CIPP Information Privacy & Security News

"The Identity Theft Resource Center (ITRC) reported its annual breach data for 2009 last week, and for the first time malicious attacks were more frequently identified as the source of those breaches than human error. In its "2009 Data Breach Report," the ITRC found 498 publicly disclosed breaches last year, down from 657 the year before. The downturn could have resulted from changes in breach disclosure, rather than a real drop-off in system compromises, the organization says. Interestingly, paper breaches now account for 26 percent of data leaks, up 46 percent compared to 2008. Malicious attacks outnumbered breaches attributed to human error for the first time in the three years the report has been compiled. The business sector accounted for 41 percent of data breaches, up from 21 percent the year before. Approximately 222 million records were compromised, the organization says -- and about 130 million of those came from the single breach at Heartland Payment Systems. Out of 498 breaches, only six reported they had either encryption or other strong security features protecting the exposed data, the ITRC says . "

Expect more action from the FTC on data privacy breeach

"The last quarter of 2009 should be partly remembered in the advertising community as a juncture when big agencies -- namely Omnicom Media Group, The Nielsen Company, and WPP -- announced consumer data mergers. The deals entailed the marriages of offline and online data and appeared to reveal a potentially major stepping stone in the evolution of "hyper-targeting." Some of the agencies have trumpeted their newfound ability to create consumer segments related to behavioral elements such as "passion points" (e.g., shown interest in electronics, photography, fantasy football, etc.), as well as geographic location, beverage preferences, favorite social media sites, activity levels at the sites, and so on. Augustine Fou, group chief digital officer for Omnicom's Healthcare Consultancy Group and a ClickZ columnist, said that while increased hyper-targeting would likely result from the data marriages, unresolved issues remain before the use of combined online/offline data is widely adopted by brands. "For example, as diverse data sets begin to be integrated, it will become painfully apparent what data can be integrated -- or not -- and specific tradeoffs will have to be made to move forward," he explained. "In particular, privacy policies of sites and ad networks will need to be revisited." The growing ability for marketers to target online ads using data gathered offline has generally raised concern among consumer privacy advocates. To that end, Fou suggested that brands are cautiously optimistic about hyper-targeting and slightly wary of public/consumer perception. "

Marriage of offline and online data sources to target advertising may make tracking more interesting for consumers and advertisers alike.

"Drug store chain Walgreens now enables its pharmacy patients to download their prescription history from the Walgreens.com Web site to a personal health record on the Microsoft HealthVault platform. The Deerfield, Ill.-based chain announced last June it would link to HealthVault. Patients registered on Walgreens' site already can access their complete prescription history. Now, that history can also reside in a HealthVault PHR and be automatically updated. Patients can enroll with HealthVault directly from the Walgreens site. The partnership will promote stronger collaboration among patients, pharmacists, physicians and other providers, says Don Huonker, senior vice president of health care innovation at Walgreens. More information is available at walgreens.com/pharmacy and healthvault.com. "

Think twice before giving MicroSoft your personal health care information.

"Fomer UCLA Healthcare System researcher Huping Zhou has pleaded guilty to violating parts of the Health Insurance Portability and Accountability Act and could be one of the first people in the country convicted under the law, federal authorities announced Friday. After learning he was to be let go, the 48-year-old is alleged to have accessed the UCLA patient records system 323 times during the three-week period, mostly to check out the files of celebrities, according to the U.S. Attorney's Office. The names of the targeted stars have not been revealed. Federal authorities say Zhou admitted to accessing the records -- cruising files that were not necessary to view as part of his job -- under a plea agreement. He'll face a judge for sentencing March 22. It's not clear what kind of punishment the U.S. Attorney's Office will recommend in exchange for his cooperation."

"Facebook founder Mark Zuckerberg told a live audience yesterday that if he were to create Facebook again today, user information would by default be public, not private as it was for years until the company changed dramatically in December. In a six-minute interview on stage with TechCrunch founder Michael Arrington, Zuckerberg spent 60 seconds talking about Facebook's privacy policies. His statements were of major importance for the world's largest social network - and his arguments in favor of an about-face on privacy deserve close scrutiny. Zuckerberg offered roughly 8 sentences in response to Arrington's question about where privacy was going on Facebook and around the web. The question was referencing the changes Facebook underwent last month. Your name, profile picture, gender, current city, networks, Friends List, and all the pages you subscribe to are now publicly available information on Facebook. This means everyone on the web can see it; it is searchable. I"

Zuckerberg should not be trusted with your personal data. The range of reader comments in response to this article are worth a read.

"Got an e-mail list of customers or readers and want to know more about each - such as their full name, friends, gender, age, interests, location, job and education level? Facebook has just the free feature you're looking for, thanks to its recent privacy changes. The hack, first publicized by blogger Max Klein, repurposes a Facebook feature that lets people find their friends on Facebook by scanning through e-mail addresses in their contact list. But as Klein points out, a marketer could take a list of 1,000 e-mail addresses, either legally or illegally collected - and upload those through a dummy account - which then lets the user see all the profiles created using those addresses. Given Facebook's ubiquity and most people's reliance on a single e-mail address, the harvest could be quite rich. Using a simple scraping tool, a marketer could then turn a list of e-mail addresses into a rich, full-fledged set of marketing profiles, with names, pictures, ages, locations, interests, photos, wall posts, affiliations and names of your friends, depending on how users have their profiles set. Run a few algorithms on that data and you can start to make inferences about race, income, sexual orientation and interests. While that information isn't available for all users, Facebook changed its privacy settings in early December so that certain information can't be made private, including one's name, current city, profile picture, gender, networks and friend list (the latter can be somewhat hidden from public view). Anyone with your e-mail address can harvest that information, the company admits."

Probably not limited to FaceBook

"Can personal medical data that has been stripped of its identifiers to protect privacy later be used to identify a specific person? That is the question that the Health and Human Services Department is hoping a research contractor can answer. HHS intends to hire a contractor to demonstrate either the "ability or inability" to re-identify data from a data set that has been de-identified under the Health Information Portability and Accountability Act (HIPAA) Privacy Rule, according to a Jan. 4 notice on the Federal Business Opportunities Web site. De-identification and re-identification of patient data have become hot issues in the discussion about how to protect patient privacy while advancing adoption of electronic health records. The Obama administration is distributing at least $17 billion in incentive payments to doctors and hospitals who buy and use digital systems for medical data."

"All Facebook users can deactivate their profiles, but doing so quietly might not make quite the same statement as using another service to slam the door on the site. One such service, Seppukoo.com, created by the Italian group Les Liens Invisibles, drew attention late last year after launching a campaign to convince people to commit Facebook suicide. Wannabe ex-Facebook members can provide Seppukoo.com with their names and passwords and Seppukoo then not only deactivates their profiles, but also creates a "memorial" page that it sends to users' former Facebook friends. Facebook evidently isn't happy about this development. Last month, the company fired off a cease-and-desist letter to Les Liens Invisibles, complaining that users who provide log-in data are violating Facebook's terms of service. The company also alleges that the scraping of its data violates a host of laws, including an anti-hacking law, the federal spam law and the copyright statute. "

FaceBook is sooooo concerned about our privacy!

"If there was anything even vaguely comforting about the data breaches that were announced this year, it was that many of them stemmed from familiar and downright mundane security failures. Companies continued to be felled more by usual issues such as lost laptops, unpatched or poorly coded software, inadvertent disclosures and rogue insiders, rather than by sneaky new attack techniques or devastating new hacker tools. Here's a look back at five of the more notable breaches of the year:"

More preventable security failures predicted for 2010. Way to show value!

"Despite concerns from some privacy groups and U.S. lawmakers about behavioral advertising, most large advertising networks generally comply with a set of privacy and data-handling standards adopted by the Network Advertising Initiative a year ago, the NAI said in a report released Wednesday." ...NAI, whose members include Google, Yahoo and Advertising.com, should be praised for doing a compliance report after skipping it for several years, said Ari Schwartz, vice president and chief operating officer CDT. However, the group should consider using a third party to audit compliance of its privacy guidelines, instead of having NAI staff do the audits, he said. In addition, while NAI members appear to be following most of the guidelines, some of the privacy safeguards are "weak," including the data retention standard, he said. "There's no maximum for data retention -- they just have to state what their data retention policy is," Schwartz added. The NAI report doesn't lessen the need for new privacy laws, Schwartz said. Several online advertising networks are not members of NAI, and the recent public pressure has led to the NAI updating 8-year-old guidelines last year and issuing a compliance report for the first time in several years, although the group had promised regular reports, he said. "It seems that when there's regulatory pressure, they actually do comply with what they said they were going to do," he said. "We certainly wouldn't want to see any regulatory pressure lifted."

Worth a read. The story changes quite a bit from the top to bottom of the story.

"The attempted attack on a Detroit-bound flight last week, along with the events preceding and following it, has provided a snapshot of the ongoing struggle to balance civil liberties and national security. President Obama on Tuesday admitted a "systemic failure" on multiple levels in the run-up to the attempted bombing. Suspect Umar Farouk Abdulmutallab was in a terror database of more than a half-million people but was not on a "no-fly" list. The administration has initiated a review of airport security and the watch-list system in the wake of the failed plot. But so far, analysts say what happened is emblematic of the struggle between privacy and security interests. "It's just (an) inability to understand the right way to strike the balance that's at fault," said constitutional attorney David Rivkin. Airlines don't have access to the government's comprehensive terrorist database. They screen travelers based on the smaller, "no-fly" list."

Perhaps this is more a question of trust (not privacy) versus security. Do we really trust our government and its agents to handle private information securely?

"A German computer scientist has published details of the secret code used to protect the conversations of more than 4bn mobile phone users. Karsten Nohl, working with other experts, has spent the past five months cracking the algorithm used to encrypt calls using GSM technology. GSM is the most popular standard for mobile networks around the world. The work could allow anyone - including criminals - to eavesdrop on private phone conversations. Mr Nohl told the Chaos Communication Congress in Berlin that the work showed that GSM security was "inadequate". "

"Craig Newmark, founder of Craigslist and a customer-service guru, was riding on a public train in San Francisco, California, recently when something common but annoying occurred: The railcar filled with people and became uncomfortably hot. If the inconvenience had happened a few years ago, Newmark said he would have just gone on with his day -- maybe complaining about the temperature to a friend. But this was 2009, the age of mobile technology, so Newmark pulled out his iPhone, snapped a photo of the train car and, using an app called "SeeClickFix," zapped an on-the-go complaint, complete with GPS coordinates, straight to City Hall. "A week or so later I got an e-mail back saying, 'Hey, we know about the problem and we're going to be taking some measures to address it,' " he said. Welcome to a movement the tech crowd is calling "Gov 2.0" -- where mobile technology and GPS apps are helping give citizens like Newmark more of a say in how their local tax money is spent. It's public service for the digital age."

Maybe Craig of Craigslist has finally found something to do with technology besides making it easier to find a prostitute in Los Angeles?

"Although physicians support the use of electronic health records, concerns about potential privacy breaches remain an issue, according to two research articles published in the January 2010 issue of the Journal of the American Informatics Association (JAMIA), in its premiere issue as one of 30 specialty titles published by the BMJ (British Medical Journal) Group, UK. "

"CRM systems are full of data that's valuable to your company. Or at least, it better be. But CRM systems are not at the top of the list for external hackers, so why should it be on your priority list for an ILP/DLP system? Let's start by clearing up a misconception: the external hacker is rarely your biggest concern, particularly for a CRM system. The most dangerous breaches come from your own employees, particularly the disgruntled ones. Given the number of layoffs and the turnover of sales reps these days, the risk has grown. Your employees not only have access to a significant amount of data, but also know what the data means and how to separate the marginal from the important."

"Forrester often gets inquiries such as, "What requirements should we keep in mind while developing our disaster recovery plans and documents?" and, "Which strategies work best for managing our disaster recovery program once it's in place?" "

"Disaster recovery and business continuity planning are processes that help organizations prepare for disruptive events-whether an event might be a hurricane or simply a power outage caused by a backhoe in the parking lot. Management's involvement in this process can range from overseeing the plan, to providing input and support, to putting the plan into action during an emergency. This primer (compiled from articles in CSO magazine) explains the basic concepts of business continuity planning and also directs you to more CSO magazine resources on the topic."

"In a bizarre case of cyber crime, the Wall Street Journal reported today that Russian hackers may have stolen tens of millions of dollars from Citigroup, a charge the bank denies. " Citing anonymous government officials, the newspaper reported that the hackers were connected to a Russian cyber gang and that two other computer systems, at least one connected to a U.S. government agency, were also attacked. The FBI is investigating the case, according to the Wall Street Journal, but the company has flatly denied the story. "We had no breach of the system and there were no losses, no customer losses, no bank losses," the banking giant said in a statement. "Any allegation that the FBI is working a case at Citigroup involving tens of millions of losses is just not true."

"* To pay all costs tied to administration of settlement * To pay class members' attorney costs Dec 21 (Reuters) - Credit card processor Heartland Payment Systems Inc (HPY.N) said it would settle consumer cardholder class actions tied to claims arising from breach of its system by cyber thieves, and pay up to $2.4 million to class members submitting valid claims. Heartland agreed to pay a minimum of $1 million to class members and take up settlement-related administration costs, including up to $1.5 million for the cost of notice to the settling class. The company will pay up to $760,000 of the costs of attorneys representing the class members. Heartland said it could terminate the deal if costs of notice exceeded $1.5 million, or if it received more than 2,500 requests for exclusion from the settlement class. The deal settles all intrusion-related proceedings by consumers who used the payment cards between Dec. 6, 2007 and Dec. 31, 2008, including those who may allege to have suffered losses, the company said in a statement. Heartland, which agreed to pay $3.6 million last week to settle claims with American Express Co (AXP.N) related to the criminal breach, reported in January this year that cyber thieves hacked its payment system and stole credit card information. Shares of the New Jersey-based company were down 18 cents at $13.29 Monday morning on the New York Stock Exchange. "

"UC San Francisco said late Tuesday it has alerted 600 patients and others that an external hacker may have obtained "temporary access to emails containing their personal information" as a result of a late September phishing scam. The breach occurred about three months ago, and was investigated in mid-October, but wasn't disclosed to the public until Dec. 15. Corinna Kaarlela, UCSF's news director, told the San Francisco Business Times late Tuesday that individuals whose data may have been compromised were notified between Oct. 21, when an in-depth investigation began, and Dec. 11, when it was completed. UCSF said Tuesday that an unnamed faculty physician in the School of Medicine was victimized in late September by the alleged scam. The physician provided a user name and password in response to an email message fabricated by a hacker, that appeared as if it came from those responsible for upgrading security on UCSF internal computer servers. UCSF's Enterprise Information Security unit subsequently identified the breach and disabled the compromised password. UCSF says it conducted an investigation and in mid-October determined that emails in the physician's account ─ including some containing demographic and clinical information and, in a few cases, Social Security numbers ─ may have been exposed."