Tag Archive for: Regulators

Ex-security head alleges Twitter misled regulators

/in


STORY: Shares of Twitter dropped sharply on Tuesday after the revelation of an explosive whistleblower complaint alleging the social media company misled federal regulators about its defenses against hackers and spam accounts.

The disclosures come from Twitter’s former security chief Peiter Zatko, a famed hacker more widely known as “Mudge,” who has testified before Congress about the vulnerabilities of the internet in the past.

“If you’re looking for computer security, then the internet is not the place to be.”

Zatko, seen here in an interview with Reuters at the 2019 Black Hat cybersecurity conference, filed an 84-page complaint last month with multiple government agencies, alleging that Twitter falsely claimed it had a solid security plan and said he had warned colleagues that half the company’s servers were running out-of-date and vulnerable software.

The complaint, which was first reported by the Washington Post and CNN, was also sent to congressional committees.

A Twitter spokesperson said on Tuesday that Zatko was fired in January for “ineffective leadership and poor performance” less than two years after then-CEO Jack Dorsey appointed him to the role, and said his complaint was designed to capture attention and inflict harm on Twitter.

The whistleblower complaint comes at a rough time for the social platform, as it’s embroiled in a legal battle with Elon Musk after he said in July he was ending an agreement to buy the company, alleging Twitter had violated the terms of the deal.

The world’s richest person has accused Twitter of hiding information about how it calculates the percentage of bots on the service.

The whistleblower complaint alleges Twitter prioritized user growth over reducing spam, offering executives massive bonuses for increases in daily users and nothing explicitly for cutting spam.

CNN reported that Musk’s legal team has subpoenaed Zatko, after the whistleblower disclosure was made public. The Tesla CEO could not be reached for comment.

Source…

China’s Internet Stocks Look Cheap but Regulators May Not Be Done Yet

/in


Text size

Source…

Financial Regulators Eye Stricter Cybersecurity Incident Reporting Standards

/in


The Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (Board), and the Federal Deposit Insurance Corporation (FDIC) (collectively, the Regulators) are considering a new rule that would require banks to notify their primary federal regulator within 36 hours of when they believe certain security incidents have occurred.

The Regulators are also proposing a new rule that would require bank service providers to notify at least two individuals at the affected bank immediately after the service provider experiences a computer security incident that could disrupt, degrade, or impair the provision of services for more than four hours.

The Regulators published a notice of proposed rulemaking (NPR) in the Federal Register on January 12, 2021, which allows for public comments for 90 days (until April 12, 2021).

Banks should consider the potential impact on procedures, operations, and vendor relations. If new rules are implemented, banks may need to update numerous documents, policies, and contracts that touch on these issues.

Renewed interest in the cyber health of the financial sector

The impetus behind the NPR is not the Regulators’ desire to start policing banks’ cybersecurity programs, or a desire to add a new regulatory burden on banks and their service providers. Rather, the Regulators want to make the rules governing notification consistent, and they want to gather more information about the types of cybersecurity incidents that could impact the stability of the financial sector.

Regardless, it has been quite some time since the Regulators have addressed cybersecurity rulemaking, so it is indicative of a renewed interest in the cyber health of the financial sector.

According to the Regulators, receiving this type of information about cybersecurity incidents from banks early and often can help the Regulators gather intelligence about emerging threats to individual banks and the financial system at large.

Banks required to notify primary regulators of “notification incidents” within 36 hours

Although the NPR sets a new, somewhat strict 36-hour reporting timeline for banks experiencing a cybersecurity incident, the Regulators…

Source…

FCC Forced To Fine Sinclair $48 Million For Bullshitting Regulators

/in

Last year when Sinclair attempted to acquire Tribune Broadcasting for a cool $ 3.9 billion, you might recall the company was accused of some highly dodgy behavior in order to get the deal done. Despite the FCC doing its best to neuter most media consolidation protections to help move the deal forward, the union would have still resulted in the merged company violating media ownership limits and dominating local broadcasting in a huge number of new markets.

To get around those limits, Sinclair allegedly got, uh, creative. Consumer groups accused Sinclair of trying to offload several of its companies to Sinclair-owned shell companies to pretend the deal would remain under the government’s ownership cap. The company also tried something similar in trying to offload some stations to friends and other partner companies at highly discounted rates, allowing it to technically not “own” — but still control — those stations.

It was all so dodgy that even the Ajit Pai FCC, which had initially been doing cartwheels to clear the way for the merger, had to back away from its support of the deal, shoveling deal approval off to an administrative law judge for review (aka the “kiss of death”). Tribune was then forced to kill the merger, and quickly thereafter filed a lawsuit against Sinclair for monumentally flubbing the deal.

Fast forward to this week, and the FCC has finally issued a $ 48 million fine for repeatedly misleading regulators. In a statement, FCC boss Ajit Pai criticized Sinclair, but also criticized those insisting the company’s broadcast licenses should be stripped away:

“Sinclair’s conduct during its attempt to merge with Tribune was completely unacceptable,” said FCC Chairman Ajit Pai. “Today’s penalty, along with the failure of the Sinclair/Tribune transaction, should serve as a cautionary tale to other licensees seeking Commission approval of a transaction in the future. On the other hand, I disagree with those who, for transparently political reasons, demand that we revoke Sinclair’s licenses. While they don’t like what they perceive to be the broadcaster’s viewpoints, the First Amendment still applies around here.”

Sinclair is, of course, under “political” fire for the fact that the company has been hoovering up quality local news outlets and replacing them with what, in many instances, is little more than political propaganda, something exposed by that viral Deadspin video. Pai was, of course, fine with that aspect of Sinclair’s effort, which annoyed those trying to reform the media sector and the rules governing the use of (purportedly) publicly-owned airwaves:

Pai’s go to move is to always simply dismiss any criticism of his agency or industry as “political.” But there’s some very legitimate questions here about what it means to use citizen-owned airwaves to broadcast propaganda, especially given the consolidation in media has decimated quality local news broadcasts to a scientifically measurable degree. It’s a shift that plays a massive role in U.S. culture, resulting in a populace that’s less informed and more divided that ever. Oh, and it’s potent enough of a force that it can measurably impact elections.

Obviously Pai and Sinclair don’t care about this now because it’s working in their party’s favor politically. But it’s still a problem.

Meanwhile, it’s hard to over-state just how sleazy you have to be to force this industry-cozy FCC to issue such a fine. And while the fine is the biggest ever levied against a broadcaster by the FCC (which isn’t saying much), Sinclair will very likely have the fine reduced or eliminated completely when folks aren’t paying attention. The penalty also doesn’t come with any kind of meaningful reform. And the decades-old media consolidation rules (long enjoying bipartisan support) the FCC stripped away to help Sinclair (before it went off the rails) remain undone, meaning the core problem — consolidation and the erosion of quality, local broadcasting and journalism — is likely to only get worse.

Techdirt.