It should come as no surprise that educational institutions are among the top targets for hackers and purveyors of personally identifiable information. In 2017, only the financial and healthcare sectors had more data breaches. Yet despite the looming menace of increased cyber-attacks, federal regulation of student data remains woefully inadequate. The Family Educational Rights & Privacy Act (“FERPA”) was enacted back in 1974, when the Internet was still a gleam in ARPANET’s eye and Jeff Bezos was only ten years old, and it has not been amended since 2001. It certainly protects (or tries to protect) student data from unwarranted disclosure or use, but it and the regulations that implement it do not meaningfully protect student data from theft or destruction. More importantly, FERPA fails to address, except in a few narrow situations, what kinds of obligations third-party contractors have vis-à-vis the student data that they collect and use. However, because FERPA has no preemption provisions, its mandates are a floor, not a ceiling; this means that states can step in and enact more stringent rules and regulations.
Continue Reading Third-Party Contractors Get Schooled in Data Privacy – New York Style

Over the past five to ten years, the advancement of technology has produced a flurry of corporate cyber-attacks. Data breaches make the news virtually every day.

Too often, however, companies seek compensation for their data breach losses by making claims on commercial general liability (CGL) or property policies – policies that simply were not written to cover these types of perils.

Instead, companies should be looking to cyber insurance, which offers more reliable coverage for the kinds of losses associated with a data breach. Cyber insurance offers varying coverage options for corporate clients and can be tailored to the type of information that needs to be protected and the data risks that are the most significant to the company.

If you want to learn more on data breach litigation issues, court rulings on coverage for cyber-attacks and cyber coverage options, join the educational webinar: Data Breach Litigation: Recent Trends and Developments. The webinar takes place on Wednesday, June 20, 2018 at 12:00 p.m.-1:00 p.m. (ET) and will be led by Husch Blackwell Senior Counsel, Eric Levy. The webinar will be hosted on The Knowledge Group and the first 30 registrants will receive complimentary passes.

Register here.


Blockchain technology is seeing increasingly wide use internationally, but security issues are becoming a major problem.

Blockchain is a public electronic ledger that can be openly shared among users and that creates an unchangeable record of their transactions. Each transaction, or “block”, is time-stamped and linked to the previous one. Each block is then linked to a specific participant. Blockchain can only be updated by consensus between users in the system, and when new data is entered, it can never be erased, edited, adjusted, or changed.

Continue Reading What the Cryptocurrency Hacks Mean for the Security of Blockchain

For over twenty years, my father was a wholesale seafood supplier. One day over dinner (probably lobster, because that’s just how we rolled), my father tells us that he has hired an off-duty US Department of Agriculture inspector to inspect the fish that his company will be sending out to its grocery store clients. When I asked him if this was a legal requirement, he said it was not (the Department of Health and Human Services, via the FDA, apparently regulates fish, not the USDA). When I then asked him why he was doing it, he said, “If you were in the grocery store and you saw one piece of fish labelled ‘USDA Government Inspected’ and one piece of fish without that label, which one would you buy?” An informal “seal” program had been born!

Continue Reading Your (Privacy) Fate is Sealed…

Eight months after a significant data breach involving customer data was reported to Panera Bread company by a security researcher and within a day of an article being published laying out the nature and extent of the breach, the company on April 2, 2018 acknowledged the data leak.  However, it insisted that fewer than 10,000 consumers had been affected in contrast to the more than 7 million customers several security researchers estimate were affected.

The story is not so much the vulnerability in Panera’s online food ordering system that exposed the customer’s information, nor the fact that Panera may not have been aware of the breach before the researcher contacted it, but rather about Panera’s delay disclosing the breach and its refusal to acknowledge the magnitude of the customer information leaked. Panera is likely to become the poster child for what not to do in addressing a data breach.  For example, Panera does not have a dedicated method to accept vulnerability reports from security researchers, it ignored numerous communications from the security researcher that attempted to alert the company to the breach and became defensive about his report, including accusing the security researcher of being a scammer of some sort.  Perhaps the greatest surprise is it waited eight months to acknowledge the leak and to set about fixing it.  In the meantime more customers were likely affected by the disclosures of personal information. In addition, the reputational harm to Panera because it failed to respond quickly and forcefully, could be significant.

A national standard that includes a set notice period for businesses to disclose data breaches to  customers would have avoided the situation Panera finds itself in.  The delay could create substantial risk that customers take legal action against the company.  For nearly the last ten years many U.S. data security and breach notification laws have been introduced in the Congress but none have passed.  Currently at least one Senate and one  House bill have been introduced.  H.R. 5388, the Data Accountability and Trust Act and S. 2179 the Data Security and Breach Notification Act have been introduced.  Both bills contain provisions that generally require consumers to be notified of any breach within 30 days after its discovery.

Panera is not alone in having delayed in reporting breaches.  Equifax and Target are among the many in that category.  In fact, in 2017 Uber actually paid two hackers to keep quiet about a cyberattack that exposed the data of 57 million Uber riders and drivers.  State and federal lawmakers and security experts all agree that the lack of transparency by businesses, governmental entities and other organizations is a problem that needs to be addressed.  While many state legislatures have passed data breach notification periods, the Congress has been unable to pass legislation to address this and other issues resulting from the many significant data breaches that occur almost daily.  While it is not clear that consumers have changed their online activity because of these breaches, that day may come.

On March 17, the New York Times covered a new item on the growing list of high-profile data breaches with its article detailing how a British political consulting firm, Cambridge Analytica, obtained personal information from millions of Facebook users by way of a low-profile researcher. The revelation sent shock waves through the online community, and the public outcry was swift and resounding. As more details emerge, Facebook and Cambridge Analytica will continue to face political and legal repercussions from all angles—with one possible legal instrument being the Computer Fraud and Abuse Act (CFAA).

Continue Reading Unauthorized Access: Cambridge Analytica’s Use of Harvested Facebook Profiles

Semper Fidelis is the U.S. Marines’ motto – “always faithful.” Perhaps an ironic twist of phrase in the context of its recent and preventable data breach. Let’s recap. The Marine Forces Reserve recently announced that personal information of over 21,000 Marines, sailors, and civilians were “compromised.” The PI included social security numbers, bank account and routing numbers, card information, name, address and other contact information. In other words, PI which is a treasure trove for identity thieves. Some of the PI may have been redacted in part. How did this breach occur? The culprit was an e-mail incorrectly sent with an unencrypted attachment. The email was sent out by the Defense Travel System which manages travel itineraries and expense reimbursement. Obviously sensitive location information is also in play. Probably not a big thing for a travelling salesperson, but highly problematic for defense sector travel.

Continue Reading <I>Semper Fi</I>: Learning From The Marines’ Data Breach