Excuse the language and think bigger than Porn

UPDATE:  Tom Scott posted a really great example of this on his YouTube channel.  Please take a look.

Motherboard, an online technology magazine, recently posted an article (excuse the NSFW language) discussing the development of artificial intelligent (AI) to face-swap celebrities into pornographic videos.

Clearly there are significant ramifications to celebrities, who will now have numerous fake pornographic videos online.  There is also a threat of blackmail of adults and kids with this new technology.  All of this is very troubling.

Another concern, which should get everyone thinking, is that this technology will not be limited to pornography.  Like many technologies, the porn industry leads the way.  This technology will eventually find its way into the mainstream.

So what does this mean for the political world?  Will “fake news” really become fake news?  At what point will we no longer be able to trust our own eyes?  Can we put Gandhi and Kim Kardashian into a meeting together discussing the benefits of Kobe beef?

It now seems clear that fake news had an influence on the 2016 elections.  How will we be able to discern fake news when the video evidence is right in front of us?  It will become easier and easier to perform the historical revisionism envisioned by Orwell or simply make up events and statements.

Revenge porn” laws exist to protect individuals from malicious disclosure of intimate activities.  Will AI assisted, fake pornography fall under the same protections?  Will we be able to develop laws or protections that protect the citizenry from AI assisted fake news videos, or will those same videos fall under 1st amendment protections?

I don’t have an answer but, even if I did, would it really be from me…?

Does data protection still matter?

Yesterday Equifax (you know the folks that sell credit monitoring services) announced that they were breached.  143 million Americans (or 44% of all Americans) had their personal information exposed.

The 143 million Americans exposed by Equifax, the 22 million exposed in the 2015 OPM breach, the 1.5 billion records exposed by Yahoo would seem to indicate that there is no data left to breach.  The chickens are out of the henhouse.  So where do we go now?

Security is a series of layers.  Physical protection, perimeter protection, system protection… Preventative, detective, and corrective controls… Compensating controls for when any of those fail.  Security is hard.  It is easier to tear something down than to build something up.  The time I spent breaking into systems and networks was a lot easier (and more fun) than the time I spent trying to protect them.

So do the victims get a free pass?  No!  Because they aren’t the victims, we are.  The information that is lost is ours.  We entrust our personal information to these companies – in the case of Equifax and the other credit reporting companies we don’t have much say in the matter.  They have a duty to protect our information from the threats we know are out there.

They need to do the hard work.

Hey, the good news is that Equifax is offering credit monitoring services for the people affected by the breach of their own systems.  That certainly makes me feel more secure.

Bills of the 85th session

Now that the 85th Texas legislative session is over, here is a list of the cybersecurity and privacy bill that made it through.  For the complete list of the bills I tracked this session, click here.

House Bills

Bill Author Caption Stage Notes
HB8 Capriglione Relating to cybersecurity for state agency information resources. Effective 9/1/2017 A significant bill affecting multiple agencies. Requires all security incidents to be report to the Department of Information Resources (DIR) within 48 hours of detection. Also includes a provision for the Sunset Commission to include cybersecurity in their review of state agencies. Additionally directs DIR to conduct exercises and to address duplication of efforts within state agencies. Well worth reading the full bill.
HB9 Capriglione Relating to cybercrime ; creating criminal offenses. Effective 9/1/2017 Amends the Penal Code to include criminal offenses for malware and ransomware, among other cybercrimes.
HB1278 Dutton Relating to availability of Previous personal information of certain current and former prosecutors. Effective immediately Excepts the personal information of district attorneys, criminal district attorneys and municipal attorneys from public disclosure.
HB1861 Elkins Relating to the confidentiality of certain information related to a computer security incident. Effective immediately Adds a provision to §552 (public information act) that excepts information related to security incident information.
HB2087 VanDeaver Relating to restricting the use of covered information, including student personally identifiable information, by an operator of a website, online service, online application, or mobile application for a school purpose. Effective 9/1/2017 An interesting bill targeted at restricting the use of student’s profiles gathered by online services. As many of these services are nationwide, it would be interesting to see this bill in action

Senate Bills

Bill Author Caption Stage Notes
SB42 Zaffirni Relating to the security of courts and judges in the state. Effective on 9/1/17 Excepts disclosure of personal information of judges and their spouses from disclosure.
SB179 Menéndez Relating to student harassment, bullying, cyberbullying, injury to or death of a minor; creating a criminal offense. Effective on 9/1/17 David’s Law
SB532 Nelson Relating to reports on and purchase of information technology by state agencies. Effective on 9/1/17 One to keep an eye on. The bill directs agencies to provide information to the Department of Information Resources about their security programs and risks. DIR must provide a public analysis of the risks and plans.  Also has some language about cloud computing and state agencies.
SB564 Campbell Relating to the applicability of open meetings requirements to certain meetings of a governing body relating to information technology security practices. Effective on 9/1/17 Expands (currently only applies to the Department of Information Resources) an exception to open meetings requirements to allow for closed meetings of governmental bodies to discuss security assessments, network security information, or other security issues.
SB705 Birdwell Relating to an exception from disclosure under the public information law for certain personal information of an applicant for an appointment by the governor. Effective immediately Excepts the personal contact information of persons applying for appointment by the governor or the senate from public disclosure under the PIA.
SB843 Perry Relating to disclosure and use of certain information regarding the Crime Victims’ Compensation Act. Effective on 9/1/17 Prohibits the release of applications for compensation
SB1910 Zaffirini Relating to state agency information security plans, information technology employees, and online and mobile applications. Effective on 9/1/17  Requires each state agency to submit a security plan to the DIR.  Also calls out that if an agency has a CISO, that CISO should report outside of the IT department!!! 🙂

Breach notification laws: Better privacy or the 10th circle?

Today (April 19th) New Mexico became the 48th state to enact a data breach notification law.  Only Alabama and South Dakota do not have a notification law on the books.

On the one hand this is good news for the privacy on New Mexicans.  They are now ensured they will have notice of a breach of their personally identifying information.  They will have the opportunity to mitigate the damage resulting from such a personal exposure.

For security and privacy folks, though, there is a different perspective.  We now have 48 distinct regulations to track.  If I have a client that does business across the country, I have to ensure I am able to help them comply with 48 different (and sometimes contradictory) regulations.  As an example, assume I have a client doing business in Texas, Oklahoma, and Colorado:

  • In Texas and Oklahoma consider a drivers license an element of personally identifying information; Colorado does not.
  • Colorado requires notification to the credit reporting agencies (CRA) if more than 1000 records are breached.  CRA reporting is required in Texas if more than 10,000 records are breached.  Oklahoma does not require CRA reporting at all.
  • Oklahoma allows for electronic communications if the cost of written communication exceeds $50,000; in Texas and Colorado it is only allowable if the costs exceed $250,000.

Add the other 45 states to the mix and the mapping becomes complex.  I won’t comment on whether there is a “better” rule, but the hodgepodge of requirements makes it more difficult for everyone.   This is the type of conflict that is ripe for a federal rule to unify requirements.  Unfortunately the attempts to do so over the past few years have failed to garner much attention.

BTW:  For the curious, there are at least 89 different counties with breach or privacy laws.  A breach at a multi-national corporation can be very complex.