Endpoint Security , Governance , IT Risk Management

Chinese telecom giant Huawei has taken a new legal step in its effort to overturn a ban on U.S. government agencies buying its telecom equipment and services.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

In a filing late Tuesday, Huawei's legal team asked a federal court to provide a "summary judgment" regarding its March lawsuit that challenges the constitutionality of the 2019 National Defense Authorization Act, which includes the ban. The company is arguing that the legislation specifically targets Huawei and effectively punishes the company's customers.

The 2019 National Defense Authorization Act is a massive spending bill that not only sets this year's budget for the U.S. Defense Department, but also establishes policies and procedures for the Pentagon. The bill contains a provision - Section 889 - that bans the federal government from purchasing equipment from Huawei as well as ZTE, citing concerns over national security.

The overriding concern is that Huawei is too closely tied to the Chinese government and its gear could be used as a backdoor for that country's intelligence services (see: Huawei's Role in 5G Networks: A Matter of Trust). But Huawei has denied that the company poses a threat to U.S. national security.

In a statement, Glen Nager, Huawei's lead counsel in this lawsuit, argues that Section 889 of the 2019 National Defense Authorization Act violates several portions of the U.S. Constitution. Nager argues Huawei's case is purely "a matter of law" related to the Constitution. Huawei filed its motion in hopes of speeding up court action on its lawsuit. A judge is scheduled to hear arguments on Sept. 19 in a federal court in Texas.

Legal Challenges

Huawei argues that Section 899 of the 2019 National Defense Authorization Act violates the Constitution because it specifically mentions the company and makes a judgment about the company's motives without due process.

"The judicial system is the last line of defense for justice. Huawei has confidence in the independence and integrity of the U.S. judicial system. We hope that mistakes in the [National Defense Authorization Act] can be corrected by the court," Song Liuping, the chief legal officer of Huawei, noted in a statement.

The federal government has argued that Huawei presents a national security threat. And some legal experts note that Congress has broad authorization to act when national security is an issue, Reuters reports.

Huawei Vs. Trump

Since Huawei filed its lawsuit in March that challenges the 2019 National Defense Authorization Act, the company's ongoing battle with the White House has escalated.

In addition to the ban enacted last year that affects government agencies, President Donald Trump this month issued an executive order giving the government the ability to ban the use by U.S. companies of any telecommunications equipment "that poses an undue risk of sabotage to or subversion of the design." The order appears to be designed to block Huawei's business in the U.S. (See: Trump Signs Executive Order That Could Ban Huawei)

The Commerce Department, however, issued a 90-day reprieve to give Huawei's customers and partners some time to resolve any negotiations or business deals in the works (see: Huawei Gets 90-Day Reprieve on Ban).

Additionally, the Commerce Department issued a memo that placed Huawei and 68 of its non-U.S. affiliates on the so-called "entity list," which prohibits them from procuring U.S. goods or services without an export license.

The U.S. has attempted to pressure its allies, especially those in Europe, to abandon Huawei and its equipment, especially for the build-out of 5G networks.

Breach Preparedness , Cybersecurity , Data Breach

One of the most-heard complaints from security experts is that often they find their work repetitive ("The CFO's laptop has been compromised... again!"), which results in the desire of trying something "new", meaning "leave for another company." Another common complaint is that the work is very compartmentalized, and there are few occasions in which the various security specialists can enjoy working as a team.

One activity that can help build a team while improving the security skills of the people involved is participating in Capture the Flag (CTF) hacking competitions. In 2003 at the University of California at Santa Barbara, one of the world's largest attack-defense CTF competitions began and has grown year-after-year, pushing the limits of the players and providing opportunities for better learning. In addition, hacking competitions are a great opportunity for recruiting new talent: CTF participants are highly skilled, well-motivated, and hard-working, which are great traits for a future employee.

Attend this webinar to learn:

Data Breach , General Data Protection Regulation (GDPR) , Governance

The United Kingdom has seen the number of data breach notifications more than quadruple since Europe's tough new privacy law went into full force.

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

The EU's General Data Protection Regulation went into full effect on May 25, 2018. For the first time, it began requiring all organizations that suffer a data breach that put Europeans' personal data at risk to notify relevant authorities.

The Information Commissioner's Office, which enforces GDPR in the U.K., says that from May 25, 2018, until the beginning of this month, it received 14,072 data breach reports, compared to receiving just 3,311 from April 2017 through April 2018.

The increase in data breach notification is a result of mandatory reporting driving better visibility, security experts say. Before last May, most organizations faced no legal obligation to publicly disclose a data breach. Now, however, they do, which means that more data breach discoveries have been coming to light.

Meanwhile, information security experts have told Information Security Media Group that they don't think the frequency of data breaches has increased or decreased significantly since GDPR went into full effect.

"I don't think it's dramatically changed the number or volume of breaches that we've been seeing," Paul Chichester, operations director at Britain's National Cyber Security Center - the public-face arm of intelligence agency GCHQ - told ISMG at a press conference held during the NCSC's recent CyberUK conference in Glasgow, Scotland (see: Cybersecurity Drives Intelligence Agencies in From the Cold).

UK Privacy Complaints Double

Under article 77 of GDPR - "Right to complain to a supervisory authority" - Europeans can file complaints with regulators about organizations' data protection practices, as they were also able to do before enactment of the new regulation.

From May 25, 2018 until the beginning of this month, the ICO received 41,054 data protection complaints, up from 21,000 in the period spanning April 2017 through April 2018.

An ICO spokesman tells ISMG that most of the complaints concerned "subject access requests, disclosure of data, right to prevent processing, security and data inaccuracy."

EU Privacy Board Tracks Increases

The figures issued by the ICO follow European privacy authorities earlier this month releasing a report into the first nine months of GDPR going into full effect

The European Data Protection Board says its report represents the "first overview on the implementation of the GDPR and the roles and means of the national supervisory authorities," or SAs.

The EDPB report says that from May 25 of last year until Feb. 18, SAs received 64,684 data breach notifications as well as 94,622 complaints. "Of these cases, 52 percent have been closed and 1 percent are the subject of lawsuits before national courts."

Based on previous research, Dutch, German and British privacy authorities have been seeing the greatest number of breach reports, compared to other EU member states (see: Netherlands, Germany and UK Have Logged the Most Data Breach Reports).

The Brussels-based EDPB is an independent European body, created as part of GPDR, which went live on the same day as the start of the regulation's enforcement. The EDPB's mandate is to ensure that data protection rules get applied consistently throughout the EU, as well as encourage the EU's data protection authorities to cooperate (see: GDPR: Europe Counts 65,000 Data Breach Notifications So Far).

The EDPB reports that SAs appear to be applying GDPR consistently across member states, backed by extensive cooperation among privacy authorities as well as a dedicated IT system that enables them all to log and track cases.

"From May 25, 2018, to February 18, 2019, no dispute resolutions were initiated," the board's report reads. "This means that up to now, the SAs were able to reach consensus in all current cases, which is a good sign in terms of cooperation."

In the same time frame, the EDPB says EU member states have imposed $63 million in GDPR fines, most of which reflected France's privacy authority fining Google €50 million (see: France Hits Google With $57 Million GDPR Fine).