TransUnion data breaches, GDPR, CCPA, BIPA, and Ramirez

TransUnion LLC, one of the three major credit reporting companies in the United States, also has branches in every continent but Antartica. It is said that just in the U.S. the personal information and credit histories of some 200 million consumers is stored in their servers; I have not been able to find veritable information regarding consumers located outside the US.

Some of you may remember that TransUnion recently suffered a data breach (I will be using the GDPR definition of personal data breach which is "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed").

"How recently," comes the voice from the back of the room, "which one are you talking about?"

Good question; it is hard to keep track of them. Let's go over a few of them and later see what we can learn from them.

The Events

1. In 2005 -- a long time ago (in dog years) -- TransUnion lost a laptop containing personal data from more than 3600 US consumers. The Chicago-based company offered up to one year of free credit reports to the affected customers. At the time -- one must remember these were pre GDPR/CCPA/BIPA times -- some of the main questions raised were
   • Were credentials to access the TransUnion databases and other systems also exposed?
   • TransUnion chose to report the data breach. At the time there was no real requirement to do so: the California Senate Bill 1386 of 2002, one of the first security breach notification laws, specified a criteria corporations should use to determine whether they were required to report the incident: if they answered "yes" to every single one of the following questions, they must report the breach:
     1. Does their data include "personal information" as defined by the statute?
     2. Does that "personal information" relate to a California resident?
     3. Was the "personal information" unencrypted?
     4. Was there a "breach of the security" of the data as defined by the statute?
     5. Was the "personal information" acquired, or is reasonably believed to have been acquired, by an unauthorized person?
     The late Alan Paller, director of the SANS Institute at the time, warned this test provided a legal loophole for companies not to report data breaches since all 5 conditions have to be satisfied before a report is required.

   So TransUnion is very popular this month, this time in due to a larger issue than possibly being used to send phishign emails.

2. During the Summer of 2019, the personal data of some 37000 Canadians being held in TransUnion servers were compromised. Note that the Canadian Digital Privacy Act, which ammended PIPEDA and provided mandatory breach notification requirements, had become law 4 years earlier. Also, GDPR and CCPA had already become law.
3. On March 12, 2022 ITWeb broke the story of a data breach, which caused TransUnion to admit that attackers had indeed stole 28 million credit records. At first it was believed that more than 3 million South Africans and businesses such as Mazda, Westbank, and Gumtree were affected. The Brazilian group who claims responsibility for this act, "N4ughtysecTU," state it gained access due to a poorly secured (password "Password") TransUnion SFTP server. TransUnion later stated that more than 5 million consumers were actually affected and once again offered a period of free credit reports to the affected customers.
   
4. On November 7, 2022 it reported to the Massachusetts Attorney General about a data breach that could involve 200 million files profiling nearly every credit-active consumer in the United States. On the same day, TransUnion also sent out data breach letters to all individuals whose information it believes was compromised. As this is still developing, the true impact is yet to be learned.

OK, I will stop here. If they had another data breach between Nov 7 2022 and the time this was published, it should not affect the point of this article.

The Outcomes

According to GDPR Recital 75, a personal data adverse effects to a person (individual) include loss of control over their personal data, limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, and loss of confidentiality of personal data protected by professional secrecy. So, if TranUnion was an European company or people living in the European Economical Area (EEA) were affected by this personal data breach, as the data controller it would have to submit the Personal Data Breach Notification to the Supervisory Authority should be done within 72 hours unless there is no risk to the freedom and rights of a data subject. In this case, they better be reporting. The next step would be to inform all those who were possibly affected about what happened, what are the consequences to their customers, and what TransUnion is doing about it. Of course, those affected should be expected to file complains with their regional Supervisory Authorities (Art 77).

In The United States things are a bit different. U.S. Supreme Court’s 2021 decision in TransUnion LLC v. Ramirez stated that only those that can show concrete harm have standing to seek damages against private defendants. How will victims of a personal data breach prove their personal information was stolen and disclosed by negligence of the company holding this data, and as a result a violation of American consumer protection and privacy laws such as California Consumer Privacy Act (CCPA) and the Illinois Biometric Information Privacy Act (BIPA)? Compare that with GDPR already mentioned article 77 and recital 141, which requires only the data subject (i.e. the victim in this case) considers that his or her rights are infringed or "supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject."

With that said, it is possible that will change. Given that the US government and the European Union are currently actively working together to establish a new EU-US data flow deal (PrivacyShield 2?), one must wonder how they will balance this Supreme Court decision with GDPR. Which one will have precedence?

Fun Facts

• I started this article mentioning the phishing campaign they were possibly being used to launch. What if that is related to this data breach? I mean, if your attack has been successful and you are already in the final (Actions on Objective) stage of the cyber kill chain and taking your time to hoover the victim's data, why not see what else you can do while there to pass time?
• In addition to its main line of business, it also offer services to help companies "protect and restore consumer confidence" after a data breach (they do not list an office address there). In fact, they title themselves as the "One-Stop-Shop Incident Response Solution."
• I made those round images representing the 3 regulations mentioned here because I did not have an interesting image to put in this article. They turned out nice, so expect me to make more and use them in future posts. You have been warned!

On the rise of work-at-home employee tracking

When COVID became a global pandemic, many companies which before have frowned upon teleworking asked its employees to work from home whenever possible. That raised a concern: how would managers verify their underlings were spending their work hours doing the tasks assigned to them? There are many ways to track the time of employees, but the one that has increasingly become the most popular is employee monitoring software. A survey of 1,250 employers by Digital.com found that 6 out of 10 employees require monitoring software for its remote workers.

Why Are Employees Being Tracked?

Employers want to manage their workforce and understand how employees are spending their time. They see employees taking a break from their work tasks and using social media or dealing with their family as potential drain on their productivity, or time theft. According to Digital.com, more than half of the monitored employees spend more than 3 hours every day on non-work activities on company time.

If a business offers consulting services, it has a vested interest in logging its workers' time with a customer so it can properly bill said customer. Also, FLSA requires employers to have accurate records of each hourly employee, and keep it for 3 years.

What is Being Tracked?

Even though this kind of software has been called an extension of traditional time-tracking systems, what it records is more expansive than simple time-tracking:

• Random screenshots
• Location (using GPS)
• Website tracking
• Log emails
• Any sounds in the immediate area using the device's microphone
• Camera
• Anything that has been typed (keylogging) and any mouse movemens (mouse logging).

Privacy Concerns

"Most employees are OK with (installing employee tracking software). As long as you tell the employee you're implementing it, it's entirely legal" according to Enzo Logozzo, director of sales and marketing for 365 IT Solutions, Toronto. That is not necessarily the case.

• Per GDPR, consent here is not freely given as there is the risk a refusal to consent to have the software installed may result in the employee being fired. Canadian news media reported recently about a school janitor in Alberta, Canada, who refused last fall to download a mobile app that would help her employer confirm workers were on the job where and when scheduled. She was fired weeks later.
• While the Canadian privacy law, PIPEDA, states that collection and disclosure of personal data by a company from its employees without their consent is allowed on certain situations, it becomes the onus of the company to justify the collection of data was done for a specific business purpose.
• Tradionally, American privacy laws such as CCPA are much more lenient towards the business. However, employee tracking software can place companies at odds with other federal regulations. We must expect some of those working from home will on occasion contact their children's teacher or doctor during working hours. Recording of these conversations conflicts with HIPAA, and FERPA.
• Using a computer built-in microphone may be subject to state wiretap and eavesdropping laws.

Other Issues

In addition to legal issues, aggressive employee monitoring negatively affects business:

• Employees lose trust in the company. 14% of companies have not informed employees they deployed this software.
• Once workers find out employee tracking is in use while they work at home, their stress level increased. According to a study run by the insurance company Colonial Life, 26% of the employees said stress was making them less productive and 15%reported feeling less engaged with their job. That is no surprise, as 88% of employers terminated workers after implementing monitoring software.
• Devices running employee surveillance software are a juicy target for malicious individuals. As these individuals want to collect passwords and other personal information, attacking a computer with employee tracking software saves them time and effort.

Living with Employee Surveilance Software

Protecting your privacy as an employee

• Ensure company issues you their computer so to minimize the chances of having personal and work data in the same system.
• Minimize using work computer for personal applications. Ideally you should just avoid, but if that is not possible, this is the next best thing. It may help to think work computer may be taken at any time for any reason; it is theirs after all.
• Ask if they will issue you a work phone. If not and also demand you to install their app in your personal phone, here are apps to help on that. In fact, that is one of the topics we covered in our DEFCON workshop and something we recommend when dealing with IoT devices. Otherwise, get yourself a dumb phone and show that is the phone you have.
• Put work computer/device in a separate network than your home one. This may require technical help; VLANs are a great start but the sky is the limit.
• Create a private location for your workspace. Ideally one that has the door in your front (behind computer). Getting a greenscreen is also recommended.
• Assume work computer's microphone and camera are always on, so once your work hours are done, place it in a box with sound absorbing foam.
• Some companies may offer you an exercise tracker device such as Fitbit. Politely refuse it as it records your biometric data, which violates GDPR if you are subjected to it.

Protecting your company's needs while respecting the privacy of your employees

• Have a clear policy outlining the justification for surveillance
• Ensure employess understand why they are being tracked
• Obtain consent from your employees if you are installing employee surveilance programs in their computers and phones. Note that if it is a requirement to work, it is not freely given.
• Ensure tracking stops after working hours.
• Hire a professional such as Privacy Test Driver to ensure you comply with relevant privacy laws and provide an environment that fosters productivity while protecting both your company and its employees.

Good Cookies, Bad Cookies, and Privacy

Cookies "banners" are a particular pet peeve of me. As in don't get me started or I will be on it for hours if not days on end. So, I will struggle a bit to get this short enough so not to kill any reader of boredom. I am not claiming I will accomplish this goal, so you have been warned.

I should also warn this article has been in the making for months; I collected a lot of real samples I need to cover the names of the companies to protect the guilty. If you recognize the site by looking at the cookie policy form, smirk and keep it to yourself.

So, are cookies bad?

That is an oversimplified question. Cookies are used to track what users are doing in a website, and that may mean storing some personal data no t only of site users but also visitors. Some of which have very valid and important applications, like ensuring users can authenticate and are the right people to access a given resource, like their bank accounts, or repository of cat videos. Then we have the ones companies are interested on, such as:

• Which pages users go to in a given website, links they have clicked, and how long they spent on a given page. That may help them figure out which content -- primarily cat videos -- their audience seek and which ones they are avoiding. Or find out whether a given page is too convoluted, causing visitors to spend too much time and frustration in them. I can see why anyone wants to provide a website that does not suck.
• How often they visit a website whose cookie is in their computers.
• Which products or keywords they search for. This may tell the product lines the websites need to be providing and which ones may be taken down.
• Geolocation and IP address. A business case is to know where its customers are coming from so they can identify markets they are not covering, and then find out why.
• Username/password, and even address. Do not ask me why someone thought it was a clever idea to have them in cookies so forms would be conveniently filled, but they are there in the wild.

None of these are really needed to provide a service to users, so GDPR would say you must ask the visitors if they give you consent (Articles 6, 7, and Recital 32) to collect said data, and provide a way for them to remove their consent. CCPA and CPRA are less restrictive, having a set of thresholds (selling personal information of more than 50,000 Californian households, or making more than half of its annual revenue selling that data) before they are applicable and providing a the get-out-of-jail-free card (Art.9(2),e).

Some of these cookies are collected by the company running the website (first-party cookies) and others by whatever add-on they have deplopyed (third-party cookies). Google Analytics is an example of an app that creates the later; we have talked about how nicely it plays with GDPR before. However, that does not necessarily make first-party cookies better for security; but that is the topic of another article.

From a security standpoint, criminals will try to steal -- phishing emails are a popular way to deploy malware to achieve the goal -- cookies to impersonate users. So, a sensible business minimizes how much data it stores in its cookies.

The Good

• Let's start with a nice bright example of someone who respects the privacy of its website visitors.
  
  It is written in plain language, gives a quick blurb on what it is being used for, and allows the user the choice to accept all the cookies, deny all of them, or do something in between (which leads to a more itemized list you can enable item by item).
• The next one, from one of the European Union's official websites, is not as nice but at least they are trying.
  
  Why am I not impressed with their banner? Because it is an all-or-nothing, without a proper explanation, and mentions these "essential cookies" (is this like "essential oils?") without explaining them. Yes, if you click the link explaining how they use the cookies you realize they are not out to suck you dry of your private info, which is why it is listed here. But, I think they could do a better job given the resources they have.

The Bad

This list is but a tiny sample of my fun collection. Still, get the popcorn.

• First we will start with one that is on the slippery slope as far as GDPR is concerned. It mentions collected data with "trusted third parties." Who are they? Google Analytics? We have talked before that you can no longer use it on a site that is accessed by European residents.
  
• We really should just get serious and look at an example of conning the user. For convenience, I highlighted the relevant wording in their privacy note.
  
  First we have "This information might be about you" (red), which uses the "might" word to imply that it is ok because maybe the information is really not about you. Well, knowing your IP (considered by GDPR personal data), OS, browser, and other facts that we will not go over here (username?) suffice to uniquely identify you. If you use the same computer without bothering to run VPN later, they will know you are back... specially if from home as your external/public IP rarely changes if at all. But then they smother your worries claiming that "the information does not usually directly identify you" (blue). It is personal data already, sunshine.
• Here is one from a bank that prides itself to have branches in many countries across the world.
  
  At first I thought the following cookie banner was just for the American market, but when connecting from Japan and Europe I still was "welcomed" by the very same banner; I do not need to say what that means. I have a ton of other examples following the same pattern, but I think we only need one to get the idea.
• This one is a variation of the bank banner we saw earlier seen in the website of a professional society. I would not have posted it if it did not have one single word: consent.
  

  I must assume the reason this specific term was used is because of the language in GDPR, specifically article 7 states that if you do not have a legal reason to collect personal data, you must obtain consent from the user, who must freely give it. They seem to beleive that by having the word "consent" in the banner, they satisfied this GDPR article. However, if the only option is to surrender your private data, this consent is not freely given. Or can be easily revoked.

  "But," one can argue, "you did not consider they are probably an American-based society which does not cross the CCPA requirements by keeping the number of Californian households under the limit." How would that work? Geolocating may be hard: one of the VPN services I use has servers in California; there might be other services with servers somewhere else in the US being used by Californian citizens. Given the banner you are seeing, how would you distiguish the two cases? And besides, if this is an international (they hope they are, as one of the letters in their name stands for that) professional society, GDPR, LGDP, and APPI just to name a few are bound to be triggered. I did my Westen Europe test, and it did not switch to a GDPR-compliant cookie banner.

The Sleazy

Now we get to the really special ones, the ones that decided laughing at the privacy rights of individuals was not enough; they had to make a point.

• First jewel is what I call a BannerWall: you cannot use the website until you click on the only option ("Accept"), so site owners can then say "here! User consented to use collecting all personal info. We have the log showing the Accept button was clicked!" Hopefully you do not need to use this site, so you can just close your browser and find some other place with similar information but more privacy conscious.
  
  Looking at the screen capture, do you know if "Privacy Policy" and "Terms of Service" are links? No? You are not alone. Can you say hiding in plain sight?
• But, what if you have to use the website? For instance, what if you need to log into the site to pay your utilities or rent, and they do not offer another way (mail or in person) to make said payment? Can you say coercion?
  

Don't Be That Guy

• Instead of having you site collect personal data based on the location of the site visitor, assume they are all coming from the EU and build it for that, as it is one of the more restrictive ones. Make your life easier, be your website a commercial or educational/research one; we covered that a while ago.
• What is wrong with asking users if it is ok to collect their data and tell them how you are going to use it without vague words? And by that, ask properly, not like the no-real-option seen in some of the examples above.
• Document everything, logs included, because the world is changing and you may be audited or even fined for non-compliance. Remember, you do not need to have suffered a personal data breach before a GDPR Data Protection Authority takes legal action against you. Don't believe me? We commented on some cases earlier this year. All is needed to get that avalance running is for someone to file a complaint.