The Future of Cybersecurity is Privacy - ThreatAdvice
2018 was the year of the privacy scandal.
Uber found out that it had been breached and proceeded to track down the hackers and pay them off as part of the ensuing cover-up. The cover-up angered the Federal Trade Commission and the states’ attorneys general, resulting in a greatly-expanded FTC settlement and a $148 million settlement with the AGs of all 50 states and DC.
Facebook apparently allowed application developers unmonitored and excessive access to Facebook user data, admitting to Congress that it did not know where a significant amount of user data was, who had it, and how it was being used. Although we do know now that the data of 87 million users was harvested by an application developer and sold to Cambridge Analytica, a campaign data brokerage firm that combined the Facebook data with data from other sources to compile individual voting profiles used to influence worldwide campaigns, such as the 2016 presidential election, the Brexit vote, and other elections all over the globe.
Facebook lost market value, share, and revenue, as well as taking a huge reputational hit, and found innovation and expansion plans stymied by the scandals. Facebook’s woes continue into 2019, as the FTCxi and AGs continue to investigate Facebook and class action suits proceed, including one in which the Judge promised Facebook a “bone-crushing” discovery process.
Consumer and regulatory anger at privacy failures rival data breach fatigue in the media. Privacy failures are generally seen as self-inflicted; the only victim is the customer. Even the Marriott data breach was criticized for apparent privacy failures, such as keeping personal data too long or in unencrypted form.
Indeed, the so-called personal details that enabled excellent guest service were themselves considered to be a target of the attack. These details are not usually encrypted, but were considered valuable by the attackers.
Uber found out that it had been breached and proceeded to track down the hackers and pay them off as part of the ensuing cover-up. The cover-up angered the Federal Trade Commission and the states’ attorneys general, resulting in a greatly-expanded FTC settlement and a $148 million settlement with the AGs of all 50 states and DC.
Facebook apparently allowed application developers unmonitored and excessive access to Facebook user data, admitting to Congress that it did not know where a significant amount of user data was, who had it, and how it was being used. Although we do know now that the data of 87 million users was harvested by an application developer and sold to Cambridge Analytica, a campaign data brokerage firm that combined the Facebook data with data from other sources to compile individual voting profiles used to influence worldwide campaigns, such as the 2016 presidential election, the Brexit vote, and other elections all over the globe.
Facebook lost market value, share, and revenue, as well as taking a huge reputational hit, and found innovation and expansion plans stymied by the scandals. Facebook’s woes continue into 2019, as the FTCxi and AGs continue to investigate Facebook and class action suits proceed, including one in which the Judge promised Facebook a “bone-crushing” discovery process.
Consumer and regulatory anger at privacy failures rival data breach fatigue in the media. Privacy failures are generally seen as self-inflicted; the only victim is the customer. Even the Marriott data breach was criticized for apparent privacy failures, such as keeping personal data too long or in unencrypted form.
Indeed, the so-called personal details that enabled excellent guest service were themselves considered to be a target of the attack. These details are not usually encrypted, but were considered valuable by the attackers.
Privacy differs from security in that privacy assigns value to data, provides a framework and policies for the protection of valuable data (including limits on the business use and disclosure of such data), and seeks to mitigate the risks of exposure to the business and the consumer that business activities may cause. A privacy assessment differs from a security assessment in that data risks are evaluated in the context of the ordinary course of the business and are not limited to administrative, technical, and physical steps taken to protect the data and systems from external attack.
Experts, including yours truly, predict continued focus on privacy throughout the year. Federal privacy legislation is imminent, California’s comprehensive privacy statute is effective at the beginning of 2020, and other states are following. The National Institute of Standards and Technology is developing a privacy framework to add to its Risk Management Framework and the International Organization for Standardization is developing a new ISO standard intended to ensure privacy-by-design in the development of consumer products.
Data privacy has become a cornerstone of any data protection program, including cybersecurity planning.
About The Author:
Paige M. Boshell, Privacy Counsel LLC. Privacy Counsel LLC is a cyber and privacy legal services provider representing businesses who value their proprietary data and the personal data of their customers. privacycounselllc.com . Twitter: @PrivacyCoLLC
Sources:
http://www.lawjournalnewsletters.com/sites/lawjournalnewsletters/2018/01/01/the-uber-breach-and-the-needfor-an-independent-privacy-function/?slreturn=20190015160016
https://www.ftc.gov/news-events/press-releases/2018/04/uber-agrees-expanded-settlement-ftc-related-privacysecurity
https://www.bloomberg.com/news/articles/2018-09-26/uber-to-pay-148-million-in-settlement-over-2016-databreach
https://www.wsj.com/articles/facebook-reveals-apps-others-that-got-special-access-to-user-data-1530454712
https://www.newyorker.com/news/news-desk/new-evidence-emerges-of-steve-bannon-and-cambridgeanalyticas-role-in-brexit ; https://www.bbc.com/news/world-43476762
https://www.marketwatch.com/story/facebook-stock-crushed-after-revenue-user-growth-miss-2018-07-25
https://www.washingtonpost.com/news/powerpost/paloma/the-technology-202/2018/12/06/the-technology-202-more-than-200-companies-are-calling-for-a-national-privacy-law-here-s-an-inside-look-at-theirproposal/5c0819be1b326b60d128012e/?noredirect=on
https://www.nytimes.com/2018/11/15/business/media/facebook-advertisers.html
http://fortune.com/2018/11/08/mark-zuckerberg-facebook-reputation/
https://www.cnn.com/2018/10/12/business/banks-facebook-privacy-risks/index.html
https://www.cnet.com/news/investigate-facebook-over-massive-breach-critic-urges-ftc/
https://oag.dc.gov/release/ag-racine-sues-facebook-failing-protect-millions
https://www.law360.com/articles/1116792/alsup-wants-bone-crushing-discovery-into-facebook-breach
https://www.nbcnews.com/tech/tech-n…
https://privacycounselllc.com/usa-today-marriott-breach-long-term-issues/
https://www.law.com/2018/12/18/legal-techs-predictions-for-2019-in-cybersecurity-and-privacy/
https://www.washingtonpost.com/news/powerpost/paloma/the-technology-202/2018/12/06/the-technology-202-more-than-200-companies-are-calling-for-a-national-privacy-law-here-s-an-inside-look-at-theirproposal/5c0819be1b326b60d128012e/?noredirect=onxviii https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1121
https://coag.gov/resources/data-protection-laws;
https://legislature.vermont.gov/assets/Documents/2018/Docs/ACTS/ACT171/ACT171%20As%20Enacted.pdf
https://www.nist.gov/privacy-framework
https://www.iso.org/news/ref2291.html