Link Search Menu Expand Document
Cybersecurity Research
  1. I. INTRODUCTION

I. INTRODUCTION

A rule of thumb is to strike while the iron is hot; for cybercriminals, that iron is a global pandemic.1 The novel coronavirus dubbed “COVID-19” is an infectious disease that was first identified in Wuhan, China in December 2019.2 In March 2020, the World Health Organization (“WHO”) officially declared the COVID-19 disease a pandemic following rapid global transmission.3 This pandemic brought the world to a screeching halt as governments frantically tried to “flatten the curve.”4 Indeed, COVID-19’s effects permeated nearly every layer

1. See Ellen Sheng, Cybercrime Ramps Up Amid Coronavirus Chaos, Costing Companies Billions, CNBC, https://www.cnbc.com/2020/07/29/cybercrime-ramps-up-amidcoronavirus-chaos-costing-companies-billions.html [https://perma.cc/DRJ7-KKL5] (last updated July 29, 2020, 12:00 PM) (discussing the increase in the frequency and intensity of data breaches during the COVID-19 pandemic).

2. See Frequently Asked Questions, CTR. FOR DISEASE CONTROL, https://www.cdc.gov/coronavirus/2019-ncov/faq.html [https://perma.cc/Y7U2-94FC] (last updated Jan. 19, 2021) (stating that COVID-19 is a novel disease that was first discovered in Wuhan, China); see also Coronavirus, WORLD HEALTH ORG., https://www.who.int/healthtopics/coronavirus#tab=tab_1 [https://perma.cc/9BBQ-N25P] (last visited Feb. 6, 2021) (discussing how COVID-19 quickly spreads among people through saliva or discharge from the nose).

3. See, e.g., Mert Topcu & Omer Serkan Gulal, The Impact of Covid-19 on Emerging Stock Markets, 36 FIN.RES. LETTERS at 1, 1 (July 10, 2020) (stating that the pandemic was officially declared as such on March 11, 2020, having spread to 216 countries).

4. See Maria Nicola et al., The Socio-Economic Implications of the Coronavirus Pandemic (COVID-19): A Review, *78 INT’L J. SURGERY 185, 185 (2020) (“Social distancing, selfisolation and travel restrictions have lead to a reduced workforce across all economic sectors and caused many jobs to be lost. Schools have closed down, and the need for commodities and manufactured products has decreased. . . . The food sector is also facing increased demand due to panic-buying and stockpiling of food products.”); Kim Parker et al., *Economic Fallout From COVID-19 Continues To Hit Lower-Income Americans the Hardest, PEW RES. CTR. (Sept. 24, 2020), https://www.pewsocialtrends.org/2020/09/24/economic-fallout-from-covid19-continues-to-hit-lower-income-americans-the-hardest/ [https://perma.cc/Y582-6VAD] (stating that the pandemic has caused many Americans to experience financial hardship); Brandon Specktor, Coronavirus: What Is ‘Flattening the Curve,’ and Will It Work? LIVE SCI. (Mar. 16, 2020), https://www.livescience.com/coronavirus-flatten-the-curve.html [https://perma.cc/NUE7-Z493] (explaining that in epidemiology, “flattening the curve” refers

of American society,5 while the banking and finance sectors suffered an especially significant blow.6 The pandemic delivered a plethora of shocks, including to economic supply and demand, as well as to digital markets.7 This downturn has surpassed the turmoil of both the Great Depression and the 2008 financial crisis.8 Global stock markets became alarmingly volatile.9 The Dow Jones Industrial Average and the NASDAQ dramatically declined.10 The bond market nearly broke down,11 and consumer spending fell drastically.12 Although the most

to slowing the spread of a virus so that there are enough hospital beds, doctors, and resources to treat infected patients).

5. See Nicola et al., supra note 4, at 185–90 (analyzing COVID-19’s impact on different sectors of the economy, including, but not limited to: agriculture, oil, manufacturing, education, and finance).

6. See id. at 187 (“The decline in global stock markets has festered a volatile environment with critical liquidity levels.”).

7. See Adam Triggs & Homi Kharas, The Triple Economic Shock of COVID-19 and Priorities for an Emergency G-20 Leaders Meeting, BROOKINGS INST. (Mar. 17, 2020), https://www.brookings.edu/blog/future-development/2020/03/17/the-triple-economic-shockof-covid-19-and-priorities-for-an-emergency-g-20-leaders-meeting/ [https://perma.cc/DEN7-6Z83] (discussing how an emergency G-20 leaders’ meeting was been called to address the financial shocks resulting from COVID-19); see also Sergej Epp, The Great Digital Shock: Adapting to a New Normal in Cybersecurity, PALOALTONETWORKS (Aug. 20, 2020), https://www.securityroundtable.org/the-great-digital-shock-adapting-to-anew-normal-in-cybersecurity/ [https://perma.cc/ZE8J-AKJL] (analyzing how digitalization has helped cushion the economic fallout of COVID-19, and how the pandemic will accelerate the need for cybersecurity among businesses).

8. See Gita Gopinath, The Great Lockdown: Worst Economic Downturn Since the Great Depression, IMF: IMFBLOG (Apr. 14, 2020), https://blogs.imf.org/2020/04/14/the-greatlockdown-worst-economic-downturn-since-the-great-depression/ [https://perma.cc/RV5H8CFY] (“[T]he Great Lockdown [is] the worst recession since the Great Depression, and far worse than the Global Financial Crisis.”).

9. See Nicola et al., supra note 4, at 187 (analyzing the decline in global stock markets, and how these markets have fallen to critical liquidity levels).

10. See id. (“In addition to the disruption in the supply chain, the capital market sector has also been affected. In the US, the S&P 500, a stock market index that measures the stock performance of 500 large companies on the US stock exchange, the Dow Jones Industrial Average and the Nasdaq fell dramatically until the US government secured the Coronavirus Aid, Relief, and Economic Security (CARES) Act[.]”).

11. See Jacob Manoukian, COVID-19 Almost Broke the Bond Market. Then the Fed Stepped In. JPMORGAN (Mar. 30, 2020), https://www.jpmorgan.com/securities/insights/covid-19-almost-broke-the-bond-marketthen-the-fed-stepped-in [https://perma.cc/4PX6-ZVUE] (discussing how the Federal Reserve stepped in with unprecedented policy responses to resuscitate the bond market).

12. See Richard D. Harroch et al., The Impact of the Coronavirus Crisis on Mergers and Acquisitions, FORBES (Apr. 17, 2020, 6:00 AM), https://www.forbes.com/sites/allbusiness/2020/04/17/impact-of-coronavirus-crisis-onmergers-and-acquisitions/#5403eba0200a [https://perma.cc/ZRD6-5FBB] (stating that COVID-19 has affected scores of businesses, workers, and consumers).

pressing concerns of the COVID-19 pandemic have been the sharp increase in cases, loss of lives, and economic shutdowns, the spike in data breaches and its insidious impact cannot be overlooked.13

COVID-19 and its subsequent expansion of work-from-home policies will have lasting implications on the data security of financial institutions.14 The pandemic forced banks to adapt to a “new normal,”15 which has entailed a shift away from the physical banking model.16 This new normal has made digitalization the future of finance and banking in a post-pandemic world.17 For example, financial institutions saw a decline in the use of cash and a surge in the popularity of contactless payments during the pandemic.18 The American economy has undergone

13. See Sheng, supra note 1 (examining how cybercriminals have capitalized on the uncertainty caused by the pandemic to scam people and businesses).

14. See Richard Yao, The Long-Lasting Impact of COVID-19 on Digital Payments, MEDIUM (Aug. 20, 2020), https://medium.com/ipg-media-lab/the-long-lasting-impact-ofcovid-19-on-digital-payments-40aa2bf4cb19 [https://perma.cc/H7AL-UKJQ] (predicting that the pandemic is the turning point for digital payment adoption); see also Amit Gautam, How Will Long-Term Work-From-Home Impact Innovation, Collaboration and Mental Health? FORBES (Dec. 14, 2020, 9:20 AM), https://www.forbes.com/sites/forbestechcouncil/2020/12/14/how-will-long-term-work-fromhome-impact-innovation-collaboration-and-mental-health/?sh=3c3caca32c33 [https://perma.cc/GQ4T-WJCF] (evaluating the pros and cons of a permanent remote workforce).

15. See Lisa Rowan, How the Banking Experience Is Adapting to the COVID-19 ‘New Normal,’ FORBES (Sept. 3, 2020, 2:16 PM), https://www.forbes.com/sites/advisor/2020/09/03/how-the-banking-experience-is-adaptingto-the-covid-19-new-normal/#6099dee2efd0 [https://perma.cc/4E9V-FG7T] (scrutinizing the operational adjustments banks may have to make in a post-pandemic world).

16. See Allissa Kline, Digital Banking: Once-Steady Shift Now Moving at Lightning Speed, AM. BANKER (June 23, 2020, 9:30 PM), https://www.americanbanker.com/news/digitalbanking-once-steady-shift-now-moving-at-lightning-speed [https://perma.cc/TQ9T-PJ2Y] (“What we’re seeing is the greatest acceleration of digital banking in history[.]”) (emphasis added) (referring to the increase in digital banking during the pandemic); see also Scott Baret et al., COVID-19 Potential Implications for the Banking and Capital Markets Sector, DELOITTE (Mar. 16, 2020), https://www2.deloitte.com/us/en/insights/economy/covid19/banking-and-capital-markets-impact-covid-19.html [https://perma.cc/YN95-WZ79] (examining how banks may need to rely more on digital banking to bolster operational resilience throughout the pandemic).

17. See Jim Marous, COVID-19 Accelerates Urgency for Digital Banking Transformation, THE FIN. BRAND (June 18, 2020), https://thefinancialbrand.com/97453/covid-19-coronavirusdigital-innovation-transformation-trend-capgemini-amazon/ [https://perma.cc/UR4H-UB75] (analyzing how the increased rate of digitalization requires financial institutions to reevaluate their existing business models).

18 See Olivia Petter, Coronavirus: Avoid Banknotes and Switch to Contactless Payments to Avoid Transmission, Suggests WHO, THE INDEP. (Mar. 4, 2020, 12:18), https://www.independent.co.uk/life-style/health-and-families/coronavirus-news-banknotesworld-health-organisation-contactless-payment-a9374441.html [https://perma.cc/C8DZ-8SXF] (discussing advice from the World Health Organization on using contactless payments to prevent the further spread of COVID-19); see also Stephanie Walden,* Banking After Covid19: The Rise of Contactless Payments in the U.S.,* FORBES (June 12, 2020, 8:02 AM), https://www.forbes.com/advisor/banking/banking-after-covid-19-the-rise-of-contactlesspayments-in-the-u-s/ [https://perma.cc/J56A-N66P] (“Overall usage of contactless payments in the country has risen 150% since March 2019.”).

an unplanned social experiment, courtesy of the work-from-home model.19 Cybercriminals have capitalized on the economic turmoil and uncertainty.20 As more institutions embrace digitalization in order to survive in the increasingly digital world, the consumer data they possess becomes more vulnerable to cyberattacks.21 Therefore, it is time for financial institutions to perfect their data security measures, while urging lawmakers to reform legislation in light of these updates.22 Improving data privacy legislation will increase consumer trust in financial institutions, safeguard consumers from additional data injury, and reduce the financial impact companies incur after a breach23

19. See Cyber Crime – The Risks of Working from Home, DELOITTE, https://www2.deloitte.com/ch/en/pages/risk/articles/covid-19-cyber-crime-working-fromhome.html [https://perma.cc/5MU2-83D8] (last visited Feb. 6, 2021) (discussing how COVID-19 has changed criminal activity, with cybercriminals increasingly targeting people using technology at home instead of at the office).

20. See id. (“Cyber criminals are switching tactics and exploiting COVID-19-related fears among the population. As a result, working from home is becoming a gateway to new forms of data theft.”).

21. See RISK BASED SEC., INC., 2020 Q1 Data Breach Report QuickView (2020), https://pages.riskbasedsecurity.com/hubfs/Reports/2020/2020%20Q1%20Data%20Breach% 20QuickView%20Report.pdf?hsCtaTracking=5d936f78-de69-45a4-9ba5- 03c2e9f20952%7C617588df-ee05-4a00-bbb1-191d6888f519 [https://perma.cc/YRK3- FJY5] (“[I]ncreased digitalization mak[es] data more vulnerable than ever.”).

22. See Nuala O’Connor, Reforming the U.S. Approach to Data Protection and Privacy, COUNCIL ON FOREIGN RELS. (Jan. 30, 2018), https://www.cfr.org/report/reforming-usapproach-data-protection [https://perma.cc/38S3-U5HB] (“The U.S. Congress should join other advanced economies in their approach to data protection by creating a single comprehensive data-protection framework. Meaningful federal laws and regulations should seek to resolve the differences among the existing federal and state legal rights and responsibilities. This would not only simplify compliance for U.S. companies, but would also strengthen and bring the United States in line with emerging data-protection norms.”).

23 See, e.g., Data Breach Cost Part One: Risks, Costs and Mitigation Strategies for Data Breaches, ZURICH 2–6, http://cdn.theatlantic.com/static/front/docs/sponsored/zurichrisk/DataBreachCost_Zurich.pdf [https://perma.cc/V6AV-F4EA] (last visited Dec. 29, 2020) (breaking down the costs a company may incur after a data breach); Einat Weiss, Data Privacy Rules Are Changing. How Can Marketers Keep Up? HARVARD BUS. REV. (Aug. 27, 2020), https://hbr.org/2020/08/data-privacy-rules-are-changing-how-can-marketers-keep-up [https://perma.cc/TV2Q-77NN] (“[The European Union’s General Data Protection Regulation and the California Consumer Privacy Act] give consumers more awareness and control over exactly what personal information is collected, how it is sold, and how its security is ensured.”); O’Connor, supra note 22 (recommending that the United States enact a comprehensive data protection law in order to better protect the data of U.S. citizens).

This Note proceeds in seven parts. Part II explores the background on data security and the data security risks faced by financial institutions before the pandemic.24 Part III examines current data protection laws pertaining to consumer financial data.25 Part IV assesses the present impact of COVID-19 on the financial services industry, including the expansion of telework and the proliferation of mobile banking.26 Part V considers the future impact of COVID-19, including new threats to consumer data arising from the shift to a remote workforce.27 Part VI recommends potential actions financial institutions can take to mitigate the risk of consumer data injury in the increasingly digital financial world.28 Part VII summarizes the argument and concludes this Note.29

Table of Contents

Table of contents