Network services provider EfficientIP has warned businesses that, in reality, February 15th is the last day that organisations can ensure their real-world compliance with GDPR.

I Thought May 25th Was The Deadline?

May 25th is the actual date that companies and organisations need to ensure that they are compliant with GDPR. However, the point that EfficientIP made in an announcement last week is that, realistically, it actually takes 99 days to detect a data breach. This gives hackers time to ‘exfiltrate’ data, or remove it without detection. Taking this into account, February 15th is exactly 100 days before May 25th 2018, and could, therefore, be regarded as the last day organisations can ensure real-world compliance with GDPR.

Dubbed ‘X-Day’

With this point in mind, some Cyber Security experts have started referring to February 15th as “X-Day” because it is the last day companies can prevent data exfiltration attacks without potential prosecution by regulators.

What Is Data Exfiltration?

Data exfiltration is the unauthorized copying, transfer or retrieval of data from a computer or server. In other words, hackers can use the DNS protocol to very quickly transfer large amounts of personal and sensitive data from your company systems e.g. customer data such as credit card numbers, or company information such as financial records.

EfficientIP have pointed out that most of the companies breached after February 15th 2018 will only discover the attack after GDPR is in force, and will, therefore, (legally) only have 72 hours to publicly disclose the breach.

How Common is Exfiltration?

EfficientIP’s own research shows that as much as 24% of companies have suffered data exfiltration in the past year.

Positive View

Although the EfficientIP is a warning, and companies already know that failing to comply with GDPR will bring large fines, and data breaches can cause irreparable damage to a company and its reputation, there are some very positive reasons for preparing now for GDPR. For example, a recent Veritas survey showed 95% of decision-makers expect a positive outcome from GDPR compliance, and 92% think they would benefit from having better data hygiene.

68% of respondents in the Veritas survey also said that getting GDPR compliant would give them a better insight into their business, which could help to improve the customer experience, and that compliance could actually save the company money.

Getting Motivated

It’s all very well issuing worrying warnings, but companies not yet compliant need to find effective ways to drive the cultural and organisational changes needed to get to grips with GDPR going forward. These motivators, also highlighted in a recent Veritas survey, could include adding compliance to employee contracts (47%), implementing disciplinary action if the regulation is disobeyed (41%), and educating employees about the benefits of GDPR (40%).

What Does This Mean For Your Business?

GDPR is just around the corner and this ‘X-Day’ warning is an indicator that realistically, GDPR compliance shouldn’t be put off any longer.

Data management commentators suggest that companies should adopt an automated, classification-based, policy-driven approach to GDPR so that they can meet the regulatory demands within the short time frame available.

Businesses have now heard all the warnings, and many companies and organisations are now starting come around to the idea of focusing on the positive outcomes and benefits that GDPR compliance will bring such as increased revenues, resulting from improved customer loyalty, heightened brand reputation, and competitive differentiation in the market.

There is also now growing realisation that companies will prefer to have business relationships with GDPR compliant companies to help ensure their own compliance. This means that GDPR compliance will be become a basic necessity to enable companies to compete in a normal way in today’s business environment.

Shortly after Lloyds Bank announced that it would be banning customers from buying crypto-currencies such as Bitcoin using their credit cards, Virgin Money is now adopting the same policy.

Why?

The volatility of cryptocurrencies such as Bitcoin have led Lloyds, and now Virgin Money to try to protect their customers from running up large debts following a sharp fall in the value of a digital currency they’ve bought. Several of the biggest issuers of credit cards in the US including Bank of America, Citigroup, JP Morgan, Capital One and Discover, have also banned customers from using their cards to buy digital currency.

Bitcoin is a perfect example of how volatile a digital currency can be. For example, at the start of 2017, one Bitcoin was worth $1,000, reached highs of around $19,000 at the end of last year, and has since plummeted to $8,291.87, its worst performance since April 2013.

The rapid rise in the value of Bitcoin last year, was also accompanied by consumers being targeted by adverts and information which acted as a temptation and incentive to invest with the promise of big returns, with many investors being inexperienced in currency investments, and unaware of the potential risks. Facebook, for example, has recently announced that it will now block any advertising that promotes crypto-currency products and services.

Bank Could Lose

Some money commentators have made the point that although the move by Lloyds and now Virgin Money could offer some protection for customers, the banks are also helping themselves because if a person buys anything on credit, such as large amounts of cryptocurrencies, it’s the bank that stands to lose if the person can’t repay the debt.

Bitcoin, for example, also operates outside of the control of banks, which may be another reason why banks may not like it.

Used By Criminals?

The police and the UK government have also taken the opportunity presented by the announcements of Lloyds and Virgin Money to make the point that digital currencies are also popular among criminals because they can use them to evade traditional money laundering checks and other regulations.

Prime Minister Theresa May, for example, has stated that action against digital currencies may be needed because of their connection to criminal activity. At the risk of sounding cynical, some money commentators have pointed out that governments tend not to like some crypotocurrencies because they are beyond their control, and they can’t (yet) make revenue from them. For example, the Chinese government has long battled with the challenges posed by Bitcoin.

What Does This Mean For Your Business?

This move by two banks, with more likely to follow, sets a new precedent. Banks don’t like unsecured risks being taken with their money, and buying cryptocurrencies on credit appears to represent a far greater risk to them than traditional gambling which you can still use a credit card for (although it will be treated as a high interest cash loan).

It’s also worth remembering that banks and governments are likely to be less happy about things that they can’t control, regulate, and raise revenue from.

Even though criminals are known to use cryptocurrencies such as Bitcoin for just these reasons (and the anonymity), it is also worth pointing out that Bitcoin actually has many attractive advantages for businesses such as the speed and ease with which transactions can take place, which is actually due to the lack of central bank and traditional currency control. Using Bitcoin also means that cross-border and global trading is made much easier and faster.

Also, even though Bitcoin looks too volatile for many to invest in at the moment, the cryptocurrency has lasted through many ups and downs (hacks and government opposition), it is still popular, and its widening popularity and potential uses for its underlying technology ‘Blockchain’ mean that Bitcoin still has a future.

From a consumer / potential individual investor’s perspective, the move by Lloyds, Virgin, and the big US credit card companies does, however, look likely to provide some responsible and sensible protection for the time-being.

South Wales Police have taken to social media to announce news of the latest arrests made using Automated Facial Recognition (AFR) technology.

First Used At Champions League Finals Week

The AFR system was first used by South Wales Police last June at the Champions League final at the Millennium Stadium in Cardiff. AFR incorporates facial recognition, uses slow time static face search, and links to specialist software that can compare a camera image of a face to 500,000 custody images from the Police Record Management system in order to find a match.

Ironically, the first arrest made in Cardiff at the time using AFR was actually a local man whose arrest was unconnected to the Champions League, and who was identified by a van-mounted camera days after the match.

Police Tweets

The latest announcements of AFR-related arrests have made the news because they relate to the use of AFR at the recent Six Nations rugby tournament, the announcements have been delivered via Twitter, and have been seen by some media commentators as being boastful in style.

For example, Project leader Scott Lloyd took to Twitter to publicise the first identification and arrest made “within an hour”, and the drugs arrest of another man on a warrant using AFR Cardiff City Centre a short time later. Mr Lloyd also announced another “UK policing first” with the arrest of a third person, identified from night club CCTV a month earlier.

Controversy

The increased use of AFR at events has, however, been criticised by groups such as Big Brother Watch for infringing peoples’ rights, having no clear basis for its use, and for edging the UK closer to a ‘surveillance state’.

There have also been reports of a possible 35 false matches and one wrongful arrest after the London Metropolitan Police used AFR at the last Notting Hill Carnival.

What Does This Mean For Your Business?

So far, AFR has proven to be a relatively expensive system for the number of arrests it has delivered (£177,000 for its use in Cardiff for 1 arrest), and it has generated a lot of negative publicity and suspicion. It is little wonder, therefore, that a police spokesperson has been only too happy to take to an immediate way (Twitter) of announcing every arrest as it happens in an attempt to boost public confidence in the system, and to demonstrate some value for money.

With the introduction of GDPR this year, however, questions will no doubt be asked about the security and privacy of the images captured by the AFR system, as personal images do fall under the category of personal data.

Despite the findings of a study from YouGov / GMX of August 2016 that showed that UK people still have a number of trust concerns about the use of biometrics for security, biometrics actually represents a good opportunity for businesses to stay one step ahead of cyber criminals. This is because biometric authentication / verification systems are thought to be far more secure than password-based systems, which is the reason why banks and credit companies have already started using them.

All this said, facial recognition systems are widely believed to have value-adding, real-life business applications. For example, last May, a ride-hailing service called Careem (similar to Uber but operating in more than fifty cities in the Middle East and North Africa) announced that it was adding facial recognition software to its driver app to help with customer safety.

A legal challenge by Labour MP Tom Watson against the UK government’s own digital mass surveillance legislation laws introduced in 2014 has led to a court deciding that the laws were illegal.

Legislation

The legislation that was successfully challenged in court was the Data Retention and Investigatory Powers Act (DRIPA), which was actually replaced at the end of 2016 by The Investigatory Powers Act, also known as the Snooper’s Charter.

What Was Wrong With DRIPA?

DRIPA required communications companies to store detailed personal information e.g. people’s mobile phone data, their emails, texts and internet communications.

Tom Watson has been reported as saying that, back in 2014, DRIPA was rushed through Parliament just before recess, and therefore lacked proper parliamentary scrutiny. This meant that one section was inconsistent with EU law. It was this section that UK judges agreed was illegal because it granted spy agencies and law enforcement access to UK citizens’ phone records and internet activity for reasons other than using the details to fight serious crime, all without seeking or getting approval from a court or independent authority.

What Difference Does This Make?

Even though DRIPA is defunct, many of those who objected to DRIPA have said that in the light of the court’s ruling, the current Investigatory Powers Act should be changed accordingly, and that a system of independent approval for access to communications data needs to be put in place.

Digital rights Charity Liberty is reported as saying that the judgement tells ministers that they are breaching the public’s human rights, and that the latest incarnation of the Investigatory Powers Act must now be changed.

Already Heading That Way Says The Government

The Security minister Ben Wallace is reported as saying that the government had already announced that it would amend the Investigatory Powers Act to address the two areas in which the Court of Appeal found against the previous data retention regime.

Current Snooper’s Charter In Crowdfunded Challenge

The current Investigatory Powers Act is being challenged separately by the charity Liberty with the help of £50,000 crowdfunding. Liberty wants to challenge the Charter on the argument that surveillance of everybody in the UK may not be lawful or necessary, and that whistleblowers and experts have warned that the powers would actually make it more difficult for security services to do their jobs effectively.

There are also the arguments that the new law puts too much power in the state’s hands, could be an invasion of privacy, and that the government’s storing of large amounts of sensitive information about each of us could in itself be irresponsible and a security risk.

Some critics have also expressed suspicions about the motives of the UK government for introducing the law e.g. to censor and control rather than to protect.

What Does This Mean For Your Business?

The ruling by the European Court of Justice back in December 2016 that DRIPA was unlawful, coupled with this latest agreement by judges with Tom Watson’s challenge will strengthen the need for the UK government to act quickly to make changes to what has been controversial legislation.

Most people would probably agree that people in the UK need to be protected from terrorist attacks, and that children and young people need to be protected from predatory behaviour and the activities of paedophiles online. Although the Investigatory Powers Act may include measures that could help with that, many people and businesses (communications companies, social media companies, web companies etc) are uneasy with the extent of the legislation and what it forces companies to do, how necessary it is, and what effect it will have on businesses publicly known to be snooping on their customers on behalf of the state. The 200,000+ signatures on a petition calling for the repeal of the Investigatory Powers Act after it became law, and the £50,000 crowdfunding raised from the public in less than a week to fight the bill, both emphasise the fact that UK citizens value their privacy and take the issues of privacy and data security very seriously.