Health Advisory Council Newsletter | 2019 Q2

_dsp6918.jpg

Health Advisory Council Newsletter Q2 2019

Welcome to the Q2 issue of the Health Advisory Council Newsletter. This quarter, NCL and Council Members have been active on many fronts. Please see our policy updates, a summary of our Spring Membership Meeting, a new Q&A with Matt Eyles of America’s Health Insurance Plans, Member updates, and more.

1health_icon.png NCL health policy at work 

ICYMI: Fifth Annual Spring Membership Meeting

On June 20, NCL hosted the Fifth Annual Spring Membership Meeting of its Health Advisory Council. In light of the ongoing measles outbreak, NCL devoted this meeting to effective vaccine policies to ensure herd immunity. The meeting featured a panel of experts engaged in the issues surrounding immunization.

Panelists included Health Reporter Lena Sun, from the Washington Post; Dr. Melinda Wharton from the Centers for Disease Control and Prevention (CDC); Kim Nelson, founder of South Carolina Parents for Vaccines; and DC-based pediatrician and immunology expert, Dr. Linda Fu of Children’s National Hospital.

The panelists talked about the anti-vaccine and vaccine hesitancy movement and the record number of measles cases in the US, the largest since 1992. Panelists pointed out key differences between vaccine-hesitant and anti-vaccine sentiments and discussed strategies for framing the issue for vaccine-hesitant parents.  

Click here to read more about the meeting and for more NCL policy updates.

 Member spotlight 1spotlight_icon.png

Get to know America’s Health Insurance Plans with a new Q&A with Matt Eyles.

1members.png Updates on Member programs

Get the latest updates on programs, policy, and initiatives from our Members, including ASHP, BeMedWise, Council for Affordable Healthcare, Eli Lilly, NCPA, and many more.

1listen.png We want to hear from you!

If you have time-sensitive information and updates you’d like to share with the Health Advisory Council in between NCL’s quarterly newsletters, please contact Nissa Shaffi (nissas@nclnet.org), and we will be happy to forward your materials to the Council membership. We also encourage you to contact us with your ideas and suggestions for Council activities.

————
National Consumers League
Health Advisory Council Newsletter | Q2 2019
Published July 16, 2019

Health Advisory Council Member Updates | Q2 2019

AMAG Pharmaceuticals 

On May 3, 2019, AMAG Pharmaceuticals released new data at the American College of Obstetricians and Gynecologists (ACOG) Annual Clinical and Scientific Meeting on their investigational drug bremelanotide (BMT), for the treatment of hypoactive sexual desire disorder (HSDD). HSDD is a legitimate medical condition affecting approximately 1 in 10 women in the U.S. At ACOG, AMAG also presented new data regarding Feraheme® (ferumoxytol) related to iron deficiency anemia (IDA) resulting from abnormal uterine bleeding (AUB). Iron deficiency anemia is a common, treatable condition that occurs when iron stores deplete due to an imbalance between iron uptake and iron utilization. IDA affects an estimated 5 million adults in the United States. Women are generally at higher risk for IDA than men, and there are several causes of heavy uterine bleeding that result in low iron levels.

America’s Health Insurance Plans

The Modern Medicaid Alliance (MMA), convened by America’s Health Insurance Plans (AHIP), spent this spring collaborating with our members to spotlight the diverse populations who rely on Medicaid. That included a resource on “Medicaid Millennials” to detail the unique health challenges the generation faces and highlight the critical role Medicaid plays in supporting them and an interview with Blue Star Families, a nonprofit organization that works to support military families, to explore the role that Medicaid plays in providing coverage to veterans and their families. In May, we took a focus on Mental Health Month with a one-pager on Medicaid and mental health and interviews with Alliance members who work in the mental health arena.

In June, the Alliance is partnering with the Health Care Transformation Task Force (HCTTF) to host a Congressional briefing on “Pursuing Value in Medicaid: States as Transformation Leaders.” The briefing will feature health care leaders from across the industry, educating congressional staff, policymakers, and health care industry stakeholders about significant successes and challenges from state-led health care innovation efforts. 

ASHP

ASHP has become a sponsoring member of the National Academy of Medicine Action Collaborative on Countering the U.S. Opioid Epidemic. The mission of the Action Collaborative is to convene and catalyze public, private, and non-profit stakeholders to develop, curate, and disseminate multi-sector solutions designed to reduce opioid misuse and improve outcomes for individuals, families, and communities affected by the opioid crisis. ASHP made a number of commitments to the Action Collaborative, including, among others, creation and dissemination of patient and prescriber education on pain management and opioid abuse mitigation best practices, enhanced patient access to evidence-based treatment for opioid use disorder through increased utilization of pharmacists on the healthcare team, and standardization of a framework for pain stewardship to coordinate pain management, opioid prescribing, and use of non-opioid therapies.

BeMedWise at NeedyMeds

This October, BeMedWise at NeedyMeds will celebrate 34 years of “Talk About Your Medicines” Month (TAYMM). It’s never been more important to be BeMedWise and “Talk About Your Medicines,” a well-recognized health observance month, that has grown and expanded over three decades to stimulate conversations between patients, caregivers and their healthcare providers about all the types of medicines they may take, with a focus on what to know about a medication in terms of expected health outcomes, possible side effects, benefits, and potential risks. For 2019, we plan to keep a spotlight on opioid abuse awareness and prevention, safe storage, and disposal. We will showcase various BeMedWise initiatives that include all ages across the lifespan, as well as the valuable educational campaigns of the BeMedWise Council Supporters and Partners such as NCL’s Script Your Future, Allied Against Opioid Abuse, FDA’s “Remove the Risk”, CDC’s Protect Initiative, the Acetaminophen Awareness Coalition’s “Know Your Dose” and more.

NeedyMeds has launched a new discount program for critical durable medical equipment which is available to users of the NeedyMeds Drug Discount card and provides a cost savings of up to 40 percent when purchasing durable medical equipment and diabetic supplies. Included in the savings are popular items such as canes, crutches, walkers, splints, incontinence supplies, and more. Also covered are diabetic supplies such as meters, testing strips, lancets, and diabetic shoes. According to a statement by Rich Sagall, MD, president of NeedyMeds: “We are pleased to be able to help more people save on so many medically-necessary items. Our mission is to help people with the financial burdens of healthcare, and this new program assists in an area where there is little help available.” More details are available on the NeedyMeds website on the Durable Medical Equipment Discounts page and dme.myvirtualdoctor.com where consumers can locate and purchase these products. Users of the Drug Discount card already save millions of dollars every month on the cost of medications. There are no eligibility guidelines, meaning anyone can take advantage of this savings. The only restriction is that the savings are only for cash-paying customers and can’t be combined with private insurance or state or federal programs.

Read the latest blogs from BeMedWise – Meeting the Medicine Information Needs of Americans with Vision Loss and NeedyMeds – Doctors Prescribe Too Many Medications. To learn more about how you can get involved in BeMedWise, including opportunities to collaborate on educational program development, webinars and TAYMM, contact Deborah.Davidson@needymeds.org. 

CDC’s Medication Safety Program

A recent American Journal of Preventive Medicine article by CDC’s Medication Safety Program estimated the rates of emergency department visits for unintentional pediatric ingestions of over-the-counter liquid medications. These product-specific rates of emergency department visits for accidental ingestions can be used to help target preventive interventions, such as enhancing safety packaging with flow restrictors.

Additionally, the Up and Away campaign recently launched its first safe storage testimonial video, reminding families with young children that safe medicine storage is critical to poison prevention and year-round household safety. Up and Away is an initiative of the PRevention of Overdoses and Treatment Errors in Children Taskforce (PROTECT) in partnership with the CDC.

Council for Affordable Healthcare

In May, the Council for Affordable Health Coverage (CAHC) released a package of policies to improve the affordability of and access to prescription drugs. While our comprehensive package contains numerous proposals, we are explicitly highlighting and advocating for policies centered around: value-based arrangements for drugs in federal health programs (Cassidy/Warner), a real-time benefit check tool so providers and patients can discuss drug prices at the point-of-prescription, and a Part D out-of-pocket cap for seniors. CAHC unveiled our drug policies at a May 10 briefing on Capitol Hill, and we are continuing advocacy efforts around these proposals this summer.

CAHC also held several briefings on the Administration’s ANPRM on the International Pricing Index and surprise billing. A summary of these briefings, along with all materials, can be found here.

This summer, CAHC is continuing our annual Capitol Hill education efforts around Medicare Parts B and D. We invite members and friends to join us during these meetings to talk about your organizations’ perspectives. To learn more about these efforts or request upcoming meeting dates, please contact Amanda Krzepicki (Amanda.krzepicki@cahc.net).

Healthcare Distribution Alliance

Spring has been a busy time for Allied Against Opioid Abuse (AAOA) and its partner organizations. In March, AAOA joined other leading national voices to raise awareness about the importance of prescription opioid safety. AAOA, along with the U.S. Centers for Disease Control and Prevention, Substance Abuse and Mental Health Services Administration, National Safety Council and others, contributed content to a special insert in the March 27 edition of USA Today as part of an opioid awareness issue developed by Mediaplanet.  

Meanwhile, the National Pledge to Pause effort, a collaboration between AAOA and the PA Foundation, continued during the American Academy of PAs (AAPA) 2019 Conference in Denver. Students attending the conference joined the Pledge to Pause effort by committing to take a moment to pause and talk with their patients before prescribing an opioid medication. Pledge to Pause reminds providers of the importance of engaging with and educating their patients every time an opioid is prescribed.

AAOA has also been participating in conferences around the country, discussing efforts to educate patients, caregivers, and the medical community about opioid abuse prevention. AAOA returned for the second consecutive year to the Rx Drug Abuse & Heroin Summit in Atlanta, Ga., and participated in a discussion at the National Alliance of State Pharmacy Associations’ (NASPA) Spring Meeting about how pharmacists are addressing the opioid abuse epidemic. Additionally, the Healthcare Distribution Alliance (HDA) 2019 Distribution Management Conference and Expo brought together representatives from AAOA national partners — including founding member HDA, as well as the National Community Pharmacists Association (NCPA) and PA Foundation — for a panel discussion about the importance of convening stakeholders to address the opioid abuse epidemic.

AAOA will be holding a partner call in early summer to plan for the rest of 2019. For more information on AAOA activities or to get involved with the organization, please contact Lee Lynch (llynch@reservoircg.com).

HealthyWomen

HealthyWomen is pleased to announce a two-day science, innovation, and technology summit: Chronic Pain in Women: Focus on Treatment, Management, and Barriers, July 17-18, 2019, at the Turf Valley Resort in Ellicott City, MD. This two-day event will advance and amplify the current dialogue on the impact of chronic pain on women’s health. We will address the current knowledge gaps and existing challenges in treating and managing chronic pain in women. Leading experts will join HealthyWomen for the robust examination of cutting edge and research on chronic pain, patients’ lived experiences and industry perspectives throughout the summit. View agenda. Please join us. Register here.

In anticipation of the summit, the HealthyWomen team is fielding a survey focusing on how chronic pain impacts women’s lives. Please take a moment to complete the survey, if you have a chronic pain experience to share (and/or share the survey with your members). All survey input is anonymous. HealthyWomen will be sharing results with researchers, clinicians, and patients at HealthyWomen’s Chronic Pain Summit, July 17-28.

Johnson & Johnson

On March 28, 2019, Johnson & Johnson released the 2018 Janssen U.S. Transparency Report. This annual report provides an inside look at how Janssen Pharmaceutical Companies of Johnson & Johnson remains committed to responsible business practices that put patients first. The report highlights details on how Janssen invests resources into research and development, practices for pricing medicine, and innovative company programs that help people gain access to the medicines they need.

The top five things to know about the report include:

1) In 2018, the average net price of Janssen medicines declined 6.8%.; 2) Janssen’s investment in research and development is 86% more than what is spent on marketing and sales.; 3) In March 2019 Janssen voluntarily began including list price and typical out-of-pocket costs in U.S. pharmaceutical TV advertising, starting with the company’s most popular medicine.; 4) Janssen helped approximately 1 million patients with access, affordability, and treatment support through the Janssen CarePath program. This includes nearly 550,000 commercially insured patients who reduced their out-of-pocket costs through the Janssen CarePath Savings Program.; 5) Janssen worked with stakeholders to advance ideas, such as value-based care models and practical policy solutions to bring down costs for patients, that can help to create a better healthcare system.

For more information and to read the full report, visit https://transparencyreport.janssen.com.

National Community Pharmacists Association

Drug pricing

In early April, NCPA submitted comments on the Trump Administration proposal to prohibit the use of rebates in contracts between Part D plan sponsors and drug manufacturers. And in his remarks at the NCPA Congressional Pharmacy Fly-In, Sec. Azar said, “we are going to pay close attention to all the input we receive from stakeholders, like you.” In our comments, we emphasized that while we stand with the administration in its efforts to lower drug prices, several “minimum requirements” are needed to eliminate the barriers inhibiting community pharmacists’ relationships with patients. These requirements include fixing pharmacy DIR, timely payments, increasing transparency and financial viability, appropriate agency oversight of implementation, protections for small business, and the opportunity for independent community pharmacies to choose their business partners. In addition to NCPA’s comments, 260 comments were submitted by pharmacists through NCPA’s grassroots portal. The Congressional Budget Office (CBO) recently released a financial score on this proposed HHS OIG Safe Harbor rule, stating that if the proposed rule is finalized in its current form, the change will increase federal spending by $177 billion between 2020 and 2029.

National Association of Nurse Practitioners in Women’s Health

NPWH just held its largest Women’s Sexual Health Course for NPs to date, with over 200 NPs joining us in Orlando. Registration for our 22nd Annual Premier Women’s Healthcare Conference, being held Oct. 16-19, 2019, in Savannah, GA, is now open. We also held the latest convening of our BOlder Women’s Health Coalition in May. If you are interested in learning more about the coalition, please click here.

PhRMA

Last year, PhRMA’s member companies committed to providing patients and families with more transparency about medicine costs by voluntarily pointing patients to medicine cost information through their direct-to-consumer (DTC) television advertising. As part of this effort, PhRMA launched a new online platform on May 2, 2019 – the Medicine Assistance Tool, or MAT. MAT provides patients, caregivers, and health care providers with links to these new websites and includes an enhanced search tool to connect patients with medicine-specific financial assistance programs. In addition, MAT has resources to help patients navigate their insurance coverage. This effort is just one of several ways our members are working to ensure patients have the information they need to make more informed health care decisions.

For more information on the cost and financial assistance for brand-name medicines provided by the Medicine Assistance Tool, visit MAT.org.

Verde Environmental Technologies

Verde® Environmental Technologies, Inc., maker of the Deterra® Drug Deactivation System weighed in recently with the Food and Drug Administration (FDA), Government Accountability Office (GAO), White House Office of National Drug Control Policy (ONDCP) and the United States Office of Management and Budget (OMB) to support programs and legislation that acknowledge and promote the effectiveness of at-home drug deactivation and disposal methods. These government agencies recognize deactivation as an effective means of ridding homes of unused, unwanted, and expired medications. This is encouraging news as Deterra is the only at-home disposal option that PERMANENTLY DEACTIVATES the drug rendering it unrecoverable and non-retrievable for all practical purposes. Moreover, Deterra meets the safe disposal standard for controlled substances set by the SUPPORT Act (SEC. 3032. SAFETY-ENHANCING PACKAGING AND DISPOSAL FEATURES of P.L. 115-271). For more information, visit DeterraSystem.com or call 612.568.1128.

Health Advisory Council June 2019 Member Meeting minutes

On June 20, NCL hosted the first Health Advisory Council meeting of 2019. The summer meeting featured a panel of leading experts in the vaccine and child immunization space who highlighted barriers and opportunities for growth in addressing vaccine-hesitant and anti-vaccine parents. The objective of this gathering was to inform and bolster Member organizations’ dissemination of evidence-based vaccine information, across the human lifespan, to their populations served.

Vaccine panel

The following panelists shared their unique perspectives and diverse experiences of navigating the current vaccine landscape. The panel discussion concluded with the panelists addressing questions from Council Member about current disease outbreaks and vaccine hesitancy prevalent in the country:

  • Moderator: Nissa Shaffi, Health Policy & Programs Associate, National Consumers League
  • Lena Sun, National Health Reporter, The Washington Post
  • Melinda Wharton MD, MPH, Director of Immunization Services Division, Centers for Disease Control and Prevention (CDC)
  • Kim Nelson, Founder, and Grassroots Activist, South Carolina Parents for Vaccines
  • Linda Fu, MD, Director of Academic Development for Community Pediatrics, Children’s National Health System

Lena Sun, National Health Reporter, The Washington Post

Lena kicked off the panel by discussing her coverage of the current measles outbreak across the country. Lena’s coverage has shed light on the impact that the anti-vaccine movement has had on the spread of the disease within particular communities, which has been integral in understanding the fears and hesitance that has led to the aggressive prevalence of the illness. Lena’s stories have uncovered the magnitude of this phenomenon–from the sentiments that have catalyzed its growth, to the parties who have directly financed prominent anti-vaccine movements.

Lena is currently in the process of curating video stories to explain and show how aggressive and damaging these vaccine-preventable diseases can be. The anti-vaccine community is incredibly visible and loud; the pro-vaccination side needs to be too. Although Lena made clear that her job as a reporter is to report on strictly what she’s observed, she implored the advocates in the room to stay vigilant and informed on the rising cases and continue to disseminate evidence-based, factual information about the safety and effectiveness of vaccines to combat anti-vaccine influence.

Dr. Melinda Wharton MD, MPH, Director of Immunization Services Division, Centers for Disease Control and Prevention (CDC)

Dr. Wharton provided insight into what the CDC is doing to mitigate the damage done by the anti-vaccine movement. Dr. Wharton reassured Members that while the anti-vaccine movement is gaining international notoriety, the majority of the population is still getting vaccinated and that only a little over 1 percent of children are unvaccinated. However, even with this promising trend, it’s essential to acknowledge the influence anti-vaccine groups have on isolated communities. Dr. Wharton warned of how the advancements made by vaccines are at stake due to rising anti-vaccine sentiments and that if the trend of forgoing vaccination continues, once eradicated diseases will make their way back into society.

Dr. Wharton told Members about the taskforces the CDC has in place to combat these rising sentiments and deliver culturally competent technical assistance to vaccine-hesitant communities that emphasize the safety and effectiveness of vaccines. Dr. Wharton expressed the vital role advocates and providers play in implementing national health standards and urged Members to be the first point of contact in communities that have prevalent vaccine hesitancy and to do so early and quickly, to ensure that scientific information about the efficacy, safety, and importance of vaccines can be the first thing they hear.

Kim Nelson, Founder, and Grassroots Activist, South Carolina Parents for Vaccines

Kim Nelson is the founder of South Carolina Parents for Vaccines. Concerned by rising anti-vaccine sentiments in her community, Kim mobilized to help disseminate vital information about the safety and effectiveness of vaccines. Being a mother of two herself, Kim shared with Members her experiences of reaching out to vaccine-hesitant parents in her state.

Kim also made the critical distinction between anti-vaccine and vaccine-hesitant sentiments and elaborated that there is no sense in rationalizing the importance of vaccines with anti-vaccine groups. Instead, advocates should reach out to vaccine-questioning communities because they are just looking for information, in a judgment-free space.

The anti-vaccine movement provides vaccine-hesitant parents with a sense of community and belonging in a way that validates their fears. Kim discussed this phenomenon and expressed the importance of assuaging these fears with time, patience, and relevant information.

Dr. Linda Fu, MD, Director of Academic Development for Community Pediatrics, Children’s National Health System

Dr. Fu is a DC-based pediatrician and serves as the Director of Academic Development for Community Pediatrics at the Children’s National Hospital. Dr. Fu spoke to her research and advocacy, which prioritizes protecting the community from vaccine-preventable diseases by understanding the barriers to children being vaccine adherent.

Dr. Fu highlighted the importance of providers guiding parents towards adhering to vaccine schedules, and the impact that provider and patient engagement have on vaccine uptake. Dr. Fu also mentioned a rise in young doctors who do not appreciate the value for vaccines used to prevent previously eradicated illnesses, as they do not have firsthand experience in treating these conditions. As a result, they do not administer these vaccines, and as a result, combined with anti-vaccine sentiments, these illnesses are making a resurgence.

 Dr. Fu shared the following tips for providers to enhance their engagement with patients with regards to vaccines:

  • Take the genuine time and interest to meet with vaccine-hesitant parents
  • Listen to and acknowledge their fears; establish that vaccination is the norm
  • Help parents to understand that the anti-vaccine community is the vocal minority
  • Help address vaccine hesitancy within the medical community 

Q&A and discussion

Addressing vaccine-hesitancy

During the question and answer session, Members raised various concerns regarding the ongoing measles outbreak and how advocates can confront vaccine-hesitancy directly. The panelists advised the audience to be sure to amplify the safety and effectiveness of vaccines across all platforms and to frame messaging on the benefits of vaccines in the most impactful manner.

The panelists recounted their personal experiences of navigating hostility from anti-vaccine groups. Lena Sun and Kim Nelson described the actions they take to protect themselves from these groups, who become emboldened within their networks and endanger the well-being of people representing a pro-vaccine stance.

The power of storytelling

Lena discussed her coverage of funders of the anti-vaccine movement, and how essential it is to follow the money with anti-vaccine efforts, in order to curtail these harmful movements. Each of the panelists also stressed the value of storytelling and how vaccine advocates need to use patient stories to spotlight the importance of the protective measures offered by vaccines. The public needs to see the harms caused by the deliberate failure to vaccinate and how these illnesses impact the quality of life.

Getting the word out about the risks of not vaccinating

Parents need consistent and easy to understand information on vaccines. Providers and advocates should address parental concerns with patience and readily available data ready to counteract misleading information contributing to fears about vaccines.

The panelists collectively stressed the value of approaching vaccine-hesitancy with vigilance and with ample facts and acknowledged that it would take an interdisciplinary approach to address this growing issue.

The #DataInsecurity Digest | Issue 96

Despite saber-rattling, U.S. woefully unprepared for cyber war with Iran

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s note: As the United States launches cyberattacks against Iran, the Department of Homeland Security (DHS) is warning that defenses against possible retaliation appear to be lacking. A bi-partisan Senate committee found that several high-profile agencies left Americans’ sensitive data vulnerable to hackers. Sen. Warner is one of several Senators asking for answers about the recent spate of healthcare data breaches. And Sen. Hassan could find herself in hot water if it’s found that she failed to notify constituents affected by a data breach in her office.             

And now, on to the clips! 

—————–

U.S. military launches cyber strike against Iran. The cyberattacks were approved by President Trump and “specifically targeted Iran’s Islamic Revolutionary Guard Corps computer system.” The attacks “disabled Iranian computer systems that controlled its rocket and missile launchers. …” (Source: The Associated Press)

DHS warns businesses that they will be targeted by Iranian hackers. In the wake of the U.S. cyberattacks, Chris Krebs, director of the Homeland Security Department’s cybersecurity division, warned that Iranian hackers have already begun “targeting U.S. companies with specialized malicious software designed to wipe the contents of their computer networks rather than to simply steal their data.” (Source: Washington Post)

Quick hit: DHS announces that it is unlikely to meet its cybersecurity goals. (Source: Department of Homeland Security)

Healthcare data breaches under new Congressional scrutiny. High-profile breaches at medical bill collectors and diagnostics companies that compromised 20 million consumer records are attracting attention from Congress. “I am concerned about your supply chain management, and your third-party selection and monitoring process,” wrote Sen. John Warner (D-VA) in a letter to Quest Diagnostics, one of the breached entities. (Source: Bloomberg)

Did Sen. Hassan violate breach notification laws? Right-wing media is abuzz over the sentencing of a former staffer for Sen. Maggie Hassan (D-NH) who engineered a massive breach of the Senator’s IT systems, compromising significant amounts of sensitive constituent data. Now questions are being raised about whether Hassan complied with relevant data breach notification laws related to the incident. “Hassan’s office provided no evidence to the Daily Caller News Foundation (DCNF) that it had disclosed its own breach, and several New Hampshire residents who had communicated with Hassan’s office told the DCNF they had not received any notification that their information could be in the hands of bad actors,” wrote @lukerosiak. (Source: Daily Caller)

EFF: Federal privacy bill should include a data security standard. The Electronic Frontier Foundation (EEF), a leading digital civil liberties group, is calling for stronger data security protections as part of its recommendations for comprehensive privacy legislation. “Also, where a company fails to meet this duty, it should be easier for people harmed by data breaches—including those suffering non-financial harms—to take those companies to court.” (Source: Electronic Frontier Foundation)

Bi-partisan Senate committee found that U.S. agencies left sensitive data vulnerable to breaches for decades. The Committee found that the Departments of State, Homeland Security, Health and Human Services, Transportation, Education, Agriculture, Housing and Urban Development, and the Social Security Administration left “Americans’ personal information open and vulnerable to theft.” (Source: The Hill)

City of Baltimore approves additional $10 million in cyberattack relief. As the city moves into its 9th week since a ransomware attack, its water billing system remains offline. (ABC News)

Lawsuit against Facebook for compromising 29 million accounts allowed to move forward. A federal appeals court in San Francisco rejected Facebook’s attempt to block the lawsuit and allowed “claims against Facebook [to] proceed for negligence and for failing to secure users’ data as promised.” (Source: Bloomberg)

Stat du jour: 50 percent of manufacturers experienced a breach in the last 12 months. Of the breached entitles surveyed, @sikichllp found that 11 percent suffered a “major” breach. (Source: Industry Week)

National Consumers League
Published July 3, 2019

The #DataInsecurity Digest | Issue 95

Federal contractors look to weaken Android cybersecurity as Trump Administration makes plans to beef up offensive cyber operations

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s note:

The U.S. is ramping up its offensive cyber operations abroad. However, cyber anxieties steadily grow at home as Baltimore city government continues to grapple with the aftermath of their devastating ransomware attack.

Good news on the cyber front was in short supply this week. Senate Majority Leader Mitch McConnell (R-KY) is reportedly telling colleagues that he plans on blocking all election security legislation regardless of party sponsorship–despite Russia’s continued efforts to hack election systems. Senator Merkley (D-OR), for one, isn’t sitting still. He’s pressing U.S. auto manufacturers for information on their data collection and data security practices.

And now, on to the clips!

—————–

Bolton: U.S. to expand offensive cyber operations. Previously, the United States “had been primarily focused on stopping election interference.” Now, White House national security adviser John Bolton, “intends to expand offensive operations in cyberspace to counter digital economic espionage and other commercial hacks…” (Source: Wall Street Journal)

Federal contractor known for breaking into iPhones turns attention toward Android. A startup that reached fame for helping agencies like U.S. Immigration and Customs Enforcement (ICE) break into iPhones, Grayshift, will now also work to thwart the cybersecurity of Android phones. Grayshift CEO David Miles recently revealed that, “the most logical next step would be [to hack] some of the more modern Android devices, from Samsung and Google…” (Source: Forbes)

Mitch McConnell blocks election security legislation. In the wake of Russia’s interference in the 2016 presidential election, many Republicans and Democrats have worked together to beef up election security. However, Senate Majority Leader Mitch McConnell (R-KY) has reportedly told his colleagues that “he will not allow the Senate to vote on election security legislation this session.” (Source: Sludge)

Breach Du Jour: Evite. The social planning and e-invitation website has suffered a breach that compromised around 10 million users’ accounts. A hacker on the dark web is now “selling ten million Evite user records that include full names, email addresses, IP addresses, and cleartext passwords.” (Source: ZDNet)

One-third of data breaches could have been easily prevented with DNS firewalls. @GlobalCyberAlln found that the installation of domain name system (DNS) firewalls that “prevent users from visiting malicious sites,” could have stopped “between $150-200 billion in cybercrime losses annually.” (Source: Global Cyber Alliance)

Quick hit: More than one in five Americans has considered canceling their plans to attend an event due to cyber or physical security concerns. (Source: Unisys Security Index)

Baltimore update: City of Baltimore still unable to send out water bills. Residents will again not receive water bills this month as the city struggles to return to normal operations in the wake of a ransomware attack on May 7, 2019. In total, the attack is now estimated to have “cost the city more than $18 million.” (Source: The Baltimore Sun)

Senator Merkley investigates car manufacturer’s data collection practices. After a study discovered that cars can collect 25 GB of data per hour, Senator Merkley (D-OR) wrote a letter to leading car manufacturers to discover “whether or not their cars collect personal data from drivers, what data they collect, who owns that data, and whether data collected is securely stored to protect consumers’ privacy.” (Source: Office of Senator Jeff Merkley)

Upcoming Events

June 27, 2019: Federal Trade Commission’s PrivacyCon – Washington, DC
Each year, the Federal Trade Commission (FTC) convenes a group of privacy experts, academics, policymakers, and regulators to discuss the latest research surrounding consumer privacy and data security. (Source: Federal Trade Commission)

National Consumers League
Published June 20, 2019

The #DataInsecurity Digest | Issue 93

With Baltimore being held hostage, ransomware fears growing once again 

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s note: Fears of another ransomware attack like 2017’s WannaCry virus prompted Microsoft to take the unusual step to provide security updates for otherwise unsupported operating systems. The patch was of little solace to the city of Baltimore, which suffered an unrelated ransomware attack that shut down its email system, among other critical functions. Baltimore’s cyber woes are not unheard of, however, as one study found that ransomware attacks on state and local governments are on the rise despite the fact that many state and local governments are refusing to pay the ransom. One reason for this concerning trend could be that two prominent data recovery firms, whose clients included local municipalities, paid off Iranian hackers in secret, fueling fears that the firms are incentivizing hackers to go after city governments.

And now, on to the clips!

—————–

City of Baltimore hit with crippling ransomware attack. @magmill95 reports that the attack “took down several of the city’s services last week, including some of the capabilities of the Baltimore City Department of Transportation, the Department of Public Works, and the Department of Finance.” At the time of the drafting of this publication, “the city was still unable to send or receive email.” Officials “could not give an exact time for when the systems would all be fully operational.” (Source: The Hill)

Firms promised to free data from ransomware attacks with technology. In reality, they were secretly paying Iranian hackers. In the wake of the SamSam ransomware attacks, tech firms promised to use their “own data recovery methods but instead payed ransoms, sometimes without informing victims such as local law enforcement agencies. …” In addition to misleading their clients, the firms “charge[ed] victims substantial fees on top of the ransom amounts.” (Source: ProPublica)

Report watch: Ransomware attacks on state and local governments are on the rise. @uuallan found that “while 2018 saw a small resurgence in overall ransomware attacks, there was a sharp jump in ransomware attacks against state and local governments, and that surge seems to be continuing into 2019.” (Source: Recorded Future)

ICE pays contractors $1.2 million to hack into Americans’ iPhones. The expenditure reveals the high priority that U.S. Immigration and Customs Enforcement has placed on undermining “passcodes and other security features Americans use to keep their information private.” (Source: Washington Post)

Microsoft scrambles to stop WannaCry 2.0 before it happens. Last week, Microsoft took the “unusual step of releasing security updates for unsupported but still widely-used Windows operating systems like XP and Windows 2003, citing the discovery of a ‘wormable’ flaw that the company says could be used to fuel a fast-moving malware threat like the WannaCry ransomware attacks of 2017.” (Source: Krebs on Security)

Russia hacked two Florida election systems during the 2016 election. Florida Gov. Ron DeSantis acknowledged that the breach occurred but stressed that “[n]othing that affected the vote count,” took place. Followers of election security will recall that “[l]ast year, former Florida Sen. Bill Nelson warned that Russia had ‘penetrated’ Florida’s voter registration systems, but election officials denied that vehemently at the time. Then-Gov. Rick Scott, who defeated Nelson in the Senate race, decried Nelson’s claims and said they ‘only serve to erode public trust in our elections at a critical time.’” (Source: NPR)

Rhode Island launches first statewide cybercrime hotline. In Rhode Island, cyber victims need to only dial 211 to “be connected with an operator who is trained to connect the victim with the proper organization to help. These include government organizations, local nonprofits, and local, state and federal agencies and resources to help protect them from further attacks and recover any money that may have been lost.” (Source: Patch)

Ajit Pai’s FCC is keeping commissioners in the dark about phone location data investigation. After news broke that AT&T, Sprint, Verizon, and T-Mobile were selling their customers’ real-time cell phone location data without their consent, the FCC vowed to look into the matter. Months later, the public still does not know what happened, and FCC Commissioners are complaining about being kept in the dark by their own agency. Commissioner Jessica Rosenworcel publicly complained that “[s]o far it appears that the FCC is more interested in protecting the privacy of its investigation than the privacy of wireless consumers across the country.” (Source: Vice)

Upcoming Events

June 27, 2019: Federal Trade Commission’s PrivacyCon – Washington, DC
Each year, the FTC convenes a group of privacy experts, academics, policymakers, and regulators to discuss the latest research surrounding consumer privacy and data security. (Source: Federal Trade Commission)

National Consumers League
Published May 23, 2019

The #DataInsecurity Digest | Issue 92

Facebook nears settlement with FTC while hackers attack U.S. electric grid

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s note:Facebook is reportedly nearing a final settlement with the Federal Trade Commission (FTC).  Once the settlement is complete, however, law enforcement’s work may just be getting started. Last week, the Department of Energy acknowledged that a western power grid was forced to battle a prolonged distributed denial-of-service (DDoS) attack, and the FBI found that cost of cybercrime grew to $2.8 billion in 2018. Meanwhile, a data breach exposed the sensitive data of 13.7 million job seekers. 

And now, on to the clips!

—————–

Experts: Nielsen exit from DHS will harm cybersecurity. As part of its rumored settlement, @ceciliakang reports that Facebook will pay a fine of as much as $5 billion and will also “create a privacy committee to protect its users’ data, as well as an external assessor who would be appointed by the company and F.T.C. The social network will also appoint a head compliance officer — who could be its chief executive, Mark Zuckerberg.” (Source: New York Times)  

DDoS attack launched against power grid in western U.S. The Department of Energy has confirmed that an attack “knocked [an] energy company’s systems offline by overloading them with traffic.” Although the attack lasted nearly 10 hours, it did not cause any customer outages. “The name of the energy company wasn’t named, but it provides power and energy to customers across Los Angeles in California, Salt Lake County in Utah, and Converse County in Wyoming.” (Source: Tech Crunch) 

FBI: Internet-enabled crime losses grow to $2.7 billion in 2018. The total losses mark a 90 percent increase from 2017. In 2018, the FBI’s Internet Crime Complaint Center received 900 complaints a day from Internet fraud victims. (Source: Internet Security Alliance)  

‘Blockchain bandit’ steals more than $50 million by guessing. The cryptocurrency industry has long been plagued by theft, but one researcher has found that a cryptocurrency bandit was able to siphon “off a fortune of 45,000 ether,” using a key-guessing technique. (Source: Wired)

Suggested reading: The SIM-swap fix that countries across Africa are using and U.S. telecoms won’t. After one Mozambique bank witnessed SIM swap scams at a rate of 17 frauds per month, it knew it needed to act. The solution was quite straightforward: since “SIM swap hackers rely on intercepting a one-time password sent by text after stealing a victim’s banking credentials… the carrier would set up a system to let the bank query phone records for any recent SIM swaps associated with a bank account before they carried out a money transfer. If a SIM swap had occurred in, say, the last two or three days, the transfer would be blocked.” As a result of this new system, the bank’s SIM swap scam rate dropped to nearly zero overnight. (Source: Wired)  

Breach du jour: 13.7 million job recruitment accounts. Ladders, a popular high-end job recruitment platform exposed the data of its users after it stored a database in the cloud without a password. “Each record included names, email addresses and their employment histories, such as their employer and job title. The user profiles also contain information about the industry they’re seeking a job in and their current compensation in US dollars.” In addition, some records included data similar to a user’s résumé, along with other “sensitive information, including email addresses, postal addresses, phone numbers and their approximate geolocation based off their IP address.” (Source: Tech Crunch)

Quick hit: Dems pledge to not reference stolen or hacked documents on campaign trail; Trump campaign refuses to make the commitment. (Source: Washington Post)   

Study watch: Financial firms spend $2,300 per employee to protect their data. The new survey outlined how companies invest in cybersecurity at “a range of around 0.2 percent to 0.9 percent of company revenue, with an average of about 0.3 percent.” (Source: Deloitte)  

Upcoming Events

June 27, 2019: Federal Trade Commission’s PrivacyCon – Washington, DC
Each year, the FTC convenes a group of privacy experts, academics, policymakers, and regulators to discuss the latest research surrounding consumer privacy and data security. (Source: Federal Trade Commission)

National Consumers League
Published May 9, 2019

The #DataInsecurity Digest | Issue 91

Nielsen’s departure from DHS deepens cyber anxietycyber insurance loopholes, and a worsening breach at Facebook

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s note: Secretary Kirstjen Nielsen’s exit from DHS signals further uncertainty for U.S. cybersecurity strategy. As the Trump Administration continues to lack a coherent strategy, hackers demonstrated the severity of force they can bring to bear after they interrupted the Weather Channel’s live broadcast. Likewise, in an unrelated incident, the state of Ecuador suffered 40 million cyberattacks last week in retaliation for revoking the asylum of WikiLeak founder Julian Assange. 

In other news, Facebook chose to announce that its Instagram breach affected millions of accounts, not the tens of thousands of accounts it had previously reported, the same morning that the findings of the Muller investigation became public. Many privacy advocates were skeptical of the choice of timing. 

Finally, companies relying on cyber insurance policies to protect them in the event of an attack are increasingly finding that they may not be covered from a state-sponsored hack like 2017’s NotPetya attack. 

And now, on to the clips!

—————–

Experts: Nielsen exit from DHS will harm cybersecurity. A majority of experts surveyed by the Washington Post are concerned that former DHS Secretary Kirstjen Nielsen’s exit will further hamper America’s cybersecurity. Cybersecurity talent at Kirstjen’s level is unique, and someone with government policy experience is even more scarce, commented Mark Weatherford, a former DHS cybersecurity official who is now global information security strategist at Booking Holdings. This is another huge blow to our nation’s momentum in the cybersecurity arena and the effects with be felt even more broadly on the international stage.” (Source: Washington Post 

Cyber insurance providers relying on cyberwar declarations to avoid paying. As cyber threats have escalated, companies relying on cyber insurance policies to protect them are increasingly finding that state-sponsored attacks provide a loophole for their claims to be denied. @satariano and @nicoleperlroth write that “[w]hen the United States government assigned responsibility for NotPetya to Russia in 2018, insurers were provided with a justification for refusing to cover the damage. Just as they wouldn’t be liable if a bomb blew up a corporate building during an armed conflict, they claim not to be responsible when a state-backed hack strikes a computer network. … The cases have broader implications for government officials, who have increasingly taken a bolder approach to naming-and-shaming state sponsors of cyberattacks, but now risk becoming enmeshed in corporate disputes by giving insurance companies a rationale to deny claims.” (Source: New York Times) 

Instagram password breach much larger than originally reported. Last month Facebook announced “that it had stored hundreds of millions of user passwords unencrypted on its servers, a massive security problem. At the time, it said that ‘tens of thousands’ of Instagram passwords were also stored in this way.” Last Thursday, Facebook admitted the breach actually included millions of Instagram users, not “tens of thousands.” (Source: Recode 

Hackers take Weather Channel off the air for 90 minutes.  Last week, hackers attacked the Weather Channel’s live broadcast early in the morning. During the attack, the network was able to play “canned content, before broadcasting from backup services.” (Source: WinBuzzer) 

Presidential candidate John Delaney proposes Department of Cybersecurity. Delaney’s proposal marks the first major cybersecurity push of the 2020 cycle. @kellymakena reports that “the proposed Department of Cybersecurity would be led by a cabinet-level secretary who would be in charge of implementing the United States’ cybersecurity strategy.” (Source: The Verge 

Cost of data breaches grows to $3.86 million per breach. The Ponemon Institute’s 2018 Cost of Data Breach Study found that the total cost of a breach grew by 6 percent last year. Each compromised record now costs companies an average of $148. (Source: NBC News) 

Personal Hotmail, MSN, and Outlook emails have been compromised. As a result of the breach, hackers were “able to access email content from a large number of Outlook, MSN, and Hotmail email accounts.” The breach did not affect corporate accounts. (Source: Motherboard)   

DHS and FBI: Election systems in all 50 states were targeted by Russia. The Joint Intelligence Bulletin (JIB) expanded by stating, the FBI and DHS assess that Russian government cyber actors probably conducted research and reconnaissance against all US states’ election networks leading up to the 2016 Presidential elections.” One DHS spokesman said: “We assume the Russian government researched and in some cases targeted election infrastructure in all 50 states in an attempt to sow discord and influence the 2016 election.” (Source: Ars Technica) 

In wake of Assange arrest, Ecuador was hit with 40 million cyberattacks. After removing Wikileaks founder Julian Assange’s political asylum status, “Javier Jara, undersecretary of the electronic government department of the telecommunications ministry, said the country had suffered ‘volumetric attacks’ that blocked access to the internet following ‘threats from those groups linked to Julian Assange. ...’ Hardest-hit were the foreign ministry, the central bank, the president’s office, the internal revenue service, and several ministries and universities.” (Source: AFP) 

Upcoming Events

June 27, 2019: Federal Trade Commission’s PrivacyCon – Washington, DC
Each year, the FTC convenes a group of privacy experts, academics, policymakers, and regulators to discuss the latest research surrounding consumer privacy and data security. Researchers are encouraged to apply to present at the conference by March 15, 2019. (Source: Federal Trade Commission)

National Consumers League
Published April 25, 2019

The #DataInsecurity Digest | Issue 90

FEMA leaks data on 2.5 million disaster victims, while President Trump’s budget slashes spending on cybersecurity readiness

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s note: Victims of flooding, hurricanes, and wildfires are facing new concerns as a data leak at the Federal Emergency Management Agency (FEMA) compromised the sensitive data of 2.5 million disaster survivors. The private sector was also not immune to breaches, as we learned that Facebook stored millions of its users’ passwords in plaintext; restaurant chain Buca di Beppo compromised 2 million payment cards; and Toyota announced its second breach in five weeks. Despite these warning signs, President Trump caused a stir among cybersecurity advocates by proposing to slash funding for long-term cybersecurity readiness.

Programming note: The #DataInsecurity Digest is heading out for spring break! We will not be publishing on April 18 and will resume publication on April 25. 

And now, on to the clips!

—————–

FEMA compromises banking information and addresses of 2.5 million disaster survivors. The Department of Homeland Security’s Office of the Inspector General found that FEMA “overshared” victims’ personal information “while transferring disaster survivor information to a contractor.” Many of the victims of the California wildfires in 2017 and Hurricanes Harvey, Irma, and Maria are believed to have been affected. (Source: Washington Post) 

Facebook stored millions of Facebook, Instagram, and Facebook Lite passwords in plaintext. The passwords were accessible by any one of Facebook’s thousands of employees. In the coming days, Facebook plans to “notify hundreds of millions of Facebook Lite users, tens of millions of Facebook users, and tens of thousands of Instagram users that their passwords may have been exposed.” (Source: Wired) 

Breach du jour: Buca di Beppo, Earl of Sandwich, and Planet Hollywood. The parent company of the popular restaurants finally acknowledged the chains were the subject of a breach after @briankrebs “contacted the executive team at Buca di Beppo in late February after determining most of this restaurant’s locations were likely involved [in] a data breach that first surfaced on Joker’s Stash, an underground shop that sells huge new batches of freshly-stolen credit and debit cards on a regular basis.” The breach is believed to have compromised 2 million of their customers’ credit and debit card numbers over a 10-month period.  (Source: Krebs on Security 

Breach du jour part deux: Toyota announces second data breach in five weeks. In Toyota’s latest breach, “hackers gained unauthorized access to data for several of its sales subsidiaries based in Tokyo. The servers that hackers accessed stored sales information on up to 3.1 million customers that included names, dates of birth and employment information.” (Source: Bank Info Security 

Trump budget provides short-term cyber fixes while hampering America’s long-term cybersecurity strategy. The proposed budget provides generous increases to military cybersecurity but cuts spending for “most government offices that tackle emerging challenges in cybersecurity. The biggest cut … is to the Homeland Security Department’s science and technology wing, which does much of the long-range research aimed at making technology fundamentally more secure.” If approved, Trump’s budget would cut the division to “slightly less than two-thirds of its 2019 funding.” (Source: Washington Post 

Investigator: Saudis hacked Amazon head Jeff Bezos in retaliation for media coverage. The investigator hired by Bezos alleged that the “Saudis obtained racy text messages between the married Bezos and his girlfriend Lauren Sanchez. The material was leaked to the National Enquirer, which published a story revealing Bezos’ affair.” Investigator @GDBAProtects “thinks the Saudis may have been motivated by the Bezos-owned Washington Post’s dogged coverage of last October’s murder of Washington Post journalist Jamal Khashoggi.” (Source: Ars Technica 

City of Albany, NY struck with ransomware attack. On Saturday, the city was struck with a crippling ransomware attack that forced city employees to utilize paper records. As of Tuesday, the city was still “directing people to the state Office of Records in Menands for birth, death and marriage certificates.” (Source: WNYT 

Suggested listening: An insider’s view of the Equifax breach. @redtapechron sat down with the GAO’s Equifax investigator to talk about the infamous breach. Listeners learn that “it took Equifax 76 days to notice the attack” and that “the attack itself was ‘not sophisticated.’ In fact, Equifax made things easy. Once inside, criminals found a text file with usernames and passwords for 51 other databases.” (Source: Bobsullivan.net

Upcoming Events

June 27, 2019: Federal Trade Commission’s PrivacyCon – Washington, DC
Each year, the FTC convenes a group of privacy experts, academics, policymakers, and regulators to discuss the latest research surrounding consumer privacy and data security. Researchers are encouraged to apply to present at the conference by March 15, 2019. (Source: Federal Trade Commission)

National Consumers League
Published April 4, 2019

The #DataInsecurity Digest | Issue 89

As Feds pursue Facebook, Schiff warns of cyber vulnerabilities in 2020

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s note: Despite having more than two years to beef up our cybersecurity in the wake of the 2016 elections, House Intelligence Chairman Adam Schiff warned that we are” enormously vulnerable” to hacking in the next election.

Meanwhile, Americans appear to be growing fed up with the constant state of data insecurity as a surprising number (more than a third) feel that executives of breached entities should face prison time when a breach occurs under their watch. Despite the growing disdain for corporate America’s allowing of breaches, a new study found that a breached organization’s CEO is actually likely to see a pay increase in the wake of a breach.

And now, on to the clips!

—————–

Chairman of U.S. House Intelligence Committee: 2020 election is ‘enormously vulnerable’ to hacking, foreign influence. Congressman Adam Schiff (D-CA) further said, “the potential for mischief now is extreme,” and he “is concerned about efforts to undermine U.S. democracy.” (Source: Reuters) 

Federal prosecutors conduct criminal investigation into Facebook’s data deals. The investigation was launched after more than 150 companies, including Amazon, Apple, Microsoft, and Sony, “entered into partnerships with Facebook, gaining broad access to the personal information of hundreds of millions of its users,” without their consent. (Source: New York Times) 

Suggested reading: Have you ever wondered what it would be like to be responsible for a 230Mperson data breach? Steve Hardigree’s small company Exactis achieved undesired fame after they stored the personal information of 230 million Americans on an unsecured server. Hardigree told @a_greenberg that the “stress over the situation was so severe that he broke out in hives and had to go to the hospital for treatment. …” The ordeal has been a grueling lesson for Hardigree, who says that he’s learned the hard way how much even a tiny firm like his must prioritize security. “Be careful with your data and be careful with the people who manage your data. I hired some guys that were careless. But at the end of the day it’s the CEO who’s responsible. I take responsibility.” (Source: Wired)  

Future cyber threats keep DHS Secretary Nielson up at night. In a speech on her future security priorities, Kirstjen Nielsen said that she is not worried about what “threat actors have done, but what they have the capability to do — surveilling sensitive secrets and deceiving us about our own data, distracting us during a crisis, launching physical attacks on infrastructure with a few keystrokes, or planting false flags to embroil us in conflicts with other nations.” (Source: Politico)  

Quick hit: 38 percent of consumers believe that C-level executives who fail to protect their data should face prison time or a fine. The survey also found that 20 percent of Americans don’t trust anyone with their data. (Source: HelpNetSecurity)  

Data breaches lead to pay raises for CEOs. A new report found that, despite the financial loss a breach inflicts upon a company, organizations actually tend to increase their CEO’s pay in the wake of a breach. Researchers attributed the pay raise to the “idea that the average response [to a breach] is to invest more in the management to address possible structural flaws, as well as maintaining the integrity of the firm in response to the reputational damage it has suffered.” (Source: PYMTS)  

Beto O’Rourke’s record suggests privacy convictions. After O’Rourke announced his run for president, @timstarks looked into the former House Homeland Security Committee member and found that “he took a few stances on cyber and surveillance issues that put him in company with privacy-oriented Democrats: a vote against a cyber threat information sharing bill, and co-sponsoring legislation meant to curb electronic surveillance. He also co-sponsored an amendment last year to reverse the Trump administration’s elimination of the White House cyber coordinator, which House Republicans blocked.” (Source: Politico) 

Senators Wyden and Cotton request congressional breach notification rules. Despite the Senate being a major target for hackers, there is currently very little transparency when a breach occurs. As @alfredwkng reports, “Congress has no legal obligation to disclose breaches, meaning that the public has no idea when elected officials are hit by cyberattacks. …” Now, Senators Ron Wyden (D-OR) and Tom Cotton (R-AR) are requesting that the Senate Sergeant at Arms help provide more transparency. The Senators have requested the Sergeant at Arms to “provide an annual report on the number of times Senate computers have been hacked, and incidents where hackers were able to access sensitive Senate data,” and “inform the Senate rules committee within 5 days of a breach occurring.” (Source: CNet)

Upcoming Events

June 27, 2019: Federal Trade Commission’s PrivacyCon – Washington, DC
Each year, the FTC convenes a group of privacy experts, academics, policymakers, and regulators to discuss the latest research surrounding consumer privacy and data security. Researchers are encouraged to apply to present at the conference by March 15, 2019. (Source: Federal Trade Commission)

National Consumers League
Published March 21, 2019