Data breaches at major retailers Target and Neiman Marcus during last year’s holiday shopping season affected more than 100 million people and focused new attention on the need to protect person information stored online.

While it’s clear that tough data breach legislation must be enacted, California Attorney General Kamala Harris is taking action to improve cybersecurity in the state before new laws are passed.  Today she released recommendations to California businesses to help protect against and respond to the increasing threat of malware, data breaches and other cyber risks.

In addition Harris is leading an investigation by state attorneys general into the Target and Neiman Marcus breaches, Don Thompson of The Associated Press reported:

Harris’ office also disclosed that California is leading a multistate investigation into the massive holiday season consumer data theft at discount retailer Target Corp. and luxury retailer Neiman Marcus, breaches that left tens of millions of customers at risk. More than 7 million Californians were affected by the Target breach alone, Special Assistant Attorney General for Law and Technology Jeff Rabkin said.

The U.S. Justice Department is taking the lead in trying to identify the culprits, who are suspected to be based overseas, while the multistate investigation focuses on whether the retailers share blame because they lacked the necessary precautions to prevent the thefts. The state investigation also will explore whether Target and Neiman Marcus acted properly as soon as they learned of the problem, Rabkin said in a telephone interview.

The guide, Cybersecurity in the Golden State, offers suggestions focused on small to mid-sized businesses, which are particularly vulnerable to cybercrime and often lack the resources to hire cybersecurity personnel. In 2012, 50 percent of all cyber attacks were aimed at businesses with fewer than 2,500 employees and 31 percent were aimed at those with less than 250 employees, Harris said.

Key recommendations for small business owners include:

• Assume you are a target and develop an incident response plan now.
• Review the data your business stores and shares with third parties including backup storage and cloud computing. Once you know what data you have and where it is, get rid of what is not necessary.
• Encrypt the data you need to keep. Strong encryption technology is now commonly available for free, and it is easy to use.
• Follow safe online practices such as regularly updating firewall and antivirus software on all devices, using strong passwords, avoiding downloading software from unknown sources and practicing safe online banking by only using a secure browser connection.

In 2003 California was the first state to pass a data breach notification.  In 2012 the law was amended to require any breach that involved more than 500 Californians be reported to the attorney general.

>The 170 breaches reported to the attorney general’s office in 2013 represent a 30 percent increase over the 131 identified the year before,  according to figures provided to The Associated Press. Among entities reporting breaches in 2012 were American Express Travel Related Services Co., Kaiser Permanente and several state government agencies, including the departments of Public Health and Social Services.

Given the current data breach laws Harris is taking meaningful action.  But, what’s ultimately needed is a law that would make her best practice recommendations legal mandates.  We need a California Financial Information Privacy Act that would:

• Change breach notification standards to be immediate.
• Set limits on the time data can be retained. And limits on what information can be collected and retained.
• Write minimum-security standards into the law so that they are no longer voluntary.
• Most importantly: create a private right of action. Put a price tag on retailers’ mistreatment of our private financial information.

Until there is a real price to pay, Target, Neiman Marcus and other retailers will continue to make us targets.

Posted by John M. Simpson, Consumer Watchdog’s Privacy Project Director.

Governor looks to maintain cautious approach

by Brian Leubitz

Carla Marinucci of the San Francisco Chronicle has a way with a video camera like few else. She readily acknowledges the less than high tech camera work, even going so far as to name her video series “Shaky Hand Productions.” But she has a way of being in the right place at the right time to ask some very pertinent questions.

Yesterday she posted another such video, this time a dimly lit interview of Gov. Brown. He covered the drought and the frustrating Bay Bridge situation. On mandatory water restrictions he hewed his refrain of letting local governments ride lead:

I like to focus attention and responsibility on local government, local school districts, whenever possible. So I certainly encourage every local community to do exactly what they need … and when it becomes necessary for the state to take over and actually order (rationing) … I’ll certainly do that. “

Cruise on over to her blog post to get the full transcript. Looks like he’ll officially kick his campaign off soon.

Former Governor speaks out on redistricting and top two reforms

by Brian Leubitz

Governor Arnold Schwarzenegger had his ups and downs as governor. He peaked That’s not all that abnormal, but with him it was entirely predictable. When he went toward the middle/leftish, he was up. When he veered hard right, he went down. 2005 hard-right special election? Down. AB 32? Up. And, more relevant here, redistricting measures? Up. You can check his approval rating history here.

And so he’s trying to craft his legacy around the government reforms that have largely been quite popular. He’ll be speaking at USC this morning about redistricting and Top-2. Yesterday, he published an op-ed that lets us know which victory lap he’ll be taking.

Many of us believed, and voters agreed, that the two reforms in combination would put California on a path toward breaking up gridlock and hyper-partisanship, and making government work better for our citizens.

We were basing our efforts on common sense and a commitment to putting people over politics. And now, the early results are starting to come in, and they show that these reforms are working.

In 2012, the top-two primary yielded 28 elections that, for the first time, pitted members of the same party against one another. Also, legislative districts that previously had been gerrymandered to protect politicians were no longer “safe” for one party or the other. … This year’s races could shake things up even more, as candidates for office are forced to appeal to all voters, not just the party bosses.(Arnold Shwarzenegger in SF Chronicle)

Now, I think he has a few fair points in the op-ed. I was a strong opponent of the redistricting system when it was on the ballot, both times actually. But I’m big enough to admit that I was wrong. The system was far more responsive to the needs and desires of the voters, rather than the legislators. The process was transparent as any we have seen, and the results were fair. Sure, there were some who were disappointed by the results, but a fair system was always likely to upset some of the entrenched apple carts.

But, as for top two, the system clearly has some big flaws. First, despite his claims that somehow the primary system allowed “party bosses” to choose, the primary system was made up of voters. There is no better example of this than the Tea Party, an insurgent force within the Republican party. How many times have we now seen the wishes of party bosses completely ignored at the ballot box? And let’s face it, the “party bosses” are bosses in name only these days. The bosses are really the big independent expenditure funding campaigns. Where they go, eventually our politics follows.

But the bigger issue of Top 2 is the troubling results it can sometimes yield to triumphs of game theory over the desires of constituents. There is no better example of this than California’s 31st district in 2012. In that election, two well-known Republicans ran against four less well known Democrats in a district with a 15+% Democratic registration advantage. In a relatively low turnout June primary, Democrats received 33,402 votes, and Republicans received 32,265 votes. Yet there was no Democrat on the ballot. This is a brilliant play for Republicans, they picked up a seat they wouldn’t have had otherwise. But, in the end, a plurality of voters in the district did not have an option from their own party. How does that make sense?

Add in the very troubling impacts of Top 2 on third parties, and you have a muddled, confusing, and anti-democratic system that favors parties that game the system with tight party boss control. If your party boss can’t impose discipline, you may end up with no candidates on the general election ballot.

Finally, with all of this, Schwarzenegger’s stated purpose was to create a more “moderate” legislature. In California, that really meant a less progressive, more pro-corporate body. It is hard to deny that Schwarzenegger was at least somewhat successful on that front. Despite the 2/3 Democratic control, many of these Democrats moved the caucus to the right. Now, whether you value the goal of making the legislature more moderate could lead you to differing judgments on Gov. Schwarzenegger. One would hope that a chief goal of structural government reform is to create a legislature that fairly and accurately represents the constituents, but that was never Schwarzengger’s thing. Sure, he had a flair for populist rhetoric, but drifted in other directions when in office.

Schwarzenegger will be talking to the hosts of MSNBC’s Morning Joe, so you will likely be able to see snippets of the conversation on TV. But, from a Governor who finished with an approval rating around 20% in 2010, there is a lot of work left to fully rehabilitate his legacy that a flawed government reform like Top 2 can’t address.

Steinberg proposal would throw monkey wrench into cap and trade

by Brian Leubitz

Cap and trade is far from perfect. And if you ask many economists, you’d find a carbon tax as a solid alternative. However, a muddy mix of the two? Well, that raises more questions than it answers.

And, so we have Sen. Steinberg’s proposal:

Next year for the first time, transportation fuels will come under the program: oil companies will have to account for the emissions from Californians’ cars and trucks. The cost of buying additional pollution permits is one that companies are almost certain to pass along to consumers.

Steinberg’s plan would make it more direct, as a tax that we pay at the pump. His reasoning is that while drivers will pay more for gas either way, with a tax the increase is more predictable and transparent.

“What people in California also need is pollution cuts,” said Tim O’Connor, director of the Environmental Defense Fund’s California Climate Initiative. He said that while he supports some of the ideas behind Steinberg’s proposal, he’s concerned it could undermine California’s efforts to charge for the right to pollute, and to reduce greenhouse emissions overall. (KQED / Molly Samuel)

The bill seems far from complete, and will likely get a lot of revisions. But, today is the deadline for bills to be filed, and so here we have something. Now, generally when the Western States Petroleum Association is happy, as they have said they are eager to listen to these changes, it should draw attention.

Whether these changes would go anywhere involves a lot of questions for a system that was just about to start in earnest next year. This will surely change, but environmentalists will want to keep a keen eye on this bill.

Added sugar leads to profound health risks

by Brian Leubitz

Last year, under a flood of beverage industry money, two proposed sugary beverage taxes were easily defeated in Richmond and El Monte. However, Californians are still wary of the health risks that they present. To wit:

California voters endorse a proposal to require beverage companies to post a health-warning label on sodas and sugary drinks to alert consumers that their daily consumption contributes to diabetes, obesity and tooth decay. Statewide 74% of voters back this requirement, of whom 52% do so strongly. Support is bipartisan, with large majorities of Democrats (80%), Republicans (64%) and non-partisans (75%) endorsing the idea.

The poll also finds continuing support among the statewide voting public to tax the sale of sodas and other sugary drinks and use its proceeds for school nutrition and physical activity programs for kids. Two in three voters (67%) favor this proposal. The results are similar to a Field Poll completed in late 2012, which found 68% of voters statewide supporting such a tax. (Field (PDF))

Unfortunately, the beverage industry isn’t keen on leaving anything to chance. And now San Francisco, led by Supervisors Scott Wiener, Eric Mar and Malia Cohen, are looking to put exactly such a measure on the ballot for November. The statewide poll found that within the San Francisco Bay Area, 78% of residents favor a soda tax to fund school nutrition and physical activity programs to reduce diabetes. San Francisco voters support it, but will all that Coke and Pepsi money be enough to confuse the issue.

Look, there are clearly some issues with the regressiveness of the sugar beverage tax. I don’t have the exact figures on this, but one would expect to see that under the proposed measure, low to middle income San Franciscans would pay a far larger share of the tax than for other taxes. However, that is also the case with tobacco taxes, yet we tolerate those. The fact is that while sugary beverages have not yet been proved to be as dangerous as tobacco, they carry very severe health risks. The Boston Public Health Commission has some startling statistics.

One, 20-oz bottle of regular soda has about 16 teaspoons of sugar.

Teens consume twice as much soda as they do milk.

On an average day, 80% of youth consume a sugary drink.

A single, 20-ounce bottle of regular soda has about 16 teaspoons of sugar.

The average person consumes almost 100 pounds of sugar a year, with the single biggest source being sodas.

The American Heart Association recommends that the maximum daily intake of added sugars be no more than 4.5 teaspoons for teens aged 12-19.

Did you know, health costs of obesity in the United States are $147 billion annually? That’s like buying everyone in the U.S. an iPad.

Economists call such taxes a case of “internalizing externalities.” In other words, the government has been subsidizing these beverages, in the form of health care, for years. It is now time to include those costs in the price of the beverage.

Target is targeting our privacy. There’s a big red bullseye, a target – like the one on the shirt I’m wearing today – that Target and Neiman Marcus, who chose not to show up to answer questions today, have put on us because they haven’t done enough to protect our private financial data. And the reason is that there’s no financial incentive to do so.

110 million Americans had their personal financial information breached. That ‘s one out of two adult Americans. I was in Sacramento today to testify in front of a joint California Assembly committee hearing investigating the breach. And yet Target did not send a single representative to Sacramento today to answer questions about the largest data breach in American history?

The fact that Target didn’t show up today tells us all we need to know about how sorry Target is and how committed it is to our privacy.

If you are as offended by this as I am, I have a t-shirt for you to wear too.

The reason Target won’t face legislative questions today is the same reason that our personal financial information and data is at such grave risk: there is no price to pay. There are few financial penalties to companies like Target when our personal data is taken.  

Beyond public embarrassment, Target has little financial incentive to care.

We, the consumers, pay the consequences but we have no remedies.

According to the Committees’ own staff research, 1 in 4 consumers whose personal information that is taken becomes a victim of identity theft. 1 in 4 victims of a data breach is also a victim of identity theft. If these numbers apply to Target, that would potentially create more than 25 million identity theft victims.  

There’s a harm. The retailers had a role in creating that harm. And yet they have no liability under California law for what they have or have not done to safeguard the sanctity of our personal information.

The problem with privacy violations is that unlike thefts of money or property the law does not recognize a harm and does not provide a remedy.

As the Committees’ staff research states: consumers have no remedy under the law for the loss of financial privacy suffered through these data breaches, and the 1 in 4 risk of id theft they face.  Zero remedies.

So why would retailers invest in greater security, or meet voluntary industry standards, or move away from risky magnetic strip technology?  

If they don’t have to pay a price they don’t have an incentive to change.  And that leaves our private financial information with a big bullseye on it.

What can we do?

We need a California financial information act that mirrors our Medical Information Privacy Act.    

When there is a data breach of our medical information, the drug company, hospital or medical center is liable to the consumer for $1,000 per violation.  

Guess what?  Medical data breaches are fewer and farther between. When they occur companies pay a big price.

The same should be true for our financial data. We need a California Financial Information Privacy Act

It would:

• Change notification standards to be immediate.
• Write minimum-security standards into the law so that they are no longer voluntary.
• Set limits on the time data can be retained. And limits on what information can be collected and retained
• Most importantly: create a private right of action. Put a price tag on retailers’ mistreatment of our private financial information.

Until there is a price to pay, Target and other retailers will continue to make us targets.

If you are as offended as I am by Target’s absence today in Sacramento, please share our Target design online to show your displeasure.

When a company as big as Target won’t provide a single representative to answer questions about the largest data breach in American history, it is time for California to step up and deliver on the promise in Article 1 Section 1 of our state constitution: Privacy is an inalienable right.

Posted by Jamie Court, President of Consumer Watchdog.