School District Hack from the Inside. Criminal Charges. 3 Bits Informed Intel.

Which school district was affected by an internal hack? Abingdon-Avon School District, IL

Who is thought to have  hacked the school district internally? The Head of its IT

The purported purpose? Changing grades

The state law charges? 3 felony counts of Eavesdropping

KWQC | Abingdon-Avon employee arrested in relation to data breach

Campaign TREND. Data Breach. Voter information Hacked.

What campaign related voter information was hacked?   Voter files compiled by  L2, a political data brokerage, but hacked from a client (campaign) that left the voter information unprotected on a cloud

What type of voter information was exposed?   names, addresses, political preferences and opinions on social issues

Where were the hackers? Serbia or routed through Serbia

The Hill | US voter database accessed from Serbian server

Business Trend. Regulatory Guide for Data Safety. 29 Point Data Security Inspection for Business.

The Federal Trade Commission publishes “Start with Security: A Guide for Business” & offers these recommendations for business:

  • Don’t collect personal information you don’t need.

  • Hold on to information only as long as you have a legitimate business need.

  • Don’t use personal information when it’s not necessary.

  • Restrict access to sensitive data.

  • Limit administrative access.

  • Insist on complex and unique passwords.

  • Store passwords securely.

  • Guard against brute force attacks.

  • Protect against authentication bypass.

  • Keep sensitive information secure throughout its lifecycle.

  • Use industry-tested and accepted methods.

  • Ensure proper configuration.

  • Segment your network.

  • Monitor activity on your network.

  • Ensure endpoint security.

  • Put sensible access limits in place.

  • Train your engineers in secure coding.

  • Follow platform guidelines for security.

  • Verify that privacy and security features work.

  • Test for common vulnerabilities.

  • Put it in writing.

  • Verify compliance.

  • Update and patch third-party software.

  • Heed credible security warnings and move quickly to fix them.

  • Securely store sensitive files.

  • Protect devices that process personal information.

  • Keep safety standards in place when data is en route.

  • Dispose of sensitive data securely.

 

  •  

Data Breach TREND. The Low Tech Data Breach in Your Printer.

Are all data breaches electronic? No, hard copies of personal information are still sources of data breaches.

Are there examples of major data breaches that were based on hard paper copies? Yes. For example:

  • The NFL medical record data breach of 2016
  • A 2014 State of California investigation of Safeway for improperly disposing of customer records
  • A 2011 find of NYPD records found in a trash bin

Do data breach laws discuss paper records?  No, not all. The Federal laws and these 8 states have added paper records to their data breach statutes:

  •  Alaska
  • Hawaii
  • Indiana
  • Iowa
  • Massachusetts
  • North Carolina
  • Washington
  • Wisconsin

Lexology | Patterson Bellknapp Webb & Tyler | The Paper Trail: The Potential Data-Breach Sitting in your Printer

A Northern State. Stronger Data breach Laws.

Why Illinois updated its data security laws? To make the laws more consistent with technology

What additional personal information is covered by data breach law?

  • health insurance
  • medical information
  • biometric information
  • username and password or security questions

How will businesses be able to notify consumers of a breach? By email

Cook County Record | New IL legislation updates data breach law to cover more tech, speed required consumer notifications

INTERIM. Regulatory Enforcement TREND. Data Breach. Financial Entity. Regulatory Fine. Be Informed.

Which financial entity is facing an SEC fine for a data breach? Morgan Stanley

How much is the SEC fine? $1,000,000

What was the data breach? Security measures failed to prevent an employee from transfering account information to a private server that was hacked

What do federal rules require of financial entities? policies and procedures that are reasonably designed to protect customer data

The Hill | Morgan Stanley to pay $1M SEC fine for data breach

Law Enforcement TREND. Local Government TREND. Protect Data Security by Approving every Surveillance Technology Purchase. Where the Left and the Right Meet.

What government is requiring authorization from the governing body before a purchase of surveillance equipment can be made? Santa Clara County deep on Silicon Valley

Which police purchases will require approval?  Any law enforcement purchase of new surveillance technologies. e.g.:

  • license plate scanners
  • products that spoof cellphone towers
  • closed-circuit cameras

What entities can approve the police technology?  County board and district attorney approval are required

Why require approval before law enforcement buys technology?

  • too little oversight in the current system
  • too many intrusive technologies are in use with the data retained

Are there other requirements for surveillance equipment? Yes, law enforcement is required to:

  • publish annual surveillance reports detailing:
    • usage
    • how successful different technologies have been
    • complaints
    • internal audits not subject to privilege

The Hill | California county becomes first to restrict surveillance technology

 

 

Data Security. Self Driving Cars. Marketing & Hacking Abounds.

Data Security is the 1 key element missing from the 7 states that have passed self driving car laws.

Cars can be hacked. Cars contain data. The data your car’s computers contain can be used for:

  • direct & targeted marketing
  • cam be accessed by hackers

California is addressing vehicle data via regulation by requiring:

  • notice and consent
  • before information can be collected from operators
  • this excludes information that is needed to operate the vehicle

The Guardian | Self-driving cars: overlooking data privacy is a car crash waiting to happen