Frost Brown Todd Podcast

Latest Episodes:

Episode 77 - Data Localization - The Case of Singapore Dec 27, 2021

Show notes

The Data Privacy Detectives turns his data localization spotlight on the island nation of Singapore. With a per capita income of 64% higher than the United Kingdom’s and a free-market economy that depends on global trade and commerce, Singapore takes a very different approach from China, Russia, India, and other countries that strive to localize their residents’ personal information. Singapore’s Personal Data Protection Act (2012) provides a comprehensive set of rules protecting the personal information of its residents. Like GDPR in scope, it differs in its flexible approach to balancing privacy and national security protections. In 2020 Singapore’s Monetary Authority and the U.S. Treasury issued a joint statement opposing data localization requirements, calling them a risk to cybersecurity and economic growth. They called instead for data mobility in financial services as a spur to innovative services and economic growth and as a more effective approach to risk management and cross-border compliance. Singapore's broad privacy protection rules allow flexibility for businesses to comply, a model that U.S. regulators may wish to study as alternatives to data fencing or rigid regulation. In February 2021 Singapore’s Privacy Data Protection Commission published a guide of model clauses for processors to follow, regardless of where they are based and not requiring that a Singapore server be the data custodian. The island’s embrace of regional multinational compacts (Asia Pacific Cooperation Cross-Border Privacy Rules and Asia Pacific Economic Cooperation Privacy Recognition for Processors) offers a regional model different from China’s data nationalism. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 76 - Data Localization - The Case of Australia Dec 06, 2021

Show notes

Our prior podcast episodes detailed how China, Russia, and to a lesser extent India have created barriers to the free flow of personal information across borders. Data localization, sometimes called data nationalization, is the practice of governments to restrict or regulate closely how personal information of their citizens can be collected or shared outside a country. This podcast episode looks at how Australia, a free-market country, is handling personal data transfers. Australia has no broad data localization requirements. But it restricts the export of medical information about its residents. Electronic health records with personally identifiable information cannot be transferred or processed outside Australia. Australia’s Privacy Act, an early national data privacy law (1988), is comprehensive and different from GDPR. Collecting personal information is possible only if “reasonably necessary,” so does not require express consent. But Australia is protective of its citizens’ privacy interests. A 2021 order of Australia’s regulator against Clearview ordered it to cease collection of facial biometrics and destroy existing images of Australian citizens. Clearview argued with no success that the images were publicly available (and so did not constitute personally protected data) and that Clearview is a U.S. company with no establishment in Australia. If a free-market oriented country like Australia engages in data localization and the extraterritorial reach of its laws, what does this mean for the internet, global data business, and the privacy of people? Tune into this discussion in our fourth episode about data localization. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 75 - Data Localization - The Case of Russia Nov 09, 2021

Show notes

We turn to Russia in our data localization series. Russia’s 2015 personal data protection law requires “data operators” to collect and keep information about Russian residents within Russia. It forces them to keep personal data about its citizens on a Russian located server, which must at all times keep at least as much data as is kept on a company’s servers outside Russia. This law resulted in LinkedIn’s being blocked from the Russian internet in 2016 for failing to do this. In 2019 Russia expanded the authority of its regulator, Roskomnadzor, to levy fines instead of being limited to blocking for violations. While the fines are modest in amount, this lets regulators allow popular sites into Russia while insisting on data localization Russian style. In July 2021, Russia began requiring giant social media companies to establish a Russian presence to connect with Russian citizens. It’s believed that more than 600 foreign companies have registered with Russian authorities to participate in the Russian market and comply with Russian data laws. These include giants such as Microsoft, Apple, and Samsung. If they fail to comply with Russian law regarding the data of Russian citizens, they can face advertising bans or blocking of access. Russia’s approach lies between the stricter regimen of China and the globally open approach of the United States. Russia’s Government would argue that its laws are there to protect Russian citizens from data abuse by foreign companies. But tech protectionism and Russian sovereignty over its citizens’ internet use are also at work. Podcast Episode 75 asks what Russia’s data localization means for the original internet dream of communications and commerce across borders. Tune in for the conversation. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 74 - Data Localization - The Case of India Nov 02, 2021

Show notes

In this second podcast episode about data localization, we spotlight India. Since 1993 the world’s largest democracy has enacted data localization laws aiming to keep certain personal records within India or otherwise restrict data transfers of Indians’ personal data. When in 2017 the Indian Supreme Court found personal privacy to be a fundamental constitutional right, a Personal Data Protection Bill (PDPB) was promptly drafted. It has since been percolating towards adoption. The draft bill defines certain personal data as “critical” and so must be stored only within India. Other data is called “sensitive,” and may be processed outside of India with a copy kept within India. A third category of “regular” data could be transferred abroad, pursuant to data transfer rules. Unlike China, reviewed in the last podcast episode (episode 73,) India has a robust tech industry heavily involved in processing foreign data. India processes more personal data than any other country, so that parochial data laws would stand in stark contrast to this essential industry of India. Yet, Amazon, Facebook, Google and other global businesses dominate the Indian home markets, unlike their absence from China. Protectionist forces within India are calling for strict data controls, purportedly to protect the privacy of Indian residents while also favoring the interests of local tech and other firms. Indian businesses such as Reliance talk of “data colonization,” the idea that foreign companies control too much of the data of Indian residents and are plundering the wealth of India as measured by the data of its 1.3 billion people. Indian sources expect the PDPB to be enacted in the winter session of 2021-22. The enacted version will reveal whether India adopts a protectionist approach to data or embraces a more global approach to how personal data is collected and processed. This in turn will affect how other nations will respond. The outcome will affect how data privacy is enhanced or diminished as the rules governing data evolve country by country. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 73 - Data Localization - The Case of China Oct 18, 2021

Show notes

The internet and the worldwide web – the words envision a global communications system that transcends national borders. But the reality differs. Is it increasingly the splinternet? Is www really a series of webs that don’t connect globally? And how is our privacy affected by data fences and controls erected by nations? In this first of a series, we explore how China deals with personal information of its residents. China collects a vast array of personal information about its people – financial, judicial, commercial, societal, and governmental. These are the five pillars of China’s Social Credit System, which aims to reward loyal and trustworthy citizens and penalize others, based on information collected about Chinese residents. Individuals are white-listed or black-listed to be rewarded or penalized, based on personal data collected, analyzed, and applied by the Government to encourage a socially proper citizenry. China has an extensive and evolving set of laws, including recent changes to its Data Security Law, Cybersecurity Law, and the forthcoming Personal Information Protection Law, which aim to keep within China’s borders “personal information” and “important data.” This allows China to prevent transfers of these two types of data to other countries. But the definitions of “personal” and “important” data are left to a vast array of sectoral ministries and regulators and to other national, regional, and local organizations, which may issue categories or lists to define and apply these broad terms. By contrast, China is free to import personal information of non-Chinese residents. Take TikTok, for example. Over twenty million U.S. persons use TikTok, owned by a Chinese company. It is not clear whether the personal information TikTok collects is made available to the Chinese Government, pursuant to PRC laws and procedures. If Chinese companies and Government can collect personal information about U.S. citizens but U.S. companies and Government cannot collect and utilize personal information about Chinese citizens, this creates an imbalance of trade and business opportunities. Is this a path to a data trade war? And if our personal information can be shared beyond our country’s borders, will this change what data we post and share within our borders? This podcast explores how China affects personal privacy and the future of the internet. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 72 - Personal Privacy Within Your Home Sep 30, 2021

Show notes

Home is our private place. But in the digital age, how private are our homes? And what can we do to protect our privacy from home invaders? 66% of us rate our highest privacy concern as being viewed through cameras in our own homes, according to a safehome.org June 2021 survey. Explore in this podcast how home devices are watching, listening, collecting, and sharing our personal data and steps we can take to limit unwanted intrusions. Terry Rankhorn, a 22-year FBI veteran and founder of Rankhorn & Associates, conducts home and business sweeps to protect clients’ personal data and safety. Computers, televisions, smart thermostats, Alexa and Siri, even dog bowls collect and broadcast our personal data in unimagined ways, jeopardizing our privacy and security. Mr. Rankhorn explains the first step to increase home privacy is to know what devices we have and which ones collect and broadcast our data. We can delete devices we don’t need or want and use privacy setting choices and common-sense steps to limit sharing. We can adjust our smart thermostats when away for an extended time, to prevent hackers from knowing from thermostat data when our homes are vacant and so are ripe burglary targets. We can protect our personal data from devices we literally live with. This podcast episode offers practical advice about how to do that. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 71 - Doxing and Kentucky’s Pioneering Anti-Doxing Statute Aug 30, 2021

Show notes

Kentucky is perhaps the first state to adopt a comprehensive anti-doxing statute that creates a civil tort of doxing, as well as providing explicit criminal penalties for defined doxing conduct. It allows Kentucky residents to sue someone for intentionally disseminating their personal identifying information (PII) with an intent to intimidate, abuse, threaten, harass, or frighten a person or immediate family or household member. In this podcast episode, Justin Fowles, an attorney in Frost Brown Todd LLC's Louisville, Kentucky office, shares key insights on what the new law contains and could mean for individuals' and businesses' online behavior. What is doxxing – or is it doxing? This word entered the Merriam-Webster Dictionary in the 21st century. It defines “dox” as a verb – “to publicly identify or publish private information about (someone) especially as a form of punishment or revenge.” Today it connotes cyberbullying or troll harassment by posting personal information about a targeted person or organization, urging others to take action intended to shame or expose the target. Doxxing has had tragic ends. Doxed individuals have had surprise visits by SWAT teams breaking down doors to targets’ homes based on the doxer’s false message that a kidnapping or domestic violence was occurring there. Death and more commonly emotional stress arise from doxing attacks. A federal anti-stalking statute includes the language “interactive computer service or electronic communication service” within it. If a person uses such services with intent to kill, harass or otherwise target persons in specific ways that puts them in reasonable fear, causes substantial emotional distress, or otherwise causes them to suffer specified harm, a doxer can be criminally prosecuted. But federal prosecutions are rare, and no U.S. statute was designed specifically to combat doxing. Enter the states. Kentucky's anti-doxing statute creates a civil tort of doxing, as well as providing explicit criminal penalties for defined doxing conduct. Effective June 29, 2021, the Kentucky statute was passed by a Republic legislature with Democratic support and signed by a Democratic governor. It allows Kentucky residents to sue someone for intentionally disseminating their personal identifying information (PII) with an intent to intimidate, abuse, threaten, harass, or frighten a person or immediate family or household member. The spread of PII must be such that a reasonable person would be in fear of physical injury to the targeted person or an immediate family or household member. Intent is measured by what would cause a reasonable person to be in fear of physical injury personally or to a family or household member, rather than requiring express proof of the doxer’s actual intent. Organizations should consider how best to avoid being either a doxing victim or a doxing perpetrator. Organizations could face civil and criminal challenges under Kentucky’s statute as to their use of personal information if communicated within the scope of the statute’s reach. Businesses and other organizations should review the personal information they hold and how it is shared or communicated, to avoid being charged with a doxing tort or prosecution. Organizations can likewise review defenses to being doxxed. The anti-doxing statute could suggest responses and provide recourse to unfair personal attacks on company personnel. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 70 - Backup Copies: Preserving Your Privacy and Business Data Aug 17, 2021

Show notes

Mike Potter’s cat bounced on his keyboard years ago. His hard drive cratered, and he lost his data. But he turned this disaster from feline treachery into a career and a company. Backing up data is an essential part of data privacy and retention for businesses as well as for people. Why is this, how does it work, and what’s the impact on how we keep and protect our data? Mike Potter is CEO of Rewind, an Ottawa, Canada based company that backs up, restores, and copies to its cloud critical information businesses store in their SaaS (Software as a Service) applications. Apps sit atop a user’s platform. Not unlike cats, they can cause problems. Ransomware attacks, employee mistakes, and many other forces can cause a business to lose essential data even when the platform itself is running well. Having a readily available backup copy can allow a business to continue its customer connections, its bookkeeping, and other essential functions without material disruption. That’s the business of Rewind. Many Rewind customers are retail and other small to midsized businesses that use Shopify, QuickBooks, and other platforms for customer interface and keeping other essential data. While major platforms have good cybersecurity protection, none is immune from a hack attack. But beyond that, a business using a SaaS platform may not realize that its own account remains vulnerable to data loss. When a data loss occurs, the affected business must decide whether this constitutes a data breach, and if so, whether data breach regulations require immediate and usually expensive remedies. A backup copy can help determine the cause of a data loss, whether from bad actors or accident. It’s a starting point to discern what went wrong and how a repeat can be avoided. It may lessen the impact of a ransomware attack if the data held hostage is available to the business anyway without paying a ransom to recoup the data. When engaging a backup copy provider, a business should consider whether the provider has ample privacy protection for its business. A shaky backup vendor would represent a second vector for hack attacks. A business should vet companies that provide such services. Effective ones will offer services that include keeping data on servers within jurisdictions that have data localization requirements, having funds to afford first-rate cybersecurity protections, offering a 24/7 hotline, and providing excellent customer support. Tips from Mike Potter to businesses on how to keep essential data private and secure when using SaaS platforms: 1. Make sure to use a password manager. 2. Use two-factor authentication. 3. Vet third-party apps before installing them about their strength and capabilities. 4. When you add teammates, make sure they receive the minimum level of permission needed. 5. Have a backup available. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 69 - Ransomware, Negotiating With Digital Kidnappers Jul 27, 2021

Show notes

Ransomware. It’s in the headlines. It’s digital organized crime across borders. When an organization’s IT system freezes with its data locked by a ransomware gang, what happens? Ransom is demanded, and ransom often gets paid. But how does this work? In this podcast episode, Bill Repasky, attorney with Frost Brown Todd LLC, shares key insights on the process of negotiating with ransomware criminals. They want payment in cryptocurrency. Victims want their data and systems restored. This becomes a business transaction. But not a typical one. Ransomware strikes in 2021 involve highly sophisticated criminal syndicates. To them it’s about the money. When they strike a target and freeze the organization’s ability to operate an IT system, they reveal their digital identity and dictate how to send a ransom payment. The target may be willing to pay – but should do so only after negotiations to ensure that the payment will accomplish two essential objectives – (1) providing a decryption key to unlock the encrypted data and restore the IT system’s operation; and (2) ensuring that the data has not been taken (exfiltrated) by the criminals, or if it has, to have it returned with no copies kept by the criminals. The victim organization should check before making payment to be certain it does not violate U.S. sanctions laws by paying a group or person listed on the OFAC list. See Specially Designated Nationals And Blocked Persons List (SDN) Human Readable Lists | U.S. Department of the Treasury. Successful conclusion of a ransomware attack requires expertise, patience, and insight. Learn how it’s done, pitfalls to avoid, lessons from past victims. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 68 - Catching Cyber-Criminals With Digital Forensics Jul 07, 2021

Show notes

Ransomware attacks, data breaches, digital theft – on the rise. Who are the cyber-criminals? Can they be traced? And what can a company do to minimize risk and respond to an incident? Joining us for a tour of the dark side of the digital age is Bill Corbitt, Vice President of Digital Forensics and Incident Response at Intersec Worldwide. www.intersecworldwide.com, a US-based team of former federal cybersecurity experts who have worked on some of the world’s largest security breaches. The firm was named a 2021 top Digital Forensics & Incident Response firm by Enterprise Security Magazine. Bill’s team has addressed serious incidents for many Fortune 100 companies. In this podcast episode he shares insights into dealing with ransomware attacks, data theft, and the aftermath. Ransomware attacks are conducted by sophisticated criminal enterprises, usually operating from data havens where government seldom prosecutes them for attacks abroad. They probe for vulnerabilities and find attack vectors into a company’s IT system, freeze digital operations, then post a ransom demand before releasing their grip that can paralyze the victim’s business. Modern digital forensic techniques can generally identify the attackers. The quicker an attacked business engages a forensic expert, the more likely it is that the perpetrator can be identified. Ransomware attackers increasingly have two waves of ransom demand – the first to unlock the system, the second to promise not to release exfiltrated data to the world. Every ransomware attack should be viewed as a data breach, though it is possible for a forensics expert to determine if data has been taken rather than only temporarily encrypted. Cybercrime, like all crime, will not disappear. If there is money to be made, criminals will seek it. Minimizing risk is essential. Businesses should constantly upgrade their entire IT systems, eliminating weak points and discarding outdated elements. Those with access to company computers and systems need training and discipline to view company property and data with care. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected