Responding to Cyber-Attacks in the Utility and Energy Sectors

By Linn Foster Freedman on Posted in Cybersecurity

To assist utilities with assessing and responding to cyber risks, the Federal Energy Regulatory Commission (FERC) and the North American Electric Reliability Corporation (NERC) recently issued a report on best practices to respond to and recover from cybersecurity incidents in the utility industry.

Like other industries, the utility industry is at high risk for cyber-attacks by bad actors or nation states. Following the cyber-attack against a pipeline earlier this year, [view related post], FERC and NERC issued the guidance based upon the National Institute of Standards and Technology (NIST) cybersecurity incident response lifecycle of preparation, detection and analysis, containment, eradication and recovery, and post-incident activity.

According to the report, an incident response plan should provide personnel responsible for incident response with well-defined roles, so they can respond quickly and effectively and include personnel with appropriate skills and support to respond, mitigate, contain and learn from a cyber incident. The guidance is helpful in outlining the elements of an Incident Response Plan and providing suggestions on how to develop and implement one, which is crucial for utilities to continue operating in the event of an attack.

In addition to attacks by bad actors and nation states, the utility and energy industries are also at risk for attacks through vendors. Therefore, in addition to developing and implementing an incident response plan, a vendor management plan can assist utilities and oil and gas companies to assess and manage the risk of a cyber-attack through vendors.

The Department of Energy’s Office of Energy Efficiency and Renewable Energy (EERE) recently announced a multi-year plan to accelerate cybersecurity research and development in the renewable energy, manufacturing, buildings and transportation sectors. According to EERE, “Cyber threats targeting EERE technologies present an immediate risk to the integrity and availability of energy infrastructure and other systems critical to the nation’s economy, security and well-being.”

These efforts are designed to assess and prevent cyber incidents against critical infrastructure and to respond and mitigate the effects of a cyber incident in these industries, which would have a serious and potentially devastating effect on the U.S. population.

Massachusetts Ballot Question 1 Still on the Forefront as Automakers Sue to Block its Implementation

By Kathryn Rattigan on Posted in Data Privacy

A group of automakers through the Alliance for Automotive Innovation is suing Massachusetts in federal court to block the new ‘Right to Repair’ law that passed on November 3rd. This law was known as “Question 1” to Massachusetts residents hitting the polls earlier this month.  As we discussed in our prior blog post, the new state law expands access to certain diagnostic and repair data collected by onboard computer systems that is currently only accessible in ‘real-time’ by the manufacturers (and in turn, their dealers). The lawsuit argues that it will impose a financial burden on auto manufacturers and threatens the privacy of car owners by exposing data from their vehicles. We discussed many of these privacy and security concerns in our post back in October when consumers were still contemplating whether they wanted their small autobody shops to have more access to their data or to prevent more sharing of their vehicle’s data.

The lawsuit asks the court to declare the new Right to Repair expansion to be legally unenforceable. It claims that this new law violates numerous federal laws related to cybersecurity and intellectual property. The lawsuit also poses the arguments that auto manufacturers made during the ballot campaign: that independent autobody shops already have access to the data they need to fix consumers’ vehicles under the existing Right to Repair law.

Moreover, manufacturers say the requirement that they install a standardized  “platform” on all cars equipped with telematic technology sold in Massachusetts by model year 2022 forces them to implement the requirement immediately because the first production of 2022 models are already getting ready to hit the market.

Finally, the lawsuit relies heavily on the testimonial letter that the National Highway Traffic Safety Administration (NHTSA) sent to a committee of the state legislature back in July that stated that Question 1 posed new cyber risks by compromising the integrity of a vehicles functions such as steering, acceleration and braking. However, the NHTSA also stated in its letter that manufacturers should continue to control those vehicle functions, which, on its face, the new Right to Repair Law also seems to support (i.e., the new system in 2022 models will communicate “mechanical data,” and the proposed definition of “mechanical data” states that it includes information that is “related to the diagnosis, repair or maintenance of the vehicle.” This would NOT include telematics data collected related to an immobilizer system or security-related electronic modules. That exception is not being stricken by these proposed revisions). 

We will follow this lawsuit to see how it shapes access to vehicle data not only in Massachusetts but across the country as a whole as more and more cars are equipped with real-time telematics data collection and transmission.

Home Depot Settles Data Breach Multi-state Enforcement Action for $17.5 Million

By Linn Foster Freedman on Posted in Enforcement + Litigation

Home Depot has agreed to settle a multi-state enforcement action by 46 U.S. states and Washington, D.C. arising from the data breach that occurred in 2014. Home Depot has agreed to pay $17.5 million to put the enforcement action behind it. The investigation was led by the Attorneys General of Connecticut, Illinois and Texas.

The multi-state investigation followed Home Depot’s data breach that affected 40 million customers who used self-checkout terminals in its U.S. and Canadian stores between April 10, 2014, and September 13, 2014. According to the investigation, hackers used a vendor’s username and password to infiltrate Home Depot’s network and deployed malware to access the customers’ payment card information. In addition to the credit card information, at least 52 million people’s email addresses were exposed.

In announcing the settlement, Connecticut Atty. Gen. William Tong stated that companies collecting sensitive personal information “have an obligation to protect information from unlawful use or disclosure… Home Depot failed to take those precautions.” In addition to the monetary settlement, Home Depot has agreed to hire a Chief Information Security Officer, upgrade its security procedures and provide employee training. Home Depot denies liability in the matter.

Is Your Business Collecting COVID-19-Related Employee Data? If So, You May Need to Update Your CCPA Employee Notice

By Deborah George on Posted in Data Privacy, Websites

The California Consumer Privacy Act (CCPA) requires businesses covered by the CCPA to notify their employees of the categories of personal information the business collects about employees and the purposes for which the categories of personal information are used. The categories of personal information are broadly defined in the CCPA and include personal information such as medical information, geolocation data, biometric information, and sensory data.

As a result of the COVID-19 pandemic, many businesses are conducting screenings of employees for COVID symptoms. In many states, it is either required or recommended that businesses conduct such screenings of employees prior to entering the workplace. These employee screenings vary across the country but many include documenting an employee’s temperature, whether they have any COVID-related symptoms or exposure to individuals with COVID-19, or documenting travel out of state or out of the country. States vary too, in the method of collection of this information, with employees completing a written questionnaire via email, text, or mobile application. COVID-19 screening and temperature data is recorded and kept daily to demonstrate compliance with state and local public health requirements.

So, what does this mean for CCPA compliance? None of us could have predicted a year ago that employers would be collecting temperature data, lists of symptoms, and travel information from our employees. If you drafted your CCPA employee notice prior to the start of the pandemic, you may want to review the categories of personal information you now collect in light of these COVID-19 data collection requirements and recommendations. For example, depending upon the type of temperature check, this data could be considered biometric information or sensory data. Your employee notice may also need to disclose how such categories of personal information are used by the business, such as to comply with state and local public health requirements.

While the CCPA requires notice to employees of the categories of data collected, in light of the pandemic, businesses may wish to review their employee notice to determine if it needs to be updated to accurately reflect any additional categories of personal information collected and how the business is using that personal information.

Privacy Tip #261 – Online Shopping Tips for the Holidays

By Linn Foster Freedman on Posted in Privacy Tips

I have done more online shopping this year than ever before, and I know that I am not alone. With the holidays approaching, this will only increase because of the pandemic, and hackers and fraudsters know it. 

A recent report by GBG entitled “GBG State of Digital Identity: 2020,” states that 47 percent of individuals have open up a new online shopping account, 31 percent have opened a new social media account and 35 percent a new online bank account in 2020. In addition, one third of consumers 75 years or older have opened a new online account in 2020.

Additional depressing statistics from that report states that one in five individuals have been affected by identity fraud this year and were informed that their personal information has been exposed following the data breach. Therefore, one third of consumers have become more aware of and consumed about fraud and believe their personal information is exposed on the dark web.

GBG estimates that during the upcoming holidays, each online retailer will have to combat an average of 20,000 fraud attempts. 

With these statistics in mind, a recap of tips to think about to protect yourself while online shopping during this holiday season may be helpful: 

  • Be wary of emails with unbelievable sales that ask you to click on embedded links or attachments
  • When shopping online, visit the retailer’s actual website instead of a link that has been provided to you through an email
  • Use a credit card and not your debit card for all ongoing shopping
  • Use a dedicated credit card for all online shopping so if there is a compromise of that credit card it is limited to that one credit card
  • When asked if you want the online shopping site to save your credit card number, click “no thanks”
  • Be wary of gift card promotions or requests
  • Watch your credit card account statements closely
  • Check your credit report frequently

During this holiday season, support your local retailers, shop safely and have a happy, safe and healthy Thanksgiving.

HHS Issues Update to Ransomware Threat Alert to Health Care Sector

By Linn Foster Freedman on Posted in Cybersecurity

The Department of Health and Human Services’ (HHS) Division of Critical Infrastructure Protection (CIP) issued a health care and public health sector notification this week entitled “Ransomware Activity Targeting the Healthcare and Public Health Sector (Update 2),” which was co-authored by the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) to provide a situation update on the threat of ransomware to the health care sector. [see previous blog post].

According to the Alert, “some recent healthcare sector victims have experienced very short periods of time between initial compromise and activation – even under a few hours. CISA, FBI and HHS urge health delivery organizations and other HPH sector entities to work towards enduring and operationally sustainable protections against ransomware threats both now and in the future.”

The risk mitigation measures the notice suggests were provided in the joint aler from October 28, 2020, which included “the use of Trickbot, BazarLoader, and other techniques to eventually deploy a ransomware (like Ryuk) for extortion and financial gain.”

The update alerts health care providers that “the threat from ransomware is ongoing and entities should develop effective deterrent procedures while maintaining effective care delivery.”

California’s Consumer Privacy Rights Act (CPRA): Key Effective Dates and the Creation of the California Privacy Protection Agency

By Deborah George on Posted in Data Privacy

With the passage of the ballot initiative known as the Consumer Privacy Rights Act (CPRA or Act) in California, we are presenting several blog articles on different topics related to this new law. Last week, we wrote about the newly-added definition of sensitive information. This week we will focus on some key effective dates in the CPRA along with what it will mean to have a separate privacy rights enforcement agency.

CPRA Effective January 1, 2023

The good news is that the CPRA’s effective date is January 1, 2023, so businesses have some time to assess and get ready for the new law while the California Consumer Privacy Act (CCPA) is still in effect and enforceable. The CPRA functions like an overlay to CCPA. Once the CPRA takes effect in 2023, it will become the privacy law of the land in California.

There is one exception to the 2023 effective date and that is with respect to the right of access. The CPRA’s right to know or right of access applies to personal information collected by a business on or after January 1, 2022. The exemptions for employee information and business-to-business information remain in place until January 1, 2023. The CPRA also provides additional rulemaking authority, which may also take place prior to the effective date.

Creation of the California Privacy Protection Agency

Section 24 of the CPRA creates the California Privacy Protection Agency (CPPA or Agency), established in the state government of California. The Agency is vested with full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act. Section 1798.199.10(a) states that: “[t]he Agency shall be governed by a five-member board, including the Chair. The Chair and one member of the board shall be appointed by the Governor. The Attorney General, Senate Rules Committee, and Speaker of the Assembly shall each appoint one member. These appointments should be made from among Californians with expertise in the areas of privacy, technology, and consumer rights.” Subsection (b) states that the initial appointments to the Agency shall be made within 90 days of the effective date of the Act.

The board will have the authority to appoint an executive director and the Agency will have broad powers to protect “the fundamental privacy rights of natural persons with respect to the use of their personal information.” Section 1798.199.40 (c). The CPRA allows individuals, businesses, customers, advocacy groups and vendors to file complaints with the Agency regarding the privacy practices of a business. The Agency will have the power to investigate complaints, to hold hearings to determine if a violation has occurred, and to issue orders to: cease and desist, and to pay an administrative fine up to $2,500 for each violation or up to $7,500 for each intentional violation as well as each violation involving the personal information of minor consumers. The Agency also has the power to bring a civil action in the superior court for the purpose of collecting unpaid administrative agency fines.

The Agency also is charged with providing guidance to both consumers and businesses regarding their rights and responsibilities under the CPRA. One final note is that Section 1798.199.100 states that the Agency “shall consider the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of any administrative fine or civil penalty for a violation of this title.”

New Canadian Privacy Legislation on the Horizon

By Kathryn Rattigan on Posted in Data Privacy, International Privacy Laws

This week, the Canadian government proposed new legislation in Bill C-11, or the Digital Charter Implementation (the ACT), which includes some hefty fines for companies for violations – up to 5 percent of their revenue or C$25 million, whichever is higher. The Act would increase protections for Canadians’ personal information by giving citizens more control and greater transparency from companies handling their information. The Act addresses consent, data portability, consumer control over their “online identity” and disposal of personal information, as well as de-identification rules. A Fact Sheet about this proposed law outlines the effect on Canadian citizens and their privacy rights.

This Act would update the existing federal Canadian privacy law (i.e., the Personal Information Protection and Electronic Documents Act, or PIPEDA) by requiring a privacy management program that is submitted to the Office of the Privacy Commissioner upon request.

This revamp from the Canadian government possibly stems from the challenge to international data flows in the recent Schrems II decision in the European Union and as the U.S. considers its own federal privacy legislation once again.

Part of the Bill also includes the introduction of the Personal Information and Privacy Protection Tribunal Act (PIPPTA), which seeks to establish a faster path for enforcement of orders of the Office of the Privacy Commission and expand the office’s role and implement strong enforcement.

We will watch this closely as it progresses.

Threat Statistics Are Scary

By Linn Foster Freedman on Posted in New + Now

The threat-related statistics of malware and ransomware are mind-boggling. We have regularly reported on the dramatic increase of ransomware, but the statistics on successful exploitation and botnet activities are just as bad.

According to Nuspire’s Q3 Threat Landscape Report (www.nuspire.com), based upon its experience over the last three months, there was an increase of 128.21 percent in malware events since Q2.  Even more shocking is that the summary of findings shows that there were 3,646,448 malware events, 30,480,289 exploitation events, and 1,519,869 botnet events.

Just to put that in perspective, there were 1,168 unique malware variants detected, 43,410 malware variants were detected per day, and 303,870 malware variants were detected per week. According to the Report, “The largest contribution to increased activity was Visual Basic for Applications based documents….VBA Agents are a generic type of trojan that utilize Microsoft Office applications such as Microsoft Word and Microsoft Excel. These are often deployed in malspam campaigns and include common lures such as legal documents, invoices or may be themed after prominent media events.”

VBA Agents are used to introduce Emotet, which Nuspire found to have increased between Q2 and Q3. Therefore, “[O]rganizations should be extremely cautious when interacting with email attachments, especially ones from unknown senders and those that contain macros. User awareness training is critical to prevent interaction with these files…”

The statistics are scary and are getting worse. Malware protection and prevention all come down to the same thing: user awareness. One user can click on one malicious phishing email and all safety protocols can be compromised. Users have to understand the increased risk they pose to the company and companies have to provide their users with tools so they don’t become a victim. Let’s make December “User Education and Awareness Month” and get that user education on the books before the end of the year.

REMINDER: Renew your Drone Registrations

By Kathryn Rattigan on Posted in Drones

The Federal Aviation Administration (FAA) issued a reminder this week for all those whose drone registrations expire next month. If an individual or business registered a drone directly with the FAA through its DroneZone, you should log into your account to renew your registration. If you registered using a third-party service, you should contact that company to request DroneZone login credentials or create a new account and obtain a new registration.

The DroneZone (and its registration processes) was established in January 2018 and granted three-year registrations for $5. Remember that the FAA requires all drones to be registered, except those that weigh .55 pounds or less and are flown exclusively under the Exception for Recreational Flyers.

Check out the DroneZone here.

LexBlog