My cartoon on why notice and choice is often not enough.
My cartoon on why notice and choice is often not enough.
This post is a reprise of a post I wrote many years ago that has remained popular. I thought I’d repost it now, during exam grading season, to help professors who want to learn the science and art of grading exams.
It’s that time of year again. Students have taken their finals, and now it is time to grade them. It is something professors have been looking forward to all semester. Exactness in grading is a well-honed skill, taking considerable expertise and years of practice to master. The purpose of this post is to serve as a guide to young professors about how to perfect their grading skills and as a way for students to learn the mysterious science of how their grades are determined.
This cartoon depicts the potential future of the Internet of Things. As more and more devices are connected to the Internet, including ones implanted in people’s bodies, increasing thought must be given to the privacy and security implications. The speed of technological development is moving at a far greater pace than the speed of policy thinking regarding privacy and security.
How will the security of new devices be regulated? The market doesn’t seem to be adequately addressing the security of the Internet of Things. Bad security in devices has externalities beyond the users, as devices can be used as part of botnets to attack other targets.
How will privacy be designed into devices? How will notice and choice work? When privacy is “baked in” to a device, do the engineers have a comprehensive understanding of privacy? How will consumers be able to understand and respond to these design choices?
Should there be special considerations for medical devices or any device that is implantable in a person?
We still await satisfactory answers to these questions . . . but the expansion of the Internet of Things isn’t waiting.
Here’s an earlier cartoon I created regarding the Internet of Things:
My cartoon depicts the discrepancy in the security and privacy budgets at many organizations. Of course, the cartoon is an exaggeration. In an IAPP survey of Chief Privacy Officers at Fortune 1000 companies in 2014, privacy budgets were nearly half of what security budgets were. That’s actually better for privacy than many might expect. Outside the Fortune 1000, I think that privacy budgets are much smaller relative to security.
Fortunately, it does appear that privacy budgets have increased according to the 2016 IAPP-EY Annual Privacy Governance Report which surveyed 600 privacy professionals from around the world. Though the data captured in 2016 has far more details, comparing the charts published by the IAPP in 2015 vs 2016, you can see a significant increase in total privacy spend.
This cartoon is about snooping, one of the most common HIPAA violations. HIPAA prohibits accessing information that people don’t need to do their jobs. It can be easy to look at electronic medical records, and people who snoop in this way might not perceive it as wrong. But the cartoon invites people to imagine how creepy the snooping would appear if it were occurring right in front of patients. Computers remove the interpersonal dynamic, making it harder for people to fully appreciate the wrongfulness of their conduct.
Though the high-profile, celebrity snooping incidents garner all the media attention, smaller cases affecting everyday individuals make up the bulk of the cases and legal activity. A large number of inappropriate access claims involve people checking on protected health information (PHI) about family and friends. Snooping is not intended maliciously. Often a concerned staff member will access the patient records of a family member or acquaintance out of worry or concern. In one case, a nurse in New York was fired for disclosing a patient’s medical history to warn a family member who was romantically involved with the patient of the patient’s STD.
It’s time for a third installment of the funniest hacker stock photos. Because I create information security awareness training (and HIPAA security training too), I’m always in the hunt for hacker photos. There are so many absurd ones that I can make enough Funniest Hacker Stock Photo posts to keep pace with Disney in making new Star Wars movies!
So without further ado, here are this year’s pictures:
This hacker hacks the Amish way — without the use of technology or electricity. Who needs a computer when a good old magnifying glass will suffice? The key to this technique is to be very sneaky. For seasoned hackers who steadfastly believe in doing things the old-fashioned way, this is how it is done! As this hacker says: “Yes, grandson, we had to walk six miles in the snow and hack with magnifying glasses . . . you young folks have it so easy these days!”
Why use just one magnifying glass when you can use two? Magnifying glasses are really important to read tiny text on computer screens. Figuring out how to enlarge the font in Windows can be tricky, and good hackers figure out “hacks” to make things faster and easier.
I’m not entirely sure what this guy is doing, but I presume that he’s so good of a hacker than he can hack with the screen facing in the wrong direction. The only problem is that there’s nothing on his computer screen — I think he needs to stop smiling and start working a bit harder.
In an earlier edition of this series, I commented extensively on hacker gloves. In this edition, it’s time to turn to the masks hackers wear. I’ve always wondered why so many hackers wear masks. Isn’t a good hacker supposed to be hard to trace? After extensive research, I have learned that hackers wear masks because when they hack from halfway across the world and try to conceal their tracks, they might somehow mess up and accidentally expose their faces from their webcams. Or, maybe it’s just a fashion statement. I still have more research to do about this very important question — I’m just waiting for some funding to support this important research.
Regarding the mask above, it’s part of a new trend. Ordinary hackers wear ninja masks, but that’s starting to become a bit passe among hacker fashion experts. Trend leaders are wearing much more elaborate masks these days.
Hacking is easy. My latest cartoon is based on the fact that many hacking attacks involve rather simple and common tactics. Why try the hard stuff when the easy stuff works so well? All it takes is for one person to fall for a social engineering trick, and the hackers can break in.
Here’s a cartoon on HIPAA and social media use to jump start your week. You can’t think enough about HIPAA these days. HIPAA audits are back, and OCR is having a vigorous enforcement year this year, something I plan to post about soon.
I created this cartoon to illustrate the fact that despite the increasing risk that privacy violations pose to an organization, many organizations are not increasing the funding and resources devoted to privacy. More work gets thrown onto the shoulders of under-resourced privacy departments.
It is time that the C-Suite (upper management) wakes up to the reality that privacy is a significant risk and an issue of great importance to the organization. Looming on the horizon is the enforcement of the new EU General Data Protection Regulation (GDPR), which will begin in 2018. It’s never too early for organizations to start preparing. GDPR imposes huge potential fines for non-compliant organizations — up to 4% of global turnover in many cases. For more information, see the FAQ page I created about the GDPR and privacy awareness training.
Of course, the C-Suite may be quick to say that privacy is very important, but what matters most are the actions they take. Privacy office budgets and sizes should be going up by a lot these days.
A recent article in Wired argues that it is time to kill password recovery questions. Password recovery questions are those questions that you set up in case you forget your password. Common questions are:
In what city were you born?
What is your mother’s maiden name?
Where did you go to high school?
HIPAA is famously impenetrable, with so many special terms and definitions. I wrote this cartoon to capture the wonderful world of HIPAA jargon, which I hope fellow lovers of HIPAA can appreciate.
For those who want an introduction to HIPAA and how the Privacy Rule and the Security Rule work, I produced a series of courses on HIPAA for the American Health Information Management Association (AHIMA). Each course is approximately 1 hour long. The courses are:
• HIPAA Privacy: The Pillars of a Privacy Program
• HIPAA Privacy: Rights and Responsibilities
• HIPAA Security: Safeguarding PHI
These AHIMA HIPAA courses are not for the entire workforce — the courses are for personnel who focus on HIPAA compliance and need to understand the basics of how HIPAA works. My HIPAA training for the workforce is shorter as well as more basic and general.
I have another HIPAA cartoon here.
Here’s a cartoon I created. It involves several Fair Information Practice Principles (FIPPs) and privacy best practices. The ones involved (and not heeded) in this cartoon are doing a data inventory, informing people about the purposes of the collection of their data, using data for only those purposes, and not keeping data longer than necessary to accomplish those purposes.
For many organizations, there is a lot of data collected that gets stored and forgotten, or that is collected with no apparent purpose in mind. Data inventories are a great way to take stock of this data and determine whether it is really necessary and appropriate to keep it.
I have good news and bad news about ransomware. First, the good news — here’s a cartoon I created. I hope you enjoy it, because that’s the only good news i have. Now, for the bad news . . .
Everyone seems to be afraid of ransomware these days, but is the fear justified? Is ransomware more about hype than harm? Unfortunately, a recent study of international companies conducted by Malwarebytes provides some startling statistics to back up the fears. According to the study, 40% of companies worldwide and more than 50% of the US companies surveyed experienced a ransomware incident in the last year.
The stakes are very high — 3.5% of companies surveyed even indicated that lives were also at stake which was exemplified by a recent attack in Marin, California where doctors lost access to patient records for over 10 days.
Recently, HIPAA celebrated its 20th birthday. HHS issued a celebratory blog post. HIPAA is 20 years old if you start counting from the date the statute was passed (1996). If we measure HIPAA’s age from the date that the HIPAA Privacy Rule became effective (2003), then HIPAA is 13.
So HIPAA could be 20 years old, eager to become 21 and be able to drink (right now, it just makes people want to drink) or 13 years old and about to begin being an unruly teenager.
A few years ago, I published an article in the Journal of AHIMA to celebrate HIPAA’s 10th birthday (counting from when the Privacy Rule became effective). The article discusses HIPAA’s growth and impact, and is a quick read if you’re interested. You can download it for free here:
HIPAA Turns 10: Analyzing the Past, Present, and Future Impact
84 Journal of AHIMA 22 (April 2013)
Here’s a cartoon I created to illustrate the importance of security awareness training. I hope you find it amusing.
After years of careful study and extensive analysis, I have arrived at a solution to all the privacy and data security problems worldwide. Although I’ve been advised that I shouldn’t give away such a perfect solution to such a vexing problem for free, my drive to altruism is simply too strong.
Without further ado . . .
Don’t collect personal data.
There is another solution — not quite a miracle cure all, but definitely very helpful — privacy and cybersecurity training! And that’s no joke.
With Professor Woodrow Hartzog, I have also solved the challenge of legal compliance more generally: The Ultimate Unifying Approach to Complying with All Laws and Regulations, 19 Green Bag 2d 223 (2016).
Back by popular demand, it’s time for another round of the funniest hacker stock photos. Because I create information security awareness training (and HIPAA security training too), I frequently find myself in need of a good hacker photo.
But good hacker photos are hard to find. I often browse through countless images, each one more ridiculous than the next.
By Daniel J. Solove
The SplashData annual list of the 25 most widely used bad passwords recently was posted for passwords used in 2015. The list is compiled annually by examining passwords leaked during a particular year. Here is the list of passwords for 2015, and below it, I have some thoughts and reactions to the list.
Professor Woodrow Hartzog and I have just published our new article, The Ultimate Unifying Approach to Complying with All Laws and Regulations, 19 Green Bag 2d 223 (2016). Our article took years of research and analysis, intensive writing, countless drafts, and endless laboring over every word. But we hope we achieved a monumental breakthrough in the law. Here’s the abstract:
There are countless laws and regulations that must be complied with, and the task of figuring out what to do to satisfy all of them seems nearly impossible. In this article, Professors Daniel Solove and Woodrow Hartzog develop a unified approach to doing so. This approach (patent pending) was developed over the course of several decades of extensive analysis of every relevant law and regulation.
By Daniel J. Solove
Dr. Seuss’s Green Eggs and Ham is a timeless classic that is read to millions of children. At first the simple rhymes and cute drawings are alluring. But parents will soon discover the book’s terrifying equation: The tiresome repetition of the book multiplied by the number of times a child will want the book read. The result is mind-numbing and will make parents curse the day they decided to make the book part of their child’s library.
. . . the Empire would have won. A search of records would have revealed where Luke Skywalker was living on Tatooine. A more efficient collection and aggregation of Jawa records would have located the droids immediately. Simple data analysis would have revealed that Ben Kenobi was really Obi Wan Kenobi. A search of birth records would have revealed that Princess Leia was Luke’s sister. Had the Empire had anything like the NSA, it would have had all the data it needed, and it could have swept up the droids and everyone else, and that would have been that.
There is an important lesson to be learned from Star Wars: If you are trying to establish and maintain a ruthless Empire, you can greatly benefit from better data aggregation and analysis.
By Daniel J. Solove
I produce computer-based privacy and data security training, so I’m often in the hunt for stock photos. One of the hardest things in the world to do is to find a stock photo of a hacker that doesn’t look absolutely ridiculous.
I’ve gone through hundreds of hacker stock photos, and I’ve discovered some that are so absurdly funny that they are true classics and deserve to be celebrated in a hall of fame. So I bought some of these gems to share them with you — because if there’s any sense of justice in the universe, when so much thought, creativity, and effort goes into a stock photo, it deserves to be sold.
I’ve been following the recent controversy over the TSA’s body imaging X-ray machines, otherwise known as the “backscatter” or “exhibit-yourself-in-the-nude” devices. It made me reminisce about an old post I wrote about the Playmobil airline screening playset.
I had not used the playset for a while. Five long years have elapsed since my post, and I had outgrown this toy and moved on to more advanced ones. But this recent controversy made me regress. . . .
After blogging a few weeks ago about the airline screening playset, I went ahead and ordered one.
Each day, I would check my mailbox, eager with excitement about its arrival. Today, it finally arrived. I rushed to open it and began what would be hours of exciting play. Here’s what came in the playset:
I was a bit disappointed in the toy’s lack of realism. There was only one passenger to be screened. Where were the long lines? The passenger’s clothing wasn’t removable for strip searching. The passenger’s shoes couldn’t be removed either. Her luggage fit easily inside the X-ray machine. There were no silly warning signs not to carry guns or bombs onto the plane. And there was no No Fly List or Selectee List included in the playset.
Another oddity was that the toy came with two guns, one for the police officer and one that either belonged to the X-ray screener or the passenger. The luggage actually opened up, and the gun fit inside. I put it through the X-ray machine, and it went through undetected. Perhaps this is where the toy came closest to reality.
The biggest departure from reality was that the passenger had a cheery smile on her face.