Connect with us

Tech

ICO wins appeal over data protection obligations in Currys cyber attack | Computer Weekly

Published

on

ICO wins appeal over data protection obligations in Currys cyber attack | Computer Weekly


The Court of Appeal (CoA) has ruled in favour of the Information Commissioner’s Office in an appeal against a previous decision regarding the data protection responsibilities of businesses that arose after a 2018 cyber attack on DSG Retail – which now operates as Currys Group Ltd – the parent organisation of former UK electronics retail brands including Carphone Warehouse, Dixons and PC World.

DSG fell victim to a major cyber attack during a nine-month period in 2017 and 2018. The incident saw cyber criminals install malware on the firm’s point-of-sale (PoS) devices that was used to steal personal data including the credit and debit card details of millions of customers, and in a small number of cases their names, postcodes and contact details.

In January 2020 the ICO levied a £500,000 fine on DSG under the Data Protection Act of 1998 (DPA) after its investigation found the retailer had failed to patch software systems, install firewalls, segregate its networks, conduct routine security testing, or protect personal data. The fine was lower than that mandated under the General Data Protection Regulation (GDPR) because the breach took place before it came into effect.

In previous appeals to the First Tier Tribunal (FTT) and Upper Tribunal (UT), DSG argued that the seventh data protection principal (DPP7) of the DPA under which it was fined was not applicable to the incident.

It said that while the attackers did obtain full 16-digit card numbers, expiry dates and cardholder names in a limited number of cases, in most cases the cards were protected by electromagnetic verification (EMV) – chip-and-pin – so the attackers could only obtain the 16-digit card numbers and expiry dates, and no names.

As such, it said it did not need to take ‘appropriate technical and organisational measures’ (Atoms) to secure the EMV data because it was not ‘personal data’ in the hands of a third-party. It argued that the question over the applicability of DPP7 to said data needed to be considered from the point of view of the third-party – that is to say, the hackers.

The FTT initially dismissed this argument, but the UT supported it, prompting the ICO to seek permission to appeal last year. At the time, information commissioner John Edwards said the DPA was clear that organisations must put Atoms in place to protect personal data regardless of whether it was pseudonymised.

“We have seen many cases where people have been affected when malicious actors have accessed, deleted or encrypted pseudonymised personal data, for example when medical or financial data is compromised,” he said.

Today’s decision, handed down by Lord Justice Warby, supports Edwards’ view, concluding that when an individual to whom data relates may is identifiable to a data controller, the data controller must safeguard that data against unauthorised or unlawful processing whether or not the person processing it can use it to identify the individual.

The ICO welcomed the CoA ruling, saying it clarified an important point of data protection law in reinstating a clear interpretation of the legal responsibilities of organisations to keep personal data safe.

“I have concluded that the UT’s reasons for adopting a narrow interpretation of the statutory wording, though careful and thorough, are not in the end compelling,” wrote Warby in his judgement.

“They lead to some surprising conclusions. In my judgment, a broader construction is more consistent with the language of the statute and its parent Directive, the identifiable purposes of the data protection legislation, and with the few decided cases that have any significant bearing on this issue. I would therefore allow the appeal.”

“Today’s judgment is a significant victory, bringing much-needed clarity for people affected by cyber attacks as well as industry,” said ICO general counsel Binnie Goh.

“We welcome the CoA’s confirmation that organisations must protect all personal data they process, regardless of how it might be used or exploited by hackers. This recognises that even if hackers can’t identify people individually from stolen datasets, cyber attacks can and do still cause real harm.

“With the rising threat of cyber crime, this decision strengthens our ability to take robust action in the future and sends a clear message to all organisations: you have a protective duty to safeguard the personal data you hold,” said Goh.

Computer Weekly has contacted Currys Group Ltd for a response, and this article will be updated should one be received.

The case will return to the FTT at a later data to reapply the CoA’s new interpretation to the facts of the DSG incident.



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

Artemis II: Everything We Know as Its Crew Approaches the Far Side of the Moon

Published

on

Artemis II: Everything We Know as Its Crew Approaches the Far Side of the Moon


On day six of its mission, Artemis II is closing in on the far side of the moon. Meanwhile, the historic journey has not been without fascinating and curious stories, from the images and videos that its four crew members have shared with the world to the inevitable unforeseen events—including a tricky toilet situation.

A few hours before the crew begins its lunar flyby, here’s how things are going on Artemis II.

When Will They Reach the Far Side of the Moon?

While Artemis II won’t actually land on the moon (that won’t happen until Artemis IV), that does not make this mission any less compelling. Once the Artemis II astronauts finish flying over the dark side of the moon, they will have the historic distinction of being the humans who have traveled the farthest from Earth.

They will also test all the systems needed for future lunar missions, validating life support, navigation, spacesuits, communications, and other human operations in deep space.

But when are they supposed to reach this far-off point? First, the Orion capsule reached what is known as the moon’s “sphere of influence” on Sunday night. This is the point where the moon’s gravitational force is stronger than the force of the Earth.

At present, Orion is circling the moon. Once the capsule is on the dark side of the moon, approximately 7,000 kilometers from the surface, communications with Earth will be interrupted. For six hours, they will be able to view the far side of the moon, something no human being has ever seen with their own eyes—not even the astronauts of the Apollo program, as this region of the moon was always too dark or difficult for them to reach.

That six-hour flyby of the dark side of the moon is expected to begin Monday, April 6, at 2:45 pm EDT and 7:45 pm London time.

After that, the capsule will use the moon’s gravity to propel itself back to Earth. Splashdown, when the astronauts reach Earth, is scheduled for April 10 in the Pacific Ocean, not far from the coast of California, the tenth day of the mission.

Remember that you can follow the live broadcast of the Artemis II mission from NASA’s official channels.

What Has Happened so Far?

Since its successful launch on April 1 from Kennedy Space Center, the Artemis II crew has shared several spectacular photos, such as the featured image in this post, which shows mission specialist Christina Koch looking down at Earth through one of Orion’s main cabin windows.

This incredible photo of a Earth, taken on April 2, went viral on social media, referencing the famous “Blue Marble” image captured by the Apollo 17 astronauts in 1972.

View of Earth taken by astronaut Reid Wiseman from the window of the Orion spacecraft after completing the translunar injection maneuver on April 2, 2026.Photograph: Reid Wiseman/NASA/Getty Images



Source link

Continue Reading

Tech

The DOJ Misled a Judge About How It’s Using Voter Roll Data

Published

on

The DOJ Misled a Judge About How It’s Using Voter Roll Data


Last week in Rhode Island, in a hearing over the Trump administration’s efforts to access the state’s unredacted voter lists, US district judge Mary McElroy asked a Department of Justice lawyer what the agency had been doing with the voter roll data it already amassed from other states in recent months.

“We have not done anything yet,” said Eric Neff, the acting chief of the agency’s voting section, a core part of the DOJ’s civil rights division that focuses on enforcing federal laws that protect the right to vote. Neff added that the data the DOJ collected from states—which can include Social Security numbers, drivers licenses, dates of birth, and addresses—was being kept separate.

“The United States is taking extra concern to make sure that we’re complying with the Privacy Act in every conceivable way,” Neff added. The Privacy Act of 1974 regulates how government agencies collect and use personally identifiable information about US residents.

But Neff was not telling the truth: The DOJ, he later admitted, was pooling the data and already analyzing it to identify voting irregularities.

In a court document filed on March 27, Neff walked back his claims. “The United States represented that each data set was stored separately,” Neff wrote. “The United States also stated that no analysis had yet been conducted on the data. To correct and clarify the record, preliminary internal data analysis of the nonpublic voter registration data has begun. In particular, the Civil Rights Division has begun the process of identifying and quantifying the number and type of duplicate and deceased registered voters in each state.”

The revelation confirms what was widely speculated, which is that the DOJ appears to be pooling the data and using it to identify potential issues with suspected voting irregularities ahead of the midterms, which is a core part of Trump’s broad attack on elections.

Neff and the DOJ did not respond to repeated requests for comment.

Critics have grown increasingly concerned about the DOJ’s voting section, which has undergone a stark transformation since President Donald Trump has retaken office. A newly installed coterie of inexperienced but ultra-loyal lawyers in the DOJ’s voting section, many of whom have supported election denial conspiracy theories, have spent their time on forcing states to hand over their voter roll information.

The initiative began in May last year, when the Department of Justice sent letters to election officials in at least 48 states and Washington, DC, asking for unredacted voter rolls. Some Republican-led states immediately handed over the information, but dozens of others pushed back. As a result, Neff and his colleagues have sued 30 states, asking courts to force them to hand over the information. So far, courts have sided with the states, with judges already dismissing cases in California, Michigan, and Oregon.

In many of the lawsuits, state election officials pointed out the huge security risk involved in sharing such sensitive data, especially when it was unclear how the data would be stored or who it would be shared with. “We still have no idea what the government is doing with this data,” says David Becker, the head of the Center for Election Innovation and Research and a former Justice Department lawyer. “No idea where it is being stored, how it is being protected, or who has access to it. This data is incredibly sensitive. If someone has any of these three data points on any of us, Social Security number, driver’s license number, or date of birth, they can wreck us financially. This is why the states protect this data, and they do a good job of it.”



Source link

Continue Reading

Tech

My Favorite Apple Watch Bands (and Which Ones to Avoid)

Published

on

My Favorite Apple Watch Bands (and Which Ones to Avoid)


Apple Watches are smart little gadgets, but they don’t always fit the vibe. There were plenty of nights and dressier events when I left mine at home because—as much as I wanted to check my notifications discreetly—it didn’t match my outfit. I’ve also had my fair share of faux pas and just let the neon orange sport band clash with my neutral ensemble.

Fortunately, Apple Watch bands are a simple and relatively affordable way to zhuzh up the look of your wearable. Beyond aesthetics, different styles also impact performance and functionality. For example, personally, I don’t want a heavy stainless steel or high-quality leather band weighing me down during a sweaty workout, just as I wouldn’t wear a flimsy silicone band to a dinner party.

At WIRED, we’ve been testing bands since the very first Apple Watch launched in 2015. After years of wearing and swapping, I’ve rounded up the best bands for every occasion. Be sure to check out Best Apple Watch Accessories, Best Apple Watch, and Best Smartwatches for more recommendations.

Jump to

Best Band for Everyday Wear

The Nike Sport Loop has been my everyday band since 2020. I bought another in 2023 because I wanted to swap colors, and I figured after three years, I should buy a brand-new one, but it has held up remarkably well. Made from a blend of recycled polyester, Spandex, and nylon, it’s breathable and lightweight. The double-layered nylon weave is designed with dense loops that help prevent moisture from getting trapped against your skin. As long as you regularly hand-wash it to rid it of sweat buildup and dirt, it stays odor-free.

The hook-and-loop fastener and pull tab make it easy to adjust with one hand. It is Velcro, so beware, it can snag on softer fabrics. Still, for a band designed with sports in mind, it’s understated enough to wear almost anywhere. I wouldn’t wear it to a formal event, but for the office or casual social events, it’s perfect.

Best Titanium Apple Watch Band

  • Photograph: Boutayna Chokrane

  • Photograph: Boutayna Chokrane

  • Photograph: Boutayna Chokrane

Nomad originally designed the Stratos Band for the Apple Watch Ultra, but it fits just as well with the SE and Series 1 through 11. It’s easy to adjust, refined enough for the office, and backed by Grade 4 titanium hardware with a scratch-resistant DLC coating. FKM rubber links (PFA-free and antimicrobial, according to Nomad) add flexibility, durability, and water-resistance. The clasp is made with corrosion-resistant N52 magnets, which make it effortless to snap on, and it’s designed with a manual release button, so you don’t have to worry about it accidentally falling off. It’s technically suited for workouts and outdoor use, but it is a hefty band that I personally prefer for casual everyday wear.



Source link

Continue Reading

Trending