more accounts hacked – 57.2 million accounts for sale on dark web. Another hack, unrelated to the Russian hack, came to light last week. While as yet unconfirmed, signs point to much of the data coming from online dating service Zoosk. @zackwhittaker has the story for ZDNet: “Hackers last year quietly stole a database containing the details of over 57 million people. The breach has only come to light this week, after the stolen data was put up for sale on the dark web. The breach data contains data spanning three years between 2012 and 2015, including usernames, email addresses, and passwords that were hashed with the MD5 algorithm, which nowadays is easy to crack. Many cell phone numbers and Facebook usernames are also in the cache.” (Source: ZDNet)
Neopets allegedly hacked, too. Virtual pet community Neopets is also getting some unwanted attention over allegations that it lost tens of millions of users’ account credentials, possibly dating as far back as 2014. While details are still sketchy, users typically provide an email address, and provide a limited amount of personal information, such as their gender, country, state, and date of birth during the sign-up process. Neopets has more than 90 millions users, many of which are young children. (Source: Motherboard)
40 million credentials from Fling.com for sale on the dark web too. Motherboard’s @josephfcox’s “Another Day, Another Hack” column is quickly turning into required reading. Last week, he also broke news about a breach at adult dating site Fling.com that may have exposed 40 million records containing “email addresses, usernames, plain text passwords, IP addresses, dates of birth, and more.” According to Cox, “[r]ecords also indicated whether the account was a free or paid version, and what gender and sort of relationships the user was interested in, such as ‘fetish,’ ‘group sex,’ ‘online flirting,’ or ‘other.’” (Source: Motherboard)
NCSA: As if you needed another reason to turn on multi-factor authentication… The Russian email hack news broke, appropriately, on World Password Day. Our colleagues at @StaySafeOnline are using the opportunity to remind everyone that the email address/password combination is no longer safe enough to protect your accounts. Turn on multi-factor authentication! Writes @MKaiserNCSA: “Logging on multiple times daily to our most frequently used accounts seems like second nature, but incidents like this reminds us of the need to be vigilant in protecting our personal online information … A simple, critical first step in this process is securing all email, social media and financial accounts, by making use of available security tools such as multi-factor authentication that provide an additional layer of protection and make it significantly harder for accounts to be accessed by others.” (Source: National Cyber Security Alliance)
Dessert: Even Betty White is getting into the safer password game! Everyone’s favorite Golden Girl is getting in on the multi-factor game. If you watch one thing today, it should be Betty saying “passwords … they annoy the [bleeping] heck out of me.” (Source: Passwordday.org)
TONIGHT: Politico Cocktails and Conversation event focusing on health care breach risk. A tip ‘o the cap to @dandiamond of POLITICO Pulse for alerting us to their great event tonight looking at medical privacy in the age of cyber attacks. The panel will include Brooking’s @niamyaraghi who recently examined the link between the federal government’s meaningful use program and the growth in healthcare data breaches. (RSVP here. Doors open at 5:15pm at the District Architecture Center – 421 7th St. NW Washington, DC).
Republican Study Committee: IRS breach another reason to shut down agency. Last year’s breach at the Internal Revenue Service is now fodder in conservative Republicans quest to shut down the agency. (Source: Forbes)
Heritage: Obama cybersecurity policy efforts “Too Little, Too Late.” The conservative Heritage Foundation is also taking aim at cybersecurity lapses by the Obama Administration. David Shedd writes that the president’s Cybersecurity National Action Plan will do little to address the weaknesses that led to breaches at OPM and the Department of Energy, “I agree with the president as to the need for a national cybersecurity plan. Unfortunately, the evidence points to years of cybersecurity complacency and outright incompetence. The poor-to-failing cybersecurity grades across all federal agencies illustrates that this administration does not have a “record of boosting cybersecurity.” Why should be we confident that this administration will follow through?” (Source: TNS)
Verizon Data Breach Investigations Report points the finger at us humans. One of the key dates on the calendar for data security geeks like us is the annual publication of Verizon’s Data Breach Investigations Report. The report is a must-read. Topline threats continue to include methods that rely on human fallibility – phishing, exploiting weak passwords, and ransomware. “You might say our findings boil down to one common theme — the human element,” said Bryan Sartin, executive director of global security services, Verizon Enterprise Solutions. “Despite advances in information security research and cyber detection solutions and tools, we continue to see many of the same errors we’ve known about for more than a decade now. How do you reconcile that?” (Source: Verizon)
Myers: Paying ransomware crooks only makes the problem worse. @LysaMyers, a security researcher for the ESET firm took to the pages of Passcode to chide those who would pay ransomware scammers to decrypt their files. Writes Myers: “To be sure, it’s a tough decision whether to pay or risk losing data. But paying should never, ever be the first, second, or even third option. There’s something wrong if the working assumption is that businesses, organizations, or individuals just pay without working on a solution to recover the data on their own – or just decide they are going to live without those pictures, files, and documents. And anyone with viable backups should greet cybercriminal’s ransom demands with a smug scoff, and then quickly restore affected files.” (Source: Passcode)
Upcoming events
June 15 – FTC Start with Security – Chicago – Chicago, IL
The FTC’s fourth “Start With Security” event will take place on Wednesday, June 15, 2016, in Chicago, Illinois, and will be co-sponsored by Northwestern Pritzker School of Law. During this one-day event, the FTC will bring together experts who will provide businesses with practical tips and strategies for implementing effective data security.
National Consumers League
Published May 10, 2016
The #DataInsecurity Digest | Issue 19
/byIssue 19 | April 27, 2016
By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud
Subscribe here. Tell us what you think.
Editor’s Note: If you’re a registered voter, it’s time to start worrying about the data that election authorities have about you. Coming on the heels of mega-breaches of voter information in Turkey and the Philippines, authorities in Mexico have confirmed that personal information on all 87 million Mexican voters has been leaked. With U.S. elections around the corner, it’s time to ask how American voters’ information can be secure, given the fact that the government sector just came in dead last in a survey of cyber vulnerabilities.
Is having your personal information hacked a turn-off? The 1.1 million users of beautiful people-only dating site BeautifulPeople.com are about to find out. Given the continued sorry state of data security in the U.S. and elsewhere, it should come as no surprise that 423 million identities were exposed by breaches in 2015, according to Symantec.
In other breach news: Tennessee just got rid of its breach notification law’s encryption safe harbor, making the state’s law the toughest in the country. If you sue mega-breach victim Anthem for damages stemming from the hack, be prepared to have them try and search your computer for security vulnerabilities. Finally, if you’re a Windows user who is still relying on Quicktime as your video player, it’s time to uninstall the old standby, since Apple will no longer be shipping security updates.
And now, on to the clips!
—————–
Symantec: 423 million identities exposed by breaches in 2015. According to security firm Symantec’s annual Internet Security Threat Report, data breaches continue to expose hundreds of millions of consumers to a heightened risk of identity theft. Among the other worrisome findings: a new zero-day vulnerability was discovered every week in 2015, a 125 percent increase from 2014. Other lowlights: more than three-quarters of all websites had unpatched security flaws and the company noted a 35 percent increase in ransomware (H/T @timstarks). (Source: Symantec)
Every Mexican voter just got breached. Security researcher Chris Vickery is at it again. This time, he’s discovered that the entire electoral register of Mexico—names, parents’ names, addresses, and voter registration numbers of 87 million people—were accessible on Amazon Web Services without even a password. Writes @AdamShepherdUK, “While any leak of personal data is bad, this particular example is especially dangerous, according to officials. This is due to Mexico’s problems with kidnapping and gang violence, which could be exacerbated by the revelation.” (Source: CloudPro)
Breached Filipino voter data now searchable online. Last month’s epic hacking of the voter registration system in the Philippines, which exposed more than 55 million citizens, just got worse. That’s because the hacked data—including full names, addresses and passport numbers, fingerprint data, height and weight of voters and maternal and paternal names—is now easily searchable. (Source: WIRED.co.uk)
Are you still beautiful if you get hacked? Dating site BeautifulPeople.com, which bills itself as an “exclusively beautiful community” just lost some of its attractiveness. Data on 1.1 million members, including names, email addresses, encrypted passwords, private messages, geo-location information, and over 100 other individual data attributes such as sexual preferences, drinking habits, hobbies, and favorite movies has ended up on the Dark Web. Writes @campuscodi, “The BeautifulPeople is infamous online because, for many years, it advertised itself as a dating and meeting website for “beautiful people” only. All users had to go through a manual approval process where other site users would vote if they were attractive enough to join the site. In 2009, BeautifulPeople operators were bragging about rejecting 1.8 million from their site. Also, as people aged, lost hair, or gained weight, the website’s staff also regularly removed members deemed not beautiful enough.” (Source: Softpedia)
Quick hit: Ashley Madison class-action plaintiffs must identify themselves, says judge. Something tells me this may limit the number of people willing to come forward. (Source: Reuters)
RAND: Is “breach fatigue” not all it’s cracked up to be? New research from RAND Corporation finds that about a quarter of American adults reported receiving a data breach notification in the past year. However, only 11 percent of those notified said they would stop doing business with the breached entity. And, despite claims by some policymakers that breach notification laws lead to “breach fatigue,” @sciencedaily says the research suggests otherwise. “Surprisingly, 62 percent of consumers reported they accepted offers of free credit monitoring. This counters claims made by others that consumers are experiencing “breach fatigue” — where consumers become desensitized to the notices and either discount them or ignore important information contained in the notices.” (Source: ScienceDaily)
Anthem wanted to search breached plaintiffs’ computers for security flaws. One of last year’s mega-breaches was an insurer Anthem, which exposed 80 million customers’ records. Now, Anthem is trying to shift the blame for harm potentially stemming from the breach on to affected consumers themselves. Writes @HallSd, “Anthem faces multiple lawsuits after a data breach that compromised information for 80 million customers, though it contends that no fraudulent activity has been linked to the breach. Plaintiffs argue otherwise. … Meanwhile, attorneys for Anthem tried to get permission to search the plaintiffs’ computers for security flaws that could have led to identity theft or fraud. The federal court rejected that motion.” (Source: FierceHealthIT)
FBI backs off latest effort to circumvent Apple’s encryption. The FBI’s decision to abandon its efforts to force Apple to break its iPhone encryption in a New York case signals that the FBI is no closer to solving its encryption woes than before. Writing for @verge, @russellbrandom takes a look back at the last few months of Bureau misadventures in court. He writes “The only win the FBI has from the past three months is a secret new method for unlocking iPhones, disclosed to the agency at the close of the San Bernardino case — but in the weeks since then, each new piece of news has made the FBI’s hack look worse. … The FBI’s retreat on Friday means that decision stands, which is bad news for anyone hoping to compel tech companies to unlock their products.” (Source: The Verge)
New Tennessee breach notification law removes encryption safe harbor. Given their role leaders in data breach notification and data security standards lawmaking, it will not be surprising to see groups taking a cue from Tennessee’s new data breach notification law, which will cover breaches of unencrypted AND (for the first time) encrypted data. The law will also add Tennessee to the list of states that mandate a specific time period after a breach is discovered for notice to occur. In Tennessee’s case, the deadline will be 45 days after the beach is discovered. (Source: Davis Wright Tremaine)
Tennessee breach notification law now toughest in the country, could be a model. By removing its encryption safe harbor and mandating a 45 day notification deadline, Tennessee’s new breach notification law makes it the toughest such law in the country, according to legal experts. Writes Jennifer Williams-Alvarez: “Though the law doesn’t require notice without question in all circumstances, it’s clear that companies storing Tennesseans’ information have more to think about when it comes to a data breach. Tennessee is now ‘making a distinction’ between strong and weak encryption, says J. Matt San Roman of Wyatt Tarrant & Combs. That distinction ‘is not being made in other states,’ he says. Many states are putting heightened requirements on companies hit with breaches, so Tennessee’s new law could be a model. ‘It wouldn’t surprise me to see other states following suit,’ says San Roman.” (Source: Corporate Counsel)
Nebraska’s breach notification law gets an update too. Nebraska Gov. Ricketts last week signed in to law a modification to the state data breach notification law. The amended law will now include user name and email address in combination with a password or security question in the definition of “personal information.” The new law also requires notification of the state Attorney General and strengthens the definition of “encrypted” information. (Source: Kelley Drye)
Survey: 47 percent of broadband households concerned about security of connected devices. As consumers embrace the coming world of connected devices, security is a top concern. Writes @ParksAssociates “47 percent of U.S. broadband households are concerned their private information stored on connected devices could be made public. Another 47 percent are worried companies will sell their personal information.” (Source: Parks Associates)
Report: Government sector dead last in cybersecurity. President Obama’s cybersecurity planners have a big job ahead of them, according to risk benchmarking startup SecurityScorecard’s new report. According to @Reuters, “U.S. federal, state and local government agencies rank in last place in cyber security when compared against 17 major private industries, including transportation, retail and healthcare … [t]he analysis … measured the relative security health of government and industries across 10 categories, including vulnerability to malware infections, exposure rates of passwords and susceptibility to social engineering, such as an employee using corporate account information on a public social network.” (Source: Reuters)
Should OPM provide free credit monitoring for life and pay for credit freezes? The breach at OPM exposed incredibly sensitive information of more than 20 million current and former federal employees and federal job applicants. Should OPM be doing to more to protect those exposed to a heightened risk of ID fraud because of the breach? Writing in @FedNewsRadio, federal retirement expert Randy Silvey seems to think so. “As I have already eluded to, identity protection should be a LIFETIME free service for anyone that has had their identities compromised due to this wide scale identity assault. It should never be the responsibility of the breach victims to ever pay for this type of service … ever! … OPM should also offer to pay for a personal credit freeze to these injured individuals. This would aid in filling some of the gaps that are apparent in the identity protection service.” (Source: Federal News Radio)
US-CERT to Windows users: time to uninstall Quicktime. As Apple ends support for ubiquitous video player Quicktime on Windows, federal cyber experts are recommending that Windows users delete the software. In an alert @USCERT_gov writes, “Computers running QuickTime for Windows will continue to work after support ends. However, using unsupported software may increase the risks from viruses and other security threats. Potential negative consequences include loss of confidentiality, integrity, or availability of data, as well as damage to system resources or business assets. The only mitigation available is to uninstall QuickTime for Windows.” (h/t @BrianKrebs) (Source: US-CERT)
Giant Food requiring gift cards to be paid for with cash or debit because of fraud. Because of a spike in scammers using counterfeit credit cards to purchase prepaid cards (a common way to launder money from stolen cards), Maryland-based Giant Food has started requiring all such purchases to be made with cash or PIN debit, writes @briankrebs. “One of the easiest ways thieves can cash out? Walk into a grocery or retail store and buy prepaid gift cards using stolen credit cards. Such transactions—if successful—effectively launder money by converting the stolen item (counterfeit/stolen card) into a good that is equivalent to cash or can be easily resold for cash (gift cards). … Meanwhile, every Giant I visit still asks me to swipe my chip-based card, effectively negating any added security the chip provides.” (Source: KrebsonSecurity.com)
New exploit targets unpatched Android devices with ransomware. Android malware has typically relied on good old-fashioned social engineering to get consumers to install malicious apps. However, a new breed of ransomware targeting older versions of Android (v.4.0-4.3) requires no user interaction at all. Writes @dangoodin001, “[D]espite the limitations, there are several reasons the attacks represent a threat that’s worth watching. For one, by Google’s own figures, about 23.5 percent of all Android devices remain vulnerable to the attacks, and if Blue Coat version 4.4 users are indeed susceptible as Blue Coat suspects, the percentage jumps to almost 57 percent. Remember, too, that a sizeable portion of vulnerable handsets will never receive an update.” (Source: ArsTechnica)
Quick hit: Even God gets breached sometimes. (Source: SC Magazine)
Upcoming events
June 15 – FTC Start with Security – Chicago – Chicago, IL
The FTC’s fourth “Start With Security” event will take place on Wednesday, June 15, 2016, in Chicago, Illinois, and will be co-sponsored by Northwestern Pritzker School of Law. During this one-day event, the FTC will bring together experts who will provide businesses with practical tips and strategies for implementing effective data security.
National Consumers League
Published April 27, 2016
The #DataInsecurity Digest | Issue 18
/byIssue 18 | April 11, 2016
By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud
Subscribe here. Tell us what you think.
Editor’s Note: The valuable data held by law firms is increasingly being targeted by hackers. The #PanamaPapers breach news is putting a spotlight on the data security vulnerability of law firms like never before. As more revelations roll in, expect law firms around the globe and those who oversee them to focus on what errors Mossack Fonseca made that allowed the data to leak out.
The FCC’s newly-released proposed rules for broadband privacy and security may be causing some heartburn for ISPs, but it represents a significant shift in a privacy and security debate in Washington that seems to be going nowhere in Congress. Public interest and privacy advocates are lining up to support the new rules while the ISPs are, unsurprisingly, taking a dim view of Chairman Wheeler’s actions. Grab your popcorn, folks!
Yet another Flash zero-day has Adobe scrambling to roll out a patch. Our advice? Just disable Flash (you won’t miss it). WhatApp’s rollout of end-to-end encryption is a step forward for consumer data protection, but it isn’t the foolproof way to protect yourself that some are suggesting. Finally, we take a look at some surprising numbers coming out on data breach litigation and provide an update on two massive breaches of government databases in Turkey and the Philippines.
And now, on to the clips!
—————–
#PanamaPapers are a lesson for law firms on the need for better data security. Repercussions of the massive leak of sensitive data from Panamanian law firm Mossack Fonseca continue to reverberate around the globe. However, the #PanamaPapers leak is just the latest in a string of law firm breaches, notes @euroinfosec, “Ask hackers why they attack law firms, and their reply – to riff on bank robber Willie Sutton’s famous quip – would no doubt be: ‘Because that’s where the secrets are.’ … Law firms are a prime hacker target because they handle secret details of intellectual property, mergers and acquisitions, and other potentially valuable information.” (Source: Data Breach Today)
More #PanamaPapers fallout: One-quarter of law firms have experienced data breaches. The #PanamaPapers saga is also making HR pro’s take a closer look at data security, writes @1SHRMScribe, “Experts worldwide are calling the data breach surrounding the so-called Panama Papers—more than 11.5 million documents detailing how hundreds of wealthy people hid money in offshore banks and investments to avoid paying taxes—the biggest data breach in history. … Last year, the American Bar Association reported in its Legal Technology Survey that 1 in 4 firms with at least 100 attorneys have experienced a data breach.” (Source: SHRM)
FCC Broadband Privacy NPRM includes security, breach notification standards for ISPs. While the privacy requirements in the FCC’s proposed rules for ISPs have gotten most of the press, the Commission is also proposing important new data security regulations for broadband providers. The rules would require ISPs to, among other things, appoint a CISO, strengthen customer authentication technology (read: multi-factor authentication), and take responsibility for the data security practices of third parties that subscriber data is shared with and notify customers and law enforcement of breaches. (Source: FCC)
Advocates: ISP rules could be a big win for consumer privacy. Public interest advocates, for the most part, welcomed the FCC’s proposal with open arms as a way to strengthen privacy and security protections in a key part of the Internet ecosystem. @M_F_Rose of Public Knowledge reflected the thoughts of many advocates, writing, “Broadband service providers occupy a unique position in the Internet ecosystem. As gatekeepers to the Internet, they have, by their very nature, access to every bit of data that their customers send and receive online. And, as they move aggressively into advertising markets, they have every incentive to exploit their access to this data and remove all consumer agency in determining where and for what purpose their personal data is used. … This NPRM represents a step forward to protecting consumers’ economic and dignitary rights in their own data.” (Source: Public Knowledge)
But not everyone’s happy with the new rules. The industry reaction to the new rules has been, to say the least, less than welcoming. Jim Halpert of @DLA_Piper reflected the views of many in his analysis of the rules for IAPP: “Unless narrowed in the final rule, the FCC’s proposed rules would create major challenges for privacy professionals with responsibilities for broadband Internet access provider customer data. They would also generate considerable consumer confusion about use of consumer data collected online.” (Source: IAPP)
Adobe rushes to patch Flash vulnerability powering ransomware attacks. If you’re one of the 1 billion users who have Flash installed on your computer, the latest zero-day vulnerability could lead to a big headache. Adobe rushed out a patch this week, but experts are already seeing hackers exploiting the bug. Writes @jim-finkle “The software maker urged the more than 1 billion users of Flash on Windows, Mac, Chrome and Linux computers to update the product as quickly as possible after security researchers said the bug was being exploited in ‘drive-by’ attacks that infect computers with ransomware when tainted websites are visited.” (Source: Reuters)
Our advice: just disable Flash. Fewer and fewer websites are using it and chances are, you won’t miss it. Here’s a step-by-step guide for disabling flash on all the major browsers.
WhatsApp hops on the end-to-end encryption train… Messaging service WhatsApp is the latest tech company to embrace end-to-end encryption as a way to better protect users’ data. WhatsApp CEO Jan Koum explains the move: “The idea is simple: when you send a message, the only person who can read it is the person or group chat that you send that message to. No one can see inside that message. Not cybercriminals. Not hackers. Not oppressive regimes. Not even us.” (Source: WhatsApp)
…but it’s not all puppies and rainbows, yet. Writing for TechDirt, @glynmoody says WhatsApp’s end-to-end encryption is a good thing, but may not be the privacy and security panacea you might think it is. “[E]nd-to-end encryption is only available if all the participants in a conversation are using the latest version of the software. If one of them isn’t, group chats will be unencrypted. … even with strong, end-to-end encryption in place, the accompanying metadata is still leaking important information about who you are communicating with, and when. … end-to-end encryption does not protect you from malware that is capturing your keystrokes and sending them over the Internet, or from slips like accidentally storing a screenshot of sensitive chats.” (Source: TechDirt)
OECD: Consumer protection laws need updating to improve trust in e-commerce. The OECD is out with new guidance to member countries on improving consumer confidence in e-commerce. “While consumers are increasingly drawn to the convenience and choice of online commerce, concerns about privacy, payment security or legal recourse in case of a problem mean that many others remain wary,” noted the agency. While the OECD recommendations are non-binding they “[put] peer pressure on countries to take action – says businesses should not misrepresent or hide terms and conditions likely to affect a decision to buy or try to conceal their identity or location.” (Source: OECD)
Krebs: Trump Hotels potentially facing another HUUUUGE breach. For the second time in less than a year, the Trump Hotel Collection chain of hotels appears to have a payment system breach on its hands. @BrianKrebs breaks the story: “KrebsOnSecurity reached out to the Trump organization after hearing from three sources in the financial sector who said they’ve noticed a pattern of fraud on customer credit cards which suggests that hackers have breached credit card systems at some — if not all — of the Trump Hotel Collection properties. … The hospitality industry has been hit hard by card breaches over the past two years. In April 2014, hotel franchising firm White Lodging confirmed its second card breach in a year. Card thieves also have hit Hilton, Hyatt, and Starwood properties.” (Source: KrebsOnSecurity)
Krebs (part deux): CEO phishing scams net $2.3 billion since 2013. @BrianKrebs also points us to a new fraud alert from the FBI about a dramatic spike in so-called “CEO phishin” scams, that’s costing businesses big-time. Writes Krebs: “Unlike traditional phishing scams, spoofed emails used in CEO fraud schemes rarely set off spam traps because these are targeted phishing scams that are not mass e-mailed. Also, the crooks behind them take the time to understand the target organization’s relationships, activities, interests and travel and/or purchasing plans. … But CEO fraud attacks succeed because they rely almost entirely on tricking employees into ignoring or sidestepping some very basic security precautions.” (Source: KrebsOnSecurity)
Breach litigation cases down 25 percent. Law firm @BryanCaveLLP is out with their annual Data Breach Litigation Report, which examines data breach cases filed in U.S. District courts. Its findings are surprising. Notably, the number of data breach litigation cases filed in the last 15 months is down 25 percent. Only 21 unique defendants were names in those cases and only 5 percent of publicly reported breaches led to class action litigation, despite a huge amount of media attention to the breach issue. (Source: Bryan Cave)
Is increased breach vulnerability being overlooked in the M&A boom? @steve_schick takes a look at one facet of the $4.3 trillion mergers and acquisitions boom of 2015: data security. “One overlooked area for the IT integration of merged or acquired companies is the blind spot that exists in not knowing whether one firm may be connecting to another where a network intruder may have been long hidden, giving an attacker easy access. … Less than 1% of enterprises today have the capability of finding an active attacker that is at work exploring their network and expanding their sphere of control in order to get to valuable assets. This means that the acquirer may be just as in the dark as the acquiree about whether or not intruders are currently in their networks.” (Source: LightCyber)
Not just a U.S. problem: COMELEC breach leaks data on 55 million Filipino voters. A breach of voter registration data in the Philippines is being blamed for leaking voter registration information on tens of millions of Filipino voters. Writes @MikeBueza and @wdmauel: “Information security experts fear that what can be considered as the biggest leak of personal data in Philippine history could result in massive identity theft by preying criminals.” (Source: Rappler)
Turkey, too! 49 million records leaked from citizenship database. @alexhern is covering the story of how hackers leaked records on nearly half of Turkey’s citizens. “A database posted online allegedly contains the personal information of 49 million people on the Turkish citizenship database, potentially making more than half of the population of the country vulnerable to identity theft and massive privacy violations. … On top of the risks of having ID numbers made public, Turks on the database also face the prospect of identity theft purely using the personal information contained within the database.” (Source: The Guardian)
Upcoming events
June 15 – FTC Start with Security – Chicago – Chicago, IL
The FTC’s fourth “Start With Security” event will take place on Wednesday, June 15, 2016, in Chicago, Illinois, and will be co-sponsored by Northwestern Pritzker School of Law. During this one-day event, the FTC will bring together experts who will provide businesses with practical tips and strategies for implementing effective data security.
National Consumers League
Published April 11, 2016
The #DataInsecurity Digest | Issue 17
/byIssue 17 | March 31, 2016
By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud
Subscribe here. Tell us what you think.
Editor’s Note: If DC policymakers weren’t attuned to the impact of data insecurity by now, the latest data breach at DC’s own Medstar Hospitals could hit them where it hurts (literally!). A reported ransomware infection all but shut down the system’s 10 DC and Maryland hospitals. Did you get turned away from a Medstar office this week? Let us know at johnb@nclnet.org or @ncl_tweets! The Medstar hack is just the latest in a string of ransomware attacks on hospitals that have highlighted the vulnerability of health care providers’ data security. We won’t attempt to cover all of the FBI v. Apple news this week, except to point out that more than 80 percent of security and privacy pro’s are worried that an undisclosed vulnerability could threaten everyone’s security, according to Passcode.
In other data security news, Tennessee enacted one of the strictest breach notification laws in the country. “W2 phishing” is the latest vector for fraudsters who are ramping up for tax ID fraud season. New research finds that March Madness app vulnerabilities could mean tracking your bracket will cost you more than your office pool entry fee. Breaches at Wall Street law firms Cravath and Weil Gotshal illustrate why more clients are requiring their legal eagles to buy cyber insurance.
Finally, don’t forget to check out NCL’s newly redesigned Fraud.org—featuring a new section dedicated to data breach education—which we launched this week. Details below!
And now, on to the clips!
—————–
Tooting our own horn: Redesigned Fraud.org launches with new data breach content! We’re proud to show off an all-new Fraud.org this week! The newly redesigned watchdog site features plenty of data breach readiness content aimed at consumers, including links to the latest official breach info, tips for victims, and a step-by-step guide for reducing your data breach risk. And that’s just for starters! Surf over to the new Fraud.org, sign up for our monthly Fraud Alerts, and spread the word! (Source: NCL press release)
Medstar Hospitals hack has DC-area patients being turned away. The cost of data insecurity was vividly revealed this week as 10 MedStar hospitals in Washington, DC and Maryland were shut down, reportedly by a ransomware scam. This is just the latest of many attacks on hospitals by hackers looking to extract hefty ransoms due to often lax health care provider cybersecurity. @JohnWoodrowCox writes for the Washington Post: “[S]ome MedStar Health patients say they are being turned away as the health-care giant’s computer systems remain crippled by a virus that infected it Monday morning. … The spouse of a man receiving cancer treatment at one MedStar facility told The Post he has been unable to receive radiation treatment for two days because of the shutdown.” (Source: Washington Post)
Krebs: Hospital ransomware attacks to become more targeted. The MedStar ransomware hack follows a string of breaches at hospitals in Kentucky and California that have netted hackers thousands of dollars in ransoms. Writes @briankrebs “Ransomware infections are largely opportunistic attacks that mainly prey on people who browse the Web with outdated Web browsers and/or browser plugins like Java and Adobe Flash and Reader. Most ransomware attacks take advantage of exploit kits, malicious code that when stitched into a hacked site probe visiting browsers for the the presence of these vulnerabilities. … It’s a fair bet that as ransomware attacks and attackers mature, these schemes will slowly become more targeted.” (Source: KrebsonSecurity)
It’s not just hospitals that should be worried about protecting health info. The same folks at Verizon who annually publish the hugely influential Data Breach Investigations Report are out with a new report looking at the security of personal health information on corporate networks. The results aren’t pretty: 90 percent of all industries have experienced breaches that lead to a loss in personal health information, according to the report. Writes the @PHIDBIR team: “Detailed health records make it easier for criminals to engage in both identity theft and medical billing fraud—the former having direct impact on an individual or family, and the latter increasing healthcare costs for governments, organizations and individuals.” (Source: Verizon)
Rich to Congress: Pass data security and breach notification laws. FTC Bureau of Consumer Protection Director Jessica Rich went before the House Oversight subcommittee and reiterated the Commission’s long-standing call for Congress to pass comprehensive data security and breach notification bills. Such legislation would give the Commission greater authority to crack down on the growing threat of medical ID theft, which was a significant focus of Rich’s testimony. (Source: Arnold & Porter)
Eighty-one percent of security and privacy experts want FBI to disclose iPhone vulnerability. A poll of 140 high-profile security and privacy experts by Christian Science Monitor’s Passcode group found a significant majority in favor of the FBI disclosing any iPhone vulnerabilities that allow it to hack into the iPhone at the center of its temporarily-resolved battle with Apple. Writes @SaraSorcher and @MalenaCarollo: “[A] strong majority of security and privacy experts from across government and the private sector … cautioned about serious security risks if investigators don’t reveal the security flaw, and the dangerous precedent it might set.” (Source: Passcode)
Tennessee updates data breach notification law; now one of the strictest in U.S. Tennessee Gov. Bill Haslam has signed into law an update to the state’s data breach notifications. Now, breached organizations are required to notify customers within 14 days of the discovery of the breach. Writes Bruce Sarkisian of @AlstonBirdLLP, “Tennessee joins a small number of states requiring notice to be made within a certain time after an organization becomes aware of the breach. Tennessee’s is one of the shortest periods adopted to date. Puerto Rico’s data breach statute requires notice to be made to the Department of Consumer Affairs within ten days of discovery of a breach. Florida requires notice to individuals to be made within thirty days following discovery of the breach.” (Source: JDSupra)
Krebs (take two): W2 phishing attacks on companies netting a haul for tax ID fraudsters. As tax prep season kicks into high gear, tax ID fraudsters are using a new scheme to bring in employee information: sending phishing emails to corporate HR and finance departments seeking employee W2 information. Writes Krebs: “Over the past week, KrebsOnSecurity similarly has heard from employees at a broad range of organizations that appear to have fallen victim to W2 phishing scams, including some 28,000 employees of the market research giant Kantar Group; 17,000+ employees of Sprouts Farmer’s Market; call center software provider Aspect; computer backup software maker Acronis; Kids Dental Kare in Los Angeles; Century Fence, a fencing company in Wisconsin; Nation’s Lending Corporation, a mortgage lending firm in Independent, Ohio; QTI Group, a Wisconsin-based human resources consulting company; and the jousting-and-feasting entertainment company Medieval Times.” (Source: KrebsonSecurity)
March Madness apps vulnerable to malware. Your bracket may not be the only thing that gets busted if you use apps to track the NCAA tournament scores, says Flexera Software. Writes @BSnyderSF, “Flexera analyzed 28 iOS apps, including the popular March Madness Live, Yahoo Sports, ESPN Tournament Challenge, and CBS Sports, and found that nearly all of them had potentially problematic features. March Madness Live, for example, can access and share users’ calendar information on social media sites, and it links to ad networks, which can act as backdoors for malware. In fact, 26 of the 28 tested apps can access and share this information, and another 79 percent, including CBS Sports, Dish Anywhere and ESPN Tournament Challenge, can access iOS devices’ location tracking features, according to Flexera.” (Source: CIO)
Attention DC lawyers: Clients increasingly demanding cyber insurance… Law firm clients are increasingly asking their legal eagles to purchase cyber insurance policies to help address the risk of data breach, writes @NellGluckman. “The policies that law firms typically carry, such as lawyers’ professional liability insurance, general liability insurance and property insurance, do not always provide coverage when employee rather than client data is compromised, or when the firm must hire a forensic team to determine what data was lost and how. They also most likely won’t cover the cost of notifying regulators or engaging a public relations firm. … Daniel Garrie, co-head of the cybersecurity practice at Zeichner Ellman & Krause, identified another factor that is pushing firms to buy cyber insurance. ‘Their clients are compelling the action,’ Garrie said. “They’re requiring the law firms to have cyber insurance as a matter of business.’” (Source: The American Lawyer)
… and breaches at Cravath and Weil Gotshal show why. Hackers’ renewed focus on law firms as a target was illustrated again this week as Wall Street firms Cravath and Weil Gotshal announced that they’ve been breached. @nicole_hong and Robin Sidel have the story for @WSJD: “The attacks on law firms appear to show thieves scouring the digital landscape for more sophisticated types of information. Law firms are attractive targets because they hold trade secrets and other sensitive information about corporate clients, including details about undisclosed mergers and acquisitions that could be stolen for insider trading.” (Source: Wall Street Journal)
Report: 60 percent of federal agencies have suffered a data breach. New research from data security firm @Vormetric finds that 60% of federal agencies have suffered a data breach, with 20% of those breaches happening in the past year. Among the other takeaways from the report, “federal agencies are planning to adopt modern security tools including cloud security gateways (40%), application encryption (34%), data masking (31%), and tokenization (27%) to protect sensitive data.” (Source: Information Week)
Report: One-fifth of companies experienced a mobile data breach. A survey of IT pro’s by Crowd Research Partners found that employees connecting to malicious WiFi hotspots is a significant vector for mobile device-based threats. According to the report, “one in five organizations (21%) suffered a security breach involving a mobile device sometime in the past, primarily due to connections to malicious Wi-Fi hotspots and malware.” (Source: CIO)
Upcoming events
Today – FCC March Open Meeting– Washington, DC
The Commission will consider a Notice of Proposed Rulemaking seeking comment on a proposed framework for ensuring that consumers have the tools they need to make informed choices about how their data is used and when it is shared by their broadband providers.
June 15 – FTC Start with Security – Chicago – Chicago, IL
The FTC’s fourth “Start With Security” event will take place on Wednesday, June 15, 2016, in Chicago, Illinois, and will be co-sponsored by Northwestern Pritzker School of Law. During this one-day event, the FTC will bring together experts who will provide businesses with practical tips and strategies for implementing effective data security.
National Consumers League
Published March 31, 2016
The #DataInsecurity Digest | Issue 16
/byIssue 16 | March 16, 2016
By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud
Subscribe here. Tell us what you think.
Editor’s Note: The FCC’s broadband privacy proposal is generating quite a lot of heat in Washington, since it would impose new rules on cable and telecom companies—no slouches when it comes to lobbying. Less talked about are the data security and breach notification requirements which would apply to ISPs businesses. The FTC has also begun an inquiry into PCI-DSS certification, which sounds pretty wonky, but in fact, represents a significant effort by the Commission to make sure that one of the most widely known security standards is up to snuff. No #DataInsecurity Digest would be complete without news of the latest data breaches and this edition is no different. Cancer treatment center franchise 21st Century Oncology is the latest victim, with more than 2.2 million consumers affected. Breach fallout continues to plague the IRS, which recently had to shut off its “Get IP PIN,” since hackers figured out how to compromise the system, which was put in place to help victims of tax ID fraud.
And now, on to the clips!
—————–
FCC broadband privacy proposal includes data security and breach notification requirements. While most of the news about the FCC’s broadband privacy proposal focused on the limits the proposal would place on ISPs ability to use customer information for advertising purposes, the Commission has also proposed strong data security rules. Notes the fact sheet: “The proposal would require broadband providers to take reasonable steps to safeguard customer information from unauthorized use or disclosure.” Breached ISPs would also be required to notify the FCC within 7 days of discovery of the breach and affected customers in 10 days. (Source: FCC)
Wheeler doubles down on data security. In a Huffington Post piece explaining the coming broadband privacy rules, FCC Chairman @TomWheelerFCC gives a shout-out to data security. “Every broadband consumer should have the right to choose how their information bits should be used and shared. And every consumer should be confident that their information is being securely protected,” said Wheeler. (Source: Huffington Post)
FTC examining PCI-DSS auditing. One of the more well-known security standards is the banks’ PCI-DSS standard, which has caused some heartburn among businesses that must comply in order to accept credit and debit cards. The FTC will take a look at the issue, thanks to orders issued to nine companies that conduct PCI-DSS assessments. @FraudBlogger has the round-up of the impact of the FTC’s action. “The FTC relies heavily on the PCI-DSS as a framework for measuring the effectiveness of merchant information security programs … This was recently put in writing with the Wyndham order the FTC released last December. The federal government has been under pressure to do something in response to the major breaches over the past couple of years. Since the FTC’s purview is retail breaches, it makes sense that they would be the government agency that starts doing more.” (Source: BankInfoSecurity.com)
Speaking of the FTC: ID theft complaints increased 47%, says NCL. Just as we went to press with last week’s #DID, the FTC released its annual Consumer Sentinel Data Book. Now that we’ve had a chance to dig in, we’ve got some more advice for policymakers. “We know that these nearly 500,000 identity theft complaints are likely just the tip of the iceberg. Far too many identity theft victims don’t report the crime, if they’re even aware of it,” said NCL Vice President of Public Policy, Telecommunications and Fraud John Breyault (aka yours truly). “Consumers can take steps to mitigate their risk of identity theft, but they can’t prevent it entirely. That’s why we need leaders in Washington to help make sure that the companies that hold consumers’ data protect it to the greatest extent possible.” (Source: National Consumers League)
Breach du jour: 2.2M patient records at 21st Century Oncology. Ft. Myers-based 21st Century Oncology, which operates a chain of 181 cancer treatment centers in the U.S. and Canada, has reported a breach that may have exposed names, social security numbers, physicians’ names, diagnoses and treatment information, and insurance information on up to 2.2M customers. The breach took place in October 2015 but the company was asked not to notify patients by the FBI until now. 21st Century Oncology also recently settled a $34.7 million fraudulent billing case with the Department of Justice. (Source: Healthcare IT News)
Breach du jour part deux: Rosen Hotels is latest hotel breach target. Orlando-based hotel chain Rosen Hotels and Resorts is the latest hotel company to have its payment system targeted, joining Hyatt, Trump Hotels, Hilton Hotels and Starwood Hotels, writes @philmuncaster. (Source: InfoSecurity Magazine)
Congress: HIPAA data security rules too slow to come. Rep. Peter DeFazio (D-OR) and Rep. Tom Marino (R-PA) are leading a group of eight bipartisan Congressmen in calling on HHS to speed up its promised data security guidance for HIPAA-covered entities, writes @HealthInfoSec. Notes the letter, “We have serious concerns about the consequences of HHS inaction. Advances in mobile health technology have the potential to dramatically improve patient outcomes and the accessibility of health care. This innovation is coming at a rapid pace, but your agency has done little to demonstrate it can manage the significance.” (Source: DataBreachToday)
Verizon has its own data security digest. Verizon is rightfully hailed for its comprehensive annual Data Breach Investigations Report. However, telecom’s budding data security business is now out with a more light-hearted digest of data breach case studies, writes @MariaKorolov for CSO. Case in point: “And there’s the story of the best developer at a company—who turned out to have outsourced his job to China in order to spend the day reading Reddit and watching cat videos. He had FedExed his authentication token key fob to the contractor, and was caught when logs showed mysterious—but authorized—VPN access from China.” (Source: CSO)
Facebook, Google, WhatsApp among big names expanding encryption in the name of security. @lancewhit breaks down the latest in Silicon Valley’s efforts to expand encryption and the government’s pushback. “Technology firms are putting a higher priority on security to convince customers their private data is fully protected. But the US government and law enforcement officials are challenging the encryption used in tech products, arguing that it obstructs their capability to access information vital in criminal and terrorist investigations.” (Source: CNET)
$19.5M set aside to settle Home Depot breach claims. The hardware retailer settled the suit, made up of 57 proposed class action lawsuits. “‘The home improvement retailer will set up a $13 million fund to reimburse shoppers for out-of-pocket losses, and spend at least $6.5 million to fund 1-1/2 years of cardholder identity protection services.’ … Home Depot also agreed to improve data security over a two-year period, and hire a chief information security officer to oversee its progress.” (Source: Reuters)
Daily Krebs: DDoS protection firm Staminus hacked. Staminus, a firm specializing in protecting websites from distributed denial of service (DDoS) attacks was itself knocked offline in a hack that reportedly cost the company 15GB of customer data. DDoS protection firms are frequent targets for DDoS attacks themselves since they are frequently used to protect websites hosting questionable content. (Source: KrebsonSecurity.com)
Daily Krebs, take two: IRs suspending “Get IP PIN” after system thoroughly pWn3d. Cyber blogger extraordinaire Brian Krebs’ reporting on the IRS’s leaky system for protecting tax identity fraud victims certainly got the feds’ attention. Writes @briankrebs, “Citing ongoing security concerns, the Internal Revenue Service (IRS) has suspended a service offered via its Web site that allowed taxpayers to retrieve so-called IP Protection PINs (IP PINs), codes that the IRS has mailed to some 2.7 million taxpayers to help prevent those individuals from becoming victims of tax refund fraud two years in a row. The move comes just days after KrebsOnSecurity first exposed how ID thieves were abusing the service to revisit tax refund on innocent taxpayers two years running.” (Source: KrebsonSecurity.com)
IRS breach’s lessons for financial services. American Banker’s @pennycrosman notes the parallels between the IRS’s growing breach problems and the financial services industry’s similar issues. “So while it’s tempting to roll your eyes and crack jokes when a government agency slips up, the IRS breach may hold some useful lessons for the financial services industry. … There are a few takeaways for banks from this mess. 1. Rethink knowledge-based authentication … 2. Don’t let bureaucracy kill a good security idea. … 3. Teach customers to protect their Social Security numbers and other personally identifiable data … 4. Try stronger authentication technology.” (Source: American Banker)
Even ISIS has data breach headaches. @a_greenberg covers the breach of 22,000 ISIS members’ personal information, proving that even the world’s most dangerous terrorists have to worry about data security. “A defector has allegedly leaked what appears to be a USB drive’s worth of ISIS’s secret data, including the personal information of 22,000 ISIS fighters. That personal data includes the fighters’ names, phone numbers, hometown and even blood types—all information they apparently filled out on forms in the process of signing up to join the violent group.” (Source: WIRED)
Quick hit: Average breach falls below cyber insurance policy deductible, study shows. (Source: DarkReading.com, via @gold_em)
Quick hit: Recap of the big non-policy news from RSA. (Source: iCrunchData News)
Infographic du jour: 2015 in data breach numbers. (Source: SafeNet)
Upcoming events
March 31 – FCC March Open Meeting– Washington, DC
The Commission will consider a Notice of Proposed Rulemaking seeking comment on a proposed framework for ensuring that consumers have the tools they need to make informed choices about how their data is used and when it is shared by their broadband providers.
June 15 – FTC Start with Security – Chicago – Chicago, IL
The FTC’s fourth “Start With Security” event will take place on Wednesday, June 15, 2016, in Chicago, Illinois, and will be co-sponsored by Northwestern Pritzker School of Law. During this one-day event, the FTC will bring together experts who will provide businesses with practical tips and strategies for implementing effective data security.
National Consumers League
Published March 16, 2016
Health Advisory Council Newsletter | 2016 Q1 | Member Q and A
/by2016 | Q1 Newsletter | Q & A with Health Advisory Council Members
Senior Manager, OTC Appropriate Use, Johnson & Johnson Consumer Inc., McNeil Consumer Healthcare Division
Q. What is your role?
A. I manage our over-the-counter (OTC) medicine appropriate use efforts and initiatives. The mission of our group is to empower consumers to make the best choices for their OTC self-care by providing them with the necessary information and tools.
Q. Tell us about some of your current initiatives
A. We have several appropriate use initiatives, some that are internally led by Johnson & Johnson Consumer Inc. while others are led by external partners such as NCL. An example of an internal initiative that we launched in Q4 2015 is Every Label Every Time. This initiative is designed to educate consumers about the appropriate use of OTC medicines and the importance of reading and following all medication labels. The campaign highlights recent findings from a new survey of more than 2000 U.S. consumers such as the finding that only one in five consumers re-read the label of an OTC medicine they have used before.
An example of a current external initiative is the LifeSmarts program through our NCL partnership. Johnson & Johnson Consumer Inc. is a supporter of the development of the “Health and Safety” section of LifeSmarts U. As a healthcare company, we believe in the importance of educating future medicators and young adults about the responsible use of medicine.
Q. What is Johnson & Johnson Consumer Inc. doing to change the way people think about and approach healthcare?
A. Some consumers believe that OTC medicines are completely safe and can do no harm. OTCs are safe when used as directed, but if they are not used according to the label, they can cause harm. Our goal is to provide at-risk consumers with a “wake-up call” to choose and use OTCs appropriately so that they and their loved ones can get effective relief safely.
Q. What do you value about membership in NCL’s Health Advisory Council?
A. I value the exchange of ideas and dialogue between the Council members. In the future, I hope there will be more opportunities for partnering with Council members on appropriate use initiatives.
Q. Tell us about some of your partnerships.
A. Research shows that children begin to self-medicate around 11 years old. Unfortunately, when not equipped with the knowledge and information to make safe choices, adolescents may end up doing more harm than good. In 2014 alone, 140,000 cases of medicine exposures reported to poison centers involved children ages 6 to 19.
With this need in mind, Johnson & Johnson Consumer Inc. has supported the development of a free, evidence-based educational program for 5th and 6th graders, focused on medicine safety. The objective is to build a more responsible future medicating population and to build a healthy respect for all medicines, including OTCs, by teaching adolescents at an early age.
The program, “OTC Medicine Safety,” was developed and refined with the help of an expert panel, qualitative testing with teachers and students, and quantitative testing with over 1,200 students. In its fifth year, the program includes comprehensive resources for teachers, school nurses, community leaders, and parents – all of which play a critical role in helping tweens learn about responsible OTC medicine use and storage. All resources are completely free and available online.
Director, Global Stakeholder Engagement, U.S. Pharmacopeial Convention (USP)
Q. Tell us about your work at USP.
A. USP’s mission is to improve global health through the development of public standards and related programs that help ensure the quality, safety, and benefit of medicines and foods. For almost 200 years, USP has developed an extensive network of stakeholders and partners that engage with us to advance USP’s work of setting quality standards for medicines, foods and dietary supplements.
My work at USP focuses on how USP collaborates and engages with a diverse community of stakeholder organizations to impact the public health landscape in the U.S. and abroad. These stakeholders include academic institutions and associations, consumer organizations, governmental bodies, non-governmental bodies, manufacturers, trade associations and professional and scientific associations.
Our interactions with these stakeholders gain in complexity as we engage them in our functions at USP –developing quality standards, advocating for patient safety and safe medication use or promoting global public health, for example – and learn how to find the intersects in mission with these organizations and how to walk shoulder to shoulder as partners to advance policies, agendas, and activities.
Q. What do you love about your job?
A. I have been at USP more than seven years, and there are three distinct areas that fuel my passion for the organization. USP was founded by scientists and practitioners who were passionate about ensuring the quality of medicines for their patients. That passion continues today with a community of more than 1,000 experts who work closely with nearly 1,000 USP scientists and staff to ensure the quality and safety of medicines, dietary supplements and food ingredients in the U.S. and many other countries.
A second remarkable aspect of USP are programs that are little known to the public, but have tremendous impact on global health, such as the Promoting the Quality of Medicines program, a collaboration with the U.S. Agency for International Development (USAID) to build regulatory capacity in many countries. Through this program, USP is working with health authorities and collaborators worldwide to address supply chain issues as well as counterfeit and substandard medicines that plague so many nations.
Another little known program is the Dietary Supplements Verification program, which is a voluntary program for manufacturers of dietary supplements and dietary supplements ingredients to verify the quality of their products.
The third aspect of USP that inspires me is the diversity of staff. At USP, you will find staff representing many different nations. This diversity adds a unique nuance to the collaborative manner in which we work so that different perspectives inform our discussions, our work and our learnings.
Q. What is USP’s role in the public health sector?
A. Scientifically based, public quality standards, like those published in the U.S. Pharmacopeia-National Formulary (USP-NF), have helped ensure the quality and consistency of drugs and drug ingredients sold in the United States for almost two centuries.
Uniform public standards, such as USP’s, make it clear to everyone in industry and regulatory bodies what quality is expected of ingredients and products and what test methods are appropriate to determine whether that quality exists.
Although our standards are referenced in U.S. law, we are not part of government. Our standards are established by experts coming from diverse backgrounds – industry, regulatory agencies, academia and practitioner groups. USP’s experts and staff develop quality standards that provide a uniform point of reference for regulators, manufacturers and consumers.
Q. What public health initiatives is USP currently working on?
A. One example is the work we have developed on prescription container labeling. According to the Institute of Medicine (IOM), 77 million Americans have limited health literacy, and a majority of Americans have difficulty understanding and using health information and services. In 2007, USP started working on a standardized prescription container label with experts in patient safety, health literacy, pharmacy, medicine, human factors research and labeling technology. The goal of the standard (now called General Chapter <17>) was to organize labels in a patient-friendly way, using explicit language to describe dosages and intervals; improve readability with clear formatting; and address those with visual impairments and those with limited English comprehension.
At its 2012 annual meeting, the National Association of Boards of Pharmacy passed a resolution supporting state boards in requiring a standardized prescription container label. As with other healthcare quality standards, enforcement of General Chapter <17> is the decision of individual state boards of pharmacy, which may choose to adopt it into their regulations.
Another public health initiative USP has been engaged in for the past several years is promoting quality standards for dietary supplements. Approximately half of the American population consumes vitamins, minerals or other dietary supplements as part of their health regimen. Yet, because the regulations on dietary supplements are different than those for medicines (dietary supplements are regulated as foods), the quality and safety of these products is often put into question, with frequent reports of products connected to patient harm.
In 2001, USP started its USP Verified program for dietary supplements, which guarantees consumers of these products that what’s on their labels is inside the bottle; that the ingredients are present in the right potency and amount; that the products don’t contain harmful levels of contaminants; and that the products were made according to FDA and USP guidelines, using good manufacturing practices.
The program is voluntary for manufacturers, but we believe that choosing a product with the “USP Verified” Mark on the label provides consumers with an added assurance that the supplement recommended by their physician is of high quality.
Q. What do you value about USP’s participation in the Health Advisory Council?
A. USP’s engagement with the National Consumers League (NCL) and its Health Advisory Council is an important aspect of my work. NCL is a critical organization in the healthcare landscape because of its important work in representing consumer perspectives. Being at NCL’s table is important for USP because it gives us the opportunity to raise awareness of quality medicines, dietary supplements and food ingredients directly to patients and consumers.
Health Advisory Council Newsletter | 2016 Q1
/byLast December, we were delighted to host Council members at a meeting that featured a fireside chat with then-nominee Dr. Robert Califf, and just weeks ago, we welcomed the news of his formal Senate confirmation as Commissioner of the U.S. Food and Drug Administration (FDA). NCL looks forward to future collaborations with the FDA and expects that under Dr. Califf’s leadership, the agency will ensure that patient and consumer protection remain the highest priority.
Since our December meeting, NCL and Council members have been active on many fronts. Please read on for NCL policy updates, Q&A’s with two members, updates, and more.
Script Your Future Medication Adherence Campaign update – Launched in 2011, NCL’s Script Your Future campaign is a national educational campaign to raise awareness of the importance of taking medications as directed.
New Script Your Future research. In December 2015, NCL released the results of survey research that compared adherence in the campaign’s pilot cities (Baltimore, MD; Birmingham, AL; Cincinnati, OH; Providence, RI; Raleigh, NC; and Sacramento, CA) before the campaign launched in 2011, at its midpoint in 2013, and again in 2015. The results demonstrate improvement in communication and adherence, particularly in the campaign’s target market cities, where patients were significantly more likely than those in a control market to say they are taking their medicines better than in the previous year. NCL was pleased to receive good media coverage of the survey results, including in the February issue of Population Health News.
Read on for more updates about NCL’s health policy work.
Welcome NCL’s new Health Policy Associate Janay Johnson – NCL is pleased to announce that Janay Johnson will join NCL’s health policy department this month. Janay received her MPH from George Washington University and comes to us from the American Heart Association. We know that you’ll enjoy working with Janay!
Get to know two Health Advisory Council members–Johnson & Johnson Consumer Inc., McNeil Consumer Healthcare Division and the U.S. Pharmacopeial Convention (USP)–with new Q&A’s.
Eli Lilly and Company – Finding common ground
In a unique partnership, Eli Lilly and Company and Anthem, Inc., have teamed up to drive policy changes that would pave the way for value-based drug pricing—with the goal of ensuring that patients get the best value for their health care dollars. This collaborative approach was unveiled in late January in an op-ed (“Discovering New Medicines and New Ways to Pay for Them”) published in Health Affairs and co-authored by David Ricks, Lilly’s senior vice president and president of Lilly Bio-Medicines, and Samuel Nussbaum, M.D., who recently retired as Anthem’s executive vice president and chief medical officer. Ricks and Nussbaum said they approach pricing issues from “different perspectives but with common ground” and with the shared belief that innovative medicines are an “incredibly powerful and cost-effective way to improve people’s lives.” To learn more, check out the LillyPad blog on the topic, which links to two white papers that detail the new initiative.
National Alliance for Caregiving
In February, the National Alliance for Caregiving, in partnership with Mental Health America and the National Alliance on Mental Illness, released On Pins & Needles: Caregivers of Adults with Mental Illness. The study examines the unique difficulties and opportunities for caregivers of adults with moderate-to-serious mental illness. Major findings of the survey: caregivers said their loved one faced an average of 11.8 years to get a diagnosis; access to treatment and support services is problematic for nearly two out of three; and half have trouble finding case managers, in-patient treatment, and substance abuse treatment. This year, the Alliance also celebrates its 20th anniversary by exploring what the next 20 years in caregiving will look like at the American Society on Aging meeting.
Society for Women’s Health Research (SWHR)
The Society for Women’s Health Research (SWHR) 26th Annual Gala “Revolutionizing Healthcare & Research Through Data” is on Wednesday, May 4 at The Ritz-Carlton Hotel. With regard to Policy developments, SWHR has recently launched The Patient’s Alliance for Drug Safety Protections to bring awareness to the importance of Risk Evaluation and Mitigation Strategies (REMS) as a tool to advance patient safety and protect public health. The organization will also host two policy roundtables to examine the regulatory issues surrounding pain management and novel therapies with the goal of providing consensus statements and recommendations for regulatory actions in mid-to-late 2016.
We hope you will join us on September 21 for NCL’s Trumpeter Awards dinner and reception in Washington. For more than 40 years, NCL’s Trumpeter Awards have recognized leaders who speak out for social justice, public health, and for the rights of consumers and workers. Past recipients have included FDA Commissioner Margaret Hamburg, Surgeon General Regina Benjamin, legislators, investigative journalists, and other leaders. Learn more about the 2016 Trumpeter Award and how to participate this year here.
Food Waste Conference – Late last year, the U.S. Department of Agriculture (USDA) and the U.S. Environmental Protection Agency (EPA) announced a national goal to reduce food waste in the U.S. by 50 percent by 2030. NCL has been covering the issue of food waste for the last year, but in 2016 we are amplifying our efforts. In May, we’ll host the first ever consumer-focused Food Waste Summit, in partnership with the Keystone Policy Center, to engage representatives from across the stakeholder spectrum on how to actively involve consumers in reducing waste. The conference will take place on May 11 at the Pew Charitable Trusts in Washington, DC. Get more information or RSVP here.
Launching new online members-only discussion board – Health Advisory Council members have told us that one of the most highly valued membership benefits is the ability to connect with the broad range of health policy stakeholders represented on the Council. To facilitate increased member communication, NCL will soon launch an online members-only discussion board where members may share news, suggestions, and ideas. Information on how to access this new communications portal is coming soon.
Meetings in the works – We are in the process of planning our annual Health Advisory Council Membership meeting in the Spring, as well as a policy forum on patient access in the Fall. We welcome your ideas or suggestions! Please feel free to contact Karin Bolte (karinb@nclnet.org) or Amy Sonderman (amys@nclnet.org).
_______________
National Consumers League
Published March 16, 2016
NCL health policy updates | Health Advisory Council Newsletter | 2016 Q1
/byScript Your Future Medication Adherence Campaign – Launched in 2011, NCL’s Script Your Future campaign is a national educational campaign to raise awareness of the importance of taking medications as directed.
Clear Choices Campaign – Along with members of the Clear Choices Campaign, a multi-stakeholder advocacy association dedicated to making health markets more transparent and consumer-friendly, NCL’s Health Policy Director Karin Bolte met with Kevin Counihan, director & marketplace CEO at CMS’ Center for Consumer and Information and Insurance Oversight (CCIIO), to share recommendations to improve the consumer-facing features and tools of HealthCare.gov.
Clear Choices also called on the Department of Health and Human Services (HHS) to put more accurate, intelligible health care data in the hands of health care consumers and stakeholders.
Senate Finance Committee Chronic Care Working Group – In January, NCL, along with colleagues in the health care, consumer, patient, labor, and business communities, submitted detailed comments on a Dec. 18 policy options document circulated by the Senate Finance Committee Chronic Care Working Group. Advocacy groups called for legislative action and praised the policy options document for putting forth strategies to: 1) engage consumers in their own health and health care; 2) expand care coordination for the highest cost, highest need beneficiaries; and 3) modernize Medicare provider payment.
Generic drugs – NCL has long been a supporter of generic drugs as a good way for consumers to save money on medications. However, NCL believes that it is critically important that all prescription drugs–both brand name and generic–carry current and adequate safety warnings. In March, NCL joined a letter to the FDA urging the agency to finalize proposed regulations that would allow generic drug manufacturers to initiate safety, efficacy, and dosing updates to their products’ labeling. Promptly updated labeling allows health care providers and patients to make better informed health decisions and can help prevent serious harm to patients.
Patient Access to Pharmacists’ Care Coalition – NCL is an active member of the Patient Access to Pharmacists’ Care Coalition (PAPCC), whose mission is to develop and help enact a federal policy proposal that would enable Medicare beneficiary access to, and payment for, Medicare Part B services by state-licensed pharmacists in medically underserved communities. Reimbursing pharmacists for patient care services will expand access to care in rural and urban areas, increase care coordination, allow seniors to access health care services in their communities, and encourage health care teams that include pharmacists. NCL has been working with PAPCC to plan a patient advocacy briefing taking place March 21.
NCL health policy updates | Health Advisory Council Newsletter | Summer 2015
/byAccess – to medications, health care, information, coverage – is a prominent theme among members as a priority, as well as in the issues we are addressing at NCL. And with the recent decision by the U.S. Supreme Court in King v. Burwell, access to health care for millions under the Affordable Care Act will continue, even while we work to ensure consumers have access to critical medications and treatments they need. The Supreme Court’s 6-3 vote is a major victory for consumers nationwide.
Vaccines – Meningitis B (MenB) outbreaks on college campuses has been a devastating public health issue in recent years. The FDA recently approved two MenB vaccines, and, in June, the CDC’s Advisory Committee on Immunization Practices (ACIP) met to decide on recommendations as to who should receive them—only high-risk populations or broader populations. NCL spoke at the ACIP meeting in favor of a routine, or broad, recommendation to ensure access to this vaccine before a deadly outbreak occurs. Dozens of speakers addressed the ACIP, including survivors of the disease as well as relatives of victims, all urging the committee to recommend routine vaccinations for young adults ages 16-23. Ultimately, the CDC declined to give a broad recommendation for the MenB vaccinations, recommending instead that decisions to vaccinate adolescents and young adults be made at an individual level with healthcare providers. NCL is disappointed with the decision and stands with patients and their families in support of protecting young people from the devastating consequences of MenB.
Flibanserin – NCL has championed women’s health and gender equality for decades and recently applauded the vote by the FDA advisory committee to recommend approval of the drug Flibanserin for low libido in women, or female sexual dysfunction (FSD). The most common FSD condition is loss of sex drive, or HSDD. At present, there are no FDA-approved drugs to treat FSD. Although there has been a diverse range of opinions concerning the drug, NCL presented testimony at the recent FDA meeting in favor of approving this treatment, and in support of giving women the same access to treatment for HSDD as provided to men, who now have 26 drugs for sexual dysfunction.
Script Your Future Campaign – The Script Your Future campaign announced the winners of its 2015 Team Challenge, an annual competition that encourages health profession students and faculty across the nation to develop creative ideas, events, and initiatives to raise public awareness about the importance of medication adherence. NCL is proud to announce that this year’s Challenge winners were the University of Pittsburgh School of Pharmacy, University of Maryland School of Pharmacy, University of Charleston School of Pharmacy, and the Northeast Ohio Medical University College of Pharmacy (NEOMED). NCL continues to fulfill frequent requests for medication adherence materials, including Public Service Announcements and wallet cards that help patients keep track of their medications and provide basic questions for patients to ask their HCPs about the medication they are taking.
21st Century Cures – The 21st Century Cures Act was introduced in Congress to focus on accelerating the discovery, development, and delivery of new drugs and devices. While some aspects of the bill could speed up the development of and access to new drugs, NCL and other consumer and patient groups have expressed concern that this legislation could ultimately lower the standards for approval of many medical products, placing patients at unnecessary risk. The current version of the bill would allow consideration of drug approvals based on clinical experience, replacing scientific data from large numbers of patients in well-designed and controlled clinical trials. And approval standards for medical devices could become less rigorous. As a part of a patient and consumer coalition, NCL is working to ensure that the bill provides greater access to medications without sacrificing safety.
Cosmetics – Cosmetics reform is long overdue. The current cosmetic product legislation, or the Federal Personal Care Products Safety Act, has remained unchanged since its enactment in 1938. Senator Dianne Feinstein (D-CA) and Senator Susan Collins (R-ME) are co-sponsoring new legislation that would give the FDA broader oversight of personal care products and more authority over companies to disclose adverse product reactions reported by consumers. Consumer groups, including NCL, are encouraging lawmakers to include additional measures to the bill that will help to ensure enhanced consumer protections.
New navigating healthcare marketplace site – NCL is partnering with a communications firm and Anthem to develop a new resource to help Americans navigate a complex and changing health care system. The content will focus on such decisions as choosing a health plan, selecting providers, sorting through drug formularies, and the information needed to make informed choices.
Biosimilars – Biosimilars, which are essentially identical versions of biologic drugs, are complex medicines made from living cells that treat deadly and debilitating diseases. It is good news for consumers that biosimilars are expected to enter the U.S. marketplace in the coming weeks. The first biosimilar for Neupogen, which reduces the risk of infection from chemotherapy for cancer patients, was approved by the FDA in March. NCL has a long history of advocating for increasing affordable access to lifesaving medicines. Biosimilars hold great potential for saving consumers money and increasing their access to lifesaving treatments.
PDUFA VI – Under the Prescription Drug User Fee Act (PDUFA), the pharmaceutical industry provides resources for the FDA to the review medications. The legislation expires in 2017 and, in order for the agency to continue to collect these user fees, it must be reauthorized. NCL has been asked by the FDA to be part of a panel on July 15 at the FDA headquarters in White Oak to represent the consumer perspective as part of this reauthorization process.
NCL continues to monitor other issues related to medication safety: compounding pharmacies, counterfeit drugs, dietary supplements, the safe use of pain relievers, and more.
The #DataInsecurity Digest | Issue 15
/byIssue 15 | March 2, 2016
By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud
Subscribe here. Tell us what you think.
Editor’s Note: Welcome to your RSA edition of the #DataInsecurity Digest! Much of Washington’s data security elite have decamped to sunny San Francisco for the annual RSA Conference—a who’s who of data security researchers and policymakers. But, never fear, we remain here in early spring-time DC to cover the latest in data security-focused policy and consumer news.
The FTC’s new Consumer Sentinel Data Book is out, so we’ll be busy digging into the complaint data to see what trends are emerging in the data security space. Also In this edition of the #DID, we highlight a new effort by consumer groups (including yours truly) to work with the FTC to take a look at the problem of unwanted software—those pesky ad injectors and other bloatware that slow down your computer and leave it more vulnerable to malware. Also, the scope of the IRS breach keeps getting bigger—now up to 700,000 records affected (and possibly growing). In the Guardian, Tom Lamont takes a deep dive into the impact of the AshleyMadison.com breach and the lackluster response by parent company Avid Life Media. However, there’s a bit of silver lining in the breach world. According to new research from Mandiant, the average time to detect a breach fell to 146 days in 2015 from 205 days in 2014, so it’s not all doom and gloom!
And now, on to the clips!
—————–
BREAKING: FTC Data Book shows continued uptick in ID theft complaints. For data security geeks, the publication of the FTC’s annual Consumer Sentinel Data Book is an opportunity to dig into one of the richest troves of complaint data available. This year is no different, with identity theft continuing to rank as a top consumer concern. With more than half a million complaints submitted to the agency, ID theft was the second-biggest complaint category in 2015. Phony debt collection ranked #1 this year, thanks in part to the contribution of telemarketing complaint service PrivacyStar. (Source: Federal Trade Commission)
Consumer groups call on FTC to convene workshop on unwanted software. In a letter to FTC Chairwoman Edith Ramirez, NCL and four other consumer groups urge the Commission to convene a workshop to examine the continuing problem of unwanted software. Wrote the groups: “Unwanted software are programs that consumers install inadvertently, typically because the program is bundled (often deceptively) with another program that the consumer intends to install. … In particular, we are concerned that unwanted software may disable security updates to operating systems, Web browsers or other essential software. This can leave consumers’ computers especially vulnerable to malware infections and raise the risk of fraud such as identity theft.” (Source: National Consumers League)
Drip, drip … IRS data breach keeps getting bigger. The hack of the IRS’s Get Transcript function was significantly worse than previously reported, said the agency’s Inspector General. The breach was originally thought to have compromised 114,000 accounts, but that number has since grown twice—first to 334,000, and now to as many as 724,000. Of note is the role that weak security at tax preparers may have played in the breach. Citing @otaalliance data, @cbsnews reports that “six out of 13 IRS-approved companies failed at providing adequate security to customers.” (Source: CBS News)
What was it like to be caught up in the AshleyMadison.com breach? Writing for the Guardian, @tomlamont has an incredibly in-depth look at what went on behind the scenes as Avid Life Media, the parent company of AshleyMadison.com, struggled to deal with one of the most sensitive data breaches in history. “The hack of Ashley Madison was historic – the first leak of the online era to expose to mass view not passwords, not pictures, not diplomatic gossip, not military secrets, but something weirder, deeper, less tangible. This was a leak of desires.” (Source: The Guardian)
Issa: Forcing Apple to break iPhone security “sets a dangerous precedent.” Amid all the discussion over Apple’s ongoing legal fight with the FBI over the bureau’s order that the tech giant help them gain access to a San Bernardino shooter’s iPhone, Congressman Darrell Issa took to the pages of WIRED to warn against unintended consequences of such an action. “Forcing Apple to manufacture new security vulnerabilities into its phones’ operating system in order to give the government access paves the way for these kinds of breaches to become all the more common. But even more alarming are the implications this decision would have for the online security of Americans for generations.” (Source: WIRED)
ICYMI: Rep. Johnson introduces mobile privacy, data broker bills. We missed this nugget in our last issue of the Digest, but on February 10, Congressman Hank Johnson (D-GA) introduced two bills to address mobile device privacy and security and data broker information collection practices. The good folks at @kslaw have the summary: “The Apps Act [would require mobile app developers] to take ‘reasonable and appropriate measures’ to safeguard the data they collect from users. The Apps Act authorizes the FTC to enforce these requirements under its existing unfair and deceptive trade practices authority codified in Section 5 of the FTC Act and permits state enforcement actions as well.” (Source: King and Spaulding)
Splunk SVP: Why cyber needs to be a priority on the 2016 campaign trail. Haiyan Song of security firm Splunk (tweeting from @SplunkGov) lays out why cybersecurity is becoming a bigger part of the campaign agenda. “The fact that we’re seeing regular, in-depth media coverage and ongoing discussions in Washington around cybersecurity proves this issue is more than a trend, it’s a sign that cybersecurity has become a national priority.” (Source: The Hill)
1,700 kids’ records exposed at uKnowKids. Chris Vickery, whose security research has exposed breaches at Microsoft, MacKeeper, and elsewhere, has another site to add to his roster—child-tracker app maker uKnowKids. Writing in the Register, @jleyden notes that “[a] misconfigured database at uKnowKids.com exposed the data of 1,700 children, their personal messages, social media profiles, and images. More than 6.8 million private text messages, nearly 2 million images (many depicting children), and more than 1,700 detailed child profiles were left exposed, according to Vickery. This includes first and last names, email addresses, dates of birth, GPS coordinates, social media access credentials, and more.” (Source: The Register)
OPM breach claims CIO. The ongoing saga of the data breach at the Office of Personnel Management (OPM), which compromised the data of more than 20 million federal employees, has claimed another victim—the agency’s CIO. Donna Seymour, OPM’s top cybersecurity officer resigned on February 22, two days in advance of new hearings in the House of Representatives on the breach. And it wouldn’t be Washington if politics didn’t intrude, writes @ErinVKelly. Said House Oversight Committee Chair Jason Chaffetz: “Her retirement is necessary and long overdue. On her watch, whether through negligence or incompetence, millions of Americans lost their privacy and personal data.” Ranking Member Elijah Cummings fired back: “Efforts by Republicans to blame her for the cyber attack on OPM are both unfair and inaccurate. And they set a terrible precedent that will discourage qualified experts from taking on the challenges that face our nation in the future.” (Source: USA TODAY)
Wendy’s data breach lawsuits start to roll in. Consumers are looking to the courts for compensation in response to a point-of-sale terminal breach at Wendy’s restaurants. Notes @LegalNewsline: The suit alleges Wendy’s could have prevented the data breach by adopting technology that helps make transactions more secure, especially as the software used in the data breach was allegedly likely a variant of the ‘BlackPOS’ strain that hackers used in last year’s data breach at many other retail establishments.” (Source: LegalNewsline)
WSJ: Microsoft upping its cybersecurity game. Recognizing the ubiquity of threats to its many platforms—PCs, mobile devices, and gaming consoles—Microsoft is making news for its new Cyber Defense Operation Center. Writes @greene, “‘Microsoft has been on the fringe of security for some time,’ said Duncan Brown, research director at IDC Research Inc. ‘Now, they are putting it at the center of operations.’” (Source: Wall Street Journal)
“Breach stats: Improving from abysmal to just awful.” @ErickaChick has the story on new data out from Mandiant M-Trends showing gradual improvement in breach response times. “[T]he median number of days it takes for victim firms to discover breaches dropped significantly to 146 days from 205 days in 2014. This is the fourth year in a row that the number has fallen. Compared to 416 days of 2011, this figure shows the industry has made marked improvements.” (Source: Information Week)
Upcoming events
RSA Conference – February 29-March 4 – San Francisco, CA
The premier conference for Internet security professionals. Agenda will include speakers from the DOJ, DOE, Department of Homeland Security, FBI, and NSA, among others.
National Consumer Protection Week – March 6-12 – Nationwide
The FTC is the hub for the annual National Consumer Protection Week. Among the topics on tap this year: identity theft and technology.