Data Breach , General Data Protection Regulation (GDPR) , Governance

Record Privacy Fine Sends Strong Signal to Data-Processing Technology Companies(jeremy_kirk) • January 22, 2019    Photo: Google

France on Monday imposed a €50 million ($57 million) fine against Google for violations of the EU General Data Protection Regulation, sending a strong to message to the technology giant that its privacy and data collection practices are not adequate.

See Also: Key Drivers to Enable Digital Transformation in Financial Services

The penalty, levied by the country's National Data Protection Commission, abbreviated as CNIL, is the largest fine handed out so far under GDPR, which is intended to better protect Europeans' personal data.

"The amount decided and the publicity of the fine are justified by the severity of the infringements observed regarding the essential principles of GDPR: transparency, information and consent," CNIL says. It has also published a longer penalty notice, written in French, outlining in full the fine against Google.

Google officials in Sydney said the company was studying CNIL's decision and that it is "deeply committed to meeting those expectation and the consent requirements of the GDPR."

EU data protection authorities can impose fines of up to €20 million ($23 million) or 4 percent of an organization's annual global revenue - whichever is greater - on any organization found to have violated GDPR. Regulators can also revoke an organization's ability to process individuals' personal data.

In 2017, the annual global revenue for Alphabet, Google's parent company, was $110.8 billion. Accordingly, the maximum fine that could have been levied by CNIL would have been $4.4 billion.

Hence a $23 million fine won't hurt Google financially. But the penalty does serve notice that EU privacy watchdogs are reviewing technology companies' data collection and usage practices, and that if they don't like what they find, organizations might face profit-impacting sanctions.

"If GDPR is actually going to be enforced like this going forward, and it's not just a one-off French expedition, the entire business model of Google and Facebook as it pertains to using personal information for ad targeting is in doubt," tweets David Heinemeier Hansson, the creator of Ruby on Rails and founder of Basecamp. "About bloody time."

Other European complaints filed against Google under GDPR remain pending. Consumer organizations in seven countries filed complaints in November 2018 over how Google obtains permission to collect the location of users, as well as their browsing data and interactions with mobile apps (see Google Faces GDPR Complaints Over Web, Location Tracking).

Google: We're Committed to GDPR

CNIL's action comes from its investigation of complaints filed by two privacy-focused advocacy groups: None of Your Business and La Quadrature du Net. Nyob filed its complaint on May 25, 2018 - the day GDPR went into effect - and LQDN filing its complaint three days later.

Max Schrems, an Austrian lawyer who is chairman of Noyb, hailed CNIL's decision. Schrems has been an influential data privacy activist, and it was his legal complaint involving Facebook that eventually led to the invalidation of the Safe Harbor agreement in 2015 by the European Court of Justice (see Europe's New Privacy Shield: Will It Hold?).

"We are very pleased that for the first time a European data protection authority is using the possibilities of GDPR to punish clear violations of the law," Schrems says. "Following the introduction of GDPR, we have found that large corporations such as Google simply 'interpret the law differently' and have often only superficially adapted their products."

As the deadline for GDPR approached, Google had sought to deflect potential regulatory action by maintaining that its data processing systems were transparently described to consumers as well as by revamping some of its privacy controls.

"We offer transparency to users through clear explanations of how we use personal data and our 'Why This Ad' program, while giving people controls to manage their privacy through My Account and My Activity," wrote William Malcolm, director of privacy and legal in Europe for Google, in an August 2017 blog post.

Data Processing: Unclear

But CNIL concluded that Google violated two aspects of GDPR, based on the regulator's examination of the account creation steps in place on an Android phone.

First, the agency alleges that Google does not transparently communicate the scope of data processing used for targeted advertisements. "Users are not able to fully understand the extent of the processing operations carried out by Google," CNIL says.

Second, CNIL says Google left consumers uninformed about how their personal data would be used, in violation of GDPR's requirement to ensure that consent from customers is specific and unambiguous.

The French regulatory agency criticized the documentation and advice that Google shows users as "too generic and vague," giving users little insight into the "particularly massive and intrusive" data processing systems that are used for ad personalization.

The regulator also found that the "general structure" for how Google presents those controls violates GDPR. For example, users must take five or six actions to get to the relevant information. "Essential information, such as the data processing purposes, the data storage periods or the categories of personal data used for the ads personalization, are excessively disseminated across several documents, with buttons and links on which it is required to click to access complementary information," CNIL says.

CNIL also contended that Google doesn't obtain proper consent for ad personalization. Google, it alleges, doesn't concisely explain that ad personalization will run across services such as Google Play, Maps, YouTube and its search engine. Rather, Google's documentation is "diluted" and doesn't meet GDPR requirements that consent be obtained in a specific and unambiguous manner, it alleges.

The regulator also took issue with Google's default settings when an individual creates an account, which automatically pre-selects a box that allows for ad personalization. Under GDPR, consent is supposed to be unambiguous, in the sense that a user must take a purposeful action to select - or opt in - to such settings.

Google's pre-checked box is a "clear violation of GDPR," says Kevin Curran, a cybersecurity professor at Ulster University in Northern Ireland. Under GDPR, he adds, user consent "also must be a positive opt-in and consent can never be inferred from silence or nefarious activities such as pre-ticked boxes or inactivity."

CNIL's fine against Google puts on notice any firm that collects or processes Europeans' personal data. "Despite numerous statements by Google that it takes the protection of people's data seriously, the decision demonstrates that they have a long way to go and that regulators will take action to hold companies that fail to comply with GDPR to account," says Ailidh Callander, legal officer for London-based civil rights group Privacy International.

"That the decision comes in response to complaints by NOYB and LQDN (representing 10,000 people) also demonstrates the importance of the role of civil society in raising these issues," she adds.

GDPR: Influencing the United States

Although GDPR only safeguards Europeans' personal data, its impact is being felt worldwide. Technology giants such as Microsoft and Facebook have said they will apply GDPR's principles worldwide. Many believe that the privacy law, over time, will cause privacy and data regulations around the world to offer greater protections.

Some countries have farther to go than others. The United States, for example, still lacks a federal privacy law that applies to consumers. But GDPR, combined with the unending pace of massive data breaches spilling consumer data, as well as ongoing privacy scandals, has been fueling legislative interest in data privacy and security.

Last week, Sen. Marco Rubio introduced the American Data Dissemination Act, saying it could provide consumers with basic data privacy rights and increased transparency about how their personal data gets collected and used. The legislation would be modeled after the Privacy Act of 1974, which governs the handling and release of personal records, but which now only applies to federal agencies.

"Your data is incredibly valuable, and for the most part, it is not even yours," Rubio writes in an op-ed in The Hill. "But use of your personal data is governed by antiquated laws that do not work in the modern economy."

Under Rubio's plan, the Federal Trade Commission would give privacy recommendations to Congress, six months after the law went into effect. If Congress failed to act on those recommendations within two years, the FTC could put into effect its own rules, based on the Privacy Act framework, Rubio writes.

Executive Editor Mathew Schwartz contributed to this report.

Anti-Malware , Cybercrime , Endpoint Security

Attackers Combine Off-the-Shelf Hacking Tools With Legitimate Admin Utilities(euroinfosec) • January 21, 2019    Source: Symantec

Security firm Symantec warns that at least four online attack campaigns, which all may be the work of one group, have been targeting banks in West Africa since mid-2017.

See Also: Live Webinar | Sunset of Windows Server 2008: Migrate with Docker

The attack campaigns have targeted banks in Cameroon, the Democratic Republic of Congo, Equatorial Guinea, Ghana and Ivory Coast, researchers at Symantec say in a blog post.

In a reminder that hackers often do not need to reinvent the wheel, the security firm notes that all of the attacks appear to be using commonly available, off-the-shelf attack tools, together with "living off the land" tactics, which refers to using legitimate tools on an already compromised system to help disguise the attack.

"Commodity malware is readily available on the cyber underground," Symantec says. "While it may not be as powerful or stealthy as custom-developed tools, it does add a certain level of anonymity to attacks, making it harder to link attacks together and attribute them to any one group of attackers."

Previously, Symantec said that it saw few, if any, attackers targeting financial services institutions in West Africa. But in the past 18 months, it's seen an uptick as at least one group - and potentially more than one - has begun targeting organizations in the region.

Four Attack Campaigns Hit West Africa

To date, Symantec says it has seen four distinct attack campaigns targeting West Africa that are continuing and include the use of the following commodity tools or tactics:

NanoCore Trojan: Since at least mid-2017, attackers have targeted organizations in Equatorial Guinea and Ivory Coast with NanoCore malware and have also used the legitimate Microsoft administrator tool PsExec to execute processes on infected systems. "Lure documents used by the attackers referred to a West African bank which has operations in several countries in the region," Symantec says. "Some tools used in these attacks are similar to tools mentioned in a 2017 SWIFT alert, indicating the attackers may have been attempting to perform financial fraud." PowerShell: Beginning in late 2017, attackers targeted organizations in Cameroon, DR Congo, Ghana and Ivory Coast using "malicious PowerShell scripts to infect their targets and also used the credential-stealing tool Mimikatz," Symantec says. Attackers also used an open source, remote administration tool for Windows called UltraVNC, then infected systems with Cobalt Strike malware, which can also provide backdoors onto PCs and download additional malware. "Communication with the C&C server was handled by dynamic DNS infrastructure, which helped shield the location of the attackers." Remote Manipulator System RAT: Also known as Gussdoor, this malware was used by attackers, together with Mimikatz and two custom remote desktop protocol tools, to attack a single organization in Ivory Coast, Symantec says. "Since Mimikatz can be used to harvest credentials and RDP allows for remote connections to computers, it's likely the attackers wanted additional remote access capability and were interested in moving laterally across the victim's network." Imminent Monitor RAT: Also known as Hawket, Symantec says attackers wielding this remote access Trojan in December 2018 began to target banks in Ivory Coast.

Symantec could not be immediately reached for comment about the extent to which these attacks were successful, the losses that targeted organizations suffered or how attackers may have stolen funds - potentially, for example, via fraudulent SWIFT messages generated by hacked PCs (see: Malaysia's Central Bank Blocks Attempted SWIFT Fraud).

Hackers Hit Africa

If West Africa had been relatively unscathed by bank hackers, the same cannot be said about all of Africa.

Last October, U.S. cybersecurity firm FireEye warned that a gang of North Korean government hackers, known as APT38, had been waging a sophisticated hacking campaign against banks in Africa and Asia, resulting in the theft of more than $100 million via fraudulent transfers through SWIFT, the global money-transfer network (see North Korean Hackers Tied to $100 Million in SWIFT Fraud).

Also last year, the U.S. Computer Emergency Readiness Team warned in an alert about "malicious cyberactivity by the North Korean government" - which it refers to as Hidden Cobra - that tens of millions of dollars had been stolen from financial services firms in Africa and Asia as part of what US-CERT refers to the "FASTCash" campaign.

US-CERT's alert says the attack campaign, which has been operating since 2016, uses malware designed to "remotely compromise payment switch application servers within banks to facilitate fraudulent transactions."

Publicly Available Hacking Tools

Some bank attacks employ malware that has been customized for the targeted environment. In the case of the $81 million heist from the New York Federal Reserve account of Bangladesh's central bank in February 2016, for example, attackers used custom-designed malware designed to alter SWIFT transactions as well as hide them from printouts. That attack has been widely attributed to North Korean hackers.

But many online attacks, including against banks, continue to use commoditized malware and legitimate administrator tools, according to the U.K.'s National Cyber Security Center, which is part of the GCHQ signals intelligence agency.

In October 2018, NCSC released a joint report on publicly available hacking tools written by cybersecurity authorities in Australia, Canada, New Zealand, the United Kingdom and the United States.

Experts in all five countries warn that the best way to blunt any online attacks today is to monitor for and block commonly used hacking tools.

"Experience from all our countries makes it clear that, while cyber actors continue to develop their capabilities, they still make use of established tools and techniques," according to the report. "Even the most sophisticated groups use common, publicly available tools to achieve their objectives."

Block 5 Common Attack Tools

The report calls out five types of commodity tools that organizations should address:

Remote access Trojans: "A RAT is a program which, once installed on a victim's machine, allows remote administrative control," the report says. "In a malicious context it can, among many other functions, be used to install backdoors and key loggers, take screenshots and exfiltrate data." Commonly seen examples include Adwind RAT, JBiFrost and Gh0st RAT. Web shells: "Web shells are malicious scripts which are uploaded to a target host after an initial compromise and grant an actor remote administrative capability," the report says. "Once this access is established, web shells can also be used to pivot to further hosts within a network." One common example is China Chopper, which the report notes can be spotted because every one of its actions will generate an HTTP POST. In fact, many Web shells appear to be very noisy, which can be used to help spot them. Credential stealers: Mimikatz is a tool first developed in 2007 that's designed to harvest Windows credentials. Its use by attackers remains widespread. "Our cyber authorities have observed widespread use of Mimikatz among hostile actors, including organized crime and state-sponsored groups," the report says. Some defenses against Mimikatz include using up-to-date Windows hardware and software, which includes security features that better protect credentials, as well as never reusing passwords across different administrator accounts, to make them more difficult to crack. Lateral movement frameworks: Designed as a legitimate penetration testing tool in 2015, the PowerShell Empire framework is now used by attackers "to escalate privileges, harvest credentials, exfiltrate information and move laterally across a network," the report says, noting that it "has become increasingly popular among hostile state actors and organized criminals." Organizations can put a range of defenses in place, including removing all old versions of PowerShell, logging all PowerShell usage and using "a combination of script code signing, application whitelisting and constrained language mode." Command and control obfuscators: To disguise their location, attackers may use C2 obfuscators, for example, in the form of the Tor anonymizing network. A tool that first debuted in 2009, called HUC Packet Transmitter, or HTran, is also in wide use. "HTran is a proxy tool used to intercept and redirect Transmission Control Protocol (TCP) connections from the local host to a remote host," the report says. "This makes it possible to obfuscate an attacker's communications with victim networks." To block such activity, network monitoring and firewalls can help.

But the report is careful to note that when it comes to network defense, these recommendations should be treated only as starting points. "The individual tools we cover in this report are limited examples of the types used by malicious actors," it says. "You should not consider it an exhaustive list when planning your network defense."

Anti-Malware , Cybercrime , Fraud

Fallout Exploit Kit Has Also Reappeared, Distributing GandCrab Ransomware(euroinfosec) • January 18, 2019    Spam email with an attached Microsoft Word document that contains a malicious macro designed to download and execute Emotet malware (Source: Brad Duncan)

Malware developers as well as their customers or subscribers often appear to take a vacation around the Christmas and New Year holidays, and last month was no exception.

See Also: Live Webinar: Building Secure Delivery Pipelines with Docker, Kubernetes, and Trend Micro

Following a December slowdown or hiatus, however, attacks involving Emotet - aka Feodo; Hancitor - aka Chanitor and Tordal; and Trickbot have resurged, reports Brad Duncan (@malware_traffic), a threat intelligence analyst for the Unit 42 research group at Palo Alto Networks, in a blog post for the SANS Institute Internet Storm Center.

Duncan says that among today's most widespread malware campaigns, "Emotet is by far the most active" in terms of attacks, as well as being frequently updated by its developers.

"Dozens of indicators are discovered every day as vectors for Emotet infections. Emotet also acts as a distributor for other families of malware," he says. "So far in 2019, I've seen Emotet retrieve Gootkit and the IcedID banking Trojan. As 2019 progresses, I expect to find examples of Emotet distributing other families of malware like Qakbot and Trickbot, something we saw in 2018."

Emotet Evolves

Emotet was a banking Trojan when it first appeared in 2014. But it has continued to wield new tricks, including serving as a dropper - aka downloader and installer - for other strains of malware, including not only Trickbot but also Zeus Panda Banker (see: Malware Moves: Attackers Retool for Cryptocurrency Theft).

In July 2018, the U.S. Computer Emergency Readiness Team warned: "Emotet continues to be among the most costly and destructive malware affecting [state, local, tribal, and territorial] governments. Its worm-like features result in rapidly spreading network-wide infections, which are difficult to combat. Emotet infections have cost SLTT governments up to $1 million per incident to remediate."

The group behind Emotet, called Mealybug, has been using the malware to distribute other malicious code, which has included Ryuk ransomware, since the middle of 2018 (see: Connecticut City Pays Ransom After Crypto-Locking Attack).

Modular Threat

Besides serving as a malware-distribution engine, Emotet remains dangerous in its own right. "It is a highly modular threat with a variety of payloads being delivered," says Edmund Brumaghin, a threat researcher at Cisco's Talos security group. He notes that the addition of new features and capabilities seems to have made Emotet especially popular with cybercriminals.

A spamming module built into Emotet, for example, recently gained the ability to check "if the compromised system's IP address is currently found on many spam-related blacklists including those hosted by SpamCop, Spamhaus and SORBS, among others," he says. Spammers can use that information to focus their efforts on using PCs that are not yet on a blacklist to distribute spam.

Cybercrime Goal: Profits

That's a reminder that for most criminals who use malware, time is money.

"The goal of Emotet, as is the case with crimeware-based threats, is monetary," Brumaghin says. "Attackers use Emotet to deliver modular payloads [they] can use to monetize infections. Those payloads can include threats like banking Trojans, stealers, self-propagation, email harvesters and ransomware. The modules the attackers deploy are likely chosen based on the way they can best monetize infected systems and the environments in which those systems reside."

Security experts say Emotet is being distributed in two ways: via emails that have attached Microsoft Word documents with malicious macros and via emails with malicious links. If a user opens the attachment and enables macros, or follows the link, it can result in the Emotet payload being downloaded and executed on their system.

Emotet is being distributed in two ways: by spam emails with malicious Word documents attached, and via spam emails with malicious links to payload downloaders. (Source: Brad Duncan)

"Malicious code embedded in the malicious attachment functions as a downloader for the Emotet malware," says Brumaghin at Cisco Talos. "When this code is executed, PowerShell is invoked, which reaches out to the Emotet malware distribution server, downloads the malicious payload, and executes it, thus infecting the system.

Spam Themes: Shipping, Invoices

Cisco Talos says that unlike many previously seen attack campaigns via email, Emotet appears to be able to cycle through a large number of different subject lines, although it often focuses on invoices or shipping. The campaigns are also being run in multiple languages.

Emotet campaign: This German-language spam email includes a link that downloads the Emotet payload. (Source: Cisco Talos)

Emotet Avoids Russia

Cybercrime expert Peter Kruse, who heads the eCrime Unit at CSIS Security Group in Denmark, says Emotet does not appear to target - or likely to work at all in - Russia, based on there being no Emotet command-and-control servers located there.

That's a clue to the identity of the group behind the malware. Cybercrime groups operating from Russia can often avoid running afoul of Russian authorities if they ensure that none of their attacks hit individuals living in Russia or neighboring countries. Russia has also never extradited a citizen for alleged cybercrime offenses (see: Russian Cybercrime Rule No. 1: Don't Hack Russians).

Fallout Exploit Kit Returns

Attack campaigns using Emotet, Hancitor and Trickbot aren't the only ones to have returned after going quiet last month.

Following a brief hiatus through early January, the Fallout exploit kit has also reappeared, says Jérôme Segura, a security researcher at Malwarebytes, in a blog post.

"Fallout EK is distributed via malvertising chains (one of them we track under the name HookAds), especially through adult traffic. Since Jan. 15, Fallout EK activity has been picking up pace again to deliver the GandCrab ransomware," Segura says (see: Ransomware Claims to Fund Child Cancer Treatments).

Fallout has also been updated to target a vulnerability in Adobe Flash Player, designated CVE-2018-15982, found in all versions of Flash up to 31.0.0.153. Adobe patched the vulnerability on Dec. 5 via a software update. Last month, Malwarebytes reported that the Underminer exploit kit was targeting the same flaw.

Subsequently, the security researcher known as Kafeine first spotted Fallout targeting the same Flash flaw on Wednesday, via in-the-wild attacks, some of which are installing GandCrab.

A recent advertisement for Fallout posted on the Associated Advert underground forum advertised the ability to target CVE-2018-15982 and also said the exploit kit is available to rent for $400 per week or $1,300 per month, Kafeine says in a blog post.

5 Most Prevalent Malware Strains

In terms of sheer prevalence, however, Emotet and its ilk still take second place to many types of malware that are designed to surreptitiously steal CPU - and sometimes GPU - cycles on a system to mine for cryptocurrency.

In December, Check Point Software Technologies listed the following as being the top five most prevalent strains of malware:

Coinhive: JavaScript that gets planted on websites to mine for monero cryptocurrency "without the user's knowledge or approval, and without sharing the profits with the user"; XMRig: Open source software also designed to mine for monero using the infected systems's CPU, first spotted in the wild in May 2017; Jsecoin: JavaScript cryptocurrency miner that can be embedded in websites; Cryptoloot: A cryptominer that competes with Coinhive - in part by taking a smaller share of mining proceeds - and which uses a victim's CPU or GPU power; Emotet: As noted above, this advanced malware often also distributes other malware. "It uses multiple methods for maintaining persistence and evasion techniques to avoid detection. In addition, it can be spread through phishing spam emails containing malicious attachments or links." Check Point's world map of malware hotspots based on risk of infection (green for low risk, red for high, and gray indicating insufficient data).

Electronic Healthcare Records , Governance , HIPAA/HITECH

New GAO Report Spotlights Problems and Potential Solutions(HealthInfoSec) • January 21, 2019    

Matching the right patients to all the right records continues to be a significant challenge, especially as healthcare providers increasingly seek to exchange health information, posing risks to patient safety and privacy, according to a new Government Accountability Office report.

See Also: Live Webinar: Building Secure Delivery Pipelines with Docker, Kubernetes, and Trend Micro

But implementing standards for recording demographic data, and also sharing best practices, could help improve patient record matching, the study concludes.

"The 21st Century Cures Act included a provision for [GAO] to review patient record matching efforts in the context of electronic health records, including the efforts of ONC and other stakeholders," the report notes.

ONC, the Office of the National Coordinator for Health IT within HHS, leads federal efforts to promote interoperability, including setting requirements for the information that EHRs and other healthcare information systems should collect.

Record Matching Challenges

Challenges in accurately matching patient health records are a barrier to health information exchange, and inaccurately matching records can adversely affect patient safety and privacy, the GAO report notes.

A survey conducted in 2017 by the American Hospital Association found that 45 percent of large hospitals reported that difficulties in accurately identifying patients across information systems limited health information exchange, according to the report.

The watchdog agency says that when it conducted interviews for its study, "stakeholders explained that when exchanging health information with other providers, they match patients' medical records using demographic information, such as the patient's name, date of birth or sex. This record matching can be done manually or automatically."

For example, several provider organizations told GAO that they rely on software that automatically matches records based on the records' demographic information. That software can also identify other potential matches, which staff must then manually review to determine whether the records correspond to the same patient.

Stakeholders also told GAO, however, that inaccurate, incomplete or inconsistently formatted demographic information in patients' records can pose challenges to accurate matching.

"They noted, for example, that records don't always contain correct information - for example, a patient may provide a nickname rather than a legal name - and that health IT systems and providers use different formats for key information, such as names that contain hyphens."

Next Steps

GAO notes in its report that stakeholders told the agency that much more could be done to improve patient record matching.

"For example, some said that implementing common standards for recording demographic data; sharing best practices and other resources; and developing a public-private collaboration effort could each improve matching," GAO writes.

Stakeholders' views varied on the roles ONC and others should play in these efforts and the extent to which the efforts would improve matching, GAO added.

"For example, some said that ONC could require demographic data standards as part of its responsibility for certifying EHR systems, while other stakeholders said that ONC could facilitate the voluntary adoption of such standards. Multiple stakeholders emphasized that no single effort would solve the challenge of patient record matching."

Bad Consequences

Kate Borten, president of the privacy and security consulting firm The Marblehead Group, notes: "Patient record matching continues to be problematic for providers. The consequences for failure to match or for a mismatch can run from time-consuming and inefficient to dangerous."

Failure to identify separate records belonging to the same patient can affect patient data integrity and lead to unnecessary, repeat testing as well as suboptimal care because providers don't have the whole picture, Borten notes.

In addition, improper matching can result in combining the records of different patients.

"This can lead to inappropriate treatment if, for example, a provider mistakenly attributes symptoms to the wrong patient," she says.

"From the privacy and security perspective, providing patient access to the record and releasing the record can lead to breaches of one patient or the other."

Patient ID Mishaps

Health records for twins are particularly vulnerable to mistakes, including being merged accidentally, says Susan Lucci, a senior privacy and security consultant at tw-Security.

"Twins are often given similar names and maybe a later admission could be mistaken as a typo - for example 'Kristen' vs 'Kirsten', 'Cody' vs 'Cory'," she says. "Extremely common names will find multiple matches not only in the name but even in the date of birth, so ... the potential for an overlaid record is high."

Privacy violations are, indeed, a big concern in inaccurate patient matching, says Joe Gillespie, a senior privacy and security consultant at tw-Security.

"One version of the patient's record may contain privacy restrictions that might not appear in another version," he notes. "The same could happen with communications with an authorized patient representative not being aware of certain health issues that were being treated due to that person's involvement not being recorded in a version of the record."

Impact on Credibility

Curt Kwak, CIO of Proliance Surgeons, a large practice in the state of Washington, says inaccurate patient record matching is a significant issue for healthcare providers because of the potential dangers. "There should never be any compromises when dealing with people's health and their lives," he says.

Other issues also develop when patient records matching problems exist, he says. "Patient safety concerns are far above anything else," he says. But other fallout with patient matching mistakes, he notes, include harm to the "credibility of the providers and the facilities that they work in."

Kwak acknowledges that progress is being made in the long-term effort to match the right patient with all the right records, but says there's still plenty of work to be done.

"With the effort to adopt electronic health record systems in the last couple of decades, I firmly believe that data standardization and synchronization have improved significantly," he says. But organizations still need to improve internal processes and provide leadership to consistently operate those processes, he argues. "Hold those who are responsible accountable and be consistent about it. Then for external data alignment, ensure good collaboration and transparency."

Efforts Underway

GOA notes that ONC in 2017 published the Patient Demographic Data Quality Framework, a tool to help providers and other organizations assess their processes for managing data quality and improving the quality of the demographic data they use in matching. It includes, for example, questions that providers can use to identify any gaps in how they manage their demographic data.

In 2017, ONC also hosted a competition for participants to create an algorithm that most accurately matched patient records. ONC selected six winning submissions and plans to report on their analysis of the competition's data, GAO notes.

In 2016, before the Patient Demographic Data Quality Framework was published, ONC began a pilot to assess how the framework could work in a clinical setting. As part of pilot study, ONC provided training on demographic data quality to staff from two community health centers, during which it shared best practices for collecting these data.

But ONC is not currently planning to assess the impact of the framework or to conduct future studies on how it works in clinical settings, GAO notes.

National Identifier Issue

HHS is somewhat limited in the steps that it can take on the patient record matching issue, especially in the context of a potential national unique patient identifier.

Originally, HIPAA, which was enacted in 1996, required the creation of patient identifiers and other uniform standards for electronic data transmission to improve the reliability of health information. But Congress later banned the HHS from expending funds to develop a unique patient identifier system, due to privacy and other concerns (see: Senators Portray Patient Matching as an Urgent Issue).

Some healthcare industry groups, including the Healthcare Information and Management Systems Society and the College of Healthcare Information Management Executives, in recent years have been urging Congress to re-examine the patient safety, security and privacy challenges created by the HHS ban on developing an unique, national patient ID standard (see: Ease Ban on Unique Patient IDs, Groups Again Urge Congress).

Data Loss , Fraud Management & Cybercrime , Geo Focus: The United Kingdom

Facebook Probed by FTC Over Failures that Enabled Cambridge Analytica Scandal(jeremy_kirk) • January 21, 2019    The U.S. Federal Trade Commission's building in Washington, D.C. (Photo: Faungg via Flickr/CC)

The U.S. Federal Trade Commission is close to concluding its investigation into Facebook over the Cambridge Analytica scandal and could levy a record-setting fine, the Washington Post reports.

See Also: Live Webinar | Sunset of Windows Server 2008: Migrate with Docker

It's unclear when any announcement might occur, however, as the FTC is not open due to the government's partial shutdown.

On Monday, a Sydney-based Facebook official told Information Security Media Group that the company has no comment on the report.

The FTC's Facebook probe began in March 2018. But it's not the first time the social network has faced scrutiny from the regulator. Since 2011, in fact, Facebook has been bound by an agreement with the FTC stemming from previous privacy missteps, including sharing data without consent.

Cambridge Analytica, which is now defunct, was a U.K.-based political-consulting firm that briefly worked for President Donald Trump's campaign. It obtained as many as 87 million Facebook profiles from a Cambridge University lecturer in violation of Facebook's policies and without those users' consent (see: Facebook: 87M Accounts May Have Been Sent To Cambridge Analytica).

The blowback over the Cambridge Analytica scandal was both fierce and global.

The U.K. was one of the first enforcers out of the gate. In October 2018, the U.K.'s Information Commissioner's Office levied its maximum possible fine of £500,000 ($645,000) against Facebook. Information Commissioner Elizabeth Denham said a higher fine would have been appropriate if the law had allowed for it, as the EU's General Data Protection now does (see: Facebook Slammed With Maximum UK Privacy Fine).

Improper Sharing?

Facebook's settlement with the FTC in November 2011 put it under a strict monitoring regime, including the provision that for the next 20 years, the social network must submit to third-party audits every two years.

One of the FTC's main aims was to ensure that Facebook obtains consent from users before sharing their data. At the time of the settlement, the FTC alleged that Facebook had misleading privacy controls, making it appear that users could isolate data sharing to "Friends Only."

But third-party apps could still collect data not only from direct users of those apps but also of those friends' friends. The practice should have ended in 2011, and that apparent failure is now one of the triggers for the agency's probe into the Cambridge Analytica debacle.

Around 2014, a Cambridge University researcher named Aleksandr Kogan created a Facebook app called This Is Your Digital Life, a kind of personality quiz. Only about 270,000 individuals directly used it. But when they did, the app grabbed the personal data of their friends, ultimately accessing details for 87 million Facebook users worldwide.

Kogan sold the data to Cambridge Analytica, which specialized in social media influence campaigns. The insight from that personal data would have helped to craft more effective messaging campaigns using Facebook's powerful advertising systems, which allow targeting based on location, age, email addresses and phone numbers, among other characteristics.

When Facebook learned of the Cambridge Analytica situation in early 2015, the company said it tightened the restrictions on what data apps could obtain. But the Wall Street Journal last June reported that despite those restrictions, Facebook still allowed certain partners to obtain personal data and bypass users' privacy settings (see: Facebook to Congress: We Shared More Data Than We Said).

Facebook said in response to the report that it would wind down those partnerships with companies including Spotify, Nissan, Netflix and Microsoft. It also admitted that it failed to deactivate certain APIs that allowed access to data when it retired a feature called "Instant Personalization" in 2014, which integrated Facebook features into other desktop applications.

Ongoing Probes

The Washington Post reports that FTC officials are considering a fine that exceeds the $22.5 million fine that Google agreed to in 2012. In that case, the FTC alleged that Google violated a 2011 agreement by misrepresenting to consumers how they could control their data.

The FTC alleged that Google circumvented a feature in Apple's Safari browser that blocked third-party cookies by default despite telling users they would be opted out of web tracking. Safari accepted temporary cookies, and Google placed a DoubleClick one within the browser's storage. Google then used that cookie to interact with other cookies used by DoubleClick network.

The U.S. lacks a federal data privacy law, although the FTC does have a consumer protection mandate. Accordingly, the agency can and does act on privacy matters if it suspects that companies may have deceived consumers. If the FTC concludes that an organization has violated consumer protection rules, it lacks the ability to fine the organization outright. Instead, it can negotiate a settlement with the organization, which may include the provision that any further violations will carry specific sanctions, including a fine.

Some U.S. states also have ongoing investigations related to Cambridge Analytica. In December 2018, the District of Columbia filed the first lawsuit at a regional level. Starting around March 2018, New York, Massachusetts, New Jersey, Connecticut and Pennsylvania also launched their own investigations (see: Facebook Sued in U.S. Over Cambridge Analytica).

The D.C. lawsuit alleges that Facebook's confusing and misleading privacy controls gave users false assurances that their data would not be shared. The district alleges Facebook violated the district's Consumer Protection Procedures Act, which gives consumers the right to truthful information about consumer goods and services.

Meanwhile in Europe, Ireland's data protection authority is investigating two Facebook data breaches.

In September 2018, Facebook said that a bug in a photo API exposed upwards of 6.8 million private photos to more than 800 app developers over a 12-day period (see: Ireland's Privacy Watchdog Probes Facebook Data Breaches). Less than a month later, Facebook said hackers exploited three separate bugs to access as many as 50 million accounts. The bugs, which were present for more than a year, mistakenly generated access tokens for private accounts (see: Facebook Breach: Attackers Exploited Privacy Feature).

Cyberwarfare / Nation-state attacks , Fraud Management & Cybercrime , Social Media

Sputnik News Agency in Russia Created 'Fake Accounts,' Social Network Alleges(jeremy_kirk) • January 18, 2019    

Facebook on Thursday announced that it has removed hundreds of Facebook and Instagram accounts that violated its rules. The social network alleged that the "fake account" creators misrepresented their identity, hiding the fact that they were employees of the Moscow-based Sputnik news agency.

See Also: Key Drivers to Enable Digital Transformation in Financial Services

The social network has been working since the 2016 presidential election to eliminate "inauthentic activity," or bogus accounts aimed at influencing discourse on political and social issues.

The two operations in question originated in Russia, but one was executed from Ukraine, writes Nathaniel Gleicher, Facebook's head of cybersecurity policy. The two operations do not appear to be linked, he writes.

Facebook's latest cull indicates the depth to which bogus accounts have permeated the social network. The company has pledged to clean up its network with heavy investments in human reviewers and improved automated detection capabilities.

But the latest findings show that Facebook faces a major challenge catching up to remove inauthentic groups that have been active on its services for years. It's difficult work, Gleicher says.

"We are constantly working to detect and stop this type of activity because we don't want our services to be used to manipulate people," Gleicher writes. "While we are making progress rooting out his abuse, as we've said before, it's an ongoing challenge because the people responsible are determined and well-funded."

Propaganda Mill

The Ukraine-based operation has some "technical overlap with Russia-based activity we saw prior to the U.S. midterm elections, including behavior that shared characteristics with previous Internet Research Agency (IRA) activity," Gleicher writes.

55 Savushkina Street in St. Petersberg, Russia, said to be the former headquarters of the Internet Research Agency, which allegedly was part of Project Lakhta (Photo: Google)

Facebook took down 107 pages, groups and accounts lined to that activity, including 41 Instagram accounts.

The IRA was identified as the propaganda mill behind many of the influencing campaigns around the 2016 presidential election. U.S. intelligence agencies concluded that Russia sought to tip the election to President Donald Trump. A special counsel investigation, led by Robert Mueller, continues to investigate whether members of the Trump campaign colluded with Russia (see: Election Hacking Probe Gets New Boss After Sessions Quits).

In October 2018, the Justice Department charged a 44-year-old Russian woman with interfering with the U.S. political system via her work as chief accountant for Project Lakhta (see: Feds Charge Russian With Midterm Election Interference).

Prosecutors alleged it was well-funded and sophisticated operation that sought to manipulate social media outlets, stirring the pot on issues such as gun control, immigration and race relations. The project was linked to Russia's IRA, prosecutors alleged.

Sputnik: We Only Do News

The Russian government owns the Sputnik news agency. A year ago, a news outlet linked to Sputnik, RIA Global, opted - under pressure - to register as a foreign agent with the U.S government, Reuters reported early last year. That move was made to comply with the Foreign Agents Registration Act, a law intended to make the source of foreign propaganda transparent.

Sputnik's press office didn't immediately respond to a request for comments. But the agency told the Wall Street Journal that Facebook's moves amount to political censorship.

Gleicher addressed the censorship argument, contending the takedown resulted not from the content, but because the account owners misrepresented their identity. The pages and accounts, he writes, purported to be independent or general interest pages focused on topics such as weather, travel, sports, economics or politics.

"In these cases, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and this was the basis for our action," Gleicher writes.

For that operation, the company removed 364 Facebook pages and accounts and Instagram accounts.

Continued Ad Spending

Both of the operations bought advertising with Facebook and, in some cases, attracted hundreds of thousands of followers.

The Sputnik-linked group spent $135,000 - paid for in U.S. dollars, rubles, and euros - on ads starting in October 2013 and continuing through last month, Gleicher writes. The 364 pages and accounts attracted some 790,000 followers.

An example of one post Facebook says came from an inauthentic account (Source: Facebook)

The Ukraine-run operation spent about $25,000 on ads using rubles over the last year. Some 180,000 Facebook accounts and more than 55,000 Instagram accounts followed one or more of its 148 misrepresented accounts.

Gleicher writes that Facebook is still reviewing the organic activity that came from both groups.