shutterstock_1385367863

On July 6, the United States Supreme Court issued its decision in Barr v. American Association of Political Consultants, Inc.. The Court considered whether a 2015 amendment to the Telephone Consumer Protection Act (“TCPA”) that created an exemption for debt collection calls relating to debts owed to, or guaranteed by, the federal government ran afoul the First Amendment. The American Association of Political Consultants, Inc. (“AAPC”) wished to make political calls to cell phones, just as the collectors of federal government debt are allowed to. The AAPC challenged the 2015 amendment’s constitutionality, claiming that it violated the First Amendment because it content-based and did not satisfy the strict scrutiny standard. The Fourth Circuit Court of Appeals agreed that the exemption unconstitutional but declined to strike down the entire TCPA as unconstitutional. The Fourth Circuit instead elected to sever the constitutionally offensive amendment and permit the balance of the TCPA to stand. The Supreme Court appeal considered two discrete questions: (1) whether the 2015 exemption for debt collection calls relating to government-backed debt was constitutional; and (2) if not, then what was the proper remedy to address the constitutional violation. Continue Reading The Big TCPA Case That Wasn’t

shutterstock_702701905

The perils of personal identity theft are well-known, but criminals target more than individuals and their credit card numbers. In recent years, businesses have become a popular target for identity thieves aiming to exploit brand recognition and customer expectations in the pursuit of illicit gains. Corporate identity theft’s effect on businesses can range from brand dilution to the exposure of sensitive company information. Hackers and data thieves have employed a number of identity-theft techniques that have proven catastrophic for some businesses.

Many corporate identity thefts begin with “typosquatting,” where thieves register look-alike domain names that vary only by a single letter or domain extension from the address of a business’s actual domain name (for example, “goggle.com” as a typosquatter for Google, or verizon.org for Verizon, which uses a .com extension). Typoquatting can be used in several ways. Continue Reading What’s Our Name Again? – Cyber Imposters Pose A Business Threat

shutterstock_441461692

Our first segment on APTs focused on the nature of the APT threat and the industries and data most at risk of these attacks. This section provides an in-depth overview of APT attack patterns and specific examples of APT attacks. Generally speaking, APT attack patterns overlap with popular cybersecurity attack pattern frameworks, such MITRE’s “PRE-ATT&CK and ATT&CK” and Lockheed Martin’s “Cyber Kill Chain” framework These frameworks break down network attacks into a series of stages that explain a threat actor’s conduct at each step of the attack. Although a number of threat actors and APTs share the attack patterns these frameworks describe, APT attacks approach these steps in a unique manner. Continue Reading U.S. Cyber Intelligence Warning Highlights Security Threat From Nation-Sponsored Advanced Persistent Threats (APTs) – Part 2

shutterstock_402124762

The U.S. Departments of State, Treasury, and Homeland Security, and the Federal Bureau of Investigation recently released a joint advisory (the “Advisory”) outlining a number of cyber theft, ransomware, and money laundering operations originating from organized hacking groups sponsored by the North Korean government. According to the Advisory, these state-sponsored hacking groups have attempted to steal as much as $2 billion through cyber-enabled thefts on financial institutions as of late 2019, and are known to use automated digital currency transactions to launder their ill-gotten gains. These cyber-theft operations are among the latest in the list of high-profile breaches these actors are believed to have been responsible for, including the WannaCry 2.0 ransomware that hit a number of hospitals and corporations in the United States and abroad in May 2017, and the Sony Pictures Entertainment breach in November 2014. Continue Reading U.S. Cyber Intelligence Warning Highlights Security Threat From Nation-Sponsored Advanced Persistent Threats (APTs) – Part 1

shutterstock_1186368262 (1)

The Genesis of Three Competing Federal Bills

In 2018, there were numerous congressional and industry proposals aimed at addressing privacy on the federal level. Although none ever crystalized as federal law, the sheer number of lawmakers introducing proposals and getting involved in the debate made clear that privacy would be a focus in 2019. As 2019 began, there was hope that the various state privacy statutes being enacted and debated were putting even more pressure on the federal government to enact bipartisan federal privacy legislation. The California Consumer Privacy Act’s (CCPA) January 1, 2020 go-live date also seemed to be increasing pressure on Congress to act. Nowhere was the combination of hope and pressure more pronounced than in the Senate Committee on Commerce, Science, and Transportation. Throughout 2019, bipartisan discussions on federal privacy legislation seemed to be progressing. Those talks ultimately broke down towards the end of 2019 and resulted in three separate, rival legislative proposals: COPRA, CDPA, and CDPSA. Continue Reading Federal Privacy Legislation: Where Are We and Where Are We Going?

shutterstock_565801447

On March 26, 2020, the District of Colombia enacted Act 23-268, known as the “Security Breach Protection Amendment Act of 2020.” Acting as an amendment of Section 28 of Chapter 38 of the District of Columbia Code, the Act: (1) expands the definition of “personal information,” (2) amends breach notification requirements, (3) adds new security requirements; and (4) expands the Act’s enforcement.

1. Definition of “Personal Information”

Under the Act, “personal information” now includes an individual’s name combined with one of the following data elements: Continue Reading District of Columbia Amended Privacy Law Creates New Requirements

shutterstock_746642194

On the list of concerns recently expressed about police conduct, data privacy ranks relatively low. However, a recent privacy leak by the New York Police Department’s union has shown how data privacy concerns can arise in any situation.

On May 30, the NYPD union tweeted a picture of a computer screen showing recent NYPD arrests relating to the recent civil disturbances following the widely publicized deaths of George Floyd, Breonna Taylor, and others. New York mayor Bill de Blasio’s daughter, Chiara, appeared on the report. The unredacted screenshot showed her name, her birth date, and her driver’s license information—the last being considered personally identifiable information under New York law. Twitter removed the post as a violation of its rules and suspended the union’s account. Continue Reading Government Data Leaks May Have Broad Data Privacy Implications

shutterstock_1725136630

Among countless other disruptions, COVID-19 has raised important questions about the limits of data collection and highlighted the shortcomings of both the European Union’s General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”). The pandemic has proven to be a black swan for which neither law nor its enforcement bodies are prepared—and which carries privacy-law implications that will persist long after the health crisis ends. Consequently, governments and businesses must work without meaningful existing guidance to strike a delicate balance between gathering the critical information needed to manage the virus and honoring the GDPR’s and CCPA’s stringent requirements.

Data Collection in Europe

The European Data Protection Board’s general guidance on how to collect data, in the context of COVID-19, leaves much room for interpretation. GDPR Articles 6 and 9 permit data collection without consent if the processing is necessary for the performance of a task carried out in the public interest. Although combating COVID-19 qualifies as a public interest need, it is unclear whether the collection methods employed, which vary by country, qualify as “necessary” under GDPR, or whether or to what extent those processes can sustain after the pandemic without violating the law. Each member state decides for itself how much intrusion is necessary, which invites comparisons to determine how far is far enough when gathering data in the public interest. Continue Reading The Crisis Beyond the Crisis: How Data Tracking for COVID-19 Creates Privacy Issues That Will Persist Once the Pandemic Is Over

shutterstock_300304496

In a case of first impression, the Seventh Circuit just answered a much-anticipated question about standing in cases filed under the Illinois Biometric Information Privacy Act (“BIPA”).  Bryant v. Compass Grp. USA, Inc. decided whether a BIPA plaintiff has Article III standing. The answer is both yes and no.  This dual answer is not surprising given the awkwardness of the arguments presented. Though the holding is a victory for the defense bar, Bryant is the latest evidence of an ever-increasing circuit split that should culminate in the United States Supreme Court further clarifying its holding in Spokeo v. Robins concerning Article III standing.

Like most BIPA cases, the Bryant complaint was originally filed in Illinois state court. The Bryant plaintiff asserted claims under both sections 15(a) and 15(b) of BIPA. The former relates to the defendant’s failure to make publicly available disclosures, and the latter relates to the defendant’s failure to secure the plaintiff’s individual informed consent. The defendant removed the case to federal court. The plaintiff then moved to remand, ironically contending that she lacked a sufficiently concrete injury in fact to maintain Article III standing to maintain federal court jurisdiction. The defendant paradoxically argued that plaintiff alleged such an injury, relying on the Illinois Supreme Court opinion in Rosenbach v. Six Flags Entm’t Corp., wherein the court held that a violation of the right to receive certain information is an actionable grievance. The novelty of these arguments was not because of their substance, but instead, which side advanced them—an observation that Judge Wood noted in her opinion. Siding with the defendant, the district court remanded the case, and the plaintiff appealed. Continue Reading BIPA Case Addressing Article III Standing Foreshadows Potential SCOTUS Review of Spokeo

shutterstock_655321561

Data security is not just hackers in cyberspace. It also exists in the physical world, and some of it relates to pedestrian but necessary security protocols for nuts-and-bolts objects. A recent report of a data leak shows how focusing exclusively on active systems can lead to unexpected and potentially problematic results.

In the story linked above, a manufacturer of connected vehicles replaced a number of its data storage appliances. A white-hat hacker reported that he had purchased four of the replaced units from eBay and found that they still contained the customers’ personal data, including the owners’ home and work locations, all saved wifi passwords, calendar entries from the customers’ phones, call lists and address books from paired phones, and Netflix and other stored session cookies. This incident follows a report from white-hat hackers last year who discovered drivers’ personal information in the electronic systems of salvaged vehicles. Continue Reading Data Security: What Happens at the End of the Road?