FaceTime bug lets callers hear you before you answer (really) [Updated]
Enlarge/ Apple demonstrates Group Facetime at WWDC 2018.
Users have discovered a bug in Apple’s FaceTime video-calling application that allows you to hear audio from a person you’re calling before they accept the call—a critical bug that could potentially be used as a tool by malicious users to invade the privacy of others.
When Ars reached out to Apple for a statement, the company replied, “We’re aware of this issue, and we have identified a fix that will be released in a software update later this week.” An hour or two after this post went live, Apple disabled Group FaceTime to mitigate the bug.
The bug requires you to perform a few actions while the phone is ringing, so if the person on the other end picks up quickly, they might not be affected. Knowledge of how to use the bug is already widespread. The steps include:
Tap on a contact on your iPhone to start a FaceTime call with them.
Swipe up and tap “Add Person.”
Instead of adding a new person, enter your own number and add yourself as another participant in the Group FaceTime call.
We have tested this method and confirmed that it works. After a caller completes the steps, they will be able to hear the recipient’s audio—but the recipient will be able to hear the caller’s audio, too. It doesn’t really work for eavesdropping for that reason, thankfully, but you could potentially catch someone by surprise. After the steps have been followed, the caller’s end shows that the recipient is part of a FaceTime call. But as far as the recipient can tell, the recipient has not yet answered.
This is an unfortunate error on Apple’s part—first and foremost because it exposes users to risk, but also because Apple has worked aggressively to position itself as the tech company most focused on protecting users’ privacy. Apple executives like CEO Tim Cook have spoken about the importance of privacy frequently over the past several months to contrast Apple with rivals like Google, and privacy has played a key role in the messaging around recent product and software unveilings.
Further, Apple bought advertising visible to attendees at the Consumer Electronics Show this year (where it does not usually have a strong public presence) with the copy: “What happens on your phone stays on your phone.”
Until the fix comes later this week, that might not entirely be the case.
Post updated in the second paragraph to report Apple has disabled Group FaceTime.
Update, February 1, 11:43am ET: According to a report in The New York Times, Apple has now fixed the FaceTime bug. Users will be able to download a software update with the fix next week. That software update will also include the ability to re-enable the Group FaceTime video chatting feature.
https://arstechnica.com/?p=1447543
Home Design Website Houzz Alerts Users of Data Breach
Home remodeling and design platform Houzz informed customers this week of a data breach that involved some personal information.
According to its website, Houzz has over 40 million monthly unique users, but the company said not everyone was impacted by the incident. It’s unclear exactly how many individuals are affected, but Houzz says it has notified them.
The company discovered the breach in December, when it learned that a file containing user data was obtained by an “unauthorized third party.” Regarding how the hack was discovered, Houzz said, “Our security team has a number of ways to learn about potential security vulnerabilities, including our own active methods and third-party reporting.”
The compromised file stored profile information such as name, city, state, country and description. Houzz noted that some users may have made this information public.
The file also contained some internal identifiers used by Houzz systems, but the company believes this data does not hold any value to outsiders. The most sensitive information includes usernames, password hashes, IP addresses, and, if access to Houzz was made through Facebook, the user’s Facebook ID.
Houzz has told users that social security numbers or financial information have not been involved in the incident.
While the company claims that it does not believe passwords were actually compromised — it has not shared any information on the hashing algorithm, but says a unique salt is used for each password — it has still advised customers to reset their password on both the Houzz platform and any other site where the same password was set.
Houzz says it has notified law enforcement and called in a forensics firm to assist with the investigation and remediation efforts.
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
New York Investigating Apple’s Response to FaceTime Spying Bug
New York authorities have announced the launch of an investigation into the recently disclosed FaceTime vulnerability that can be exploited to spy on users. The probe focuses on Apple’s failure to warn customers and the company’s slow response.
Videos and posts describing the flaw started making rounds earlier this week on social media websites. The mother of a 14-year-old from Arizona claimed her son had identified the bug and that they had attempted to inform Apple more than 10 days before details of the hack became public. She claimed the tech giant ignored their responsible disclosure attempts, which included calls, messages on social media, emails and even faxes.
The vulnerability is easy to exploit and it does not require any technical knowledge. The attacker simply calls the targeted user via FaceTime and then immediately initiates a group chat by using the “Add person” button from the bottom of the screen. If the attacker adds their own number to the group chat they start hearing what the victim says even if they haven’t actually answered the call.
The victim continues to see the incoming call (i.e. the screen where they can accept or decline the call) and there is no indication that the person on the other end can hear them. Furthermore, if the victim presses the power button on their device, they give the attacker access to their camera as well.
The vulnerability appears to affect FaceTime on both iOS and macOS. Apple has promised to release a fix sometime this week and in the meantime it has suspended the Group FaceTime feature to prevent abuse.
The bug poses serious privacy concerns and New York Governor Andrew M. Cuomo and Attorney General Letitia James have decided to launch an investigation into Apple’s failure to warn customers and its slow response. The Department of State’s Division of Consumer Protection is accepting complaints from consumers as part of this investigation.
“In the wake of this egregious bug that put the privacy of New Yorkers at risk, I support this investigation by the Attorney General into this serious consumer rights issue and direct the Division of Consumer Protection to help in any way possible,” Governor Cuomo said. “We need a full accounting of the facts to confirm businesses are abiding by New York consumer protection laws and to help make sure this type of privacy breach does not happen again.”
Attorney General James commented, “This FaceTime breach is a serious threat to the security and privacy of the millions of New Yorkers who have put their trust in Apple and its products over the years. My office will be conducting a thorough investigation into Apple’s response to the situation, and will evaluate the company’s actions in relation to the laws set forth by the State of New York. We must use every tool at our disposal to ensure that consumers are always protected.”
In another part of the United States, in Texas, a lawyer has filed a lawsuit against Apple claiming that the FaceTime vulnerability was exploited to record a client’s private deposition.
“Plaintiff was undergoing a private deposition with a client when this defective product breach allowed for the recording of a private deposition,” the complaint reads. “The Product was used for its intended purposes because Plaintiff updated their phone for the purpose of group Facetime calls but not unsolicited eavesdropping. Plaintiff suffered injuries.”
SecurityWeek has reached out to Apple for comment and will update this article if the company responds.
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
State Bank of India Leaves Millions of Customer Messages Exposed
The State Bank of India is the latest large organization to leave a database full of personal information exposed and accessible on the internet.
While active hacking has led to many major data breaches, there have also been many examples of large-scale databases of personal information simply left exposed on the internet. Exactis (340 million records), an unspecified Brazilian database (120 million Brazilian residents), and the Georgia election database (6.7 million Georgia voters) are just a few examples.
Now the State Bank of India – the largest bank in India, ranked fourth in the Indian Fortune 500 – has done similar. An anonymous security researcher discovered and reported that a server belonging to the bank’s Quick service – a mobile-based quick information service – had no password protection. Anyone who knew where the database was located could gain access to the plaintext information it contained.
SBI describes Quick as “a free service from the Bank where in you can get your Account Balance, Mini Statement and more just by giving a Missed Call or sending an SMS with pre-defined keywords to pre-defined mobile numbers from your registered mobile number.”
Tests showed that the database of these calls provided access to many millions of text messages between the bank and its customers. There were three million messages on Monday alone, while the database contains stored archives going back to December. Information includes the customer’s phone number, partial bank account number, bank balance and records of transactions.
The access vulnerability was fixed within hours of it being reported. But with no public statement from the bank, it is impossible to know how long it existed, nor whether any malicious actors gained access to it.
Stephan Chenette, the CTO and co-founder of AttackIQ, commented, “Malicious actors could use the information to target bank customers known to have high account balances, or their phone numbers to launch social engineering attacks against the bank’s 500 million customers… All organizations trusted with sensitive consumer data must continuously assess the viability of their security controls to make sure that they are enabled, configured correctly and operating effectively. It shouldn’t take a massive breach such as this to make companies realize they need a more proactive approach to strengthen security.”
In terms of risk to customers, this operational flaw should be seen in context with the Aadhaar breach (India’s national identity database). Aadhaar is managed by the Unique Identification Authority of India (UIDAI). UIDAI always has and still does deny any breach. Its website says, “Aadhaar database has never been breached during the last 7 years of its existence. Data of all Aadhaar holders is safe and secure. Stories around Aadhaar data breach are mostly cases of mis-reporting.”
Nevertheless, this year’s World Economic Forum Global Risks Report says that of all 2018 breaches, “The largest was in India, where the government ID database, Aadhaar, reportedly suffered multiple breaches that potentially compromised the records of all 1.1 billion registered citizens. It was reported in January that criminals were selling access to the database at a rate of 500 rupees for 10 minutes…”
Any potential combination of bank details and ID details could give criminals a huge advantage in targeted phishing and identity theft.
Ilia Kolochenko, CEO at High-Tech Bridge, fears that SBI might merely be the first of such banking flaws discovered. “I think virtually any large financial organization may face a similar incident,” he told SecurityWeek in an emailed comment. “Modern IT infrastructures are so complicated that virtually no single company has an up-to-date and holistic inventory of their digital assets, let alone continuous monitoring and related security processes. And data sharing with trusted third-parties makes privacy and data protection virtually impossible.”
Oliver Muenchow, security consultant and evangelist at Lucy Security, added, “There are millions of servers out there exposed right now…Not only is the customer’s data exposed, but also the employees’ accounts and passwords are out there floating around. It’s shocking to see that around 86,000 leaks are currently being traded in the Dark Net for the domain sbi.co.in.”
It is a good sign that SBI fixed the flaw so quickly – but it remains a worrying habit for Indian firms to deny or ignore breaches. It does, however, excuse them from any need to offer free ID theft monitoring to any potential victims.
Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.
Apple revokes Facebook’s developer certificate over data-snooping app—Google could be next
Enlarge/ Google and Facebook circumvented the App Store to distribute VPN apps that collected user data against Apple’s policies.
Aurich / Getty
Both Facebook and Google have used Apple’s Enterprise Developer Program—which is intended for exclusive use by companies to give system administrators the ability to distribute apps to employees’ devices internally—to circumvent Apple’s app store and distribute to users applications that closely monitor users’ app, messaging, and network activity.
News of Facebook’s application was published on TechCrunch yesterday, leading Apple to revoke Facebook’s enterprise certificate. This same certificate had been used internally by Facebook for distributing beta builds of Facebook’s apps and for other needs, so the revocation poses a serious challenge for the company.
News of Google’s similar program also broke on TechCrunch, but that happened more recently, and Apple has not yet indicated whether it intends to take similar action with Google. We’ll start by unpacking the Facebook side.
Facebook Research
Since 2016, Facebook has distributed an iOS and Android app that offers users $20 per month in gift cards for substantial access to their mobile data and usage habits. Called Facebook Research, the app was distributed on iOS outside of Apple’s App Store by Facebook. It asked users for root access for any data on their phones and allowed Facebook to track their browsing history, message contents, app usage habits, and location data. It even had the potential to allow Facebook to decrypt encrypted network traffic on users’ devices.
The app was targeted to users ages 13 to 35 (5 percent of whom were teenagers) through Instagram and Snapchat ads. It was not immediately clear in the advertisements that the program was run by Facebook, though that detail was available to users who read carefully once starting the sign-up process.
TechCrunch published a report yesterday afternoon detailing the app’s nature and history. The report noted that Facebook used Apple’s Enterprise Developer Program to distribute the app.
Apple promptly revoked Facebook’s Enterprise Certificate yesterday evening. This had the effect not only of preventing further use of the app to collect user data but also of removing Facebook’s ability to use Apple’s Enterprise Developer Program internally. Facebook employees must now use Apple’s App Store to download the apps they have developed onto their own iPhones or iPads until the situation is resolved or a new solution is adopted. Apple’s move not only affects distribution of new apps but makes existing apps inoperable within the organization.
Google has not taken any action or made any statement regarding the app on Android. Apple provided the following statement to TechCrunch on the matter:
We designed our Enterprise Developer Program solely for the internal distribution of apps within an organization. Facebook has been using their membership to distribute a data-collecting app to consumers, which is a clear breach of their agreement with Apple. Any developer using their enterprise certificates to distribute apps to consumers will have their certificates revoked, which is what we did in this case to protect our users and their data.
Facebook stated that it pulled the app voluntarily after Apple had already revoked the access. The company also told TechCrunch that the app was not in violation of Apple’s policies but did not provide any explanation as to why.
It’s hard to imagine what adequate reasoning Facebook could have offered. The wording of Apple’s policy appears quite clear, per a copy of the Apple Developer Enterprise Program License agreement posted to LinkedIn by TechCrunch writer Josh Constantine. It states that the program is for “Internal Use Applications,” which the agreement defines as “a software program… that is developed by You on a custom basis for Your own business purpose” and that is “solely for internal use by Your Employees and Permitted Users.” Permitted Users is defined as “employees and contractors of Your Permitted Entity.”
The agreement does allow for “customers” to use the internal use applications, “but only on Your physical premises and/or on Your Permitted Entity’s physical premises,” or in other locations if “all such use is under the direct supervision and physical control” of the employees or contractors.
This has happened before
This is not the first time Apple has smacked Facebook’s hand away from the user data cookie jar. Facebook had previously used a VPN app called Onavo Protect to do exactly the same type of user data collection and monitoring. Facebook had promoted Onavo Protect as an app that would keep users’ personal data safe, even as it used that same app to collect users’ data. The app was promoted from within Facebook’s popular social networking iOS app as well.
In August, Apple determined that Onavo Protect was in violation of its policies, prompting Facebook to pull the app from the App Store. Apple had just updated its privacy policies in prior months to close several loopholes that allowed some apps like Onavo Protect to exist in the App Store.
The changes effectively precluded Facebook from offering the app through Apple’s App Store, but Facebook continued to collect user data through the Facebook Research app distributed via enterprise certificates. Further, TechCrunch commissioned Guardian Mobile Firewall security expert Will Strafach to examine the Facebook Research app. He found that it shared code with Onavo Protect and contained numerous references to that application and shared resources. Facebook confirmed that the two apps were supported by the same team.
Facebook avoided using TestFlight, Apple’s official test build distribution platform, to distribute the Facebook Research app. Instead, it leaned on similar third-party beta testing services like Applause.
Facebook offered a statement to TechCrunch that nitpicked perceived issues with the framing of yesterday’s story—such as any implication that the program was targeted specifically at teenagers—but it did not dispute any of the facts. This is the statement:
Key facts about this market research program are being ignored. Despite early reports, there was nothing ‘secret’ about this; it was literally called the Facebook Research App. It wasn’t ‘spying’ as all of the people who signed up to participate went through a clear on-boarding process asking for their permission and were paid to participate. Finally, less than 5 percent of the people who chose to participate in this market research program were teens. All of them with signed parental consent forms.
Google Screenwise Meter
Also a VPN, Google’s similar app is called Screenwise Meter. Like the Facebook app, it is “distributed by way of a special code and registration process using an Enterprise Certificate” after users agree to opt-in in exchange for gift cards, according to TechCrunch. Using this method, it also skips past the App Store to collect a wide range of user data.
Google uses Apple’s TestFlight solution in contrast to Facebook’s usage of Applause and other alternative services. Unlike some of the other services, TestFlight limits distribution to 10,000 users.
Google previously targeted users 13 and older but has since updated the rules to require users to be 18 years or older, though teens as young as 13 can be included if they are part of a household that is joining the program together. Additionally, Google offers a guest mode that allows you to disable tracking if a younger member of your household is using the device you’ve installed the app on.
This is only one recent iteration of Google’s Screenwise data collection program. We reported way back in 2012 that Google was paying users to track 100 percent of their Web usage using a physical hardware box called the Screenwise Data Collector.
Apple has not yet said whether it views Google’s application as a similar violation to Facebook’s or whether it will also revoke Google’s enterprise certificate. If the circumstances are indeed similar, it could pose real challenges for Google, both in terms of internal services and functions and in terms of being able to easily develop and test future versions of its apps for Apple devices.
Update: Google reached out to TechCrunch after the story ran, saying that it would would remove the app from Apple’s enterprise certificate program and disable it immediately on iOS devices. This quick action, apology, and admission of error might lead Apple to avoid the nuclear option while maintaining consistency, but we still haven’t seen any statements from Apple about Google’s app yet. Here’s Google’s statement to TechCrunch:
The Screenwise Meter iOS app should not have operated under Apple’s developer enterprise program — this was a mistake, and we apologize. We have disabled this app on iOS devices. This app is completely voluntary and always has been. We’ve been upfront with users about the way we use their data in this app, we have no access to encrypted data in apps and on devices, and users can opt out of the program at any time.
https://arstechnica.com/?p=1448635
Apple Working on Patch to Prevent FaceTime Spying
A critical vulnerability in Apple’s FaceTime chat application can be exploited to spy on people. The tech giant has disabled a FaceTime feature in an effort to prevent abuse until a patch is made available.
Videos and descriptions of the vulnerability have been making the rounds on social media websites. The attack does not require any technical knowledge and it can be carried out in seconds.
The attacker calls the targeted user via FaceTime and then immediately initiates a group chat by using the “Add person” button from the bottom of the screen. The attacker adds their own number to the group chat and FaceTime treats this action as if the targeted user answered the call, thus allowing the attacker to hear the victim.
On the victim’s side, it appears that they haven’t answered the call and there is no indication that the person on the other end can hear them.
Even more worrying, as The Verge and others have discovered, if the victim presses their device’s power button during the incoming call, the attacker also sees them through their camera. At this point, the victim can also hear the attacker, but the screen still shows the incoming call. Some have reported that there are also other ways to get access to video using this flaw.
The bug reportedly affects FaceTime on the latest versions of iOS and macOS. Apple says it’s working on a fix and in the meantime it has suspended the Group FaceTime feature to prevent abuse.
While the origin of the flaw has not been confirmed, one US-based individual who uses the online moniker “MGT7” claims his 14-year-old discovered the issue. He said the bug was reported to Apple more than 10 days ago, but he never heard back from the company.
Google Project Zero researcher Natalie Silvanovich, who in the past discovered several potentially serious FaceTime vulnerabilities, has a theory on the possible cause of the bug.
Industry professionals have commented on the impact of the bug and Apple’s response.
This is not the first time someone has found a way to abuse the recently introduced Group FaceTime feature. A few months ago, an iPhone enthusiast demonstrated that the feature could have been used to bypass a device’s lockscreen and gain access to contact information saved on a device.
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Appeals Court to Hear Case of Reporter Alleging Surveillance
When Sharyl Attkisson first began hearing clicking sounds on her phone and her computers started turning on and off in the middle of the night, she thought it was a technical glitch that could be easily fixed.
Attkisson, then a longtime investigative reporter for CBS News, didn’t suspect anything more until her sources in the intelligence community suggested that the government might be spying on her because of critical stories she had done.
Attkisson alleged in a 2015 lawsuit that former Attorney General Eric Holder, former Postmaster General Patrick Donahoe, and unnamed federal agents conducted unauthorized surveillance of her home and electronic devices in an attempt to determine who was leaking confidential information to her.
A federal judge dismissed Attkisson’s lawsuit, finding that resolving the allegations would overstep the court’s authority because it “would require inquiry into sensitive Executive Branch discussions and decisions.”
Attkisson’s appeal will be heard Tuesday by the 4th U.S. Circuit Court of Appeals.
Attkisson said she, her husband and daughter first noticed unusual activity with their electronic devices in 2011, after she did a story on Operation Fast and Furious, a failed sting operation in which federal agents allowed firearms dealers to sell weapons to straw purchasers in an attempt to trace the guns back to Mexican drug cartels.
The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives lost track of most of the guns, including two found at the scene where a U.S. Border Patrol Agent was fatally shot in the Arizona desert. The operation sparked a political backlash against the Obama administration.
Attkisson left CBS in 2014 and is now the host of “Full Measure with Sharyl Attkisson,” a weekly Sunday news program broadcast by the conservative Sinclair Broadcast Group.
In her lawsuit, Attkisson says that two computer forensics teams identified an unauthorized communications channel opened into her laptop was connected to an IP address belonging to the U.S. Postal Service, “indicating unauthorized surveillance.”
Government lawyers argue that Attkisson’s lawsuit does not include any evidence that Holder and Donahoe had direct involvement in spying on her.
“At best, plaintiffs’ complaint suggests a mere possibility that Holder and Donahoe could have participated in developing or enforcing policies concerning electronic surveillance generally; there are no allegations that they conducted or ordered the particular incursions about which plaintiffs complain,” Justice Department lawyers argue in a legal brief filed in the 4th Circuit.
A spokeswoman for the Justice Department declined to comment on Attkisson’s lawsuit.
Attkisson alleges that the surveillance violated her rights under the First and Fourth Amendments, as well as the Electronic Communications Privacy Act.
The lawsuit says the surveillance was part of a pattern of spying on reporters during the Obama administration to crack down on leaks. In 2012, the Justice Department secretly obtained two months of telephone records of some reporters and editors for The Associated Press. Holder also sought and received a judge’s permission to look through records of Fox News reporter James Rosen’s calls and emails from 2009.
“Given the high-profile nature of this case, the fact that the alleged surveillance focused on potential government whistleblowers, and the need for close inter-agency coordination, it is certainly plausible to infer that both Holder and Donahoe would have had direct knowledge of the surveillance activities and indeed likely would have had to approve all such activities,” her attorneys, Tab Turner and Paul Berman, argue in their legal brief.
Attkisson went public with her allegations of illegal surveillance in 2013 and filed a complaint with the DOJ’s Inspector General. The FBI and DOJ publicly stated that they had no knowledge of any electronic surveillance of Attkisson or her family.
After examining Attkisson’s desktop computer, the inspector general released a “partial report” that noted “a great deal of advanced computer activity” not attributable to Attkisson or her family, but found “no evidence of intrusion” into the desktop.
Attkisson is asking the 4th Circuit to overturn the dismissal of her lawsuit and allow the case to proceed.
She said the experience disrupted her life and the lives of her family, and also affected her professional life by making some of her sources reluctant to talk to her on the phone out of fear of government eavesdropping. She said she also sees a more significant reason to continue to pursue the lawsuit.
“From the standpoint of constitutional violations, I think this is huge,” Attkissson said.
“This is about government actors of some kind doing this to journalists and private citizens … it used to be unheard of, and now, people aren’t surprised at all.”
Flood of Complaints to EU Countries Since Data Law Adopted
More than 95,000 complaints have been filed with EU countries since the bloc’s flagship data protection laws took effect eight months ago, the executive European Commission said Friday.
The complaints have already triggered three financial penalties, including France’s record 50 million euros fine Monday on US giant Google for not doing enough inform users on how their data is used.
Google has promised to appeal the French ruling that was applied under the European Union’s General Data Protection Regulation (GDPR), which was adopted on May 25 last year.
“Citizens have become more conscious of the importance of data protection and of their rights,” First Vice President Frans Timmermans and other commission officials said.
“And they are now exercising these rights, as national Data Protection Authorities see in their daily work. They have by now received more than 95,000 complaints from citizens,” the joint statement added.
“What is at stake is not only the protection of our privacy, but also the protection of our democracies and ensuring the sustainability of our data-driven economies.”
The officials, however, pointed out that Brussels was still waiting for five member countries to adapt the GDPR to their national legislation.
The five are Bulgaria, the Czech Republic, Portugal, Slovenia and Greece, a European source told AFP on condition of anonymity.
The GDPR is enforced by national data protection agencies.
The EU has billed the GDPR as the biggest shake-up of data privacy regulations since the birth of the web, saying it sets new standards in the wake of the Facebook data harvesting scandal.
The law establishes the key principle that individuals must explicitly grant permission for their data to be used and gives consumers the “right to know” who is processing their information and what it will be used for.
People will be able to block the processing of their data for commercial reasons and even have data deleted under the “right to be forgotten”.
The case for the new rules was boosted by the scandal over the harvesting of Facebook users’ data by Cambridge Analytica, a US-British political research firm, for the 2016 US presidential election.
Microsoft Chief Calls for ‘Global Standard’ on Privacy
Microsoft Joins Apple in Calling for Strong Privacy Legislation
In an interview this week at the World Economic Forum Annual Meeting in Davos, Switzerland, Microsoft CEO Satya Nadella praised the EU’s GDPR and called it a “fantastic start on really treating privacy as a human right.”
He went on to say, “In fact I will hope that the world over, we all converge on a common standard. One of the things we do not want to do is fragment the world and increase transaction costs, because ultimately it’s going to be born in our economic figures. I hope we all come together, the United States and Europe first, and China. All the three regions will have to come together and set a global standard.”
The implication is that GDPR should be used as a blueprint for worldwide user privacy protections. But is this realistic? The U.S. is already considering a federal privacy law — but most people suspect a federal law will weaken some existing state laws, such as the California Consumer Protection Act (CCPA) due to come into force next January.
The latest proposal, the ADD Act, put forward by Sen Marco Rubio, is already weaker than GDPR in the exemptions it makes. In fact, Rubio’s proposal highlights the huge cultural difference between the U.S. and Europe: Europe believes that business must not impede legitimate personal privacy while the U.S. believes that personal privacy must not impede legitimate business.
But difficulties between Europe and the U.S. will be nothing compared to aligning China with western views on personal privacy. China’s culture, and not just in modern times, has always been focused on the state and the collective rather than the individual. China is also pursuing a policy of economic parity — if not supremacy — with the west. It is difficult to see China not using international laws to protect its own companies against the western giants.
In fact, suspicion of protectionism is even a possibility between the EU and the U.S. It has been suggested that if Europe imposes a series of multi-billion-dollar fines against the U.S. tech giants, it could be seen as protectionism in favor of newer and smaller European companies.
It is difficult to see how a single overarching legislation could satisfy the divergent cultural views of the U.S., Europe and China. But the Nadella interview was an interview at Davos — and Davos has been described as a ‘mix of pomp and platitude’. Microsoft has never been afraid of making public appeals that have public but not government support. Its call for international norms of cyber behavior overseen by a panel of independent international experts has gained zero traction.
More recently, Brad Smith called for a Cyber Geneva Convention that would involve worldwide governmental cyber weapon disarmament. Both the U.S. and UK governments have made it clear that they retain, and will continue to retain, selected zero-day vulnerabilities for operational use. This call for an international privacy law may well go the same way as Microsoft’s norms and Geneva convention — a good idea with public support ignored by government.
But there is another point worth making. Microsoft is not alone among the U.S. tech giants calling for strict privacy rules. In an opinion piece in Time this week, Apple CEO Tim Cook did similar. While he did not name ‘GDPR’, he described something with a similar effect. He called for the minimization of data collection; the right for users to know what is collected; the right for users to access, correct or delete collected data; and the right to have that data securely protected. To this he added the right to track the movement of personal data through data brokers. All of this is covered by GDPR.
Apple has, for several months now, been attempting to differentiate itself from its competitors via a strong stance on personal privacy. Has Microsoft decided to do similar? It is, after all, noticeable that the two giants who gain at least most of their income from selling products rather than data are supportive of personal privacy. The two giants that depend upon selling data rather than products (Google and Facebook) have not taken a similar stance.
Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.
GDPR Compliance Brings Other Benefits: Cisco Study
Companies that are ready for the EU’s General Data Protection Regulation (GDPR) have reported shorter sales delays and fewer or less serious data breaches, according to Cisco’s 2019 Data Privacy Benchmark Study.
The study uses data collected for Cisco’s Annual Cybersecurity Benchmark Study, for which over 3,200 security professionals from around the world were surveyed. Privacy-related questions were addressed to more than 2,900 of them.
The Data Privacy Benchmark Study shows that organizations that have invested in customer privacy requirements, mainly to become GDPR compliant and to avoid fines and penalties, are seeing some benefits beyond GDPR compliance.
According to Cisco, 59% of respondents said their organization had met GDPR requirements and 29% expect to become compliant within one year.
Since GDPR applies to Europe and the processing of personal data belonging to individuals in Europe, it’s unsurprising that there is a high GDPR readiness rate in this region. However, GDPR is not ignored in other parts of the world either – the GDPR readiness level is at 57% in the US, 60% in Canada, 50% in Australia and 42% in China.
Meeting data security requirements, internal training, keeping up with evolving developments, complying with privacy-by-design requirements, and meeting data subject access requests were cited as some of the most significant challenges in getting ready for GDPR.
The number of organizations that have reported sales delays due to data privacy concerns has increased to 87%, from 66% in the previous year. However, Cisco found that sales delays were 1-2 weeks shorter in the case of GDPR-ready organizations, compared to ones that expect to become compliant within a year or more.
While a majority of the surveyed companies admitted being hit by a data breach in the past year, the percentage of GDPR-ready organizations affected was 74%, compared to 80% in the case of organizations that expect to become ready in less than a year and 89% for ones that still have a long way to go.
Furthermore, GDPR-ready organizations that have suffered a data breach reported that the average number of impacted records was 79,000, compared to 212,000 reported by non-compliant organizations.
Cisco also found that the system downtime associated with a breach was shorter in the case of GDPR-ready firms, and the costs of dealing with the incident were also considerably smaller.
Specifically, 37% of GDPR-ready companies spent over $500,000 due to a breach. On the other hand, 64% of firms that have more than a year to become compliant reported spending over half a million dollars as a result of a breach.
“Organizations have a long way to go to maximize the value of their privacy investments. Our research shows that the market is set and ready for those willing to invest in data assets and privacy may be the path forward to get there,” said Michelle Dennedy, Chief Privacy Officer at Cisco.
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Tags:
Tags:
Tags:
Tags:
Tags:
Tags:
Tags:
Tags:
