Biometrics Institute finds privacy, data protection, legislation lead industry concerns in 2019

NIST Shows Facial Recognition Has Improved 20 Times in 4 Years

A significant increase in the use of biometrics in all sectors was noticed in 2019, however a higher concern was expressed regarding controversies around the technology’s use such as privacy, ethics and responsible use, says the State of Biometrics Report 2019 released by the Biometric Institute. The report found that public opinion had a direct influence in where policy is heading with a number of U.S. cities limiting biometrics use on the public, however biometric technologies were still deployed for activities that raise ethical concerns, such as mass surveillance in China.

The report quotes 2018 findings by the U.S. National Institute of Standards and Technology (NIST) which showed that facial recognition performance had improved 20 times in just four years. Facial recognition, however, is seen differently by the public, who is concerned about its capabilities and future deployments in relation to privacy, ethics, and data protection, and the private sector that has widely accepted it and is already working on different roll out strategies.

The Biometrics Institute Annual Survey found that privacy, data protection, ethics, and legislation are top concerns among its respondents who are both members and non-members. With almost twice as many respondents for its tenth annual survey, 44 percent said legislation is not strict enough, showing that industry experts don’t consider legislation a roadblock for innovation and investment in biometrics. biometricupdate.com

Background Checks Litigation Rising
FCRA Litigation on Track to Reach a New High
The number of lawsuits brought under the Fair Credit Reporting Act (FCRA) will be the highest on record at the close of 2019-a reminder to employers that conduct background checks that they need to comply with the law to avoid expensive legal action.

FCRA litigation increased by 8.7 percent year-over-year, with 4,163 claims filed through October 2019, according to data-tracking firm WebRecon LLC.

The number of claims has more than doubled since 2009, and they have mostly been brought against screening firms for reporting inaccurate information or employers for failing to satisfy consent and adverse action requirements. Because individual departments in large companies use standardized documents and screening processes-and thus repeat the same violations-many FCRA claims have been filed as class actions, resulting in multimillion-dollar settlements, often for procedural or technical violations.

"FCRA cases are getting more publicity, and increased publicity is, in turn, generating more filings," "Simultaneously, the spike in FCRA litigation can be attributed to the heightened consumer expectation of privacy," he said. "As we see more concerns about maintaining privacy of personal data and more sensitivity to the disclosure and authorization of that data, we see more people looking at the FCRA as a potential cause of action."

Additionally, the structure of the FCRA is attractive to the plaintiffs' bar, since remedies include defendants' paying actual damages, punitive damages, lawsuit costs and attorney fees. "It's so easy for plaintiffs' lawyers to quickly enter into settlements with employers because of the availability of statutory damages, especially in the class-action context,"

The marked increase in the number of employment background checks conducted over the last decade has also likely given rise to more claims.

Two employer actions present the greatest risk of falling into noncompliance: when preparing the stand-alone disclosure and authorization form before performing the background check, and when providing notice to the applicant or employee before taking adverse action, such as disqualifying an applicant or firing an employee. shrm.org

Former CEO Convicted of Fixing Prices For Canned Tuna
Affected hundreds of millions of dollars on Consumers
The former President and Chief Executive Officer of Bumble Bee Foods LLC, Christopher Lischewski was convicted today in San Francisco, California, for his participation in an antitrust conspiracy to fix prices of canned tuna, from in or about November 2010 until in or about December 2013.

According to evidence presented at trial, Lischewski participated in a conspiracy to fix prices of canned tuna that affected hundreds of millions of dollars in sales throughout the United States. He also authorized and supervised his subordinates’ participation in the conspiracy. Lischewski and his co-conspirators employed measures to conceal their conspiratorial conduct, including meeting at offsite locations, using third-party e-mail addresses, and discouraging retention of documents concerning the conspiracy.

Bumble Bee pleaded guilty and was sentenced to pay a criminal fine of at least $25 million. In September, StarKist Co. was sentenced to pay a $100 million criminal fine. In addition to Bumble Bee and StarKist, four individuals, including Lischewski, have been charged in the investigation. The other three individuals pled guilty and testified in Lischewski’s trial.

“A company’s senior leadership sets the example for how it should operate, and in this case a CEO prioritized his own greed at the expense of American consumers.” justice.gov

UPS Driver Filed "Whistleblower Complaint" For Safety & Wins
OSHA backs UPS driver who refused to drive without an ELD
UPS Ground driver who was fired for refusing to drive without an ELD will receive more than $47,000 in compensatory and punitive damages, according to an announcement from the U.S. Department of Labor.

The driver filed a whistleblower complaint against the company. Per Department of Labor guidelines, the agency does not release the names of employees involved in whistleblower complaints.

OSHA investigators determined that in March 2019 the driver refused in good faith to drive a truck without either a permanent ELD or a mounting device for a portable ELD because he believed doing so would violate the Federal Motor Carrier Safety Regulations. FMCSR required the driver to use an ELD, and the company to provide a vehicle with either a permanent ELD or a portable ELD mounted in a fixed position during his assigned route.

Investigators also determined that the driver’s supervisor was not trained on FMCSR’s requirements for ELDs and that company managers “attempted to coerce the complainant into violating the regulation” the release stated. When the driver refused to comply, the company terminated him for “gross insubordination.”

Investigators reportedly found that the company later modified the driver’s termination to a suspension and engaged in post-reinstatement harassment.

In addition to the monetary award, OSHA also ordered the company to take additional corrective actions to resolve violations of the whistleblower provisions of STAA. landline.media

OSHA Press Release: U.S. Department of Labor Orders Compensation For Employee Who Refused to Drive Without Safety Measure

UPS Workers Arrested in Nationwide Drug Shipping Bust
Police say Tucson, Ariz., UPS Ring moved bulk amounts of drugs, evading authorities for a decade

Detectives Frustrated For Years - Thought UPS Could Have Been More 'Proactive'

Four United Parcel Service Inc. workers have been arrested as part of a two year investigation into how criminal organizations use the shipping giant to move narcotics into the U.S.

The UPS drivers and supervisors were among 11 people arrested in the Tucson, Ariz., area, over approximately the past two weeks, law-enforcement officials said.

Tucson-area law enforcement had been tracking Barcelo since at least 2009, but Tucson Police Sgt. William Kaderly said detectives were frustrated for years that the company did not work more “proactively” with them to intercept and prevent the suspected criminal behavior. Barcelo was arrested on Nov. 13.

The lucrative operation at times involved moving thousands of pounds of marijuana and narcotics each week from narco-traffickers into the United States to destinations across the country, using standard cardboard boxes that were carefully routed through the private mail carrier’s trucking and delivery systems, authorities said. washingtonpost.com wsj.com

The Final Act?
Sears Limps into the Holidays with 128 Stores
Many of the stores that remain have the same old problems. They’re grungy and understaffed, poorly stocked and losing vendors. At the end of the year — a crucial time for retailers — Sears’ threadbare Black Friday catalog signals it’s going to have problems getting shoppers to its doors. And online, it can’t compete with Amazon and its traditional rivals.

A store needs to have stuff on its shelves to attract customers, and Sears is having issues with some suppliers cutting it off. The signs at Sears are ominous heading into the holidays. Is this the final curtain for Sears? nbcnews.com

LPF Announces November's LPC and LPQ Professionals
The Loss Prevention Foundation would like to recognize and congratulate the following individuals who successfully completed all of the requirements set forth by the board of directors to be LPQualified (LPQ) and/or LPCertified (LPC). View Full List Here

WSJ Pro Cybersecurity Executive Forum
- Yesterday in NYC

CISO's & CSO's Panels Talk Industry Concerns

NSA to issue updated cloud security guidance
The National Security Agency, amid a series of attacks that have targeted service providers in recent months, is fine-tuning advisories that will describe attack methods used by nation-state and advanced hackers and will lay out methods to counter them.

“We’ll be coming out with an unclassified advisory on the techniques used to compromise clouds and some mitigation advice,” said Anne Neuberger, director of the NSA’s Cybersecurity Directorate, speaking at the WSJ Pro Cybersecurity Executive Forum in New York on Tuesday.

This new NSA advisory follows previous guidance issued by the agency on cloud services last year, detailing basic cybersecurity precautions that companies should take. An NSA spokesperson said the coming release would be more sophisticated than that document. wsj.com

Equifax CISO & Former Home Depot CSO Talks About Equifax Breach
Spends $1 Billion on Systems & Hires Hundreds
Speaking on the same panel, Jamil Farshchi, chief information security officer of Equifax Inc., said that the effects of a cybersecurity incident can stretch out for months. Mr. Farshchi joined Equifax from Home Depot Inc., where he cleaned up after a 2014 breach that had exposed data about 56 million customers. It was one of the biggest cyber incidents until the Equifax breach, which affected nearly 150 million consumers. Equifax announced it in September 2017, several months before Mr. Farshchi joined the company.

“What you step into, when you get into an organization that’s post-breach, is chaotic. You have a workforce that’s been grinding day-in, day-out for several months, and I’m talking about situations where people have put cots on the floor and are staying there night after night,” he said.

Mr. Farshchi defended Equifax’s response to the breach.

“You can armchair quarterback any breach and the response. I think Equifax actually did a great job in responding to this situation,” he said.

Executives from Equifax were brought before Congress to testify about the breach. The company eventually paid around $700 million to resolve claims from state and federal investigators, as well as class-action lawsuits.

Equifax has since invested more than $1 billion in its technology systems and has hired hundreds of staff in security roles, Mr. Farshchi added.

Plaintiffs have criticized the company for its technology controls, with one lawsuit claiming that Equifax used “admin” for a username and password for a portal containing sensitive information. Mr. Farshchi, however, said Equifax’s pre-breach controls shouldn’t be characterized as poor, and suggested that attacks are simply a part of a large organization’s day-to-day risks.

“I don’t care what number of controls you have, what infrastructure you have, every organization out there can be the victim of a breach,” he said. “We are at war here.”

Former Equifax U.S. CSO Pleads Guilty to Insider Trading Before Going Public About Breach


Businesses Use AI to Thwart Hackers
AI-powered apps can root our security vulnerabilities, executives say
Companies are racing to improve products and services with artificial intelligence, the Internet of Things and other emerging technologies, stoking fears that data is becoming more vulnerable to hackers.

But rather than impeding the pace of innovation, these concerns are prompting many corporate security chiefs to accelerate the development of advanced capabilities, in a bid to turn the tables on attackers by better detecting the misuse of data and keeping it safe.

“Artificial intelligence is a backbone of security initiatives,” Camille François,chief innovation officer of social-media analytics firm Graphika Inc., said Tuesday at the WSJ Pro Cybersecurity Executive Forum in New York.

Among other applications, AI is being used in cyberattack modeling, where smart tools identify security vulnerabilities in simulated breaches or hacks, Ms. François said.

Securing data is expected to account for at least 10% of total spending this year. wsj.com

Why Cloud Security Is a Murky Issue
Lines of responsibility for cybersecurity measures are often blurred between companies and their cloud providers, leaving businesses vulnerable to attacks, security experts say.

It can be challenging to identify security features that are included in cloud platforms and those that companies need to build themselves, said Sameer Malhotra, chief executive and founder of security firm TrueFort Inc.

The problem is compounded by corporate information-technology strategies to use multiple cloud providers for different workloads, he added.

“The industry has to come up with a way to normalize all of this,” Mr. Malhotra said Tuesday at the WSJ Pro Cybersecurity Executive Forum in New York.

Cloud providers need to be much clearer about what security features come with a basic platform and those that need to be purchased separately. wsj.com