Cybersecurity Policy Report, NYDFS recommends new cybersecurity regulatory framework for giant social media companies, (Oct 15, 2020)

By Stephanie K. Mann, J.D.

The recommendation comes after an investigation was launched to examine the July hack of several Twitter users.

After the Twitter accounts of several cryptocurrency firms and well-known figures were hacked on July 15, 2020 (see Banking and Finance Law Daily, July 17, 2020), the New York State Department of Financial Services launched an investigation into the breach of security. As a result of this examination, the NYDFS found that Twitter lacks adequate cybersecurity protections and, at the time of the attack, did not have a chief information security officer. As a result, the examination report recommends a new cybersecurity regulatory framework for giant social media companies.

"Social media platforms have quickly become the leading source of news and information, yet no regulator has adequate oversight of their cybersecurity. The fact that Twitter was vulnerable to an unsophisticated attack shows that self-regulation is not the answer," said Superintendent of Financial Services Linda A. Lacewell. "As we approach an election in fewer than 30 days, we must commit to greater regulatory oversight of large social media companies. The integrity of our elections and markets depends on it. The swift and effective response of DFS-regulated cryptocurrency companies illustrates how effective regulation can foster innovation and growth, while also protecting consumers."

Findings. As a result of its investigation, the NYDFS found:

• The hackers accessed Twitter’s systems with a simple technique: by calling Twitter employees and claiming to be from Twitter’s IT department. After the hackers duped four employees into giving them their log-in credentials, they hijacked the Twitter accounts of politicians, celebrities, and entrepreneurs, including Barack Obama, Kim Kardashian West, Jeff Bezos, Elon Musk, and several cryptocurrency companies regulated by the NYDFS.

• The hackers tweeted simple "double your bitcoin" messages, with a link to send payments in bitcoin, which led to the theft of over $118,000 worth of bitcoins from consumers.

• NYDFS-regulated cryptocurrency companies, Coinbase, Square, Gemini Trust Company, and Bitstamp responded quickly to block attempted transfers to the Bitcoin addresses the fraudsters used.

• Despite being a global social media platform boasting over 330 million average monthly users in 2019, Twitter lacked adequate cybersecurity protection. At the time of the attack, Twitter did not have a chief information security officer, adequate access controls and identity management, and adequate security monitoring.

Currently, Twitter and other large social media companies do not have a dedicated federal or state regulator ensuring that their cybersecurity policies and programs adequately address the risks of their digital operating models. Instead, they are largely self-regulated and have no accountability for significant cybersecurity lapses.

Recommendations. The report recommends that the largest social media companies, such as Twitter, should be designated as systemically important institutions with prudent regulation to manage heightened cybersecurity risk so that the government can protect consumers and safeguard markets and institutions.

According to the state regulator, these recommendations are critical to ensuring that the cybersecurity of global social media companies has continued oversight. As social media companies grow more systemically significant, it is crucial that they establish strong cybersecurity measures to protect users’ accounts, maintain consumer trust, and safeguard business and political systems from outside influences.

Companies: Bitstamp; Coinbase; Gemini Trust Company; Square

RegulatoryActivity: CyberPrivacyFeed DataBreach DataSecurity IdentityTheft NewYorkNews OversightInvestigations Privacy StateBankingLaws DataPrivacy