What's Trending on NP Privacy Partner
Total Page：16
File Type：pdf, Size：1020Kb
April 29, 2016 What’s trending on NP Privacy Partner Hacktivism poses business risks, vehicle cybersecurity faces challenges, privacy cases continue to raise diverse claims, HHS develops a task force, a high profile breach targets “beautiful people,” and privacy questions linger as the government accesses iPhones. Here’s what’s trending in data privacy and security. Cybersecurity Are privacy and security-minded hacktivists another risk of doing business? Businesses are likely familiar with some of the “usual suspects” when it comes to hacking— cybercriminals, foreign-state supported individuals and the default “bad actor,” but some of the shadowy figures behind more recent leaks involving commercial entities have expressed motives more along the lines of “hacktivists.” They may simply want to reveal information for the sake of revelation. Hacktivism (“hacking” plus “activism”) is where political/social agendas and bad acts meet in the exploitation and infiltration of computers and networks. Government agencies are largely the traditional targets of hacktivism, and, to be clear, there is a constant debate about whether hacktivism is a force for “good” or a force for “evil.” As we have seen more recently, the goal of a leak may not necessarily be individual monetary gain (unlike the deployment of ransomware), but instead to put the spotlight on a company’s security or privacy practices. Given consumers’ interest in the security and privacy of their information, it is not unreasonable to expect hacktivism to take on a more socially-minded flavor in the coming years. And the impact of a socially-motivated breach is not necessarily different from a commercially-motivated breach. Some of the more recent socially-motivated leaks appear to have happened after someone simply discovered a vulnerability and decided to exploit it to demonstrate weak security. One recent example, at the end of last year, the actor behind the VTech breach explained that he had no plans to use or sell the information he obtained from the toy makers’ customer database. The individual apparently used a SQL injection, a well-known method for purging information from servers, to obtain personal information of 12 million users, including 6.4 million minors. VTech was promptly investigated by several states’ attorneys general and was the subject of class actions in federal court. This newsletter is intended as an information source for the clients and friends of Nixon Peabody LLP. The content should not be construed as legal advice, and readers should not act upon information in the publication without professional counsel. This material may be considered advertising under certain rules of professional conduct. Copyright © 2015 Nixon Peabody LLP. All rights reserved. Regardless of the motive behind the breach (and whether it was truly altruistic from the start), the costs to VTech were still the same. This does not mean that commercial entities are necessarily being targeted by hacktivists (and there is no indication that anything but financial gain will ever be the number one motivation for hacks), but certainly if someone “trips” upon a system vulnerability there could be real consequences. So, companies should continue to focus on their own networks and vulnerabilities, and understand that it’s not just the information that is being targeted, but a company’s security and processes, as well.—Kate A.F. Martinez GAO report addresses vehicle cybsersecurity The Governmental Accounting Office (“GAO”) has released a report noting that the Department of Transportation (“DOT”) and the automobile industry have undertaken important cybersecurity initiatives, but the GAO warns that the DOT needs to define its role in responding to a real-world attack on vehicles’ software. The GAO undertook its study because the amount of software code has grown exponentially to support growing automotive safety and other features. The report stresses that “[m]odern vehicles contain multiple interfaces—connections between the vehicle and external networks—that leave vehicle systems, including safety-critical systems, such as brakes and steering, vulnerable to cyberattacks. Researchers have shown that these interfaces—if not properly secured—can be exploited through direct access to a vehicle, as well as short-range and long-range wireless channels.” The GAO reviewed existing regulations and literature and interviewed officials from the DOT, and the Departments of Commerce, Defense and Homeland Security; industry officials; and 32 selected stakeholders, including automakers, suppliers, vehicle cybersecurity firms and subject matter experts. A majority of the industry stakeholders (23 out of 32) agreed that wireless attacks, such as those exploiting vulnerabilities in vehicles’ built-in cellular-calling capabilities, which could access and target vehicles from anywhere in the world, would pose the largest risk of passenger safety. Some stakeholders, however, emphasized that such attacks remain difficult to implement because of the required time and expertise and that, to date, they have not been reported outside of the research environment. Several industry-led initiatives will help automakers and parts suppliers identify and mitigate vehicle cybersecurity vulnerabilities and address the challenges faced by industry stakeholders. For example, two U.S. industry associations have promoted the establishment of an American Information Sharing and Analysis Center to collect and analyze intelligence information and provide an anonymous forum for members to share threat and vulnerability information. The GAO notes that, while the DOT’s National Highway Traffic Safety Administration (“NHTSA”) has undertaken steps to addressed vehicle cybersecurity issues, the NHTSA should enhance steps to define more fully its role in responding to a real-world vehicle cyberattack. The NHTSA has added research capabilities in the cybersecurity area and developing guidelines to assist the industry in determining when cybersecurity vulnerabilities should be considered a safety threat meriting a recall. The NHTSA is also examining the need for governmental standards or regulations, but may not make any final determinations before 2018. While acknowledging the importance of these initiatives, the GAO warns that the NHTSA’s response efforts to a vehicle cyberattack could be slowed unless its staff has a plan of action to quickly identify the required responsive actions. The GAO’s report sends an important message that cyber threats will only increase as vehicles become smarter. Collaborative efforts and continuing initiatives involving both the public and private sectors will be vital to ensure proactive and preventative measures to protect our vehicles and passenger safety.—Steven M. Richard Privacy Litigation and Class Action Credit union files suit against Wendy’s in wake of data breach First Choice Federal Credit Union (“First Choice”) filed suit against The Wendy’s Company (“Wendy’s”) in the Western District of Pennsylvania asserting claims of negligence after Wendy’s customers’ data and payment cards were exposed in a data breach. First Choice Federal Credit Union v. The Wendy’s Company, et al. (No. 2:16-cv-506) In the suit, the credit union argues that it and other financial institutions have borne the costs of the fast food chain’s “inadequate approach to data security,” which it claims resulted in a massive data breach and fraudulent charges on payment cards issued by financial institutions across the country. First Choice alleges that the costs incurred include canceling and reissuing compromised cards and reimbursing customers for fraudulent charges. Citing industry standards (such as PCI DSS and the movement away from magnetic stripe to chip technology) and state and federal statutes (including Section 5 of the FTC Act), First Choice argues that Wendy’s point of sale systems were largely outdated and that the restaurant company failed to use reasonable data security measures to properly handle and protect payment card information. First Choice also alleges that malware was installed on Wendy’s systems for months before detection and that Wendy’s failed to promptly notify the public and financial institutions. Because of this, according to First Choice, hackers were able to collect large amounts of sensitive information before anyone was made aware of the issue. This case is just getting off the ground; none of the defendants have appeared as of yet, but Wendy’s has previously been sued by consumers for the same event, and that litigation is still in its early stages with a pending motion to dismiss. This is not the first instance of card issuers filing suit in the wake of a breach. Payment card issuers settled their claims against Target after 2013’s major data breach in a deal that is pending approval in the District of Minnesota. Though financial institutions are well-equipped to deal with fraud, it is clear that they are focusing their sights on companies that are the front lines of consumer sales and using industry standards as a basis for liability post-breach. Companies that seek to comply with the PCI DSS standards and industry best practices, in particular, should review those standards and work with security and technology experts to ensure that all systems are in compliance.—Kate A.F. Martinez Privacy group backs hacked employees, argues breach is an injury-in-fact for purposes of standing Last week, the Electric Privacy Information Center (“EPIC”), a public interest research group based in