InfoHive – Data Security – Page 202

INTERIM Lege Trend: State Data Security Commission from the East Coast. Public Private Partnerships. 4 Bits of Informed Intel.

New Jersey Legislature is considering SB 808 that would:

Create a 6 member Cybersecurity Commission under the Department of Law and Public Safety
tasked with evaluating New Jersey’s “informational infrastructure”
private and public collaboration on cybersecurity
Issue recommendations on:
- securing state networks
- offering strategies to bolster the cybersecurity industry in the state
- providing cyberhygiene and awareness

Fitbits will get hacked.
The E.U. and U.S. fight on datat security will continue
Businesses should have data security policy & do risk assessments
Data Security will be guided by industry specific standards
Telephone Consumer Protection Act will be a new source of data security lawsuits
Company issued electronic devices vs. personal electronic devices means more now that we’re in the age of data security
Curate and protect your social media like you do your health data from your fitbit
FTC and FCC will go stronger to protect data
HIPPA and data security will see a renaissance
Develop a breach notification plan (regulators are rewarding those that do)

Which states have pending legislation to penalize fully encrypted cell phones? California & New York
What fine is being imposed under these bills? $2500
What’s the goal of these encryption bans?
- help law enforcement better combat human trafficking and other serious criminal activities that are being conducted over hidden encrypted networks and locked devices.
What groups oppose these encryption penalties? The tech and privacy community

The IRS has ruled that businesses can go tax free for credit monitoring & identity theft protection services that:

4 Key points to know now:

Incentives for corporations to share data is a ruse for law enforcement to access data without a warrant
Libertarians are calling the 2015 law, “the worst anti-privacy law since the USA Patriot Act”
Undermine government accountability
Erode American privacy protections

California Assembly has a new committee to handle privacy and technology issues. What’s the committee jurisdiction?

data breach defined in new Orgegon law as:
- “an unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information that a person maintains.”
personal information that triggers the notification statute
- Social Security number;
- Driver license number or state identification card number issued by the Department of Transportation;
- Passport number or other United States issued identification number; or
- Financial account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to a consumer’s financial account
Statute only applies to unencyoted information
law enforcement can delay notification if it would impede an investigation
Statute does not apply to medical or health insurance information

What did hackers breach? Lawrence, MA Public Schools’ online database

How did the hackers breach the school database? A phishing attack

What did hackers take? Teachers’ personal information:

How did the school district respond?

email to teachers informing them of the breach
explained that the district would:
- mitigate the breach
  - directing teachers to sign up for 90 days of free credit monitoring
- prevent future breaches
- work with Massachusetts State Police, State Attorney General, & the state Office of Consumer Affairs and Business Regulations
The day after emailing the teachers, the district issued a press release

Maryland’s concerns over data storage and security for police body cameras include:

Price tag to store the data is prohibitively expensive
The data costs have stopped police departments from using body cameras
The storage retention policies differ for the recordings.
- General 90 day retention
- If there is an ongoing investigation data retention is for the length of the investigation
- any video considered evidence must be maintained for 4 years