Tag Archive for: fines

China Fines Didi $1.2 Billion as Tech Sector Pressures Persist

/in


The authorities in China on Thursday fined the country’s ride-hailing giant, Didi, $1.2 billion for data security violations, the latest in a string of regulatory actions that have laid low China’s once-soaring internet sector.

The penalty, announced by China’s internet regulator, the Cyberspace Administration of China, ended a yearlong investigation into the data practices of the ride-sharing giant that spoiled a blockbuster listing in the United States and ultimately led to a decision to delist from the New York Stock Exchange. The regulator said it would also fine two top executives at the company.

The firm violated several Chinese data security laws, the regulator said, by collecting millions of addresses, phone numbers, images of faces, and other data.

The eye-watering fine most likely clears the way for the one-time Wall Street-darling to list its shares in Hong Kong. But the regulator’s announcement did not mention whether it would allow Didi to put its app back on Chinese app stores and to restore its ability to register new users. The government had imposed the restrictions on Didi’s operations last July as part of its investigation.

The fine broadly matched penalties paid out by other Chinese internet giants, in terms of the share of the companies’ annual revenue, during a nearly two-year regulatory crackdown on the sector.

Some analysts have argued there are signs that a frenzied period of rule-making and harsh enforcement by China’s regulators may be on the wane. Even so, more government oversight and a willingness to punish China’s innovation leaders appears to have become the new normal. In this month alone, China’s antitrust regulator punished Didi and other internet firms for failing to report mergers for antimonopoly review, while the country’s central bank fined Didi for mishandling customer data.

In a long list of infractions that included excess collection of data, the Cyberspace Administration of China singled out Didi’s chief executive and founder, Cheng Wei, and its president, Jean Liu. Each was fined roughly $150,000.

“Didi’s illegal operations have brought serious security risks to the security of the country’s key information…

Source…

DOJ fines NSA hackers who assisted UAE in attacks on dissidents

/in


The Justice Department announced a controversial deal with three former US intelligence operatives that allows them to pay a fine after breaking multiple laws through their offensive hacking for the repressive government of the United Arab Emirates.



text: (Image: file photo)

© By Mark Van Scyoc — Shutterstock

(Image: file photo)


The DOJ said 49-year-old Marc Baier, 34-year-old Ryan Adams and 40-year-old Daniel Gericke “entered into a deferred prosecution agreement” that allows them to avoid prison sentences in exchange for paying $1,685,000 “to resolve a Department of Justice investigation regarding violations of US export control, computer fraud and access device fraud laws.”

The three were part of Project Raven, an effort by the UAE to spy on human rights activists, politicians and dissidents opposed to the government. The three even hacked into US companies, creating two exploits that were used to break into smartphones.

Both Reuters and The Intercept conducted an in-depth investigation into the work of Project Raven and a UAE cybersecurity firm named DarkMatter after members of the team raised concerns about the kind of hacking they were being asked to do by UAE officials. 

Despite the accusations listed in the court filing, the DOJ said Baier, Adams and Gericke — all former NSA employees or members of the US military — reached an agreement on September 7 to pay the fines in addition to other restrictions on their work. 

Loading...

Load Error

Baier will be forced to pay $750,000, Adams will pay $600,000, and Gericke will pay $335,000 over a three-year term. All three will also be forced to cooperate with the FBI and DOJ on other investigations and relinquish any foreign or US security clearances. 

They are also permanently banned from having future US security clearances and will be restricted from any jobs involving computer network exploitation, working for certain UAE organizations, exporting defense articles or providing defense services.

The DOJ said the three were senior managers at a UAE company from 2016 to 2019 and continued to hack for the UAE despite being told they were violating rules that say people need a license from the State Department’s Directorate of Defense Trade…

Source…

U.S. to require energy pipelines report computer hacks or face fines

/in


Holding tanks are seen in an aerial photograph at Colonial Pipeline’s Dorsey Junction Station in Woodbine, Maryland, U.S. May 10, 2021. REUTERS/Drone Base/File Photo

Energy pipeline companies will have to report cybersecurity incidents to the U.S. government under a new directive that will be announced by the Transportation Security Administration (TSA) on Thursday, senior government officials said.

The officials, who asked to remain unidentified, said the directive will impose fines on pipeline companies that fail to report incidents within 12 hours and mandate that the pipeline companies designated a cybersecurity coordinator to report incidents and coordinate with the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA).

“This is the first time there’s mandatory reporting of cybersecurity incidents,” said one of the four senior officials that spoke to journalists ahead of the directive’s unveiling.

The new directive comes after hackers earlier this month carried out a ransomware attack on the Colonial Pipeline Co (COLPI.UL), the United States’ biggest fuel pipeline system, that caused supply disruptions, price spikes and panic buying across the East Coast earlier this month. read more

The directive was first reported by The Washington Post earlier this week.

The hackers, alleged to be operating out of Russia, held Colonial Pipeline’s computer network hostage and successfully extorted millions of dollars in digital currency. The incident has bumped the cybersecurity of critical infrastructure to the top of the national agenda.

The U.S. government has traditionally relied on private industry to flag hacks to officials, but is shifting toward mandatory reporting amid a number of major intrusions.

Similar mandates might appear in other industries. Speaking Wednesday, the officials said the new pipeline mandate is being eyed as a potential model for other sectors as well.

Our Standards: The Thomson Reuters Trust Principles.

Source…

Court Tells Agency That Tried To Charge $1.5 Million For A Records Request It Now Owes The Requestor $12,000 In Fines

/in

It’s too bad it takes a lawsuit to free up supposedly “open” records. A few years ago, transparency group Reclaim the Records asked for some easy-to-compile birth and death data from the Missouri Department of Health and Senior Services and received this ridiculous response.

DHSS told [Brooke] Ganz her request would cost $ 1.4 million to gather the documents. Ganz hired an attorney, Bernie Rhodes of the Lathrop GPM law firm. Rhodes, of Kansas City, is a Sunshine Law expert. He did some research and figured out obtaining the records would literally take a few keystrokes at a computer. He protested the ridiculous charge — a common tactic in Missouri when public officials don’t want to release public documents. The state backed off and said the search would cost closer to $ 5,000.

When this drastically-reduced estimate was delivered, Reclaim the Records said it was still too high. So, the state just decided it wasn’t going to release the records at all.

The Cole County Court has sided with Reclaim the Records. The state will have to produce the records and for even less than the $ 5,000 it quoted before deciding it wasn’t going to release anything. The decision [PDF] details the government’s dishonest dealings during this case, making it clear the DHSS did everything it could to avoid complying with the state’s Sunshine Law.

The first couple of communications from the DHSS quoted an hourly rate of $ 20.85. The next response — sent after state officials spent a few days “obtaining information about Reclaim the Records” — suddenly increased the hourly rate to $ 42.50/hour, raising the entire estimate to nearly $ 1.5 million.

This estimate was drastically reduced when Reclaim’s lawyer pointed out the search could be performed easily, pulling birth/death data from the state’s database a year at a time, rather than the state’s proposed day-by-day search through 40+ years of data.

The ruling provides more insight on the DHSS’s obfuscation — a coordinated effort by the government to withhold these records permanently.

On July 21, 2016—while Mr. Rhodes and Ms. Loethen were corresponding about search methodologies that would comply with the Sunshine Law—Dr. Wambuguh spoke with Garland Land, the former State Registrar, about Ms. Ganz’s requests.

Later the same day, Mr. Land wrote Dr. Wambuguh and told her that DHSS should deny Ms. Ganz’s requests, and “require them to take you to court,” and to use the delay caused by the lawsuit to get the Legislature to change the law.

The court’s opinion includes a screenshot of an email from Garland Land detailing the state’s attempt to wait this out to see if it could get the law amended before Reclaim could sue the records out of the state’s hands.

I would not honor the request. I would require them to take you to court and then bring in national genealogical and vital records experts to testify why making indexes is not good public policy. By delaying this you might file a regulation or get the Legislature to clarify the intent of the law.

That’s what the DHSS did. It went to work trying to have the law changed, rather than simply comply with a (simple) public records request.

As stated in Mr. Ward’s e-mail, DHSS did in fact put forward a request to the Missouri Legislature to remove the provision from Missouri law providing that birth and death listings are available upon request.

Specifically, DHSS lobbied to have the Missouri Legislature remove the provision in Section 193.245 that provides that birth and death listings are available upon request.

The court finds the DHSS is obligated to produce these records. The law clearly states the DHSS “may disclose” the information Reclaim the Records requested. Nothing forbids the production of these records. Not only that, but it will have to do so for even less than the $ 5,000 it last quoted. The court says the allowable charges are only $ 2,557.30 — a total it arrived at after stripping the cruft from the DHSS’s quoted hourly rate of pay, decreasing it from $ 42.50/hour to $ 20.65/hour. This final total is “three-tenths of one percent of DHSS’ original $ 1.49 million estimate.”

The court doesn’t care for the government’s actions at all.

This secret plan represents an utter disdain for “the public policy of this state that … records … of public governmental bodies be open to the public unless otherwise provided by law.” Mo. Rev. Stat. § 610.011.1. Governmental bodies are not allowed to deny requests and then seek a law closing them; instead, they may only close records that are closed by existing law.

It is also important to consider the chronology of events—specifically, the fact DHSS’ denial came only after Ms. Ganz’s counsel had debunked the original $ 1.49 million demands for fees, which was clearly intended to be a back-door denial of Ms. Ganz’s requests. And when DHSS refigured its cost estimate using information supplied by Ms. Ganz’s counsel, it arrived at an estimate of approximately $ 5,000—still significantly higher than the allowable charges, but in a range that Ms. Ganz might consider paying.

Faced with this reality, DHSS had to scramble to find a way to prevent the disclosure. It found that way when Mr. Land provided a literal roadmap to achieve DHSS’ illicit goal: deny the request, make Ms. Ganz sue, and then use the delay caused by the resulting lawsuit to go to the Missouri Legislature and try to get them to change the law to close otherwise open records. It is hard to imagine a more purposeful plot.

For these willful violations of the state’s Sunshine Law, DHSS has been hit with $ 12,000 in fines, payable to Reclaim the Records. It is also now liable for Reclaim’s legal fees, which are yet to be determined. Unfortunately, these payments will come out of taxpayers’ pockets, which kind of limits the deterrent effect. But it’s clear the government never had any intention of following the law. Worse, it tried to have the law changed to align with its desire for opacity — an amendment that would have produced zero net benefit for residents of the state. It’s a pretty bold move to charge constituents for the privilege of having less access to public records. Fortunately, none of this worked out for the DHSS.

Techdirt.