How effective are data breach penalties? Are ever-bigger fines enough?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

For the past couple of years, data security company ViaSat UK has spiced up the Infosecurity Europe conference by filing an FoI (freedom of information) request for data breach statistics.

In previous years, things have ended up with ViaSat in a spot of biffo with the UK Information Commissioner's Office (ICO).

In 2011, ViaSat noted that "monetary penalties have been enforced in less than one per cent of the data losses [the ICO] has dealt with."

The company went on to suggest that this, combined with the modesty of some of the fines that were imposed, might lead to companies simply risking the fines as an alternative to doing the right thing:

Organisations could easily look at the £60,000 penalty meted out to [one company...] compared to the company's £145 million turnover, and its rarity, [...]and feel that the risk of ICO action is one they are prepared to take.

The issue of "paying instead of playing" is one that won't go away in the computer security field.

We ran a poll last year after Google coughed up $22.5 million to the US Federal Trade Commission (FTC) to dispose of charges that it "misrepresented privacy assurances to users of Apple's Safari browser."

We asked, "Are financial penalties enough to make the online behemoths play ball on privacy?"

Nearly 95% of the respondents said, "No."

That's a worrying degree of scepticism!

In 2012, the ICO brought the fight back to ViaSat, with the UK Information Commissioner on record referring to ViaSat's FoI request as a "stunt".

ViaSat's complaint in 2012 was that the private sector seemed under-represented in the statistics on UK data breach penalties, with just one penalty imposed in 263 self-reported cases, compared to eight penalties in 467 self-reported data breaches from the public sector.

This year's FoI request, however, revealed that the ICO handed out 20 penalties overall (instead of the nine in 2011/2012), in response to 1150 self-reported breaches (against the 730 in 2011/2012), and ViaSat's sound bites were correspondingly more conciliatory:

It's pleasing to see the ICO make good on its promise to use both the "carrot and the stick" when enforcing the Data Protection Act.

Some of the recent fines in the UK (or "monetary penalty notices" to give them their proper name) certainly haven't been trivial.

We've written about some of the big fines, sorry, monetary penalties, already on Naked Security.

There was £150,000 (about $230k) paid up by the Greater Manchester Police over an unencrypted USB key, for example, and £225,000 ($345k) paid by the Belfast Health and Social Care Trust.

Technologies such as encryption and DLP (data loss prevention) can, of course, go a long way towards helping you prevent data breaches, especially those that happen through ignorance or carelessness.

Device encryption, for example, helps you ensure that you don't end up making your files accessible to everyone (by accident or design) if you copy them to removable storage (by design or by accident).

And DLP heads you off at the pass before you cut-and-paste sensitive data to the wrong place, and makes sure that you don't include database fields you're supposed to omit when preparing reports.

But the abovementioned Belfast breach, you may remember, is an unyielding reminder that technology alone can't solve your data breach woes.

In that case, physical records were left behind in a mothballed hospital building; thieves broke in, got hold of confidential patient records and tried to sell them online.

Preventing data breaches is as much about attitude as it is about technology: the more you care about your own data and what happens to it, the better inclined you'll be to look after other people's.

So, why not take a look at Sophos's free IT Security DOs and DON'Ts - a downloadable toolkit which helps to keep some simple but effective security tips clear in your mind.

Check out IT Security DOs and DON'Ts

From videos and an employee handbook to posters you can put up round the office (yes, you'll see them on the walls at Sophos!), all the downloads are free, and no registration is required.

Follow @duckblog

View the original article here

Fake Tesco/Asda voucher scammers on Facebook hit with large fines

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Two firms have been fined a total of £450,000 (approximately US $720,000) for running a series of scams on Facebook.

The scams, which claimed to offer free vouchers and supermarket gift cards for the likes of Tesco and Asda, resulted in members of the public signing-up for expensive premium-rate phone services.

Australian firm mBill Pty and Amazecell Limited, based in Israel, were judged by PhonepayPlus - the regulatory body for all premium rate phone-paid services in the United Kingdom - to have run deliberately misleading promotions on Facebook.

The problem got so bad that Tesco warned its customers not to click on the offending links.

In two separate cases, mBill and Amazecell used affiliates to promote their premium rate competitions, exploiting social networking users trust in what their online friends had "liked" and "shared", and spreading rapidly.

The promotions - which took place in 2011 - included the lure of vouchers worth up to £250 for major retailers, including Tesco and Asda, with messages posted on Facebook users' walls. The messages were either shared on walls without the users' explicit permission, or users were told they were required to 'share' the promotion in order to have a chance of receiving a voucher.

According to PhonepayPlus:

"After clicking on the promotion consumers were misled into participating in premium rate competitions. Consumers believed that these were stages towards receiving the promoted offer and did not realise that by entering their phone number they would be charged."

"In the Amazecell case, consumers were charged £5 per question sent to their phone. Consumers were subsequently charged for further questions regardless of whether or not they answered them. Over 89,000 consumers entered the service only once but were sent a second question for which they were charged."

It's pretty despicable, in my opinion, to dupe people into believing they have a chance of winning a pre-release iPhone 4S for testing, grocery vouchers, theme park tickets or a new iPad or Dell laptop, only to sign them up for expensive £5-a-go SMS messages.

PhonepayPlus' Tribunal found that the companies had breached the Code of Practice by misleading consumers and not providing clear pricing information. Amazecell Ltd was fined £300,000 and mBill Pty Ltd was fined £150,000. Both have been ordered to refund any consumers who request a refund.

Aside from the Tesco and ASDA Facebook scams, Sophos has also warned of Facebook scams involving other retailers - including Argos, Pizza Hut, Costco, JB Hifi, Apple iTunes, Amazon, Tim Hortons and Starbucks.

Sadly Facebook is rife with scams such as this, duping users into making expensive mistakes and unwittingly tricking their friends to also sign up.

Make sure that you keep informed about the latest scams spreading fast across Facebook and attacks elsewhere on the internet. Join the Sophos page on Facebook, where over 190,000 people regularly share information on threats and discuss the latest security news.

Follow @gcluley

View the original article here