>> Shifting focus away from
the search warrant requirements and
the requirements to search computer systems.
We go into other legal aspects and the
definition of personally identifiable information.
This is going to come into play for data breaches and
for information that might be
exposed where an organization
would not want that exposed.
This is a legal definition of what constitutes
personally identifiable information
for the United States.
If you're working in some other type of jurisdiction,
particularly across the seas
outside of the United States,
then this more than likely will not apply to you.
Sensitive personally identifiable information is
any information or compilation of information in
electronic digital form that
includes any of the following: so number 1,
you have an individual's first and last name
or first initial and last name,
and any combination with any of the
two of the following data elements.
So that's going to be their home address,
home telephone number, mother's maiden name,
and month, day, and year of birth.
Again, it has to be that first part of that sentence,
their first and last name,
and a combination of A, B,
or C in order to
constitute personally identifiable information.
Number 2 would be
a non-truncated social security number,
so that's going to be all the digits of your social,
a driver's license number,
a passport number,
alien registration number,
eight numbers as it's often referred to,
or other government-issued
unique identification numbers of
that could be a DOD identification number,
>> for instance.
>> Number 3 is going to be
unique biometric data such as fingerprint,
voice print, a retina-iris image
or any other unique physical representation.
Number 4 is going to be a unique account identifier,
including a financial account number
or a credit or debit card number,
electronic identification number,
user name or routing code.
Number 5, you'll have a user name or electronic mail
address in combination with
the password or security question,
and answer that would permit access
>> to an online account.
>> This is number 6,
which combines a lot of these elements,
any combination of following data elements.
An individuals first and last name
or a first initial and last name,
a unique account identifier,
including a financial account number
or a credit card number,
electronic identification, user name
or routing code, or any security code,
access code or password,
or source code that could be used to
generate such codes or passwords.
Those are some of the basic elements
that constitute personally identifiable information.
The reason that you need to know that is
when you do or if you do suffer a data breach,
the type of information that's exposed will warrant
your response of how you're supposed to
notify your customers of that breach.
Now that we have an understanding of
what personally identifiable information is,
at least that defined at the federal level,
we can start looking at some of
the notification requirements and what is required or
how you're supposed to notify
individuals if there is a data breach.
Essentially, there's two types of notice;
you have an individual notice
and you have a media notice.
For individual notice, notice to individuals can
be accomplished by one of the following means.
You'd have three means of an individual notice.
You have written notification to
the last known home mailing address at
the individual in the records of the business entity.
For the second method, you'd have
telephone notice to the individual personally.
Last one is you're going to have the email notice.
The email notice if the individual has
consented to receive such notice and the notice is
consistent with the provisions permitting
electronic transmission of notices under
section 101 of the Electronic
Signatures in Global and National Commerce Act.
You'll have to go in and look at
that Act if you're going to consider
notifying customers of potential data breach
to that specific Act.
The next one you're going to have is media notice.
A media notice,
if number of residents of the state
whose sensitive personally
identifiable information was or
is reasonably believed to have been accessed or
acquired by an authorized person exceeds 5,000,
notice to media reasonably
calculated to reach such individuals
such as major media outlets
serving the state or jurisdiction.
What is wrapped up in that
is that the individuals have to be
isolated to one state
and the number of that has to exceed 5,000.
On top of that, you're having to put notices in
a very major media outlet
serving that particular state or jurisdiction.
Obviously, you can't find
the smallest newspaper or the smallest radio station in
state and expect to reach
>> every person within that state.
>> Again, I would seek
legal counsel advice if
you are considering to do any of these,
but it just provides
a broad overview of what is generally expected.
Going forward, we look at
the national data breach notification standard.
This standard essentially provides any business entity
engaged in or affecting
interstate commerce that uses, accesses,
transmit, stores,
disposes of, or collect
sensitive personally identifiable information
about more than 10,000 individuals
during any 12-month period shall,
following the discovery of
a security breach of such information,
notify all individuals who
sensitive personally identifiable information has been
or is reasonably believed to have been accessed or
acquired unless there is
no reasonable risk of harm or fraud such individual.
There's a lot wrapped up in
that statement but essentially,
very large businesses that are dealing
with 10,000 or more individuals in
that 12-month period are required to essentially notify
those individuals if they believe
their data has been exposed.
Now there are exceptions to
this national data breach standard,
and those are generally reserved for
Law Enforcement and National Security Concerns.
More than likely what will happen
is that in certain cases,
the organization will actually be contacted by
Law Enforcement and International Security elements to
not notify customers and that goes back to
our previous topic of operational security.
Just as incident responders,
we want to maintain operational security
>> to not notify the attackers that we're
>> investigating them with our networks.
Law Enforcement and National Security
individuals would also want to maintain
>> operation security,
>> so they may contact your business.
Now that being said,
you as a business owner or as an incident responder,
don't have the authority to make that call.
Again, that would have to be at the direction of
Law Enforcement and National Security elements.
Then in order to determine if we're going
back to the last part of that statement,
is reasonably believed to have been accessed,
acquired unless there's no reasonable risk
of harm or fraud,
a risk assessment has to be conducted by
or on behalf of the business entity and
concluded that there is no reasonable risk that
a security breach has resulted in
>> or will result in harm.
>> The harm that individuals
>> whose sensitive personally identifiable information
was subject to the security breach.
Again, a lot of words in that.
Basically, it's summarized that as
the business has conducted that risk assessment.
However, you're going to do it,
you'd have to look and analyze that data
and come to that determination that you do not
believe that individuals information who is
exposed will come to any reasonable harm.
However, if you're doing that and you mess that up,
you might actually be in violation of the law
>> and you can subject yourself to further scrutiny
>> on dark or action by the government.
Again, it's very important to seek
legal counsel when or if you're
going to decide to do
that risk assessment and not notify individuals.
You want to make sure that you're doing
that correctly and above board.