Is NYDFS Targeting Social Media for Its Next Round of Cyber Regulations?

After adopting comprehensive cybersecurity regulations for financial services companies, NYDFS is now turning its attention to social media companies…

After adopting comprehensive cybersecurity regulations for financial services companies, the New York State Department of Financial Services (NYDFS) is now turning its attention to social media companies. The agency recently concluded its investigation into the recent Twitter hack aimed at accounts of cryptocurrency firms and well-known public figures, including Barack Obama, Kim Kardashian West, Jeff Bezos, and Elon Musk. The resulting report recommends a new cybersecurity regulatory framework for giant social media companies. 

“Social media platforms have quickly become the leading source of news and information, yet no regulator has adequate oversight of their cybersecurity. The fact that Twitter was vulnerable to an unsophisticated attack shows that self-regulation is not the answer,” Superintendent of Financial Services Linda A. Lacewell said in a press statement. 

July 2020 Twitter Hack

On July 15, 2020, a 17-year old hacker, along with several accomplices, breached Twitter’s network and took control of dozens of Twitter accounts belonging to high-profile users. The hackers were able to access Twitter’s internal systems by impersonating the Twitter IT department and duping employees into providing their log-in credentials.

Once the hackers seized control of the accounts, they tweeted out a “double your bitcoin” scam, with a link to send payments in bitcoins. For several hours, the cyberattack played out in public, with Twitter seemingly unable to stop the hackers. Overall, 130 Twitter user accounts were compromised, and the hackers stole more than $118,000 worth of bitcoin.

The NYDFS Twitter Investigation Report highlights several cybersecurity weaknesses that made the hack possible, including:

• Lack of leadership: The NYDFS report notes that Twitter had not had a chief information security officer (CISO) since December 2019. According to NYDFS, having a CISO is important for getting buy-in on cybersecurity measures from senior management and across the organization. NYDFS also maintains that the lack of a CISO sends the message that cybersecurity is not a top priority from senior leadership.
• Failure to address remote workforce: The report states that Twitter did not implement any significant compensating controls after March 2020 to mitigate the heightened cyber risk to its remote workforce. The hackers directly exploited Twitter’s shift to remote working by posing as Twitter’s IT department and then persuading employees to enter their credentials into a website designed to look identical to the company’s real VPN login website. 
• Lax access controls and identity management: The hackers relied on social engineering — the use of deception to manipulate individuals into divulging confidential or personal information which is later used for fraudulent purposes — to obtain employee credentials. Once they had this information, Twitter’s access management and authentication failed to prevent the hackers from accessing the company’s internal tools.

NYDFS Calls for Cyber Regulations

In 2016, NYDFS enacted its first-in-the-nation cybersecurity regulation that requires financial institutions under the agency’s oversight to implement a risk-based cybersecurity program and to report any attempted or executed unauthorized access to their information systems. NYDFS is now calling for similar regulations for large social media companies like Facebook and Twitter.

“The risks posed by social media to our consumers, economy, and democracy are no less grave than the risks posed by large financial institutions,” NYDFS argues. “The scale and reach of these companies, combined with the ability of adversarial actors who can manipulate these systems, require a similarly bold and assertive regulatory approach.”

In its report, NYDFS notes that current proposals to improve public oversight of large social media companies primarily focus on the issues of antitrust/competition or content moderation. It proposes comprehensive cybersecurity regulation of large social media companies that goes further than its existing cybersecurity regulation for the financial services industry.

“An effective cybersecurity regulation here should go even further than the Department’s regulation. The Department’s regulation, which was drafted with substantial industry input, was carefully designed to be flexible enough to apply to the thousands of companies regulated by the Department, from global corporations to small businesses,” the report states. “By contrast, a regulation for major social media companies could be applied to a handful of large, complex, and technologically sophisticated corporations with a global footprint. A cybersecurity regulation for large social media companies should be both more detailed and require more security in high-risk areas.”

NYDFS also advocates for a dedicated regulator for social media companies, arguing that the “regulatory vacuum must be filled.” According to the agency, a “useful starting point” is to create a “systemically important” designation for large social media companies, akin to the designation given by the Financial Stability Oversight Council (FSOC) to critically important bank and non-bank financial institutions.

“An analogue to the FSOC should be established to identify systemically important social media companies. This new Oversight Council should evaluate the reach and impact of social media companies, as well as the society-wide consequences of a social media platform’s misuse, to determine which companies they should designate as systemically important,” the NYDFS explains. “Once designated, those companies ‘stress tests’ to evaluate the social media companies’ susceptibility to key threats, including cyberattacks and election interference.”

Key Takeaway

It remains unclear whether a new regulatory framework for social media companies will become a reality. However, it is likely that they will continue to face scrutiny, particularly if more high-profile cybersecurity incidents occur. For businesses in all industries, the Twitter hack and the resulting NYDFS report provide valuable insight into how unsophisticated hackers can capitalize on cyber weaknesses, particularly those created by the COVID-19 pandemic. It is, therefore, imperative that businesses take the appropriate measures to curb against cyber threats irrespective of the implementation of regulatory mandates.

If you have questions, please contact us

If you have any questions or if you would like to discuss the matter further, please contact me, Maryam Meseha, or the Scarinci Hollenbeck attorney with whom you work, at 201-896-4100.