Frost Brown Todd Podcast

Latest Episodes:

Episode 67 - Data Flows After Brexit... For Now Jul 01, 2021

Show notes

Europe finds UK data privacy system adequate, for now. On June 28, 2021, the Europe Union granted two adequacy decisions to the United Kingdom for personal privacy purposes. 1. Decision on the adequate protection of personal data by the United Kingdom - General Data Protection Regulation 2. Decision on the adequate protection of personal data by the United Kingdom - Law Enforcement Directive This assures, for now, that data flows between the EU and UK can continue without restrictions. But for the first time, the EU’s decisions were not permanent and will last only four years. What’s going on? Because of Brexit, the UK and the EU reached a transition agreement at the end of 2020. This included six months for the UK and EU to reach an agreement about data privacy flows. The deadline approached, and the EU decision was made just in time (the UK had already issued its own adequacy decision regarding data going to the EU). Had it not been made, one estimate was that UK businesses would face immediate compliance costs of about 1.6 billion pounds, aside from other costs. So, UK businesses can rest easy – for a time. According to Kim Walker, a leading UK privacy attorney at the firm of Shakespeare Martineau (Kim Walker | Shakespeare Martineau (shma.co.uk), 11% of global data flows through the UK, and 70% of UK data flows through the EU. Why the last-minute timing and why the unusual temporary grant of an adequacy decision? The answer lies in the same surveillance issues that restrict data flows between the EU and the United States. Without a comprehensive and protective federal personal data privacy law, the United States is unlikely to receive an adequacy decision from the EU indefinitely. The EU is particularly skeptical of mass surveillance by U.S. authorities. The British mass surveillance system is not that different from the American approach to how and when public authorities can access private personal information. The EU is concerned that by granting adequacy to the UK, this could create a back door for the UK to grant unrestricted data flow to the United States, thus undermining Europe’s basic GDPR approach to restricting data flows that may disrupt the protections of personal privacy at the heart of GDPR. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 66 - Phone Scams and You May 09, 2021

Show notes

This is a true story of a phone scam of May 2021. The Data Privacy Detective got a call on the home landline. This scam will succeed in stealing money from countless Americans. It’s targeted particularly at older people who dearly love their television, especially during pandemic times. You can see the tricks and traps in this scam. Of course, the best defense is not to answer such calls at all, but then how can one know that a local number is not an old friend or acquaintance calling for a good reason. If you get a call like this, write down the details. Share them with the fraud hotline of the company being impersonated. Notify the FBI and the Federal Trade Commission if you have the time. This builds a file on these entities. Though it’s unlikely that law enforcement will be able to shut down the criminal syndicates and others active in this fund-raising activity, it will build the awareness that our privacy is attacked through such intrusions. Without greater regulation and defense against such increasing scams, there’s a risk that our communications systems become so riddled with such problems, that we’ll all retreat into a hole to avoid them. One definition of privacy is the right to be left alone. Anyone with a phone will find that hard to achieve. You can, however, work with your phone service provider to block calls in various ways. Check with your provider what restrictions you can put into place to limit calls from James Michael and Ralph Smith. Remember – protecting your personal privacy begins with you. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 65 - Ransomware Basics May 03, 2021

Show notes

This podcast episode explores ransomware from preventive, legal, and communications angles. While there’s no 100% effective vaccination against a ransomware attack, there are steps enterprises and each of us can take to beware, prepare, and take care. Ransomware. It’s the modern equivalent of kidnapping – except people aren’t grabbed and held hostage. Instead, an enterprise has its computer and information system locked by a criminal. Data gets encrypted and unusable until and unless the organization pays a ransom to the thief, who is known only by a digital address and often demands untraceable payment in cryptocurrency. Ransomware is a type of malware – software installed in a system by an outside party for bad purposes. Unlike malware focused on stealing data, ransomware aims to extract a ransom payment in exchange for decrypting and restoring the victim’s data. From a criminal’s perspective, ransomware is a simpler, less expensive way to get money than malware that aims to export (or exfiltrate) and resell data. It can be an “in and out” operation, not requiring search, download, categorization, and reselling of purloined data. Despite this, because data has great value, Blackfog estimates that 70% of ransomware attacks include data exfiltration, so that the attacks not only temporarily freeze data usage but result in a release of personal and business data to third parties as secondary damage. Ransomware theft is rising. Security sector experts report a 7-times increase in ransomware attacks between 2019 and 2020, with the average ransom demand increasing more than 3 times the prior year’s figure. Blackfog predicts cybersecurity theft will approach $6 trillion for 2021. CrowdStrike’s comprehensive summary of 2020 and early 2021 reports a four-fold increase in interactive intrusions in the past two years, with 149 criminal syndicate followed as tracked actors on its list of named adversaries. Ransomware is organized crime on a massive and global scale. For units of government, businesses, and non-profits (like universities and hospitals), ransomware can strike like a rogue wave at sea. But it’s often an attack more like a time bomb, lying in wait until the criminal gang is ready to demand its ransom at a time of its choosing. And when this happens, it can immobilize the organization’s ability to operate. Immediate action is required. How do we get our data back? Do we pay the ransom? If we do, will we get the data back? Even then, how do we know it’s safe? How can we prevent this from happening again? If it does, how do we deal with the immediate issues, recoup the data, and ensure it’s clean and usable? If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 64 - The Two Faces of Browsers and Our Privacy Options Apr 02, 2021

Show notes

Janus was the Roman god of doors, gates, and transitions. He needed two faces to look in both directions - life and death, past and future. Internet browsers allow us to access and gaze across the internet, but at the same time, they are watching us, recording what we do while browsing. True, browsers do not charge us for their services – browsing is free. But as it is said, when a product is free, we become the product – or more specifically, our data becomes the product. In this podcast episode Jeff Bermant, the founder and CEO of the browser Cocoon, joins us to explore how browsers and privacy intersect. Cocoon was founded for the purpose of providing a more privacy-secure experience than any other browser by creating a cocoon around the browsing individual. We discuss how users have data privacy choices – which browsers to consider, how to adjust privacy settings, and what add-ons are available for browsing. When it comes to data privacy, protecting your personal data begins with you. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 63 - Your Face, Time To Scrub? Mar 23, 2021

Show notes

Facial recognition. It’s a hot topic. Targeting, misidentification, and doxing - the dangers are real. So are the benefits – finding criminals and solving crimes, searching for relatives and old friends, researching history, conducting social research, sharing with friends over a lifetime. Kashmir Hill’s penetrating cover article in the March 21, 2021 New York Times Magazine, “Your Face is Not Your Own,” details how our photos are scraped and used by companies far beyond what we imagine. Our images are available from public sources such as driver’s licenses. Many arise from our choice– through Facebook and Instagram postings, directories, newspaper and other media sources. As the TV series Cheers’ theme song sang, “Sometimes you want to go where everybody knows your name.” But now it’s not just the neighborhood pub. It’s the internet, where everybody knows your name, and everybody can find your face. What to do? That’s where scrubbing comes in. Scrubbing is the effort to erase, stop, or minimize the spread of a digital posting. Scrubbing is a challenge. It can be expensive. Certain scrubbing services charge annual fees of $100 a year or more per person. In this episode we discuss what options are available to you, what governments are experimenting with to find a balanced solution, and if there is any hope to truly erase your face from digital history. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 62 - TIKTOK and Privacy: Challenges from Europe and America Feb 17, 2021

Show notes

On February 16, 2021 TikTok was sued in Europe for abusing consumer rights. Millions of Europeans use TikTok to post, share and watch videos 3 to 60 seconds long, ranging from dogs in pink tutus to Shaq dancing. The European Consumer Organization BEUC is an authorized entity in the EU to file complaints against businesses. Its press release, BEUC files complaint against TikTok for multiple EU consumer law breaches | www.beuc.eu, claims that TikTok engages in a “massive scale” of consumer abuse, including unfair and deceptive practices, terms of use that hurt consumers, failure to protect minors from harmful content and embedded advertising, and misleading use of personal data. By contrast, the U.S. President on August 14, 2020 issued an executive order to kick TikTok out of operation in the States unless it sold its American operations to a U.S. buyer. The Executive Order was based on TikTok’s Chinese ownership, which the prior U.S. Administration claimed was a threat to U.S. national security because the owner ByteDance was accessing personal data of U.S. persons that could be provided to PRC authorities. EO-on-TikTok-8-14-20.pdf (treasury.gov) TikTok successfully sued in several courts to block immediate enforcement of the Executive Order, a matter on appeal in the federal courts. On February 10, 2021, the Wall Street Journal reported that the Biden Administration decided that it would review the matter but was unlikely to pursue a forced sale to American companies. TikTok Sale to Oracle, Walmart Is Shelved as Biden Reviews Security - WSJ. What’s the future of TikTok as a Chinese-owned business that allows people to post, share and watch videos globally? And what does it mean for the world where business and human connections flow across borders? The Data Privacy Detective explores these puzzles in this podcast. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 61 - How Not To Get Phished! Jan 29, 2021

Show notes

Data theft set new records in 2020. The major causes are not failures of equipment, software, or services. In an estimated 85% of cybercrime, the cause is us. We make careless mistakes as though we were inviting villains into our homes. We let thieves into our IT systems by accident. We get phished. You get a message on your computer. It may seem to be from a friend, a trusted source, a reliable company, even your boss. It might seek an urgent response about something. How do you avoid dealing with the emailed message without letting a villain into your computer, and so into your personal or business’ IT systems? How do you prevent making a mistake that gives a cybercriminal the chance to freeze and hold your personal or your company’s IT system for ransom or to hack personal and proprietary information? Here are seven top tips to avoid being the reason you or your business is the victim of data theft. Check emailed messages for seven red flags before acting: 1. Bad spelling 2. Bad grammar 3. Nonsense in the subject line 4. Incorrect domain name in images and links (hover over a link without clicking to reveal this) 5. Pressure tactics to scare you into acting fast 6. Unexpected message 7. Unexpected attachments or links in the message

Episode 60 - Cyber Insurance: What it Does and Doesn’t Cover Jan 04, 2021

Show notes

As businesses move into 2021, what insurance can they have to limit cyber risk? What does cyber insurance cover and not cover? How is it priced and secured? Data Privacy Detective guest Sean McGee is a Vice President of USI Insurance Services, an independent company serving global clientele and accessing global insurance markets. www.usi.com / Sean.McGee@usi.com . Also an Ohio and Kentucky attorney, at USI Sean advises customers on a broad array of business risks, including those arising from personal data collection and use. Cyber insurance emerged in 1997. Insurance Journal reported 2019 premiums of over $2.2 billion, spread among a competitive range of providers, with growth anticipated in number of policies, variety of risks covered, and premiums. As one example, the average payment for ransomware attacks jumped to almost $85,000 by year-end 2019, almost double the prior year’s average, triggering an adjustment of price for covering this type of risk. Cyber insurance pricing is competitive. It depends on a company’s responses to questionnaires that can be 20 pages in length and interviews with CIO’s and others. Underwriters assess the strength and scope of an applicant’s cyber protection program before quoting a premium. A solid cyber policy will generally cover direct costs resulting from a data breach or incident. These include attorney fees and other costs of defense, resolution of private and public claims, expenses to recover purloined data, business interruption (subject to defined caps and other details), and similar out-of-pocket losses suffered from a cyber-attack. Policies generally cover global losses, including direct losses suffered in the European Union under GDPR. Coverage typically does not extend to more indirect losses, such as damage to reputation, costs to improve a system after an attack, or potential future lost profits as distinguished from business interruption loss. The more indirect or difficult to measure a loss is, the less likely it will be insured. Deductibles, caps and other limits, and unusual types of risks should be carefully reviewed before finalizing an insurance purchase. Top tips for businesses considering cyber insurance: -Have a top-to-bottom training program to help every individual avoid phishing and other incidents that lead to data breaches, ransomware attacks and other losses. -Have a data response plan in place before it’s needed, ready to activate immediately when required. -Think holistically. Preventing data attacks is not just a hardware problem. Review regularly measures to upgrade data protection, protect personal and proprietary data, and limit losses from data risks.

Episode 59 - Taiwan: A Bridge For East-West Commerce? Dec 21, 2020

Show notes

Taiwan is one of the “Four Asian Tiger” economies. Its companies hold 66% of the world’s semiconductor market. It consistently tops the USPTO per-capita list of patent files, and its population of about 25 million enjoys what is considered the world’s fastest internet connection. It is becoming a major player in data. Considered part of China by the PRC which refers to it as the “Taiwan Authority,” Taiwan declares itself to be the Republic of China. Despite geopolitical issues, robust business flows between the two. Taiwan is a leading investor in the PRC. Commerce between the two seems unimpeded by political differences. With rising tensions between the U.S. and PRC, alongside changes in Hong Kong that threaten the “one country two systems” approach, how should global business consider Taiwan? Is it a bridge for east-west data-related commerce? John Eastwood leads of the Taiwan firm Eiger Law’s Greater China Practice. John EASTWOOD - Eiger. In this podcast John explains how Taiwan is becoming a major Asian data, financial and regional headquarter center for North American and European businesses, growing to rival Singapore and Hong Kong. Personal privacy protection is highly valued and regulated by Taiwan law that differs significantly from the PRC’s data localization regimen. Taiwan generally blocks flows of personal information from Taiwan to the PRC, and so can be viewed as a safe haven for western businesses that collect and process personal and company data in Asia. Unlike the PRC, Taiwan does not require data to be shared at will with government authorities. Taiwan’s Personal Data Protection Act (PDPA) adopts entirely neither the U.S. nor the GDPR model, though it embraces most of the key principles of the GDPR. Taiwan’s Personal Data Protection Rules - Taiwan Business TOPICS (amcham.com.tw). More flexible and consent-based than the EU’s regulation but comprehensive unlike the U.S. sectoral approach, Taiwan in recent years has broadened the protection of personal data while aiming to be attractive to multinational business seeking an east Asian data hub. Taiwan is pursuing an “adequacy decision” with the EU while addressing numerous concepts differently from the GDPR’s provisions. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 58 - Personal Privacy and Community IT Systems Dec 20, 2020

Show notes

Data privacy is about balancing individual concerns and community needs. Without assurance that private information will be responsibly shared and used, people may not share accurate information or be willing to provide data at all. But to get student aid, applications must reveal sensitive family financial information. To gauge student success, performance details must be documented and shared with others. Sociological research requires that a database be accurate and credible. How can a community design its IT system to reassure individuals about privacy but obtain and share data responsibly and create data platforms and visualizations to meet collective needs and aspirations? This challenge is common to any community, whether it’s a city, a business, a university or other type of collective. In this podcast Lee Norris, Vice Provost for Enterprise Data Architecture of the University of North Carolina Greensboro, discusses how a community that gathers data of 25,000 people at its core and about 100,000 data subjects overall, designs and operates its data system. Through a combination of communication and technology, its data architecture stems from privacy by design. This approach advances essential ethical, research, institutional and other objectives, beyond compliance with federal and other laws that regulate particular types of data, such as student information (FERPA) and medical information (HIPAA). UNCG’s design starts with an understanding of individuals’ concerns and circumstances. By communicating clearly to data subjects (people) what data is needed, what data need not be shared, and what and how data will be handled and safeguarded within UNCG, the data system is created to encourage appropriate but limited data sharing. This is data minimization and privacy by design thinking. By building a culture of trust, UNCG has not found that its constituents are reluctant to share needed information. This in turn increases the accuracy and reliability of databases that UNCG staff create from data pools for a variety of purposes, ranging from assessing individual and collective student success to compiling research databases. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected