Connecticut’s Data Privacy Breach Notification Law Gets a Facelift

As of October 1, 2021, Connecticut’s Data Privacy Breach Notification Act’s (“Act”) Amendments (“Amendments”) are in effect.  P.A. No. 21-59.  The Amendments:

Expand the definition of “personal information;”
Create extraterritorial jurisdiction;
Remove the safe harbor provision while conducting an investigation;
Lower the notification period from ninety to sixty days;
Further detail notification methods and procedures; and
Create safe harbors for those in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPPA) and the Health Information Technology for Economic and Clinical Health Act (HITECH).

The new definition of personal information will require businesses to examine the types of data it stores and how it is stored.  The expanded definition of personal information now includes taxpayer identification numbers, IRS issued identity protection personal identification numbers, passport numbers, military identification numbers or any other commonly issued government identification numbers – in conjunction with the first name or initial and last name of the individual.

Businesses storing COVID-19 vaccination records will also need consider the new definition because it expands coverage to medical information.  The expanded definition now includes medical information regarding an individual’s medical history, conditions (mental or physical), treatment, diagnosis; identifiers used by Health Insurance companies and biometric data – in conjunction with the first name or initial and last name of the individual.

The Amendments also define a breach of security as including the disclosure of a username and password combination including an e-mail address or security question and answer that would provide online access to an account.  The Amendments require, in the event of a breach of login credentials, that (1) a notice informing the person whose information was breached to promptly change their credentials on other websites using the same credentials and (2) not to rely on an email account that was part of the breach to make such notice.

The Amendments remove the limitations that required that: (1) persons subject to the Act must conduct business in Connecticut and (2) that the information subject to the Act be maintained in the ordinary course of business.  Theoretically, any business that stores personal information of a Connecticut resident is now subject to the Act.

The Amendments remove the safe harbor provision allowing for an investigation after discovery of the breach before notification.  Companies now have only sixty-days from the discovery of the breach of security to notify Connecticut residents.   The Act also now includes an ongoing notification duty to Connecticut residents as well.

The notification of affected persons may be avoided if after an “appropriate investigation” the person covered by the Act determines that no harm will befall the individual whose personal information was either acquired or accessed.  However, the sixty-day notification period still applies and any “appropriate investigation” would need to be completed before the duty to notify is triggered.  Furthermore, the Act no longer requires that the information be both acquired and accessed.  Simple acquisition is enough as well as is a brief intrusion into unencrypted protected personal information stored on a secured network.

Finally, the Amendments create a safe harbor for persons in compliance with HITECH and HIPPA privacy and security standards so long as notice to the attorney general is provided.  Materials and information provided to the attorney general are exempt from public disclosure except when provided by the attorney general to third parties for the purpose of furthering an investigation.

The Amended Data Privacy Breach Notification Act is much more onerous to comply with and best practices include having a breach notification plan that can be used at a moment’s notice, creating an inventory of personal information stored by the entity and, encrypting all personal data.  Encrypting personal information remains the best way to comply with Act but the risk of non-compliance can be high since non-compliance is considered a Connecticut Unfair Trade Practices violation which can result in compensatory and punitive damages as well as attorney’s fees.

Federal Jury Rules Four Cryptocurrency products are not Securities

A recent decision in the United States District Court for the District of Connecticut appears to be the first of its kind in the nation. In the case Audet et al v. Garza et al, a federal jury recently weighed in on whether cryptocurrency products were considered securities.[1] The jury held that four digital-asset products linked to cryptocurrency were not securities.[2]

In the case, a class of customers brought an action against GAW Miners LLC (“GAW Miners”) and ZenMiner LLC (“ZenMiner”) for running a cryptocurrency Ponzi scheme.[3] When GAW Miners and ZenMiner were faced with demands from customers for the physical cryptocurrency mining equipment which they could not meet, GAW Miners and ZenMiner turned to Hashlets, Hashpoints, Paycoin and HashStakers (collectively the “Digital Assets”). [4]  These Digital Assets provided customers with a portion of the computing power without owning the physical hardware.[5] Moreover, the Digital Assets served as virtual wallets for the promissory notes and virtual currency of GAW Miners and ZenMiner.[6] The plaintiffs argued that these Digital Assets were investment contracts and therefore were unregulated securities.[7]

The plaintiffs asked Judge Michael Shea to rule as a matter of law that the Digital Assets were securities under the Howey test. [8] The Supreme Court in Howey stated an investment contract exists when “a person invests his money in a common enterprise and is led to expect profits solely from the efforts of the promoter or a third party.” [9] However, in an unusual decision, Judge Shea declined to rule as a matter of law that the Digital Assets were securities.[10] Instead, the judge left the issue of how to classify the Digital Assets for the jury.[11] Despite the SEC previously referring to one of the Digital Assets, Hashlets, as a security in a case against one of the former defendants in this case,[12] the jury ruled that the Digital Assets were not investment contracts, and therefore, they were not securities.[13]

The issue of how to define cryptocurrencies is an ongoing debate, and the federal jury’s ruling in this case does not settle it.

[1] Elise Hansen, Crypto Mining-Linked Products Weren’t Securities, Jury Finds, Law360 (Nov. 2, 2021), https://www.law360.com/articles/1436790/crypto-mining-linked-products-weren-t-securities-jury-finds.

[2] Id.

[3] HHR Wins Groundbreaking Jury Verdict in Crypto Fraud Trial, HHR (Nov. 3, 2021), https://www.hugheshubbard.com/news/hhr-wins-groundbreaking-jury-verdict-in-crypto-fraud-trial.

[4] Id.

[5] Hansen, supra note 1.

[6] Id.

[7] Id.

[8] Alison Frankel, In apparent first, Conn. class action jury finds crypto products are not securities, Reuters (Nov. 3, 2021), https://www.reuters.com/legal/transactional/apparent-first-conn-class-action-jury-finds-crypto-products-are-not-securities-2021-11-03/.

[9] SEC v. W. J. Howey Co., 328 U.S. 293, 298­–99 (1946).

[10] Id.

[11] Id.

[12] HRR, supra note 3.

[13] Hansen, supra note 1.

Cryptocurrencies: Security, Currency, or None of the Above?

As interest in cryptocurrencies (“crypto”) continues to rise, businesses and investors are left wondering what regulations they must follow. While crypto may contain the word “currency” in its name, it is unclear whether it truly is a currency. There has been a lot of debate over which category it belongs to for regulatory purposes.1 Is it a currency or a security? The SEC has yet to provide guidance on this rapidly developing market.

Simply put, a currency is a store of value, unit of account, and medium of exchange, while a security is a tradable financial asset that has monetary value.2 The Securities Act of 1933 (“the ‘33 Act”) provides a list of what qualifies as a security, and crypto is not included. However, the list contains investment contracts, which is the category the SEC has openly debated whether cryptocurrencies belong.3 The Supreme Court in Howey stated an investment contract exists when “a person invests his money in a common enterprise and is led to expect profits solely from the efforts of the promoter or a third party.”4

The determination of which category crypto belongs in is essential for investors as it implicates which governing body has the authority to regulate the market. If crypto is categorized as a currency, the SEC lacks jurisdiction. If it is considered a security, it falls squarely in the SEC’s jurisdiction and becomes subject to the agency’s strict reporting and trading regulations.

The SEC is not the only government agency that has failed to provide clear guidance on what category crypto belongs in. The IRS still refers businesses to its 2014 Notice where it opined on the topic.5 The 2014 Notice stated it is “aware that ‘virtual currency’” exists and referred to “Bitcoin” as a convertible virtual currency because it has an equivalent value in real currency. However, in the same notice, it stated that virtual currency could be held as a capital asset like stocks and bonds.

Something that tends to complicate the classification of crypto even more is the fact that it seems a specific cryptocurrency’s classification may change over time. This happened in the case of the token ether, the primary token for Ethereum.8 The then SEC Chairman decided it no longer met the Howey test and declared it not a security. Then SEC Chairman Clayton also stated that Bitcoin was not a security due to its decentralized nature.10

Even though the SEC has stated Bitcoin and ether are not securities, the question remains on what the status is of the numerous other cryptos. A recent action brought by the SEC against Ripple Labs, Inc. (“Ripple”) in the U.S. District Court for the Southern District of New York could significantly impact how crypto is regulated and categorized. The SEC argues that XRP, Ripple’s cryptocurrency, is an investment contract under the Howey test, and therefore by not registering it, Ripple sold XRP as an unregistered security.11 While the parties have entered into settlement discussions, it is still a case to watch for potential regulatory impacts on cryptos.

While it is still unclear whether cryptos are securities or currency for regulatory purposes, one thing is clear: the market is only continuing to grow, and the SEC and other government agencies are taking notice of the unregulated area. Common sense, sound legal advice, and diligence will help any business or investor navigate this market despite the uncertainty surrounding crypto.

1. SEC Reckons With Crypto’s Currency And Security Conundrum, PYMNTS (Apr. 20, 2021).
2. Public Statement, Bill Hinman, Dir. Of Div. of Corp. Fin., SEC; Valerie Szczepanik, Senior Advisor for Digital Assets & Innovation, SEC, Statement on “Framework for ‘Investment Contract’ Analysis of Digital Assets” (Apr. 13, 2019).
3. Public Statement, Chair Gary Gensler, SEC, Remarks Before the Aspen Security Forum (Aug. 3, 2021).
4. SEC v. W. J. Howey Co., 328 U.S. 293, 298­–99 (1946).
5. I.R.S. Notice 2014-21, 2014-16 I.R.B. 938 (Apr. 14, 2014).
6. Id.
7. Id.
8. David Borsack & Cole Schotz, Cryptocurrencies And The Security And Exchange Commission, JDSUPPRA (Aug. 4, 2021).
9. Aaron Hankin, SEC’s Jay Clayton says Ether isn’t a security, reiterating the regulator’s stance, MarketWatch (Mar. 12, 2019).
10. Is Crypto A Commodity or Security?, SoFi (Apr. 27, 2021).
11. Press Release, SEC, SEC Charges Ripple and Two Executives with Conducting $1.3 Billion Unregistered Securities Offering (Dec. 22, 2020).

Working Remote Without Privacy Violations

COVID-19 revolutionized the need for remote work by employees.  And the trend toward working remote likely will continue after the outbreak is a distant memory. However, the privacy and cybersecurity implications surrounding these remote workers are often either unknown and/or ignored.  So now what?  With more of your employees working off-site, how do you protect your company against privacy violations of state, federal and international law?

The first step is to review your privacy policy.  Is it too lax?  Is it too strict?  Either extreme creates its own issues such as inefficiency for remote workers or potential data breaches.  The policy must contain clear penalties for violations.  Violations must be tracked and the penalties enforced for the privacy policy to fulfill its purpose.

The second step is to make sure that every employee, vendor and client, is aware of the privacy policy and where appropriate, commits to the privacy policy with either a physical or digital signature.  These acknowledgements must be stored and organized by privacy policy version. As the privacy policy is amended from time to time, it is important to determine whether an additional acknowledgement is required from your employees, vendors and clients.

The third step is to train employees on how to abide by the privacy policy.  A policy is useless if no one understands it or is unsure how to apply it to their employment duties. With remote workers, this becomes even more critical as data that may permissibly be left on a desk or sent in an email on a secure network, may not be appropriate in a remote working environment.  Remote workers need to use Virtual Private Networks (VPN) to access company systems.  Companies should verify that each remote worker is using a VPN while working remotely.

The final step requires taking a second look at your data, the processing of the data and specific business sector regulations such as the Graham-Leahy Bliley Act in the financial sector.  During this review it is important to identify new risks posed by remote workers.  One way of achieving this review is to either assign or hire a Chief Information Officer (CIO) to coordinate and stay abreast of the latest trends and developments.

Another aspect of cybersecurity and privacy that must be evaluated and implemented wherever possible is Privacy Enhancing Technology (PET).  These various technologies (there are five) allow for a greater use of data while removing all identifiable information and resisting attempts to reconstruct personal information by combining an anonymous data set with a data set that “decodes” the first set, such as Census data or voter registration databases.  More information on PET can be found here.

P&D attorneys can assist with all these recommendations with a cost effective and pragmatic approach.  Our attorneys routinely handle the most challenging privacy and cybersecurity issues and are ready and eager to help your company during these uncertain times.

When It Rains, It Pours: The Psychology that Makes Us More Vulnerable During a Crisis

I received the following email alert from a cybersecurity client of mine:

“6x increase in cyber attacks over the last 4 weeks.”

“Information about COVID-19 should only come from a legitamate source. Don’t trust unsolocited emails or open unknown links”

“Really?,” I thought to myself; “We’re on lock-down, stressed about family and friends, not to mention business and jobs, and I’m getting cybersecurity alerts?” Frankly, I usually ignore them when I’m not distracted, but who has time for this now? 

However, the more I thought about it, the more I realized that’s exactly what cybercriminals are thinking too and why people need to stay alert and resist the temptation to click on those compelling links.

The truth is, despite the fancy hardware and software solutions available, most cybersecurity breaches occur due to human error or phishing attacks. Unless you have relatively sophisticated automated solutions, the people IN your organization may represent your greatest internal threat.

While companies see high risks from external threat actors, such as unsophisticated hackers (59%), cyber criminals (57%), and social engineers (44%), the greatest danger, cited by 9 out of 10 firms, lies with untrained general (non-IT) staff. In addition, more than half see data sharing with partners and vendors as their main IT vulnerability. Nonetheless, less than a fifth of firms have made significant progress in training staff and partners on cybersecurity awareness (ESI ThoughtLab/WSJ Pro Cybersecurity, 2018).

And this was before COVID hit us between the eyes. Let’s take a quick look at the psychology at play that makes us even more vulnerable during a crisis.
The Neuroscience of Crisis

As humans, we are prewired for crisis. 

Whether you think of this brain system as the “reptilian brain,” attributed to Paul MacLean and his Triune Theory (Sagan, 1977), or the fight-flight reaction of the sympathetic nervous system (System 1) which is our immediate, emotional reaction (Kahneman, 2011), it is clear that our brain protects us in times of danger. 

This system, which is buried deep in the interior of the human brain, is both evolutionarily older and more immediate than simple cognitive thought; it is pre-cognitive. When the danger is ambiguous, System 2 thinking (which, in contrast with System 1 is slower, more deliberative and more logical) is nice; go through your options, take your time, don’t rush. 

But when there is a perception of crisis, the need to ACT is immediate. 

The fight-flight response makes us want to DO something, and now! From an evolutionary point of view, in times of danger, those who acted first were often safer than those who took their time.

The COVID-19 pandemic is, of course, a crisis. 

Have people noticed how much more tired they are these days, even though we aren’t even leaving the house? It’s because crisis mode requires more energy. During a crisis, the thoughtful, reflective parts of our brain shut down. In other circumstances, we might hover over a suspicious link, while we process whether it seems risky or not. 

But that requires fully functional frontal lobes, or executive functioning, which need time and undivided attention to work properly. In crisis mode, frontal lobe functioning is significantly diminished, or may go offline altogether, in favor of a quick (albeit less considered) action or reaction. 

To make matters worse, cybercriminals know this: They know what emotional buttons to push to make you afraid (just click the link) or try to help (just click the link), or maybe even register your opinion (just click the link). 

But if you do click that unfamiliar or disguised link, you may have just let criminals into your personal computer and, by default, into your company’s IT system. 

Wait, consider, relax. Let System 2 kick in before you commit yourself, your computer, and your company to whatever those “black hat” cybercriminals have in mind.

Motivation During a Crisis

After the fear comes a desire to help. 

This is one of the ways that cybercriminals trick well-meaning people. Whether it’s a donation, or a message of support, or some other activity to help, we are again motivated in ways that leave us open to online criminal behavior. 

McClelland’s Social Motive Theory suggests there are three primary social motives: Achievement, Affiliation, and Power (McClelland, 1987). 

We all have the capacity for all three, and genetics and socialization as well as cognitive choice determine which motive wins the day in a given situation. In times of individual crisis, needs for achievement (e.g., successful social distancing) or needs for power (e.g., controlling the situation) may come to the fore. 

But in a social crisis, many of us are “hard-wired” to help, triggering a need for affiliation. 

That desire to help may cause people to act impulsively in what they believe is a pro-social, affiliative manner. Just click the link to make your donation, just click the link to show your support, and on and on, the cybercriminals never stop trying. Like the very best advertisers, they are clever about pushing your emotional (non-cognitive, pre-cognitive) buttons to get you to act in ways that benefit them.

I am assuming everyone reading this has the best of motives. Those very motives make you susceptible to the manipulation of cybercriminals. 

If your current impulse is to put this away, turn to something else, then you have experienced exactly what cybercriminals are counting on. 

Information fatigue, too much bad news, or just a desire to put some positive energy back out into the world, may all leave you vulnerable. 

Don’t click suspicious links, or even links that look well-meaning, without doing some simple checks and reviews first. 

  • Hover over a link and see if the URL is the same as whom the email purports to be from. 
  • Don’t provide any information, on any social media, whether at work or elsewhere, that can be used against you. 
  • Hackers are clever and unscrupulous so check and double-check links that looks suspicious in any way. 
  • Do a bit of research before you agree to anything and certainly before sending money or private information.
What’s Your Story?

Narrative is the final pillar in this little tripartite approach to cybercrime. I have come to believe that personality is a story we tell ourselves (and the world) about ourselves (Bruner, 1985). 

This story comprises our identity, it is who we think we are and often these beliefs about who we are dictate how we behave in the world and how we process information. 

For example, as a psychologist (not to mention a human being), I think of myself as a helpful person. I try to be kind and considerate. I don’t like to walk past beggars without giving them something (yes, yes, I know that would cause me to lose points on the WAIS IQ test but there you go, despite my cognition telling me this could be a trick, he or she will just buy cigarettes and beer, I often give in anyway). 

Cybercriminals will use these ideal images we have of ourselves to manipulate our thoughts, emotions, and purse-strings. 

  • I am good, so I give to the sick and needy. 
  • I love children, so I’ll give to those orphaned by COVID. 
  • I support healthy behaviors, so I’ll do most anything to protect my health. 
  • I’m a good parent, so I will click the link that shows me 10 ways to protect my family from infection. 

Your personal narrative is the core of your personal identity. We sometimes value it more than life itself (think of martyrs). 

If a clever cybercriminal hacks your social media, understands what makes you “tick,” that information can be used against you in a cybercrime.

The threats are real and so are the psychological levers cybercriminals pull to manipulate your fear. 

We are all overwhelmed, trying our best to hang in there, and help each other where we can. Don’t let your best intentions, and fatigue, allow you to be manipulated to behave unsafely online. COVID is real, and so is cybercrime. We must be alert to both.

Written by: Dr. Mark Sirkin, CEO at Sirkin Advisors

References

Bruner, J. (1986). Actual minds, possible worlds. Cambridge, MA: Harvard University Press.

ESI ThoughtLabs/WSJ Pro Cybersecurity (2018). The cybersecurity imperative: Managing cyber risks in a world of rapid digital change. New York: Author.

Kahneman, D. (2011). Thinking, fast and slow. New York: Farrar, Straus and Giroux.

McClelland, D. (1987). Human motivation. New York: University of Cambridge.

Sagan, C. (1977). The dragons of Eden. New York: Penguin Random House.

 

Connecticut’s New Insurance Data Security Law: The Costs and Benefits of Compliance

An important section of the recent budget bill adopted by the state of Connecticut demonstrates that regulatory fever has become contagious, at least as far as data security is concerned. Section 230 of the recently adopted bill sets forth a comprehensive set of cybersecurity regulations for the state’s insurers, requiring them to comport with guidelines modeled after those developed by New York State’s Department of Financial Services (DFS).1 Connecticut insurers will now have to develop a “comprehensive written information security program,” evaluate the efficacy of that program “not less than annually,” and periodically aver to the state’s Insurance Commissioner that the law’s provisions are being followed.2 In addition, the law requires that insurers establish strict cybersecurity regulations for third parties and develop “incident response plan[s]” to recover in the wake of a cyberattack.3

The data security law also establishes a comprehensive enforcement regime to investigate and punish noncompliance. Under the provisions of Section 230, the state’s Insurance Commissioner has a broad investigative power to verify compliance with the new regulations.4 Furthermore, the Commissioner retains the power to punish recalcitrant insurers by revoking business licenses and issuing fines of up to fifty thousand dollars (provided that the offending firms have not shown themselves to be exempt in an evidentiary hearing).5 The law does contain some exceptions, however. For a one-year period between 2020 and 2021, insurers with fewer than twenty employees will be exempt from the law’s requirements, and from 2021 on insurers with fewer than ten employees will be exempt.6 Moreover, those firms already compliant with the requirements set forth in the Health Insurance Portability and Accountability Act of 1996 (a federal statute)7 are exempted from the Connecticut law if they can certify their compliance to state regulators.8 Nevertheless, compliance figures to be costly for Connecticut insurers.

As discussed on this blog previously, however, the cost of a cyberattack can often far outstrip the cost of compliance with cybersecurity regulations. This goes double for insurance companies, especially because such firms often possess “high-value consumer information, such as sensitive personal information, health information and payment card information.”9 Thanks to the creation of cybersecurity insurance, insurers are often left holding the bill in the wake of a devastating cyberattack elsewhere. Because they have presumably processed numerous such claims, they should know better than anyone else the true cost of a data breach. The aid of knowledgeable legal professionals and a healthy dose of common sense are all that stand in the way of cost-saving compliance with Connecticut’s new cybersecurity regulations.

 

  1. https://www.natlawreview.com/article/connecticut-budget-includes-insurance-data-security-law
  2. https://www.cga.ct.gov/2019/act/pa/pdf/2019PA-00117-R00HB-07424-PA.pdf
  3. Ibid
  4. Ibid
  5. Ibid
  6. Ibid
  7. Better known as HIPAA
  8. https://www.cga.ct.gov/2019/act/pa/pdf/2019PA-00117-R00HB-07424-PA.pdf
  9. https://www.stradley.com/-/media/files/publications/2017/05/landon—cyber-attacks-targeting-insurers.pdf

Data-Centric Security Strategies and Regulatory Compliance

In the wake of a recent spate of cybersecurity breaches, the practice of data-centric security has received renewed attention from business leaders concerned about the integrity of critical data. As defined by a PKWare white paper, data-centric security focuses on protecting data itself, rather than the systems that contain it.1 Central to the concept of data-centric security is the notion that the systems established to store and guard data sometimes crumble in the face of cyberattacks.1 Given that all manner of data storage systems have shown themselves to be vulnerable, it is hard to argue with this foundational principle. Rather than offering prescriptions for the improvement of systems, then, data-centric security places safeguards around the data itself – safeguards which are automatically applied and regularly monitored to ensure data security.1

Data-centric security strategies have several key advantages over the “network-centric” models currently employed by many firms.2 As discussed, data-centric strategies account for the proclivity of security networks to succumb to cyberattacks by securing the data itself. In addition, because security measures are built into data, “security travels with the data while it’s at rest, in use, and in transit,” a characteristic of data-centric strategies that facilitates secure data sharing and allows firms to move data from system to system without having to account for inevitable variations in security infrastructure.3 Moreover, data-centric security allows for easy access to data (a cornerstone of productivity in any firm) without compromising data security. In fact, Format-Preserving Encryption (FPE) – the specific type of encryption employed by many data-centric strategies4 – “maintains data usability in its protected form,” striking a balance between security and accessibility.5 Clearly, data-centric strategies provide stronger, more all-encompassing, and eminently manageable modes of data protection.

But perhaps the most important aspect of data-centric security is its essential role in any security regime compliant with New York State cybersecurity regulations. In fact, as the data security company Vera has noted, “the new rules are focused not just on protecting information systems but on securing, auditing and the disposition of data itself.”6 New York’s determination to advance data-centric security is evident in certain provisions of the recent cybersecurity regulation, the most important of which mandate that companies “restrict access privileges not only to systems but to the data itself.”6 Moreover, New York State’s cybersecurity regulations reflect the priorities of data-centric security because they require firms to “implement an audit trail system to reconstruct transactions and log access privileges,” a system which allows the security of individual pieces of data to be monitored automatically.6 New York regulators have already recognized the benefits of data-centric security strategies. Now, with the assistance of legal experts well-versed in cybersecurity compliance, companies concerned about their data security can too.

____________________________________________________________________________________

  1. https://pkware.cachefly.net/webdocs/pkware_pdfs/us_pdfs/white_papers/WP_Data_Centric_Security_Blueprint.pdf
  2. https://www.symantec.com/blogs/expert-perspectives/data-centric-security-changing-landscape
  3. https://www.comforte.com/fileadmin/Collateral/comforte_FS_tokenization_vs_FPE_WEB.pdf?hsCtaTracking=8a3a11b3-5ba3-4e1a-a41f-78bb92d22458%7C358952c5-4dff-4793-bbeb-8835361c3b14
  4. https://www.1stmarkets.de/en/blog/blog-article-3
  5. https://www.techpowerusa.com/wp-content/uploads/2018/03/MicroFocus.Techpower-Big-Data-eBook-2018-9434.pdf
  6. https://www.vera.com/wp-content/uploads/2018/02/Veras-Guide-to-the-NY-DFS-Regulations.pdf

Cybersecurity Compliance Could Have Saved Capital One Millions

A recent cybersecurity breach involving one of the country’s largest financial services firms illustrates both the necessity of strong cybersecurity regulations and the imperative for credit card holders to jealousy safeguard their personal information. In a criminal complaint filed July 29th, 2019 at the U.S. District Court for the Western District of Washington, the federal government alleged that Paige A. Thompson, a computer engineer, had taken advantage of a gap in Capital One’s cloud security to obtain the personal financial records of millions of the company’s customers in the U.S. and abroad.1 Thompson, who used the online alias “erratic,” allegedly exploited a defect in Capital One’s firewall to access confidential financial information stored on the servers of the Cloud Computing Company, a Capital One service provider.1 Despite Capital One’s claim that “no credit card account numbers or log-in credentials were compromised and less than one percent of Social Security numbers were compromised,” the episode is a reminder that without robust cybersecurity measures and a broad-based commitment to personal data security, information stored with American financial institutions remains vulnerable to cyberattack.2 In fact, had Thompson been more careful to remain anonymous,3 the data breach could well have become catastrophic.

First, the data breach demonstrates the value of robust cybersecurity regulations. For example, if Capital One’s cybersecurity measures had met the stringent standards of the regulations issued by New York State’s Department of Financial Services that is now being enforced by the state’s new Cybersecurity Division, this problem may have been avoided. The DFS has committed itself to ensuring that “encryption and other robust security control measures” characterize the cybersecurity policies of the state’s financial services firms.5 Had Capital One encrypted or tokenized6 all of the data subject to the recent breach, it is possible that the effects of the cyberattack may have been less widespread. In fact, the criminal complaint against Thompson notes that “although some of the information” targeted by the cyberattack “has been tokenized or encrypted, other information[…]regarding their credit history has not been tokenized,” allowing “tens of millions” of credit card applications to be compromised.1 Of course, the cybersecurity regulations adopted by New York State are burdensome. But the alternative is even worse – especially considering that Capital One will “incur between $100 million and $150 million in costs related to the hack, including customer notifications, credit monitoring, tech costs and legal support,” a price tag that doubtless outstrips the costs of regulatory compliance.3

Pastore & Dailey is a leading firm in the drafting and implementation of procedures necessary to comply with federal and state securities and banking cybersecurity regulations and laws, which in this case could have saved Capital One millions if properly followed.

Second, the cyberattack bears out the importance of diligence in safeguarding financial information. According to Forbes, individuals worried about the security of their financial information can take a host of precautions: “[updating] passwords,” avoiding the use of e-mail accounts to share confidential information, “[establishing] two-factor authentication,” and so on.7 Cyberattacks like the one that recently struck Capital One have become a fact of life for many Americans who bank online, but they need not be costly. Common-sense precautions and security diligence can go a long way towards ensuring the integrity of your financial records.

New DFS Cybersecurity Division

Perhaps as a signal of its commitment to fight cybercrime and stringently enforce its cybersecurity regulations, New York State recently established a “cybersecurity division”1 within the state’s Department of Financial Services (DFS). The creation of the division marks yet another step taken by New York State to guard against the dangers posed by cyberattacks, perhaps motivated by its status as the home of many prominent financial services firms. In addition, the presence of the division strongly suggests that the cybersecurity regulation2 issued by DFS in Spring 2017 [WB1] cannot be taken lightly by the state’s largest and most important financial services firms. Aside from the comprehensive nature of the regulation and the sizable power afforded to the new cybersecurity division, the novelty of New York’s recent innovations in cybersecurity regulation suggests their importance and staying power. In fact, as JDSupra notes, the creation of the new division more or less completed a years long process that has made “New York[…]the only state in the country that has a banking and insurance regulator exclusively designated to protect consumers and companies from the ever-increasing risk of cyber threats.”1

Some financial services firms, conscious of their vulnerability to cyberattacks, will doubtless welcome these additional steps. As a report from the Identity Theft Resource Center notes, financial services firms “are reportedly hit by security incidents a staggering 300 times more frequently than businesses in other industries.”3 Far from being mere annoyances, these cyberattacks are often extremely costly. In fact, according to a study from IBM and the Ponemon Institute, the cost to a financial services firm per record lost in a cyberattack was more than $100 greater than the cost to the average company.4 Moreover, cyberattacks can also cripple consumer confidence in financial services firms, causing them to lose business and endure even greater costs.5 In general, then, cyberattacks can damage both a financial services firm’s sensitive records and its public image, making them a grave threat to any such company’s bottom line.

It would be a mistake, however, to think about DFS regulation purely in terms of cost reduction. Regulation also entails costs – not least because compliance with the 2017 regulation can be investigated and punished by DFS’ new cybersecurity division. In fact, these new developments indicate that cybersecurity will not come cheaply, especially because the regulation imposes a bevy of new security requirements on top firms, costing them a not insignificant amount of time and money. From multi-factor authentication to training programs to the appointment of a “Chief Information Security Officer,” the now fully enforceable regulation will force financial services firms to foot the bill for a host of cybersecurity measures.6

  1. https://www.jdsupra.com/legalnews/new-york-creates-cybersecurity-division-20881/
  2. https://www.dfs.ny.gov/docs/legal/regulations/adoptions/dfsrf500txt.pdf
  3. https://www.idtheftcenter.org/wp-content/uploads/2019/02/ITRC_Generali_The-Impact-of-Cybersecurity-Incidents-on-Financial-Institutions-2018.pdf, pg. 3
  4. IBM and the Ponemon Institute, The Cost of a Data Breach (2017), summarized in https://www.idtheftcenter.org/wp-content/uploads/2019/02/ITRC_Generali_The-Impact-of-Cybersecurity-Incidents-on-Financial-Institutions-2018.pdf, pg. 6
  5. https://www.idtheftcenter.org/wp-content/uploads/2019/02/ITRC_Generali_The-Impact-of-Cybersecurity-Incidents-on-Financial-Institutions-2018.pdf, pg. 8
  6. https://www.dfs.ny.gov/docs/legal/regulations/adoptions/dfsrf500txt.pdf, pg. 5

Technology Regulation in the Federal Securities Market

Pastore & Dailey LLC has an extensive RegTech practice, and Jack Hewitt, a P&D Partner, is one of the country’s authorities in this area.  In line with this, P&D is pleased to announce that Bloomberg BNA has just published Mr. Hewitt’s new treatise, Technology Regulation in the Federal Securities Markets.

The treatise is structured into three major segments – cybersecurity, the new market technologies and blockchain.  The cybersecurity segment provides a comprehensive review of all applicable federal and state regulations and guidelines while the market technology segment addresses, among others, the Cloud, robo-advisers and smart contracts.  The final segment, Blockchain, includes cryptocurrency, tokens and ICOs.  Mr. Hewitt, whose expertise extends to virtually all major business sectors, regularly reviews client cybersecurity and technology procedures and would be pleased to discuss performing one for your firm.

Please use the below link to view the Table of Contents and the chapters on Information Security Programs and ICOs of the new treatise.

https://s3.amazonaws.com/pdlaw-cdn.sitesdoneright.net/userfiles/WebSample.pdf