Agency Slapped for Mismanaging Data Security Contract

Which agency is causing an uproar? The federal Office of Personnel Management. AKA “The OPM Breach of 2015”

How did the agency mishandle the data breach? A report this week from OPM’s Inspector General found 5 contracting irregularities when OPM awarded a $21M clean up the data breach contract. 

The 5 Government Contracting Problems:

  • OPM did not offer a complete scope of the work
  • Conduced inadequate market research
  • had an incomplete acquisition plan
  • exceeded dollar limits on blanket agreements
  • Unreliable contract file

CNN | OPM hit for mishandling data breach cleanup

Lege Meet Legal Trend: Hacking Laws. Define Data Ownership Like This.

The 9th Circuit Court of Appeals is wrangling over wording in an anti-hacking statute.

What legislative craft became legal fodder? Whether a law that prevents hacking can be applied against a business.

Why does this matter to your clients? Businesses want to protect the data they retain and the data their customers have on their websites and computers. But, who owns that data?

Why does this matter in Texas? Data storage facilities in Texas, like the large Facebook data storage open Texas legal system to the issue. And state laws on the issue matter too. Are there tech companies in Texas? Yes. Are your clients storing data there? Yes, probably so.

This is confusing, give me an example. Hypothetically, there’s a website where people post every detail about their life. If the postings are targeted by a marketing company, the data accessed, does this hypoethical site with its walls of information have the right to stop it or do the people posting the info have privacy rights in their data?

What have courts done? In California, lower courts have sided with the business that stores the data, and not recognized personal privacy of the individual.

The Recorder | Hacking Law Gets Workout in Facebook Case

Lege Trend: Exempt Government and Telecoms from Data Security Legislation

Australia is re-writing its data security laws. A draft proposal includes exemptions from notification requirements for governmental entities and telecommunications companies. 

Australia’s Draft Data Security Legislation 

The Guardian | Telcos and security agencies exempted from data breach rules in draft bill

Lege Trend: State Budget to Boost Data Security

Where? Virgina

What budget provisions are boosting data security? Governor McAuliffe says the state’s budget will include education investments for cybersecurity, including:

  • scholarships for students who agree to serve two years of public service in the cybersecurity workforce after graduation
  • increased cybersecurity training in high school including:
    • new virtual, secure platform to enhance student cyber skills
    • providing training on cyberattack detection and defense
    • developing cyber certifications
    • encouraging student collaboration within the industry, to conduct research
    • offering training for active duty military and veterans.
  • higher education fudning for institutions that meet national standards for cybersecurity training

Why the state focus on cybersecurity? “Cybersecurity education is a key component to building the new Virginia economy.”

NBC 29 WVIR| Gov. McAuliffe Says Budget Would Boost Cybersecurity Industry

INTERIM Lege Trend: State Proposes 6 Data Security Standards for Businesses.

New York Legislature, at the behest of its Attorney General, is strengthening its data security laws. 

Assembly Bill 6866 adds new data to protection requirements and increases penalties.

This bill creates these standards that establish compliance with the law for businesses:

  • a business that protects data more than the law requires
  • a business that complies with Gramm-Leach-Bliley Act
  • a business that meets international standards for information security
  • a business that complies with HIPPA
  • a business that complies with current National Institute of Standards and Technology Standards Special Publication 800-53
  • a business that:
    • has a designated security employee
    • identifies reasonably foreseeable security risks
    • assesses safeguards and risks
    • selects providers that are have appropriate safeguards
    • regularly tests and monitors its business systems
    • maintains a Security Program Practices & Procedures
    • disposes of information in a manner that does not allow the information to be read or reconstructed

New York A06866

INTERIM Lege Trend: State Data Security Laws. Upstate Ups the Ante on Health Care & Biometric Data. More fines for More companies.

New York Legislature is considering stronger data security laws which would:

  • increase penalties against companies from $150,000 to $1,000,000
  • in addition to current required protected information of  Social Security, driver’s license and credit card numbers, this bill would require protection of biometrics like fingerprints
  • user names, email addresses, securty questions and answers
  • health information protected under HIPPA
  • establishes reasonable safeguards for business
  • establishes government data security standards in New York

Times Union | Santabarbara promotes data security bill on Cyber Monday

AO6866 Data Security Act in New York Legislature 

Data Security Meets Bond Ratings. See How it will impact Texas.

Moody’s is warning that its ratings analysis will include cybersecurity.

Moody’s big picutre cybsersecurity:

  • cyber defense
  • cyber detection
  • cyber prevention and response

Moody’s specific analysis will include:

  • Nature of the affected assets or businesses 
  • Duration of service disruption and expected time to restore
  • Scope of the affected assets or businesses 

Why does this matter to Texas? Every state entity and local governmental entity that issues bonds will be impacted.

Think Advisor | Threat of Cyberattacks Could Now Affect Moody’s Ratings

Legl Tech News | Threat of Cyberattacks Could Now Affect Moody’s Ratings

INTERIM: Data Breach. Kid data and pictures hacked.

VTech, a manufacturer of electronic educational gadgets for kids, has been hacked.

Hackers took:

  • headshots of kids & parents
  • chat logs
  • audio files of kids
  • names of kids & parents
  • email addresses
  • home addresses
  • birthdays

Remedies:

  • A hacker contacted a tech company to expose VTECH’s unsecured data storage.
  • VTECH took down their portals that allowed for data storage until a resolution can be reached.

Motherboard | Hacker Obtained Children’s Headshots and Chatlogs From Toymaker VTech

The Hill | Toy maker hack exposes data on 200K children

Mashable | The VTech data breach shows kids are just as vulnerable to hacking

 

Lege Trend: Power Grid + Data Security. 5 Rationals. 4 Solutions.

Congress is working to secure the nation’s power grid because the power grid is facing a major cyberattack because:

  • the power ” industry’s digital defenses are dangerously lagging and underfunded
  • energy companies are “scrambling to play catch-up”
  • energy companies  are ” leaving the all-important power grid exposed to hackers”
  • “the industry isn’t fully prepared to stymie sophisticated hackers.”
  • “In 2014, the energy sector was the most targeted of the nation’s critical infrastructure industry sectors,”

5 Solutions bandied about in D.C.:

  • New presidential team to coordinate cyber threat assessment & response efforts 
  • More funding for cybersecurity in energy and utilities
  • More funding for the Energy Department program, Cybersecurity for Energy Delivery Systems, to research & develop tools to protect the grid
  • Create “The Terrorism Prevention and Critical Infrastructure Protection Act” to direct DHS to work with critical infrastructure companies, like power grid operators and utilities to boost their cyber defenses

The Hill | Congress struggles to secure nation’s power grid