WOW! It’s been a while

It has been way to long since I’ve posted anything here.  For the diligent, thank you for sticking with me.  I’m back on the train and will get back to regular posts.

My practice has been picking up, so I’ve been a bit busy.  For those that don’t know, my legal practice is centered around cybersecurity issues.  Primarily:

  • Mergers and Acquisitions diligence
  • Risk Assessment
  • Security and privacy policy creation and review
  • Breach planning and response
  • Cyber-insurance
  • PCI-DSS, HIPAA HITECH, GDPR analysis and review
  • Negotiating Technology Agreements
  • Terms of Use
  • End User License Agreements
  • Helping startups address security issues
  • IT Counseling
  • Calling out Security “snake oil” salespeople

It is a fun and interesting way to spend my days.  I get to play with all the areas of my firm’s practices, I get to meet cool and interesting people, and I get to solve problems.

There is a great essay from Eric S. Raymond called “How to Become a Hacker“.  It is one of my favorite pieces of writing on what hackers are and the ethos.  I need to reread it every year or so to remind me that there are people like me and how I need to focus my attention.  Everyone should read the essay. The 5 attitudes ESR calls out, that have become my mantras are:

1. The world is full of fascinating problems waiting to be solved.

2. No problem should ever have to be solved twice.

3. Boredom and drudgery are evil.

4. Freedom is good.

5. Attitude is no substitute for competence.

My practice really does let me find “fascinating problems waiting to be solved” and I feel really enthused every time I get to find that solution.

Anyway, more to come.

Website accessibility under Title III

When I was in law school our assignment for mock trial in Legal Research and Writing was a debate regarding whether websites were “places of public accommodation” under title III of the Americans with Disabilities Act.

This was a fairly novel idea at the time.  Title III requires that places of public accommodation, like grocery stores, must make their stores accessible to disabled shoppers.  As with any law school mock trial assignment we had to argue both sides with equal fervor.

Over the last several years this debate has continued in real courtrooms across the country.  This month another court stepped into the fray.  In Juan Carlos Gil v. Winn-Dixie Stores, Inc., the judge ruled the Winn-Dixie grocery store must make its website accessible to the disabled.  Gil, the plaintiff, is legally blind and the Winn-Dixie website was incompatible with screen readers that he used to browse the website.

The Judge in this case did not specifically address whether a website is a place of public accommodation, but stated:

The Court need not decide whether Winn-Dixie’s website is a public accommodation in and of itself, because the factual findings demonstrate that the website is heavily integrated with Winn-Dixie’s physical store locations and operates as a gateway to the physical store locations.

This integration with the physical Winn-Dixie stores is more than just an advertising platform but

The services offered on Winn-Dixie’s website, such as the online pharmacy management system, the ability to access digital coupons that link automatically to a customer’s rewards card, and the ability to find store locations, are undoubtedly services, privileges, advantages, and accommodations offered by Winn-Dixie’s physical store locations.

Thus, the judge found that Winn-Dixie had violated the ADA Title III and issued an injunction which requires, among other provisions, that Winn-Dixie’s

website must be accessible by individuals with disabilities who use computers, laptops, tablets,
and smart phones

If you would like to test how your webpage renders on a screen reader, there is a chrome extension called ChromeVox, that will let you browse the web using a screen reader.  Anyone who doesn’t understand the reason why this is important should install this extension and browse the web for a half and hour with your eyes closed.  The experience should be quite enlightening.

Bills of the 85th session

Now that the 85th Texas legislative session is over, here is a list of the cybersecurity and privacy bill that made it through.  For the complete list of the bills I tracked this session, click here.

House Bills

Bill Author Caption Stage Notes
HB8 Capriglione Relating to cybersecurity for state agency information resources. Effective 9/1/2017 A significant bill affecting multiple agencies. Requires all security incidents to be report to the Department of Information Resources (DIR) within 48 hours of detection. Also includes a provision for the Sunset Commission to include cybersecurity in their review of state agencies. Additionally directs DIR to conduct exercises and to address duplication of efforts within state agencies. Well worth reading the full bill.
HB9 Capriglione Relating to cybercrime ; creating criminal offenses. Effective 9/1/2017 Amends the Penal Code to include criminal offenses for malware and ransomware, among other cybercrimes.
HB1278 Dutton Relating to availability of Previous personal information of certain current and former prosecutors. Effective immediately Excepts the personal information of district attorneys, criminal district attorneys and municipal attorneys from public disclosure.
HB1861 Elkins Relating to the confidentiality of certain information related to a computer security incident. Effective immediately Adds a provision to §552 (public information act) that excepts information related to security incident information.
HB2087 VanDeaver Relating to restricting the use of covered information, including student personally identifiable information, by an operator of a website, online service, online application, or mobile application for a school purpose. Effective 9/1/2017 An interesting bill targeted at restricting the use of student’s profiles gathered by online services. As many of these services are nationwide, it would be interesting to see this bill in action

Senate Bills

Bill Author Caption Stage Notes
SB42 Zaffirni Relating to the security of courts and judges in the state. Effective on 9/1/17 Excepts disclosure of personal information of judges and their spouses from disclosure.
SB179 Menéndez Relating to student harassment, bullying, cyberbullying, injury to or death of a minor; creating a criminal offense. Effective on 9/1/17 David’s Law
SB532 Nelson Relating to reports on and purchase of information technology by state agencies. Effective on 9/1/17 One to keep an eye on. The bill directs agencies to provide information to the Department of Information Resources about their security programs and risks. DIR must provide a public analysis of the risks and plans.  Also has some language about cloud computing and state agencies.
SB564 Campbell Relating to the applicability of open meetings requirements to certain meetings of a governing body relating to information technology security practices. Effective on 9/1/17 Expands (currently only applies to the Department of Information Resources) an exception to open meetings requirements to allow for closed meetings of governmental bodies to discuss security assessments, network security information, or other security issues.
SB705 Birdwell Relating to an exception from disclosure under the public information law for certain personal information of an applicant for an appointment by the governor. Effective immediately Excepts the personal contact information of persons applying for appointment by the governor or the senate from public disclosure under the PIA.
SB843 Perry Relating to disclosure and use of certain information regarding the Crime Victims’ Compensation Act. Effective on 9/1/17 Prohibits the release of applications for compensation
SB1910 Zaffirini Relating to state agency information security plans, information technology employees, and online and mobile applications. Effective on 9/1/17  Requires each state agency to submit a security plan to the DIR.  Also calls out that if an agency has a CISO, that CISO should report outside of the IT department!!! 🙂

We have to do better: Pacemaker security

Last week Billy Rios and Jonathan Butts published a research on the security of pacemakers.  In all they identified over 8000 vulnerabilities in third-party components within the subsystems of 4 major vendors’ physician programming and home monitoring devices.

These vulnerabilities exist primarily because vendors are able to cut development time by using commonly available libraries.  While the libraries may be considered secure when initially deployed, over time new vulnerabilities are discovered.  Unfortunately the patches for these vulnerabilities are not uniformly applied.

This is a common problem with embedded devices, internet-of-things things, and industrial control systems.  The use of public libraries makes sense to get a product to market, but many vendors don’t account for the update and patch process.

Additionally, as I’ve written about before, many vendors still use hardcoded or backdoor passwords.  The researches have been able to verify hardcoded credentials in three of the four devices tested.

We have to demand better from the vendors selling critical information technology, whether it is an industrial control system or medical equipment.  Simple vulnerabilities like insecure libraries, the inability to patch, and hardcoded credentials must be addressed by vendors.