Health Advisory Council Newsletter | 2019 Q1 | Member Q&A

Kimberly A. Rawlings

Deputy Director, Office of Communications
Food and Drug Administration/Center for Drug Evaluation and Research  

Q. How long have you been at FDA’s Center for Drug Evaluation and Research (CDER), and what do you love most about your job?

A. I have worked for FDA’s Center for Drug Evaluation and Research, Office of Communications (OCOMM), for almost 10 years, and I’ve been with FDA for 20 years working in other positions. CDER’s mission is to protect and promote public health by helping to ensure the availability of safe, effective, high-quality drugs. OCOMM supports the mission through our education and outreach programs to stakeholders. Informing and educating the public helps them make informed decisions about CDER-regulated products. Working at FDA/CDER is rewarding and fulfilling. I enjoy communicating about a variety of scientific and regulatory issues. We communicate through a wide range of formats, including education campaigns, statements, webinars, videos, web content, and social media.

Q. What are the biggest challenges and opportunities facing FDA/CDER today?

A. In the Office of Communications, we support all of CDER’s programs. This requires thinking strategically about the message and the platform for disseminating that message to the target audience. The biggest challenge is translating complex scientific and regulatory information into messages for the general public or specific audiences.

Q. What FDA/CDER initiatives would you like to share with the Council?

A. There are several multi-media educational/outreach campaigns. The generic medicine campaign educates consumers and healthcare providers, in English and Spanish, about the safety, effectiveness and quality of generics. Biosimilars continue to generate interest from our stakeholders also. The biosimilar campaign promotes an understanding of biosimilars and interchangeable products for patients and providers. In addition, the BeSafeRx:Know Your Online Pharmacy campaign continues to raise awareness of the dangers of buying prescription medicines from fake online pharmacies.

Most recently, OCOMM has focused communication on the ongoing recalls of angiotensin II receptor blockers (ARBs), a class of prescription drugs to help patients with heart conditions or those who are at risk of stroke. It’s important that patients understand the risk of exposure to cancer is much lower than your risk of a heart-related problem if you don’t take your medicine.

Q. What does FDA/CDER value about membership in NCL’s Health Advisory Council?

A. As a non-voting member of NCL’s Health Advisory Council, I appreciate the opportunity to meet and collaborate with other organizations that align with FDA’s public health mission. The Council’s collegial and supportive culture enables knowledge and resources to be shared among the membership. This, in turn, widens our reach to consumers about important issues that impact their everyday life.

NCL health policy updates | Health Advisory Council Newsletter | 2019 Q1

NCL health policy at work

Script Your Future Medication Adherence Team Challenge

In January, NCL launched the eighth annual Medication Adherence Team Challenge. From January 21 through March 22, inter-professional teams—including student pharmacists, doctors, nurses, and others—implemented outreach activities in their communities to raise awareness and improve understanding about medication adherence, using Script Your Future. Since the Challenge began in 2011, more than 15,000 future healthcare professionals have directly counseled nearly 65,000 patients and reached more than 24.5 million consumers about the importance of medication adherence. Stay tuned for NCL’s announcement of this year’s winners in May.

Vaccine advocacy 

NCL is a strong supporter of vaccines and works to dispel the myths about vaccine safety and educate consumers about the importance of vaccines in protecting themselves, their families, and their communities. This quarter, NCL has been actively engaged in the vaccine policy arena. NCL submitted comments to the Advisory Committee on Immunization Practices (ACIP) urging the Committee to maintain its recommendation for the pneumococcal vaccine for adults ages 65+.

In response to the measles outbreak, NCL renewed its call for legislation requiring child vaccinations.

Finally, NCL joined the Adult Vaccine Access Coalition’s (AVAC) comments on the CMS 2020 Medicare Advantage and Part D Advance Notice Part II and Draft Call Letter. The comments urge Medicare Advantage and Medicare Part D plans to place vaccines on the no cost-sharing or low cost-sharing tiers; support the flu Star Rating measure; request inclusion of the 4-vaccine adult composite in the Star Ratings; and support Medication Therapy Management (MTM), which increases adult vaccination rates.       

Counterfeit drugs and importation 

NCL continues to have a strong focus on counterfeit drugs. On January 14, NCL issued a statement on drug importation legislation introduced in Congress. NCL expressed concern that the legislation would open the U.S. market to a flood of counterfeit and/or substandard drugs, putting patient health and safety at risk. Rather than considering misguided importation proposals, NCL encouraged Congress to strengthen our drug supply chain and pursue other strategies to ensure the affordability and accessibility of safe and effective prescription drugs.  

On January 31, NCL cosponsored the Partnership For Safe Medicines’ Congressional briefings on counterfeit drugs. At the briefings, victims of counterfeit medicines and their families, local law enforcement, former DEA agents, and other experts in the fight against counterfeit drugs discussed the widespread impact fake drugs are having on communities and the enormous burden the problem places on regulators who are responsible for ensuring public safety.

Counterfeit drugs consumer education campaign

NCL appreciates the support of Eli Lilly, PhRMA, Pfizer, Allergan, and Gilead for NCL’s Counterfeit Drugs Consumer Education Campaign. We anticipate launching the campaign in the fall of 2019, and are still seeking additional campaign partners. Please contact Karin Bolte at karinb@nclnet.org for information about how your organization can join this resource-rich platform to educate consumers on making smart decisions. 

Alliance for Advancing Women’s Health

On February 4, the Journal of Women’s Health published a consensus paper on the barriers to better female sexual health authored by several of NCL’s partners from the Alliance for Advancing Women’s Health (AAWH). Titled “Female Sexual Health: Barriers to Optimal Outcomes and a Roadmap for Improved Patient–Clinician Communications,” the paper details ways to overcome the barriers currently impeding patient–clinician communication about women’s sexual health. The publication will be the scientific foundation for the clinical and consumer resources that AAWH plans to develop this year to facilitate patient-clinician conversations on this topic. As a co-chair of AAWH, NCL will be spearheading the development of the patient tools.

Fighting the opioid epidemic

Continuing our focus on the opioid epidemic, on February 6 in Columbus, Ohio, NCL’s Health Policy and Programs Associate Nissa Shaffi (right) joined Ohio state legislators and allies at the Ohio Statehouse for the launch of Rx Abuse Leadership Initiative (RALI) – Ohio, a broad-based coalition of more than 2 dozen local, state, and national organizations dedicated to finding solutions to end the opioid crisis in the state. NCL is committed to partnering with RALI coalitions across the country to educate consumers about the safe use and disposal of opioids and resources available to support addiction prevention, treatment, and recovery services.   

FDA appropriations and Commissioner Gottlieb’s resignation 

Each year, NCL advocates for a solid base of budget authority appropriations for the FDA. On February 13 and March 19, NCL participated in the Alliance for a Stronger FDA’s Capitol Hill Advocacy Days. NCL met with staff of members of the House and Senate Agriculture/FDA Appropriations Subcommittees, including the office of Senator Jeff Merkley (D-OR), Ranking Member of the subcommittee. Altogether, Alliance teams met with over 70 Congressional offices to advocate for additional investment in the FDA that will result in substantial added value to the American public.

NCL also expressed its disappointment at the resignation of FDA Commissioner Scott Gottlieb, and urged the next FDA Commissioner to put the interests of consumers first by maintaining the agency’s strong oversight of the safety and effectiveness of drugs and medical devices.

Protecting Medicare

On January 25, NCL joined with over 50 organizations in urging CMS not to finalize the proposed changes to the Medicare Part D six protected classes of drugs (anticonvulsants, antidepressants, antineoplastics, antipsychotics, antiretrovirals, and immunosuppressants). Led by the American Cancer Society Cancer Action Network, the letter expresses concern that the proposed changes could result in cost-shifting to beneficiaries and could jeopardize vulnerable beneficiaries’ access to medically-necessary prescription drugs.

Health Advisory Council Newsletter | 2019 Q1

_dsp6918.jpg

Health Advisory Council Newsletter Q1 2019

Welcome to the Q1 issue of the Health Advisory Council Newsletter. This quarter, NCL and Council Members have been active on many fronts. Please see our policy updates, a new Q&A with the FDA’s Center for Drug Evaluation and Research, Member updates, and more.

1health_icon.png NCL health policy at work 

Script Your Future Medication Adherence Team Challenge

In January, NCL launched the eighth annual Medication Adherence Team Challenge. From January 21 through March 22, inter-professional teams—including student pharmacists, doctors, nurses, and others—implemented outreach activities in their communities to raise awareness and improve understanding about medication adherence, using Script Your Future materials and messaging. Since the Challenge began in 2011, more than 15,000 future healthcare professionals have directly counseled nearly 65,000 patients and reached more than 24.5 million consumers about the importance of medication adherence. Stay tuned for NCL’s announcement of this year’s winners in May.

More NCL health policy updates.

 Member spotlight 1spotlight_icon.png

Get to know the FDA’s Center for Drug Evaluation and Research with a new Q&A.  

1members.png Updates on Member programs

Get the latest updates on programs, policy, and initiatives from our Members, including AARP, BeMedWise, Eli Lilly, FDA’s Office of Women’s Health, NCPA, and many more.

1listen.png We want to hear from you!

If you have time-sensitive information and updates you’d like to share with the Health Advisory Council in between NCL’s quarterly newsletters, please contact Karin Bolte (karinb@nclnet.org) or Nissa Shaffi (nissas@nclnet.org), and we will be happy to forward your materials to the Council membership. We also encourage you to contact us with your ideas and suggestions for Council activities.

————
National Consumers League
Health Advisory Council Newsletter | Q1 2019
Published March 26, 2019

Health Advisory Council Member Updates | Q1 2019

AARP

On March 12, 2019, AARP announced the launch of ‘Stop Rx Greed,’ a nationwide campaign aimed at lowering prescription drug prices. The goal of the campaign is to help drive down drug prices for all Americans by advocating for a variety of legislative, executive, and regulatory actions at both the federal and state level. As part of the campaign, AARP conducted a national survey of likely voters ages 50 and older which found that significant majorities of them shared concerns about the high price of drugs, and support common-sense policies that will lower prices.

AMAG Pharmaceuticals

On January 17, 2019, AMAG Pharmaceuticals announced that it completed its acquisition of Perosphere Pharmaceuticals Inc., a private biopharmaceutical company. AMAG’s acquisition is an opportunity to add an innovative, durable and differentiated clinical asset to its portfolio. Through this acquisition, AMAG adds ciraparantag to its development portfolio. Ciraparantag is in development as a single dose, ready-to-use solution for use in patients treated with novel oral anticoagulants (NOACs) or low molecular weight heparin (LMWH) when reversal of the anticoagulant effect of these products is needed for emergency surgery, urgent procedures, or due to life-threatening or uncontrolled bleeding. Ciraparantag has been granted Fast Track review designation by the U.S. Food and Drug Administration (FDA) and has patent protection until 2034. 

America’s Health Insurance Plans

Earlier this year, AHIP launched Better Care America, a healthcare information project. Through BCA, AHIP is working with policymakers and the public on real solutions to improve care, lower costs, and ensure every American has affordable coverage, access to high-quality care, and the ability to make healthcare choices that are right for them. Health care shouldn’t be complicated and confusing – Better Care America provides tools and resources to build on what’s working and fix what isn’t in today’s system.

Association for Accessible Medicines

The Association for Accessible Medicines (AAM) was one of many organizations that weighed-in with the Centers for Medicare and Medicaid Services (CMS) on April 1st to support its recent proposal that, if implemented, would immediately lower patient spending on drugs by a large degree. In its call letter outlining policies for Medicare Advantage and Medicare Part D prescription drug plans for 2020, CMS suggested the straightforward proposition that generic drugs belong on plans’ generic drug formulary tiers with low copays instead of co-mingled onto tiers with brands as they are today. The proposal would increase access, reduce patient confusion, and save our nation’s patients more than $4 billion per year.

A new report from Avalere Health provided further evidence that America’s patients are needlessly spending too much out-of-pocket for affordable generics: Since 2015, seniors have paid nearly $22 billion in additional out-of-pocket costs for their prescription drugs in Medicare. This means that seniors using low-cost generic drugs were forced to pay billions more for low-cost medicines even as the prices of their drugs declined. America’s patients and taxpayers should receive the full value of competition from more affordable generic and biosimilar medicines. Instead of using higher co-pays for generic drugs, health plans and policymakers can help patients by ensuring that generic and biosimilar medicines are immediately placed on accessible, low-cost tiers. You can read AAM’s comment letter here.

BeMedWise at NeedyMeds 

BeMedWise at NeedyMeds announces a new partnership with Maryland’s Worcester County Health Department (includes Ocean City, MD). This spring, the Worcester County Health Department will launch BeMedWise’s Talk Before You Take program with a focus on the importance of patient advocacy and awareness about opioids. Educational materials including rack cards (English and Spanish) have been developed with messaging for patients and healthcare professionals to enhance understanding and evaluate the benefits and potential risks when using opioid medications. The educational materials will be distributed to doctor’s offices, clinics, and health fairs throughout the county.

Sharps disposal is a public health and safety issue that is commonly overlooked. Information about safely disposing of sharps is difficult to come by and often misunderstood. SafeNeedleDisposal.org, a project of NeedyMeds, is the most comprehensive information resource for home-generated sharps disposal in the United States. It is listed on the FDA website and has been mentioned in Consumer Reports. The website provides information on state guidelines as well as listings of disposal locations and programs. There is also guidance on sharps management and a Resource Center to download or order educational materials.

Read the latest BeMedWise blog, Patient Safety & Poison Prevention, in recognition of Poison Prevention Week (March 17-23, 2019). To learn more or find out how you can get involved in BeMedWise, contact Deborah.Davidson@needymeds.org.

Consumer Healthcare Products Association

The Consumer Healthcare Products Association (CHPA) recently released the results of a study on the value of over-the-counter (OTC) medicines to the U.S. healthcare system. The new research, conducted by IRI for CHPA, looked at nine major therapeutic categories of OTC medicines, finding that the availability of OTC medicines provides $146 billion in value to the U.S. healthcare system every year. Additionally, OTC medicines provide additional value through expanded access to more than 27 million consumers who would otherwise forgo treatment – more than 13 million Americans for allergies alone.

CHPA has launched a multi-pronged communications strategy and encourages all stakeholders to leverage our new findings and collateral, including infographics, video, and a social media kit. Check out our new microsite to learn more: www.chpa.org.

Eli Lilly and Company

Eli Lilly and Company recently announced plans to make available a lower-priced authorized generic version of its most commonly used insulin. Its list price will be 50 percent less than the branded version – immediately providing a more affordable option for certain Americans in high-deductible health insurance plans, the uninsured, and seniors that hit the coverage gap in their Medicare Part D plans.

Lilly is working with partners in the supply chain to stock U.S. pharmacies as quickly as possible.

The significant rebates companies like Lilly pay on insulins do not directly benefit all patients, and this needs to change. In the meantime, Lilly’s solutions can help address gaps in the healthcare system until a more sustainable model is achieved.

FDA Office of Women’s Health

The FDA Office of Women’s Health (OWH) is pleased to announce Kaveeta Vasisht M.D., Pharm.D as the new Deputy Director and Acting Associate Commissioner. OWH is also excited to have Rashetta Fairnot MSW, LMSW on board as the new Director of Outreach and Communications.

OWH is actively updating its publications to include content updates and a refreshed visual identity, ensuring that OWH continues to provide women timely and free health information in a clear and easy-to-read format.

National Association of Nurse Practitioners in Women’s Health

NPWH will hold its sixth annual Women’s Sexual Health Course for NPs in Orlando, FL May 30 – June 2. We recently released the first look at H.E.R. Hub, our upcoming patient portal. Finally, we are continuing to work to advance older women’s health care with our bOlder Women’s Health Coalition and anticipate an official Coalition launch in May 2019. To learn more about the Coalition, click here.

National Community Pharmacists Association

Drug pricing

The 2020 Medicare Part C/D Pricing Proposed Rule closed its comment period on January 25. NCPA submitted comments, a joint letter with more than 150 pharmacy stakeholder organizations, joint comments with the National Association of Chain Drug Stores (NACDS) and the National Association of Specialty Pharmacy (NASP), as well as joint comments with the American Society of Consultant Pharmacists (ASCP) and Senior Care Pharmacy Coalition (SCPC). Additionally, more than 3,300 pharmacists voiced their support and two dozen patient advocacy organizations supported the rule.

NCPA continues to advocate for the elimination of, or at the very least, prospective application of pharmacy price concessions (also known as pharmacy DIR) in Medicare Part D, which CMS estimates could save beneficiaries about $7.1 to $9.2 billion over 10 years resulting from reduced cost-sharing. This is because patients’ out-of-pocket spending is reduced when pharmacy price concessions are included in the negotiated price and applied at the point of sale. In a recently proposed rule, CMS correctly stated, “beneficiary cost-sharing is generally calculated as a percentage of the negotiated price. When pharmacy price concessions are not reflected in the negotiated price at the point of sale … beneficiary cost-sharing increases, covering a larger share of the actual cost of a drug.” NCPA’s analysis of the recently proposed rule on pharmacy price concessions is available here. Should your organization have any questions regarding this proposed policy change, please contact NCPA’s advocacy team.

The #DataInsecurity Digest | Issue 88

Regulators in Europe, Members of Congress, consumer advocates taking a critical eye at misuse of consumer data 

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s note: While EU regulators take aim at social media giants like Facebook, the new leadership in the House of Representatives pledged to protect consumer data. The newly invigorated Democratic Congress has its work cut out for it, though, as more research came out to prove just how vulnerable our entire system is to hacking and how one wellplanned attack could collapse our entire financial system.

And now, on to the clips!

—————–

EU Regulators: First of seven investigations into Facebook to be completed by summer. Ireland’s Data Protection Commissioner commented that he anticipated that the remaining six investigations into the company’s use of personal data should be completed by the end of the year. @conorhumphries reports that in addition to probing Facebook’s data practices, “the commissioner is also probing Facebook subsidiaries WhatsApp and Instagram as well as Twitter, LinkedIn and Apple in relation to their processing of personal data and the transparency of their data processes.” (Source: Reuters) 

Democrats hold first major tech policy hearing since taking over the House. @TonyRomm reports that “party lawmakers charged that long-standing inaction on Capitol Hill had left consumers unprotected in the digital age.” Chairman Frank Pallone said, “It’s time that we move past the old model that protects the companies using our data and not the people.” (Source: Washington Post) 

Banks, securities firms, financial market infrastructures, and hospitals found to be at the highest risk of a devastating cyber-attack. @MoodysInvSvc’s report found that these industry sectors hold around $11.7 trillion of the world’s debt and that an “attack in one of those sectors would also have broad ripple effects.” The report said such an attack could result in “far-reaching impact on other sectors,” and that a single successful attack on a large bank, for example, could “pose a systemwide risk” that affects the entire financial sector. (Source: Washington Post 

North Korea launches cyberattacks against U.S. banks and business while meeting with Trump in Hanoi. While the attacks had been going on for months, thanks to the help of “an unnamed foreign law enforcement agency,” researchers were able to access “one of the main computer servers used by the North Korean hackers to stage their attacks [and watch] in real time, as the North Koreans attacked the computer networks of more than a hundred companies in the United States and around the globe. (Source: New York Times 

Equifax’s CEO admits that compromising Social Security numbers causes harm while simultaneously arguing in court that it does not. When asked to share his Social Security number by Rep. Katie Porter (D-CA) in a committee hearing, Equifax CEO Mark Begor declined, citing fears over identity theft. valid concern, but also noteworthy ithat Equifax has been desperately trying to “beat back a class-action lawsuit by arguing that the plaintiffs’ claims of breach-related harm are merely theoretical. In asking a judge to dismiss the case, Equifax said last July that the ‘alleged injuries are the very definition of speculative and conjectural.’” (Source: Politico 

In wake of DNA test kit data misuse, consumer advocates call for HIPAA protections for patient info. After news reports disclosed that FamilyTreeDNA.com was giving the FBI access to its DNA database, an act it said it would not do without a customer’s permission, NCL’s @sallygreenberg called on Congress to take action. “We need some rules of the road. ... Right now it puts consumers at great risk of having their very private information shared, sold and misused in ways they didn’t sign up for. ... We need a strengthened HIPAA for DNA testing companies.” (Source: Washington Post 

Breach du jour: Dow Jones watchlist of 2.4 million high risk individuals. The sensitive data “can include names, addresses, cities and their location, whether they are deceased or not and, in some cases, photographs.” The watchlist includes “current and former politicians, individuals or companies under sanctions or convicted of high-profile financial crimes such as fraud, or anyone with links to terrorism.” This trove of sensitive data was exposed “after a company with access to the database left it on a server without a password.” (Source TechCrunch) 

Technology used by law enforcement to hack mobile devices for sale on eBay for $100. The devices, manufactured by a company known as Cellebrite, are “used by police around the world to break open iPhones, Androids and other modern mobiles to extract data. ...” With an unknown amount of Cellebrite devices being sold second-hand by law enforcement agents on the Internet, “cybersecurity researchers are now warning that valuable case data and powerful police hacking tools could have leaked as a result.” (Source: Forbes)

Upcoming Events

June 27, 2019: Federal Trade Commission’s PrivacyCon – Washington, DC
Each year, the FTC convenes a group of privacy experts, academics, policymakers, and regulators to discuss the latest research surrounding consumer privacy and data security. Researchers are encouraged to apply to present at the conference by March 15, 2019. (Source: Federal Trade Commission)

National Consumers League
Published March 7, 2019

The #DataInsecurity Digest | Issue 87

Facebook reportedly nears hefty FTC settlement; national cybersecurity at risk from external hackers and internal ineptitude

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s note: As Facebook and the Federal Trade Commission (FTC) reportedly near a record-setting privacy settlement, Chinese and Iranian hackers are beefing up their efforts to steal military and trade secrets from the United States. Meanwhile, both the Census Bureau and Federal Housing Finance Agency received bad publicity for failing basic cybersecurity best practices. Amid this storm of bad data security news, the Senate Homeland Security Chairman finds himself on the receiving end of condemnation from both sides of the aisle for blocking key cyber bills during his tenure as chairman of the Senate Homeland Security Committee.

And now, on to the clips!

—————–

Chinese and Iranian hackers take aim at U.S. companies and military. @nicoleperlroth reports that the “Iranian attacks on American banks, businesses and government agencies have been more extensive than previously reported. Dozens of corporations and multiple United States agencies have been hit…” Meanwhile, cyber watchers have observed a “renewed Chinese offensive geared toward stealing trade and military secrets from American military contractors and technology companies.” (Source: New York Times)

Chairman Johnson stalls efforts to enact cybersecurity legislation. @timstarksand @ericgellerreport that,while cyber threats have grown, Senate Homeland Security Committee Chairman Sen.Ron Johnson (R-WI) has “derailed many of the most significant cybersecurity-related bills in the past four years, including legislation to secure elections, study whether the growing use of encrypted apps hampers law enforcement and hold companies accountable for the proliferation of insecure connected devices.”@MiekeEoyangcommented that @RonJohnsonWI’s committee “is the place where legislation goes to die on cybersecurity.” Former Chairman Michael McCaul (R-TX) also publicly lamented Johnson’s leadership stating that “[t]he record speaks for itself.” Source: Politico)

Facebook reportedly negotiating multi-billion fine with FTC for privacy violations. @tonyromm reports that, while a deal has not yet been reached, the fine “would be the largest the agency has ever imposed on a technology company… If talks break down, the FTC could take the matter to court in what would likely be a bruising legal fight.” (Source: Washington Post)

Census Bureau finds data collected in the 2010 Census to be vulnerable. While a breach is not thought to have occurred, the age, gender, location, race, and ethnicity data collected from millions of Americans was found to be improperly secured. “The Census Bureau is now scrapping its old data shielding technique for a state-of-the-art method that [Census Bureau Chief Scientist John] Abowd claimed is far better than Google’s or Apple’s.” (Source: AP News)

Quick hit: Patient healthcare data breaches nearly triple. The Protenus 2019 Breach Barometer found that patient record data breaches surged from 5 million records in 2017 to 15 million in 2018. (Source: Health IT Security)

Breach du jour: Dating app notifies users of Valentine’s Day breach. The breach at“Coffee Meets Bagel” is believed to have compromised a partial list of user details, including names and email addresses. Thankfully, users’ financial information and passwords do not seem to be at risk in this breach. However, the breach is still troubling as “dating apps run a risk of leaving users’most intimate communications vulnerable.” (Source: Axios)

Stolen Equifax data has yet to surface. Seventeen months after the historic breach, the records of 143 million Americans “never appeared on any [of the] hundreds of underground websites selling stolen information. Security experts haven’t seen the data used in any of the ways they’d expect in a theft like this — not for impersonating victims, not for accessing other websites, nothing.” The lack of movement of the valuable data has led many researchers to suspect that the Equifax breach was the work of an international spy agency. (Source: CNBC)

One in three FHFA employees fail phishing test. An audit found that one-third of tested employees at the Federal Housing Finance Agency (which oversees Fannie Mae, Freddie Mac, and the Federal Home Loan Bank Systemfailed to properly handle suspicious emails. (Source: FCW)

Upcoming Events

June 27, 2019: Federal Trade Commission’s PrivacyCon – Washington, DC
Each year, the FTC convenes a group of privacy experts, academics, policymakers, and regulators to discuss the latest research surrounding consumer privacy and data security. Researchers are encouraged to apply to present at the conference by March 15, 2019. (Source: Federal Trade Commission)

National Consumers League
Published February 21, 2019

The #DataInsecurity Digest | Issue 86

Post-shutdown cyber agenda: mitigate government brain drain, investigate Equifax

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s note: While the longest government shutdown in history has ended, the consequences are still being realized. Chairmen in both chambers of Congress are working to understand how the shutdown affected crucial cybersecurity programs and stem a feared exodus of government cyber talent to the private sector. And with another shutdown potentially looming, the damage of the first 35-day shutdown could be exacerbated.

Despite having fewer data breaches than 2017, breaches in 2018 compromised twice as many records. Sadly, 2019 is not appearing to offer any relief as 773 million email address, passwords, and potentially other personal data like Social Security numbers has been posted on the Dark Web. With the constant onslaught of data breaches, it is perhaps not surprising that Americans, by a factor of more than two to one, are more concerned about data security than border security.

And now, on to the clips!

—————–

House Homeland Security Chairman fears cyber vulnerabilities caused by shutdowns. Chairman Bennie Thompson (D-MS) stated that another shutdown would “absolutely” serve as an open invitation for foreign hackers to attack federal systems. “Our concern is that so many of those persons we relied on, they weren’t there. … We could respond to [the Iranian activity] but we couldn’t be proactive in looking for bad actors because of the shutdown. And that was a problem because you have to have a system that’s both defensive and offensive. But if you’re only defensive, you’re limited in what you can identify.” (Source: The Hill) 

Breach du jour: Half of the world’s email addresses and passwords. Hackers have dumped a cache of more than 773 million email addresses and passwords on the Dark Web. “The records do not come from a single breach but are a compilation of tens and possibly hundreds of data leaks that have happened over the years, noted @panda_security. To make matters worse, researchers are currently analyzing four more just-released caches that could include the social security numbers of almost every US citizen and permanent resident in the US.” (Source: Panda Security)

While data breach frequency was down in 2018, the number of compromised records has more than doubled Research from @ITRCSD and @CyberScout found that in 2018, “there were 1,244 reported data breaches, down from an all-time high of 1,632 the previous year.” However, “the number of exposed records more than doubled from 197.6 million in 2017 to 446.5 million last year.” @ITRCCEO notes that “[t]he increased exposure of sensitive consumer data is serious. …Never has there been more information out there putting consumers in harm’s way.” (Source: Fortune)

Global authorities crack down on Denial of Service attacks. “The takedown by law enforcement in April 2018 of the illegal marketplace webstresser.org… has given authorities all over Europe and beyond a trove of information about the website’s 151 000 registered users.” The newly available data has allowed law enforcement agencies to “track down the users of these Distributed Denials of Service (DDoS) attacks.” (Source: EUROPOL)

Chairwoman Waters to call on credit reporting companies to testify. @Zachary reports thatRep. Maxine Waters, Chairwoman of the House Financial Services Committee, is expected to invite senior executives from TransUnion and Experian to a mid-February hearing. Waters is an outspoken critic of the credit reporting industry, and the hearing will put a spotlight on legislation she drafted to revamp its practices. Expect the hearing to serve as an “outlet for bipartisan outrage lingering from the historic Equifax data breach that was revealed in 2017.” (Source: Politico)

Quick hit: Americans are more worried about cybersecurity than border security The survey, conducted by Verge Analytics, found that “some 63% of those surveyed said that ‘making sure our computers are protected and privacy respected’ is the most urgent security issue compared to 29% who think that physical border security is the most important.” (Source: Dark Reading)

Sen. Johnson’s focus is to retain top cyber talent in the government Senator Ron Johnson (R-WI) told @Joseph_Marks_ that his number one goal “is to make it more attractive for cybersecurity workers to stay in government jobs rather than flee to the private sector.” Johnson acknowledged that this task may be more difficult in the wake of the government shutdown, which “furloughed about half the Homeland Security Department’s main cyber agency and required the other half to work without pay.” (Source: Washington Post)

Facebook caught (again) paying users to download an app so that it can spy on them. This time around, the app was called “Facebook Research” and paid teens and young adults up to $20 to download the app. “Seven hours after TechCrunch’s original story published, Facebook told TechCrunch it would shut down the iOS version of its Research app.” Last week, anApplespokesperson “confirmed that Facebook violated its policies, and it had blocked Facebook’s Research app on Tuesday before the social network seemingly pulled it voluntarily (without mentioning it was forced to do so).” (Source: TechCrunch)

NCL’s Top Ten Scams report warns about breach-fueled phishing and spoofing scams. Information scammers glean from data breaches can be put to many different uses, including making phishing emails seem more convincing. That’s one potential reason that complaints about phishing and spoofing scams continue to rise, according to NCL’s Fraud.org campaign’s annual Top Ten Scams report. (Source: National Consumers League)

Events

June 27, 2019: Federal Trade Commission’s PrivacyCon – Washington, DC
Each year, the FTC convenes a group of privacy experts, academics, policy makers, and regulators to discuss the latest research surrounding consumer privacy and data security. Researchers are encouraged to apply to present at the conference by March 15, 2019. (Source: Federal Trade Commission)

National Consumers League
Published February 7, 2019

Statement on resolution of lawsuit against Walmart, JC Penney, and The Children’s Place

Washington, DC – NCL Statement on resolution of lawsuit against Walmart, JC Penney and The Children’s Place 

The National Consumers League (“NCL”) and Walmart, JC Penney and The Children’s Place (“the Retailers”) are pleased to announce that they have resolved consumer-related litigation pending in the Superior Court of the District of Columbia, in National Consumers League v. Wal-Mart Stores, Inc. et al., No. 2015 CA 007731 B. The Retailers recognize the value of helping consumers learn about the measures that they have in place to assess and improve working conditions in factories that make goods for sale in the District of Columbia and elsewhere. 

Defendants’ Answers

Order on Motion to Dismiss

 

The #DataInsecurity Digest | Issue 85

Shutdown puts data security at risk while Big Tech’s ‘grand bargain’ lands with a thud

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s note: As the longest shutdown in U.S. history continues, cyber experts are beginning to sound the alarm that our nation’s data security is needlessly being put at risk. The shutdown wasn’t bad news for everyone, as the lapse in federal funding provided some relief for FCC Chairman Ajit Pai, who used the shutdown as an excuse to avoid appearing before Congress to explain his agency’s inaction on telecom companies selling users’ location data. Also in the news, Big Tech’s “grand bargain” on privacy seems to have landed with a resounding thud on the Hill.

And now, on to the clips!

—————–

Government cyber workers warn that shutdown is making government and personal data more vulnerable to hackers. @Joseph_Marks_ reports that the government’s cybersecurity professionals are growing concerned that “hackers will take advantage of the partial shutdown to tamper with sensitive government data or steal citizens’ information — and that the bare-bones staff won’t be able to fend them off… .” (Source: Washington Post) 

Senator Wyden asks IRS how it plans to combat taxpayer identity theft during shutdown. @RonWyden tweets: “If IRS is working with a skeleton staff as a result of the shutdown, is there an elevated risk that cybercriminals filing fraudulent returns with stolen taxpayer identities will be able to steal taxpayers’ refunds?” (Source: Twitter)

Chairman Pallone requests emergency hearing to discuss why FCC did not stop carriers from selling user location data. In the wake of revelations that every major carrier was violating consumer privacy, the Energy and Commerce Chair wrote, “The FCC once again appears to have dragged its feet in protecting consumers…,” in his request that FCC Chairman Ajit Pai appear before the committee. (Source: CNET)

Quick hit: FCC Chairman Pai to Chairman Pallone’s invite to testify: Thanks, but no thanks… (Source: The Hill)

FTC considers record-setting fine against Facebook for violating consent order. While not confirmed, @TonyRomm and @lizzadwoskin report that “U.S. regulators have met to discuss imposing a record-setting fine against Facebook for violating a legally binding agreement with the government to protect the privacy of its users’ personal data, according to three people familiar with the deliberations but not authorized to speak on the record.” (Source: Washington Post)

Breach du jour: 26+ million text messages with reset links and passwords. When you use two-factor authentication, or are texted a password form a company, you probably assume that the text message is secure. However, “a massive database containing tens of millions of text messages, including password reset links, two-factor codes, shipping notifications and more,” was found “easily readable, browsable and searchable for names, cell numbers and the contents of the text messages themselves,” on an unsecured server. (Source: Tech Crunch)

Big Tech proposes ‘grand bargain,’ privacy law. The “grand bargain” would preempt states and eliminate previously won protections like HIPPA and COPPA. Senator Blumenthal (D-CT) commented: “If Big Tech thinks this is a reasonable framework for privacy legislation, they should be embarrassed… . This proposal would protect no one – it is only a grand bargain for the companies who regularly exploit consumer data for private gain and seek to evade transparency and accountability.” (Source: The Verge)

Events

January 28, 2021: National Cyber Security Alliance’s Data Privacy Day – San Francisco, CA and online
Each year on January 28, the National Cyber Security Alliance convenes privacy leaders from the private, government, and non-profit sectors to discuss opportunities and challenges for the road ahead. (Source: National Cyber Security Alliance)

June 27, 2019: Federal Trade Commission’s PrivacyCon – Washington, DC
Each year, the FTC convenes a group of privacy experts, academics, policy makers, and regulators to discuss the latest research surrounding consumer privacy and data security. Researchers are encouraged to apply to present at the conference by March 15, 2019. (Source: Federal Trade Commission)

National Consumers League
Published January 24, 2019

The #DataInsecurity Digest | Issue 84

As government shutdown continues, data insecurity only grows

By John Breyault (@jammingecono, johnb@nclnet.org)
NCL Vice President of Public Policy, Telecommunications and Fraud

Subscribe here. Tell us what you think.

Editor’s note: Welcome back to #The DataInsecurity Digest, and happy New Year! As the partial government shutdown drags into its third week, cybersecurity is suffering. The Department of Homeland Security (DHS) has sent nearly half of its workforce home causing it to “cease a variety of critical cybersecurity” functions. Likewise, both the Federal Trade Commission (FTC) and the Federal Communications Commission (FCC) have shuttered their offices and stopped offering support to victims of identity theft and investigations into companies like Facebook, which may have violated its obligations to protect consumers’ data.

In the absence of federal government oversight, there was no shortage of companies mismanaging their users’ data. The Weather Channel was found to be collecting and profiting off its users’ personal data, and the Marriott breach was found to have exposed more data than originally thought.

And now, on to the clips!

—————–

Government shutdown forces DHS to furlough 45 percent of its personnel. @timstarks reports that DHS has “ceased a variety of critical cybersecurity” functions while it has “maintained baseline operational capabilities.” (Source: MorningCybersecurity)

Quick hit: FCC, FTC closed. Both agencies ran out of funds last week and will only reopen once funding is restored. (Source: Gizmodo)

Weather Channel app sued for profiting off consumers’ personal data. The city of Los Angeles is suing The Weather Company, the creator of the popular Weather Channel app, for manipulating “users into turning on location tracking by implying that the information would be used only to localize weather reports. Yet the company, which is owned by IBM, also used the data for unrelated commercial purposes, like targeted marketing and analysis for hedge fundsaccording to the lawsuit.” (Source: Los Angeles Times)

Google takes three years to patch security vulnerability. The security flaw, which was originally reported to Google in May 2015, “leaked information about smartphones’ hardware model, firmware version, and indirectly the device’s security patch level.” @campuscodi observed that in the wrong hands, the data is “indeed, dangerous, as it could have been used for exploit targeting and user fingerprinting.” (Source: ZD Net)

Marriott breach is both smaller and more extensive than originally thought. While Marriott believes that the overall number of affected customers is smaller than originally thought, the data that was compromised is believed to be more damaging. The breach now includes an additional 5.25 million unencrypted passport numbers, in addition to the 20.3 million encrypted passport numbers that were previously announced. “Unencrypted passport numbers are valuable to state intelligence agencies because they can be used to compile detailed dossiers on people and their international movements.” The FBI believes China is behind the breach, which “would allow that country’s security ministry to add to databases of aggregated information on valued individuals. Those data points include information on people’s health, finances and travel.” (Source: WSFA News)

Chart du jour: Democrats and Republicans agree that data security worsened in 2018. Of the 10 subject areas Morning Consult polled, data security was one of only two issue areas that Republicans and Democrats agreed was getting worse. The other issue Democrats and Republicans agreed upon was that the divide between the two parties was getting wider. (Source: Morning Consult)

Facial recognition found to be unsecure. Dutch researchers found that “holding up a photo of the phone’s owner is enough to unlock 42 of the [110] tested smartphone [models].” @campuscodi reported that “using a printed photo of the owner’s face is the first test that regular users, pen-testers, and attackers alike would use to break into a facial ID-protected smartphone before they move to try more complex attacks that involve creating masks or 3D printed heads of the phone’s owner. Any facial recognition system that fails ‘the photo test’ is usually considered useless.” (Source: ZDNet)

Events

January 28, 2019: National Cyber Security Alliance’s Data Privacy Day – San Francisco, CA and online
Each year on January 28, the National Cyber Security Alliance convenes privacy leaders from the private, government, and non-profit sectors to discuss opportunities and challenges for the road ahead. (Source: National Cyber Security Alliance)

June 27, 2019: Federal Trade Commission’s PrivacyCon – Washington, DC
Each year, the FTC convenes a group of privacy experts, academics, policy makers, and regulators to discuss the latest research surrounding consumer privacy and data security. Researchers are encouraged to apply to present at the conference by March 15, 2019. (Source: Federal Trade Commission)

National Consumers League
Published January 10, 2019