Privacy and data protection

Government publishes second version of digital identity trust framework

The second iteration of the framework, still in alpha version, sets out how organisations can become certified digital identity service providers Continue Reading

Investigatory Powers Tribunal finds UK spy agencies unlawfully collected personal data

Campaign groups Privacy International and Liberty are gearing up to bring further legal action after a court found that UK spy agencies unlawfully collected phone and internet records Continue Reading

Almost half unaware of GP data-sharing plans

Around half of adults in England – approximately 20 million people – remain unaware of the scope of the NHS GPDPR programme, prompting calls for a public education campaign Continue Reading

Security Think Tank: Consider cyber policies and procedures as you welcome employees back

With Covid-19 restrictions easing, offices are welcoming back remote workers this summer, bringing with them their notebooks and mobiles, and creating an endpoint management headache for CISOs. What do security teams need to account for to protect their returning office workers? Continue Reading

ICO ends its involvement in dispute between NatWest Bank and data breach whistleblower

The Information Commissioner’s Office has ended its involvement in a dispute between a data breach whistleblower and NatWest bank Continue Reading

US lawmakers call for probe into ‘arrogant’ spyware firm

US members of Congress have called for an investigation into NSO Group, the spyware supplier at the centre of a massive surveillance scandal Continue Reading

TikTok sets up cyber security hub in Dublin

Dublin-based cyber centre will oversee the security of TikTok’s users across Europe Continue Reading

How IBM is solving the data privacy problem

IBM’s fully homomorphic encryption technology lets enterprises apply analytics and machine learning to encrypted data without compromising data privacy Continue Reading

No More Ransom initiative saves £850m over five years

Initiative’s free ransomware decryption tools have been used by more than six million people since 2016 Continue Reading

Government-led innovation can help cyber startups find a market

There are many reasons why early-stage cyber startups often struggle to get off the ground, but government-backed programmes can help them find a path Continue Reading

Tokyo 2020 hit by data breach

The user names and passwords of Tokyo 2020 ticket holders and event volunteers were reportedly compromised, but government official claims the data leak was not large Continue Reading

OAIC: Uber failed to protect personal data of Australians

Uber did not take reasonable steps to protect Australians’ personal information from unauthorised access, says Australia’s national privacy watchdog Continue Reading

New thinking and systems required to tackle online fraud in retail

Online fraud is a growing problem for retail, but are merchants doing enough to update systems and how should they change their actions to address it? Continue Reading

Five ways to ensure remote working security and compliance

A mix of on-site and remote working has become a fact of life for many organisations. We look at five key things you should consider to ensure compliance and security Continue Reading

France’s Macron among alleged Pegasus targets

Data relating to devices used by French president Emmanuel Macron and the head of the World Health Organization, among others, has been uncovered in a dataset linked to government use of spyware Continue Reading

NCSC’s Cameron urges deeper cyber alliance-building

Speaking to an event in Israel, NCSC CEO Lindy Cameron has praised joint UK-Israeli efforts on security collaboration Continue Reading

Sparsely staffed offices: the new post-pandemic cyber gap

With many offices still operating at limited capacity, a red teaming expert reveals how his job is getting easier, and why this is a problem Continue Reading

The Secret IR Insider’s Diary: It’s all gone quie...

The ‘Q’ word isn’t one that’s really used in incident response, says the Secret IR Insider, largely because as soon as you use it, something happens Continue Reading

NHS Digital tightens rules for GPDPR data scrape

The proposed collection of patient data held by GPs will now only commence when three key criteria have been fulfilled, says NHS Digital Continue Reading

Security Think Tank: A return to the office is not a return to normal

With Covid-19 restrictions easing, offices are welcoming back remote workers this summer, bringing with them their notebooks and mobiles, and creating an endpoint management headache for CISOs. What do security teams need to account for to protect their returning office workers? Continue Reading

UK, US confirm Chinese state backed MS Exchange Server attacks

UK and US governments, alongside the EU and Nato, have formally attributed the March 2021 Microsoft Exchange Server attacks to Chinese state-backed actors Continue Reading

Pegasus mobile RAT abused to monitor journalists and activists

Israel-based surveillance specialist NSO Group is facing renewed pressure after it emerged its Pegasus mobile surveillance tool may be being widely abused by repressive regimes Continue Reading

Privacy Shield: One year on and companies are still grappling for answers

Activist lawyer Max Schrems and Eduardo Ustaran, partner at Hogan Lovells, look for common ground in a problem with no easy answers Continue Reading

CW APAC: Trend Watch on supply chain security

In this handbook, Computer Weekly looks at the rise of supply chain attacks, the challenges that come with zero trust security and attacks on the Covid-19 vaccine supply chain Continue Reading

Lawyers take EncroChat hacking operation to French supreme court

Lawyers head to French supreme court after appeals court finds EnroChat inception legal under French law Continue Reading

Privacy Shield: US surveillance law reforms essential for EU-US data, says EU parliamentary study

EU Committee on Civil Liberties, Justice and Home Affairs study calls for major reforms of US spying laws to enable an EU-US data-sharing agreement to replace Privacy Shield Continue Reading

Singapore to invest S$50m in ‘digital trust’ capabilities

The Singapore government is pumping in S$50m to bolster research in technologies that will foster digital trust in areas such as privacy protection and identity management Continue Reading

REvil ransomware crew drops offline, reasons murky

The REvil ransomware operation appears to have gone dark, but claims about its demise are almost certainly exaggerated Continue Reading

Secureworks sets up in EU datacentre for XDR services

New datacentre location helps Secureworks’ customers meet EU data residency requirements Continue Reading

Dutch prosecutor ordered to give evidence on EncroChat hack

Netherlands court rules that a public prosecutor should give evidence about the role of the Dutch in the EncroChat cryptophone hack which has led to arrests of organised gangs worldwide Continue Reading

NSW department of education hit by cyber attack

Australia’s New South Wales department of education takes some systems offline as a precautionary measure in response to a cyber attack last Thursday Continue Reading

Professionals need protection from the Computer Misuse Act

The UK needs cyber legislation fit for the 21st century, so it is important for the industry to get behind the government’s proposed reform of the Computer Misuse Act Continue Reading

Met Police should release information on British WikiLeaks journalists passed to US, tribunal told

The Metropolitan Police should release correspondence with the US Department of Justice about three UK based WikiLeaks journalists, despite national security claims, a tribunal heard Continue Reading

Why identity is the central problem for the future of the internet

As debate rages over who has the right to control user identities online, is the concept of decentralised identity about to have its day? Continue Reading

US government given permission to appeal UK’s decision to not extradite Julian Assange

US offers assurances that Assange could serve time in his home country of Australia if convicted Continue Reading

ICO to probe Hancock over private email use

Former health secretary faces an investigation by the UK’s data protection watchdog over his use of private email to conduct government business Continue Reading

How the UK Cyber Security Council plans to professionalise security

As chair of the new UK Cyber Security Council, Claudia Natanson is in a superb position to develop professional standards in IT security and she intends to fundamentally reimagine what a security job actually is Continue Reading

Opportunists seen targeting Kaseya REvil victims

Malwarebytes researchers highlight new spam campaign targeting businesses impacted by the ongoing Kaseya REvil ransomware incident Continue Reading

About 60 Kaseya customers hit by REvil

Kaseya has revised upward the number of managed service providers compromised by the REvil ransomware gang in a supply chain attack at the weekend Continue Reading

Cyber insurance costs up by a third

The frequency and severity of ransomware attacks is a leading factor behind a substantial increase in the cost of obtaining cyber security insurance Continue Reading

BA reaches settlement in data breach group action

A group action against BA following its 2018 data breach has been successfully settled Continue Reading

REvil crew wants $70m in Kaseya ransomware heist

Two days after one of the largest ransomware attacks in history by the REvil/Sodinokibi gang, the security community is assessing its next moves, while over 1,000 victims remain in limbo Continue Reading

Berlin court finds EncroChat intercept evidence cannot be used in criminal trials

In a major setback for police hacking operations, Berlin’s regional court has decided that intercepted data from the EncroChat phone network should not be used in criminal prosecutions Continue Reading

Cyber attackers up the ante on embattled IT teams

Opportunistic threat actors are pouncing on embattled IT teams that are under pressure to expand remote work arrangements Continue Reading

Cyber espionage campaign targeted central Asian states

The Afghan, Kyrgyz and Uzbek governments are all thought to have been targeted by the same APT Continue Reading

NHS IT fraudster Barry Stannard sentenced to five years in prison

Stannard used his position as head of unified communications at an Essex NHS Trust to cheat the taxpayer of more than £800,000 Continue Reading

Nominations open for 2021 Security Serious Unsung Heroes Awards

Nominations are now open for this year’s edition of the Unsung Heroes Awards for cyber professionals and educators Continue Reading

Half of mobile phones sold in the UK at risk of security issues

Lengthy mobile phone contracts leave buyers at risk of their devices losing support for security updates Continue Reading

REvil affiliates offer hefty ransom discounts, data reveals

REvil or Sodinokibi ransomware activity is higher than ever, but its success appears to be relative, with some affiliates prepared to dramatically cut their prices Continue Reading

LinkedIn denies exposure of 700 million user records is a data breach

Data relating to 700 million users of the LinkedIn networking platform has appeared for sale, but the firm says it is the victim of data scraping, not a security breach Continue Reading

UK data exchanges with EU can continue after adequacy decision - but for how long?

For now European businesses can continue to send data to the UK without additional safeguards and paperwork. How long will it last? Continue Reading

Cops seize criminal VPN used by ransomware gangs

A coordinated sting has ended the operations of the DoubleVPN service, the owners of which are accused of harbouring cyber criminal activity Continue Reading

EU recognises UK data protection adequacy but warns against divergence

The European Commission has granted the UK data adequacy, allowing data sharing between the EU and the UK, but warns it may yet be revoked Continue Reading

Banking tech fraud: How to trace and recover your money

Even when stolen assets are sent offshore, the special powers of the English civil court system mean all may not be lost Continue Reading

Is the UK government planning to rewrite GDPR?

In this week’s Computer Weekly, a government taskforce on post-Brexit regulations has recommended changes to GDPR in the UK – we examine the implications. The NHS has launched a new data strategy - we look at what it means for your medical records. And we ask how to avoid the performance problems that affect private cloud. Read the issue now. Continue Reading

Video game industry under relentless cyber attacks

Web application attacks against the global video game industry grew by 340% in 2020 as more people turn to gaming during pandemic lockdowns Continue Reading

UK’s FCA bans crypto exchange Binance as crackdown spreads

Ban on Binance Markets comes amid a wider global crackdown on the largely unregulated global market for cryptocurrencies and related assets. Continue Reading

HMRC-branded phishing scams surge despite protections

The number of HMRC-branded phishing scams surged 87% in the past 12 months, according to latest revealed figures Continue Reading

How CIOs can help their organisations accelerate digital transformation

Companies need to win the trust of their customers to gather the data they need to transform their businesses Continue Reading

Lazada rolls out public bug bounty programme

Regional e-commerce giant Lazada is looking to uncover more vulnerabilities that could compromise data security in a public bug bounty programme that offers up to $10,000 per bounty Continue Reading

NCSC CEO: UK-Ireland collaboration crucial to stop cyber threats

Speaking at a conference in Dublin, NCSC Lindy Cameron is highlighting the importance of continued collaboration between the UK and Ireland to protect shared interests and counter security threats Continue Reading

Anglesey schools offline after cyber attack

Isle of Anglesey County Council is investigating a cyber attack that has forced it to shut down systems at all five secondary schools on the island Continue Reading

CMA to probe Amazon and Google over fake reviews

The CMA has opened an investigation into Amazon and Google over possible breaches of consumer protection law Continue Reading

Google hands third-party cookies a stay of execution

Google’s proposed Privacy Sandbox initiative – which will see third-party cookies phased out in the Chrome web browser – has been pushed back to 2023 Continue Reading

Stalkerware apps becoming normalised among young people

Data in a new report appears to show that dangerous stalkerware apps are becoming normalised in younger age groups Continue Reading

City of York picks Barracuda Networks for data protection

York Council needed to refresh its backup service to bring new security protections after it went ‘all-in’ on Microsoft Office 365 Continue Reading

UK councils reported over 700 data breaches to ICO in 2020

Data disclosed under the Freedom of Information Act reveals an estimated 700 data breaches were reported to the Information Commissioner’s Office by local councils last year Continue Reading

Openness can protect Dutch companies against ransomware

Dutch businesses that suffer ransomware attacks need to be more open about it, if this growing problem is to be brought under control Continue Reading

European ‘chat control’ plans in the name of ‘child safety’ threaten end-to-end encryption

Proposals by European Commission to search for illegal material could mean the end of private messaging and emails Continue Reading

NSPCC, IWF help under-18s scrub their nude photos from the web

Report Remove tool is designed to be used by under-18s to report nude images or videos of themselves that have appeared online Continue Reading

A new three-year plan for digital government

In this week’s Computer Weekly, the new CEO of the Gov-ernment Digital Service, Tom Read, explains his three-year strategy for improving online public services. EU attempts to regulate AI are under fire – we examine the issues. And we find out how Bupa is turning to the cloud to deliver per-sonalised healthcare. Read the issue now. Continue Reading

Parliamentary devices left in taxis, buses, trains and pubs

Nearly 100 devices belonging to parliamentary staffers, including MPs and peers, were lost or stolen over the course of 2019 and 2020 Continue Reading

NHS App reaches six million users, thanks to Covid vaccine feature

More than two million new users have downloaded the NHS App since it was updated in May to include Covid-19 vaccination status Continue Reading

ICO issues guidance on facial recognition in public spaces

Information commissioner’s concern over the problematic use of facial recognition in public spaces has prompted her to publish official guidance on its deployment, while civil society calls for an outright ban Continue Reading

Lorca Ignite programme targets breakout cyber talent

Six of the most successful companies to have come through Lorca’s existing accelerators are being inducted into an intensive programme Continue Reading

Carnival Cruises hit by fourth cyber incident in a year

Latest data breach at Covid-hit cruise line comes hot on the heels of two recent ransomware attacks and a spring 2020 breach Continue Reading

Cyber crooks target Amazon Prime users ahead of retail bonanza

A surge in malicious domain registrations ahead of Amazon Prime Day indicates cyber criminals have set their sights on exploiting vulnerable shoppers Continue Reading

NHS Test and Trace picks Risk Ledger to secure supply chain

Risk Ledger’s technology promises ‘unparalleled’ visibility into NHS Test and Trace’s supply chain Continue Reading

Privacy pro salaries rise throughout pandemic, but at a cost

Data from the IAPP’s latest salary survey reveals some insight into how the pandemic impacted the privacy profession Continue Reading

The Security Interviews: How to build a government model to ‘hack for good’

Kyle Hanslovan started Huntress to give back after a career in the intelligence sector. After US authorities took action to help people hit by the Microsoft Exchange attacks, we discussed how governments can ‘hack for good’ Continue Reading

How healthcare organisations are tapping data analytics

Healthcare providers are harnessing data analytics to improve clinical and operational outcomes even as they continue to face challenges in data aggregation and data protection Continue Reading

G7 commits to action on ransomware, digital privacy

The G7 urges Russia to do more to hold criminal ransomware gangs operating from within its borders to account as it commits to more action on the issue Continue Reading

Europe’s proposed AI regulation falls short on protecting rights

The European Commission’s proposal for artificial intelligence regulation focuses on creating a risk-based, market-led approach replete with self-assessments, transparency procedures and technical standards, but critics warn it falls short of being able to protect people’s fundamental rights and mitigating the technology’s worst abuses Continue Reading

FBI planned a sting against An0m cryptophone users over drinks with Australian investigators

Australian Federal Police and the FBI came up with the idea over drinks: build a cryptophone network with a built-in backdoor and sell it to crime gangs around the world Continue Reading

CMA secures commitments from Google on future of cookies

The Competition and Markets Authority is opening a consultation on commitments offered to it by Google to ensure its Privacy Sandbox proposals do not harm digital advertising markets Continue Reading

Australia names ‘strategic’ datacentre operators

Australia’s Digital Transformation Agency certifies Macquarie Telecom, Canberra Data Centres and Australian Data Centres as strategic operators for hosting government data Continue Reading

How the pandemic changed backup

The Covid-19 pandemic forced big changes in how people work – we look at impacts on backup, including increased reliance on the cloud, plus security and compliance vulnerabilities and ransomware Continue Reading

FBI arrests distributors accused of selling An0m encrypted phones to crime groups

Working with overseas law enforcement, the FBI has arrested eight people and named a further 13 accused of distributing An0m phones to organised crime groups Continue Reading

NHS Digital delays data collection plans until September

NHS Digital has postponed its proposed collection of GP data for two months, to allow more time for the public to understand the process and opt out if wanted Continue Reading

National data guardian calls for dialogue on NHS Digital GP plans

The UK’s national data guardian says it is important the public has clarity on how their confidential medical information will be used and kept secure under NHS data-sharing plans Continue Reading

The rise and rise of supply chain attacks

Supply chain attacks in Asia-Pacific and elsewhere have intensified as cyber threat actors look to exploit the weakest links in business and digital supply chains Continue Reading

NGOs file complaints against Clearview AI in five countries

Privacy and human rights organisations have asked data protection regulators in the UK, France, Austria, Italy and Greece to investigate controversial facial recognition company Clearview AI Continue Reading

Police raids around world after investigators crack An0m cryptophone app in major hacking operation

Police in 16 countries carried out raids on after Australian Police and the FBI cracked an encrypted An0M communications network used by crime groups Continue Reading

Security Think Tank: What must a secure print strategy take into account?

Though rarely discussed in a cyber context, the prevalence of connected printers and MFPs poses security risks both technological and physical. What does a print security strategy need to take into account? Continue Reading

EU privacy chief investigates use of US cloud services

Use of Amazon and Microsoft’s cloud services by public sector bodies in the European Union is being scrutinised by the bloc’s privacy watchdog Continue Reading

NCSC updates schools ransomware guidance amid surge

The National Cyber Security Centre says it is dealing with a renewed surge of ransomware attacks targeting schools, colleges and universities Continue Reading

Campaigners plan legal action over NHS data sharing

Privacy coalition aims to force NHS Digital to push back its plans to scrape medical information on millions of patients into a central database Continue Reading

NHS Digital’s GP data-scraping plan must be publicised and delayed

The UK government must launch a national awareness campaign and delay this month’s planned GP data slurp, say privacy consultants Ben Rapp and Sara Newman Continue Reading

Updated standard contractual clauses will provide ‘legal certainty’ for transfer of data

Organisations have 18 months to update data transfer agreements, known as standard contractual clauses, or SCCs, to continue sharing data outside the European Union Continue Reading

Security Think Tank: Printers can’t be an ‘add-on’ in your cyber strategy

Though rarely discussed in a cyber context, the prevalence of connected printers and MFPs does pose security risks both technological and physical. What does a print security strategy need to take into account? Continue Reading