January 2016

It's finally time to embrace Privacy by Design

[Commentary] On Data Privacy Day, it's sobering to remember how many people have been personally affected by devastating breaches. But many of those hacks could have been prevented if companies simply employed a more than 20-year-old principle known as Privacy by Design.

According the PbD standards, companies should consult with data protection officer "prior to the design, procurement, development, and setting-up of systems for the automated processing of personal data, in order to ensure the principles of privacy by design and privacy by default." All this before going live; not after a security breach has exposed an organization's failure to fully operationalize its lack of respect for user privacy. Bolting on privacy protections after a breach, often likened to bolting the barn door after the horses have left the stable, is costly, clunky, and may not win back the trust of consumers.

[Cobb is a global security researcher for Internet security maker ESET]

Why Icann and Internet governance are no longer America’s domain

[Commentary] In the next few weeks, the Internet Corporation for Assigned Names and Numbers is expected to announce a leadership change. Fadi Chehadé, the organisation’s Lebanon-born American chief executive, is due to step down — and he hopes that a non-American will take his place. Behind the scenes a battle is under way over who should control these protocols and domain names. This is not only relevant to technical folks: the story of Icann might give Washington a well-timed opportunity to defuse some of the anger that European and Asian governments feel about US internet policy. The issue revolves around the question of who should oversee, monitor and assign domain names, such as .edu or .com, and IP addresses. Icann has handled this work since it was established by the US government in 1998. It operates as a non-profit group with a licence from the US Department of Commerce, and it does its work by organising a vast community of volunteers to perform functions such as ensuring that IP addresses do not clash.

FCC Finds Nation Makes Progress in Broadband Deployment But Challenges Remain (updated with link to report)

The Federal Communications Commission’s 2016 Broadband Progress Report concludes that broadband is not being deployed to all Americans in a reasonable and timely fashion. Here’s why:

  • While the nation has made significant progress in broadband deployment, 34 million Americans still lack access to broadband meeting today’s benchmark speeds of 25 Mpbs for downloads/3 Mbps for uploads.
  • A persistent digital divide has left approximately 40 percent of the people living in rural areas and on Tribal Lands without access to service at the FCC’s speed benchmark.
  • In addition, while connectivity for schools has greatly improved since the FCC began modernizing its E-rate program, 41 percent of schools have not yet met the FCC’s short-term goals for connectivity capable of supporting digital learning applications.
  • No satellite broadband service met that speed benchmark during the reporting period.

The report also determines that today’s communications landscape requires access to both fixed and mobile broadband services, which offer both distinct and complementary functions. However, because the FCC has not yet established a mobile speed benchmark, deployment of mobility is not reflected in the current assessment. The Report concludes that more work needs to be done by the private and public sectors to expand robust broadband to all Americans in a timely way. The FCC will continue working to accelerate broadband deployment and to remove barriers to infrastructure investment, in part by direct subsidies, and in part by identifying and helping to reduce potential obstacles to deployment, competition, and adoption.

Online Public File Expands to Radio, Cable and Satellite

The Federal Communications Commission adopted rules to require cable operators, satellite television (DBS) providers, and broadcast radio and satellite radio licensees to post their public and political files to the FCC’s online public inspection file database. Specifically, the rules:

  • Require entities to upload to the online file only public file documents that are not already on file with the Commission or maintained by the Commission in its own database; the Commission will include in the online file documents already on file with the Commission;
  • Exempt existing political file material from the online file requirement and require that political file documents be uploaded only on a going-forward basis, consistent with the approach taken in the television transition;
  • Exempt cable systems with fewer than 1,000 subscribers from all online file requirements, as these systems have few public file requirements and are not required to maintain a political file;
  • Delay for two years the requirement to upload new political file material to the online file for cable systems with between 1,000 and 5,000 subscribers, similar to the approach taken toward smaller television stations in the television transition;
  • With respect to radio broadcasters, impose the online file requirement initially only on commercial stations in the top 50 Nielsen Audio markets with 5 or more full-time employees while delaying for two years all mandatory online public file requirements for other radio stations;
  • Permit entities that are temporarily exempt from part or all online public file requirements to upload material to the online file voluntarily before the delayed effective date of their online file requirement;
  • Permit entities that have fully transitioned to the online public file to cease maintaining a local public file, as long as they provide online access to back-up political file material via the entity’s own website if the FCC’s online file database becomes temporarily unavailable.

FCC Proposes Strengthening The Emergency Alert System

The Federal Communications Commission proposed rules to strengthen the Emergency Alert System (EAS), the national public warning system through which broadcasters, cable television providers, and other participants deliver emergency information, such as weather alerts, to Americans. The proposals are intended to improve EAS by facilitating involvement on the state and local levels, supporting greater testing and awareness of the system, leveraging technological advances, and enhancing EAS security. The Notice of Proposed Rulemaking (NPRM) adopted today by the Commission, aimed at promoting community preparedness and ensuring that the public receives the most effective alerts during emergencies, includes proposals to:

  • Encourage more strategic engagement in EAS at the state and local levels by streamlining, automating, and improving the utility of state EAS plans filed with the FCC
  • Authorize state and local alert originators and EAS participants to conduct periodic “live” EAS tests, provided that steps are taken to prevent public confusion
  • Allow federal, state, and local governments to issue public service announcements using the EAS Attention Signal (i.e., sound), provided that they are presented in a non-misleading and technically harmless manner

FCC Adopts 3 Items From Jan 28 Open Meeting

The following items have been adopted by the Federal Communications Commission:
Application of The KBOO Foundation for a New NCE(FM) Station in Chehalis (WA): The Commission will consider a Memorandum Opinion and Order concerning an Application for Review filed by CVEF challenging the grant of an application and waiver requests filed by KBOO Foundation for a new NCE FM station.
Application for Renewal of License and Request for Extension of Special Temporary Authorization for Class A Television Station WEBR-CD in Manhattan (NY): The Commission will consider a Memorandum Opinion and Order concerning an Application for Review filed by Jose Luis Rodriguez seeking review of the grant of a license renewal and STA of WEBR-CD, Manhattan (NY).
San Fernando Cathedral of San Antonio (TX) (SFC), Application for Review (CG Docket No. 06-181): The Commission will consider a Memorandum Opinion and Order addressing an Application for Review filed by SFC seeking review of the Bureau’s dismissal of SFC’s petition for exemption from the Commission’s closed captioning requirements.

Chairman Wheeler Hammers 'Noncompetitive' Set-Top Market

In a press conference following the Federal Communications Commission's public meeting, FCC Chairman Tom Wheeler discussed the proposal he is circulating to the other commissioners on set-top boxes. Chairman Wheeler read e-mails from a widow and an angry cable customer to make his point that there was no competition in the set-top market. He said that contrary to pay-TV company assertions, his proposal changes nothing about the pay-TV business model but is instead "all about whether the standard for set-top boxes should be a closed standard or an open standard." Chairman Wheeler held up a chart from a filing on the issue by Public Knowledge and Consumer Federation of America to illustrate how the price of set-tops had skyrocketed (by 185%) while the price of computers and mobile phones had plummeted (80%), saying that was the difference between a competitive and noncompetitive market.

Chairman Wheeler said that cable companies are inaccurately claiming that his plan is identical to a previous proposal for a CableCard replacement that was scrapped. The National Cable & Telecommunications Association (NCTA) has been calling Chairman Wheeler's proposal "AllVid," the name of the previous plan. AllVid was proposed in 2010 and could have required a second cable box, Chairman Wheeler said.

FTC Announces Significant Enhancements to IdentityTheft.gov

For the first time, identity theft victims can now go online and get a free, personalized identity theft recovery plan as a result of significant enhancements to the Federal Trade Commission’s IdentityTheft.gov website. The new one-stop website is integrated with the FTC’s consumer complaint system, allowing consumers who are victims of identity theft to rapidly file a complaint with the FTC and then get a personalized guide to recovery that helps streamline many of the steps involved. The upgraded site, which is mobile and tablet accessible, offers an array of easy-to-use tools, that enables identity theft victims to create the documents they need to alert police, the main credit bureaus and the IRS among others.

In 2015, the FTC received over 490,000 consumer complaints about identity theft, representing a 47 percent increase over the prior year, and the Department of Justice estimates that 17.6 million Americans were victims of identity theft in 2014. The updated website provides a range of new features designed to make the recovery process as easy as possible for consumers. It now walks consumers through a simplified step-by-step checklist that is tailored to the specific type of identity theft they are facing. The advice consumers receive is not generic, but instead customized for their individual needs.

Privacy & Data Security Update (2015)

To mark Data Privacy Day, the Federal Trade Commission released their 2015 Privacy and Digital Security Update, highlighting the initiatives it undertook in 2015 to meet that goal, including law enforcement, reports, public workshops, educational efforts, and international cooperation. The FTC's initiatives in 2015 included launching IdentityTheft.gov, a new resource to help people report and recover from identity theft. Just this week, it enhanced the website. Identity theft victims now can get free, interactive personal recovery plans, step-by-step guidance, and pre-filled letters and forms to speed their recovery. In 2015, we brought or resolved enforcement actions against:

  • Companies that we charged failed to secure consumers’ personal information, including Oracle, Wyndham, and Lifelock
  • Businesses that we alleged misused consumers’ information, such as Sequoia One and CWB Services, LLC, or tricked seniors and others into disclosing their financial information, like Pairsys, Inc. and Click4Support, LLC; and
  • Organizations that we alleged violated children’s privacy, including Retro Dreamer and LAI Systems.

The FTC also hosted workshops and issued reports on cutting-edge issues such as the Internet of Things, cross-device tracking, and online lead generation. Earlier in Jan the FTC hosted PrivacyCon, a first-of-its kind FTC event examining pioneering research and trends in protecting consumer privacy and security.