INTERIM. 5 Bits Intel to Know about Stakeholders in Cyber Security Banking & Retailer Legislation.

Let’s peak into the Electronic Payments Coalition:

Electronic Payments Coalition- who are they?

  • payments industry stakeholders
  •  credit unions
  • community banks
  • trade associations
  • payment card networks
  • banks

What’s the point of the EPC? 

  • EPC protects the value, innovation, convenience, security and competition that exists in the modern electronic payments system

What’s the EPC saying about the federal Data Security Act of 2015 (H.R. 2205)​?

  • Retailers are wrong about their position. These reforms are common sense consumer protections.
  • This bill would have stopped data breaches. 
  • This bill is flexible for all retailers.  H.R. 2205 is scalable and flexible to the size and risk profile of the covered entity

EPC | EPC SUPPORTS COMMONSENSE MEASURES TO PROTECT CONSUMER DATA

INTERIM. Health Care Data Security Bill. 4 Takeaways.

What 4 Ways does the Health & Human Services Data Protection Act protect health care data?

  • Creates the  Office of the Chief Information Security Officer (CISO) within HHS
  • Creates a data protection arrangement between the new CISO, the HHS General Counsel, & the HHS CIO
  • Keeps information technology & information security separate to ensure the highest level of security
  • Incentivizes better security to protect health care data

Health IT Security | Healthcare Cybersecurity Bill Introduced for HHS Operations

Attorney General Opinion: Data Retention. License Plate Readers. Procurement FAIL.

What is the question answered by Attorney General Opinion KP-0076? Whether Bowie County can engage a private company to use a license plate reader data looking for vehicles that don’t have liability insurance?

Is there a fee splitting arangement in this scenario? Yes, the vehcile owner will get a letter from the District Attorney office, and fees will be split 50-50 between the County and the company.

Can this fee splitting arrangement with automatic license plate readers work? No.

What is the statutory solution to make automatic license plate readers ok for counties? Counties need specific authority for the “use of automated photographic or similar technology to enforce the state’s vehicle financial responsibility laws. “

What does the Attorney General analysis look like? Its a laundry list of all the uses for photo enforcement in Texas. The highlights:

  • statutes  limit what local government it applies to
  • statutes limit specifically what can be captured by the photgraphic enforcement
  • statutes limit the kind of penalty that is permitted. (i.e. civil or criminal penalties)

INTERIM. Retailers v. Financial Institutions. Data Security Legislation Cage Fight. 4 Key Points Informed Intel

Retailers and Financial Institutions are like the Hatfields & the McCoys when it comes to federal data security legislation.  

Here’s what you need to know when this fight comes to your state legislature:

  • Fairness.  Retailers think it unfair to hold retialers to the financial institution standards for customer notification upon a data breach.
  • Impact Beyond Small Businesses. The impact of imposing financial institution standards on businesses will impact businesses large and small that operate in the retail sector and all other ecnomc sectors.
  • Agreement: Federal Laws are better than state laws. They agree that uniform federal laws that preempt state laws would be preferred for data security.
  • Consumer Protections v. Overzealous Regulators. Priority of Democrats is  strong consumner protections, while Republicans are concerned about overzealous federal regulators.

The Hill | Retailers battle financial sector over data breach legislation

State Chief Information Officers Call for Improved State Data Security. 3 Key Informed Intel.

What group is calling for improved state data security systems? National Association of State Chief Information Officers

What sparked the call to arms? the cost of cyber crime world wide is $375 billion to $575 billion, which is labled a threat to democracy

What do the NASCIO propose states do? Create statewide cybersecurity ecosystem 

What would a statewide cybersecurity ecosystem link? 

  • state government

  • local government

  • federal government

  • higher education

  • K-12 education

  • nonprofits

  • industry – all sectors

  • sector specific information sharing and analysis centers

  • critical infrastructure providers: electric, water, natural gas, waste water treatment

  • transportation: all modes 

  • critical supply chains 

 

NASCIO |  Advanced Cyber Analytics | April 2016

Politico | Morning CyberSecurity | STATES PUSHED TO UPGRADE CYBER ANALYTICS

3 Steps for a FitBit can Lead to a Conviction and Probation.

WHO WAS CONVICTED: A woman in Pennsylvania reported her rape to the police

WHAT EVIDENCE LED TO CONVICTION: When police came to the scene, they collected as evidence the woman’s fitbit found laying in a hallway

WHY DID THE EVIDENCE INDICATE GUILT: The woman claimed she had gone to sleep and was later attacked, but the data downloaded from the Fitbit indicated the woman was walking about at the time and logged her heart rate

Wall Street Journal | Prosecutors Say Fitbit Device Exposed Fibbing in Rape Case

 

Legal Trend: Sue over Data Breach. Can you remain anonymous?

No. Nien. Nyett. Nej. A federal judge ruled that people caught in the data breach at Ashley Madison cannot remain anonymous. 

Why did these plaintiffs want to be anonymous? Fear of the impact to the professional and personal lives.

Why did the court deny the request? Because the data breach is not equal to instances when a person can remain anonymous. Those instances are reserved for minors, rape, or other highly sensitive matters.

Washington Post | People suing Ashley Madison for last year’s hack can’t be anonymous, judge rules

Poll: 54% Trust Tech Companies More Than Government

A poll commissioned by The App Association reveals a distrust of government on data security issues.

The informed intel:

  • 54% trust tech companies to secure their personal information
  • 21% trust the government to secure their personal information
  • 7 in 10 believe hacking is increasing

The Hill | Poll: Voters trust tech companies ahead of FBI on data security

INTERIM. 4 Credit Card Processing Recommendations for TX House Committee on Investments & Financial Institutions.

The Credit Union National Association proposed the following changes to credit card processing in Texas to improve data security:

  • Data Security at Merchant Level. Require merchants receiving payment by credit or debit cards to protect the sensitive personal financial information they receive;
  •  Require Consumers to Notify Card Processors of Breaches. Require card recipients to notify their card processor immediately upon detecting a breach, and require the information be provided to the issuing financial institutions by the card processors;
  • Card Issues Should Cover Costs. Allow card issuers to recover costs and losses resulting from a business’s failure to protect or destroy the data; and
  • Prohibit Merchants from Storing Card Data Beyond Transactions. Require anyone taking credit or debit cards to remove card data once the transaction is completed.

Credit Union National Association | Texas House committee hears CU’s data breach concerns

INTERIM. TREND. Data Breach Law Changes. Read the Bill. New Requirements for Business.

Which state jumped on the enanced data breach notification law bandwagon? Nebraska

What 3 changes did Nebraska make to its data breach laws?

  • Expand the Data Triggering Notification to incude:
    • user name or email address along with
    • a password or security question and answer
    • that would permit access to an online account
  • Expands who Receives notice of a breach. Companies also have to notify the State Attorney General.
  • Encryption standard changed so that if the hackers got a hold of the encryption key, the data is no longer considered encrypted.

Nebraska’s LB 835

AdLaw Access | Nebraska Amends Data Breach Notification Law