INTERIM. Lege Trend: State Cyber Security Czar

From where did this cyber security czar idea eminate?  It was in the 2016 proposed federal budget from the White House. The feds had a gigantic data breach, so its time to fix it.

Are state’s picking up on a state cyber security czar position? Yes, including a proposal this week from California

What moves states to implement a state cyver security czar?  Here’s what motivated California legislators:

  • 160 state departments hold personal information about residents including:
    • SSNs
    • home addresses
    • medical information
  • On a voluntary state audit, 73 of the 77 responding state agencies said their departments “are not in compliance with cyber security standards”
  • The State Department of Technology says its because agencies do not have enough funding for up to date technology

The Recorder | Lawmakers Seek Fix for State’s Cybersecurity Woes

 

 

INTERIM. 98% of health care data breaches caused by…

…hackers. Yes, that’s right 98% of the data breaches in 2015 that occured in health care were initiated by hackers.

That’s an 80% increase over 2014.

What is the intent of the hackers that seek health care information? 

  •  identity theft
  •  leverage the health care data to access medical care
  •  conduct corporate extortion 

AJMC.com | Cyberattack on Hollywood Hospital Part of a Growing Trend

New Head of DIR beginning March 2016

Stacey Napier will lead the Department of Information Resources as the its executive director beginning mid-March 2016.

Napier replaces Todd Kimbriel, the interim executive director of DIR. 

An overview of her background:

  • She arrives from Governor Abbott’s office.
  • She was with the Texas Attorney General’s Office for 10 +years
  • She was previously the Chief of Staff to former state Sen. Florence Shapiro

Austin Business Journal | Texas names Capitol veteran as technology agency director

3 lessons from a data breach lawsuit. Specs Liquor v. Insurance.

Spec’s experienced a data breach that resulted in legal fees. Spec’s was insured and has sued its insurer over the coverage of costs incurred from the data breach.

3 Take aways from a Texas Company with data breach insurance coverage:

  • Spec’s wants its insurance company to pay its legal fees for a legal fight between Spec’s and the credit card processor that experienced the data breach
  • Insurance companies have become good at covering the initial expenses (notifications, initial legal fees, computer foresenics) of a data breach, it’s these longer term expenses, like litigation, where it gets murky
  • Insurance companies have been re-writing general commercial liability policies to expressly exclude coverage for data breaches and instead offering a separate policy

Houston Business Journal | Spec’s lawsuit raises questions on how insurance companies should handle data breaches

Data Security Trend: Health Data Held Hostage for Ransom. Is it a crime?

The question for Texas, does holding business data hostage constitute a crime?

Where did data get held hostage? In California

How was the data held hostage? “malicious “ransomware” application to encrypt data on the hospital’s computer system, demanding payment in exchange for a decryption key” 

What type of business?  Hollywood Presbyterian Medical Center  patient input information 

What did the hackers want? $17,000 worth of bitcoin was paid to retrieve an encryption code.

Where patients harmed? No patient records or hospital care was impacted.

The Hill  Ransomed hospital pays $17K to hackers to restore computer access

5 Bits Informed Intel on License Plate Reader Data and Legislative Restrictions. Procurement Doors Closing.

How much data has been gathered by license plate readers in Texas? Estimated 10 million license plate pictures, with locations, collected by month.

What can be done with this stored license plate information?  It can track the location of a vehicle by plotting its sightings by day and time

What’s happening on this legislatively?

  • In 2015, Texas bills preventing license plate recording & collection died
  • Arkansas & Utah prohibit private companies from amassing license plate data collection
  • California permits the collection of license plate data for 60 days, longer if the information is being used in an active felony investigation
  • Colorado allows for data retention for 3 years, then the data must be destroyed
  • Maine allows license plate readers for limited law enforcement purposes and data can only be retained for 21 days
  • Maryland prohibits license plate readers
  • New Hampshire allows license plate readers for limited law enforcement purposes
  • Tennessee limis license plate data retention to 90 days

Lege Trend: Curtail Release of Any and All Student Data to 3rd parties. Bonjour, education vendors.

What happened to spark stronger student data privacy protections? A court allowed for the release of student data to a group of parents who are fighting a court battle over the quality of education for disabled students.

What data do legislators want to prevent schools from releasing?

  • student social security numbers
  • medical histories
  • mental health assessments
  • student disciplinary records

​What is the nobel purpose of the legislative action? Schools collect data that is neither required by law nor required for public education purposes

The Recorder | Lawsuit Spurs New Student Privacy Proposal

California Assembly Bill 2097 

Legal Trend: Lawsuits Over Smart TVs gathering & selling your data. the machines are alive. 2 Bits Informed Intel.

What data is being collected and sold by electronic devices? Smart televisions gather information about viewing habits and that data is sold to third parties .

Do owners of smart tvs know or have they consented to the data collection? According to a series of law suits, no, owners neitehr know of the data collection nor consent to it. 

WFAA | Vizio’s smart TVs are snitches, lawsuit alleges