Inside Privacy - Updates on Developments in Global Privacy & Data Security

On Tuesday, Senators Carl Levin (D-MI), John McCain (R-AZ), Jay Rockefeller (D-WV), and Tom Coburn (R-OK) introduced the “Deter Cyber Theft Act.”

The Act would require the Director of National Intelligence (“DNI”) to provide relevant congressional committees with an annual report on “foreign economic and industrial espionage in cyberspace.”  The report would require the DNI to identify “foreign countries that engage in economic or industrial espionage in cyberspace with respect to trade secrets or proprietary information owned by United States persons” and “priority foreign countries”—those countries that the DNI “determines engage in the most egregious economic or industrial espionage in cyberspace.”  The bill specifies that the DNI must identify foreign countries pursuant to the Act  if the foreign government “engages in economic or industrial espionage in cyberspace with respect to trade secrets or proprietary information owned by United States persons” or “facilitates, supports, fails to prosecute, or otherwise permits such espionage by” its citizens or residents or entities organized under its laws or subject to its jurisdiction.

Continue Reading

In a vote Wednesday afternoon, the House Permanent Select Committee on Intelligence passed the Cyber Intelligence Sharing and Protection Act (“CISPA”).  Eighteen Representatives voted in favor of the bill, and two--Rep. Adam Schiff (D-CA) and Rep. Jan Schakowsky (D-IL)--voted against.

The Committee adopted amendments that Chairman Mike Rogers (R-MI) and Ranking Member Dutch Ruppersberger (D-MD) outlined on Monday in response to privacy and other concerns voiced about the bill.  In particular, amendments were adopted to eliminate a provision enabling the government to use shared information for broad “national security purposes,” to require the government to remove personally identifiable information from information shared pursuant to the bill, and to clarify that the bill does not allow companies to “hack back” entities that engage in cyber theft.

The panel did not adopt amendments offered by Representatives Schiff and Schakowsky.  Those amendments would have required private sector entities to remove personally identifiable information before sharing data with the government, limited liability protection available to companies that share information, and required information to be shared first with a civilian agency, rather than the National Security Agency.

By David N. Fagan and Kristen E. Eichensehr 

In a call with reporters Monday, Representatives Mike Rogers (R-MI) and Dutch Ruppersberger (D-MD), respectively the Chairman and Ranking Member of the House Permanent Select Committee on Intelligence (“HPSCI”), announced several planned amendments to the Cyber Intelligence Sharing and Protection Act (“CISPA”).  The bill is expected to come to a vote in HPSCI on Wednesday.

CISPA passed the House last April, despite opposition by privacy groups and a veto threat by the White House. Congressmen Rogers and Ruppersberger intend to use amendments to alleviate concerns that derailed the bill last year.  Specifically, reports (here and here) indicate that amendments will:

• Eliminate a provision that would have allowed government agencies to use shared cybersecurity information for “national security purposes”;
• Allow private companies to use cybersecurity information they receive from the government only for cybersecurity purposes;
• Require the government to remove personally identifiable information from information shared pursuant to the Act; and
• Clarify that CISPA does not authorize hacking in retaliation for cyber theft, as some had alleged.

The list of amendments does not include one Rep. Adam Schiff (D-CA) intends to offer that would require companies to remove personally identifiable information from data before sharing it with the government.

On Tuesday, the U.S. cybersecurity firm Mandiant released a 60-page report detailing the activities of a hacking collective it claims has direct ties to China’s military. The firm has linked the collective to cyberattacks on more than 140 organizations across 20 industries worldwide since 2006.

Mandiant claims the activity—carried out by a group called the “comment crew”—can be traced to four networks near Shanghai, with some of the activity occurring in a nondescript building on Datong Road—the headquarters of Unit 61398, a secret wing of the People’s Liberation Army.

The report notes that the hackers have a “well-defined attack methodology,” that has enabled them to steal large volumes of intellectual property, including technology blueprints, proprietary manufacturing processes and business plans.

In the wake of the report, two recent victims of cyberattacks—The New York Times and The Wall Street Journal—have published editorials that are outwardly critical of China. Both publications pressed President Obama to confront China more aggressively and publicly on its cyber espionage.

By Jacqueline Clover and Ezra Steinhardt

In December 2012, the European Network and Information Security Agency (ENISA) published a set of (non-binding) Guidelines titled, “Appropriate security measures for smart grids; Guidelines to assess the sophistication of security measures implementation”.  The Guidelines are intended to help EU Member States and smart grid stakeholders improve the resilience of smart grid cyber security systems against cyber threats and attacks, and follow on from a pair of European Commission initiatives that have called for improved security of European electricity networks:  the Commission’s Standardization Mandate to support European Smart Grid Deployment, released in March 2011, and the Commission’s Recommendation on the roll-out of smart metering systems, released in March 2012.  The latter document encourages EU Member State electricity network providers to consult the ENISA Guidelines when implementing smart grid security measures.

The Guidelines stress the importance of data privacy for smart grid stakeholders, and note that many such stakeholders “still have little experience in these areas”.  The Guidelines do not set out to address data privacy concerns per se, but the information security measures proposed by the Guidelines will also be of use to controllers, who must take adequate organizational and technical measures to protect personal data under European data protection law. 

The Guidelines aim to harmonise and establish minimum cyber security standards and best practices for European smart grids.  The Guidelines identify ten smart grid security issue areas and make security recommendations for each area.  To take into account different smart grid characteristics, such as the size of the grid or the types of services provided, and correspondingly different risk profiles, the Guidelines accommodate varying degrees of security measure implementation (“sophistication levels”).  Some security measures (or security issues) discussed by the Guidelines include:

• Protection of sensitive information processing facilities;
• Encryption methods for sensitive data during storage and transmission;
• Controlling access to critical asset information, and the use of secure remote access methods;
• Precautions against malware and viruses;
• Timely technical upgrades to smart grid information systems;
• Segregation of information services and information systems into groups and networks;
• Protection of security audit information;
• Security policies and monitoring of grid information systems;
• Staff cyber security training programs, personnel risk assessments, and staff security responsibilities and oversight;
• Third party agreements (e.g., with external suppliers and contractors) and monitoring of third parties to preserve confidentiality;
• Communication with relevant authorities and cyber security interest groups (i.e., to stay ahead of the latest vulnerabilities and threats);
• Maintaining updated inventories of all smart grid components and systems;
• Management of authentication credentials, user names, etc.; and 
• Policies for secure disposal of smart grid components and systems.

The smart grid provider should conduct a risk assessment when determining how to implement and maintain the above measures. 

In the wake of the Senate’s failure to pass comprehensive cybersecurity legislation in August and amid continued discussion about the possibility of a cybersecurity executive order, Senator Jay Rockefeller has sought information directly from Fortune 500 companies. 

Senator Rockefeller has urged President Obama to issue a cybersecurity executive order, but in a letter sent to Fortune 500 CEOs on September 19, Senator Rockefeller explained his belief that legislation will be still be necessary.  His letter noted that he would like to hear “directly from the chief executives of leading American companies about their views on cybersecurity.”

Specifically, Senator Rockefeller requested answers to eight questions by October 19.   The questions include whether each company has adopted cybersecurity best practices; how such practices were developed, including whether the company received outside input; how frequently the company’s cybersecurity practices are updated; and whether the federal government played a role in developing the practices.  To address particular features of the proposed Cybersecurity Act of 2012 (S. 3414), of which Senator Rockefeller is a co-sponsor, the Senator asked each CEO to explain any concerns his or her company has with a voluntary program for the federal government and private sector to develop cybersecurity best practices, with the federal government conducting cyber risk assessments, and with the federal government determining, in consultation with the private sector, what counts as critical cyber infrastructure.

A complete list of recipients of Senator Rockefeller’s letter is available on the website of the Senate Committee on Commerce, Science, & Transportation, which Senator Rockefeller chairs. 

Yesterday, the Senate voted to move forward with a floor debate of the Cybersecurity Act of 2012 (“CSA2012”) (S. 3414), and the White House formally endorsed CSA2012, saying it will strengthen efforts to secure American networks against cyberattacks.  As a result of yesterday's procedural vote, the Senate is likely to consider the current version of the legislation next week, ahead of the August recess.  As Inside Privacy previously reported, last week, CSA2012’s primary authors introduced a revised version of their bill that incorporates elements drawn from efforts by Senators Sheldon Whitehouse (D-RI) and Jon Kyl (R-AZ) to reconcile CSA2012 with the Republican-sponsored SECURE IT Act (S. 3342).  Our prior post provides a comprehensive overview of the approach taken by the revised CSA2012, which looks to voluntary private sector compliance with cybersecurity standards. 

The Senate is expected to consider a number of amendments during the floor debate next week.  Among them, Republican sponsors of the Secure IT Act have indicated that they plan to offer their bill as a substitute amendment to CSA2012.

A bank that required a commercial customer to answer “challenge questions” for virtually all online payments and that did not implement other common security measures failed to provide a commercially reasonable level of security, the U.S. Court of Appeals for the First Circuit ruled this week.

The case arose when unknown hackers were able to make large electronic transfers over the course of seven days from Patco Construction’s accounts at Ocean Bank, a southern Maine community bank owned by People’s United Bank.  Patco lost more than $345,000. Patco sued People’s United, alleging that Ocean Bank’s security procedures were not “commercially reasonable,” and therefore the bank was liable for Patco’s loss under the Uniform Commercial Code.

Continue Reading

By Nigel Howard, Jessica Milner and Mark Johnson

Interesting questions are arising in relation to how to implement an “opt out” for smart meters.  In many states, customer unease about the privacy and safety concerns associated with smart meters has resulted in new legislation or regulations that give customers the ability to decline the installation of a smart meter.  However, smart meters enable energy efficiency and cost savings, so should customers that opt out have to pay more?

This question arose last month in the Maine Supreme Court in the case of Friedman v. Maine Public Utilities Commission and Central Maine Power Company. The court heard an appeal from the Maine Public Utilities Commission’s dismissal of a complaint raising concerns over smart meter technology, including privacy and security issues.

Continue Reading

On Thursday, the House voted on and passed two cybersecurity bills.

The Cyber Intelligence Sharing and Protection Act (CISPA) (H.R. 3523), sponsored by Rep. Mike Rogers (R-MI) and more than a hundred other Congressmen, passed by a vote of 248-168. As previously discussed on this blog, CISPA would facilitate information sharing between private entities and the intelligence community via the Department of Homeland Security’s National Cybersecurity and Communications Integration Center and would provide liability protection for entities that share cyber threat information. 

Despite a formal statement by the White House threatening a Presidential veto of CISPA in its then-current form, the bill garnered bipartisan support, with 42 Democrats and 206 Republicans voting in favor. Before the final vote, the House adopted several amendments. One of the amendments limits the federal government to using shared cyber threat information for five enumerated purposes: cybersecurity, investigation and prosecution of cybersecurity crimes, protection of individuals from death or serious bodily harm, protection of minors from sexual exploitation or physical threat, and protection of national security.

The House also passed by a voice vote the Federal Information Security Amendments Act of 2012 (H.R. 4257), sponsored by Rep. Darrell Issa (R-CA). The bill would reform the Federal Information Security Management Act of 2002 to provide for automated and continuous monitoring of the security of government information systems. FISMA reform is also included in the two cybersecurity bills pending in the Senate, the Cybersecurity Act of 2012 (S. 2105), introduced by Sen. Joseph Lieberman (I-CT), and the SECURE IT Act (S. 2151), introduced by Sen. John McCain (R-AZ).