More Signal. Less Noise.

V2 | Issue 75 | 4.17.20

The CyberWire Pro Privacy Briefing for 4.17.20

Summary

By the CyberWire staff

At a glance.

Protecting customer data a motive for encryption.
Updates on contact-tracing apps.
Unauthorized parties might be able to retrieve deleted recordings of Zoom sessions.
The pandemic hasn't made HIPAA obsolete.

Protecting customer data is the primary driver of businesses adopting encryption.

nCipher Security surveyed businesses and found that their respondents indicated that protecting consumers' personal information was the primary reason they'd adopted encryption. The Cambridge Independent reports that the study found that 54% described safeguarding PII as their top priority. The former top priority, compliance, dropped to fourth place with 47%, trailing not only protection of personal data, but also security of intellectual property (52%) and protection against "specific, identified threats" (51%). A 54% majority also said that they regarded employee mistakes as the biggest threat to sensitive data.

Contact tracing for COVID-19 infections.

Apple and Google are proceeding with their work on technology for contact-tracing. ESET has a quick overview of how Apple's Mobility Trends Reports are working out. Their systems are designed in the first instance for US domestic use, and may have difficulty attracting enough opt-ins to be effective. A report from the Sinclair Broadcasting Group quotes experts who doubt that Americans are likely to sign on in sufficient numbers to attain the 75% threshold generally thought to be the point at which such contact-tracing tools become valuable. The perception that people generally have become skeptical about Big Tech's privacy record seems to contribute to the pessimistic conclusion.

Another Zoom privacy issue surfaces.

A new problem has surfaced for Zoom. CNET writes that a researcher has found a vulnerability that could allow Zoom videos to persist in the cloud even after the users had deleted them. They may continue to exist inside an AWS S3 bucket, and should someone access that bucket, the recording could be compromised.

HIPAA hasn't gone away for the duration of the pandemic.

An op-ed in Law360 cautions against assuming that the privacy protections in HIPAA, the Health Insurance Portability and Accountability Act of 1996, somehow go away during a public health emergency. They don't. Prudent organizations will lawyer up before they get too frisky with healthcare data, no matter how public-spirited their mood and motives may be.

The Department of Health and Human Services clarified the circumstances in which protected data might be shared without explicit patient consent. It may be shared for purposes of the patient's treatment, and it may be shared for four specific public health "activities":

"A covered entity may disclose to the CDC protected health information on an ongoing basis as needed to report all prior and prospective cases of patients exposed to or suspected or confirmed to have novel coronavirus;
"At the direction of a public health authority, to a foreign government agency;
"To persons at risk of contracting or spreading a disease or condition if other law, such as state law, authorizes the covered entity to notify such persons as necessary to prevent or control the spread of the disease or otherwise to carry out public health interventions or investigations; and
"Disclosures to prevent a serious and imminent threat."

These aren't public disclosures. HIPAA continues to require a patient’s consent before making a public disclosure about their condition.

Selected Reading

Hospitals On COVID-19 Frontline Facing ‘Double Extortion’ Cyber Threat (Forbes) A new report published by Check Point Research today cautions hospitals regarding the rise of what it refers to as a double extortion cyber threat.

Malvertising Campaign Targeting Internet Explorer Users (Avast) A malvertising campaign used Fallout Exploit Kit to distribute Kpot v2.0 to people using outdated versions of Internet Explorer

Fake COVID-19 medication websites on the rise, stealing money and information (WCNC) Scammers are claiming they have medication to protect against or treat coronavirus.

Pandemic Doesn't Alter HIPAA Privacy, Public Welfare Balance (Law360) Eroding the disclosure protections afforded to patients under the Health Insurance Portability and Accountability Act during the coronavirus pandemic would undermine the benefits to society because the aggregate data the public needs is already available, say Habib Ilahi at Stinson and attorney Rachel Rose.

Fever surveillance ‘to become as common as CCTV’ (The Telegraph) Being turned away from events for running a fever might become the 'new normal'

Apple releases mobility data to help combat COVID‑19 (WeLiveSecurity) Apple has released Mobility Trends Reports, which shows how movement trends around the world were impacted by the COVID-19 pandemic since January 13th.

Some experts doubtful enough Americans will get on board with new contact tracing system (WDKY) Going from competitors to collaborators, Apple and Google are launching a Bluetooth contact tracing system for coronavirus cases that some are concerned won't be effective.

Residential Internet Connections are now Business Connections: What about Security and Compliance? (Akamai) Near-global mandates to stay at home have completely reshaped the internet security landscape. Remote work is the new normal, inverting the traditional office model. Attackers are not relenting as they see opportunity to take advantage of a world with a...

Zoom Hires Security Heavyweights to Fix Flaws (Wall Street Journal) Zoom Video Communications is calling in the equivalent of the cybersecurity cavalry after security lapses that have drawn attention from U.S. authorities and raised concerns with customers.

Zoom Rolls Out New Measures as Security Fears Mount (SecurityWeek) Zoom is rolling out a number of measures meant to stem criticism over how it has handled security as users flock to the video communications system during the coronavirus pandemic.

()

Your Zoom videos could live on in the cloud even after you delete them (CNET) Yet another Zoom issue found.

'Not a Safe Platform': India Bans Zoom for Government Use (SecurityWeek) India has banned the use of video-conferencing app Zoom for government remote meetings, the government said, in the latest warning about the platform's security.

()

Google's fast-growing Meet video tool getting Zoom-like layout, Gmail link (Reuters) Google will allow business and education users on Gmail.com to directly take calls on its video conferencing tool Meet starting Thursday, a new feature being offered as the Alphabet Inc unit seeks to capitalize on security and other concerns with rival services.

Verizon Buys Zoom Conferencing Rival BlueJeans (Wall Street Journal) The carrier will pay less than $500 million for the Zoom Video Communications rival, part of an effort to bolster Verizon’s business group as it rolls out faster 5G networks and pitches new applications of wireless technology to its largest corporate customers.

Microsoft stock is up because businesses want secure video conferencing, says Robert Herjavec (CNBC) "The use of Teams at the corporate enterprise level is really taking off," the "Shark Tank" investor said on CNBC's "Squawk Alley."

Double Extortion: Ransomware's New Normal Combining Encryption with Data Theft (SecurityWeek) 'Double extortion' is the term given to an evolving ransomware tactic: first steal confidential data, then encrypt the victim's files.

Bad news: So much of your personal data has been hacked that lesson manuals on how to use it are the latest hot property (Register) Cyber-crims bone up on methods for fun and profit, but mainly profit

Protecting consumer’s personal data becomes top reason for encryption, global study involving nCipher Security finds (Cambridge Independent) Employee mistakes are now considered the biggest risk to keeping sensitive data safe by IT professional.

KnowBe4 Launches PhishRIP to Remove Suspicious Emails From Inboxes (PR Newswire) KnowBe4, the provider of the world's largest security awareness training and simulated phishing platform, today announced it has launched a new...

New tool detects AWS intrusions where hackers abuse self-replicating tokens (ZDNet) New SkyWrapper tool generates Excel spreadsheets so AWS account owners can easily spot compromised tokens.

ZeroFOX's AI-powered platform now includes security for Zoom and Slack (Help Net Security) ZeroFOX has extended its AI powered platform to now include advanced cyberattack protection capabilities for business collaboration platforms.

47 States Have Weak or Nonexistent Consumer Data Privacy Laws (Security.org) Last Updated April 16, 2020 By Gabe Turner and the Security.org Team “It’s like the wild wild west,” Emily Mancini, communications director for New York State Sen. Kevin Thomas (D), says, “for businesses and consumers alike.” A bold comparison, perhaps, but one that’s not altogether incorrect. No, we don’t travel by horseback anymore, but as … Continued

Inter-Continental Agrees To $1.55M Data Breach Settlement (Law360) Inter-Continental Hotels Corp. has agreed to pay $1.55 million to settle a proposed class action in Georgia federal court brought by consumers who claimed the company failed to protect credit and debit card data from hackers.

Words With Friends Gaming Co. Hid Data Breach, Suit Says (Law360) Zynga Inc., the gaming company behind popular social media games Words With Friends and FarmVille, was accused in a proposed class action on Wednesday of failing to tell users about a massive data breach last fall.

Feds Say Film Orgs Can't Sue Over Social Media Visa Policy (Law360) The U.S. Department of State has urged a D.C. federal court to toss film organizations' lawsuit challenging the government's policy of collecting immigrants' social media info on visa applications, saying that the groups can't sue over a policy that doesn't affect them.

3rd Circ. Won't Revive Penn State Worker's Email Privacy Suit (Law360) The Third Circuit on Thursday refused to revive a Pennsylvania State University employee's suit alleging that state investigators illegally accessed her emails as part of now-dropped criminal charges, reasoning in a precedential decision that her constitutional rights weren't violated because the college voluntarily turned over the communications.

Stone Jurors Plea For Protection, Citing Attacks And Threats (Law360) The jurors who convicted Roger Stone last year are urging a D.C. federal judge to reject a right-wing blogger's bid to release jurors' questionnaires, saying the disclosure would only exacerbate the continued attacks and harassment they've been subject to from President Donald Trump and other conservative critics.