It has been revealed that US authorities found out about the Spectre and Meltdown chip flaws from media reports rather than being informed directly by US computer chip manufacturer Intel.

What Chip Flaws?

Back in January, researchers from Google’s Project Zero, the Technical University of Graz in Austria and the security firm Cerberus Security in Germany, discovered that two major security flaws are present in nearly all modern processors / microchips. The hardware flaws were dubbed ‘Spectre’ and ‘Meltdown’.

Meltdown affects all Intel, ARM and most other processors on the modern market. It is believed that Meltdown could affect every processor since 1995, except for Intel Itanium and Intel Atom before 2013. The flaw could, for example, leave passwords and personal data vulnerable to attacks.

Found Out Via The Media

In this latest revelation, news has emerged that Intel didn’t inform US cyber-security officials about the flaw in its processors until after the news had been leaked to the media.

Google’s parent company Alphabet has said it informed Intel, AMD and ARM about the chip flaws in June 2017, and the three semiconductor / chip manufacturers were given 90 days to fix the flaws before disclosing the discovery of the flaws and the fix to the public. According to Alphabet, and in keeping with ‘standard practice’, it had left it up to the companies to decide whether they should inform government officials about the security flaws.

Extended

In response, Intel gives a slightly different version of events. According to Intel, Google Project Zero had chosen to extend the 90-day timeframe to 9 January 2018, and Intel had agreed to keep the information confidential until that date.

No Exploits Anyway

Even though there is general agreement that the security flaws are now present in nearly all modern devices, including all iPhones, iPads and Macs, Intel has been quick to stress that there have been no known exploits to date.

What Does This Mean For Your Business?

It is worrying that ‘standard practice’ in the industry is to be allowed to keep quiet about a security problem for 3 months from government cyber-security officials, and from the public. It is also worrying that it took journalists to uncover the problem, particularly when you consider the sheer scale of the flaws i.e. that they’re present in almost all modern processors.

There have been far too many stories of large, well-known companies choosing to keep quiet as long as possible about cyber / data security risks or breaches, and these episodes all serve to undermine confidence that companies will act responsibly themselves, without the threat of new regulations and huge fines (such as those that GDPR will bring).

The best advice to businesses is now to install all available patches for the flaws without delay, and to make sure that you are receiving updates for all your systems, software and devices.

Regular patching is a good basic security habit to get into anyway. Research from summer 2017 (Fortinet Global Threat Landscape Report) shows that 9 out of 10 impacted businesses are being hacked through un-patched vulnerabilities, and that many of these vulnerabilities are 3 or more years old, and there are already patches available for them.

Technology and employment commentators are predicting that with the already high demand for skilled and talented Data Protection Officers (DPOs), the introduction of GDPR may see businesses having to compete to recruit the right one.

What’s A Data Protection Officer?

A DPO’s role is essentially that of looking after any legal and ethical issues related to handling customer data. They are required to have specialist knowledge in matters relating to data and information privacy and security.

What Is Demand For DPOs Like Now?

According to figures from the Indeed job search site, DPO job listings posted in the UK have increased by no less than 700% over the past 18 months. That’s the equivalent of an increase from 12.7 listings per 1 million in April 2016 to 102.7 listings per 1 million in December.

Triggered An Increase In Training

The huge increase in the demand for DPOs has led to a corresponding increase in the demand for GDPR training, as individuals spot a potentially lucrative career, and companies seek to bring their in-house DPOs up to speed.

Some GDPR training providers have reported selling out of courses for the next six months as demand for GDPR-Ready training programs for DPOs have increased by as much as one-third.

Even Bigger Demand With Introduction of GDPR

The International Association of Privacy Professionals (IAPP) estimates that, with the introduction of GDPR in May this year, 28,000 DPOs will be needed in Europe and U.S. and perhaps as many as 75,000 around the globe.

Why?

GDPR requires that companies must have a DPO to help with tasks such as data audits for compliance with privacy laws, training employees on data privacy, and to be the main point of contact in the company for European regulators.

With its 99 articles, under the guidance of 6 privacy principles, General Data Protection Regulation (GDPR) is long, and complicated, and it needs as well as requires someone within the business to understand it, and how it should be practically applied. Failure to comply with GDPR, and data breaches resulting from non-compliance can bring large fines and other potentially disastrous consequences for businesses and organisations e.g. loss of customers, and damage to brand and reputation.

Legal and business commentators are also predicting that companies may only want to deal with suppliers who are GDPR compliant in order to maximise their own compliance and avoid the penalties.

What Does This Mean For Your Business?

For those who are already, or are currently training to be DPOs, the immediate future looks bright in terms of their choice of employment, the massive (and growing) demand for their services, and the bargaining power that this may give them with employers e.g. for their salary.

For businesses that are already trying to get to grips with the complications and costs of complying with GDPR, and who already know that they will need somebody in the DPO’s role, they may not have anticipated the extra complication of having to compete with other businesses to get one. With the demand for good DPOs looking like continuing to out-strip supply, the situation may arise where some businesses attempt to poach DPOs from others.

With X-day already past, and the introduction of GDPR just 3 months away, the clock is now ticking loudly for businesses that may not yet have given any serious thought to the role of DPO, or where to get GDPR training.

Google’s latest Transparency Report reveals that of the 2.4 million requests made since 2014 to remove certain URLs from its search results, Google has only complied with less than half.

Removal Requests

The removal requests relate to a ruling by the European Union’s Court of Justice in May 2014 which said that Google and other search engines can be held responsible for personal data that appears in its search engine results pages – they are considered to be ‘Data Controllers’. Google and other search engines can, therefore, be asked to remove links to some web pages that are published by third parties, and any EU citizen can ask Google to remove information about them from their search results.

Doesn’t Have To Comply

The problem with the ruling for individuals who want their data removed is that Google doesn’t actually have to comply with the request, and can refuse to take links down if can demonstrate that there is a public interest in the information remaining in the search results. Google can also re-instate links that it has already taken down in a previous request if it can show that it has grounds to do so.

One example highlighted in Google’s Transparency Report concerns the UK man who managed to get Google to delist 239 (of 300) URLs that linked him to a fraud conviction where he was later found to be innocent. Following a 2nd request by the same man to remove pages relating to a benefits case linked to him, Google refused this request AND re-instated the previously de-listed URLs because it said that he provided forged documents with his 2nd request.

Two Main Reasons

The statistics appear to indicate that the two most likely reasons why Google would be asked to consider de-listing URLs are when they relate to personal information being shown in social media and directory services, and when aspects of a requester’s legal history from news outlets and government websites are shown in the search engine results.

What If Google Refuses Your Request?

Examples of why Google may refuse to take URLs down include when they give business information that might be useful for potential customers, or if the content about a violent crime could be of interest to the general public.

If Google refuses your request to take down certain URLs, you can then still take your complaint to the national data watchdog. This, of course, takes time.

Less Than Half Of Requests

The Transparency Report shows that, since May 2014, Google has not delisted 56.7% of URLs, and in the UK, 60.2% of requests to remove certain URLs were not complied with by Google.

What Does This Mean For Your Business?

This story appears to show that despite an EU ruling, Google is still really in charge of making the decision about whether your personal details appear in its search engine results, based on its own research rather than your reasons in your request. For businesses wanting to hide certain information from public view, this is clearly an obstacle. Many businesses and individuals may have arguably suffered a much longer lasting punishment for any wrongs or from any bad publicity simply because they now operate in the age of the Internet, where things take a long time to be forgotten.

It will be interesting to see what difference GDPR makes to this situation because with GDPR, any EU citizen has the ‘right to be forgotten’ (all data held about them is to be removed), and GDPR can be enforced with the help of substantial fines for companies failing to comply with requests from individuals.

Google has long appeared to take the position that it sees some requests to remove certain URLs from its search engine results as a kind of censorship, and it remains to be seen just how much influence individuals will be able to exert over the big internet companies in the coming years.