Connect with us

Tech

ICO wins appeal over data protection obligations in Currys cyber attack | Computer Weekly

Published

on

ICO wins appeal over data protection obligations in Currys cyber attack | Computer Weekly


The Court of Appeal (CoA) has ruled in favour of the Information Commissioner’s Office in an appeal against a previous decision regarding the data protection responsibilities of businesses that arose after a 2018 cyber attack on DSG Retail – which now operates as Currys Group Ltd – the parent organisation of former UK electronics retail brands including Carphone Warehouse, Dixons and PC World.

DSG fell victim to a major cyber attack during a nine-month period in 2017 and 2018. The incident saw cyber criminals install malware on the firm’s point-of-sale (PoS) devices that was used to steal personal data including the credit and debit card details of millions of customers, and in a small number of cases their names, postcodes and contact details.

In January 2020 the ICO levied a £500,000 fine on DSG under the Data Protection Act of 1998 (DPA) after its investigation found the retailer had failed to patch software systems, install firewalls, segregate its networks, conduct routine security testing, or protect personal data. The fine was lower than that mandated under the General Data Protection Regulation (GDPR) because the breach took place before it came into effect.

In previous appeals to the First Tier Tribunal (FTT) and Upper Tribunal (UT), DSG argued that the seventh data protection principal (DPP7) of the DPA under which it was fined was not applicable to the incident.

It said that while the attackers did obtain full 16-digit card numbers, expiry dates and cardholder names in a limited number of cases, in most cases the cards were protected by electromagnetic verification (EMV) – chip-and-pin – so the attackers could only obtain the 16-digit card numbers and expiry dates, and no names.

As such, it said it did not need to take ‘appropriate technical and organisational measures’ (Atoms) to secure the EMV data because it was not ‘personal data’ in the hands of a third-party. It argued that the question over the applicability of DPP7 to said data needed to be considered from the point of view of the third-party – that is to say, the hackers.

The FTT initially dismissed this argument, but the UT supported it, prompting the ICO to seek permission to appeal last year. At the time, information commissioner John Edwards said the DPA was clear that organisations must put Atoms in place to protect personal data regardless of whether it was pseudonymised.

“We have seen many cases where people have been affected when malicious actors have accessed, deleted or encrypted pseudonymised personal data, for example when medical or financial data is compromised,” he said.

Today’s decision, handed down by Lord Justice Warby, supports Edwards’ view, concluding that when an individual to whom data relates may is identifiable to a data controller, the data controller must safeguard that data against unauthorised or unlawful processing whether or not the person processing it can use it to identify the individual.

The ICO welcomed the CoA ruling, saying it clarified an important point of data protection law in reinstating a clear interpretation of the legal responsibilities of organisations to keep personal data safe.

“I have concluded that the UT’s reasons for adopting a narrow interpretation of the statutory wording, though careful and thorough, are not in the end compelling,” wrote Warby in his judgement.

“They lead to some surprising conclusions. In my judgment, a broader construction is more consistent with the language of the statute and its parent Directive, the identifiable purposes of the data protection legislation, and with the few decided cases that have any significant bearing on this issue. I would therefore allow the appeal.”

“Today’s judgment is a significant victory, bringing much-needed clarity for people affected by cyber attacks as well as industry,” said ICO general counsel Binnie Goh.

“We welcome the CoA’s confirmation that organisations must protect all personal data they process, regardless of how it might be used or exploited by hackers. This recognises that even if hackers can’t identify people individually from stolen datasets, cyber attacks can and do still cause real harm.

“With the rising threat of cyber crime, this decision strengthens our ability to take robust action in the future and sends a clear message to all organisations: you have a protective duty to safeguard the personal data you hold,” said Goh.

Computer Weekly has contacted Currys Group Ltd for a response, and this article will be updated should one be received.

The case will return to the FTT at a later data to reapply the CoA’s new interpretation to the facts of the DSG incident.



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

One of Our Favorite 360 Cams Is 35 Percent Off

Published

on

One of Our Favorite 360 Cams Is 35 Percent Off


Tired of taking your action camera on an adventure, only to get home and find out you missed the action with a bad angle? One option is to switch to a 360-degree action cam, so you can capture all of the action and then edit down to just the good stuff later. One of our favorite options, the DJI Osmo 360, is currently available for just $390 on Amazon, a $209 discount from its usual price, and it comes with a selfie stick and an extra battery.

The DJI Osmo 360 achieves its impressive all-around video quality by leveraging a pair of 1/1.1-inch sensors, larger than some other offerings, and by supporting 10-bit color. You can really see that in the camera’s output, with colors that are vivid and bold, to the point that you may need to dial them back a bit in post if you want something more natural. With support for up to 50 frames per second at 8K when recording in 360 degrees, or 120 fps at 4K when shooting with only one sensor, you’ll have plenty of material to work with. In our testing, it ran for just shy of two hours at 30 fps, which is also around the time the internal storage had filled up anyway.

If you plan on catching any serious discussions with your Osmo 360, you’ll be pleased to know it connects directly to DJI’s line of wireless lavalier microphones, including the excellent and frequently discounted DJI Mic 2 and Mic Mini. If you want to mount it to something other than the included 1.2-meter selfie stick, it has both DJI’s magnetic attachment system and a more traditional ¼”-20 tripod mount. The DJI Mimo app lets you control the camera and adjust any settings, and there’s even a simple editor for on-the-fly production. For desktop users, DJI Studio has even more in-depth settings and editing options, in case you don’t want to pay for Premiere.

The DJI Osmo 360 is one of our favorite action cameras, and is particularly appealing at the discounted price point, but make sure to check out our full review for more info, or head over to our full roundup to see what else is available.



Source link

Continue Reading

Tech

Artemis II: Everything We Know as Its Crew Approaches the Far Side of the Moon

Published

on

Artemis II: Everything We Know as Its Crew Approaches the Far Side of the Moon


On day six of its mission, Artemis II is closing in on the far side of the moon. Meanwhile, the historic journey has not been without fascinating and curious stories, from the images and videos that its four crew members have shared with the world to the inevitable unforeseen events—including a tricky toilet situation.

A few hours before the crew begins its lunar flyby, here’s how things are going on Artemis II.

When Will They Reach the Far Side of the Moon?

While Artemis II won’t actually land on the moon (that won’t happen until Artemis IV), that does not make this mission any less compelling. Once the Artemis II astronauts finish flying over the dark side of the moon, they will have the historic distinction of being the humans who have traveled the farthest from Earth.

They will also test all the systems needed for future lunar missions, validating life support, navigation, spacesuits, communications, and other human operations in deep space.

But when are they supposed to reach this far-off point? First, the Orion capsule reached what is known as the moon’s “sphere of influence” on Sunday night. This is the point where the moon’s gravitational force is stronger than the force of the Earth.

At present, Orion is circling the moon. Once the capsule is on the dark side of the moon, approximately 7,000 kilometers from the surface, communications with Earth will be interrupted. For six hours, they will be able to view the far side of the moon, something no human being has ever seen with their own eyes—not even the astronauts of the Apollo program, as this region of the moon was always too dark or difficult for them to reach.

That six-hour flyby of the dark side of the moon is expected to begin Monday, April 6, at 2:45 pm EDT and 7:45 pm London time.

After that, the capsule will use the moon’s gravity to propel itself back to Earth. Splashdown, when the astronauts reach Earth, is scheduled for April 10 in the Pacific Ocean, not far from the coast of California, the tenth day of the mission.

Remember that you can follow the live broadcast of the Artemis II mission from NASA’s official channels.

What Has Happened so Far?

Since its successful launch on April 1 from Kennedy Space Center, the Artemis II crew has shared several spectacular photos, such as the featured image in this post, which shows mission specialist Christina Koch looking down at Earth through one of Orion’s main cabin windows.

This incredible photo of a Earth, taken on April 2, went viral on social media, referencing the famous “Blue Marble” image captured by the Apollo 17 astronauts in 1972.

View of Earth taken by astronaut Reid Wiseman from the window of the Orion spacecraft after completing the translunar injection maneuver on April 2, 2026.Photograph: Reid Wiseman/NASA/Getty Images



Source link

Continue Reading

Tech

The DOJ Misled a Judge About How It’s Using Voter Roll Data

Published

on

The DOJ Misled a Judge About How It’s Using Voter Roll Data


Last week in Rhode Island, in a hearing over the Trump administration’s efforts to access the state’s unredacted voter lists, US district judge Mary McElroy asked a Department of Justice lawyer what the agency had been doing with the voter roll data it already amassed from other states in recent months.

“We have not done anything yet,” said Eric Neff, the acting chief of the agency’s voting section, a core part of the DOJ’s civil rights division that focuses on enforcing federal laws that protect the right to vote. Neff added that the data the DOJ collected from states—which can include Social Security numbers, drivers licenses, dates of birth, and addresses—was being kept separate.

“The United States is taking extra concern to make sure that we’re complying with the Privacy Act in every conceivable way,” Neff added. The Privacy Act of 1974 regulates how government agencies collect and use personally identifiable information about US residents.

But Neff was not telling the truth: The DOJ, he later admitted, was pooling the data and already analyzing it to identify voting irregularities.

In a court document filed on March 27, Neff walked back his claims. “The United States represented that each data set was stored separately,” Neff wrote. “The United States also stated that no analysis had yet been conducted on the data. To correct and clarify the record, preliminary internal data analysis of the nonpublic voter registration data has begun. In particular, the Civil Rights Division has begun the process of identifying and quantifying the number and type of duplicate and deceased registered voters in each state.”

The revelation confirms what was widely speculated, which is that the DOJ appears to be pooling the data and using it to identify potential issues with suspected voting irregularities ahead of the midterms, which is a core part of Trump’s broad attack on elections.

Neff and the DOJ did not respond to repeated requests for comment.

Critics have grown increasingly concerned about the DOJ’s voting section, which has undergone a stark transformation since President Donald Trump has retaken office. A newly installed coterie of inexperienced but ultra-loyal lawyers in the DOJ’s voting section, many of whom have supported election denial conspiracy theories, have spent their time on forcing states to hand over their voter roll information.

The initiative began in May last year, when the Department of Justice sent letters to election officials in at least 48 states and Washington, DC, asking for unredacted voter rolls. Some Republican-led states immediately handed over the information, but dozens of others pushed back. As a result, Neff and his colleagues have sued 30 states, asking courts to force them to hand over the information. So far, courts have sided with the states, with judges already dismissing cases in California, Michigan, and Oregon.

In many of the lawsuits, state election officials pointed out the huge security risk involved in sharing such sensitive data, especially when it was unclear how the data would be stored or who it would be shared with. “We still have no idea what the government is doing with this data,” says David Becker, the head of the Center for Election Innovation and Research and a former Justice Department lawyer. “No idea where it is being stored, how it is being protected, or who has access to it. This data is incredibly sensitive. If someone has any of these three data points on any of us, Social Security number, driver’s license number, or date of birth, they can wreck us financially. This is why the states protect this data, and they do a good job of it.”



Source link

Continue Reading

Trending