Katharina Koerner

The path to cyber regulatory harmonization is guided by a stained Mapquest printout (with a missing last page of directions because the printer was out of ink) that leads the driver to a pot-hole filled dirt road and a bridge that isn't complete. From today's Senate HSGAC hearing, "Streamlining the Federal Cybersecurity Regulatory Process: The Path to Harmonization," Sen. Peters said it best: "In the past four years alone, federal regulators have passed 48 rules on cyber security. More than 10 per year. And that doesn't include policies at the state as well as the local level...No one is coordinating this effort. This is a patchwork of new guidelines set by separate agencies....Businesses are scrambling to follow a web of new standards....A bank could have 16 different oversight bodies, all of whom are passing their own standards and expecting those standards to be followed. This is not necessarily a case of more is better, we must be smart in these regulations."

5

1 Comment

OBS Deadline August 11, 2024: Call for Papers on Early Modern privacy for The Renaissance Society of America Conference 2025. As an associate organization of RSA, Centre for Privacy Studies will organize panels on Early Modern Privacy for RSA 2025, which takes place in Boston 20-22 March, 2025. The panels will explore experiences, spaces, activities, terminologies and conditions that pertain to Early Modern versions of privacy and the private. Read more and submit your abstract below. #callforpapers #cfp #privacy #conference Danmarks Grundforskningsfond / The Danish National Research Foundation

8

Our September 2024 issue article: "A Typology and Model of Privacy- and Security-Concerned Users’ Attitudes toward Digital Footprints and the Consequent Influence on Their Social Media Adaptation" by Syed Sardar Muhammad - Brunel University London, Bidit Dey - The University of Sheffield, Hillol Bala - Indiana University - Kelley School of Business, Sharifah Faridah Syed Alwi - Cranfield University, and Yousra Asaad - Brunel University London is available for download - "How users with #privacy and #security concerns engage with #social #media in light of their perceptions of the risk associated with their #digital #footprint is a critical question for research and practice. Using a mixed methods approach, we examined the privacy- and security-related concerns of social media users and their subsequent #adaptation #behaviors in two studies. The first study, a qualitative inquiry, helped us develop a typology of four groups of social media users with respect to their privacy- and security-related attitudes characterized as careless, carefree, conscious, and cautious. We developed a conceptual model comprised of eight hypotheses based on a qualitative study that captured the relationship between privacy- and security-related attitudes and social media adaptation. The second study, a quantitative study, tested the model and revealed that users with careless and carefree #attitudes are likely to explore social media to maximize benefits and exploit certain applications, while cautious users are likely to avoid using social media as much as possible. However, the findings are inconclusive for conscious users’ adaptation. This could be due to their systematic and informed decision-making, which is likely to have contextual variability. We contribute by offering a clear and coherent typology and a model of privacy- and security-concerned users’ attitudes and social media adaptation."   https://lnkd.in/esweaJZV https://lnkd.in/eW_GQMJ2 #JAIS #IS #research #informationsystems #mis #InformationSystems #SocialMedia #DigitalFootprint #Privacy #Security #AdaptationBehaviors #Attitudes

13

The HIATUS program aims to develop novel human-useable systems for attributing authorship and protecting author privacy. Authorship attribution capabilities address many Intelligence Community (IC) needs, including combating sophisticated malicious information campaigns online and identifying counterintelligence risks. Authorship privacy capabilities protect authors whose writing, if attributed, could place them in danger.

26

📌 Andersen's IP, IT, and Data Protection Service Line announces the release of their new publication, EU Artificial Intelligence Act: Key Considerations for Data Protection Officers. Explore the guide 👉 https://bit.ly/4bIedcD This insight explores the implications of the groundbreaking EU AI Act—the first regulation addressing AI technology's untapped potential. Learn more about how the Act ensures personal data protection through existing data laws and introduces new obligations aimed at safeguarding data in high-risk AI systems. It also highlights the vital role of Data Protection Officers (DPOs) in ensuring compliance, transparency, and risk management, in alignment with GDPR principles. #IPITDataProtection #AndersenEurope #AndersenIPITDataProtection #ArtificialIntelligenceAct

4

#PublicPolicy & #Regulation attorney Paul Stimers was quoted by Inside Quantum Technology News on the urgency of implementing #postquantumcryptography (#PQC) standards. Paul answered questions surrounding #liability for cybercrimes and noted the importance of incorporating PQC protocols in everyday business practices. Read to learn more: https://bit.ly/3yB8fNy #quantumcomputing

40

1 Comment

Explore how encryption and zero-knowledge proofs can harmonize privacy rights with institutional oversight. In a recent pre-print, Sofía Cossar and our senior researcher, Eric Alston, examine the evolving relationship between technology, institutions, and individual privacy in the digital era. https://lnkd.in/gEyYA3uJ

6

Explore how encryption and zero-knowledge proofs can harmonize privacy rights with institutional oversight. In a recent pre-print, Sofía Cossar and our senior researcher, Eric Alston, examine the evolving relationship between technology, institutions, and individual privacy in the digital era: https://lnkd.in/gEyYA3uJ

3

📢 📖 CAIDP Publishes Report on Rights-Impacting and Safety-Impacting AI Systems in Federal Agencies - "No Time for Delay" The CADIP report evaluates agencies' compliance with the 2024 Office of Management and Budget memo, which ➡️ mandates disclosure of AI usage in federal agencies, ➡️ requires identification of "rights-impacting" and "safety-impacting" AI systems, ➡️ requires implementation of minimum safety practices for such systems, and ➡️ requires decommissioning of non-compliant AI systems. Key findings include: ⚠️ ❗ No indication of federal agencies identifying or preparing to decommission non-compliant AI systems by the December 1, 2024 deadline. ⚠️ ❗ Lack of information regarding establishment of minimum practices for rights- impacting and safety-impacting AI systems. ⚠️ ❗ Federal agencies have not published updated AI use case inventories. ⚠️ ❗ Only 28 out of 50 federal agencies have published compliance plans, with key agencies yet to report on their AI activities. The Center for AI and Digital Policy report concludes with the recommendation: 🔥 "The OMB should move quickly to require federal agencies to uphold their reporting requirements and to decommission those AI systems that pose a threat to the public. Principles are important, but ensuring compliance is essential." #aigovernance Christabel R. Bhawna M. Rupali Lekhi Ngonidzaishe Gotora

140

5 Comments

What’s just around the corner from #ISO to help with #AI? * ISO/IEC 42005 AI Impact assessment  * ISO/IEC 12792 Transparency Taxonomy of AI Systems * ISO/IEC 12791 Treatment of unwanted bias  * ISO/IEC 42006: Requirements for bodies providing audit and certification of AI systems. There are a LOT of choices when putting together an AI Governance (#AIGov) program. Don't make every choice from scratch! These are the standards I recommend following for future work.

28

1 Comment

Read our new #Privacy, Cyber & Data Strategy blog post by Kimberly Kiefer Peretti and Seol Namgoong on the #NIST’s updated draft guidelines regarding #AI use in identity systems. https://bit.ly/47HaPyA

5

Unveiling the American Privacy Rights Act (APRA) CheatSheet:   Explore this cheat sheet summarising the key points of APRA. This significant measure was announced on April 7, 2024, by House Committee Chair Cathy McMorris Rodgers and Senate Committee Chair Maria Cantwell, which aims to set national standards for consumer data privacy and security.    Source: https://lnkd.in/dPKVsB2h #dataprivacy #US #Americanprivacylaw #cheatsheet #APRA

61

💡 Check out our latest #article on the #EU's new #Regulatory Technical Standards (RTS), aimed at enhancing incident reporting for Financial Entities (FEs) across Member States. With clear #criteria for classifying #cyberthreats and #ICT-related incidents, the #RTS aims to strengthen #incidentresponse and minimize disruptions. Read the full article: https://lnkd.in/ePC8CA98

15

Privacy of Brain Data There has been a lot of noise this month about California's amendment to consumer privacy laws to make it clear that data about brain activity will be protected as "sensitive personal information." I've had the chance to speak about this and other legal aspects of brain data privacy (structural info as well as info about brain activity) in the English and French language media over the last month (see below). There is a range of views to be seen on whether existing and near-term neurotechnologies pose a threat to privacy - these views range from "nothing to see here" all the way to "this can read your mind." Ethicists have an incentive to find and point out interesting things to be worried about, and perhaps sometimes this gets over-heated. At the same time, note an old warning from Plato in the Phaedrus (Socrates is recounting a discussion on whether the human faculty of memory would be destroyed by the innovation of writing) - "the parent or inventor of an art is not always the best judge of the utility or non-utility of his own inventions to the users of them." The developers of new tools may not see - or have incentive to see - the full path that their new tools will take and how they will be repurposed. As is usually the case, we are at present somewhere in the middle, and whether there's a serious issue depends upon which kind of brain data, what type of inference is to be drawn, and for what reason. Also - relying upon consumer knowledge and consent to protect privacy is demonstrably not very effective. Also keep in mind that in some contexts, the freedom to choose whether or not to share data is greatly constrained. In my view from the mushy middle - it is wise to try to anticipate in a reasonable manner. We don't want to throw the baby out with the bathwater by raising problems that will damage a promising field, and we don't want to sleepwalk into problems that could be headed off ahead of time. Do we need laws on this? In some places, existing privacy laws already capture brain data as personal information. We will likely see more legislative change in the coming months and years. Goodyear S. Why your brain could be the next frontier of data privacy. As it Happens. CBC. (11 October 2024) https://lnkd.in/eBCMZfeW Mullin E. I tried these brain-hacking headphones that claim to improve focus. (24 September 2024) https://lnkd.in/epn56yC5 Robitaille-Grou P. Neurotechnologies commerciales : un far west à l’abri des normes médicales. Radio-Canada (29 August 2024) https://lnkd.in/emWfBC4b California law here: https://lnkd.in/eHitYyre

31

ICYMI: Our Guide to GDPR in Online Testing 🕵️🔎 Did you know? Integrity Advocate is the only online proctoring system built on Privacy by Design principles — a cornerstone of GDPR, CCPA and related privacy legislation. In this post from the archive, we look at what that means, and why privacy and testing integrity don't have to be in tension. #GDPR #CCPA #OnlineTesting #PrivacyByDesign #EdTech #ComplianceMatters https://bit.ly/4g7z1Ob

8

Useful for a wide range of those assessing uses of cameras for employee monitoring.

13

1 Comment

"The new USPTO guidance brings 𝘓𝘒𝘘 𝘷. 𝘎𝘔 𝘎𝘭𝘰𝘣𝘢𝘭 ( https://bit.ly/4dMgdD0 ) to the attention of design examiners, but perhaps expectedly, it leaves many questions unanswered on how 𝘓𝘒𝘘 will be implemented at the USPTO.   https://bit.ly/3V3rWoq   𝘓𝘒𝘘 overruled the previously long-standing 𝘙𝘰𝘴𝘦𝘯-𝘋𝘶𝘳𝘭𝘪𝘯𝘨 approach to establishing design obviousness, in that: • there is no more requirement that the primary reference be 'basically the same' as the claimed design • there is no more requirement that any secondary references be 'so related' to the primary reference • instead, it is only necessary that all references be 'analogous art' in the same field as the article of manufacture   The new USPTO guidance does provide a series of 4 factual inquiries for design examiners to undertake before asserting an obviousness rejection under the new 𝘓𝘒𝘘/𝘞𝘩𝘪𝘵𝘮𝘢𝘯 𝘚𝘢𝘥𝘥𝘭𝘦 approach, namely: 1. find a primary reference as similar as possible to the claim, and then find secondary references, all from the 'same field of endeavor' or at least from 'analogous art' 2. identify the differences between the claim and the found references 3. consider the knowledge of an ordinary *𝗱𝗲𝘀𝗶𝗴𝗻𝗲𝗿* of such articles 4. consider any 'secondary considerations' as indicia of nonobviousness   The USPTO guidance helpfully emphasizes that: '[T]here must be some 𝗿𝗲𝗰𝗼𝗿𝗱-𝘀𝘂𝗽𝗽𝗼𝗿𝘁𝗲𝗱 𝗿𝗲𝗮𝘀𝗼𝗻 (𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗶𝗺𝗽𝗲𝗿𝗺𝗶𝘀𝘀𝗶𝗯𝗹𝗲 𝗵𝗶𝗻𝗱𝘀𝗶𝗴𝗵𝘁) that an ordinary designer in the field of the article of manufacture would have modified the primary reference with the feature(s) from the secondary reference(s) to create the same overall appearance as the claimed design.'   For design prosecutors, 𝘓𝘒𝘘 does *𝗻𝗼𝘁* automatically mean we should blindly accept Franken-art obviousness rejections that simply cobble together bits of prior art into the claimed design. Even if 𝘞𝘩𝘪𝘵𝘮𝘢𝘯 𝘚𝘢𝘥𝘥𝘭𝘦 (as affirmed by 𝘓𝘒𝘘) said it would be obvious to mate the front half of one saddle to the complementary rear half of another saddle, examiners should be strongly challenged on any obviousness rejections reliant upon assembling a *𝗻𝗲𝘄 𝗮𝗿𝗿𝗮𝗻𝗴𝗲𝗺𝗲𝗻𝘁 𝗼𝗿 𝗹𝗮𝘆𝗼𝘂𝘁* of design elements that would not have naturally mated together in their original contexts. Doing that would arguably run afoul of the CAFC’s admonition in 𝘜𝘯𝘪𝘳𝘰𝘺𝘢𝘭 𝘷. 𝘙𝘶𝘥𝘬𝘪𝘯-𝘞𝘪𝘭𝘦𝘺 (1988), '𝗜𝘁 𝗶𝘀 𝗶𝗺𝗽𝗲𝗿𝗺𝗶𝘀𝘀𝗶𝗯𝗹𝗲 𝘁𝗼 𝘂𝘀𝗲 𝘁𝗵𝗲 𝗰𝗹𝗮𝗶𝗺𝘀 𝗮𝘀 𝗮 𝗳𝗿𝗮𝗺𝗲 𝗮𝗻𝗱 𝘁𝗵𝗲 𝗽𝗿𝗶𝗼𝗿-𝗮𝗿𝘁 𝗿𝗲𝗳𝗲𝗿𝗲𝗻𝗰𝗲𝘀 𝗮𝘀 𝗮 𝗺𝗼𝘀𝗮𝗶𝗰 𝘁𝗼 𝗽𝗶𝗲𝗰𝗲 𝘁𝗼𝗴𝗲𝘁𝗵𝗲𝗿 𝗮 𝗳𝗮𝗰𝘀𝗶𝗺𝗶𝗹𝗲 𝗼𝗳 𝘁𝗵𝗲 𝗰𝗹𝗮𝗶𝗺𝗲𝗱 𝗶𝗻𝘃𝗲𝗻𝘁𝗶𝗼𝗻.'” Post contributed by Joseph Wang, a registered patent attorney and principal at Schwegman Lundberg & Woessner. Joseph J. Wang practices in a variety of technological disciplines: https://bit.ly/4dRmdKT. #designpatents

18

🆕 ISACA white paper: "Understanding the EU AI Act: Requirements and Next Steps." Read for free and check out the next steps you will need to take to ensure compliance: https://lnkd.in/gxB5pZjU #ISACA #EUIAAct #ArtificialIntelligence #AIlegislation

214

5 Comments