Welcome to the second issue of the Health Advisory Council Newsletter!
Mark your calendar for our end-of-year Council event: a briefing and holiday reception, featuring remarks by Dr. Robert M. Califf, Deputy Commissioner for Tobacco and Medical Products, U.S. Food and Drug Administration (FDA), recently nominated to be the next FDA Commissioner. Please join us on Monday, Dec. 7 at 4 pm at the Omni Shoreham Hotel in Washington, DC to hear from Dr. Califf, and network with other Council members. Please RSVP by Dec. 1 here!
NCL health policy at work
.jpg)
Script Your Future Campaign – “So Simple, So Hard” was the theme of a medication adherence conference hosted by NCL in September in Sacramento, CA. Sponsored by the Agency for Healthcare Research and Quality (AHRQ), the speakers and attendees explored the challenges and barriers to medication adherence and highlighted tools and strategies to improve adherence and health outcomes, especially among underserved populations. NCL gathered more than 80 stakeholders including health care professionals, community health workers, advocates, industry representatives, policy makers, and researchers. Conference participants heard from researchers and experts on adherence and engaged with each other about possible collaborations and solutions. Click here to view conference presentation slides and video.[1]
In addition to the research conference, Script Your Future California partnered with the California Chronic Care Coalition and the California Pharmacists Association to conduct an informational briefing hosted by state Senators Richard Pan, MD and Jeff Stone, PharmD on Oct. 21in Sacramento. “Chronic Disease and Medication Non-Adherence: Problems worth Solving,” featured evidence based strategies to improve outcomes and reduce costs when treating people with chronic diseases, with a focus on Comprehensive Medication Management. In addition to the state Senators, speakers included Sloane Salzburg, Council for Affordable Health Care, Prescriptions for a Healthy America; Assistant U.S. Surgeon General Pamela Schweitzer, PharmD; the University of Southern California’s Steven Chen, PharmD; and Michael Hochman, MD, with AltaMed Health Services. Briefing materials are available here.
PDUFA VI – NCL was one of two consumer groups invited by the FDA to be part of a panel at a public hearing on the reauthorization of the Prescription Drug User Fee Act (PDUFA) at the FDA this summer. Under PDUFA, the pharmaceutical industry provides resources for FDA to review medications. As part of her comments, Sally Greenberg, NCL executive director, made the case that there is a difference between patients and consumers, in how they view and weigh risks. A patient suffering from a serious illness is far more likely to take on greater risk to get the benefits from a specific treatment. A consumer, on the other hand, may refrain from taking a high-risk drug or choose a lower-risk drug for a moderate to mild illness or condition. The difference in risk assessment between patients and consumers is critical when considering the policy implications in the sixth reauthorization of PDUFA.
Health insurance marketplace – NCL was part of an Alliance for Health Reform briefing in July called “Empowering the Consumer as the Ultimate Health Care Stakeholder.” The briefing, the first in a two-part series on the role of consumers and patients in our healthcare system and co-sponsored by NCL, explored questions such as: How is the evolving insurance marketplace affecting the choices consumers have when selecting a health plan, whether through a health insurance exchange, employer, or other mechanism? What information do consumers need to select a plan that is right for them? Rebecca Burkholder, NCL vice president of health policy, provided an overview of the consumer experience in today’s health care system, patients’ priorities in making health care and coverage decisions, and the challenges patients face in selecting a plan.
21st Century Cures – NCL was recently part of a group of patient and consumer advocates who met with FDA officials, including Acting FDA Commissioner, Dr. Stephen Ostroff, and nominated FDA Commissioner, Dr. Robert Califf, regarding concerns about the 21st Century Cures Act. The Act , passed the House in July, intends to accelerate the discovery, development, and delivery of new drugs and devices. The legislation is currently being reviewed by the Senate HELP Committee. While some aspects of the bill could speed up the development of and access to new drugs, NCL and other consumer and patient groups have expressed concern that it could ultimately lower standards for approval of many medical products, placing patients at unnecessary risk. The current version of the bill would allow consideration of drug approvals based on clinical experience, replacing scientific data from large numbers of patients in well-designed and controlled clinical trials. Advocates also fear approval standards for medical devices could become less rigorous. As a part of a patient and consumer coalition, NCL is working to ensure that the bill provides greater access to medications without sacrificing safety.
FDA approves first female treatment for low libido – This fall, NCL welcomed an announcement from the FDA of its approval of the first-ever treatment for women’s low libido. Approval of the drug—flibanserin, which will be sold under the name ADDYI—came nearly four decades after the condition of HSDD (Hypoactive Sexual Desire Disorder), which it will treat, was first recognized in scientific journals. For months, NCL and other advocates had been calling for FDA to consider the treatment option because it would be the first of its kind for women. In October 2014 and June 2015, NCL Executive Director Sally Greenberg testified in support of treatments for patients suffering from HSDD.
Reagan Udall Foundation Board – NCL is a member of the Congressionally created Reagan Udall Foundation board formed to support the FDA. RUF is a private public partnership that works on a variety of projects, including analyzing FDA data for safety signals on drugs, devices and other products regulated by the FDA.
Medicare Advantage Care Coordination (MACC) Task Force – Despite the fact that two-thirds of Medicare beneficiaries have two or more chronic conditions, care for many of these individuals is fragmented. Beneficiaries often shuffle between numerous providers in multiple care settings, including doctors’ offices, the ER and hospital facilities. Without sufficient coordination across these various points of care, the health issues these beneficiaries are already facing may be compounded. NCL recently joined the MACC Task Force, an initiative founded by the Association of Health Insurance Plans, which is a collaboration of leading aging, caregiver, patient and provider organizations addressing the critical issue of care coordination. In October the Task Force launched the Care for Us Project, a campaign to build awareness around best practices related to care coordination and disease management of specific chronic conditions prevalent among Medicare beneficiaries
NCL staffing news
Health policy staff changes – After 14 years at NCL, Rebecca Burkholder, vice president of health policy, will be departing in early 2016 to start a new career in Thailand, focusing on international development work. “I have truly appreciated having the opportunity to work on consumer health issues at NCL and to collaborate with so many well-respected organizations,” Burkholder said. NCL welcomes suggestions for potential candidates or other considerations as we look to fill this position. You can access the job description here. We look forward to introducing our new Director of Health Policy to the Health Advisory Council in 2016!
Meet our new Linda Golodner Food Safety & Nutrition Fellow, Ali Schklair!
Ali is a graduate of Smith College and is from Cape Elizabeth, ME. She joined NCL staff in September after her time at the Nurse Practitioners in Women’s Health as a Continuing Education Coordinator.
“I came to NCL from an organization that works with health care providers, and it was interesting for me to switch over to an organization that supports consumers. Joining NCL with previous experience working with providers allows me to look at issues in full scope,” said Ali.
Schklair’s time at NCL has overlapped with the FDA’s new rules for the Food Safety Modernization Act (FSMA). This gave her the opportunity to learn about food safety during a very pivotal time. Read her thoughts on the final preventive control rules here.
Member spotlight
Get to know two Health Advisory Council members–NCPIE and Lilly–with new Q&A’s.
Updates on member programs
National Council on Patient Information and Education (NCPIE) – Boy Scouts’ Safe Medicine Use Program. The Boy Scouts of America are joining efforts to promote safe medicine use with the new SCOUTStrong Be MedWise Award program, providing Scouts the opportunity to earn a patch for learning about responsible use of medicines. Created in collaboration with the National Council on Patient Information and Education, (NCPIE) the lessons involved in earning the patch–like learning how to read, understand, and follow a medicine label–can set youth on a course of responsible medicine use they can carry forward for the rest of their lives. The curriculum is also publicly available for educators and youth initiatives.
United States Pharmacopeia (USP) – Fight against food fraud. Globalization of food supply chains has helped make possible the wonderful, diverse, and affordable food supply that we all enjoy today. At the same time, it has increased the complexity, scale, and dynamics our food system, opening new doors of opportunities for fraudulent adulteration. To help manufacturers and regulators identify the ingredients most vulnerable to fraud in their supply chains and choose effective mitigation tools to combat economically-motivated adulteration, the USP recently released its Food Fraud Mitigation Guidance. Learn more about this tool and its potential impact on USP’s Quality Matters blog.
McNeil Consumer Healthcare – OTC Safety Program for 5th and 6th Graders. McNeil is thrilled to share the news of the launch of the 4th year of the OTC Medicine Safety program. This program, developed in partnership with Scholastic and the American Association of Poison Control Centers, is an evidence-based educational program tailored towards 5th and 6th grade students with the goal of providing free resources to teachers, school nurses, community leaders, and families to support the education of tweens about the responsible use and storage of medicines. Research shows that students begin to self-medicate at 11 years old; if not equipped with the knowledge and training to make responsible choices around OTC use, they can form unsafe habits. Visit scholastic.com/OTCmedsafety to explore the new and improved website experience and the extensive host of optimized resources available – all available for free – to teachers, nurses, parents, and community leaders. Reach out to Leily Saadat-Lajevardi at lsaadat@its.jnj.com for materials to help you promote the program!
Consumer Healthcare Products Association (CHPA) – Acetaminophen Awareness Coalition “Double Check; Don’t Double Up” Campaign. Acetaminophen is found in more than 600 over-the-counter (OTC) and prescription medicines, including many that treat cough, cold, and flu symptoms. It’s safe and effective when used as directed, but there is a limit to how much you can take in one day. Taking more than directed is an overdose and can lead to liver damage. Taking two medicines with the same ingredient could be harmful. That’s why it’s important to read and follow the label every time you take a medicine. Double check; don’t double up! Find out more at KnowYourDose.org
CHPA survey on consumer knowledge About OTCs. In September, the CHPA Educational Foundation released the results of its national survey, conducted to identify consumers’ knowledge gaps around the appropriate use, storage, and disposal of oral OTC medicines. The survey was conducted online by Harris Poll in February 2015 among 2,002 U.S. adults 18 and older who have used or purchased oral OTC medicines in the last six months. Learn more at KnowYourOTCs.org
CHPA’s Up and Away Campaign. Pediatrics, the official journal of the American Academy of Pediatrics, in September reported a declining number of emergency department (ED) visits for unsupervised medication exposures in young children since 2010. After rising steadily from 2004 through 2010, the number of ED visits for these exposures peaked in 2010. According to the article, after 2010 this trend reversed, and visits decreased by an average of 6.7 percent annually. Through Up and Away and Out of Sight, a campaign led by CHPA’s Educational Foundation and the U.S. Centers for Disease Control and Prevention’s PROTECT Initiative, CHPA continues to remind parents and caregivers to store their medicine up and away and out of the reach of children. For more information, visit UpAndAway.org.
We want to hear from you!
We are seeking Advisory Council member input on events and activities for 2016. Feel free to contact Amy Sonderman with any ideas or suggestions (amys@nclnet.org).
[1] Funding for this conference was made possible in part by grant number 1R13HS023948-01A1 from the Agency for Healthcare Research and Quality (AHRQ). The views expressed in written conference materials or publications and by speakers and moderators do not necessarily reflect the official policies of the Department of Health and Human Services; nor does mention of trade names, commercial practices, or organizations imply endorsement by the U.S. Government.
Health Advisory Council Newsletter | Fall 2015
/byWelcome to the second issue of the Health Advisory Council Newsletter!
Mark your calendar for our end-of-year Council event: a briefing and holiday reception, featuring remarks by Dr. Robert M. Califf, Deputy Commissioner for Tobacco and Medical Products, U.S. Food and Drug Administration (FDA), recently nominated to be the next FDA Commissioner. Please join us on Monday, Dec. 7 at 4 pm at the Omni Shoreham Hotel in Washington, DC to hear from Dr. Califf, and network with other Council members. Please RSVP by Dec. 1 here!
In addition to the research conference, Script Your Future California partnered with the California Chronic Care Coalition and the California Pharmacists Association to conduct an informational briefing hosted by state Senators Richard Pan, MD and Jeff Stone, PharmD on Oct. 21in Sacramento. “Chronic Disease and Medication Non-Adherence: Problems worth Solving,” featured evidence based strategies to improve outcomes and reduce costs when treating people with chronic diseases, with a focus on Comprehensive Medication Management. In addition to the state Senators, speakers included Sloane Salzburg, Council for Affordable Health Care, Prescriptions for a Healthy America; Assistant U.S. Surgeon General Pamela Schweitzer, PharmD; the University of Southern California’s Steven Chen, PharmD; and Michael Hochman, MD, with AltaMed Health Services. Briefing materials are available here.
PDUFA VI – NCL was one of two consumer groups invited by the FDA to be part of a panel at a public hearing on the reauthorization of the Prescription Drug User Fee Act (PDUFA) at the FDA this summer. Under PDUFA, the pharmaceutical industry provides resources for FDA to review medications. As part of her comments, Sally Greenberg, NCL executive director, made the case that there is a difference between patients and consumers, in how they view and weigh risks. A patient suffering from a serious illness is far more likely to take on greater risk to get the benefits from a specific treatment. A consumer, on the other hand, may refrain from taking a high-risk drug or choose a lower-risk drug for a moderate to mild illness or condition. The difference in risk assessment between patients and consumers is critical when considering the policy implications in the sixth reauthorization of PDUFA.
Health insurance marketplace – NCL was part of an Alliance for Health Reform briefing in July called “Empowering the Consumer as the Ultimate Health Care Stakeholder.” The briefing, the first in a two-part series on the role of consumers and patients in our healthcare system and co-sponsored by NCL, explored questions such as: How is the evolving insurance marketplace affecting the choices consumers have when selecting a health plan, whether through a health insurance exchange, employer, or other mechanism? What information do consumers need to select a plan that is right for them? Rebecca Burkholder, NCL vice president of health policy, provided an overview of the consumer experience in today’s health care system, patients’ priorities in making health care and coverage decisions, and the challenges patients face in selecting a plan.
21st Century Cures – NCL was recently part of a group of patient and consumer advocates who met with FDA officials, including Acting FDA Commissioner, Dr. Stephen Ostroff, and nominated FDA Commissioner, Dr. Robert Califf, regarding concerns about the 21st Century Cures Act. The Act , passed the House in July, intends to accelerate the discovery, development, and delivery of new drugs and devices. The legislation is currently being reviewed by the Senate HELP Committee. While some aspects of the bill could speed up the development of and access to new drugs, NCL and other consumer and patient groups have expressed concern that it could ultimately lower standards for approval of many medical products, placing patients at unnecessary risk. The current version of the bill would allow consideration of drug approvals based on clinical experience, replacing scientific data from large numbers of patients in well-designed and controlled clinical trials. Advocates also fear approval standards for medical devices could become less rigorous. As a part of a patient and consumer coalition, NCL is working to ensure that the bill provides greater access to medications without sacrificing safety.
FDA approves first female treatment for low libido – This fall, NCL welcomed an announcement from the FDA of its approval of the first-ever treatment for women’s low libido. Approval of the drug—flibanserin, which will be sold under the name ADDYI—came nearly four decades after the condition of HSDD (Hypoactive Sexual Desire Disorder), which it will treat, was first recognized in scientific journals. For months, NCL and other advocates had been calling for FDA to consider the treatment option because it would be the first of its kind for women. In October 2014 and June 2015, NCL Executive Director Sally Greenberg testified in support of treatments for patients suffering from HSDD.
Reagan Udall Foundation Board – NCL is a member of the Congressionally created Reagan Udall Foundation board formed to support the FDA. RUF is a private public partnership that works on a variety of projects, including analyzing FDA data for safety signals on drugs, devices and other products regulated by the FDA.
Medicare Advantage Care Coordination (MACC) Task Force – Despite the fact that two-thirds of Medicare beneficiaries have two or more chronic conditions, care for many of these individuals is fragmented. Beneficiaries often shuffle between numerous providers in multiple care settings, including doctors’ offices, the ER and hospital facilities. Without sufficient coordination across these various points of care, the health issues these beneficiaries are already facing may be compounded. NCL recently joined the MACC Task Force, an initiative founded by the Association of Health Insurance Plans, which is a collaboration of leading aging, caregiver, patient and provider organizations addressing the critical issue of care coordination. In October the Task Force launched the Care for Us Project, a campaign to build awareness around best practices related to care coordination and disease management of specific chronic conditions prevalent among Medicare beneficiaries
Meet our new Linda Golodner Food Safety & Nutrition Fellow, Ali Schklair!
Ali is a graduate of Smith College and is from Cape Elizabeth, ME. She joined NCL staff in September after her time at the Nurse Practitioners in Women’s Health as a Continuing Education Coordinator.
“I came to NCL from an organization that works with health care providers, and it was interesting for me to switch over to an organization that supports consumers. Joining NCL with previous experience working with providers allows me to look at issues in full scope,” said Ali.
Schklair’s time at NCL has overlapped with the FDA’s new rules for the Food Safety Modernization Act (FSMA). This gave her the opportunity to learn about food safety during a very pivotal time. Read her thoughts on the final preventive control rules here.
Get to know two Health Advisory Council members–NCPIE and Lilly–with new Q&A’s.
National Council on Patient Information and Education (NCPIE) – Boy Scouts’ Safe Medicine Use Program. The Boy Scouts of America are joining efforts to promote safe medicine use with the new SCOUTStrong Be MedWise Award program, providing Scouts the opportunity to earn a patch for learning about responsible use of medicines. Created in collaboration with the National Council on Patient Information and Education, (NCPIE) the lessons involved in earning the patch–like learning how to read, understand, and follow a medicine label–can set youth on a course of responsible medicine use they can carry forward for the rest of their lives. The curriculum is also publicly available for educators and youth initiatives.
United States Pharmacopeia (USP) – Fight against food fraud. Globalization of food supply chains has helped make possible the wonderful, diverse, and affordable food supply that we all enjoy today. At the same time, it has increased the complexity, scale, and dynamics our food system, opening new doors of opportunities for fraudulent adulteration. To help manufacturers and regulators identify the ingredients most vulnerable to fraud in their supply chains and choose effective mitigation tools to combat economically-motivated adulteration, the USP recently released its Food Fraud Mitigation Guidance. Learn more about this tool and its potential impact on USP’s Quality Matters blog.
Consumer Healthcare Products Association (CHPA) – Acetaminophen Awareness Coalition “Double Check; Don’t Double Up” Campaign. Acetaminophen is found in more than 600 over-the-counter (OTC) and prescription medicines, including many that treat cough, cold, and flu symptoms. It’s safe and effective when used as directed, but there is a limit to how much you can take in one day. Taking more than directed is an overdose and can lead to liver damage. Taking two medicines with the same ingredient could be harmful. That’s why it’s important to read and follow the label every time you take a medicine. Double check; don’t double up! Find out more at KnowYourDose.org
CHPA survey on consumer knowledge About OTCs. In September, the CHPA Educational Foundation released the results of its national survey, conducted to identify consumers’ knowledge gaps around the appropriate use, storage, and disposal of oral OTC medicines. The survey was conducted online by Harris Poll in February 2015 among 2,002 U.S. adults 18 and older who have used or purchased oral OTC medicines in the last six months. Learn more at KnowYourOTCs.org
CHPA’s Up and Away Campaign. Pediatrics, the official journal of the American Academy of Pediatrics, in September reported a declining number of emergency department (ED) visits for unsupervised medication exposures in young children since 2010. After rising steadily from 2004 through 2010, the number of ED visits for these exposures peaked in 2010. According to the article, after 2010 this trend reversed, and visits decreased by an average of 6.7 percent annually. Through Up and Away and Out of Sight, a campaign led by CHPA’s Educational Foundation and the U.S. Centers for Disease Control and Prevention’s PROTECT Initiative, CHPA continues to remind parents and caregivers to store their medicine up and away and out of the reach of children. For more information, visit UpAndAway.org.
We are seeking Advisory Council member input on events and activities for 2016. Feel free to contact Amy Sonderman with any ideas or suggestions (amys@nclnet.org).
[1] Funding for this conference was made possible in part by grant number 1R13HS023948-01A1 from the Agency for Healthcare Research and Quality (AHRQ). The views expressed in written conference materials or publications and by speakers and moderators do not necessarily reflect the official policies of the Department of Health and Human Services; nor does mention of trade names, commercial practices, or organizations imply endorsement by the U.S. Government.
The #DataInsecurity Digest | Issue 7
/byIssue 7 | Nov. 4, 2015
By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud
Subscribe here. Tell us what you think.
Editor’s Note: Despite opposition from the tech industry and privacy/consumer advocates, the Senate approved the Cyber Information Sharing Act (CISA). But will the bill, once enacted, actually do much good to protect consumers’ data security? The consensus, according to security watchers at the New York Times and KrebsonSecurity.com is that Congress felt like it needed to do something, even if it was a bad bill like CISA. In other data security news: USPIRG wants you to get a credit freeze; 000Webhost.com loses 13 million passwords; and we find out why Craigslist isn’t the best place to place a wanted ad for a hacker.
And don’t forget to tune in on Thursday for the FTC’s second Start with Security conference, direct from Austin, TX. We’re keeping the #DID weird here in DC, so let’s roll on to the clips!
—————–
CISA passes Senate: Was it worth it? @SangerNYT and @nicoleperlroth take a look at what hath Congress wrought, and find it wanting: “In the years that Congress was debating it, computer attackers have grown so much more sophisticated — in many cases, backed by state sponsors from Shanghai to Tehran — that the central feature of the legislation, agreements allowing companies and the government to share information, seems almost quaint. To many in the trenches of daily computer combat, it is a little like the insistence of some cavalry officers in the 1930s on sticking to horses, rather than investing in mechanized divisions.” (Source: New York Times)
Instant analysis: “Virtually impossible” to tell if CISA will do any good. @BrianKrebs offers his take: “The most frustrating aspect of a legislative approach to fixing this problem is that it may be virtually impossible to measure whether a bill like CISA will in fact lead to more information sharing that helps companies prevent or quash data breaches. Meanwhile, history is littered with examples of well-intentioned laws that produce unintended (if not unforeseen) consequences.” (Source: KrebsonSecurity.com)
Breach du Jour: 13M passwords from prominent web hosting firm. If you needed another reminder to turn on two-factor authentication, news of a massive breach at (apparently) Arizona-based web hosting company 000Webhost.com comes to us from @dangood001: Anyone who has used 000Webhost should be on the alert for fraud. In the event that users have used the same or a similar password on other websites, they should change it immediately. The fresh infusion of 13 million passwords into the already massive corpus of existing passwords should bring new urgency to the oft-repeated admonition to use a long, randomly generated password that’s unique to every site. (Source: Ars Technica)
USPIRG: The time to get a credit freeze is before a breach. (with a hat tip to @EdMPIRG) Consumer colleagues USPIRG are out with a new report containing advice that we’re increasingly giving consumers to help reduce the risk of breach-fueled identity fraud: Get a credit freeze now. “‘Only the security freeze can prevent someone from opening a new credit account in your name,’ said Mike Litt (@MikeLittUSA) of U.S. PIRG. ‘Credit monitoring services may tell you but only after you’ve already been victimized. Worse, they are often offered after simple retail credit number breaches, even though they offer no help against unauthorized use of your existing accounts, which is the fraud most likely to occur from that type of breach.’” (Source: USPIRG)
Bankers mobilizing behind Carper-Blunt bill. American Bankers Association head Frank Keating is in The Hill calling for Congress to move on the Carper-Blunt Data Security Act of 2015. Expect resistance from retailers and advocates. (Source: The Hill)
Nearly 1 in 4 U.S. business get cyber insurance. New research from the Council on Insurance Agents and Brokers (@TheCIAB) puts the take rate on cyber insurance for U.S. businesses at 24%. “As cyber threats move beyond just the theft of personal information, meaningful business interruption insurance is starting to become available,” said [CIAB President and CEO Ken] Crerar. “While the market has more loss data on cyber incidents, theft of intellectual property, physical damage and bodily injury are still not fully comprehended.” (Source: CIAB)
Self-regulatory news: CEA offers “guiding principles” for wellness data. With the explosion in IoT, the Consumer Electronics Association (@CEA) has offered up a new set of voluntary guidelines for wearables manufacturers. Nice to see “Provide robust security measures” at the top of the list. (Source: CEA)
SMU study: C-Suite increasingly “gets it” on cybersecurity. Key data points from a new survey of CISO’s on the state of cybersecurity preparedness: “More than 80 percent of those interviewed reported broad and increasing support among senior-level management and corporate boards for their cybersecurity efforts; Eighty-eight percent of respondents reported that their security budgets have increased.” (Source: SMU)
Small biz data breach case study: Less than 1 hour from start to pWn3d. Joe Ross of security firm @CSIdentity is out with the result of an interesting experiment. He looked at how quickly hackers can take down a new small business when employees make common data security mistakes. “Our experiment further ensured that Jomoco’s fictional employees made common mistakes when protecting their professional and personal data online, including sharing sensitive information via email and reusing passwords across multiple sites. Then we sat back and let the real cyber criminals take it from there. … We didn’t wait long. Within an hour, and armed only with a personal email and login, hackers completely shut down Jomoco.” (Source: Entrepreneur.com
Sony settles employee data breach suit for $8M. Remember the Sony Pictures hack that made news last year? Affected employees will finally see some restitution for the harm caused by (alleged) North Korean hackers, writes @edpettersson for Bloomberg: “Former employees alleged the company knew it had inadequate measures in place to protect its data and suffered breaches twice before last year’s attack. The former employees claimed Sony made a ‘business decision to accept the risk’ of losses associated with being hacked. … Some ex-employees claimed in July that identity thieves had attempted to use their credit cards and were trying to sell their personal data on black market websites.” (Source: Bloomberg)
#DataInsecurity news of the weird: PA man gets two years for hiring hackers to erase court records. (H/T @PogoWasRight) “A Harrisburg man will serve at least two years in prison for recruiting a computer hacker to wipe out fines he owed to Lancaster County. … Landis posted an advertisement on Craigslist for a hacker who could erase records of more than $16,000 he owes for victim restitution, fines, and court costs.” (Source: ABC 27)
Upcoming Events
Postponed – U.S. Cyber Crime Conference
Originally scheduled for National Harbor, Nov. 18-20. Make-up date/location TBD.
Nov. 5 – After the Shift: Securing Tomorrow’s Payment Technology – Washington, DC
The recent shift to chip technology in credit and other payment cards aims to reduce fraud and better protect consumer data. But as cyber threats become more sophisticated, what are the financial services and tech industries doing to stay ahead? Speakers to include: Sen. Gary Peters (D-MI), Sen. Mike Rounds (R-SD), Rep. Ed Perlmutter (D-CO-7)
Nov. 5 – Start with Security – Austin, TX
This one-day conference will continue the FTC’s work to provide companies with practical tips and strategies for implementing effective data security. Aimed at start-ups and developers, this event will bring together experts to provide information on security by design, common security vulnerabilities, strategies for secure development, and vulnerability response.
Jan. 14, 2016 – PrivacyCon – Washington, DC
The FTC will hold a conference on January 14, 2016 to bring together a diverse group of stakeholders, including whitehat researchers, academics, industry representatives, consumer advocates, academics, and a range of government regulators, to discuss the latest research and trends related to consumer privacy and data security.
National Consumers League
Published November 4, 2015
The #DataInsecurity Digest | Issue 6
/byIssue 6 | Oct. 20, 2015
By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud
Subscribe here. Tell us what you think.
Editor’s Note: As Congress returns from its Columbus Day recess, there are rumblings that the Senate is expected to take up the long-delayed Cybersecurity Information Sharing Act of 2015 (CISA). The case for data security reform (though not necessarily CISA itself) was highlighted last week when NCL, along with 24 other consumer privacy organizations, called on the CFPB and FTC to investigate the breach at Experian that led to the exposure of 15 million T-Mobile customer records. CISA also made waves on the presidential campaign trail when Democratic candidate Sen. Bernie Sanders announced his opposition to the bill. Finally, if you haven’t already done so, mark your calendars for the FTC’s second “Start with Security” event in Austin on Nov. 5. We will be following the event with interest, particularly to see what Commissioner McSweeny has to say about data security and the startup economy.
—————–
Bloomberg: Dow Jones breach potentially involved market-moving info. @MichaelRileyDC has the story on the latest hack of potential market-moving information: “The breach is described by the people as far more serious than a lower-grade intrusion disclosed a week ago by Dow Jones, a unit of Rupert Murdoch’s News Corp. … Information embargoed by companies and the government for release at a later time could be valuable to traders looking to gain an edge over other market participants, as could stories being prepared on topics like mergers and acquisitions that move stock prices.” (Source: Bloomberg)
Groups urge FTC & CFPB to investigate Experian/T-Mobile breach. More than two dozen consumer and privacy organizations (including NCL) are calling on the FTC and CFPB to investigate security lapses at Experian and T-Mobile that could have contributed to the breach of 15 million T-Mobile customers’ and applicants’ personal information. The letter, via @USPIRG: “We believe this breach, occurring at one of the nationwide CRAs, takes this problem to a whole new and dangerous level given the extraordinarily large amounts of critical financial information they hold.” (Source: USPIRG)
More Experian/T-Mobile fallout: Senator wants answers. Sen. Sherrod Brown is using his perch as ranking member on the Senate Banking, Housing and Urban Affairs Committee to demand answers from Experian and push for free credit freezes and an end to forced arbitration (h/t @KatieBoWill). (Source: Office of U.S. Senator Sherrod Brown)
Krebs: Talent exodus at Experian could have contributed to T-Mobile breach. @briankrebs talks to a number of ex-Experian security staff to get the inside scoop on factors that could have allowed the T-Mobile breach to occur: “Over the past week, KrebsOnSecurity has interviewed a half-dozen security experts who said they recently left Experian to find more rewarding and less frustrating work at other corporations. Nearly all described Experian as a company fixated on acquiring companies in the data broker and analytics technology space, even as it has stymied efforts to improve security and accountability.” (Source: KrebsOnSecurity)
Bernie comes out against CISA. No candidates on the Democratic side of the ledger had taken positions on the Cyber Information Sharing Act until Bernie Sanders made his opposition clear last week. @ericgeller for @DailyDot: “Sanders’ stance … aligns him with privacy advocates and makes him the only Democratic presidential candidate to stake out that position … Sanders has not decided whether or not to join a potential filibuster. His office told the Daily Dot that he is waiting to see which of the 22 proposed amendments get votes on the Senate floor.” (Source: The Daily Dot)
Study: 87% of Android devices are vulnerable. @RonAmadeo covers disturbing new information on the vulnerability of the world’s most popular mobile OS for @ArsTechnica: “…a recent study … finds that ‘on average 87.7% of Android devices are exposed to at least one of 11 known critical vulnerabilities.’ … As for why so many Android devices are insecure, the study found that most of the blame sits with OEMs. The group states that ‘the bottleneck for the delivery of updates in the Android ecosystem rests with the manufacturers, who fail to provide updates to fix critical vulnerabilities.’”
EU moves toward comprehensive data breach notification. @markscott82, who handles EU tech reporting for @NYTimes, takes a look at the coming EU breach notification regs: “Under the proposals, any company — even one based outside Europe — that collects and manages data about the region’s more than 500 million residents would need to inform a national privacy watchdog within 72 hours of discovering a data breach. … The rules, which are still being negotiated, are expected to be completed by early next year and take effect as early as 2018.” (Source: New York Times)
Think Millennials don’t care about privacy & security? Think again! UK-based cybersecurity firm @IntercedeMyID is out with a new survey of Millennials’ attitudes towards privacy and security online. Significant findings: “New survey reveals fewer than 5% of UK and US Millennials believe their digital identity is completely protected by effective safeguards; 70% believe risk to their online privacy will increase as we become more digitally connected; 54% claim failure of businesses to implement better online security will result in public distrust of goods and services.” (Source: Intercede)
California Gov. signs expanded breach notification bill. @natllawreview covers the impact of the changes Gov. Jerry Brown has made to California’s data breach notification law, considered the gold standard for breach notification laws by some. Among the changes: a strengthened definition of “encryption,” standardizing breach notice verbiage, and expanding the definition of “personally identifiable information” to cover data captured by automated license plate recognition (ALPR) system. (Source: National Law Review)
Stat du jour: Medical ID theft to affect 25M patients over next 5 years. New research from @Accenture puts the tab for health system cyber attacks at $305 million over the next five years, with one in 13 patients having their personal information compromised. (Source: Accenture)
Breach du Jour: America’s Thrift Stores. The chain of for-profit Christian charity thrift stores last week announced that its point-of-sale system was compromised last month, affecting credit and debit card transactions made Sept. 1-27. Point-of-sale systems have been a frequent target for hackers, as the stolen data can be quickly sold on online dark markets to carding rings who use the hacked cards to purchase high-dollar merchandise for resale. (Source: Krebs on Security)
ICYMI: New ITRC app puts ID theft counselors in your pocket. TheSan Diego-based Identity Theft Resource Center (@ITRCSD) recently released a helpful app to help ID theft victims. The new app “offers resources for victims including direct links to victim advisors, all free of charge to consumers. The app also offers educational tools for consumers wanting to protect themselves against identity theft.” Check it out! (Source: ITRC)
Upcoming Events
National Cybersecurity Awareness Month – National
October 2015
Oct. 30 – Follow the Lead: An FTC Workshop About Online Lead Generation – Washington, DC
The workshop will bring together a variety of stakeholders, including industry representatives, consumer advocates, and government regulators. The FTC has invited the public to submit research, recommendations for topics of discussion, and requests to participate as panelists.
Nov. 5 – Start with Security – Austin, TX
This one-day conference will continue the FTC’s work to provide companies with practical tips and strategies for implementing effective data security. Aimed at start-ups and developers, this event will bring together experts to provide information on security by design, common security vulnerabilities, strategies for secure development, and vulnerability response.
Jan. 14, 2016 – PrivacyCon – Washington, DC
The FTC will hold a conference on January 14, 2016 to bring together a diverse group of stakeholders, including whitehat researchers, academics, industry representatives, consumer advocates, academics, and a range of government regulators, to discuss the latest research and trends related to consumer privacy and data security.
National Consumers League
Published October 20, 2015
The #DataInsecurity Digest | Archive
/byThe #DataInsecurity Digest, a publication of the National Consumers League’s #DataInsecurity Project, monitors the latest in data breach news, including policy analysis and information about upcoming events.
New! November 7 | Issue 105: Equifax breach still generating headlines; Congress urging Barr to end attacks on encryption sponsible for breaches
Subscribe or view past issues below.
October 24 | Issue 104: Senator Wyden introduces bill empowering consumers to control their data, hold companies re
October 10 | Issue 103: As fears over foreign election interference grow, Washington remains idle
September 26 | Issue 102: Ecuador leaks personal data for its entire population
September 12 | Issue 101: Google warns of new iPhone hacking scheme while Texas towns continue to struggle with ransomware attack
August 29 | Issue 100: Massive biometric data breach raises concerns for long-term data security
August 15 | Issue 99: Millions of Intel processors, Boeing 787 planes, and WhatsApp all found to have major cyber vulnerabilities
August 1 | Issue 98: Settlement with Equifax, Capital One hack put spotlight back on financial breaches
July 18 | Issue 97: Regulators strike back as new data puts cost of breaches at $45 billion annually
July 3 | Issue 96: Despite saber-rattling, U.S. woefully unprepared for cyber war with Iran
June 20 | Issue 95: Federal contractors look to weaken Android cybersecurity as Trump Administration makes plans to beef up offensive cyber operations
June 6 | Issue 94: Senator questioning Alexa privacy issues; states leading efforts to strengthen security requirements
May 23 | Issue 93: With Baltimore being held hostage, ransomware fears growing once again
May 9 | Issue 92: Facebook nears settlement with FTC while hackers attack U.S.electric grid
April 25 | Issue 91: Nielsen’s departure from DHS deepens cyber anxiety, cyber insurance loopholes, and a worsening breach at Facebook
April 4 | Issue 90: FEMA leaks data on 2.5 million disaster victims, while President Trump’s budget slashes spending on cybersecurity readiness
March 21 | Issue 89: As Feds pursue Facebook, Schiff warns of cyber vulnerabilities in 2020
March 7 | Issue 88: Regulators in Europe, Members of Congress, consumer advocates taking a critical eye at misuse of consumer data
February 21 | Issue 87: Facebook reportedly nears hefty FTC settlement; national cybersecurity at risk from external hackers and internal ineptitude
February 7 | Issue 86: Post-shutdown cyber agenda: mitigate government brain drain, investigate Equifax
January 24 | Issue 85: Shutdown puts data security at risk while Big Tech’s ‘grand bargain’ lands with a thud
January 10 | Issue 84: As government shutdown continues, data insecurity only grows
December 13 | Issue 83: Marriott closes out the year with another mega-breach while Congressional bipartisanship on data security fades
November 29 | Issue 82: Facebook’s past and present handling of Cambridge Analytica scandal continues to draw criticism
November 15 | Issue 81: Mid-terms apparently free of hacking incidents; Dem control of House adds momentum to privacy, data security push
November 1 | Issue 80: Facebook breach is first test of GDPR data security penalties; midterm election integrity worries could depress voter turnout
October 18 | Issue 79: Google+ user data compromised, GAO reports on weapon vulnerability, CA legislating stronger passwords
October 4 | Issue 78: Facebook, Uber, others in the firing line as Big Tech data breaches draw increased scrutiny
September 20 | Issue 77: Warren: A year after Equifax, it doesn’t look like we’re any safer
September 6 | Issue 76: Financial data breach legislation on tap in Congress while cybersecurity insurance gets more attention
August 23 | Issue 75: Breach costs continue to climb while worries of state-sponsored hacks go unheeded
August 9 | Issue 74: Administration claims Russian hacking threat being taken seriously; evidence suggests otherwise
July 26 | Issue 73: Cyber threats are ‘blinking red’ as U.S. readiness struggles continue
July 12 | Issue 72: Data broker leaves 340M consumers’ most personal data unsecured
June 28 | Issue 71: New fraud related to OPM hack underscores growing threat of data breach fallout
June 14 | Issue 70: The FCC ‘hack’ that never was; U.S. thought to be nation most vulnerable to hacking
May 31 | Issue 69: Cyber challenges remain as Russia infects hundred of thousands of Internet routers
May 17 | Issue 68: As cyber threats continue to grow, White House eliminates top cyber job
May 3 | Issue 67: Pompeo pledges ‘great deal of resources’ to cybersecurity
April 19 | Issue 66: Russian hacker threat to consumer IoT devices prompts warnings from US, UK; Facebook’s woes continue
April 5 | Issue 65: The #DataInsecurity Digest | Issue 65: Facebook data leak estimated at 87 million accounts; Breaches affect Atlanta, Baltimore, Saks, Panera
March 22 | Issue 64: Facebook data leak prompts renewed calls for privacy legislation
March 8 | Issue 63: FTC calls for reforms to smartphone security update policies; White House AWOL on addressing Russian hacking
February 22 | Issue 62: Data security takes top billing at FTC Commissioners’ confirmation hearing
February 8 | Issue 61: 2017 found to be worst year ever for data breaches
January 25 | Issue 60: Federal shutdown impact on state election systems’ much-needed repairs; continued fallout from Spectre, Meltdown
January 11 | Issue 59: Discovery of major vulnerabilities ushers in 2018
December 14 | Issue 58: Nielsen settling in at DHS during uncertain times for cybersecurity
November 30 | Issue 57: Uber under fire for cover-up
November 16 | Issue 56: Voter data exposed; major Hilton payout from 2015 breaches
November 2 | Issue 55: Equifax knew about vulnerability; White House considers cyber strategy
October 18 | Issue 54: Equifax aftermath continues; cyber veteran to lead DHS
October 5 | Issue 53: Momentum for action on data security standard building
September 20 | Issue 52: The Equifax issue
September 7 | Issue 51: Congress returns from recess with full cybersecurity agenda
July 19 | Issue 50: Russia behind Wolf Creek? Biometric data, 9-1-1 systems vulnerable
July 6 | Issue 49: Trump’s voter fraud commission is potentially massive data security vulnerability
June 21 | Issue 48: Massive RNC leak exposes vulnerability of political profile data; WannaCry could’ve been much worse
June 7 | Issue 47: Credit unions pushing for retailer standard; Kmart and OneLogin breaches
May 24 | Issue 46: WannaCry
May 10 | Issue 45: Macron hacked; Google Docs attack hits 1 million users
April 26 | Issue 44: White House still has no cyber plans; Shoney’s, Intercontinental Hotels breaches roll in
April 12 | Issue 43: Q&A with Koskinen, Trump rolls back broadband privacy protections, more woes for Arby’s
March 29 | Issue 42: Congress uses CRA to roll back broadband privacy and data security rule, Trump cyber order delays
March 15 | Issue 41: WikiLeaks not as bad as we thought? Average zero-day lasts nearly seven years. Breach costs Yahoo’s Mayer $2M.
February 28 | Issue 40: Advocates unite against DHS plan to check passwords at the border
February 15 | Issue 39: Rich out, Pahl in at FTC. What does it mean for data security? Plus Spicer’s cyber woes continue
February 1 | Issue 38: No executive action on cyber just yet; reflecting on Ramirez, and more
January 18 | Issue 37: Giuliani’s cyber cred takes a hit, more headaches for Verizon-Yahoo, Ramirez stepping down at FTC
January 5 | Issue 36: Predictions for 2017
December 7 | Issue 35: Cyber policy clues about Trump transition hires; ransomware hack cripples Muni
November 22 | Issue 34: Rogers pick for DNI could steady Trump cybersecurity jitters, FriendFinder mega-breach, and more!
November 14 | Issue 33: Post-Election Special | What does Trump victory mean for data security?
November 7: Issue 32 | Special Election Day preview: Will Russian hacking undermine results?
October 26: Issue 31 | Massive DDoS attack highlights IoT security woes; GOP now getting hacked, too
October 13: Issue 30 | Yahoo breach causing heartburn on Capitol Hill during National Cyber Security Awareness Month
September 28: Issue 29 | Yahoo breach – who knew what, when? Hillary, Donald disagree on ‘the cyber’
September 14: Issue 28 | Russians hack WADA, ransomware on tap at the FTC and our interview with AG Madigan
August 31: Issue 27 | NSA hacking fallout, breaches continue affecting consumer confidence, and more!
August 3: Issue 26 | Thought Leaders interview series kicks off with FTC Commissioner McSweeny
July 20: Issue 25 | FDIC breach cover-up? New Thought Leaders Series coming!
July 7: Issue 24 | HHS calls ransomware “major threat,” phishing hits HRC campaign & is anti-virus pwned?
June 22: Issue 23 | Data security in the spotlight in presidential race, FTC chief technologist an ID theft victim
June 8: Issue 22 | SEC Chair says cybersecurity is biggest threat to financial system, breach ‘aftershocks,’ and more
May 26: Issue 21 | LinkedIn breach worse than we thought; FDIC’s Bair a victim
May 10: Issue 20 | Betty White plugs multi-factor auth, massive email hack affects 272 million, unwanted software, and more!
April 27: Issue 19 | Voters, how safe is your personal information? BeautifulPeople.com hack and more
April 11: Issue 18 | #PanamaPapers puts the spotlight on law firm data woes, broadband privacy NPRM and security, another Flash zero-day and more!
March 31: Issue 17 | New Fraud.org features new Data Breach HQ for consumers; Will breach at DC hospital system force politicians to act?
March 16: Issue 16 | FCC wades in to data security for ISPs; data breaches plague cancer treatment center; and more!
March 2: Issue 15 | FTC shows ID theft complaints up again in 2015, behind the scenes of the AshleyMadison.com breach, and more!
Feb. 18: Issue 14 | Another IRS breach highlights tax ID fraud threat. Will POTUS’ cybersecurity plan make a dent?
Feb. 3: Issue 13 | ID theft complaints up nearly 50% in 2015 and more
Jan. 20: Issue 12 | Consumer orgs want FCC to move on data security, privacy; Hill breach bills could move late spring; Koch network venturing into data security
Jan. 6: Issue 11 | 2015 the year of health care data breaches; IoT zombie botnets and other predictions for 2016
December 15: Issue 10 | Wyndham settlement affirms FTC’s “top cop” status, HR 2205 & CISA updates, year-in-review
December 2: Issue 9 | VTech breach exposes personal info for 200K children, Target +2 years, and more
November 17: Issue 8 | State of security in health care space looking bleak; attorney-client confidentiality compromised; and more!
November 4: Issue 7 | CISA passes: Was it worth it? Also USPIRG credit freeze report and more
October 20: Issue 6 | CISA entering campaign conversations; Experian/T-Mobile fallout; latest breach involving Dow Jones
October 6: Issue 5 | T-Mobile/Experian breach kicks off National Cybersecurity Awareness Month
September 23: Issue 4 | New details emerge about Target breach, Apple App Store, Excellus hacked
September 9: Issue 3 | More Ashley Madison and OPM fallout, Congress returns, Breaches at Heritage & ReverbNation
August 26: Issue 2 | Ashley Madison underscoring devastation caused by breaches
August 11: Issue 1 | Welcome to The #DataInsecurity Digest
The #DataInsecurity Digest | Issue 5
/byIssue 5 | Oct. 6, 2015
By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud
Subscribe here. Tell us what you think.
Editor’s Note: Welcome to October and National Cybersecurity Awareness Month! NCL is a proud supporter of this effort to raise awareness about the need for everyone to take steps to make the Internet a safer and more secure place. There are many data security events taking place this month, so be sure to check out the calendar below!
Unfortunately, new breaches at Experian, Hilton, Scottrade, and Trump Hotels remind us how much work is still to be done. However, the news isn’t all bad. The much ballyhooed EMV liability shift began October 1 for many retailers. With that shift should come an accelerated transition from insecure mag-stripe credit and debit cards to more secure chip-based cards. However, the crooks know what’s coming too and they’re likely to shift to online card fraud, so keep checking those statements, friends! Finally, rumor has it that the Cybersecurity Information Sharing Act (CISA) could have fresh legs now that Congress has managed to fund the government. Stay tuned, since advocates like NCL have some serious reservations about how useful the bill would be for protecting consumers’ data, at the price of significant civil liberties concerns. Fireworks to come!
P.S. You can catch yours truly via livestream today at my presentation to the Department of Energy’s NCSAM conference. I’ll be discussing tips and tricks that workers can use to reduce their risk of hackers. The action kicks off at 11am ET at http://energy.gov/live.
P.P.S. Also don’t forget about NCL’s Trumpeter Awards Dinner tonight! Honorees include data security champions FTC Chairwoman Edith Ramirez and Senator Amy Klobuchar.
And now, on the to clips!
—————–
POTUS marks National Cybersecurity Awareness Month. October is when data security advocates across the country recommit to the fight against data breaches and online scammers of all stripes. President Obama kicked things off with a presidential proclamation affirming that cybersecurity is one of the most important consumer issues of our time: “It is the responsibility of every American to proactively defend our digital landscape. The Department of Homeland Security’s “Stop.Think.Connect.” campaign is designed to inform our citizenry of the dangers posed by cyber threats and to provide the tools needed to confront them. I urge all Americans to take measures to decrease their susceptibility to malicious cyber activity, including by choosing stronger passwords, updating software, and practicing responsible online behavior.” (Source: White House)
Breach at Experian exposes data on 15 Million T-Mobile subscribers. More depressing news about another mega-breach. This time, wireless carrier T-Mobile announced that data on 15 million subscribers was compromised at credit-check partner Experian. Names, birthdates, and mailing addresses are among the personal information that was compromised. Worryingly, the encryption protecting more sensitive data, such as Social Security Numbers and driver’s license numbers, could also have been compromised. Additional FAQ on the breach available at Experian. (Source: T-Mobile)
More breaches making news this cycle. Hilton Hotel Properties and Trump Hotel Collection.
CISA talk bubbling back up in Senate. @TimStarks brings us intriguing news about possible movement on the controversial Cybersecurity Information Sharing Act (CISA). “Sen. Dianne Feinstein said they’re still trying to chop down the number of amendments, possibly by adding some to a manager’s amendment. She didn’t sound excited about more being added – a possibility under the existing agreement. ‘I wouldn’t be for any more amendments. Twenty-two seems like enough,’ she said. … A whip notice from Tuesday that includes the word ‘cybersecurity’ also suggests CISA is likely on deck.” (Source: POLITICO)
NTIA’s vulnerability disclosure process off to a rocky start. @KimZetter brings us excellent reporting on the security researcher vs. company tensions that came to a boil at the first NTIA multistakeholder process meeting on cybersecurity disclosures: “Security researchers and vendors have long been locked in a debate over how to disclose security vulnerabilities, and there’s little on which the two sides agree. Apparently this extends even to the question of whether they should meet to hash out their disagreements. … ‘The DMCA has already created a chilling effect on some research,’ one participant, who asked to remain anonymous, said. ‘The Wassenaar agreement is [also] a problem. This is the Commerce Department. What makes you think they won’t take [information gathered from this meeting] to Congress [to get legislation passed]?’” (Source: WIRED)
OPM hack gets worse: 5.6M fingerprints among the hacked data. The drip-drip-drip of fallout from the hack at the U.S. Office of Personnel Management continues. @AP has the story: “OPM says the ability of an adversary to misuse fingerprint data is limited, though an agency statement acknowledged that “this probability could change over time as technology evolves. For American intelligence agencies, the notion that the Chinese have fingerprints on millions of federal security clearance holders, some of whom may be intelligence officers overseas, is troubling. Any intelligence officer whose prints have been taken would face great risk in operating under an alias because those prints would give away someone’s true identity.” (Source: Associated Press)
Why hacked fingerprint data is kind of a big deal. @euroinfosec brings us some scary scenarios for what could be done with all that stolen OPM fingerprint data: “Some security researchers refer to authentication systems based on fingerprints – such as unlocking an iPhone by using the home button’s fingerprint reader – as a type of active biometrics, as opposed to passive biometrics, which might look at the location or MAC address of a PC that is attempting to log into a banking application. And when active-biometrics data gets stolen, there’s little that victims can do to prevent the data from being abused.” (Source: BankInfoSecurity.com)
The October 1 liability shift could be costlier for retailers. @KimZetter gets a double-mention in this #DID thanks to her look at the October 1 EMV liability shift and its impact on retailers and card cloning fraud: “‘Every market [where EMV has been adopted] has seen an explosion with ecommerce fraud despite the fact that CVVs are used, and it will happen here too,’ Horwedel says. ‘It’s very predictable. In a couple of years you’ll see that the merchants are going to be responsible for more fraud than they’re bearing today because internet fraud is going to explode because we have no real solution to prevent ecommerce fraud.’” (Source: WIRED)
House Small Business Committee tees up the impact of EMV shift on small biz on Oct. 7. Witness List for the hearing includes reps from Visa, Electronics Transactions Association, TCM Bank, and State Department Federal Credit Union. (Source: House Small Business Committee)
European data protection law could be a boon for cyber insurance providers. A tip o’ the cap to @taknockless at PropertyCasualty360.com for flagging this new data: “According to a new report from Timetric, the cyber risk insurance market is experiencing rapid development, with the size of global gross written premiums growing from US$850 million in 2012 to an estimated US$2.5 billion in 2014. … The demand for cyber insurance in Europe is expected to grow substantially, once the new General Data Protection (GDPR) law is finalised by the end of 2015. It is expected to come into force by 2017 in all the EU member states, making data breach notification compulsory. This will likely give more power to the regulators, along with an increase in penalties – up to EUR1 million (US$1.3 million) or 2% of company’s global annual turnover.” (Source: Timetric)
Upcoming Events
Today – International #2FactorTuesday Kick-Off – Washington, DC
The National Cyber Security Alliance and FIDO Alliance warmly invite you to participate in #2FactorTuesday to raise international awareness for two-factor authentication as a means of enhancing the security of online accounts. Confirmed speakers include: Michael Daniel, Special Assistant to the President & Cybersecurity Coordinator at the White House; Brett McDowell, Executive Director at FIDO Alliance; Charles McColgan, Chief Technology Officer at TeleSign; Marc Boroditsky, Vice President & General Manager at Authy; Michael Kaiser, Executive Director at NCSA; Sean Brooks, Privacy Engineer at NIST; Stephan Somogyi, Product Manager, Security & Privacy at Google.
Today – U.S. Chamber of Commerce: Fourth Annual Cybersecurity Summit – Washington, DC
The U.S. Chamber of Commerce is pleased to host the Fourth Annual Cybersecurity Summit to explore the latest threat landscape, market-based and public-private solutions, and the new framework. The summit will feature speakers from the business community, international experts, the administration, and Congress.
Oct. 8 – Creating a Culture of Cybersecurity at Work – Webinar
Join the National Cyber Security Alliance, the U.S. Department of Homeland Security, the Council of Better Business Bureaus and the Federal Trade Commission for a 1-hour webinar in honor of National Cyber Security Awareness Month (NCSAM) to discuss cybersecurity and online safety for small businesses. This webinar will discuss the security landscape for businesses and highlight resources and programs available to help businesses establish cultures of cybersecurity.
Oct. 14-15 – ICF International: CyberSci Summit – Fairfax, VA
ICF International is hosting this workshop to teach attendees about key solutions to challenges in cyber science, technology, and research and development in an age of cyber weapons. Keynote speakers include: William Glodek (U.S. Army Research Laboratory), General Michael Hayden (former CIA director), and Dr. Michael A. Wertheimer (former NSA research director). Free admission for federal employees, contractors, White House staffers, and academia.
Oct. 30 – Follow the Lead: An FTC Workshop About Online Lead Generation – Washington, DC
The workshop will bring together a variety of stakeholders, including industry representatives, consumer advocates, and government regulators. The FTC has invited the public to submit research, recommendations for topics of discussion, and requests to participate as panelists.
Jan. 14, 2016 – PrivacyCon – Washington, DC
The FTC will hold a conference on January 14, 2016 to bring together a diverse group of stakeholders, including whitehat researchers, academics, industry representatives, consumer advocates, academics, and a range of government regulators, to discuss the latest research and trends related to consumer privacy and data security.
National Consumers League
Published October 6, 2015
The #DataInsecurity Digest | Issue 4
/byIssue 4 | Sept. 23, 2015
By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud
Subscribe here. Tell us what you think.
Editor’s Note: In this edition of the #DataInsecurity Digest, we examine the continuing fallout from the December 2013 Target breach, as revelations from leaker after-action reports detail Target’s vulnerabilities that led to the hack. Expect this new information to give fuel to the plaintiff’s bar. In other news, the Apple App Store, once thought nearly impregnable, shows its vulnerability to hacking, with hundreds of malware-infested apps making it into the store. Finally, we look at the latest mega-breaches—10M consumers affected at New York-based health insurer Excellus and 80,000 Cal State students. These breaches are just a few of many in the troubling spate of breaches targeting health insurers and universities. These institutions often have an enticing (to hackers) combination of valuable data and weak data security.
On to the clips…
—————–
Krebs: Leaked after-action report on Target breach showed little/no impediment to attackers. @briankrebs gets his hands on a leaked Verizon report on the Target breach: “Once inside Target’s network, there was nothing to stop attackers from gaining direct and complete access to every single cash register in every Target store. … In one instance, they were able to communicate directly with cash registers in checkout lanes after compromising a deli meat scale located in a different store.” (Source: KrebsonSecurity)
More pain on the way for Target as bank suit gains class-action status. @megangeuss covers the latest twist in the ongoing Target breach legal fallout: The plaintiffs named five banks that originally sued Target—Umpqua Bank, Mutual Bank, Village Bank, CSE Federal Credit Union, and First Federal Savings of Lorain—to represent the class. These banks claimed that they sustained over $5 million in damages from the Target breach. (Source: Ars Technica)
Apple App Store invulnerable no longer: 344 apps tainted. @jim_finkle has the story for Reuters on how hackers finally cracked the App Store: “The company disclosed the effort after several cyber security firms reported finding a malicious program dubbed XcodeGhost that was embedded in hundreds of legitimate apps. … The hackers embedded the malicious code in these apps by convincing developers of legitimate software to use a tainted, counterfeit version of Apple’s software for creating iOS and Mac apps, which is known as Xcode, Apple said.” (Source: Reuters)
Get smart quick: What Wyndham and Target decisions mean for breach liability. @FYRashid brings us up to speed on the growing legal liability faced by breached businesses in the wake of recent court decision: “Combine the District Court decision against Target with the recent appellate decision in the case between Wyndham and the Federal Trade Commission, and it’s clear organizations are being held to a higher standard than before.” (Source: InfoWorld)
Guilty plea for Heartland hacker, via @ismg_editor. “Vladimir Drinkman, 34, has pleaded guilty to one count of conspiracy to commit unauthorized access of protected computers and one count of conspiracy to commit wire fraud, prosecutors announced Sept. 15. … [He] faces a maximum sentence of 30 years in prison on the wire fraud charge and five years on the other charge, plus fines. … ‘This hacking ring’s widespread attacks on American companies caused serious harm and more than $300 million in losses to people and businesses in the United States.’” (Source: Data Breach Today)
Breach du jour: 10 million Excellus health care subscribers. “Excellus, an upstate New York health care company, says information for as many as 10 million of its clients nationwide may have been exposed in an attack dating back to 2013. … The attackers may have gained access to Excellus clients’ names, dates of birth, Social Security numbers, mailing addresses, telephone numbers, member identification numbers, financial account information and claim information, the company said.” (Source: USA Today)
What makes health care data so valuable to hackers? Longer shelf life than financial data. @FYRashid gets a double-dip in this edition of the #DID: “Financial data has a finite lifespan because it becomes worthless the second the customer detects the fraud and cancels the card or account. … information contained in health care records has a much longer shelf life and is rich enough for identity theft. Social Security numbers can’t easily be cancelled, and medical and prescription records are permanent.” (Source: InfoWorld)
Breach du jour part deux: 80K Cal State students affected by data breach. Affected students were enrolled in an online sexual violence prevention course. Breached info included “passwords, login names, campus-issued email addresses, gender, race, relationship status and sexual identity.” (Source: L.A. Times via @carlareiveralat)
Universities are becoming prime targets for hackers. @KWagstaff and @CASottile examine the growing trend in university data breaches: “In 2014, 10 percent of reported security breaches involved the education sector … That trails only health care (37 percent) and retail (11 percent). … Despite the frequency of attacks, many schools aren’t prepared to defend themselves. … Tinfoil Security tested the networks of 557 state universities with a cross-site scripting (XSS) attack. Twenty-five percent of them were vulnerable.” (Source: NBCNews.com)
Gemalto: Number of breaches up 10%, number of compromised records down 41% in 1st half of 2015. @Gemalto is out with their newest Breach Level Index report, which contains some interesting nuggets: “Identity theft remained the primary type of breach, accounting for 75% of all records compromised and slightly more than half (53%) of data breaches in the first half of 2015. Five of the top ten breaches, including the top three – which were all classified as Catastrophic on the BLI – were identity theft breaches, down from seven of the top 10 from the same period last year.” (Source: Gemalto – Full report)
Xi visit linked to fewer China-based hacks? Major intrusions by Chinese hackers of U.S. companies’ computer systems appear to have slowed in recent months, private-sector experts say, ahead of a meeting between China’s president and President Barack Obama with cyber security on the agenda. (Source: Reuters)
And finally, because we can’t get enough of data breach infographics … Barricade’s @jackleonardme brings us “Anatomy of a Data Breach” (Source: Barricade)
Upcoming Events
October – National Cybersecurity Awareness Month
Designed to engage and educate public and private sector partners through events and initiatives with the goal of raising awareness about cybersecurity and increasing the resiliency of the nation in the event of a cyber incident.
Oct. 6 – U.S. Chamber of Commerce: Fourth Annual Cybersecurity Summit – Washington, DC
The U.S. Chamber of Commerce is pleased to host the Fourth Annual Cybersecurity Summit to explore the latest threat landscape, market-based and public-private solutions, and the new framework. The summit will feature speakers from the business community, international experts, the administration, and Congress.
Oct. 14-15 – ICF International: CyberSci Summit – Fairfax, VA
ICF International is hosting this workshop to teach attendees about key solutions to challenges in cyber science, technology, and research and development in an age of cyber weapons. Keynote speakers include: William Glodek (U.S. Army Research Laboratory), General Michael Hayden (former CIA director), and Dr. Michael A. Wertheimer (former NSA research director). Free admission for federal employees, contractors, White House staffers, and academia.
Oct. 30 – Follow the Lead: An FTC Workshop About Online Lead Generation – Washington, DC
The workshop will bring together a variety of stakeholders, including industry representatives, consumer advocates, and government regulators. The FTC has invited the public to submit research, recommendations for topics of discussion, and requests to participate as panelists.
Jan. 14, 2016 – PrivacyCon – Washington, DC
The FTC will hold a conference on January 14, 2016 to bring together a diverse group of stakeholders, including whitehat researchers, academics, industry representatives, consumer advocates, academics, and a range of government regulators, to discuss the latest research and trends related to consumer privacy and data security.
National Consumers League
Published September 23, 2015
Our legal work
/byThe National Consumers League is a private, nonprofit advocacy group representing consumers on marketplace and workplace issues. We are the nation’s oldest consumer organization. In support of our mission, we routinely advocate through petitions to agencies, promotion of legislation, and through litigation. Below are some examples of such advocacy:
Petitions to State and Federal Agencies
Promotion of Legislation
Samples of Amicus Filings
Advocacy through Litigation
The #DataInsecurity Digest | Issue 3
/byIssue 3 | Sept. 9, 2015
By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud
Editor’s Note: Welcome to the third edition of NCL’s #DataInsecurity Digest! With Congress returning from August recess this week to a packed September schedule, it’s unclear whether any of the pending data security or breach notification bills will see the light of day. However, that doesn’t mean that it’s a slow news cycle when it comes to data security policy. Most notably, the 3rd Circuit’s decision in much-watched Wyndham case paves the way for the FTC to increase its role as the federal government’s data security cop on the beat. FTC Commissioner Terrell McSweeney also wades into the encryption debate, cautioning against crypto back-doors. Finally, the steady drop of fallout from the OPM hack and the Ashley Madison leak continues.
On to the clips…
—————–
FTC Commissioner McSweeney takes on encryption back-doors. @tmcsweenyFTC takes a not-so-veiled swipe at law enforcement calls for encryption keys: “This debate, sometimes called the crypto wars, is hardly new — it has been going on in some form or another for decades. But what is changing is the extent to which we are using connected technology in every facet of our daily lives. If consumers cannot trust the security of their devices, we could end up stymieing innovation and introducing needless risk into our personal security. In this environment, policy makers should carefully weigh the potential impact of any proposals that may weaken privacy and security protections for consumers.” (Source: Huffington Post)
Get up to speed quickly on the Wyndham decision. The good folks at @FrankfurtKurnit provide this analysis of the 3rd Circuit’s Wyndham ruling: “The big message here is that companies with vulnerable data security regimens will have a lot of difficulty arguing in future cases that they lacked notice from the FTC of what specific cybersecurity practices are necessary.” (Source: FKKS)
FTC announces “PrivacyCon” to examine privacy and security trends. Circle January 14 on your calendars for the FTC’s first “PrivacyCon.” … “We want to increase the FTC’s engagement with the technology community in order to more effectively encourage innovation that is protective of consumer privacy and security,” said FTC Chairwoman Edith Ramirez. “At PrivacyCon, our goal is to have leading experts in privacy and data security sit at the table with us and other policymakers to discuss their original research findings and the implications for consumer privacy.” (Source: FTC)
NYT: Farhad Manjoo (@fmanjoo) hits the nail on the head re: the Ashley Madison punditry. “There has been a tendency in the tech commentariat to minimize the Ashley Madison breach. …. But the victims of the Ashley Madison hacking deserve our sympathy and aid because, with slightly different luck, you or I could just as easily find ourselves in a similarly sorry situation. This breach stands as a monument to the blind trust many of us have placed in our computers — and how powerless we all are to evade the disasters that may befall us when the trust turns out to be misplaced.” (Source: New York Times)
WIRED on dumbing down of Ashley Madison data analysis. @iammollymchugh warns us that the relentless infographic’ing on the Ashley Madison leak threatens our ability to accurately assess it: “If you’re better able to digest the scope of the Ashley Madison hack in infographics and data bites, it’s OK—and it doesn’t make you bad or stupid if you find them interesting. But just remember that behind that carefully chosen typeface and designer-made template are people whose private lives are being ripped to shreds in Internet-friendly, eye-catching iconography.” (Source: WIRED)
Quick hit: The terrifying simplicity of Ashley Madison-fueled extortion. @cfarivar gives us a taste of how easy it is to extract cash from Ashley Madison users. (Source: Ars Technica)
CIO warning: New hacks will be focused on “embarrassment.” (Via @TechRepublic) “It used to be that hacking was all about credit card data and identify theft. What Ashley Madison and Sony before it have shown is that breaches are now evolving – and focused on embarrassment. … Furthermore, the ability to control, protect and secure the huge amount of data we have, not to mention understanding what could be used to exploit and manipulate a company is in my view unmanageable.” (Source: TechRepublic)
OPM ID theft monitoring price tag? Up to $329M. @jonfingas writes on the continuing OPM breach fallout: “Officials have awarded ID Experts a contract to protect the 21.5 million affected government workers against identity theft. The arrangement will cost the government at least $133.3 million, and options could bring its value to as high as $329.8 million. … However, there’s a question as to whether or not the money will be well-spent. Any short-term damage has likely already been done, after all.” (Source: Engadget)
Krebs: OPM (Mis)Spends $133M on Credit Monitoring. @briankrebs pulls no punches in criticizing OPM’s ID theft monitoring contract: “No matter how you slice it, $133 million is a staggering figure for a service that in all likelihood will do little to prevent identity thieves from hijacking the names, good credit and good faith of breach victims.” (Source: KrebsonSecurity)
I thought that was Michael Daniel’s job? RAND opinion makers Susan Everingham and Lillian Ablon (@lillyablon) suggest a data security czar could prevent government breaches better – “The public trusts the government to take care of some of its most personal and sensitive data. … Perhaps it’s time to appoint a data security czar who can establish guidelines and oversee how government agencies manage sensitive data.” (Source: Newsweek)
AP: Sony settles breach class action for an undisclosed amount. “Other former employees criticized Sony’s response to the data breach, contending the company emphasized protecting its public image instead of ensuring that its workers were protected from identity theft as a result of having their Social Security numbers, salary details and other sensitive data posted online.” (Source: Wall Street Journal)
Quick hit: ReverbNation breach could have affected 3.8 million. (H/T @writingadam) Music artists are now in the breach crosshairs, thanks to a breach at music marketing portal ReverbNation. Names, SSNs, DOBs, EINs, postal addresses, email addresses, and encrypted passwords were among the haul. Change your passwords, rockstars. (Source: SC Magazine)
Quick hit: Latest DC breach target: Heritage Foundation. Conservative think tank may have had private donor information compromised. (Source: Heritage Foundation)
Heritage had criticized OPM hack response. POLITICO’s @timstarks adds some context to the Heritage breach news: “The breach occurred at the same time that the foundation’s multimedia news organization, the Daily Signal, has criticized the Obama administration and federal agencies such as the Office of Personnel Management over lax cybersecurity.” (Source: POLITICO)
Infographic du jour: Top 10 HPAA Breaches. #1 Anthem – 78.8M, #2 Premera Blue Cross – 11M – 143M Americans affected since 2009. (Source: Healthcare IT News)
Upcoming Events
Today – FTC: Start with Security – San Francisco
The FTC’s initial “Start With Security” conference will focus on data security challenges for startups and developers. Last week, the FTC released its speaker lineup, and it’s a doozy. In addition to remarks from Chairwoman Edith Ramirez, we’ll also hear from Michael Coates (Twitter), Raymond Forbes (Mozilla), Paul Moreno (Pinterest), Pierre Farr (Google) and Yan Zhu (Yahoo), among others. Not to be missed: FTC chief technology Ashkan Soltani’s fireside chat with Accel’s Arun Mathew. Agenda. Start with Security guide for businesses.
October – National Cybersecurity Awareness Month
Designed to engage and educate public and private sector partners through events and initiatives with the goal of raising awareness about cybersecurity and increasing the resiliency of the nation in the event of a cyber incident.
Oct. 14-15 – ICF International: CyberSci Summit – Fairfax, VA
ICF International is hosting this workshop to teach attendees about key solutions to challenges in cyber science, technology, and research and development in an age of cyber weapons. Keynote speakers include: William Glodek (U.S. Army Research Laboratory), General Michael Hayden (former CIA director), and Dr. Michael A. Wertheimer (former NSA research director). Free admission for federal employees, contractors, White House staffers, and academia.
Oct. 30 – Follow the Lead: An FTC Workshop About Online Lead Generation – Washington, DC
The workshop will bring together a variety of stakeholders, including industry representatives, consumer advocates, and government regulators. The FTC has invited the public to submit research, recommendations for topics of discussion, and requests to participate as panelists.
Jan. 14, 2016 – PrivacyCon – Washington, DC
The FTC will hold a conference on January 14, 2016 to bring together a diverse group of stakeholders, including whitehat researchers, academics, industry representatives, consumer advocates, academics, and a range of government regulators, to discuss the latest research and trends related to consumer privacy and data security.
National Consumers League
Published September 9, 2015
The #DataInsecurity Digest | Issue 2
/byIssue 2 | Aug. 26, 2015
By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud
Editor’s Note: The posting of subscriber data from extramarital affair site AshleyMadison.com last week underscores the significant harm that can affect millions of consumers when sensitive data is leaked. While little usable financial data was leaked, the nature of the Ashley Madison data means that subscriber information could result in lost jobs, the breakup of marriages, blackmail, or worse. Unfortunately, many of the data security and data breach notification bills that have been proposed in Congress include harm triggers that rely on financial harm to trigger notification. The Ashley Madison leak, despite its embarrassing nature, illustrates that broad definitions of “harm” should be included in any data security legislation that Congress considers when it returns from recess.
On to the clips…
—————–
Ashley Madison leak is a sign of things to come; could lead to lost pensions, blackmail, suicides. @MikeMillerDC has the WaPo story on the fallout from the public posting of leaked subscriber data from the AshleyMadison.com hack: “Within minutes of the alleged leak, people began combing the data for information and posting their findings. Journalists and security experts quickly noted that there were 15,000 .mil or .gov email addresses among those used for the site. … Under military rules, philanderers can be punished by a year in confinement and a dishonorable discharge, which means losing their pension.” (Source: Washington Post)
Toronto PD: Unconfirmed reports of suicides linked to the leak. @Riannon_Westall @SunnyFreeman report from Avid Life Media’s home base in Toronto: “The Ashley Madison hack … has triggered spinoff extortion crimes and unconfirmed reports of suicides,’ … published U.S. media reports have said a police captain in San Antonio, Texas took his own life after his official email address was linked to an Ashley Madison account.” (H/T @BrianKrebs) (Source: Toronto Star)
Email addresses in Ashley Madison tied to “multiple” gov’t agencies, House, and Senate. @Cory_Bennett notes potential DC connections in leaked data. “Buried in the list are emails that could be tied to multiple administration agencies, including the State Department and Department of Homeland Security, as well as several tied to both the House and Senate. … Other tech news outlets … have discovered British government officials, United Nations employees, and Vatican staff among the millions of people in the leaked database.” (Source: The Hill)
AP connects Ashley Madison subscribers to White House, DOJ, DHS. @jackgillum and @tbridis find the first of what are sure to be many federal employees with sensitive jobs in the leaked data: “By tracing the IP addresses of people who visited the site over more than five years, AP reporters determined the visitors included two assistant U.S. attorneys; an information technology administrator in the Executive Office of the President; a division chief, an investigator, and a trial attorney in the Justice Department; a government hacker at the Homeland Security Department; and another DHS employee who indicated he worked on a U.S. counterterrorism response team.” (Source: Associated Press)
Krebs (@BrianKrebs) already seeing Ashley Madison extortion attempts. “Kellerman is convinced we’ll see criminals leveraging the AshleyMadison data to conduct spear-phishing attacks … ‘There is going to be a dramatic crime wave of these types of virtual shakedowns, and they’ll evolve into spear-phishing campaigns that leverage crypto malware,’ Kellerman said. ‘The same criminals who enjoy deploying ransomware would love to use this data.’” (Source: Krebs on Security)
More on Ashley Madison … “this feels like a momentous event.” @hermann of TheAwl.com sees the future in the AshleyMadison leak: “I’m not sure anyone is really reckoning with how big this could be, yet. If the data becomes as public and available as seems likely right now, we’re talking about tens of millions of people who will be publicly confronted with choices they thought they made in private … The result won’t just be getting caught, it will be getting caught in an incredibly visible way that could conceivably follow victims around the Internet for years.” (Source: The Awl)
Media interest in Ashley Madison data could linger. @lilyhnewman compares the coming fallout to revelations from the Sony breach: “In the case of the Sony hack, various embarrassing details about the company—or even just interpersonal relationships between high-profile people—came to light for weeks because the North Korean hackers had released huge troves of email correspondences. The Ashley Madison data will probably lead to the same type of slow but persistent revelations. Some discoveries will attract broad interest, but most will be important on a community or individual scale.” (Source: Slate)
What can we learn from the Ashley Madison leak? Via @euroinfosec: “Ashley Madison Fallout: 8 Security Takeaways” (Source: InfoRisk Today)
And in non-Ashley Madison news…
BIG win for the FTC; Court upholds data security authority. @b_fung has the story on the 3rd Circuit’s much-anticipated Wyndham decision: “Yes, federal regulators can go after firms whose lax security policies result in big hacks and a loss of personal data, a federal appeals court ruledMonday. … Monday’s decision from the Third Circuit Court of Appeals clarifies the FTC’s powers, giving it more ammunition against businesses that fail to invest in their own security.” (Source: Washington Post)
House Oversight teeing up another round of OPM hack hearings. @thisismaz preps for continued fallout from the OPM breach: “…Rep. Jason Chaffetz, chairman of the House Oversight and Government Reform Committee, is looking for details on the timeline of the response to the hacks as reported to [U.S. CERT] and details on computer security manuals exfiltrated from the Office of Personnel Management. … Rep. Gerry Connolly, a senior Democrat on the committee, says firings are not the answer … ‘Going after an agency head or CIO is a lot easier, a lot more comfortable, than dealing with the big systemic questions that Congress has failed to deal with.’” (Source: Federal Computer Week)
Box CEO: Gov’t IT “fundamentally broken.” Cloud storage company Box’s CEO @levie took to the pages of the WaPo to highlight the risks the OPM breach exposed: “…legacy software and infrastructure are the biggest weaknesses to protecting information. Attackers know how to exploit archaic technology—software that was designed in an era of less emphasis on security risk—and processes riddled with vulnerabilities.” (Source: Washington Post)
Former DHS CIO Richard Spires (@raspires) piles on with his take on gov’t IT’s security woes. “We will now likely pay an even greater cost in the exposure of the personally identifiable information of millions of current and former government employees—certainly in terms of those individuals’ privacy and potentially in terms of our national security as well.” (Source: Federal Computer Week)
Industry efforts to silence security researchers leaves consumers at risk. @kansasalps writes for WaPo on how Volkswagen’s efforts to silence security vulnerability research helps criminals, hurts consumers: “But the story seems to represent a cautionary tale about how efforts to suppress security research can backfire, according to some experts: Companies attempting to save face or avoid costly repairs by keeping quiet about problems may end up leaving consumers at risk and without the information they need to make educated decisions about whom to trust.” (Source:Washington Post)
Target settles breach suit with Visa for $65M, but small lenders aren’t happy. Robin Sidel writes for the WSJ: “Card issuers have long complained about the process by which they are reimbursed for data breaches and the fraud that results from them. … the Visa agreement quickly drew criticism from small financial institutions … said the latest agreement fails to fully reimburse them for their losses.” (Source: Wall Street Journal)
POTUS 2016 hopefuls need basic cybersec education. @josephcox gives the candidates an earful on basic #cybersec for @WIRED: “…anyone running for office in 2016, or working as an official (or really anyone, period) needs a basic grasp of good privacy and security practices. In February, Jeb Bush dumped a huge cache of his governmental emails onto the web in the name of transparency. What his office forgot to do, however, was redact the personal information of anyone included within that dump—such as the social security numbers of some Florida residents.” (Source: The Verge)
Quick hit: @jtarnow of Drinker Biddle reviews the pending student privacy bills, many of which have data security components. (Source: National Law Review)
Upcoming Events
Sept. 9 – FTC: Start with Security – San Francisco
The FTC’s initial “Start With Security” conference will focus on data security challenges for startups and developers. Last week, the FTC released its speaker lineup, and it’s a doozy. In addition to remarks from Chairwoman Edith Ramirez, we’ll also hear from Michael Coates (Twitter), Raymond Forbes (Mozilla), Paul Moreno (Pinterest), Pierre Farr (Google) and Yan Zhu (Yahoo), among others. Not to be missed: FTC chief technology Ashkan Soltani’s fireside chat with Accel’s Arun Mathew. Agenda. Start with Security guide for businesses.
October – National Cybersecurity Awareness Month
Designed to engage and educate public and private sector partners through events and initiatives with the goal of raising awareness about cybersecurity and increasing the resiliency of the nation in the event of a cyber incident.
Oct. 14-15 – ICF International: CyberSci Summit – Fairfax, VA
ICF International is hosting this workshop to teach attendees about key solutions to challenges in cyber science, technology, and research and development in an age of cyber weapons. Keynote speakers include: William Glodek (U.S. Army Research Laboratory), General Michael Hayden (former CIA director), and Dr. Michael A. Wertheimer (former NSA research director). Free admission for federal employees, contractors, White House staffers, and academia.
Oct. 30 – Follow the Lead: An FTC Workshop About Online Lead Generation – Washington, DC
The workshop will bring together a variety of stakeholders, including industry representatives, consumer advocates, and government regulators. The FTC has invited the public to submit research, recommendations for topics of discussion, and requests to participate as panelists.
National Consumers League
Published August 26, 2015
The #DataInsecurity Digest | Issue 1
/byIssue 1 | Aug. 11, 2015
By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud
Welcome to the #DataInsecurity Digest, a new publication of the National Consumers League’s #DataInsecurity Project.
In the coming weeks, I’ll be using these emails to deliver important, consumer-focused data security news, policy analysis, and information about upcoming events directly to your inbox. The #DataInsecurity Project is an advocacy campaign, so we’ll also use these emails to keep you up to date on our latest efforts to push Congress and the Administration to pass comprehensive data security protections for consumers.
Subscribe here. Tell us what you think.
On to the news!
—————–
Coming up today! I’ll be speaking on card security, EMV, and the Administration’s efforts to combat ID theft and data security with ProtectMyData.org’s Debra Berlyn, Steve Pociask (@consumerpal), and Liz Garner, among others. The fun begins at 12:00 pm in Rayburn B-339. RSVP to info@protectmydata.org.
Bloomberg: Chinese intel creating “vast database” of breached data. @MichaelRileyDC & @jordanr1000 have the story on the latest China-backed breach, this time of United: “It’s increasingly clear, security experts say, that China’s intelligence apparatus is amassing a vast database. … That data could be cross-referenced with stolen medical and financial records, revealing possible avenues for blackmailing or recruiting people who have security clearances.” (Source: Bloomberg)
Bloomberg with another scoop: Sabre and (potentially American Airlines) also hacked by Chinese. @MichaelRileyDC & @jordanr1000 are on a roll with the breach scoops: “Sabre, one of the largest clearinghouses for travel reservations, is a potentially rich target for state-sponsored hacks because of the company’s role as a central repository of what it says are records on more than a billion travelers per year across the globe.” (Source: Bloomberg)
DHS: CISA “increase the complexity and difficulty” of info sharing. NJ’s @kavehewaddell shares DHS’s concerns with the now-punted CISA: “The Homeland Security Department said in an official letter that a cyberinformation-sharing bill under consideration in the Senate would be detrimental to Americans’ privacy and the country’s cybersecurity. … The problems DHS outlines in the letter mirror many of the concerns that privacy advocates and security experts have raised about the bill…”(H/T @benton_fdn). (Source: National Journal)
WSJ: Stephanie Armour (@stepharmour1) has the story on the burgeoning world of medical ID theft. “Victims sometimes only find out when they get a bill or a call from a debt collector. They can wind up with the thief’s health data folded into their own medical charts. A patient’s record may show she has diabetes when she doesn’t, say, or list a blood type that isn’t hers—errors that can lead to dangerous diagnoses or treatments.” (Source: Wall Street Journal)
FTC Cmmr. McSweeny talks common-carrier exemption at DEFCON. In a wide-ranging interview with WaPo’s always-current @kansasalps: “I’d also support repealing the common carrier exemption … I think it’s outdated at this point and [repeal] would allow us to better protect consumers in partnership with the FCC.” (Source: WaPo)
Breach suits aren’t giving industry religion on data security… @deborahtodd reports for the Pittsburgh Post-Gazette: “In American courtrooms seeing the first wave of lawsuits related to cybersecurity breaches, injured consumers have received awards but it’s not clear the damages to companies have been enough to encourage change.” (Source: TNS)
… or are they? Neiman Marcus decision could lead to more success in breach suits – “According to the 7th Circuit, Neiman Marcus customers have standing to sue because [they] are at substantial risk of fraudulent charges or identity theft. … Plaintiffs’ lawyers are already cheering the Neiman Marcus decision.” (Source: Reuters)
Ashley Madison’s data breach is everyone’s problem. “The service was engineered and arranged like dozens of other modern web sites — and by following those rules, the company made a breach like this inevitable.” (Source: The Verge)
NYT: What data security problem? @nathanielpopper offers a contrarian view on breach costs: “Only a tiny number of people exposed by leaks end up paying any costs. … ‘For the bad guys, your five-year growth plan is not data breaches and stealing credit cards. It involves stealing all the info you can and opening legitimate accounts in people’s names.’” (Source: New York Times)
Fortune: Attacks softening EU wariness on privacy and security. (by @PBeshar) “The visceral brutality of recent terrorist attacks in Europe, coupled with fear engendered by the growing spate of cyber incursions, is dramatically changing the way Europeans think about privacy and security.” (Source: Fortune)
Daily Caller: DoL offers more grist for datasec oversight mill. @ethanrbarton has the scoop: “The Department of Labor has disregarded 11 warnings from its inspector general since 2010.” (Source: Daily Caller)
Scary health data breach numbers of the day. From @databreachtoday: So far this year, just the top five breaches have impacted a total of 99.3 million individuals. … As of Aug. 4, the official federal tally of major health data breaches since September 2009 listed 1,282 breaches affecting a total of 143.3 million individuals. That means the five recent hacker attacks represent almost 70 percent of all victims on the six-year tally. (Source: Data Breach Today)
47 times for me, but who’s counting? @joshkellerjosh @kkrebeccalai & @nicoleperlroth with an excellent tool for diagnosing your breach exposure. (Source: New York Times)
Upcoming Events
Sept. 9 – FTC: Start with Security – San Francisco
Aimed at start-ups and developers, this event will bring together experts to provide information on security by design, common security vulnerabilities, strategies for secure development, and vulnerability response.
October – National Cybersecurity Awareness Month
Designed to engage and educate public and private sector partners through events and initiatives with the goal of raising awareness about cybersecurity and increasing the resiliency of the nation in the event of a cyber incident.
Oct. 30 – Follow the Lead: An FTC Workshop About Online Lead Generation – Washington, DC
The workshop will bring together a variety of stakeholders, including industry representatives, consumer advocates, and government regulators. The FTC has invited the public to submit research, recommendations for topics of discussion, and requests to participate as panelists.
National Consumers League
Published August 11, 2015