Scarinci Hollenbeck, LLC
The Firm
201-896-4100 info@sh-law.comAuthor: Scarinci Hollenbeck, LLC|October 26, 2020
After adopting comprehensive cybersecurity regulations for financial services companies, the New York State Department of Financial Services (NYDFS) is now turning its attention to social media companies. The agency recently concluded its investigation into the recent Twitter hack aimed at accounts of cryptocurrency firms and well-known public figures, including Barack Obama, Kim Kardashian West, Jeff Bezos, and Elon Musk. The resulting report recommends a new cybersecurity regulatory framework for giant social media companies.
“Social media platforms have quickly become the leading source of news and information, yet no regulator has adequate oversight of their cybersecurity. The fact that Twitter was vulnerable to an unsophisticated attack shows that self-regulation is not the answer,” Superintendent of Financial Services Linda A. Lacewell said in a press statement.
On July 15, 2020, a 17-year old hacker, along with several accomplices, breached Twitter’s network and took control of dozens of Twitter accounts belonging to high-profile users. The hackers were able to access Twitter’s internal systems by impersonating the Twitter IT department and duping employees into providing their log-in credentials.
Once the hackers seized control of the accounts, they tweeted out a “double your bitcoin” scam, with a link to send payments in bitcoins. For several hours, the cyberattack played out in public, with Twitter seemingly unable to stop the hackers. Overall, 130 Twitter user accounts were compromised, and the hackers stole more than $118,000 worth of bitcoin.
The NYDFS Twitter Investigation Report highlights several cybersecurity weaknesses that made the hack possible, including:
In 2016, NYDFS enacted its first-in-the-nation cybersecurity regulation that requires financial institutions under the agency’s oversight to implement a risk-based cybersecurity program and to report any attempted or executed unauthorized access to their information systems. NYDFS is now calling for similar regulations for large social media companies like Facebook and Twitter.
“The risks posed by social media to our consumers, economy, and democracy are no less grave than the risks posed by large financial institutions,” NYDFS argues. “The scale and reach of these companies, combined with the ability of adversarial actors who can manipulate these systems, require a similarly bold and assertive regulatory approach.”
In its report, NYDFS notes that current proposals to improve public oversight of large social media companies primarily focus on the issues of antitrust/competition or content moderation. It proposes comprehensive cybersecurity regulation of large social media companies that goes further than its existing cybersecurity regulation for the financial services industry.
“An effective cybersecurity regulation here should go even further than the Department’s regulation. The Department’s regulation, which was drafted with substantial industry input, was carefully designed to be flexible enough to apply to the thousands of companies regulated by the Department, from global corporations to small businesses,” the report states. “By contrast, a regulation for major social media companies could be applied to a handful of large, complex, and technologically sophisticated corporations with a global footprint. A cybersecurity regulation for large social media companies should be both more detailed and require more security in high-risk areas.”
NYDFS also advocates for a dedicated regulator for social media companies, arguing that the “regulatory vacuum must be filled.” According to the agency, a “useful starting point” is to create a “systemically important” designation for large social media companies, akin to the designation given by the Financial Stability Oversight Council (FSOC) to critically important bank and non-bank financial institutions.
“An analogue to the FSOC should be established to identify systemically important social media companies. This new Oversight Council should evaluate the reach and impact of social media companies, as well as the society-wide consequences of a social media platform’s misuse, to determine which companies they should designate as systemically important,” the NYDFS explains. “Once designated, those companies ‘stress tests’ to evaluate the social media companies’ susceptibility to key threats, including cyberattacks and election interference.”
It remains unclear whether a new regulatory framework for social media companies will become a reality. However, it is likely that they will continue to face scrutiny, particularly if more high-profile cybersecurity incidents occur. For businesses in all industries, the Twitter hack and the resulting NYDFS report provide valuable insight into how unsophisticated hackers can capitalize on cyber weaknesses, particularly those created by the COVID-19 pandemic. It is, therefore, imperative that businesses take the appropriate measures to curb against cyber threats irrespective of the implementation of regulatory mandates.
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
The Firm
201-896-4100 info@sh-law.comAfter adopting comprehensive cybersecurity regulations for financial services companies, the New York State Department of Financial Services (NYDFS) is now turning its attention to social media companies. The agency recently concluded its investigation into the recent Twitter hack aimed at accounts of cryptocurrency firms and well-known public figures, including Barack Obama, Kim Kardashian West, Jeff Bezos, and Elon Musk. The resulting report recommends a new cybersecurity regulatory framework for giant social media companies.
“Social media platforms have quickly become the leading source of news and information, yet no regulator has adequate oversight of their cybersecurity. The fact that Twitter was vulnerable to an unsophisticated attack shows that self-regulation is not the answer,” Superintendent of Financial Services Linda A. Lacewell said in a press statement.
On July 15, 2020, a 17-year old hacker, along with several accomplices, breached Twitter’s network and took control of dozens of Twitter accounts belonging to high-profile users. The hackers were able to access Twitter’s internal systems by impersonating the Twitter IT department and duping employees into providing their log-in credentials.
Once the hackers seized control of the accounts, they tweeted out a “double your bitcoin” scam, with a link to send payments in bitcoins. For several hours, the cyberattack played out in public, with Twitter seemingly unable to stop the hackers. Overall, 130 Twitter user accounts were compromised, and the hackers stole more than $118,000 worth of bitcoin.
The NYDFS Twitter Investigation Report highlights several cybersecurity weaknesses that made the hack possible, including:
In 2016, NYDFS enacted its first-in-the-nation cybersecurity regulation that requires financial institutions under the agency’s oversight to implement a risk-based cybersecurity program and to report any attempted or executed unauthorized access to their information systems. NYDFS is now calling for similar regulations for large social media companies like Facebook and Twitter.
“The risks posed by social media to our consumers, economy, and democracy are no less grave than the risks posed by large financial institutions,” NYDFS argues. “The scale and reach of these companies, combined with the ability of adversarial actors who can manipulate these systems, require a similarly bold and assertive regulatory approach.”
In its report, NYDFS notes that current proposals to improve public oversight of large social media companies primarily focus on the issues of antitrust/competition or content moderation. It proposes comprehensive cybersecurity regulation of large social media companies that goes further than its existing cybersecurity regulation for the financial services industry.
“An effective cybersecurity regulation here should go even further than the Department’s regulation. The Department’s regulation, which was drafted with substantial industry input, was carefully designed to be flexible enough to apply to the thousands of companies regulated by the Department, from global corporations to small businesses,” the report states. “By contrast, a regulation for major social media companies could be applied to a handful of large, complex, and technologically sophisticated corporations with a global footprint. A cybersecurity regulation for large social media companies should be both more detailed and require more security in high-risk areas.”
NYDFS also advocates for a dedicated regulator for social media companies, arguing that the “regulatory vacuum must be filled.” According to the agency, a “useful starting point” is to create a “systemically important” designation for large social media companies, akin to the designation given by the Financial Stability Oversight Council (FSOC) to critically important bank and non-bank financial institutions.
“An analogue to the FSOC should be established to identify systemically important social media companies. This new Oversight Council should evaluate the reach and impact of social media companies, as well as the society-wide consequences of a social media platform’s misuse, to determine which companies they should designate as systemically important,” the NYDFS explains. “Once designated, those companies ‘stress tests’ to evaluate the social media companies’ susceptibility to key threats, including cyberattacks and election interference.”
It remains unclear whether a new regulatory framework for social media companies will become a reality. However, it is likely that they will continue to face scrutiny, particularly if more high-profile cybersecurity incidents occur. For businesses in all industries, the Twitter hack and the resulting NYDFS report provide valuable insight into how unsophisticated hackers can capitalize on cyber weaknesses, particularly those created by the COVID-19 pandemic. It is, therefore, imperative that businesses take the appropriate measures to curb against cyber threats irrespective of the implementation of regulatory mandates.
If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.