Tech Support : support@safience.io

Blog

Alabama First To Mandate ‘Sensory Inclusion’ Training For State Law Enforcement

By a Biometrica staffer

In a bid to improve the relationship between law enforcement and the community, and to help officers de-escalate tense but not necessarily criminal situations, Alabama Governor Kay Ivey announced on Tuesday, August 3, that the Alabama Law Enforcement Agency (ALEA) would be entering into a statewide partnership with KultureCity, a nonprofit, to train officers in becoming “sensory-inclusive.”

This means fostering understanding, compassion, acceptance, and empathy in those first responders in situations involving people living with sensory processing issues or invisible disabilities. The hope is that this education will increase officers’ understanding, making it easier for them to identify when they are dealing with people who have different needs. This move makes the ALEA the first state law enforcement agency to take this step.

https://twitter.com/GovernorKayIvey/status/1422586466253918215

Under this initiative, all state troopers, Special Agents with ALEA’s State Bureau of Investigation, communication personnel, and employees of the Driver License Division have completed the training. The module included a training video and a test, after which the officers were certified by KultureCity and were given sensory-aid kits with tools like noise-cancelling headphones, nonverbal communication cards, and fidget spinners to keep in their cars and offices.

Gov. Ivey said the move was based on the fact that “individuals with sensory-issues have often been misdiagnosed or received delayed assistance due to the lack of understanding of their sensory issues.”

A person with sensory-processing issues typically struggles to manage stimuli information like sight, sound, and taste. An invisible disability, on the other hand, is any “physical, mental or neurological condition” that is not noticeable — i.e., through the use of a cane or wheelchair — but that still impacts a person’s movement, senses, activities, and everyday life.

Estimates vary on how many Americans are living with sensory-processing issues or invisible disabilities as the prevalence of these conditions is difficult to fully measure. KultureCity says that around one in six Americans has a sensory processing need of some kind, while others peg it at around one in every five. Approximately 96% of severe disabilities (which itself affects around 42 million Americans) are invisible, according to some estimates.

In addition to autism spectrum disorder, these two categories could include conditions such as post-traumatic stress disorder (PTSD), dementia, the after-effects of a stroke, Parkinson’s disease, chronic pain or fatigue, traumatic head or brain injuries, diabetes, cancer, lupus, Crohn’s disease, and fibromyalgia, among many others.

Experts say people who struggle with these problems are often the subject of misunderstandings or judgements, as the lack of an outward manifestation can lead others to think they are “faking it.” Yet, many of these conditions are protected by laws like the Americans with Disabilities Act.

Children are more likely to have sensory-processing issues, while adults who do have them have likely had them since childhood and probably have learned how to manage and hide their symptoms from others. Some data suggest that anywhere between 5% to 16% of school-aged children have sensory-processing disorders.

Of particular concern is the fact that sensory processing difficulties and invisible disabilities can cause turbulence in the emotional, social, academic, and civic spheres of a person’s life. Such a person may find it difficult to make friends or interact socially with others, and could get into trouble with authority figures frequently. People living with such problems may also have concurrent mental health issues like anxiety and depression, making them prone to acting out or being overwhelmed.

In a successful use-case earlier this year, the Helena Police Department in Alabama was able to use their KultureCity training to defuse a situation in which a person who appeared to be experiencing a psychiatric episode was blocking a highway. Officers managed to prevent a potentially deadly outcome in that situation. Officials in Helena say it is the first city to have trained 100% of its employees in sensory-inclusive practices.

KultureCity began working with law enforcement first in Salt Lake city, in Utah, when the fatal shooting of a young boy spurred officials to invest in the training. By April this year,  95% (over 9,000) of fire, police, and 911 personnel in the city had been through the training. The CEO of KultureCity said that the training has already prevented “four potential police-related shootings” in Salt Lake so far.

How The World Series Of Poker Became A Beloved American Contest

By Aara Ramesh

Less than 60 days from now, on Sept. 30, the World Series of Poker (WSOP) will make its return to the Rio in Las Vegas after a hiatus of over two years. Operators and spectators alike are hoping for a truly spectacular showing, especially in the Main Event, scheduled for November 4–17.

In 2019, when the tournament was last held, it drew 187,298 competitors from nearly 120 countries across the globe. The WSOP is the game’s longest-running competition, and over its five-decade run has given out over $3.2 billion in prize money. For amateurs, professionals, casual viewers, celebrities, and general fans of card games, this tournament remains the gold-standard.

Today, let us take a look at the inception of this ever-popular championship and how it evolved into the behemoth it is today.

It All Started In A Tiny Desert Town…

A few weeks ago, we wrote about how the history of the game of poker itself goes back centuries, with various origin myths pinning its birthplace as China or Persia. It gained popularity, however, in the Americas, when it became the preferred game of choice on the frontier. On the other hand, the flagship event of the game, the WSOP, has only been around for a handful of decades.

The first edition of what would come to be known as the World Series was held in 1970, in Nevada, with around 30 or so participants. At that time, gambling and card games, albeit popular, were slightly frowned upon in “polite” society. Nevada only had 70 poker tables across the state, while Las Vegas had fewer than 50. The host casino didn’t even have a designated poker room.

The inaugural tournament was held at the Horseshoe Casino, owned by Benny Binion. A year previously, Binion had played at the Texas Gamblers Reunion in Reno, put on by industry insiders Tom Moore and Vic Vickrey. Invitations were extended to some of the biggest names in poker of the day and the event was received fairly well, though it did not attract much attention from outside their circle.

When the pair declined to host the event again the next year, Binion seized on the opportunity, seeing its value, and hosted the first-ever WSOP. The champion that year was Johnny Moss, though in reality, he did not so much as win the tournament as he did win his peers’ votes for “best all-round player.” The event was held without fanfare, with no one outside Las Vegas seeming to care about it.

Binion didn’t give up. The next year, he changed the format to a “freeze-out.” There were seven players, each of whom paid an entry fee of $5,000, with the winner getting the whole pot. That person turned out to be Johnny Moss once more.

The first sign of growth for the tournament came in 1972, when “Amarillo Slim” Preston won. The savvy Texan leveraged his win for publicity, both for himself and the game, touring the country to proselytize the virtues of poker to anyone who would listen. He appeared on The Tonight Show 11 times, acted in movies, and wrote a best-seller, drawing unparalleled attention to poker and the WSOP. The following year, it was aired for the first time on CBS Sports.

It was seven years later, in 1979, that an amateur bested elite players for the first time, with Hal Fowler’s win inspiring many to try their hand at entering the tournament, including several foreign players. In 1981, NBC Sports aired the WSOP, bringing it to millions more homes.

The rapid growth of the competition led the Binion family to buy a casino next door, to expand their operations and open a full-time poker room. The patriarch of the family, Benny, died on Christmas 1989, at the age of 86, leaving the running of the casino and WSOP to his son, Jack.

In 1990, an Iranian expatriate living in the UK became the first non-American to win the most prestigious prize in poker. Less than a decade later, the popularity of the WSOP began to wane, as infighting in the Binion family caused a deterioration in the competition.

In 1998, Planet Poker, the first online poker room, was launched, giving a platform to millions across the world. Though these humble beginnings would later unspool into a multibillion dollar industry, Planet Poker was forced to suspend real-money operations in 2007, and formally shuttered its virtual doors a decade later.

The dwindling interest in poker all changed, however, on one miraculous, unbelievable evening in 2003, when Chris Moneymaker, an out-and-out amateur beat the tournament favorite to win the $2.5 million prize. His unlikely victory spurred millions around the globe to try becoming millionaires through online poker. Within a short timeframe, poker players became recognizable celebrities, and celebrities became poker players.

The Horseshoe was sold in 2004, and Harrah’s Entertainment (now known as Caesar’s Entertainment), the largest gaming company of the day, bought the rights to the WSOP, the game’s biggest event. From 2005 onwards, the tournament has been held at the Rio All-Suites Casino and Hotel.

The expanded space allowed for more events to be added to the schedule, drawing thousands of players to Vegas. By 2006, the WSOP spanned 45 tournaments and $100 million in prize money. That year, the winner bested over 8,500 competitors and won $12 million — an award that far outstripped the combined winnings of Wimbledon, the Masters, and the Kentucky Derby.

2012 saw the first-ever $1 million buy-in tournament at the WSOP, called the Big One for One Drop. It was also announced that a significant proportion of every buy-in would be donated to efforts to bring clean drinking water to underserved communities all across the world. Predictably, the tournament drew in a huge number of players, and culminated in Antonio Esfandiari winning a whopping $18.3 million prize.

With time, the WSOP expanded overseas, to Europe, Africa, and Asia, establishing a World Series of Poker Circuit. As the game became more ubiquitous and mainstream, it attracted new and lucrative advertising deals, only growing the value of the industry as a whole.

Poker In The Time Of Covid

Over the last year and a half, poker has seen a boom that could rival that generated by the Moneymaker effect. According to estimates, interest in online poker reached a five-year high last year, indicating that increased downtime, limited leisure activity options, and higher internet usage is driving people towards playing poker for fun.

Further, the 14th edition of the Sunday Million tournament attracted a record 93,016 entries and an $18.6 million pot, compared to 2019’s 61,342 entries and $12.2 million prize. Last October, both New Jersey and Pennsylvania saw record revenues from online casinos and poker rooms, up 106.7% in the case of the former.

It seems to many that poker professionals and casual players, as well as the general population, are choosing to indulge in online poker, with casinos across the country shut down by Covid-19 restrictions. Federal gambling regulations mean that to play in the WSOP online events, players must be physically located in Nevada or New Jersey, prompting some to play from grocery store parking lots in neighboring states. Others traveled abroad to take part.

All WSOP events in 2020 were held online, with the Main Event taking on a hybrid avatar and the final taking place at the Rio. Initially denied a U.S. visa, Argentina-native Damian Salas won the Main Event in January 2021. The American portion of the online tournament comprised 31 events, 44,000 entries, and $26 million in winnings, with an average buy-in of just over $800. 

Despite this stellar showing in what was an off-year for the casino and gaming industry as a whole, many are hoping that the return of the full tournament to Las Vegas this year will be nothing short of a triumph. With Nevada making a steady but slow comeback, there are few who would argue that a mega WSOP tournament this fall would be unwelcome.

Two More Officers Who Responded To Capitol Hill Riot Dead From Apparent Suicide

By Deepti Govind

It was just last Tuesday, July 28, that the House select committee formed to investigate the Jan. 6 attack on the U.S. Capitol convened its first hearing. At that hearing, the entire nation heard the emotional testimony of four police officers who were present at the insurrection, defending the building against the mob. Their accounts told of how they were beaten, taunted with racial insults, subjected to threats including “kill him with his own gun,” and how they thought they were going to die.

Now, almost exactly a week later, news media is reporting that two more police officers who responded to the Jan. 6 insurrection have died by apparent suicide. With that, the total number of officers who were at the Capitol during the rioting and are known to have committed suicide afterwards since stands at four, reports add.

Officer Gunther Hashida, assigned to the Emergency Response Team within the Special Operations Division, was found deceased in his residence on Thursday, July 29, according to a statement given to CNN from Metropolitan Police Department spokesperson Kristen Metzger. Only two weeks before that, i.e., on July 10, Metropolitan Police Officer Kyle DeFreytag had been found dead, according to the department’s public information officer Sean Hickman.

Hashida had joined the Metropolitan Police Department in 2003, and DeFreytag had been with the department since November 2016, CNN says. Hashida is survived by his wife Romelia, three children, a sister, and other members of a “wonderful family,” according to an online fundraising campaign established in his memory, the Guardian reported.

DeFreytag was a 26-year-old resident of Alexandria, Virginia, and was originally from Pennsylvania, according to an obituary posted by the Bensing-Thomas funeral home, Forbes said.

The other two officers who are known to have committed suicide and were at the Capitol on Jan. 6 were Metropolitan Police Officer Jeffrey Smith, who died several weeks after the riot, and US Capitol Police Officer Howard Liebengood, who died days after the insurrection. Smith was a 12-year veteran of the force, while Liebengood was a 16-year veteran. It was towards the end of January that the force first confirmed that two officers had taken their own lives after the insurrection.

Another Capitol Police officer, Brian D. Sicknick, suffered strokes and died of natural causes one day after responding to the attack. But even in Sicknick’s case, the D.C. medical examiner noted that “all that transpired played a role in his condition.”

In total, 138 Capitol Police and D.C. Metropolitan Police officers were injured in the attack, according to the New York Times. Those, however, are physical injuries and don’t account for several others who may be facing post-traumatic stress disorder or may be battling other mental health issues as a result of that fateful day.

The Jan. 6 insurrection has been described as “the worst violence at the Capitol since the British invasion in the War of 1812.” According to the testimony of one of the officers at the hearing on July 28, rioters wielded a range of weapons that included police shields, batons, sledgehammers, flag poles, Taser devices, chemical irritants, metal pipes, rocks, broken table-legs, and metal guard-rails.

Well over 500 people are facing criminal charges for their roles in the rioting, according to an average tally of several media reports. “That day continues to be a constant trauma for us literally every day, whether because [of] our physical or emotional injuries or both,” Capitol Police Sergeant Aquilino Gonell told the committee at the hearing last week.

The National Suicide Prevention Lifeline can be reached at 800-273-8255, or via online chat. You can also text HOME to 741741 to connect with a crisis text line counselor.

Nine In Ten Kids Have An Online Presence By The Age Of Two — Protecting Children’s Data Online

By a Biometrica staffer

It would not come as any surprise to say that the Covid-19 pandemic pushed most of the world online, particularly children, as schools went virtual under lockdowns and restrictions. This increased children’s use of the internet, and has prompted a renewed wave of concern over the safety of kids online.

One topic that has received attention recently is the governance and protection of children’s data online. Earlier this year, in May, the UN convened a panel of 17 experts from around the world, with the aim of developing a 10-point framework for governing the data of children that will a) maximize the benefits of technology for children and b) protect children who are not able to consent or control their own data.

The manifesto calls for, among other things, minimizing the use of surveillance and algorithms to track children and create digital profiles for them; keeping in mind that each child and their context is different and will call for flexible approaches; placing the burden of protecting children’s data on companies and the government, not on parents and children alone; extending the age of protection up to 18; providing sufficient resources to the community and all stakeholders so they can understand and implement the new policies well; investing more in research so that knowledge gaps can be filled and so that all regulations are based on a solid bedrock of evidence.

There are many who would say that the law has struggled to keep pace with the rapid advancement of technologies, which seem to grow and evolve on a daily basis. In the U.S., laws governing the protection of children’s data is somewhat of a patchwork quilt, but falls mostly into the hands of the Federal Trade Commission (FTC), thanks to the Children’s Online Privacy Protection Act of 1998 (COPPA).

In today’s piece, we take a look at why it is so crucial that governments and companies act fast to establish a better framework for governing children’s data privacy online.

The Case For Protecting Children’s Data

It is hard to ignore the pressing need for stakeholders from governments to parents to better regulate and confront how a child’s data is being accessed, stored, and used.

According to some estimates, around 92% of American children have an online presence of some sort before the age of two. Parents are likely to share ultrasound photos and/or the child’s gender before they are born, and then may even share photos on a monthly basis, believing that they are innocuously documenting their child’s growth and development. A study from around a decade ago found that eight in 10 babies had an online presence, as did more than nine in ten two-year-olds. 

Many children say that by the age of 10, they are allowed to or do browse the internet without their parents’ permission or knowledge. When it comes to teens, 95% report having access to a smartphone, and just under half of those say they are online for an average of nine hours a day. In addition to this, classrooms are increasingly becoming tech-centered, representing another possible point for data collection. In addition to children themselves sharing data, some researchers say that parents post an average of around 1,300 photos and videos of their children online by the time the child turns 13.

The dangers of a child having unrestricted and free access to the internet are manifold. Risks can range from localized problems like bullying and body image issues, all the way to a child being exposed to inappropriate material like pornography at a young age or being groomed and trafficked.

Children can have their pictures manipulated for horrific purposes, or can be subjected to humiliation, bullying, and even discrimination in the future. It may also affect their cognitive ability to understand and navigate the intricacies of autonomy and consent as they grow older.

According to observers, when they are young, children have no control over their online personas, nor do they really even understand the pitfalls and careful negotiations that must be considered before sharing personal information online. They do not understand what it means to give consent, experts say, and many parents do not even consider whether a child (now or in the future) wants information about their lives up for the world to see.

Identity theft is another cause for concern. One report by Barclays estimated that by 2030, parents sharing information about their children online (popularly known as “sharenting”) will account for two-thirds of all identity fraud in the UK. Minors prove an attractive target for this type of fraud, as there is little credit history associated with their data, and any identity theft may not even be uncovered until the child attempts to open a bank account.

COPPA 

Updated a decade ago, COPPA mandates websites to get explicit permission from parents before tracking the personal data of a child younger than 13. It also does a little to direct how online companies can market their products to children. When parents do consent, companies are allowed to store, collect, share, and use children’s information as they please.

The FTC has been successful in bringing charges against multiple companies under COPPA. Just last year, it was revealed the teen-sensation video app TikTok was once again being investigated by the Department of Justice and the FTC for violating COPPA. In 2019, the company had reached an agreement with the U.S. government to pay $5.7 million in civil penalties for collecting the first and last names, phone numbers, email addresses, and pictures of children under 13.

Similarly, also in 2019, YouTube paid a $170 million fine for violating COPPA by collecting information on children who watched the extremely popular toys and children’s content on its platform.

Even a seemingly innocuous coloring mobile app and digital coloring book has come under fire for violating COPPA by allowing children under 13 to use the app as a social media platform for communication. They were handed a civil penalty of $3 million.

The problem, some say, is that technology has evolved beyond just the basic worldwide web since 1998. Today, there are smartphones available, and new social media apps seem to proliferate at an astonishing rate. There are some who say that COPPA is no longer sufficient to protect children, and may actually even be counterproductive. Often, sites may have truly helpful and informative content for children, but will prohibit kids from accessing it due to fears over violating COPPA and being slapped with a heavy fine.

These deficiencies in the existing law have not gone unnoticed. In May, Senator Edward Markey, the original House author of COPPA, introduced into the U.S. Senate the Children and Teens’ Online Privacy Protection Act, aiming to update COPPA. The bill aims to protect children more widely by raising the age requirement for parental consent to 15.

Just days ago, Representative Kathy Castor reintroduced a bill she had submitted last year — the Protecting the Information of our Vulnerable Children and Youth Act (PRIVCY Act). Her House version raises the age of parental consent to 18 and will require all sites used by children and teens to comply with these regulations. It would also ban targeted advertising for teens and kids, and would ask teenagers for their permission before collecting their data. Rep. Castor also hopes that under the expanded law, the FTC will be able to pursue punitive damages against those found to be violating it.

It appears that there are many who believe COPPA still leaves much to be desired and that it needs to be updated for the rapidly shifting technology dynamics of the twenty-first century.

“In 2019, children and adolescents’ every move is monitored online, and even the youngest are bombarded with advertising when they go online to do their homework, talk to friends, and play games,” Sen. Markey said in introducing his bill, adding, “In the 21st century, we need to pass […] legislation that puts children’s well-being at the top of Congress’s priority list. If we can agree on anything, it should be that children deserve strong and effective protections online.”       

ICE Announces First ‘Continued Presence’ Resource Guide To Help Victims Of Human Trafficking

By a Biometrica staffer

U.S. Immigration and Customs Enforcement (ICE) announced its first Continued Presence (CP) resource guide on Friday, July 30, targeted at assisting federal, state, local, tribal, and territorial law enforcement agencies nationwide with their human trafficking investigations and prosecutions. The CP guide is a tool that will help increase the likelihood of success in human trafficking investigations and prosecutions, ICE added.

The guide addresses various aspects and begins by defining CP. We delve briefly into the topic based on excerpts from the ICE guide.

Firstly, what exactly is CP? It is a temporary immigration designation provided to noncitizens identified by law enforcement as victims of a “severe form of trafficking in persons” who may be potential witnesses. It allows noncitizen human trafficking victims to lawfully remain and work in the United States temporarily during the investigation into human trafficking-related crimes committed against them, and during any civil action under 18 U.S.C. § 1595 filed by noncitizen victims against their traffickers.

It’s initially granted for two years and may be renewed in up to two-year increments. Those who are granted CP also receive federal benefits and services. The idea behind it, of course, is to provide victims of some of the most heinous crimes that exist in the world today with stability, a means of support, and protection from removal. It also improves a victim’s ability to seek justice against their trafficker, either by cooperating with law enforcement and/or filing a civil action.

According to ICE, the routine use of CP for victims fosters trust with service providers and organizations that may be a greater source of referrals for law enforcement when they know that victims will be protected if they come forward. It will, ultimately, increase officers’ ability to identify victims and traffickers, ICE adds.

Successful human trafficking investigations and prosecutions all point to using a victim-centered approach as a reason behind their success, decades of past experiences show, the guide says. This approach places equal value on the investigation and prosecution of human traffickers and on the identification and stabilization of victims of human trafficking. It emphasizes consideration of victims’ rights, safety, and interests throughout the investigation and prosecution to minimize stress, harm, and trauma.

A key aspect, the guide says, is to dispel the fear of law enforcement and deportation that human traffickers often instill in their noncitizen victims. These fears can remain even after a victim is recovered from human trafficking. CP is meant to address some of these fears and anxieties by giving them authorization to live in the U.S. with the ability to work legally and receive federal benefits available to refugees.

For a person to be considered eligible for CP, law enforcement must identify the individual as a victim of trafficking in persons who may be a potential witness in a human trafficking investigation/prosecution or who have filed a civil action under 18 U.S.C. § 1595. Officers are required to use the definition of a victim of a severe form of trafficking per the Trafficking Victims Protection Act of 2000, Pub. L. No. 106-386, § 103(8-9) as amended in 22 U.S.C. § 7102(11-12), according to which a victim is a person subjected to:

  • sex trafficking, which is the recruitment, harboring, transportation, provision, obtaining, patronizing, or soliciting of a person for a commercial sex act either induced by force, fraud, or coercion, or in which the person induced to perform such act has not attained 18 years of age; or
  • forced labor, which is the recruitment, harboring, transportation, provision, or obtaining of a person for labor or services, through the use of force, fraud, or coercion for the purpose of subjection to involuntary servitude, peonage, debt bondage, or slavery.

The second eligibility requirement, i.e., that the victim “may be a potential witness,” means law enforcement has some indication that this individual has information that could be helpful to the investigation or prosecution of the trafficker. It does not require certainty that the victim will be a testifying witness at a prosecution nor that there be an indictment or prosecution.

Healthcare — The Latest Critical Infrastructure Sector In The Crosshairs Of Cybercriminals

By a Biometrica staffer

It seems like every day brings a new cyber incident that compromises the personal data of thousands, if not millions, of Americans. Last week, we wrote about how K–12 schools became the favored target for malicious cyber actors last year. This week, there seems to have been an abundance of healthcare organizations disclosing that their systems had been compromised by hackers, and that patients’ private healthcare information had been stolen.

The litany of incidents is at once terrifying and astounding. Just last week, Orlando Family Physicians, LLC, disclosed that in April a phishing scam affected four employee email accounts, with the data of around 450,000 patients being potentially exposed. Announced this week was that, over a four-month period between December last year and April this year, hackers compromised UC San Diego Health’s systems in a phishing attempt.

In May 2021, attackers hacked Florida Heart Associates and stole the data of over 45,000 people. When their ransom demands were not met, they took down the firm’s systems. As of this week, the clinic is still operating at only about 50% capacity. In October last year, the University of Vermont Medical Center lost an estimated $50 million in an attack, despite not paying the ransom. 

As per federal law, organizations are obligated to report to the Department of Health and Human Services (HHS) any data breaches that affect 500 or more individuals within 60 days of the incident. In turn, the HHS Secretary must inform the public about these attacks. The industry is classified by the federal government as “critical infrastructure,” alongside energy, fuel, food supply, water management, etc.

The statistics surrounding attacks on the industry are just as alarming and bleak. According to a recent report by Comparitech, over 18 million patient records were compromised in some way by ransomware attacks last year, 470% more than in 2019. Further, the attacks in 2020 forced downtime that cost the healthcare industry $20.8 billion, twice as high as what was seen in 2019.

The report concluded that 600 clinics, hospitals, and organizations were affected in 92 separate ransomware incidents. The number of attacks was the highest noted in the previous five years. Another report by SonicWall said that the number of attempts to compromise healthcare facilities rose 123% last year.

One survey found that more than 1 in every 3 healthcare organizations across the world reported being a victim of ransomware attacks in 2020. Another study concluded that, since November 2020 alone, the industry saw a 45% increase in such attacks. It was also found that 1 in every 3 victimized organizations opted to pay the ransom, just to get their operations up and running again quickly.

IBM has also highlighted that the industry topped a list of the industries with the most expensive data breaches, with an average cost of $9.23 million. Mega breaches (attacks in which 50–65 million records are exposed) cost an average of $401 million.

Further, around 44% of the breaches exposed sensitive personal data, ranging from names, emails, passwords, and birthdates, to health records, insurance details, social security numbers, and/or passport numbers. People affected can include current, past, and prospective patients, employees, students, and many others.

These attacks are particularly debilitating for healthcare entities as they significantly strain budgets that are already quite low. At higher risk are nonprofits and public health systems, as well as rural hospitals that serve thousands in surrounding counties, as they are generally underfunded and understaffed, and so possess fewer resources across the board.

Hackers proved to be particularly prolific last year, with HHS indicating that more than a million people’s records were impacted by data breach at a healthcare organization virtually every month in 2020. In September alone, nearly 10 million individuals had their data compromised by a cyberattack against a healthcare organization. 

What made the industry such an attractive target in 2020? Much like with schools, malicious actors took advantage of the Covid-19 pandemic and the associated confusion, fear, and anxiety to exploit victims. Like many other industries, hospitals moved services online, increasing telehealth consultations, remote working, online data storage. Through this, hospitals that were already devastated and overburdened by the pandemic, became an easy target for hackers.

Another factor is the higher pressure on hospitals to ensure business continuity; they cannot afford prolonged downtime, with many situations literally being life or death. This makes them more vulnerable to extortion, which many hackers are more than happy to exploit. In addition, the highly sensitive nature of data means that hospitals will want to react quickly to secure their systems.

Experts are also highlighting the deficiencies in hospitals’ cybersecurity infrastructure. Many are unable to or unwilling to allocate funds to patch security, especially last year, as this has historically not been seen as a priority. In addition, they are exposed to supply-chain risks as they tend to rely on a hodge-podge of solutions from third-parties rather than in-house technology.

Studies have also shown that healthcare organizations often neglect the most basic of cybersecurity directives, storing sensitive information on unsecured servers and not using two-factor authentication. Medical devices are also now more likely to be connected to the internet — which in hospitals is often unprotected, providing an easy entry point for hackers.

The lax standards are particularly worrying to observers and stakeholders, as records are being increasingly digitized in hospitals, and there is a pressing need for cybersecurity measures to keep up.

Of course, all these gaps were only exacerbated by the pandemic, when the resources of the health industry were already stretched thin and in high demand. Many organizations were even forced to furlough cybersecurity staff amidst shortages, demand increases, and lockdown measures.

The federal government has been doing its best to help organizations deal with and respond to ransomware attacks. On Wednesday, July 28, President Joe Biden issued a memo detailing voluntary actions critical infrastructure companies can undertake to mitigate threats. He has been constrained by the federal government’s inability to impose regulations on private companies, who own around 90% of the country’s critical infrastructure assets. Various officials have, however, been increasingly sounding the alarm over the threat that cyberattacks pose to national and economic security, as well as public health and safety.

Per some estimates, hacking attacks that have compromised patient information reported to HHS so far this year have skyrocketed by over 150%, compared to the same time-frame in 2020.

You can find a list of all the breaches reported to HHS over the last 24 months that are currently being investigated here.

Commercial Driver’s License Background Checks: An Overview After The New FMCSA-DOT Rule

By a Biometrica staffer

Two weeks ago, a Department of Transportation (DOT) Inspector General audit found that states fail too often when it comes to transmitting driver electronic conviction notifications in a timely manner to federal regulators, Transport Topics reported. What does that imply when it comes to commercial driver’s licenses (CDLs)?

According to federal regulations, states have to disqualify the CDLs of drivers who have been convicted of major offenses and serious traffic violations, as well as other offenses, as expeditiously as possible. Federal policies also require that states notify other states about convictions within 10 days. What happens when states do not transmit conviction notifications as soon as they can to federal regulators, though? It could mean individuals with records of major offenses and serious traffic violations may unintentionally — due to delays in the process — be allowed to operate vehicles for longer than they perhaps ought to be.

For instance, the DOT Inspector General audit listed an example from June 2019 wherein a commercial driver licensed in Massachusetts had his driving privileges suspended for refusing to take a chemical drug test but continued to drive thereafter. Less than six weeks after his suspension, the commercial driver was involved in a crash that killed seven motorcyclists in New Hampshire. An internal investigation conducted after the collision showed that his CDL would have been revoked before the crash if the Registry of Motor Vehicles had followed its own procedures for processing out-of-state driver notifications.

FMCSA-DOT’s new rule

In response to the audit, on July 23, the Federal Motor Carrier Safety Administration (FMCSA) and the DOT brought out a rule codifying the statutory requirement that state driver licensing agencies (SDLAs) implement a system and practices for the exclusively electronic exchange of driver history record (DHR) information through the Commercial Driver’s License Information System (CDLIS), including the posting of convictions, withdrawals, and disqualifications.

The CDLIS is the system that is used to notify the state where the driver is licensed. And the new rule, which the FMCSA and DOT says will be effective Aug. 23, is a way to address gaps in the way information on CDL disqualifications is collected. It also aligns with existing statutory requirements in the Moving Ahead for Progress in the 21st Century Act (MAP-21).

Provisions of the rule require that states ensure CDL and commercial learner’s permit (CLP) holders who are convicted of serious traffic violations are prohibited from operating a commercial motor vehicle for specific periods of time, depending on the violation. The rule, which is final, is based on the general authority of 49 U.S.C. Chapter 313, the Federal Register notice says. According to the FMCSA, states must achieve “substantial compliance with this requirement as soon as practicable, but not later than three years after the effective date of the final rule.”

What happens in a typical CDL record check?

What typically happens when an individual applies for a CDL or tries to renew one? According to the FMCSA, the state first performs a check of its databases, the CDLIS, and the National Driver Registry (NDR) to ensure that the driver is not disqualified in that state or any other jurisdiction, or that he/she does not possess a commercial license from more than one jurisdiction. If the driver possesses a license from another jurisdiction, the state must require the CDL applicant to surrender his/her driver’s license issued by that jurisdiction before issuing a new license.

The state is also required to request the complete driving record of the applicant from all jurisdictions where the driver was previously licensed in the past 10 years. The current licensing state also has to consider other aspects such as asking the driver to certify the type of operation they expect to conduct; obtain a medical certificate documenting that the driver is physically qualified to operate a commercial motor vehicle; and post the medical certification information within 10 business days to the CDLIS driver record. The state has to update said driver record to include information from the FMCSA regarding issuance or renewal of a medical variance for a driver, once again, within 10 days of receiving the information.

Then there are other, more specific rules. For instance, if a driver is applying for a hazardous materials endorsement, the state must require compliance with the standards for such an endorsement as specified in Transportation Security Administration requirements, and provide proof of citizenship or immigration status, the FMCSA says.

What happens if a state determines that the applicant has falsified information or any of the required certifications?

At a minimum, the state can disqualify the person’s CDL or his/her pending application from operating a commercial motor vehicle for a period of at least 60 consecutive days. This can be done at any point: either after a state’s check of an applicant’s license status and records before issuing a CDL, or anytime after the CDL is issued.

If the person is convicted of fraud related to this issuance, the state must record this withdrawal in his/her driving record and they may not reapply for at least one year. If a state receives credible information that a CLP/CDL holder is suspected, but not convicted of fraud related to the issuance of their license, the state must require the license holder to retake the questionable test. If the driver does not retake the test within 30 days the state is required to disqualify the driver.

For more on the FMCSA-DOT rule, click here.

For more information on CDLs per the FMCSA in general, click here.

Lots Of Proposals But Little Action So Far To Address the Opioid Epidemic

By Charlotte Spencer

There have been nearly 100 bills introduced so far this year that address the opioid epidemic. It seems everyone can agree this is an issue that needs to be addressed, but very few have managed to get any support at all behind their proposals. Only two bills with a direct focus on the epidemic have seen any kind of movement this year. And only one with a direct focus on the opioid epidemic has managed to become law.

As of late July 2021, a total of five bills that touch on the epidemic — even if only as a side note — have seen some movement past being introduced, although only two of those have managed to become law. As we mentioned earlier, for the most part these bills sit unmoving with no cosponsors, or only a handful of cosponsors.

It’s a miniscule amount of headway on an issue that so many agree needs to be addressed. At this point, it seems like introducing more bills would simply muddy the waters further. We have plenty of bills, but most of them aren’t making any progress. In this piece we give an overview of the bills that touch on the opioid epidemic, and those that have actually made progress so far this year.

S.957 – DUMP Opioids Act

This is one of only two bills introduced this year with a direct focus on the epidemic that have seen any movement. As of the writing of this article, it has passed the Senate and the House, but has not yet been signed into law. It amends the Veterans Health Care and Benefits Improvement Act of 2020 by mandating that the Secretary of Veterans Affairs designate times when individuals can dispose of controlled substances at Department facilities. It also allows for public information campaigns on this subject.

H.R.1319 – American Rescue Plan Act of 2021

This is one of only two bills introduced this year that touch on the opioid epidemic at all that have actually managed to become law. It does not focus primarily on substance abuse, but does contain one section on funding for community-based substance abuse disorder services. This includes “distributing opioid overdose reversal medication to individuals at risk of overdose, connecting individuals at risk for, or with, a substance use disorder to overdose education, counseling, and health education, and encouraging such individuals to take steps to reduce the negative personal and public health impacts of substance use or misuse.”

S.1260 – United States Innovation and Competition Act of 2021

This is the only bill introduced this year that just touches on the opioid epidemic and has managed to pass the Senate, besides the two that became law. It does not focus on the opioid crisis, but briefly touches on the issue of sanctioning China for a number of reasons, including “drug trafficking, including trafficking in fentanyl and other opioids.”

H.R.3684 – INVEST in America Act

This is the only bill introduced this year that just touches on the opioid epidemic, and has managed to pass the House, aside from the other two that became law. It does not focus on the opioid epidemic, but touches briefly on controlled-substance testing in the Motor Vehicle Carrier Act.

H.R.2630 – Extending Temporary Emergency Scheduling of Fentanyl Analogues Act

This bill is the only bill so far this year that focuses directly on the opioid crisis that has managed to become law as of late July 2021. The original temporary order placing fentanyl related substances in Schedule I of the Controlled Substances Act was set to expire May 6. This bill became law May 4, thus extending this classification until October 22. Schedule I is the most serious classification of drugs in the Controlled Substances Act. This is still a temporary fix waiting on a more permanent update.

For a full list of pending legislation and to see updates on the progress of bills see https://www.congress.gov/. If you found this overview informational, you may also be interested in our recent article on a landmark case and settlement on this subject.

The information provided in this article should not be considered legal advice or a substitute for legal advice. Biometrica is not a law firm and cannot offer legal advice.

White House Ramps Up Pressure On Critical Infrastructure Companies To Improve Resilience Against Cyberattacks

By a Biometrica staffer

In another sign of how seriously President Joe Biden is taking a recent swell in the number of cyberattacks on American entities, on Wednesday, July 28 the White House released a national security memorandum on “improving cybersecurity for critical infrastructure control systems.”

The mostly voluntary set of recommendations is designed to help secure the type of companies that provide services essential to the safety, wellbeing, and functioning of the country and its citizens, including energy, food, power, and water systems. The White House statement called the risk of cyberattacks on such systems “among the most significant and growing issues confronting our Nation.” 

Calling protecting critical infrastructure from cyberthreats a priority of his administration, President Biden said he was establishing an “Industrial Control Systems Cybersecurity Initiative” to encourage collaboration and cooperation between the government and the companies that own these assets. The hope is that enhanced information sharing will allow all stakeholders to identify, prevent, and respond in a better way to any cyberthreat or attack. 

The memo also calls for the Secretaries of Homeland Security and Commerce to develop a framework that establishes minimum performance goals for cybersecurity in critical infrastructure industries. The aim is to provide clear, coherent, and measurable guidance to those who own and operate these assets. 

The move was prompted by the fact that there are no uniform regulatory or minimum standards in the industry, despite the importance of these vital systems. However, President Biden is severely hamstrung by the limitations on the government’s authority over matters of cybersecurity.

Around 90% of so-called “critical infrastructure” is privately owned, meaning individual companies set their own standards and requirements when it comes to cybersecurity. This is why even the most recent memo’s guidelines are not mandatory. Many industries have their own standards, but those are patchy and inconsistent at best, making easy targets for malicious foreign actors or states to exploit.

The way President Biden is planning to handle this is two-fold. On one hand, the memo says that if it is found that “additional legal authorities” are necessary and would be beneficial to securing the infrastructure, then his administration would work to make that happen. 

The other way that the current administration is tackling their limited influence is by reframing the issue and narrative altogether. President Biden has routinely highlighted that these systems are imperative to national security, economic security, public health and safety. In the memo, he says that if there is evidence that any “disruption, corruption, or dysfunction” to these services would “debilitate” the country, then it is up to the federal, state, local, tribal, and territorial governments to act.

In recent weeks, President Biden has stepped up rhetoric about cybersecurity. In addition to bringing up the issue with Vladmir Putin, President of Russia, on a recent call, the commander-in-chief has spoken of the potential national security risks of such attacks on virtually a weekly basis, the New York Times says. He is the first president to do so on a consistent basis, though this has been a cause for concern since George W. Bush’s tenure.

On Tuesday, July 27, the day before he signed the new executive order, the president told national intelligence officials that “if we end up in a war, a real shooting war with a major power, it’s going to be as a consequence of a cyber breach of great consequence.” By framing it as a national security issue and a genuine threat to American people, the president is hoping to drive home just how important it is to protect crucial systems.

Separately, also on Wednesday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the United Kingdom’s National Cyber Security Centre (NCSC), and the Australian Cyber Security Centre (ACSC) released a joint cybersecurity advisory on the top 30 vulnerabilities they found that were most commonly exploited by cybercriminals in 2020 and those that are most being used so far in 2021.

The advisory recommends that both private and public entities across the world apply the available patches for the highlighted vulnerabilities as soon as possible. It also directs interested parties to available resources that could help affected parties.

How One Man With Mafia Ties Swindled $24M From McDonald’s Monopoly Game

By Aara Ramesh

Next month marks 20 years since the Federal Bureau of Investigations (FBI) conducted a series of raids and arrested eight individuals for a racketeering plot in which they defrauded McDonald’s Corp of $24 million dollars over a 12-year period. 

On the face of it, this summary may seem bland and unexciting, but the truth is that even Hollywood couldn’t spin a story quite like this. This tale has it all: wire fraud, mail fraud, money laundering, the New York mafia, convicted drug dealers, unscrupulous characters aplenty, roadside meetings to exchange cash, a gold suit, sting operations, clandestine airport bathroom operations, and more.

No one could blame you if you missed the story of Operation Final Answer (as the FBI nicknamed it), as the long-anticipated trial for it began the day before 9/11. The case came back into prominence in 2018, when the Daily Beast published a tell-all expose of the case, and in 2020, when HBO released a six-part documentary, “McMillion$,” chronicling the case.

In today’s piece we take you through the myriad twists and turns of this conspiracy, which, at times, truly beggar belief.

The Plot

The overall skeleton of the scam, which began as early as 1995, is at once both intricate and painfully simple, and is predicated on a series of extremely fortunate coincidences — if just one tiny detail had been different, the whole thing would never have happened at all.

At the center of it is a man called Jerome P. Jacobson, also known as “Uncle Jerry” (an affectionate moniker bestowed on him by a mob associate who we will get to later). At the time, Jacobson worked as the Director of Security at Simon Marketing, a firm that was contracted by McDonald’s to run a promotional scheme in the 1980s and 1990s that featured the board game Monopoly.

The twice-a-year game involved customers buying McDonald’s products and peeling back a sticker on the packaging to reveal what prize they had won. The rewards ranged from a free menu item to a $1 million jackpot. The odds of winning the jackpot were one in 250 million, and the odds of even just three connected people winning the same $1 million prize were “virtually impossible.”

As part of his job, Jacobson oversaw the printing of unique game pieces and was responsible for ensuring their safety and for hand-delivering them to the various McDonald’s packaging plants across the country. By chance, a supplier accidentally sent him a package of the holographic, tamper-proof stickers that were used to seal the envelopes that carried the game pieces. If the envelopes were ever opened after the pieces had been deposited inside, the seal would ideally reflect that. This delivery proved to be the true jackpot for Jacobson.

He concocted a plan in which he would break the seal, swap out the high-value tickets for lower prizes, and then just replace the seal. Where did he do this? In various airport bathrooms. Jacobson was accompanied on all trips by an independent auditor, who was supposed to double-check that the seal was in place. But Jacobson was able to make the swap by slipping her and doing the deed in the men’s bathroom, where she obviously couldn’t follow him.

Once he had the jackpot tickets, Jacobson would sell them to his family and friends for a premium, as he was not able to redeem them himself. As time went on, he recruited middlemen to do the sales for him, to make more money himself and to diversify the winners’ pool and make it less obvious that all of them were linked by a common person or geography. At his trial, Jacobson admitted to stealing up to 60 of the lucrative game pieces.

One time, Jacobson even anonymously “donated” a $1 million game piece to St. Jude Children’s Research Hospital in Tennessee, allegedly to offset the gravity of his crime in the eventuality he was ever caught. The extremely generous good-will gesture from a stranger even made national headlines.

So who were his co-conspirators?

The Cast

Each character in this plot is more colorful and vibrant than the last. 

Jacobson himself was briefly a police officer in Hollywood, Florida, before he went into private security. His then-wife was a security auditor and managed to get him a job with Dittler Brothers, a printer business known for serving high-profile clients with a need for extreme confidentiality. One of those clients was Simon Marketing, who devised and ran the Monopoly game for McDonald’s.

The first associate Jacobson recruited was Gennaro Colombo (also known as Jerry), who claimed to be a member of New York’s Colombo crime family. His father, Joseph Colombo, was apparently the head of that family. An attempted assassination on Joseph in 1971 was at the center of the Robert De Niro movie “The Irishman.” Jerry Colombo’s wife, Ruby, was also implicated in the scam, and roped some of her friends into it. 

Colombo died in a car crash in 1998, after which Andrew Glomb was brought on board. He was an ex-convict who had been imprisoned for trafficking cocaine on an airplane. Dwight Baker, a Mormon real-estate developer, was also drawn in after he grievously injured his spine in a tractor accident. He and his wife were hoping to make some money by selling the stolen pieces to pay off back taxes they owed.

These men would coach the winners through the process of lying to McDonald’s and claiming the money, even going so far as to falsify addresses in their name to legitimize wins and spread the victor pool out evenly.

In addition to these, a wide array of people benefitted from the scheme. One man who Glomb sold a ticket to was convicted in 1999 for dealing 400 lbs of cocaine. Another person used his winnings to buy a boat, which he then named… “Ruthless Scoundrel.” (You can’t make this stuff up.) Jacobson’s stepbrother, nephew, and butcher all benefited as well, the latter two trading $45,000 for game pieces worth $200,000. In a side-of-the-highway deal, Colombo sold Gloria Brown a $1 million ticket for $40,000 in cash, which she mortgaged her house to obtain.

In the end, over 50 people were convicted in the scheme, with the following ones arrested in August 2001 by the FBI:

  • Linda L. Baker, 49;
  • Noah D. “Dwight” Baker, 49;
  • John F. Davis, 44;
  • Andrew M. Glomb, 58;
  • Michael L. Hoover, 56;
  • Ronald E. Hughey, 56;
  • Jerome P. Jacobson, 58; and
  • Brenda S. Phenis, 50.

The Climax

The truth is that had it not been for one aggrieved party (the identity of whom is not definitively known), this case might never have even popped up on the FBI’s radar. In March 2000, someone left an anonymous tip directing authorities to an “Uncle Jerry” and highlighting that there had been a suspicious amount of winners in the Jacksonville, Florida area.

The local branch of the FBI picked up the case, led by Special Agent Richard Dent and his rookie partner Doug Matthews. They settled on the codename “Operation Final Answer” as a nod to the game show “Who Wants to Be a Millionaire,” which was co-sponsoring that year’s McDonald’s Monopoly contest. One actual suggestion initially floated was “Operation Hamburglar.”

To gain traction in the investigation, the team had to inform some executives of McDonald’s about what they had discovered. They also hoped to gauge whether anyone on the inside of the fast food company was involved in the scheme. Eventually, they roped in Amy Murray, then with the company’s marketing team, to work alongside them. At one point, the team encompassed 25 agents nationwide.

In a bid to get results and expedite the process, the FBI tapped suspects’ phones and deployed undercover agents as a production crew in a string operation to get on tape the suspects’ stories. In the end, Dent convinced McDonald’s to run the Monopoly game one more time, despite the fact that doing so would open the company up to future litigation, as they knowingly ran a compromised contest.

Finally, in August 2001, the Department of Justice (DOJ) and FBI had all the evidence they needed to successfully prosecute. In a cross-state, coordinated series of raids, the eight individuals named above were arrested. They were accused of conspiring to defraud McDonald’s and its customers.

Jacobson was also charged with conspiracy to commit mail fraud, a technicality that allowed him to be prosecuted, as it was not explicitly against the law or the game rules to sell a ticket onto someone else. The fact that he used the U.S. postal service to do it, however, is what got him in real legal trouble.

Denouement

Jacobson, as the ringleader and mastermind, ultimately served just over three years in prison. He was ordered to pay $12.5 million in restitution, which the HBO documentary says he is still doing today. In his seventies now, he reportedly still lives in Georgia with his new wife. He has not appeared to have acquiesced to any interview requests since his arrest and conviction.

The remaining conspirators received varying sanctions and sentences for their involvement, though Glomb declares in the documentary that he would do it all again “tomorrow” if given the chance.

McDonald’s was noted to have cooperated with the authorities and was not implicated in the conspiracy, given that an external vendor had employed Jacobson. It tried, over the next few years, to gain back favor with customers by conducting instant million-dollar giveaways, to a mostly lukewarm response.

McDonald’s and Simon Marketing sued each other later in 2001 for breach of contract. That ended with the former agreeing to a $16.6 million settlement in favor of the latter. McMillion$ says that in the aftermath, tainted by the whole sordid business, both Dittler Brothers and Simon Marketing folded, resulting in job losses for many.

Roll Credits

The last time McDonald’s ran the Monopoly competition in the U.S. was in 2016. It still has similar marketing schemes in other countries, though it says it has created an “independent promotions task force” to monitor the administration of the games and ensure that a similar scam is not repeated.

Many argued that this was a victimless crime, really. McDonald’s would have paid out the money anyway, they say. And yes, some of the co-conspirators were intimidated or bullied, and there was an element of organized crime to the whole thing, but at the end of the day, critics point out, the “winners” chose to participate in a scheme that seemed fishy at best. Despite all the bend-over-backwards lies and reassurances of legality that the middlemen made, the “victors” should have known better, according to some.

It seems completely implausible, really, that but for one anonymous tip on a post-it noticed by a newbie FBI agent seeking excitement and adventure, Uncle Jerry could have gotten away with “stealing” $24 million.

The only victims in this case might be those poor customers who thought they had a fair shot at winning a million dollars. If it hadn’t been for that mistaken delivery of holographic stickers…