Blanca Escribano

Datonomy takes a look at the recent recommendations in the Article 29 Working Party Opinion on the Internet of Things, and what these mean for players in the value chain.

Consumers’ fear of potentially intrusive new technologies is often cited as one of the main barriers to the adoption of the Internet of Things.

Regulators in the US and Europe are starting to get to grips with the issue. As Datonomy readers will be aware, the Article 29 Working Party recently issued an Opinion on the topic, with recommendations on how to embed privacy compliance at every stage of the IoT value chain.

In this paper on the Olswang website here I consider the key privacy and security challenges posed by a connected world, and analyse the latest best practice for suppliers – from device manufacturers, through to app developers and providers of operating systems.

Stakeholders who can demonstrate privacy compliance and ethical practices will be best placed to win consumers’ trust and gain competitive advantage in this brave new and connected world.

Posted in Uncategorized | Leave a comment
Ross McKean

As Datonomy readers may know October is Cybersecurity Month – a good time to read the second edition of Olswang’s Cyber Alert. There is no doubt that cyber security is rising up the international as well as the business agenda. NATO recently adopted an amendment to its charter to put cyber attacks on the same footing as armed attacks – see paragraph 72 of NATO’s Declaration.

In this edition:

  • In our lead article, EJ Hilbert, Managing Director, Cyber investigations, Kroll EMEA, considers the true cost of cybercrime;
  • In our standards and benchmarks section we consider the new ISO standard for processing PII in the cloud, new standardisation guidelines for cloud computing SLAs and look at the UK’s new certification scheme Cyber Essentials.
  • On our regulatory radar in this edition we  track the  progress of EU legislation on data and cyber breach notification, and draft US legislation and look in depth at new cyber security legislation in France and Germany and proposals to strengthen criminal penalties in the UK. We also look at a first of its kind ruling by the French data protection regulator, the CNIL, over supply chain security breaches, and at the impact UK fines are having on security compliance.
  • In our threat vectors section we highlight just some of the breaches and threats which have been in the headlines over the summer.

We hope Datonomy readers will enjoy the Cyber Alert. There is a printable PDF version of it here.

Posted in Cloud computing, cyber crime, cyber-privacy, cybersecurity, data, data breach, data breaches, data loss, e-Privacy, Germany, information security, internet, New publication, online data protection, outsourcing | Tagged | Leave a comment

Threat Vectors

Tom Errington - October 22nd, 2014
Tom Errington

A small selection of the cyber threats and statistics that have made recent headlines.

  • Sources including censorship watch dog GreatFire have alleged that the Chinese authorities are staging a “man-in-the-middle” attack on Apple’s iCloud, just days after the iPhone went on sale in China. The attack is designed to intercept user’s iCloud account usernames and passwords, using a fake login site that looks exactly like the Apple iCloud login site. Read more from The WHIR and ITProPortal.
  • A new bug, which could be affecting hundreds of millions of computers, servers and devices using Linux and Apple’s Mac operating system, has been discovered. System administrators have been urged to apply patches to combat the bug, which has been dubbed “Shellshock”. Read more from the BBC.
  • US companies Home Depot, Supervalu and JPMorgan Chase & Co have all been hit by high profile cyber attacks.
  • Mark Boleat, head of policy for the City of London, has echoed comments made by New York’s financial regulator Benjamin Lawsky that an “Armageddon style” cyber attack will trigger the next global financial crisis by making a major bank “disappear”. Mr Boleat also said that the City of London police had uncovered a huge underground economy, and a huge underground network” capable of conducting movie-style cyber attacks. Read more from The Telegraph.
  • As has been widely reported, there has been an extremely targeted hack against celebrities, resulting in numerous nude photographs being temporarily floated in the public domain. In the fallout, cyber-thieves reportedly sent out fake notification messages to iCloud users to trick people into handing over their login details.
  • Similarly, 13 GB worth of photos from popular mobile phone app Snapchat have been dumped online. The attack has been dubbed “The Snappening” and was carried out by the use of insecure third-party software designed to let users store “disappearing” snaps. Many are blaming Snapchat for the breach. Read more from The Independent.
  • Security firm Hold Security has announced the “largest data breach known to date”, after a Russian gang dubbed “CyberVor” stole over 2 billion credentials. More details here and here.
  • As ZDNet reports, new research published by FireEye claims that 68% of the most popular free Android apps could become a pathway for cybercriminals to lift sensitive data.
  • An interesting blog by CBR highlights six cyber security trends to watch out for during the rest of 2014, which includes more focus being placed on cyber education and an increase in infrastructure targeting by hackers.
  • The “very alarming” level of cyber threats organisations face is unlikely to fall for at least 10 years, says Suleyman Anil, head of cyber defence at the emerging security challenges division of NATO. Mr Anil asserted there are three prime reasons for this; cyber crime is low risk with the promise of high profits, there has been an increase in opportunity to attack systems and most worryingly, there is growth in state-sponsored cyber attacks. Read more here.


Posted in cyber crime, cyber-privacy, cybersecurity, data | Tagged , , | Leave a comment
Claire Walker

As  reported  in our first edition, there are two proposals making their way through the Brussels legislature which will change the legal landscape for the reporting of cyber attacks. These are the draft Network and Information Security Directive, which will impose reporting obligations on providers of critical infrastructure, and the draft General Data Protection Regulation which will impose data breach reporting requirements on all data controllers. The summer has seen much institutional change in the EU, first with the European Parliament elections in May, the start of Italy’s Council Presidency in July and now with the reorganisation of the European Commission and appointment of a new Commission President and Commissioners with effect from 1 November.  The summer has seen little procedural progress, although trilogue negotiations on the NISD have now begun, and on the GDPR the Council (representing the Member States) has, according to this Council press release, just reached a broad consensus on the security and breach provisions in Chapter IV of the draft Regulation (although the Council has not yet agreed its position on the whole proposal).  We will continue to monitor progress in our Cyber Alert.

We summarise the state of play – as at 22 October 2014 – on both proposals in a table available here

Posted in cyber-privacy, cybersecurity, data | Tagged , , | Leave a comment
Thibault Soyer

With the text of the draft Network and Information Security Directive (“NISD”) still being negotiated between EU institutions, and the national transposition deadline for the Directive likely to be 18 – 24 months from the date of EU adoption, some Member States are pre-empting the new regime with national legislation of their own. France has already implemented the principles enshrined in the draft Directive via its Military Programming Act, which was published at the end of 2013.


France has already implemented many of the principles enshrined in the Draft NISD into national law. The French Government published its strategy on Information systems and defence in February 2011. This included reviewing and where necessary strengthening cyber laws. As a result, the government passed Article 22 of Act n°2013-1168 dated 18 December 2013 (the “Military Programming Act”) which sets out several obligations applicable to vitally important operators (“VIOs”) which are comparable to those imposed by the Draft NISD on operators of critical infrastructures.

 It should be noted that Article 22 of the Military Programming Act has not yet come into force; various decrees and Ministerial orders which will spell out the detail of the regime have not yet been published – for example, those specifying security standards applicable to VIOs, the notification procedure, criteria defining an “incident” triggering the notification obligation and conditions and limits of “inspection” powers of the Prime Minister.

 The French National Agency for the Security of Information Systems (“ANSSI”), i.e. the regulatory authority which has been empowered to define implementing and enforcement measures of Article 22, is currently working with the French government as well as with public and private entities to define the application conditions of this framework. The implementing decree had been announced by the ANSSI to be due by Autumn 2014. As of the date of publication of this article, however, no such decree has been published.

When published, the decree will set out general principles, and following such publication, ministerial orders will be published to define sector-specific rules (if any) and implementation deadlines. At a cyber security conference in September, the ANSSI director indicated that France was “the first to go down this road. Other countries have tried, without succeeding” and that implementation conditions remain “unclear”, even at the NATO level (therefore not providing a reference framework for the ANSSI).

 NISD vs Military Programming Act – how do they compare?

 Below we highlight the key similarities and differences between the French legislation and the proposed NISD. Note that there are significant differences between the Commission’s original draft of the NISD published in February 2013 and the amended text approved by the European Parliament in March 2014. It remains to be seen what the final compromise text of the NISD agreed by all three EU institutions will look like. As things stand, here’s how the new French regime compares to the proposed EU-wide regime.

Key similarities:

  • Breach notification deadlines: the Draft NISD (as amended by the European Parliament) requires breach notification “without undue delay” (Article 14 (2)) and the Military Programming Act requires notification “without delay”.
  • Audits: the broad obligation for VIOs to subject themselves to security Audits under the NISD (as originally proposed by the European Commission, Article 15(2)) is similar to the “inspection” obligation under the Military Programming Act. However, the EP’s text has significantly watered down the audit requirement.

Key differences:

  • Scope: the notions of VIOs in the Military Programming Act and of “vitally important sectors” under the relevant French legislation are slightly broader than the scope of “critical infrastructure” (in the sense of the Council directive 2008/114/EC) and of “market operators” in the Draft NISD (see the table for more detail).
  • Inspection and audit: the extent of inspection/auditing powers of VIOs by the French Prime Minister is deeper than the equivalent proposals under the EP’s version of the Draft NISD.
  • Sanctions: the French law includes specific sanctions for a VIO’s failure to comply with any of the obligations specified in Article 22, following a formal notice (up to EUR 750.000 for corporate entities). However, such formal notice is not required prior to imposing a fine in case of failure by a VIO to notify the Prime Minister “without delay” of a cyber-breach.
  • Notification triggers: no materiality threshold for cyber security incidents triggering the notification requirement is yet provided by the Military Programming Act, compared to the “significant impact” threshold and criteria included in the European Parliament’s proposed version of Article 14(2) of the Draft NISD.
  • Notification to the public: whereas the Draft NISD (European Parliament’s version, Article 14 (4)) provides for precise criteria and conditions for notification to the public of cyber security incidents, the Military Programming Act remains silent on this possibility.

For further details on the similarities and differences between the Draft NISD and the Military Programming Act, please refer to the comparative table available here.

Posted in cybersecurity, data | Tagged , , | Leave a comment
Tom Errington

The ICO has published a review of the impact of its civil monetary penalties (CMPs), the vast majority of which have related to security breaches. The review canvassed the views of representatives from 14 organisations who had received a CMP and 85 peer organisations who had not. The findings suggest that overall CMPs are effective at improving data protection compliance. However some respondents felt that there was a lack of transparency about how CMPs have been calculated and some showed a lack of understanding of just what poor practices trigger the CMP threshold.

Posted in civil monetary penalties, cybersecurity, data | Tagged , , | Leave a comment
Katharine Alexander

UK: Cyber security certification scheme launched

Following the consultations on the requirements for a preferred standard for cyber security, which concluded in November 2013 (background information here), the Government has launched a new cyber security certification scheme. The scheme focuses on five main controls for basic cyber hygiene:

  • boundary firewalls and internet gateways;
  • secure configuration;
  • access control;
  • malware protection; and
  • patch management.

Businesses can apply for a “Cyber Essentials” certificate (based on independently verified self-assessment) or a “Cyber Essential Plus” certificate (offering a higher level of assurance through external testing). The scheme is designed to be affordable and offers a snapshot of the organisation’s cyber security effectiveness on the day of assessment. Guidance on meeting the Cyber Essentials requirements can be downloaded from the government-approved cyberstreetwise website here, and a summary of the scheme can be found here. Vodafone has become the first telecoms company to gain the UK ‘cyber essentials plus’ accreditation.

Posted in cybersecurity | Tagged , , | Leave a comment
Claire Walker

These new guidelines were published in June by the Cloud Select Industry Group.

Forming part of the European Commission’s wider Cloud Computing strategy which was unveiled in 2012, the guidelines have been described as a first step towards standardised building blocks for terminology and metrics in cloud SLAs. They aim to improve the drafting clarity and customer understanding of cloud SLAs. European Commission Vice-President Viviane Reding said: “[the] new guidelines will help generate trust in innovative computing solutions and help EU citizens save money. More trust means more revenue for companies in Europe’s digital single market.”  The 62 page guidelines – created by a drafting team which included participants from IBM, Amazon, Microsoft and T-Systems – deal with service levels relating to availability, reliability, security, support services and data management, and take into account the guidance of the Article 29 Working Party.

Posted in Cloud computing, cybersecurity | Tagged , , | Leave a comment
Tom Errington

In July the Senate Intelligence Committee approved a bill for the Cybersecurity Information Sharing Act (“CISA”) that would encourage companies to share information about threats with each other and the federal government. The bill has been controversial, especially in the wake of Edward Snowden’s revelations about access to US citizens’ data, as it would give the NSA wider powers to access, retain and use data for “a cybersecurity purpose”. This is rather broadly defined as “the purpose of protecting an information system or information that is stored on, processed by or transiting an information system from a cybersecurity threat or security vulnerability”. Indeed, an open letter from a number of privacy, civil liberties and open government groups has been published criticising the bill. Further coverage can be found here, here and here. The bill is expected to see a full vote in the Senate this year. The text of the bill is available on the Congress website here.

Posted in cybersecurity | Tagged , , | Leave a comment

 In August this year (to not a great deal of fanfare), ISO published a new security standard for cloud services: ISO/IEC 27018Information technology – Security techniques – Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors (“ISO 27018”).  Datonomy reported in May this year, that this new standard was on its way. This publication is a welcome step towards ensuring compliance with the principles of privacy laws and further boosting customer confidence in in cloud computing technologies.

 Here are Datonomy’s questions and answers on this new security standard.  

 What’s the aim of ISO 27018?

 The standard’s aim is to create a common set of security controls that can be implemented by a public cloud computing service provider that is processing personal data on behalf of another party.   

 How is ISO 27018 structured?

 The standard is based on (and follows a similar structure to) ISO/IEC 27002 – Information technology – Security techniques – Code of practice for information security controls (“ISO 27002”).  In short, ISO 27018 tailors ISO 27002 for use by a public cloud computing service provider.  The structure breaks down into three key parts:

  1. ISO 27018 provides a reference to ISO 27002 where the controls in ISO 27002 are applicable to cloud computing service providers processing personal data. 
  2. ISO 27018 sets out additional guidance and/or information for these controls, where necessary for cloud computing service providers processing personal data. 
  3. There are additional controls (and associated guidance) in the Annex to the standard which are not covered in ISO 27002.

 What’s in ISO 27018?

 The main section of ISO 27018 covers the same  areas as ISO 27002: Information security policies; Organization of information; Human resource security; Asset management; Access control; Cryptography; Physical and environmental security; Operations security; Communications security; System acquisition, development and maintenance; Supplier relationships; Information security incident management; Information security aspects of business continuity management; and Compliance.

 The Annex to ISO 27018 covers additional areas: Consent and choice; Purpose legitimacy and specification; Data minimization; Use, retention and disclosure limitation; Openness, transparency and notice; Accountability; Information security; and Privacy compliance.

 From a legal perspective, ISO 27018 can been seen as having elements of a controller to processor agreement and elements of technical and organizational security measures.

 Who can use ISO 27018?

 ISO states that “ISO 27018 is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, which provide information processing services as PII processors via cloud computing under contract to other organizations.

 How can ISO 27018 be used?

 The organizations listed above can use the standard to select applicable controls when implementing a cloud computing information security management system and/or as a guidance document for implementing these controls. Like ISO 27002, ISO 27018 does not specify what controls are applicable to what organization.  This is not surprising as it would be near impossible to do so. However, to circumvent this issue, ISO/IEC 27001 requires a risk assessment to be performed to identify what controls are required and to what extent it should be applied. A new ISO 27017  that is still in the pipeline might fill this gap.

 Providers that comply with ISO 27018 will definitely have a better selling argument as they confirm compliance with important data protection standards. There are also good arguments that a self-audit by a provider under ISO 27018 is accepted as proof of compliance with technical and organizational measures (as required, for example, under EU law for data processing agreements).

 What are the limitations of ISO 27018?

 Most of the controls in the standard will also apply to a controller of personal data.  However, the controller will, in most cases, be subject to additional obligations, not included in this standard.

  1. Cloud beyond personal data.  ISO 27017, which has not been published yet, will deal with the application of ISO 27002 to the use of cloud services and to the provision of cloud services generally.  ISO 27018 is focused on cloud services that process personal data.
  2. Legal nuances.  We will have to see if this ISO standard is widely adopted. It is being  heavily promoted by cloud giants.  The standard addresses, broadly, the key obligations in privacy laws around the world (and there are of course large similarities).  However,  there are nuances in privacy laws around the world.  The standard does not address all of these.  Therefore customers and providers alike will still have to consider those nuances. 
  3. Additional sector rules.  There are often additional rules to privacy laws that ISO 27018 doesn’t deal with.  Many readers will be familiar with additional relevant rules imposed in particular industry sectors e.g. the financial services industry, the public sector, the health sector and the education sector.  Customers and providers in these sectors will still have to consider these additional rules.


 This is a helpful standard for the cloud industry.  ISO 27018 is not a management standard (c.f. ISO 27001) and therefore is unlikely to be certified against.  The same is true for ISO 27017.  However, it provides a useful reference guide for customers and suppliers alike – it is the first global standard of its kind and is a suitable means for globally operating providers to demonstrate their data protection/privacy compliance – instead of having to cope with different national standard in various jurisdictions.  If this standard is adopted and accepted widely, then customers and providers can use this standard to evaluate what protections are in place and, more importantly, what’s missing!

Posted in Uncategorized | Leave a comment