Archives: Legislation

Subscribe to Legislation RSS Feed

A Review of the OMB Guidelines Issued to Federal Agencies for Reporting Requirements to Congress That Redefined What Constitutes a “Major” Cybersecurity Incident

With the growing threat of cyberattacks, we thought it would be worthwhile to discuss a late 2016 change in reporting requirements for federal agencies that have suffered a data breach.  The Office of Management and Budget’s (OMB) Memorandum 17-05, issued November 4, 2016, significantly redefined what constitutes a “major” cybersecurity incident that would require federal … Continue Reading

Broadband Internet Service Providers no Longer Subject to FCC Privacy Rules Preventing them from Selling Private Consumer Information

Both the House (215-205) and Senate (50-48) have voted to revoke the Federal Communication Commission’s (FCC) broadband privacy rules which would have forced broadband Internet Service Providers (ISPs), such as Verizon, Comcast and Charter, to obtain affirmative “opt-in” consent from consumers to use and share their personal sensitive information.  Sensitive information includes things such as … Continue Reading

Trump Budget Raises Questions about Approach to Cybersecurity

On Thursday, March 16, 2017, President Trump unveiled his “America First” budget blueprint.  One of the most important quandaries for those in the cybersecurity world is how the proposal to reorganize the executive branch to improve “the Federal Government’s effectiveness, efficiency, cybersecurity, and accountability” will impact our nation’s cyber defenses since overall spending in this … Continue Reading

Google Ruling may give Government an Opening to Broaden its Power Under Outdated Stored Communications Act

As technology progresses and the world becomes even more interconnected, the scope of the Stored Communications Act (“SCA” or “Act”) has become a topic of much interest in the federal courts. One question courts have grappled with lately is whether law enforcement may subpoena data stored on foreign servers under the Act. A recent ruling by Magistrate … Continue Reading

NARUC Release of Cybersecurity Guidelines should have Utility Companies on High Alert

On January 30, 2017, the National Association of Regulatory Utility Commissioners (“NARUC”) released Version 3.0 of “Cybersecurity A Primer for State Utility Regulators.”  This cybersecurity overview is an important reminder to public utilities to be prepared for cyber threats. Then again, public utilities probably don’t need a reminder after a cybersecurity event that occurred at … Continue Reading

New York Department of Financial Services Delays Compliance Deadline for Cybersecurity Regulations

On October 25, the Privacy Law Report featured a blog post on new cybersecurity regulations being implemented by the New York Department of Financial Services (“DFS”).  Those regulations impose a number of requirements on financial institutions, including banks and insurance companies, such as the implementation of cybersecurity programs, the manner in which those companies handle … Continue Reading

House Committee Warns Congress to Set Security Standards

Last week, members of the House Energy and Commerce Committee told Congress that they must set cyber security standards for all devices connected to the internet or else face the possibility of a major cyberattack that could cripple critical infrastructure throughout the United States. This hearing came on the heels of the widespread internet outage … Continue Reading

Major Security Breach Reported to Congress By Federal Bank Regulator

Recently, the Office of the Comptroller of the Currency (OCC) informed Congress that it had suffered a major information security incident. The agency reported that, in November 2015, a former employee downloaded over 10,000 records onto two thumb drives before retiring.  The breach was first detected in September 2016 during an internal review of employee … Continue Reading

New York Department of Financial Services Proposes Comprehensive Cybersecurity Regulations for Financial Institutions

In September, the New York Department of Financial Services (“DFS”) proposed new rules (“Rules”) that would require covered financial institutions – banks, insurers, and other institutions regulated by the DFS – to establish and maintain cybersecurity programs to protect consumer data and financial systems from cyberattacks. The Rules may have a very broad impact, if … Continue Reading
LexBlog