1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar

HHS Issues Warning About Phishing Campaign Disguised As Official Communication

As part of its efforts to assess compliance with the HIPAA Privacy, Security and Breach Notification Rules, the US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) engages in audits of covered entities and their business associates.

On November 28, 2016, the OCR issued an alert warning covered entities about a phishing e-mail that is being circulated on mock HHS Departmental letterhead under the signature of OCR’s Director, Jocelyn Samuels.  The e-mail purportedly prompts the receiver to click a link regarding possible inclusion in the HIPPA Privacy, Security, and Breach Rules and Audit Program, and directs the recipient to a non-governmental website.  The phishing e-mail originates from the e-mail address OSOCRAudit@hhs-gov.us and directs individuals to http://www.hhs-gov.us.  This is a slight difference from the official e-mail address for the HIPAA audit program, OSOCRAudit@hhs.gov, and the official HHS website http://www.hhs.gov.

The OCR advises covered entities and their business associates to alert employees of this issue and take note that official communications regarding the HIPAA audit program are to be sent to selected auditees from the official e-mail address OSOCRAudit@hhs.gov.

A copy of the OCR alert can be found here.

If you or one of your entities has received this phishing e-mail, the Dentons Privacy and Cybersecurity Law Group is available to help you navigate next steps.

HHS Issues Warning About Phishing Campaign Disguised As Official Communication

FTC Announces New Guidance on Ransomware

On November 10, 2016, the U.S. Federal Trade Commission (FTC) released new guidance for businesses and consumers on the impact of, and how to respond to ransomware.  Ransomware is a form of malicious software that infiltrates computer systems or networks and uses tools like encryption to deny access or hold data hostage until the victim pays a ransom.  Ransomware incidents have increased over the past year, including a number of high-profile attacks on health care organizations.

Business Guidance

For businesses, the FTC released Ransomware – A closer look with a companion video Defend against Ransomware.  A copy of both can be found here.

According to the FTC, if your business holds consumers’ sensitive information “you should be concerned about the threat of ransomware.”  The FTC notes it can impose “serious economic costs on businesses because it can disrupt operations or even shut down a business entirely.”

In order to defend against ransomware attacks, the FTC recommends businesses invest in prevention through:

  • Training and education: Implement education and awareness programs to train employees to exercise caution online and avoid phishing attacks.
  • Cyber hygiene:  Practice good security by implementing basic cyber hygiene principles (including updating software, and implementing new procedures for users).
  • Backups:  Backup data early and often.
  • Planning:  Plan for an attack.  Develop and test incident response and business continuity plans.

For those businesses hit with a ransomware attack, the FTC recommends organizations take the following steps:

  • Implement the continuity plan:  Have a tested incident response and business continuity plan in place.
  • Contact law enforcement:  Immediately contact law enforcement, such as a local FBI field office, if an attack is discovered.
  • Contain the attack:  Keep ransomware from spreading to networked drives by disconnecting the infected device from the network.

Consumer Guidance

For consumers, the FTC released How to defend against ransomware.  A copy of this guidance can be found here.  The FTC recommends consumers take the following steps to protect against ransomware:

  • Update your software:  Use anti-virus software and keep it up to date.  Set your operating system, web browser and security software to update automatically, and on mobile devices do it manually.
  • Think twice before clicking on links or downloading attachments or applications:  You can get ransomware from visiting a compromised site or through malicious online ads.
  • Back up files:  Back up files whenever possible, and make it part of your routine.

If you are a victim of a ransomware attack, the FTC recommends:

  • Disconnecting the infected devices from the network;
  • Restoring the infected device where possible; and
  • Contacting law enforcement.

Next Steps

If you or your organization becomes a victim of ransomware, or you are interested in developing a comprehensive prevention plan, Dentons’ Privacy and Cybersecurity Group is ready to help.

FTC Announces New Guidance on Ransomware

Lessons Learned: E-Learning Company Faces $50,000 Spam Fine

The Canadian Radio-television and Telecommunications Commission (CRTC) has issued its first Compliance and Enforcement Decision* under Canada’s Anti-Spam Law (CASL).  The Commission confirmed the staff finding that Blackstone Learning Corp. had committed 9 violations of CASL by sending almost 400,000 emails in 2014 without proper consent.  However, the Commission reduced the administrative monetary penalty originally set in the notice of violation from $640,000 to $50,000.  While it is open to Blackstone to appeal the decision, meaning that we may not have heard the last of this case, the Commission’s decision provides useful commentary on its approach to CASL compliance and enforcement.  The following are lessons learned under two headings: implied consent, and what we will refer to as “sender conduct”.

Email addresses posted online – ripe for the picking as “implied consent”?

Not so fast, cautions the CRTC.  While addresses that have been “conspicuously published” online or otherwise may qualify for implied consent, this “does not provide persons sending commercial electronic messages [CEMs] with a broad licence to contact any electronic address they find online”.  The CASL conditions attached to “conspicuous publication” set a higher standard than that.  As a starting point, the person who receives the email message must have posted his address himself, or authorized it to be posted.  Often, an employer will post contact information including an employee’s email address, which for the purposes of CASL implies that CEMs can be sent IF there is no indication otherwise, and IF the messages are relevant to the person’s business role or function.

As the CRTC points out, if a business chooses to advertise through a third party (our example: an online service provider listing) and includes an employee’s contact information along with the ad, this can be the basis for implied consent to contact the employee in relation either to the ad or to the employee’s role, because the account holder (the employer) caused the publication.  Implied consent stops there:  if the listing service goes on to copy or sell the list of addresses on its own, new senders can no longer count on the “conspicuous publication” implied consent, because the account holder did not authorize any further publication.

Lesson learned:  Implied consent is evaluated on a case-by-case basis.  Under CASL, the onus is on the sender to prove consent.  The CRTC “stress[es] the importance of detailed and effective record-keeping for this reason.”

What is a “reasonable” monetary penalty under the CASL regime?  How important are the sender’s conduct and circumstances?

CRTC staff set out an administrative monetary penalty (AMP) of $640,000 in the notice of violation issued to Blackstone.  Having determined that Blackstone did commit the CASL violations, the Commission considered whether the AMP was reasonable.  CASL sets out a number of factors to be taken into consideration.

  • purpose of the penalty: the Commission stated that the amount must be representative of the violations, and have enough of an impact on a person to promote changes in behavior, in effect a second chance. An amount high enough to put a person out of business would mean he would no longer have that second chance.  An AMP of $640,000 would be too high.
  • nature and scope of the violations:  while almost 400,000 non-compliant messages were sent, were disruptive to the recipients, and prompted at least 60 complaints to the Spam Reporting Centre, the violations took place over only 2 months, and suggests that an AMP of $640,000 would be too high.
  • ability to pay:  based on the evidence, an AMP of $640,000 would significantly exceed Blackstone’s ability to pay.
  • other factors – cooperation and self-correction:  Blackstone’s failure to cooperate with the investigation increased the need for a penalty to ensure future compliance. However, the Commission saw some possibility of “self-correction” going forward, which suggested that a lower AMP would be appropriate.

The Commission decided on the amount of $50,000.  The Commission noted that Blackstone did not have the benefit of more recent CASL guidance which is now available to everyone online.  This should be read as a thinly-veiled direction to others:  the decision cites The Commission’s Guidance on Implied Consent for CASL and also the Department of Industry’s Fightspam information website for businesses and individuals.

Lesson learned:  the Commission expects organizations to do their homework, to cooperate with investigations, and to self-correct when they discover mistakes.

We have been assisting many organizations in Canada and other countries to adapt their practices to comply with CASL.  Let us know if we can help you.

*A number of organizations have been subject to CASL enforcement since the Act came into force in July 2014; some of these cases have not been made public, and others have been publicly available only through brief settlement summaries.  This is the first Commission decision reviewing a Compliance and Enforcement Sector notice of violation.

,

Lessons Learned: E-Learning Company Faces $50,000 Spam Fine

CASL compliance undertakings continue to mount

Another company that is well-known to consumers has agreed to enter into a compliance undertaking with the CRTC for alleged CASL violations.  Kellogg Canada Inc. has paid a monetary penalty of $60,000 and undertaken to enter into a compliance program to better address elements such as:

  • written CASL compliance policies and procedures;
  • training programs for employees;
  • tracking CASL complaints and resolution; and
  • monitoring and auditing mechanisms to assess compliance.

Notably, the compliance issues arose from messages that were sent: not only by Kellogg, but also by its third party service providers, and not long after CASL entered into force in July 2014.  This was a time when many companies were early on in the process of familiarizing themselves with the many CASL requirements, and implementing programs to make sure that databases, third party agencies (marketing companies and other service providers) and internal procedures were all in line.

The CRTC’s Notice regarding Kellogg’s 2014 compliance issues comes only a month after the CRTC issued its Enforcement Advisory to businesses and individuals on how to keep records of consent (see our recent blog post here), and less than a year before the Private Right of Action becomes available in Canada under CASL legislation, meaning that the CRTC will not be the only one taking businesses to task for CASL compliance.

CASL compliance undertakings continue to mount

Office of the Privacy Commissioner of Canada discusses its investigation against Compu-Finder

The Office of the Privacy Commissioner of Canada (OPC) recently hosted a knowledge session to stakeholders to discuss its recent investigation against Compu-Finder. This was the first investigation by the OPC involving the address harvesting provisions under the Personal Information and Electronic Documents Act (PIPEDA). See our post summarizing the findings and the OPC’s full report here.

While the OPC could not disclose details of its investigation, the OPC provided attendees with information about its interpretation of its investigative powers, its approach to the investigation and tips for organizations.

The Investigation

Unlike its complaint-driven investigations, this investigation was an intelligence-driven case under the address harvesting provisions that were added to PIPEDA by Canada’s Anti-Spam Legislation (CASL). After significant intelligence gathering to meet its reasonable grounds burden, a Commissioner-initiated investigation was commenced allowing the OPC to collect further intelligence from Compu-Finder, affected individuals and third parties, including by affidavits. The OPC highlighted it applied a cross-functional investigation, using numerous departments and tools, including extensive use of the OPC technology LAB.

It is important to note that unlike the Canadian Radio-television and Telecommunications Commission (CRTC), which is the regulator with main responsibility for enforcement of CASL, the OPC must have reasonable grounds to start an investigation that has not been filed by an individual. The CRTC does not have to discharge that burden before commencing an investigation.

Key Takeaways

“The truth is in your records”. The OPC stressed the importance of record keeping. This has become a consistent theme regarding PIPEDA and CASL. (See our post on the CRTC’s guidance here.) The OPC highlighted that record-keeping was a fundamental issue in its investigation. Organizations must be able to meet their due diligence obligations and prove they have consent for the personal information they collect and use, and for every e-mail they send under CASL. The OPC found that Compu-Finder’s records were inadequate or in some cases may have contradicted their position.

Other lessons offered were:

  • Exercise care when crafting responses to the OPC during investigation
  • An established privacy compliance program can greatly assist you in demonstrating accountability
  • Part of due diligence involves following up, double checking and auditing your policies and procedures

Stakeholders undoubtedly appreciated the OPC’s proactive gesture in providing this opportunity to learn more.

Office of the Privacy Commissioner of Canada discusses its investigation against Compu-Finder