by mwalsh5 | Aug 7, 2020 | Biometrics, Cybersecurity, Facial Recognition, voting
Written By: Michael Walsh
A Byte of Online Voting
Sorry, you cannot vote online in the primaries or in presidential elections this year. That is, unless you have been selected to participate in one of the few small-scale pilot programs, such as the DemocracyLive system in Seattle, Washington, the Voatz platform in West Virginia, or most recently, the Shadow voting tool used for the 2020 Iowa caucuses just a few weeks ago.[1] These voting tools use blockchain technology to generate a unique hash for each vote.[2] To mitigate the risk of election tampering, the votes are submitted, but not counted electronically. [3] Each electronic submission is verified with a printed version of the ballot, then the printed ballots are tallied to calculate the total number of votes.[4] These electronic systems are usually deployed in areas in which voter turnouts are low or voting is only possible by remote means.[5] Ideally, these types of services may help improve voter turnout in the United states—a country in which less than 56% of voting-age adults participated in the 2016 presidential election.[6]
There is little federal oversight for online voting infrastructure, but Congress allocated an additional $380 million for voting infrastructure and security improvements,[7] and 85% of those funds are estimated by the U.S. Elections Assistance Commission to be used by states before the 2020 election.[8] Ideally, those funds will help to alleviate problems in areas with intermittent or low bandwidth internet connections, such as some of the precincts that experienced problems with the Shadow voting app during the 2020 Iowa caucuses.[9] Additionally, a slew of other bills has been introduced to help secure elections from (predominantly foreign) interference (see S.2669; H.R. 1946; H.R. 4990).[10] One amendment to the Help America Vote Act (HAVA) of 2002, passed in December 2019, allocated an additional $400 million to help secure voting infrastructure.[11] However, some experts indicate that modernizing and securitizing current voting infrastructure would cost nearly $2.5 billion, not considering recurring maintenance costs.[12] To modernize Pennsylvania’s infrastructure alone is estimated to cost upwards of $150 million, which accounts for nearly half of the total HAVA funds allotted from Congress.[13]
Election Security Concerns and the 2016 Election
The costs to establish secure voting infrastructure do not seem so exorbitant when considering voter trust. 2016 marked the first year in which Russian interference influenced the presidential elections.[14] This foreign interference happened not by meddling with voter infrastructure (which now usually verifies electronically submitted votes with paper ballots), but by alternative means such as phishing, distributed denial-of-service (“DDoS”), and denial-of-service (“DoS”) attacks.[15] These kinds of interference will certainly not be the last.[16] A recent national survey asked politicians about cybersecurity risks, “[f]orty percent said they’ve had an account compromised in a phishing attack. And 60% said they haven’t significantly updated the security of their accounts since 2016.”[17] Even without direct interference with voter infrastructure, threat actors can make a meaningful difference in the outcome of elections with phishing, DDoS and DoS attacks on other vectors including campaign email accounts or insecure servers used by political groups. In response, Microsoft and Google (the companies that provide the most popular email services in the nation) have been implementing security measures to prevent these attacks. Most countermeasures focus on implementing typical information security protections, such as multi-factor authentication, tokenization, and software-based mitigation techniques, such as spoofing and phishing detection.[18]
Experts still have many questions about the security and privacy of electronic voting systems, most particularly those that are completely paperless.[19] Nevertheless, some voting this year will be done in select states by phone or PC through the Voatz system (but with paper ballot verification).[20] Voatz uses blockchain technology paired with biometric data from users’ phones, such as face scans and fingerprints. Although this version of multi-factor authentication may alleviate fraudulent voting, it poses serious privacy concerns[21] and does not address other salient security risks of online voting, such as phishing, DDoS, and DoS attacks. Regardless, the future of voting is likely to be a digital one, as a recent study from University of Chicago found. The survey estimated that voter turnout could increase by several percentage points,[22] a figure that could compound with the help of universally compatible voting technology.
[1] Emily S. Rueb, Voting by Phone Gets a Big Test, but There Are Concerns, The New York Times (Jan. 23, 2020), https://www.nytimes.com/2020/01/23/us/politics/mobile-voting-washington.html [https://perma.cc/B2SR-NF88].
[2] Voatz, Frequently Asked Questions, https://voatz.com/faq.html [https://perma.cc/9RBS-6BK5].
[3] Id.
[4] Id.
[5] Rueb, supra note 1; Emily Dreyfuss, Smartphone Voting Is Happening, but No One Knows if It’s Safe, Wired (Aug. 9, 2018), https://www.wired.com/story/smartphone-voting-is-happening-west-virginia/ [https://perma.cc/JC2B-SYWF].
[6] Drew Desilver, U.S. Trails Most Developed Countries in Voter Turnout, Pew Research Center (May, 21 2018), https://www.pewresearch.org/fact-tank/2018/05/21/u-s-voter-turnout-trails-most-developed-countries/ [https://perma.cc/4T3C-4JD4].
[7] The Impact of HAVA Funding on the 2018 Elections, U.S. Election Assistance Commission (2019), https://www.eac.gov/sites/default/files/paymentgrants/TheImpactofHAVAFundingonthe2018Elections_EAC.pdf [https://perma.cc/6KDW-RNEJ].
[8] Id.; U.S Senate Committee on Rules and Administration Oversight of the Election Assistance Commission, U.S Election Assistance Commission (May 15, 2019), https://www.rules.senate.gov/imo/media/doc/EAC_Testimony.pdf [https://perma.cc/95VB-NA4H]; Elizabeth Howard, Defending Elections: Federal Funding Needs for State Election Security, The Brennan Center (July 18th, 2019), https://www.brennancenter.org/our-work/research-reports/defending-elections-federal-funding-needs-state-election-security [https://perma.cc/P7UC-8ZW4].
[9] Kevin Roose, The Only Safe Election is A Low-Tech Election, The New York Times (Feb. 4, 2020), https://www.nytimes.com/2020/02/04/technology/election-tech.html, [https://perma.cc/2C8W-982G]; Nick Corasaniti, Sheera Frenkel and Nicole Perlroth, App Used to Tabulate Votes is Said to Have Been Inadequately Tested, The New York Times (Feb. 3, 2020), https://www.nytimes.com/2020/02/03/us/politics/iowa-caucus-app.html [https://perma.cc/B7TG-YJ2P]; Keith Collins, Denise Lu, Charlie Smart, We Checked the Iowa Caucus Math. Here’s Where it Didn’t Add Up, The New York Times (Feb. 14 2020), https://www.nytimes.com/interactive/2020/02/14/us/politics/iowa-caucus-results-mistakes.html [https://perma.cc/HH8N-DURV].
[10] S.2669, 116th Cong. (2019); H.R. 1946, 116th Cong. (2019); H.R. 4990, 116th Cong. (2019).
[11] U.S. Election Assistance Commission, How Can The States Use the Funds? (Jan. 6, 2020) https://www.eac.gov/how-can-states-use-funds-0 [https://perma.cc/79W6-WHYA]; H.R. 1158 § 501, 116th Cong. (2019).
[12] Lawrence Norden and Edgardo Cortez, What Does Election Security Cost?, The Brennan Center (Aug. 15, 2019), https://www.brennancenter.org/our-work/analysis-opinion/what-does-election-security-cost [ https://perma.cc/TL69-YCU2].
[13] Howard, supra note 8.
[14] U.S. Senate Committee 116th Congress, Report of the Select Committee on Intelligence United States Senate on Russian Active Measures Campaigns and Interference in the 2016 U.S. Election Volume 1: Russian Efforts Against Election Infrastructure With Additional Views
https://www.intelligence.senate.gov/sites/default/files/documents/Report_Volume1.pdf [https://perma.cc/CZ47-7XLY]; Andy Greenberg, Feds’ Damning Report on Russian Election Hack Won’t Convince Skeptics, Wired (Jan. 6, 2017), https://www.wired.com/2017/01/feds-damning-report-russian-election-hack-wont-convince-skeptics/ [https://perma.cc/2T8Q-YZR9]; David E. Sanger and Catie Edmonson, Russia Targeted Election Systems in All 50 States, Report Finds, The New York Times (July 25, 2019), https://www.nytimes.com/2019/07/25/us/politics/russian-hacking-elections.html [https://perma.cc/78SM-YVZ4].
[15] Andy Greenberg, Everything We Know About Russia’s Election-Hacking Playbook, Wired (June 9 2017), https://www.wired.com/story/russia-election-hacking-playbook/ [https://perma.cc/EAZ8-W5Z4]; Shannon Bond, 2020 Political Campaigns Are Trying To Avoid A 2016-Style Hack, Nat’l Pub. Radio (Jan. 28, 2020), https://www.npr.org/2020/01/28/799062773/2020-political-campaigns-are-trying-to-avoid-a-2016-style-hack [https://perma.cc/T2ER-KQ9U]; Jeremey Ashkenas, Was It a 400-Pound, 14-Year-Old Hacker, or Russia? Here’s Some of the Evidence, The New York Times (Jan. 26, 2017), https://www.nytimes.com/interactive/2017/01/06/us/russian-hack-evidence.html [https://perma.cc/U9CX-N829].
[16] Miles Parks, Russian Hackers Targeted The Most Vulnerable Part Of U.S. Elections Again, Nat’l Pub. Radio (July 28, 2018), https://www.npr.org/2018/07/28/633056819/russian-hackers-targeted-the-most-vulnerable-part-of-u-s-elections-again [https://perma.cc/MR8E-3H3Q]; Shannon Bond, Microsoft Says Iranians Tried To Hack U.S. Presidential Campaign, Nat’l Pub. Radio (Oct. 4, 2019), https://www.npr.org/2019/10/04/767274042/microsoft-says-iranians-tried-to-hack-u-s-presidential-campaign [https://perma.cc/K9ST-T55N].
[17] Bond, supra note 15.
[18] Tom Burt, Protecting Democracy with Microsoft AccountGuard, Microsoft Blog (August 20, 2018), https://blogs.microsoft.com/on-the-issues/2018/08/20/protecting-democracy-with-microsoft-accountguard/ [https://perma.cc/7MGY-MW5X]; Lily Hay Newman, Google’s Giving Out Security Keys to Help Protect Campaigns, Wired (Feb. 11, 2020), https://www.wired.com/story/google-free-security-keys-campaigns/ [https://perma.cc/4TN7-9SQ2].
[19] David Jefferson et al., What We Don’t Know About the Voatz “Blockchain” Internet Voting, System (May 1, 2019), https://cse.sc.edu/~buell/blockchain-papers/documents/WhatWeDontKnowAbouttheVoatz_Blockchain_.pdf [https://perma.cc/62H2-MQN4]; Michael A. Specter et al, The Ballot is Busted Before the Blockchain: A Security Analysis of Voatz, the First Internet Voting Application Used in U.S. Federal Elections, Mass. Inst. of Tech., https://internetpolicy.mit.edu/wp-content/uploads/2020/02/SecurityAnalysisOfVoatz_Public.pdf [https://perma.cc/89H7-XLP2]; Abby Abazorius, MIT Researchers Identify Security Vulnerabilities in Voting App, MIT News (Feb. 13, 2020), http://news.mit.edu/2020/voting-voatz-app-hack-issues-0213 [https://perma.cc/AA49-97FS]; Robby Mook et al., Cybersecurity Campaign Playbook, Harv. Kennedy School Belfer Center (Nov. 2017), https://www.belfercenter.org/CyberPlaybook [https://perma.cc/82NN-KA57]; Miles Parks, In 2020, Some Americans Will Vote On Their Phones. Is That The Future?, Nat’l Pub. Radio (Nov 7, 2019), https://www.npr.org/2019/11/07/776403310/in-2020-some-americans-will-vote-on-their-phones-is-that-the-future [https://perma.cc/4W62-9TLS].
[20] Voatz, supra note 2.
[21] Jefferson, supra note 19.
[22] David Stone, Jul 30, 2019 West Virginia Was the First State to Use Mobile Voting. Should others follow? U. of Chi. (July 30, 2019), https://news.uchicago.edu/story/voting-mobile-devices-increases-election-turnout [https://perma.cc/NAF9-69B5]; Anthony Fowler, Promises and Perils of Mobile Voting, U. of Chi. (June 2019), https://cpb-us-w2.wpmucdn.com/web.sas.upenn.edu/dist/7/538/files/2019/06/Fowler_MobileVoting.pdf [https://perma.cc/6N8C-VQGZ].
by mwalsh5 | Jul 17, 2020 | Biometrics, COVID, Cybersecurity, Legislation
Written by: Michael Walsh
Disclaimer: This post does not contain legal advice. I am not a licensed attorney nor am I qualified to give compliance help or other legal services. This post is for educational purposes only.
Due to a resurgence of the COVID-19 pandemic in many states, federal and state health agencies have deployed several technologies to help track (and ultimately quell) the spread of the pandemic. Temperature scans and other screening technologies have become commonplace, and nonconsensual mass temperature screening has been used to mitigate the spread of other major pandemics in the past.[1] The Food and Drug Administration (FDA) issued comprehensive, but nonbinding guidance on the use of thermal imaging technologies for COVID diagnostics, which advocates for the use of thermal imaging tech as an initial screening tool in “high throughput areas” such as airports, businesses and other high density areas where traditional temperature measuring techniques would be ineffective or impracticable.[2]
Technical Limitations and Efficacy of Temperature Screening
Some scientific studies support the use of telethermographic devices or non-contact infrared thermometers (NCITs) to accurately measure skin temperature (which correlates with core temperature).[3] NCITs are thermal imaging systems that measure infrared radiation that is omitted from febrile humans (humans with a detectable fever) and convert that radiation map into a relative temperature measurement.[4] However, the FDA emphasizes that such technologies are not suitable as a sole means of diagnosing COVID-19.[5]
NCITs can be effective at sensing relative temperatures but have palpable limitations that can affect the technology’s efficacy. The American Civil Liberties Union (ACLU), citing a clinical study of NCITs, asserts that mass screening of open rooms can lead to wildly inaccurate temperature measurements.[6] The FDA recommends that temperature scans should be made in highly controlled environments or in rooms which have a temperature between 68-76 degrees Fahrenheit and that have no draft, radiant heat, (filament) light interference, or reflective backgrounds.[7] Because the technology senses relative infrared radiation, most systems also require a controlled temperature reference (called a blackbody) to compare the radiation density between the individual and the ambient environment. A relatable analogy to the purpose of the blackbody is comparing a white tissue (blackbody) to the color (heat radiation) of one’s teeth to determine if one’s teeth are truly white (heat saturated). The relative differences between the thermal maps of the blackbody and the scanned individual can be used to estimate skin temperature with relatively high confidence (this study found skin temperature variations of ±10 degrees Fahrenheit and within a 95% confidence interval),[8] meaning that measured temperatures were generally accurate within 2-3 degrees Fahrenheit.[9]
Additionally, FLIR, one of the most prominent thermographic device manufacturers concedes that the technology has technical limitations and is not suitable as the sole diagnostic tool for identifying individuals with COVID.[10]
Regardless, the aforementioned CDC study found that although thermal imagery systems are highly dependent on controlled environments, infrared tech can reliably detect “elevated skin temperatures” and are significantly more accurate at determining fever than self-reported questionnaires (In this study, only one tenth of those who reported a fever were actually febrile).[11] Overall, the technology, once calibrated and controlled, can determine core temperatures with similar accuracy to more traditional oral temperature measurements.[12]
Legal Implications of NCITs
NCITs are governed exclusively by the FDA under part 201(h) of the FD&C Act 21 U.S.C. § 321(h), which governs some medical devices.[13] Generally, these medical devices are those which are intended for use in the diagnosis of disease or other conditions, or in the “cure, mitigation, treatment, or prevention of disease.”[14] However, thermal devices that are not intended for such a purpose are not within the regulatory scope of the FDA, meaning the Food, Drug, and Cosmetic Act (FD&C) does not apply to those businesses or individuals using nonmedical thermal devices. Of course, the definition of a medical device under 201(h) is dependent on the intent of the user, so thermal imaging systems that were originally unintended for COVID screening should still comply with the FD&C and other relevant FDA guidance.[15] However, the FDA promotes the use of thermal imaging technologies as a preliminary tool for COVID screening. The FDA states that businesses (because the COVID-19 pandemic is defined as a public health emergency) likely need not comply with many medical device regulations so long as such use does not “create undue risk.”[16]
Privacy Concerns
HIPAA
HIPAA, the flagship federal legislation that protects medical health information is rendered obsolete in the age of contact tracing. HIPAA applies primarily to health plans, clearinghouses and health care providers, of which Google, Apple, PwC, PopId and Clear (contact tracing powerhouses) are not.[17]
Searches
It is also important to note that thermal imagery can qualify as a “search,” but Constitutional protections for unreasonable searches and seizures only apply to government actors. However, there is evidence that tech companies have shared location data with government agencies to help track the spread of COVID.[18] This data may be aggregated and anonymized, but combining relevant data sets may reidentify that data, revealing private medical data traceable to specific individuals. Apparently, 63% of individuals can be uniquely identified by a combination of gender, date of birth, and zip code alone.[19] By combining different data sets which have both “anonymized” or “aggregate” direct or indirect personal identifiers, many anonymous data sets can be reidentified, compromising the privacy of specific individuals.[20]
ADA
The Americans with Disabilities Act (ADA) enforces nondiscrimination based on disability (under which COVID may qualify) and binds all private employers with fifteen or more employees.[21] However, the U.S Equal Employment Opportunity Commission (EEOC) explicitly states that the ADA should not interfere with COVID-19 guidelines made by the CDC.[22] Temperature and other COVID tests must be ‘job related and consistent with business necessity’ and employees may be furloughed or excluded if they have a “medical condition” that would pose a direct threat to health or safety (such as COVID-19).[23]
State Privacy Laws
Of course, there are some existing protections such as the California Consumer Privacy Act (CCPA), Vermont’s data broker registration law, and Illinois’s biometrics law (BIPA), each of which either contain a public health emergency, “direct relationship” or other exception, meaning that most contact tracing companies are exempted from complying with these privacy laws until they are amended or COVID is no longer classified as a health emergency.[24]
Two companies, Clear and PopID have already begun using biometric face scanning and thermal imaging technologies to monitor COVID-19 in businesses and other public places.[25] Some restaurants are implementing these screening procedures in response to the White House guidelines, which require businesses to “monitor workforce[s] for indicative symptoms.”[26]
Pending Federal Legislation
Amid concerns of private health information gathered from COVID screening, senators have introduced a COVID-19 privacy bill which would: (1) require express consent to collect, process or transfer “personal health, geolocation, or proximity information”; (2) disclose to whom that data will be transferred to and retained by; (3) give individuals the opportunity to opt out of their health information being stored or compiled; and (4) give individuals the right to delete or deidentify all personal information that is no longer being used.[27] However the bill has been criticized for preempting stricter state laws (including the CCPA) and not providing a private right of action.[28]Another bill, the Public Health Emergency Privacy Act (PHEPA), is sufficiently broad in its definitions of medical health data, contains clauses for nondiscrimination against those who opt out of COVID tracing programs, and does not undermine existing state data privacy laws through preemption.[29]
The novel coronavirus is just that, novel. Government health agencies and businesses are scrambling to adapt to the constantly changing circumstances. Due to resurgences in cases, the global pandemic has appropriately been categorized as a national health crisis. There is evidence that contact tracing, health screening, and mass temperature scanning can help mitigate the spread of the virus, or at the very least, allow researchers to learn more about the virus. The remaining question is what we are willing to give up in the process. Will government agencies forfeit the private health data that was shared with them once the virus subsides? If so, how will the government and cooperating tech companies protect individuals’ data privacy?
[1]Pejman Ghassemi et al., Best Practices For Standardized Performance Testing of Infrared Thermographs Intended For Fever Screening, PLoS ONE, 1710 (Sept. 19, 2018), https://doi.org/10.1371/journal.pone.0203302 [https://perma.cc/SUB3-8JKB].
[2]U.S. Food and Drug Administration, Enforcement Policy For Telethermographic Systems during the Coronavirus Disease 2019 (COVID-19) Public Health Emergency, Food And Drug Administration, 2 (April 2020), https://www.fda.gov/media/137079/download [https://perma.cc/SZ4J-RGXU].
[3]An Nguyen, et al., Comparison of 3 Infrared Thermal Detection Systems and Self-Report for Mass Fever Screening, Centers For Disease Control and Prevention, 1713-14 (Nov. 2010), https://www.cdc.gov/eid/article/16/11/10-0703 [https://perma.cc/5CXG-TAZS].
[4] U.S. Food And Drug Administration, Thermal Imaging Systems (Infrared Thermographic Systems/ Thermal Imaging Cameras), Food and Drug Administration (May 13, 2020), https://www.fda.gov/medical-devices/general-hospital-devices-and-supplies/thermal-imaging-systems-infrared-thermographic-systems-thermal-imaging-cameras [https://perma.cc/89CQ-WR8N].
[5]U.S. Food and Drug Administration, supra note 2, at 3.
[6] Jay Stanley, Temperature Screening and Civil Liberties During an Epidemic, American Civil Liberties Union, 1-4 (May 19, 2020), https://www.aclu.org/aclu-white-paper-temperature-screening-and-civil-liberties-during-epidemic [https://perma.cc/8ZVH-AUHP].
[7]U.S. Food and Drug Administration, supra note 4.
[8] Nguyen, supra note 3, at 1713.
[9] Id.
[10]Frequently Asked Questions: Thermal Imaging for Elevated Skin Temperature Screening, FLIR (May 13, 2020), https://www.flir.com/discover/public-safety/faq-about-thermal-imaging-for-elevated-body-temperature-screening/ [https://perma.cc/J2AG-X9MM].
[11] Nguyen, supra note 3, at 1713-15.
[12] Id. at 1713.
[13] U.S. Food and Drug Administration, supra note 2, at 3.
[14] Id.
[15] Id. at 4.
[16] Id.; pt. 510(k) of the FD&C Act (21 U.S.C. § 360(k)) (requiring device certification and quality testing before the introduction of the device into interstate commerce); 21 C.F.R. pt. 807.81 (requiring device manufacturers to submit a premarket approval request to the FDA before commercial distribution of the device); 21 C.F.R. pt. 806 (governing the scope and definitions of manufacturer liability for medical devices that have been removed or corrected from current marketed equivalents); 21 C.F.R. pt. 80 (governing medical device registration); 21 C.F.R. pt. 820 (governing device quality control and system requirements); 21 C.F.R. pt. 830 (requiring unique identifiers for medical devices); 21 CFR pt. 801.20 (governing labeling requirements for medical devices).
[17]U.S. Department of Health and Human Services, HIPAA for Professionals (April 2015), https://www.hhs.gov/hipaa/for-professionals/privacy/index.html [https://perma.cc/RE33-8JTK]; Adam Schwartz, Two Federal COVID-19 Privacy Bills: A Good start and a Misstep, Electronic Frontier Foundation (May 28, 2020), https://www.eff.org/deeplinks/2020/05/two-federal-covid-19-privacy-bills-good-start-and-misstep [https://perma.cc/TFW6-LWBR].
[18] Garret Stone, Constitution in Crisis: The Fourth Amendment and Combating COVID-19, Wake Forest J. of L. and Pol’y (April 20, 2020), https://wfulawpolicyjournal.com/2020/04/20/constitution-in-crisis-the-fourth-amendment-and-combating-covid-19/ [https://perma.cc/98TB-F4TM].
[19]Boris Lubarsky, Re-identification of “Anonymized” Data, 1 Geo. L. Tech Rev. 202 (2017), https://georgetownlawtechreview.org/wp-content/uploads/2017/04/Lubarsky-1-GEO.-L.-TECH.-REV.-202.pdf [https://perma.cc/AU9G-E4FA].
[20] Id.
[21]U.S. Equal Employment Opportunity Commission, What You should Know About COVID 19 and ADA Rehabilitation Act, and Other EEO Laws (June 17, 2020), https://www.eeoc.gov/wysk/what-you-should-know-about-covid-19-and-ada-rehabilitation-act-and-other-eeo-laws [https://perma.cc/F2TN-LAY5].
[22]Id.
[23]Id.
[24] Adam Schwartz, Vermont’s New data Privacy Law, Electronic Fronteir Foundation (Sept. 27, 2018), https://www.eff.org/deeplinks/2018/09/vermonts-new-data-privacy-law [https://perma.cc/MH8P-QE4B]; Daniel Gottlieb, California Bill Proposes CCPA Exceptions for HIPAA De-Identified Information, McDermott, Will and Emory, (Jan. 17, 2020), https://www.mwe.com/de/insights/california-bill-proposes-ccpa-exceptions-for-hipaa-de-identified-information-other-health-data/ [https://perma.cc/BR9P-GJ2Z]; Illinois General Assembly, § 740 ILCS, https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57s/california-bill-proposes-ccpa-exceptions-for-hipaa-de-identified-information-other-health-data/ [https://perma.cc/8TBQ-CDUP].
[25]Natasha Singer, Employers Rush to Adopt Virus Screening. The Tools May Not Help Much., New York Times, (May, 11, 2020), https://www.nytimes.com/2020/05/11/technology/coronavirus-worker-testing-privacy.html [https://perma.cc/7AMC-QANC].
[26]Centers for Disease Control, Opening Up America Again, https://www.whitehouse.gov/openingamerica/ [https://perma.cc/MKT6-Z9MG].
[27]John Thune, Thune Wicker, Moran, Blackburn Announce Plans to Introduce Data Privacy Bill, US Senator for South Dakota (April 30, 2020) https://www.thune.senate.gov/public/index.cfm/press-releases?ID=37E557F5-566E-4872-A66D-EBBFEC1D190A [https://perma.cc/F6RM-LCZN].
[28]U.S. Department of Health and Human Services, supra note 17.
[29]Id.
by bhoyt | Jun 5, 2020 | Cybersecurity
Written By: Bryce Hoyt
In the wake of all the massive changes due to COVID-19, the IAPP (International Association of Privacy Professionals) partnered with EY (Ernst & Young) to launch a research initiative to gain more insight into the unique ways privacy and data protection practices have been affected by the pandemic. They conducted a survey on a total of 933 privacy professionals between April 8th and 20th.[1] Although working remotely was not entirely unfamiliar for many people, according to their findings, 45% of organizations have adopted a new technology or contracted with a new vendor to enable remote work due to the pandemic.[2]
Due to the severity and urgency of combating such a pandemic resulting in “stay at home orders,” around 60% of organizations rolling out new “working from home” (WFH) technology either skipped or expedited a privacy or security review.[3] On top of existing obligations, the pandemic demanded privacy professionals to add an array of new concerns to their agenda. When asked how organizations’ priorities have changed, about half (48%) said that safeguarding against attacks and threats has become more of a priority for them.[4] Understandably, many otherwise cautious citizens are now required to navigate most of their life through a technological space that is somewhat unfamiliar, not to mention, likely on a less secure at-home network.
Unsurprisingly, a recent study by the Information Systems Audit and Control Association found that many companies are seeing an increase in the number of cyberattacks since the pandemic began.[5] Additionally, since January 1st the FTC has received over 61,000 reports amounting to over $45 million in total fraud losses.[6] The top four categories of complaints include, (1) travel and vacation related reports about cancellations and refunds, (2) reports about online shopping issues, (3) mobile texting scams, and (4) government and business imposter scams.[7] Many of the phishing scams have targeted college students and international supply chain companies.[8] The scam often takes the form of an email, claiming to provide important information and resources relating to things such as the coronavirus relief fund (CARES Act) or providing fake health advice or vaccine information from the Center for Disease Control (CDC).[9] These emails often have you “login” through an unprotected link where they obtain your personal information or have you download a document which installs a form of malware to your desktop and can further obtain personal information and track your activity.[10]
Hacking has also been on the rise—now targeting organizations in the healthcare sector. Among those who have been attacked, the University of California San Francisco (UCSF), who has been instrumental in sampling and antibody testing for COVID-19, has confirmed that it was the target of a ransomware attack.[11] Ransomware attacks generally gain access to secured information and threaten to publish or delete the data unless a monetary payment is made.[12] Additionally, the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) issued a Public Service Announcement warning organizations researching COVID-19 that they may have been compromised by Chinese cyber threat actors.[13] It appears the race to find a cure has resulted in international intelligence gathering and potential intellectual property theft, however, most of these incidents are still under investigation.
Along with the embarrassing unintended consequences that result from working behind a webcam at home—additional privacy concerns arise when having otherwise protected and privileged conversations at work, are now done at home using a virtual program. For example, therapy sessions, confidential business meetings, college courses/exams, and court hearings are all being held online and the reliability of protection of that data is being questioned.[14] There’s a saying in Silicon Valley, “[i]f the product is free, you are the product.”[15] Many of the videoconferencing companies have been quickly trying to adjust and adapt to the rapid demand and concern for their product, battling complaints and even lawsuits for alleged faulty data protection.[16]
The standout brand Zoom, who we’ve all become familiar with, experienced a surge of 200 million users in March compared to just 10 million the previous year.[17] Despite many companies seeking to extend the enforcement date of The California Consumer Privacy Act (CCPA) out of fear that they are not prepared to deal with the potential data requests due to coronavirus—California’s Attorney General Xavier Becerra’s office has made it clear that enforcement is still set to begin on July 1.[18] Furthermore, the European Data Protection Board (EDPB) released a statement regarding the processing of personal data in the context of the pandemic, clarifying the role of the General Data Protection Regulation (GDPR) during this emergency.[19] The statement emphasized the lawfulness of processing personal data in the context of such an emergency, reiterating provisions such as Article 23—which allows competent public health authorities and employers to process otherwise protected health data for reasons of substantial public interest as it relates to public health.[20] This means that companies are permitted to collect and share information relevant to their employees status of COVID-19 to ensure public safety, so long as such collection is properly limited and not communicated beyond what’s necessary; urging companies to aggregate and anonymize the data when possible.[21] According to those surveyed by the IAPP, about 19% of organizations have shared the names of staff diagnosed with COVID-19 with a third party.[22]
Moving forward, organizations and privacy professionals are working around the clock to ensure compliance with privacy legislation like the GDPR and CCPA and are attempting to resolve the issues above as quickly as possible. For example, Google is working with the World Health Organization (WHO) to implement safeguards against the new phishing and malware threats.[23] The FTC is also increasing its efforts to raise awareness of these scams, creating new guides and resources for the general public to better navigate the “new normal.”[24] The FTC is also sending warning letters to any company falsely promoting a cure or treatment for COVID-19, creating a list of all companies making false claims.[25] The Senate also announced they intend to introduce federal privacy legislation that will preempt state privacy laws, coined the “COVID-19 Consumer Data Protection Act.”[26] This act is intended to help regulate the data collection and processing of personal information in connection with the pandemic.[27]
The balancing act between privacy and pandemic interests carries on and only time will tell the reasonableness of the response. In the meantime, governments and privacy professionals are keeping an eye on the new technologies being implemented such as thermal imaging, contact tracing, and video surveillance. Many of us remain hopeful that regardless of the efficacy of this emergency privacy legislation, there appears to be a growing societal and governmental concern and acknowledgment for protecting privacy interests.
[1] Müge Fazlioglu, Privacy in the Wake of COVID-19: Remote Work, Employee Health Monitoring and Data Sharing, International Association of Privacy Professionals (May 2020), https://iapp.org/media/pdf/resource_center/iapp_ey_privacy_in_wake_of_covid_19_report.pdf.
[2] Id. at 5.
[3] Id.
[4] Id.
[5] ISACA, ISACA Survey: Cybersecurity Attacks Are Rising During COVID-19, But Only Half of Organizations Say Their Security Teams Are Prepared for Them, ISACA (April 2020), https://www.isaca.org/why-isaca/about-us/newsroom/press-releases/2020/isaca-survey-cybersecurity-attacks-are-rising-during-covid-19.
[6] Fed. Trade Comm’n, Coronavirus (COVID-19) Consumer Complaint Data (2020), https://www.ftc.gov/system/files/attachments/coronavirus-covid-19-consumer-complaint-data/covid-19-daily-public-complaints-060220.pdf.
[7] Id.
[8] See Sherrod Degrippo, Coronavirus-themed Attacks Target Global Shipping Concerns, proofpoint (Feb. 10 2020), https://www.proofpoint.com/us/threat-insight/post/coronavirus-themed-attacks-target-global-shipping-concerns. See also Ari Lazarus, COVID-19 scams targeting college students, Fed. Trade Comm’n (May 27, 2020), https://www.consumer.ftc.gov/blog/2020/05/covid-19-scams-targeting-college-students.
[9] See Lazarus, supra note 8. See also Steve Symanovich, Coronavirus phishing emails: How to protect against COVID-19 scams, NortonLifeLock (2020), https://us.norton.com/internetsecurity-online-scams-coronavirus-phishing-scams.html.
[10] Id.
[11] Kartikay Mehrotra, Hackers Target California University Leading Covid-19 Research, Bloomberg (June 3, 2020), https://www.bloomberg.com/news/articles/2020-06-04/hackers-target-california-university-leading-covid-19-research.
[12] Id.
[13] Chinese Malicious Cyber Activity, Cybersecurity & Infrastructure Security Agency (2020), https://www.us-cert.gov/china.
[14] The Editorial Board, Privacy Cannot Be a Casualty of the Coronavirus, The New York Times (Apr. 7, 2020), https://www.nytimes.com/2020/04/07/opinion/digital-privacy-coronavirus.html.
[15] Id.
[16] Hurvitz v. Zoom Video Communications, Inc., No. 2:20-cv-03400, (C.D. Cal. Apr. 12, 2020), https://loevy-content-uploads.s3.amazonaws.com/uploads/2020/04/Todd-Hurvitz-et-al-v.-Zoom-et-al.pdf.
[17] The Editorial Board, supra note 11.
[18] Dustin Gardiner, Coronavirus sparks new fight over California’s internet privacy law, San Francisco Chronicle (May 5, 2020), https://www.sfchronicle.com/politics/article/Coronavirus-sparks-new-fight-over-California-s-15246541.php.
[19] Andrea Jelinek, Statement on the processing of personal data in the context of the COVID-19 outbreak, European Data Protection Board (Mar. 19, 2020), https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_statement_2020_processingpersonaldataandcovid-19_en.pdf.
[20] Id.
[21] Id.
[22] Fazlioglu, supra note 1.
[23] Kim Lyons, Google saw more than 18 million daily malware and phishing emails related to COVID-19 last week, The Verge (Apr. 16, 2020), https://www.theverge.com/2020/4/16/21223800/google-malware-phishing-covid-19-coronavirus-scams.
[24] Fed. Trade Comm’n, Coronavirus Advice for Consumers, Fed. Trade Comm’n (2020), https://www.ftc.gov/coronavirus/scams-consumer-advice.
[25] Lesley Fair, 45 more companies get coronavirus warning letters, Fed. Trade Comm’n (May 7, 2020), https://www.ftc.gov/news-events/blogs/business-blog/2020/05/45-more-companies-get-coronavirus-warning-letters.
[26] Glenn Brown, Senate to Introduce “COVID-19 Consumer Data Protection Act”, The National Law Review (May 6, 2020), https://www.natlawreview.com/article/senate-to-introduce-covid-19-consumer-data-protection-act.
[27] Id.
