Data Breach v. Data Hack – What is the difference?

We often conflate the terms ‘data breach’ and ‘data hack’ to describe risks associated with computer security. In reality, each encompasses its own space in the cyber security world and delineate distinct protective measures.

What is a Data Breach?

A data breach speaks to an inadvertent release of sensitive data from a secure space to an untrusted environment. This often occurs when data is unintentionally left unsecured allowing unauthorized individuals to access it. This form of breach does not occur as a result of malicious intent, but instead due to negligence, incompetence, or human error. An example of this is the Cambridge Analytica scandal, where Facebook released confidential user data to a third party. While some classified this is as a hack, it is technically considered a breach given that Cambridge Analytica did not attempt to break through Facebook’s security screens; it took advantage of a pre-existing privacy oversight.

What is a Data Hack?

A hack on the other hand, is a calculated alteration to a computer’s hardware or software for a purpose other than that originally intended by the developer. Unlike a data breach, a data hack is intentional. It is usually conducted by cyber criminals with malicious intent for adverse purposes such as data theft or fraud. An example of a cyber hack was evidenced in 2018 when Marriot International revealed that cyber criminals had hacked their system to steal confidential data of 500 million customers.

Understanding the Difference:

It is important to understand the distinction between intentional versus inadvertent cyber threats, so we can take measures to protect against all security breaches. The Office of the Privacy Commissioner of Canada has compiled a guide on preventing and responding to both privacy breaches and hacks. This guide is summarized below:

Understand the Threats:

1. Know what personal information you have, where it is, and what you are doing with it.
2. Know your vulnerabilities by conducting risk and vulnerability assessments and/or penetration tests to ensure that threats to privacy are identified.
3. Be aware of breaches in your industry. Attackers will often re-use the same attacks against multiple organizations.

Thinking Beyond the Hacker:

1. Encrypt laptops, USB keys and other portable media.
2. Limit the personal information you collect, as well as what you retain.
3. Protect personal information throughout its lifecycle.
4. Train your employees.
5. Limit, and monitor, access to personal information.
6. Maintain up-to-date software and safeguards.
7. Implement and monitor, intrusion prevention and detection systems.

Containing Breaches

1. Take immediate steps to limit the breach:
   • Designate an appropriate individual to lead the initial investigation.
   • Determine the need to assemble a team which could include representatives from appropriate parts of the business.
   • Determine who needs to be made aware of the incident internally, and potentially externally, at this preliminary stage.
   • Do not compromise the ability to investigate the breach.
2. Prevent future breaches:
   • Conduct a security audit of both physical and technical security.
   • Review policies and procedures.
   • Review employee training practices.
   • Review service delivery partners (e.g., dealers, retailers, etc.).

The complete guideline summarized above can be found here:

https://www.priv.gc.ca/en/privacy-topics/business-privacy/safeguards-and-breaches/privacy-breaches/respond-to-a-privacy-breach-at-your-business/c-t_201809_pb

The post Data Breach v. Data Hack – What is the difference? appeared first on FCL LLP.

By Samah Rahman

While at one time, blurring of the online and offline space was the sensation, the age of ‘hey Google/hi Siri/excuse me, Alexa’ is experiencing a significant tech-backlash. In 2017, we learned that Facebook allowed Cambridge Analytica to leverage user data to manipulate public sentiment around major world events. There is now a newly cultivated air of caution among consumers who use “quantified self” devices (think smart watches and fitness trackers) to learn more about themselves. These machines serve as a platform to diarize and measure daily exercise, nightly sleep, and other routines. This also means that manufacturers of these products are privy to sensitive data about users and their habits. Consumers are now demanding answers to questions about their privacy: how is this data stored; who has access to this data; how is this data used; and how is consumer privacy protected?

The Human Data Commons Foundation, a nonprofit organization seeking to build an equitable digital future, responded to such queries in their third annual Quantified Self Report Card. The Report reviewed 18 leading companies on how the makers handle sensitive data generated by their users. The Report Card graded companies out of 30 on their protocols surrounding: a) legal rights, b) data collection and sharing, c) data access, and d) security protocols.

The results of the Report revealed that despite the climate of consumer distrust and caution, these companies lag behind in addressing the holes in their privacy policies. It was found that many companies combine fitness data with information from social media, to create habit portfolios. Such data is then shared with third parties such as insurance companies, or the police, in aid of investigations. As a securities measure, some companies have attempted to implement the European Union’s General Data Protection Regulation which allows for a “right to erasure” or a “right to be forgotten”, which means users can request their personal data be deleted. However, the consensus in the Reports is that it is increasingly difficult for users to opt out of, or protect against these privacy breaches. Long story short: companies are still not doing enough to protect their users.

As an exception to these findings, the Report ranked Apple in first place, with a mark of 25/30. Greg McMullen, co-author of the Report noted that Apple’s attempt to harness privacy as a competitive advantage is good for their users. Of course, not everyone can afford Apple products to invest in their privacy. McMullen warned of the risks that come with using privacy as a marketing tool; “privacy should not be a luxury, privacy is a human right,” he said. Samsung and Moov, arguably more “affordable” brands, finished at the bottom of the class with marks of 6/30. Both companies had aggressive data collection and sharing practices. On this disparity, the Report stated that: “in addition to excluding people who can’t afford the price of privacy, this risks creating a class of people who feel insulated from the negative effects of surveillance capitalism and are less concerned about creating effective legal protections.”

To undercut this “protected class,” consumers should leverage their purchasing power to demand protections against the misuse of their personal data, and the legal profession in turn, should advocate for changes in policies and legislation in support of this goal.

The post Privacy – a luxury or a human right? appeared first on FCL LLP.