Panaji: In a disturbing cybercrime case, the Goa Cyber Crime Police arrested a Bengaluru resident, Mohan Raj V, for allegedly cyberbullyi...
Right to Sue: Under the law, Vermont residents can directly sue companies that collect or share their sensitive data without their consent. This provision is a departure from the usual regulatory approach, which relies on government agencies to enforce privacy rules.
Sensitive Data Definition: The law defines sensitive data broadly, encompassing not only personally identifiable information (PII) but also health-related data, biometric information, and geolocation data.
Transparency Requirements: Companies must be transparent about their data practices. They are required to disclose what data they collect, how it is used, and whether it is shared with third parties.
Opt-In Consent: Companies must obtain explicit consent from users before collecting or sharing their sensitive data. This opt-in approach puts control back in the hands of consumers.
The Vermont scenario is a rare but dramatic exception to a growing national trend: with little action from Congress, the responsibility of regulating technology has shifted to the states. This sets state lawmakers, who frequently have limited staff and part-time occupations, against big national lobbies with corporate and political influence.
It's unclear whether Vermont's new strategy will work: Republican Gov. Phil Scott has yet to sign the bill, and lawmakers and industry are still arguing about it.
However, national consumer advocacy groups are already turning to Vermont as a possible model for lawmakers hoping to impose severe state tech restrictions throughout the country – a struggle that states have mostly lost up to this point.
Vermont’s data privacy law has galvanized state lawmakers across the country. Here’s why:
Grassroots Playbook: Lawmakers collaborated with counterparts from other states to create a “grassroots playbook.” This playbook outlines strategies for passing similar legislation elsewhere. By sharing insights and tactics, they hope to create a united front against tech industry lobbying.
Pushback Against Industry Pressure: Tech lobbyists have historically opposed stringent privacy regulations. Vermont’s law represents a bold move, and lawmakers anticipate pushback from industry giants. However, the alliance aims to stand firm and protect consumers’ rights.
Potential Model for Other States: If Vermont successfully implements its data privacy law, other states may follow suit. The alliance hopes to create a domino effect, encouraging more states to prioritize consumer privacy.
The fight for privacy legislation has been fought in states since 2018 when California became the first to implement a comprehensive data privacy law.
In March 2024, Vermont's House of Representatives began debating a state privacy law that would allow residents the right to sue firms for privacy infractions and limit the amount of data that businesses may collect on their customers. Local businesses and national groups warned that the plan would destroy the industry, but the House passed it overwhelmingly.
The bill was then sent to the state Senate, where it was met with further support from local businesses.
The CFO of Vermont outdoor outfitter Orvis wrote to state legislators saying limiting data collecting would "put Vermont businesses at a significant if not crippling disadvantage."
A spokesman for Orvis stated that the corporation did not collaborate with tech sector groups opposing Vermont's privacy measure.
On April 12, the Vermont Chamber of Commerce informed its members that it had met with state senators and that they had "improved the bill to ensure strong consumer protections that do not put an undue burden on Vermont businesses."
Priestley expressed concern about the pressure in an interview. It reminded her of L.L. Bean's significant resistance to Maine's privacy legislation. She discovered similar industry attacks against state privacy rules in Maryland, Montana, Oklahoma, and Kentucky. She invited politicians from all five states to discuss their experiences to demonstrate this trend to her colleagues.
Predictably, tech companies and industry associations have expressed concerns. They argue that a patchwork of state laws could hinder innovation and create compliance challenges. Some argue for a federal approach to data privacy, emphasizing consistency across all states.
The foundation of this innovative work is a database known as the Multimodal Sarcasm Detection Dataset (MUStARD). This dataset, annotated by a separate research team from the U.S. and Singapore, includes labels indicating the presence of sarcasm in various pieces of content. By leveraging this annotated dataset, the Dutch research team aimed to construct a robust sarcasm detection model.
After extensive training using the MUStARD dataset, the researchers achieved an impressive accuracy rate. The AI model could detect sarcasm in previously unlabeled exchanges nearly 75% of the time. Further developments in the lab, including the use of synthetic data, have reportedly improved this accuracy even more, although these findings are yet to be published.
One of the key figures in this project, Matt Coler from the University of Groningen's speech technology lab, expressed excitement about the team's progress. "We are able to recognize sarcasm in a reliable way, and we're eager to grow that," Coler told The Guardian. "We want to see how far we can push it." Shekhar Nayak, another member of the research team, highlighted the practical applications of their findings.
By detecting sarcasm, AI assistants could better interact with human users, identifying negativity or hostility in speech. This capability could significantly enhance the user experience by allowing AI to respond more appropriately to human emotions and tones. Gao emphasized that integrating visual cues into the AI tool's training data could further enhance its effectiveness. By incorporating facial expressions such as raised eyebrows or smirks, the AI could become even more adept at recognizing sarcasm.
The scenes from sitcoms used to train the AI model included notable examples, such as a scene from "The Big Bang Theory" where Sheldon observes Leonard's failed attempt to escape a locked room, and a "Friends" scene where Chandler, Joey, Ross, and Rachel unenthusiastically assemble furniture. These diverse scenarios provided a rich source of sarcastic interactions for the AI to learn from. The research team's work builds on similar efforts by other organizations.
For instance, the U.S. Department of Defense's Defense Advanced Research Projects Agency (DARPA) has also explored AI sarcasm detection. Using DARPA's SocialSim program, researchers from the University of Central Florida developed an AI model that could classify sarcasm in social media posts and text messages. This model achieved near-perfect sarcasm detection on a major Twitter benchmark dataset. DARPA's work underscores the broader significance of accurately detecting sarcasm.
"Knowing when sarcasm is being used is valuable for teaching models what human communication looks like and subsequently simulating the future course of online content," DARPA noted in a 2021 report. The advancements made by the University of Groningen team mark a significant step forward in AI's ability to understand and interpret human communication.
As AI continues to evolve, the integration of sarcasm detection could play a crucial role in developing more nuanced and responsive AI systems. This progress not only enhances human-AI interaction but also opens new avenues for AI applications in various fields, from customer service to mental health support.
In an unexpected move that has disrupted the cybersecurity equilibrium, IBM has announced its exit from the cybersecurity software market by selling its QRadar SaaS portfolio to Palo Alto Networks. This development has left many Chief Information Security Officers (CISOs) rethinking their procurement strategies and vendor relationships as they work to rebuild their Security Operations Centers (SOCs).
IBM's QRadar Suite: A Brief Overview
The QRadar Suite, rolled out by IBM in 2023, included a comprehensive set of cloud-native security tools such as endpoint detection and response (EDR), extended detection and response (XDR), managed detection and response (MDR), and key components for log management, including security information and event management (SIEM) and security orchestration, automation, and response (SOAR) platforms. The suite was recently expanded to include on-premises versions based on Red Hat OpenShift, with plans for integrating AI capabilities through IBM's Watsonx AI platform.
The agreement, expected to close by the end of September, also designates IBM Consulting as a "preferred managed security services provider (MSSP)" for Palo Alto Networks customers. This partnership will see the two companies sharing a joint SOC, potentially benefiting customers looking for integrated security solutions.
Palo Alto Networks has assured that feature updates and critical fixes will continue for on-premises QRadar installations. However, the long-term support for these on-premises solutions remains uncertain.
Customer Impact and Reactions
The sudden divestiture has taken the cybersecurity community by surprise, particularly given IBM's significant investment in transforming QRadar into a cloud-native platform. Eric Parizo, managing principal analyst at Omdia, noted the unexpected nature of this move, highlighting the substantial resources IBM had dedicated to QRadar's development.
Customers now face a critical decision: migrate to Palo Alto's Cortex XSIAM platform or explore other alternatives. Omdia's research indicates that IBM's QRadar was the third-largest next-generation SIEM provider, trailing only Microsoft and Splunk (now part of Cisco). The sudden shift has left many customers seeking clarity and solutions.
Market Dynamics
This acquisition comes at a pivotal time in the cybersecurity industry, with SIEM, SOAR, and XDR technologies increasingly converging into unified SOC platforms. Major players like AWS, Microsoft, Google, CrowdStrike, Cisco, and Palo Alto Networks are leading this trend. Just before IBM's announcement, Exabeam and LogRhythm revealed their merger plans, aiming to combine their SIEM and user and entity behaviour analytics (UEBA) capabilities.
Forrester principal analyst Allie Mellen pointed out that IBM's QRadar lacked a fully-fledged XDR offering, focusing more on EDR. This gap might have influenced IBM's decision to divest QRadar.
For Palo Alto Networks, acquiring QRadar represents a significant boost. The company plans to integrate QRadar's capabilities with its Cortex XSIAM platform, known for its automation and MDR features. While Palo Alto Networks has made rapid advancements with Cortex XSIAM, analysts like Parizo believe it still lacks the maturity and robustness of IBM's QRadar.
Palo Alto Networks intends to offer free migration paths to its Cortex XSIAM for existing QRadar SaaS customers, with IBM providing over 1,000 security consultants to assist with the transition. This free migration option will also extend to "qualified" on-premises QRadar customers.
The long-term prospects for QRadar SaaS under Palo Alto Networks remain unclear. Analysts suggest that the acquisition aims to capture QRadar's customer base rather than sustain the product. As contractual obligations expire, customers will likely need to transition to Cortex XSIAM or consider alternative vendors.
A notable aspect of the agreement is the incorporation of IBM's Watsonx AI into Cortex XSIAM, which will enhance its Precision AI tools. Gartner's Avivah Litan highlighted IBM's strong AI capabilities, suggesting that this partnership could benefit both companies.
In conclusion, IBM's exit from the cybersecurity software market marks a paradigm shift, prompting customers to reevaluate their security strategies. As Palo Alto Networks integrates QRadar into its offerings, the industry will closely watch how this transition unfolds and its impact.
The Securities and Exchange Commission (SEC) is demanding financial institutions to report security vulnerabilities within 30 days of discovering them.
On Wednesday, the SEC adopted revisions to Regulation S-P, which controls how consumers' personal information is handled. The revisions require institutions to tell individuals whose personal information has been compromised "as soon as practicable, but no later than 30 days" after discovering of illegal network access or use of consumer data. The new criteria will apply to broker-dealers (including financing portals), investment businesses, licensed investment advisers, and transfer agents.
"Over the last 24 years, the nature, scale, and impact of data breaches has transformed substantially. These amendments to Regulation S-P will make critical updates to a rule first adopted in 2000 and help protect the privacy of customers’ financial data. The basic idea for covered firms is if you’ve got a breach, then you’ve got to notify. That’s good for the investor,” said SEC Chair Gary Gensler.
Notifications must describe the occurrence, what information was compromised, and how impacted individuals can protect themselves. In what appears to be a loophole in the regulations, covered institutions are not required to provide alerts if they can demonstrate that the personal information was not used in a way that caused "substantial harm or inconvenience" or is unlikely to do so.
The revisions compel covered institutions to "develop, implement, and maintain written policies and procedures" that are "reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information." The amendments include:
The standards also increase the extent of nonpublic personal information protected beyond what the firm gathers. The new restrictions will also apply to personal information received from another financial institution.
SEC Commissioner Hester M. Peirce expressed concern that the new regulations could go too far.
"Today’s Regulation S-P modernization will help covered institutions appropriately prioritize safeguarding customer information," she said. "Customers will be notified promptly when their information has been compromised so they can take steps to protect themselves, like changing passwords or keeping a closer eye on credit scores. My reservations stem from the rule's breadth and the likelihood that it will spawn more consumer notices than are helpful."
Regulation S-P has not been substantially modified since its adoption in 2000.
Last year, the SEC enacted new laws requiring publicly traded businesses to disclose security breaches that have materially affected or are reasonably projected to damage business, strategy, or financial results or conditions.