More information is hidden in plain sight than ever before. When the success of the global economy is hinged on the secure ownership of intellectual property and data, it behooves those who govern in the global company to understand how this information is being protected—and how it could be compromised. To that end, the National Association of Corporate Directors convened directors and cyber risk experts in Geneva, Switzerland, for its first Global Cyber Forum.
Dr. Simon Singh demonstrates the inner workings of an Enigma machine (Credit: Les Studios Casagrande).
Attendees from nearly every continent made their way to the Hotel President Wilson to confront the challenges of securing data across borders in light of complex and sometimes competing regulations. The European Union’s General Data Protection Regulation (GDPR), which goes into effect on May 25, 2018, will be a watchword during each session. The complex and potentially costly regulation is likely to affect most companies that do business with or employ Europeans.
GDPR defines protected data far more broadly than the protections set by most country regulators. (Click here to learn more about the implications of GDPR.) Experts from international KPMG offices, cybersecurity firm Rapid7, AIG together with NACD cohosts Ridge Global and the Internet Security Alliance, will proffer their best advice on the interconnected challenges and solutions of cybersecurity oversight for today’s board directors.
NACD’s Global Cyber Forum commenced Tuesday night with a keynote presentation by popular scientist and author Dr. Simon Singh.
A particle physicist who completed his degree at Cambridge University while working at the European Organization for Nuclear Research (CERN), Singh has committed himself to helping everyday people understand some of the most complex concepts in modern math and science. He is the author of several books and won a BAFTA award for producing Fermat’s Last Theorem, a documentary based on the search to prove one of the most difficult mathematical theories in history.
Singh’s presentation in Geneva turned directors’ attention to “the history of secrecy,” a topic that he covers in his 1999 book, The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography (Doubleday). He pointed to writers of the popular TV programs, The Simpsons and Futurama, to highlight how unexpected points about mathematics and science hidden in plain sight and how susceptible we are to finding patterns that may have absolutely no meaning.
He cited several instances of codes being found in popular texts or songs, including in the rock band Led Zeppelin’s “Stairway to Heaven,” which when played in reverse has been interpreted to contain an evil message. When Singh queued up the song, at first no one in the audience heard any discernable words. Then he pointed to the lyrics on a slide deck and almost half of the audience “heard” the words. His point? To challenge the audience to be more skeptical and open to believing that which can be proven—or disproven—with rigorous evidence.
When the science of cryptography was introduced to the audience. Singh noted that messages can be found as a pattern almost anywhere—including in Moby-Dick, where one author found an inordinate number of passages pointing to history that had coincidentally happened since its publication in 1851. The human mind, however, has been able over the millennia to form some truly remarkable codes that have eluded prying eyes and minds for hundreds of years.
While some of the earliest computing machines, such as Enigma, developed during the First World War present nearly insurmountable odds against being deciphered, Singh reminded the audience that all ciphers are created by humans, and where there are humans, there is bound to be error. The same human curiosity and propensity to find patterns in behavior has led some skilled code-breakers such as those at the UK’s Bletchley Park who turned the tide of World War II by breaking codes.
Directors in the audience were challenged to think of the technologies that could protect their company’s own secrets while also considering the power—and foibles—of human error. Singh brought with him a prized possession: his very own Enigma machine.
When he turned to the audience to see if they had any questions about it after a brief demonstration, one attendee asked how the next frontier of quantum encryption would impact businesses. Singh pointed to the fact that scientists in Geneva were already sending messages encrypted at the quantum level within cities, and that others had sent quantum-secured messages via satellite. Quantum computing itself could make all encryption obsolete, he said. Such a development would render useless our current understanding of how to protect corporate assets, such as customer information and other data. He also noted that no one really knows what governments around the world have already achieved regarding this next frontier in information security.
Coverage of the full day of programming at the Global Cyber Forum is forthcoming in another installment of the blog and in the May/June issue of NACD Directorship magazine.
The European Union’s (EU) General Data Protection Regulation (GDPR) is causing a seismic shift in the digital information space, and, whether your company has a presence in Europe or not, the sweeping regulation likely applies. As a director in the era of bet-the-farm digital transformation, familiarity with the basics of GDPR is a must. To that end, Michael Walter and Joel Wuesthoff, experts from Protiviti and Robert Half Legal, respectively, recently presented the ins and outs of the regulation at an NACD Atlanta Chapter program.
Does GDPR even apply to my company?
Effective May 25, 2018, it probably does. The regulation is borderless and applies to all organizations—regardless of size and regardless of whether they have a physical European location—that collect and process personal data of data subjects in the EU. An EU data subject is anyone from whom personal data is collected while in the EU (i.e. data subject is not limited to someone with EU “citizenship”). For example, a skier from Colorado who buys a snowboard online while in the EU may subject the product seller to the GDPR. The rules apply to both data controllers and data processors. The range of information that is protected is quite broad, ranging from vehicle identification numbers to photos to employment information to IP addresses.
If GDPR applies, what’s the big deal?
In the U.S., personal information is often collected as a matter of course, with only an “opt out” offered to consumers. By contrast, GDPR requires that in order to collect information from EU data subjects, an affirmative “opt in” consent must be obtained that clearly specifies how the data will be used. Privacy policies must match. Then, once information is obtained, the EU data subject has the right to request that his or her data be deleted; that is, to invoke the right “to be forgotten.” Incorrect information must be corrected upon request. These rights may seem simple enough, but when data is held in multiple locations, developing a process to handle such requests may be quite difficult.
The burdens of GDPR cannot be outsourced, as companies have joint and several liability with third-party vendors. Due diligence requirements for vendors therefore will be heightened, and all in scope data processors will need to be GDPR compliant.
What if my company has a data breach or fails to comply?
In the event of a data breach involving an EU subject, the breached company has 72 hours to notify regulators and must notify EU data subjects without undue delay under certain conditions.
Fines for failure to comply with GDPR can be up to 20M Euros or four percent of an organization’s annual global turnover, whichever is higher. Further, data subjects can claim compensation for damages from breaches of their personal data.
GDPR won’t be enforced right away, will it?
The expectation is that GDPR likely will be enforced right away against global organizations that collect large volumes of personal data. However, beware. EU countries continue to hire people for enforcement of the GDPR. Also, since individuals have a right of action, it is unclear whether GDPR will be used as a manner of protest against companies that are unpopular with EU data subjects.
What should I be asking management?
The path to compliance with GDPR will require a multi-functional task force, including information technology, legal, human resources, privacy, and other functions. Directors may consider asking about the key phases of compliance:
Discovery and inventory: Have we identified high risk areas to ensure a focused approach?
Gap analysis: Have we determined exposure and prioritized compliance activities?
Compliance remediation: Are we implementing changes to achieve compliance?
Ongoing compliance: Are we prepared to provide evidence of accountability and compliance?
Boards may also want to discuss the appointment of—and ramifications of having—a data protection officer (DPO), required under GDPR for companies processing large scale data; however, bear in mind that the DPO is a unique intermediary between the regulators, the organization and the data subjects who is required to be an independent actor within the organization reporting up to the highest levels of the organization. Care must be taken prior to appointing a DPO as significant obligations attach once this decision is made.
In short, GDPR’s long reach and substantial requirements merit fulsome discussions in the boardroom, even of U.S. companies. Is your company ready?
Looking to learn more about how your board will be impacted by GDPR? Stay tuned. NACD will release an FAQ brief in May.
Kimberly Simpson is an NACD regional director, providing strategic support to NACD chapters in the Capital Area, Atlanta, Florida, the Carolinas, North Texas and the Research Triangle. Simpson, a former general counsel, was a U.S. Marshall Memorial Fellow to Europe in 2005.
In 2015, Chrysler issued a 1.4 million-vehicle recall to plug a security hole that could enable hackers to take over a car remotely. It’s the frightening reality that internet-connected systems in cars can present new vulnerabilities, which only stand to get worse as such systems proliferate and cars become more autonomous.
Reacting to this danger, Michigan lawmakers initially introduced legislation to make car hacking punishable by up to life in prison. But cybersecurity researchers argued that hacking for testing purposes can be a good thing because it reveals vulnerabilities—as it did for Chrysler—that can then be corrected by manufacturers. Therefore, placing a blanket restriction on car hacking could interfere with keeping the public safe.
It’s only through dialogue between industry and government that such thorny policy problems can be effectively resolved. Doing so is vital to the national interest as well as to individual companies, and boards of directors can play an important role in reviewing the work being done by executives and legal counsel to connect the company to the right partners in government.
Combating Cyber Threats Together
The ever-expanding complexity of cybersecurity drives a need for those with deep expertise to engage policymakers in informed discussion. Given that the increasing adoption of connected technologies makes cybersecurity vital to everything from manufacturing to healthcare, this discussion needs to take place across industries. That’s why lawmakers and regulators rely upon experts with specific industry expertise for input, factoring this advice into their final decisions.
This presents companies across a range of industries an opportunity to engage in meaningful conversations about the threats they are seeing. The board can plan a role in encouraging that dialogue by asking its executives how they are engaging with government officials on information sharing, for instance.
Industry leaders can often spot areas for improvement in proposed regulations that others may miss due to a lack of expertise. For example, in 2013, officials aiming to stop the distribution of hacking technologies to oppressive regimes proposed broad new restrictions on cybersecurity-related software as part of the Wassenaar Arrangement, an international export control agreement.
At Rapid7, we foresaw that the new controls could actually compromise global security by blocking access by legitimate international organizations to the tools they needed to stay secure. So we joined with other cybersecurity firms and experts to publicly comment on the proposed controls. After lengthy discussion, education, and effort—so often a prerequisite for complex issues—the export controls were recently modified to create new protections and exceptions for legitimate cybersecurity activity.
Being a part of the conversation helps avoid policies that are poorly executed or one-sided. And since good policies and a strong industry are in the best interests of each country, lawmakers around the globe often welcome that dialogue.
But what’s the best way for companies to engage? And how should directors oversee work done by their companies to actively work with national and international agencies on cyber issues?
Different Levels of Engagement
Corporate boards can play an important role by ensuring that engagement is incorporated into the company’s broader risk management strategy. Companies can opt into different levels of engagement for policy advocacy, much of it at negligible cost. And while official public-private partnerships generally require more significant resources, less formal opportunities for collaboration are in no short supply.
For example, many industries, such as healthcare, transportation, and the financial sector, have established information sharing and analysis centers (ISACs), providing resources for gathering information on cyber threats, coordinating with government agencies, and disseminating critical advisories.
Another example: Before government bodies issue a policy, report, or guidance, they often solicit public input and feedback. In fact, they’re often required to consider those comments in decision making. At Rapid7, we write letters and comment on policy drafts on topics that we feel are important to the business community at large. To engage on the low end of the bandwidth scale, however, companies can also simply sign on to letters or comments that others have opened to group signatures. Directors should consider asking what the company’s plans are for engaging in such action.
The board can also push the management team to make use of available educational opportunities such as workshops. One we recently attended centered on botnets and other automated attacks. The US Department of Commerce solicited public written comments and held a workshop where the public was encouraged to lend their opinions and expertise. This and other feedback will help shape the final report and subsequent action to tackle the problem.
Engagement for the Greater Good
Cybersecurity is critically important to every major industry. Policymakers want to hear from these industries about the issues they face, and how they overcome them. This provides an opportunity for businesses, experts, and consumers to positively influence policy for the greater good. Conversely, poorly implemented policies can be ineffective, inefficient, and even harmful.
In the case of the Michigan car hacking bill, nearly two dozen cybersecurity researchers, academics, and companies wrote a letter to Michigan legislators detailing concerns about the effect of the proposed law on cybersecurity. Ultimately, the lawmakers created new protections for security research carried out in safe conditions. Without sustained engagement between the business community and policymakers, the result would have been much different.
It may require some effort and even some expenditure of resources, but it is essential that experts at companies work to assist officials with crafting well-informed and effective policies.
Corey E. Thomas is CEO of Rapid7. Read more of his insightshere.