Cyber Defense eMagazine May 2019

On Security and Privacy, States Are Taking the Lead
By Andrea Little Limbago, Chief Social Scientist, Virtru
When Toyota announced the second data breach of the year, initial signs pointed to the group
OceanLotus, a Vietnamese-linked state sponsored espionage group. The Marriott breach, and the almost
400,000 compromised customer records, has been linked to China. These incidents continue the steady
drumbeat of new data breaches linked to nation-states, but we’re also seeing a rise in other sources of
data breaches. An unsecured database accidentally exposed two billion personal records, while
Collection #1 and subsequent collections’ combined for 3.5 billion user records posted on a hacking site.
Together, these compromises highlight the proliferation of attackers, the growing size of data breaches,
and the prominence of unsecured and accidental data exposures. However, despite this proliferation, the
United States lacks a federal privacy regulation to incentivize better protection and security standards
while also introducing accountability. Absent a federal privacy regulation, individual states are initiating
their own data protection and privacy regulations to help combat these threats and shift corporate
incentives.
Data protection and privacy legislation are not usually included in discussions of the latest cyber defenses
and the threat landscape. However, they should be viewed as core components for augmenting
deterrence by denial. While many of the new and existing authorities develop deterrence by punishment,
much less focus has been devoted to explicitly shifting incentives to prioritize data protections. In fact,
57