Hacking Mother Lode at the U.S. Department of Education. 5 Points to Know First. Education Contractors Be Aware.

  • Treasure Trove of Data. House Oversight Committee Chairman Jason Chaffetz (R-Utah) is warning that a hack on the Department of Education would make the OPM data breach look like child’s play
  • 1/2 of all U.S. government records are at the U.S. Department of Education
  • Bad Inspector General Report. Deficiencies in security at Department of Education were called out by a November Inspector General report
  •  An F In Security. The agency also got an F in implementing security requirements under the Federal Information Technology Acquisition Reform Act
  •  Contractors have hands in 184 data cookie jars. Congress is laser focused on the 184 different programs that are used or maintained by 3rd party contractors.

The Hill  Oversight head: Hackers would hit mother lode at Education Department

Data Security Meets Sharing Economy Meets Regulatory Enforcement Powers

Which state has an agency enforcement action against the sharing economy? New York’s Attorney General

Which part of the sharing economy is the NY Attorney General looking into? Ride Share

What’s the issue? Buzzfeed reported that company execuitves had access to rider locations through the ride share app

Let’s get to know what could happen in Texas, and look at what enforcement deal was worked out in NY. The settlement included:

  • a 20K fine
  • requiring ride share entity to adopt a data security plan
    •  encryption of  rider geo-location information
    • adopting  “multi-factor authentication
    • establish corporate data security safeguards like:
      • ​annual privacy and security training for employees
      • designation of a person to supervise a privacy and security program
      • maintain reasonable security practices

 

NY Daily News | Uber agrees to pay $20K fine, adopt data security provisions to settle probe by AG Schneiderman’s office

The Hill | Uber settles with New York AG over privacy

INTERIM. State Creates Office of Data Privacy and Protection

What State created an Office of Data Privacy and Protection? Washington

Did it do it by legislative action? No. It was created by Executive Action.

2 Reasons Why Washington State Created this new Data Office:

  • Washington is the “world’s center for digital commerce.”
    • That’s sure to make Texans happy.
  • “good cybersecurity is essential to the continuity of global commerce and to a thriving economy”

3 Powers the new Office of Data will have:

  • Train state agencies on best privacy practices
  • Assist Washington residents through consumer outreach and education programs
  • Conduct annual reviews of the state’s privacy policies and practices

Governing | Washington State Creates Office of Privacy and Data Protection

INTERIM. 4 Points from the EU to Guide Texas Data Security Legislation

The EU is revamping its data security statutes, why should Texas care? Because E.U. courts have taken a very libertarian and conservative view to protect personal information.

Did the EU take any actions that might translate to Texas? Yes, 4 Points to consider:

  • Stronger requirements for obtaining consent to collect/store data
  • Memorializing the “right to be forgotten”.Sounds an awful lot like the Texas Do Not Call List.
  • 72 hour noptification requirement for comapnies to notify the EU of a breach
  • Fines up to 4% of a company’s global revenue for its non-compliance 

National Law Review | EU Finalizes Text of New General Data Protection Regulation 

Looking for Clients in a booming business? Look to data security insurers.

 Data security insurance is a hot commodity. Here’s why:

  • Gross income from premiums will rise by 300+%  in the next 5 years
  • More income is on the horizon, even with factoring in new regulatory and legislative changes for this burgeoning market

Why the boom? High profile data security breaches lead to more data security policies being written.

Bloomberg | Cybersecurity Insurance Explosion Poses Challenges

Power Grid Vulnerable to Hacking. 3 Reasons Why.

  • A cyber security researcher in California discovered that Cyberattackers had opened a pathway into the networks running the United States power grid.
    • Digital clues show hackers tied to Iran have possession of passwords and engineering drawings of dozens of power plants
    • In 2012 and 2013 Russian hackers sent encrypted commands to points on the US power grid
  • Why is the power grid so vulnerable? An aging, outdated power system
  • Just like other hacks, vulnerabilities occur in 3rd party providers
    • Hundreds of contractors sell software and equipment to energy companies

Sacramento Bee | AP Investigation: US power grid vulnerable to foreign hacks

 

INTERIM Lege Trend: Education Contractors Contracting Changes for Data Security

California revamped its data security statutes for education last year. California Education Code Section 49073.1 requires education contractors to:

• a statement that pupil records continue to be the property of and under the control of the local educational agency;

• a description of the means by which pupils may retain possession and control of their own pupil-generated content, if applicable, including options by which a pupil may transfer pupil-generated content to a personal account;

• a prohibition against the service provider using any information in the pupil record for any purpose other than those required or specifically permitted by the contract;

• a description of the procedures by which a parent, legal guardian, or eligible pupil may review personally identifiable information in the pupil’s records and correct erroneous information;

• a description of the actions the service provider will take, including the designation and training of responsible individuals, to ensure the security and confidentiality of pupil records;

• a description of the procedures for notifying the affected parent, legal guardian, or eligible pupil in the event of an unauthorized disclosure of the pupil’s records;

• a certification that a pupil’s records shall not be retained or available to the service provider upon completion of the terms of the contract and a description of how that certification will be enforced;

• a description of how the local educational agency and the service provider will jointly ensure compliance with the Family Educational Rights and Privacy Act (“FERPA”); and

• a prohibition against the service provider using personally identifiable information in pupil records to engage in targeted advertising.

California Education Code Privacy Chapter 

The Recorder | Keep Up with Data Security 

INTERIM 2015 Health Care Data Breaches Leaked 112 Million Health Records. 3 Points to Know.

  • Health care comapnies are required by HIPPA to report breaches 
  • The federal government publishes breach information. Check out: Office of Civil Rights (OCR) under Health and Human Services
  • 90% of health care breaches in 2015 were the result of a Hacking/IT Incident

Remember when Texas passed laws to go above and beyond over HIPPA? Look for it in health care data protection too.

Forbes | Data Breaches In Healthcare Totaled Over 112 Million Records In 2015

3 New Rules from Cyber Insurance Coming to a Regulator Near You

  • Lots of cyber insurance policy litigation.
    • You know what lawyers mean- lawsuits and legislation.
  • 2015 was once in a lifetime groeth in cyberinsurance market
    • Hyper growth leads to regulation and legislation as the unintended consequences emerge
  • health care cyber insurance renewal rates are seeing 150% premium increases
    • Big premium cases mean, big regulatory and legislative changes are afoot

 

Property Casualty 360 | Cyber insurance 2015: Inside a robust and rapidly changing market

5 Most Costly Data Breaches of 2015. Taxpayer Costs. Procurement Opportunities.

  • IRS breach. 100,000 taxpayers exposed. Estimated cost $50 Million.
  • Anthem health insurance breach. 80 million health insurance records leaked. Cost estimate $100 Million.
  • Office of Personnel Management.  21 million federal employee and contact records breached. Minimum cost is the $133 million contract to a credit monitoring and mitigation services provider.
  • Ashley Madison Breach. 37 million customer information hacked. A class action lawsuit seeks $578 million.
  • Two Year 100 banks in 30 countries.  $1 billion over the course of two years.

Secure Speak | The Most Costly Data Breaches of 2015