Cyber crime, online scams and other digital threats get so much attention, we often forget about other risks to our privacy, especially those in the physical realm. That's why I was so excited to see this sign posted on our recent trip to Grand Teton National Park. It reminds (or informs for the first time) park-goers of the risks presented by drones commonly flown in the area.
The sign addresses the trifecta of risk: safety, security and privacy. Out-of-control drones can injure people; threat actors use drones for all kinds of nefarious deeds; and on-board video cameras can capture private moments.
Naturally, I love the awareness the sign attempts to raise; it's very nice to see such efforts within our national parks. It's a sign of the times... a stark reminder that privacy and security risks are everywhere.
We have more on drone privacy, and other places with inherent security and privacy risks below. Keep on reading!
|
|
|
|
| I hope you enjoy the pics from my recent trip to Boise, Idaho, for the NIST Privacy Workshop No. 3. This was taken in the Craters of the Moon Lava National Monument in an area known as The Devil's Orchard. |
|
Data Security & Privacy Beacons
|
People and places making a difference**
Have you seen an organization or individual taking actions to improve privacy? Send me a note to nominate a privacy beacon of your own!
A Tips reader sent me a note (Thank you!) to recommend
TRUSTe/TrustArc
in Europe
as a privacy beacon. A
ccording to
her
,
TRUSTe/TrustArc
has done an outstanding job with its cookie notices.
In her opinion, the company
does a great job spelling out for site visitors which cookies are strictly necessary, as opposed to which are for traffic analytics, for personalization of content or for targeting of ads. In addition, they provide a button to say "NO" to any cookie that isn't necessary for technical reasons.
The city of Ontario has established a data strategy that prioritizes "thoughtful and robust protections for the privacy and personal data of all Ontarians." This comes after a survey of citizens revealed 83% of respondents believe data about people and businesses in Ontario need stronger protection. Time will tell how successful they will be. However, if this starts a trend among governments promoting privacy for their citizens, it could be a great bellwether of such moves, despite their individual success.
The FTC has increased enforcement against false claims of participation in Privacy Shield and other privacy frameworks. This is good. I've seen many organizations that simply post that they are participating in Privacy Shield as a marketing ploy without actually taking any steps to follow the framework. That type of deception should be uncovered and sanctioned.
Kudos to the group of privacy experts and legislators that have demanded an investigation of Amazon's child data protection practices. There are concerns that Amazon's Echo Dot Kids Edition violates COPPA, the Children's Online Privacy Protection Act. Advocates for children's privacy and others believe the violations mainly center on failing to provide parental notice and obtain parental consent for online services.
**P
rivacy beacon shout-outs do not necessarily indicate an organization or person is addressing every privacy protection perfectly throughout their organization (no one is). It simply highlights a noteworthy example that is, in most cases, worth emulating.
|
|
|
|
| I love how flowers thrive within the rocks at Moon Lava National Monument. |
|
You Can Make Privacy History
|
|
Global privacy standards are being written right now. Speak up!
NIST, the U.S. National Institute of Standards and Technology, is asking for your help -- yes, you. Regardless of your industry, profession, level of experience or expertise, NIST wants your feedback on the privacy framework it is currently developing.
The framework will eventually serve as voluntary tool for organizations to better identify, assess, manage and communicate about privacy risks. The idea is create
a tool, with a wide range of guidance, for all sizes and types of organizations to use within their privacy programs to create services and products that will allow individuals to enjoy the benefits of innovative technologies with greater confidence and trust.
The NIST Privacy Framework: An Enterprise Risk Management Tool is nearing V1.0 release, but NIST still wants your input!
Feedback from public and private sector stakeholders has played a key role at each milestone throughout the development of the framework, and NIST continues to seek your input as they reach for the framework finish line.
Here are some upcoming events. They are free to attend and will share more than what is currently on the NIST site:
- "Roundtable Discussion on the NIST Privacy Framework." Thursday, August 15, 2019, 2:00 PM - 3:30 PM PT | San Francisco, CA. The Providence Group and Reed Smith LLP invite you to join the National Institute of Standards and Technology (NIST) for a roundtable discussion on the Privacy Framework.
- "NIST Privacy Framework: V1.0 is Coming!" Wednesday, September 25, 2019, Tampa, Florida, 4:00 PM - 5:00 PM ET. Attend this session for a closer look at the latest framework draft from NIST, and to share your feedback and insights to help inform the development of Privacy Framework Version 1.0.
I am happy to be part of the NIST Privacy Framework development team and was thrilled to be both a facilitator and panelist at the most recent public workshop on the framework at Boise State University. You can see
the final recap video from the panel in which I participated on my Facebook page. You can see all the videos and other materials from that event on the NIST website.
|
|
|
|
| Visitors descending from the peak of a huge lave ember mound. |
|
|
Popular App's Terms of Services Makes Waves
|
Language in FaceApp's terms raise privacy and security concerns.
There is still heated debate about whether
FaceApp is a tool of the Russian government. In addition, many in the data privacy and security community are concerned about language in the app's Terms of Service. As
reported by CNN:
In one densely-worded section, the company informs users that they "grant FaceApp a perpetual, irrevocable, nonexclusive, royalty-free, worldwide, fully-paid, transferable sub-licensable license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, publicly perform and display your User Content and any name, username or likeness provided in connection with your User Content in all media formats and channels now known or later developed, without compensation to you."
Translation: FaceApp can effectively do what it wants with your selfie.
Truth be told, that language is far from unusual.
And I've noticed a troubling trend in how app makers, and actually a large portion of other types of organizations, are writing their privacy notices. They
are often buried in their Terms of Service.
ISACA invited me to write an article
about this, which I will point to in the September Tips. And who knows... there may be even more new developments in the growing controversy of how apps are using images, recordings and videos to share in September, as well.
M
ost users of "fun" apps like FaceApp, and generally other technologies, rarely read through the Terms of Service. Imagine how dramatically the number of privacy breaches could drop if more people asked app developers and technology providers to do a better job of protecting their privacy!
What's the big deal?
- Your photos may be sent to, stored and possibly used in other countries, like Russia. There are very real concerns about nation-state cybersecurity throughout the world. A huge repository of photos, even from a single app, may be very useful for malicious purposes. Consider the great number of people use use images of their face to unlock devices and access websites.
- Hackers may be able to use facial data to break into financial accounts.
- The open-ended language in FaceApp's Terms of Service could allow the app provider to use the photos and data any way they want.
|
|
|
|
| One of the many hot springs in Yellowstone National Park, Wyoming. |
|
Diverted benefits check are just one of the many consequences.
Have you ever wondered what cyber criminals and identity thieves do with stolen Social Security numbers? This Washington Post columnist's story demonstrates just one of the many malicious acts committed by crooks in possession of this valuable personal data.
Below is just some of the tale told by 73-year-old journalist Robert J. Samuelson. His story begins with a snail-mail letter from the Social Security Administration that read:
"On June 28, 2019, you successfully created an online account with the Social Security Administration."
... seemed innocuous, except for one troubling detail: I didn't create an online account with the Social Security Administration.
...I decided to call the 800 number in the letter. The woman who answered was courteous and helpful. Yes, my personal data had been altered so that my monthly benefit would be diverted to someone else's bank account, not mine. She reinstated the correct address and put a "block" on the account, meaning that unless I visited an SSA office, my personal information could not be changed.
...Just how my personal data was altered remains a mystery to me...We do know some things, however.
...The number of reported data breaches - hostile penetrations of computer networks - has soared from 421 in 2011 to 1,579 in 2017, according to the Identity Theft Resource Center. Each breach in turn may contain data on millions of people. The breach in 2017 of Equifax, a major credit bureau, is widely regarded as a bonanza for cyberthieves because it contained personal data on more than 147 million people.
...So, be forewarned. This is the Internet's new normal.
Be Suspicious
In this day and age, it's critically important to verify the legitimacy of any email, call, text or snail mail requesting your personal data. In the circumstance above, the journalist dutifully compared the letter he'd received to others he'd received in the past. He also verified the legitimacy of the phone number contained in the letter by checking the SSA's website before calling. Kudos to Mr. Samuelson!
|
|
|
|
| The water in the Sawtooth Mountain streams in Idaho was so clear and such a beautiful blue-green. |
|
Are You Entitled To a Piece of the Equifax Breach Settlement?
|
Millions of Americans offered credit monitoring or $125 cash.
| | | |
