InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
State AGs Urge Card Companies to Advance Consumer Protection by Implementing Chip and PIN Technology
On November 16, nine state attorneys general sent a letter urging leading card brands to expedite the implementation of chip and PIN technology in the United States. The letter summarizes research connected to recent data breaches, stating “individuals whose credit or debit cards were breached in the past year were nearly three times more likely to be an identity fraud victim.” Addressing concern that PIN technology would be burdensome or confusing to consumers, the AGs maintain that many consumers are accustomed to financial transactions that rely on PIN technology, such as transactions involving debit cards, and point to a November 2014 poll that indicated cardholders were supportive of chip and PIN technology. The AGs emphasize that PIN technology is “nothing new” and is considered the “gold standard” for payment card security, noting that countries around the world have seen a dramatic decrease in fraud since implementing the technology. Finally, while the letter stresses that chip and PIN technology would better protect both consumers and businesses from data breaches, it does not suggest that the technology be legally mandated at the federal or state level: “[T]his letter calls upon you as good corporate citizens to voluntarily expedite the implementation of existing technology that offers the most substantial security benefits, and to continue to adapt and improve security as quickly as possible as technology advances.”
FFIEC Releases Revised Management Booklet with Emphasis on Sound IT Governance
On November 10, the FFIEC issued a revised Management booklet, which outlines the principles of overall sound governance and, more specifically, IT governance. The booklet is one of 11 that makes up the FFIEC’s Information Technology Examination Handbook, and explains how risk management, including IT risk management, is a component of governance. The handbook emphasizes that the board of directors sets the tone and the direction of an institution’s IT program. Specifically, the board’s responsibilities include (i) reviewing and approving an IT strategic plan that aligns with the overall business strategy and includes an information security strategy to protect the institution from ongoing and emerging threats, including those related to cybersecurity; (ii) overseeing an institution’s process for approving third-party vendors; (iii) approving policies to report significant security issues to the board, steering committee, government agencies, and law enforcement, as necessary; (iv) holding management accountable for identifying, measuring, and mitigating IT risks; and (v) providing independent, comprehensive, and effective audit coverage of IT controls. The revised handbook incorporates cybersecurity concepts as an integral part of maintaining effective IT policies and procedures, noting that, “[a]lthough an institution is not required to have a separate cybersecurity program, its information security program should identify, measure, mitigate, monitor, and report on the heightened risks associated with cybersecurity.”
DOJ Unseals Indictment Against Individuals for Alleged Involvement in Hacks Against Various U.S. Institutions
On November 10, the DOJ unsealed an indictment against three individuals, Gery Shalon, Joshua Samuel Aaron and Ziv Orenstein, for allegedly orchestrating and committing computer hacking crimes against U.S. financial institutions, brokerage firms, and financial news publishers. According to the DOJ, “these three defendants perpetrated one of the largest thefts of financial-related data in history – making off with the sensitive information of literally thousands” of Americans. The DOJ alleges that, from approximately 2012 to mid-2015, Shalon and Aaaron hacked financial institutions to steal the personal information of more than 100 million customers, and then manipulated the price of certain U.S. publicly traded stocks, seeking to “market the stocks, in a deceptive and misleading manner, to customers of the victim companies whose contact information they had stolen in the intrusion.” Additionally, Shalon engaged in illegal businesses with Orenstein between 2007 and July 2015, allegedly operating (i) unlawful internet gambling businesses; (ii) multinational payment processors for illegal pharmaceutical suppliers, counterfeit and malicious software distributors, and unlawful internet casinos; and (iii) Coin.mx, a Bitcoin exchange company that violated federal anti-money laundering laws. Through the defendants’ schemes, they profited hundreds of millions of dollars in illegal funds and, using aliases, laundered criminal proceeds through at least 75 international shell companies and bank and brokerage accounts. The defendants are charged with multiple counts of offenses, including conspiracy to commit computer hacking, conspiracy to commit securities fraud, aggravated identity theft, wire fraud and operation of an unlicensed money transmitting business.
The DOJ also announced the unsealing of a separate indictment against Anthony R. Murgio, who was arrested on complaint in July for operating Coin.mx in the United States.
New York DFS Submits Letter to Federal Regulators Regarding Potential Cybersecurity Regulations
On November 9, the New York DFS sent a letter to federal regulators and other interested parties, including the CFPB, Federal Reserve Board, and the OCC, regarding potential new regulations aimed at increasing cybersecurity efforts within the financial sector. The letter references recent DFS reports that covered key findings from surveys given to regulated banking organizations on their cybersecurity programs, costs, and future plans. The reports raised the following concerns: (i) the speed of technological change and the increasingly sophisticated nature of threats; (ii) third-party service providers tend to have access to sensitive information and companies’ IT systems, providing potential hackers with a point of entry; and (iii) the “scale and breadth of the most recent breaches and incidents.” In light of these concerns, the DFS asserts that it would be beneficial to coordinate with state and federal regulators to “develop a comprehensive [cybersecurity] framework that addresses the most critical issues, while still preserving the flexibility to address New York-specific concerns.” According to the letter, the DFS expects to propose regulations requiring entities to set specific requirements in areas such as: (i) cybersecurity policies and procedures; (ii) third-party service provider management; (iii) cybersecurity personnel and intelligence, including implementing mandatory cybersecurity training programs; and (iv) notice of cybersecurity breaches.
FCC Settles with Company Over Alleged Data Protection Failures
On November 5, the FCC resolved its first ever data security action against a cable company with a $595,000 settlement. According to the FCC, the company did not have adequate data security measures in place for employees and contractors with access to the company’s electronic data systems. In 2014, the company’s electronic data systems were breached by a third party who, by pretending to be from the company’s IT department, convinced a customer service representative and a contractor to enter their account information into a fake website. The third party hacker allegedly used the information to gain access to customers’ personally identifiable information, subsequently sharing the information with another hacker and posting the information on social media sites. The cable company did not use the FCC’s breach-reporting portal to report the breaches. In addition to the civil money penalty, the settlement requires the company to: (i) identify and notify all customers affected by the breach and provide them with one year of free credit report monitoring; (ii) designate a senior corporate manager who is a certified privacy professional; (iii) conduct privacy risk assessments; (iv) implement a written information security program; (v) maintain reasonable oversight of third party vendors and implement multi-factor authentication; (vi) implement a more robust data breach response plan; (vii) provide privacy and security training to third party vendors and employees; and (viii) regularly file compliance reports with the FCC.
FFIEC Issues Joint Statement Regarding Cyber Attacks Involving Extortion
On November 3, the FFIEC issued a statement notifying financial institutions of the increasing frequency and severity of cyber attacks involving extortion. The joint statement urges financial institutions to take steps to ensure effective risk management programs, including but not limited to the following: (i) conducting ongoing information security risk assessments; (ii) performing security monitoring, prevention, and risk mitigation; (iii) implementing and regularly testing controls around critical systems; and (iv) participating in industry information-sharing forums. The statement identifies resources financial institutions can refer to for assistance in mitigating cyber attacks involving extortion.
The OCC also published a bulletin alerting all OCC-supervised institutions of the FFIEC’s joint statement.
FTC Announces Agenda for Cross-Device Tracking Workshop
On November 3, the FTC announced the agenda for its Cross-Device Tracking workshop, which is scheduled to take place on November 16 in Washington, D.C. FTC Chairwoman Edith Ramirez will deliver opening remarks, with FTC Office of Technology, Research and Investigation Policy Director Justin Brookman introducing two panel discussions. The first panel will examine the technology used for cross-device tracking, including how it has evolved, privacy concerns, and how the technology benefits consumers and businesses alike. The second panel will focus on the policy implications of cross-device tracking, such as: (i) the type of data being collected about consumers; (ii) consumer awareness of this type of tracking; (iii) notice to consumers of cross-device tracking and consumers’ ability to give consent; and (iv) industry self-regulation efforts.
German Data Protection Authorities Issue Position Paper In Light of Schrems EU Court Decision
Recently, German data protection authorities issued a position paper to address potential consequences of the Court of Justice of the European Union’s (CJEU) Schrems ruling on the handling of personal data. The first section of the paper summarizes the ruling, noting that the court found the Safe Harbor decision overly restrictive of the “supervisory powers of the European data protection supervisory authorities and does not follow the requirements of the provisions that empower the Commission to decide on the level of protection of a third country.” The remaining four sections of the paper consider the following: (i) the European Commission’s options to either adopt a new decision which declares U.S. law provides an adequate level of protection, or to push for an international treaty to include a data protection agreement with the U.S.; (ii) the legal basis for the transfer of personal data; (iii) private bodies’ use of standard contractual clauses, concluding that private bodies must “consider terminating the underlying standard contract with the data importer in the U.S. or suspending data transfers”; and (iv) enforcement concerning private bodies, noting that authorities will examine “whether orders against private bodies must be issued and on which basis data transfers to the United States must be suspended or banned.”
FTC and International Partners Launch New Information-Sharing System
On October 25, the FTC and seven members of the Global Privacy Enforcement Network (GPEN) launched GPEN Alert, a new information-sharing system designed to enhance coordinated efforts to protect consumer privacy. The FTC and seven data protection authorities from Australia, Canada, Ireland, the Netherlands, New Zealand, Norway, and the United Kingdom signed an MOU to participate in GPEN Alert. GPEN Alert is based on the FTC’s Consumer Sentinel Network and will allow participating agencies to confidentially share information about privacy investigations and enforcement actions.
FTC Announces Agenda, Panelists for Lead Generation Workshop Addressing Consumer Protection Issues
On October 19, the FTC announced the agenda for its upcoming workshop entitled, “Follow the Lead: An FTC Workshop About Online Lead Generation.” As consumers search the internet for goods and services, they are often times asked to provide sensitive personal and financial information that a lead generator may then subsequently transfer to third-party marketing companies. The workshop will examine consumer protection issues raised as a result of the practices of the lead generation industry, and is scheduled to host the following panels in Washington, DC on October 30: (i) Introduction to Lead Generation Marketplace and Mechanics; (ii) Case Study on Lead Generation in Lending; (iii) Case Study on Lead Generation in Education; (iv) Overview of Consumer Protection Concerns and the Legal Landscape; and (v) Looking Ahead – Protecting and Educating Consumers.