I posted this last Friday, with some of the same
questions.
The St. Charles Health System may think they’ve met all
their obligations in their handling of
an
insider snooping incident, but Deschutes County District Attorney John
Hummel says the matter
should
have been reported to them for criminal investigation.
Now that’s interesting to think about. If a covered entity is convinced that an
employee snooped just out of curiosity and not for any intended misuse of
information for tax fraud, etc., should the covered entity be referring the
matter to law enforcement for criminal investigation?
Would employees be more hesitant about snooping if they
knew their employer could not just handle an incident internally and their name
and actions would be referred for a criminal investigation?
And would employers/covered entities be even more
motivated to prevent insider snooping if they knew they had to refer incidents
for criminal investigation if more than X number of patients were involved?
Probably true in this case, but what happens if someone
really does forget? How could I prove it? Should I have to?
Thomas Claburn reports:
The US Third Circuit Court of
Appeals today upheld a lower court ruling of contempt against a chap who
claimed he couldn’t remember the password to decrypt his computer’s hard
drives.
In so doing,
the appeals court opted not to address a lower court’s
rejection of the defendant’s argument that being forced to reveal his password
violated his Fifth Amendment protection against self-incrimination.
Read more on
The
Register.
Something for my Computer Security students to research!
Hacking Tools Get Peer Reviewed, Too
In September 2002, less than a year after Zacarias
Moussaoui was indicted by a grand jury for his role in the 9/11 attacks,
Moussaoui’s lawyers lodged an official complaint about how the government was
handling digital evidence. They
questioned the quality of the tools the government had used to extract data
from some of the more than 200 hard drives that were submitted as evidence in
the case—including one from Moussaoui’s own laptop.
When the government fired back, it leaned on a pair of
official documents for backup: two reports produced by the National Institute
of Standards and Technology (NIST) that described the workings of the software
tools in detail. The documents showed
that the tools were the right ones for extracting information from those
devices, the government lawyers argued, and that they had a track record of
doing so accurately.
It was the first time a NIST report on a digital-forensics
tool had been cited in a court of law. That
its first appearance was in such a high-profile case was a promising start for
NIST’s Computer Forensics Tool Testing (CFTT) project, which had begun about
three years prior. Its mission for
nearly two decades has been to build a standardized, scientific foundation for
evaluating the hardware and software regularly used in digital investigations.
…
Today, the
CFTT’s
decidedly retro webpage—emblazoned
with a quote from an episode of Star Trek: The Next Generation—hosts dozens of
detailed reports about various forensics tools.
Some reports focus on tools that recover
deleted files, while others cover “file carving,” a technique that can
reassemble files that are missing crucial metadata.
The largest group of reports
focuses on acquiring data from mobile devices.
There is a place for my Computer Security students in law
firms, but will the lawyers listen?
Lia Marie Brooks and Peter A. Nelson have an article on Harleysville
Insurance Co. v. Holding Funeral Home, Inc. that I nearly skipped. I’m glad I didn’t, because it may have some
applicability to cases where entities leave confidential or protected health
information on public FTP servers without any password protection and then try
to claim they were “hacked” when someone copies the data.
From their article:
The court found that the
disclosure was “inadvertent” under state law because the insurer “unknowingly
provided access to information by failing to implement sufficient precautions
to maintain its confidentiality.” Further, the court
held that the insurer waived any claim of privilege because the site was not
password protected and the information “was available for viewing by anyone,
anywhere who was connected to the internet and happened upon the site by use of
the hyperlink or otherwise.”
“In essence,” the court held, the
insurer had conceded that its actions were “the cyber world equivalent of
leaving its claims file on a bench in the public square and telling its counsel
where they could find it. It is hard to
imag[in]e [sic] an act that would be more contrary to protecting the
confidentiality of information than to post that information to the world wide
web.”
The court found that
disqualifying defense counsel would serve no practical purpose, as any replacement
counsel would be entitled to receive the same claims file in discovery. The court
also chastised defense counsel for downloading the claims file because a
confidentiality notice was displayed on the email message that was produced
with the hyperlink. “[B]y
using the hyperlink contained in the email containing a Confidentiality Notice
… defense counsel should have realized that the Box Site might contain
privileged or protected information.”
You can read their full article on Patterson Belknap
Data
Security Law Blog.
For my Computer Security students.
Erich Falke writes:
Then there were two.
On March 16, 2017, the New Mexico
state legislature passed a
bill requiring
that New Mexico residents be notified if their “personal identifying
information” was affected by a breach of electronic data.
Upon signature of the bill, New Mexico will
join 47 other states requiring such notification, and
the only states remaining without notification laws will be Alabama and
South Dakota.
Read more on Baker Hostetler
Data
Privacy Monitor.
This could be amusing.
New Bill Forces Cybersecurity Responsibility Into the
Boardroom
A new bill introduced to the Senate seeks to change this
by requiring a board level statement of cyber security expertise or practice in
annual SEC filings.
S536, cited as the
'Cybersecurity Disclosure Act of 2017', is sponsored by Democrats Mark Warner
of Virginia and Jack Reed of Rhode Island, and Republican Susan Collins of
Maine. Its purpose is to promote
transparency in the oversight of cybersecurity risks at publicly traded
companies.
The bill (
PDF)
defines a cyber security threat as any action not protected by the First
Amendment that "may result in an unauthorized effort to adversely impact
the security, availability, confidentiality, or integrity of an information
system or information that is stored on, processed by, or transiting an
information system..."
The bill then proposes
just three requirements under the aegis of the Securities and Exchange
Commission (SEC): that annual reports to the SEC must disclose the level of
cyber security expertise of the board; or, if none exists, what "other
cybersecurity steps taken by the reporting company were taken into account";
and that the definition of what constitutes
that expertise should come from the SEC in consultation with NIST.
…
The effect of
the bill will be to make the board legally and transparently responsible for
cyber security.
It is not the first
regulation to seek this effect in 2017. On 1 March, the New York Department of
Financial Services' 23
NYCRR 500
regulation came into force.
That
regulation imposes a responsibility for regulated organizations to name a
'CISO' who will provide an annual cyber security report to be submitted and
signed off by the board to the regulator.
Taken together, these
two examples of new regulations suggest that regulatory authorities are no longer satisfied to make recommendations
about board-level security responsibility, but are now
ready to mandate and legally require it.
A wacky idea that might have some attraction. I have several students with military
experience. I’ll be interested to see
how they would structure something like this.
Perhaps a non-military version?
Experts divided on value of Cyber National Guard
This past weekend at SXSW, two Congressmen suggested that
the U.S. create a cybersecurity reserves system, similar to the National Guard,
but the idea has received a mixed welcome from the cybersecurity community.
According to House Rep. Will Hurd, a Republican from
Texas, a national cybersecurity reserve could help strengthen national security
and bring in a diversity of experience.
… "We have
military reserves for all the traditional branches of the armed services, but
nothing for the cyber realm, largely because of restrictive military hiring
policies that discourage information security professionals from joining
up," he said.
… For example,
typical reservists are trained to shoot a rifle, or pilot a helicopter, he
said, but cyber professionals are already trained. Plus, there's the culture gap, he added. "Being forced to cut their hair, having
to work out, being deployed away from their families."
"There are plenty of patriots in the ranks of the
cybersecurity elite, but not many who are going to leave lucrative corporate
and consulting gigs to join the military," said Jonathan Sander, vice
president of product strategy at
Lieberman Software. "However, offer them an option to keep
their income but be on call to come to the national defense when it’s needed
and you may have a winning formula."
Tools for small businesses? But not at the Mom & Pop level.
Foursquare is launching an analytics platform to help
retailers understand foot traffic
While Foursquare started as a social check-in
app, the company has always said there is a bigger picture —
mainly related to unique ways of leveraging its database of check-ins
at nearly 100 million public places.
There’s no better example than when Foursquare
predicted that Chipotle same-store sales would fall 29
percent after the Mexican chain was hit with E. coli outbreaks.
The actual decline announced by Chipotle ended
up being a spot-on 30 percent.
As you can imagine, these analytics can be
very valuable to retailers, allowing them to better understand customers’
habits as well as predict store traffic.
So today the company is announcing
Foursquare Analytics,
a foot-traffic dashboard for brands and retailers.
The platform is available for retailers with
any number of stores, no matter how small.
Previously the only way for companies to
access this data was through one-off deals with Foursquare.
Retailers will be able to use the dashboard to see
foot-traffic data across metrics
like gender, age and new versus returning customers — on a national
or citywide scale. They also can compare
their foot traffic against a set of competitors and
their category as a whole.
As long as they don’t screw this up too…
Samsung has a plan to turn Google into a dumb tube
Samsung has decided to wade into a massive battle over the
future of computing — and it has a huge potential advantage.
On Monday,
the
South Korean electronics company announced "Bixby": A
voice-controlled AI assistant that lives inside your smartphone.
It now joins Google, Amazon, and Apple, who are all
betting that these virtual assistants will be the next major frontier in how
people interact with their devices. (They have Google Assistant, Alexa, and Siri,
respectively.)
Thanks to Samsung's vast range of appliances, which are
already sitting in consumers' homes, it has a massive potential head start on
its competitors, just waiting to be leveraged. And it could also help it lessen its
long-running dependence on Google.
(Related). Is this
the start of a ‘personal assistant’ war?
Amazon Using Trojan Horse Approach To Go After Smartphone
Voice Market
… Here we'll look
at the latest steps the e-commerce giant is taking to go beyond its own device
and have Alexa embedded in its competitors' devices.
This is important because the number of users of Apple's
iPhone and smartphones using Google's Android is very high. To go after that market while seeking to have
itself part of the home experience puts its competitors on the defensive as
they have to not only try to grow their own market share but defend themselves
from being overtaken in their own back yards.
In a way, with voice virtual assistants becoming a major
growth market segment of the future in tech, it's probably good for Amazon that
its attempt to introduce a smartphone failed. Like it does in retail, now it can compete
without a physical presence, focusing primarily on invading existing hardware
ecosystems. In other words, it doesn't
have to defend against its own smartphone devices as any success with its
competitors' devices will make it harder to root the company out of them as it
expands its presence into further devices and smart home appliances.
Interesting but not (yet) alarming.
5 reasons why China will rule tech, 2017 edition
I never would have thought of this. I wonder if my students have a different
perspective?
Now There's a Netflix-Like Service for Cadillacs
…
Back in January,
GM launched
Book by Cadillac, a
“luxury vehicle subscription service” that the company says is ideal for
drivers that don’t want to “worry about insurance premiums, taxes, maintenance
or mileage restrictions and no long-term commitment.”
Since its launch at the beginning of the year, 5,000
people have signed up for Book by Cadillac.
It’s currently only available in the New York
City area, but the company has plans to expand the
program to
other parts of the country.
Membership is on a month-to-month basis, and for a
one-time fee of $500 then $1500 each
month, participants have access to 10 different current-year car
models and can swap for a new one up to 18 times during the course of the year.
I must ask my students how many social media sites they
visit on a given day.
Keeping on top of your social networks is no easy
feat. In an ideal world, there’d be one
social network to keep up with. Perhaps
the next best thing is a platform that consolidates several of your social
accounts and feeds into one place.
Hootsuite
has stood the test of time.
It’s not
perfect, but it’s by far the best option.
You won’t be able to use it for
all of
your social needs, but it can definitely help you stay up to date with more
social networks, both via your browser and
on mobile.
Something to watch for…
MIT SMR and MIT Press Announce Book Publishing Partnership
… it is with great
excitement that I share the news that MIT Sloan Management Review
and MIT Press are joining forces to launch two new book series exploring the
digital frontiers of management. One
series will feature original titles. The
other series will collect the best MIT SMR articles on key digital
topics.
… Look for more
information about the series and how to submit proposals on our website coming
soon.
