June 2016

Practice Fusion, a cloud-based electronic health record company, has agreed to settle Federal Trade Commission charges it misled consumers by soliciting reviews for their doctors, without disclosing adequately that these reviews would be publicly posted on the Internet resulting in the public disclosure of patients’ sensitive personal and medical information. The settlement with the FTC will prohibit Practice Fusion from making deceptive statements about the privacy or confidentiality of the information it collects from consumers, and will also require the company, prior to making any consumers’ information publicly available, to clearly and conspicuously disclose this fact and obtain consumers’ affirmative consent.

“Practice Fusion’s actions led consumers to share incredibly sensitive health information without realizing it would be made public,” said Jessica Rich, Director of the FTC’s Bureau of Consumer Protection. “Companies that collect personal health information must be clear about how they will use it – especially before posting such information publicly on the Internet.”

A Silicon Valley county has become the first in the United States to vote in a new law that requires "continued oversight and regular evaluation" for law enforcement agencies prior to the acquisition of surveillance technology. The ordinance, which was unanimously approved by the Santa Clara County Board of Supervisors, requires that the county sheriff's and the district attorney’s offices seek board approval before those agencies even begin the process of obtaining new snooping gear. The agencies are not required to immediately notify the board in exigent circumstances, but they must do so within 90 days.

Agencies must also submit a usage policy to the county government and, notably, an "Annual Surveillance Report," which should describe what data the device captures, how the agency deals with information collected about people not suspected of any wrongdoing, and whether the gear has been effective, among other requirements. "The ordinance doesn’t prohibit the acquisition of any surveillance technology," said Supervisor Joe Simitian, a longstanding local privacy advocate and former state senator. "It says if you’re going to acquire any surveillance technology, let’s talk about privacy and due process rights." "The issue is not the technology. The question is whether or not we have the wisdom to use the technology appropriately," he added.

The Federal Communications Commission is giving proxy bidders more flexibility in lowering their asking price for TV spectrum in the broadcast incentive auction that began May 31. Bidders can set the system to accept the FCC's lower bids automatically—by proxy—but in the initial rounds, the FCC would not accept an automatic lower bid (sort of like the reverse of an eBay auction automatic higher bid) floor--lower than which a broadcaster would not go--of less than 75% of the current bid.

Setting a maximum percentage drop for proxy bids was a "safety mechanism," said the FCC, to "ensure bidders do not accidentally enter a dollar figure much lower than they had intended." Given that the auction is now in round 11—as of 10 a.m. June 8—bidders should be familiar with the process and so the FCC Wednesday changed the automatic bid percentage to be no less than 50% of the current bid. That means that if a current bid were, say $100 million, the previous automatic proxy bid could be no less than $75 million. Now it could be no less than $50 million.

It’s a good time to be a cybercriminal. There are more victims to target, there is more data to steal, and there is more money to be made from doing so than ever before. It would seem to follow, then, that there’s been very little progress since 2007, when hackers stole at least 45.6 million credit-card numbers from the servers of TJX, the owner of TJ Maxx and Marshalls, catapulting the now-commonplace narrative of the massive data breach to national prominence. But the truth is that the forces of cyber law and order have made lots of headway in the past decade.

There are still large-scale data breaches, but credit-card companies are getting better at detecting them early and replacing customers’ cards as needed, payment networks are pushing microchip-enabled cards that render transaction data worthless to criminals, and law enforcement has gotten smarter and savvier. Cybersecurity is often framed as a matter of keeping up with the rapid evolution of online attacks—patching software vulnerabilities and identifying new malware programs. But cybercriminals’ most crucial adaptation in recent years has little to do with their technical tools and everything to do with their business model: They have started selling stolen data back to its original owners. To keep cybercrime profitable, criminals needed to find a new cohort of potential buyers, and they did: all of us. At the heart of this new business model for cybercrime is the fact that individuals and businesses, not retailers and banks, are the ones footing the bill for data breaches.