Virtual Armor, a company founded to assist businesses with addressing cybersecurity concerns, found itself the victim of a significant data breach. Fearing for the loss of trust by its customers, Virtual Armor’s top management chose to hide the evidence of the data breach. Approximately one year after the breach, the FTC informed Virtual Armor that the company and its top management were under investigation concerning the data breach. The results of the FTC investigation included both civil and criminal allegations against Virtual Armor and its top management. Which federal agency or agencies are able handle these civil and criminal allegations in court?

Proactive Protection, a prominent threat analysis group, notified affiliated companies that it had identified an approach used for nation-state attacks. The hackers set up a cybersecurity blog in an attempt to build credibility with potential targets. In the blog, the hackers focused on vulnerabilities that were actually already public.  The hackers then created a series of social media accounts linked to the blog. The hackers, posing as the authors of the blog, reached out to security researchers, asking them to collaborate on their work. When the security researchers responded, the hackers sent these researchers Visual Studio Projects software containing malware, which infect the researchers’ computers. This type of threat to online privacy is known as:

Smarter Owl, a start-up company that uses artificial intelligence to help businesses to gain a competitive edge, hopes to expand its market into Europe. Smarter Owl’s attorney worries that the company will have difficulties complying with certain provisions of the GDPR. The problematic provisions include:

Gracious Gadfly, an industry watchdog, is considering filing a complaint against Bobcat Bank, with the bank’s federal regulatory agency, for failing to store personal financial information in a secure manner. Under which of the following regulations might the regulatory agency be able to pursue legal action for this issue? 

With the growth of cloud storage of records, including by web email and social network providers, evidence for a criminal case is more frequently held in a different country, a phenomenon that has been called “the globalization of criminal evidence.” Two recent mechanisms address the concerns of law enforcement accessing this electronic evidence.

Akira Wang is the Vice Provost of Research and Grants at Modern University in Austin, Texas. In January 2024, Akira travels to a conference in Washington, DC. During her travels, Akira uses a wi-fi connection at Comic Coffee Café, a local coffee shop. As a Comic Coffee Café customer, Akira is able to obtain the password to access Comic Coffee Café’s wi-fi.  Due to a technical issue with her laptop, Akira is unable to utilize Modern University’s virtual private network (VPN). While checking her university email on her laptop, Akira learns of a credit card payment that she needs to make during her trip. Fearing that this credit card payment will be late if she does not act, Akira makes the credit card payment online while using her laptop at Comic Coffee Café. Which of the following is a concern raised by Akira’s online activity?

You are reviewing the privacy policy of Calmer Waters, a medical equipment sales company. Calmer Waters wants to ensure they are not handling any PHI in their business arrangements with hospitals to avoid being classified as a covered business associate under HIPAA. You find an issue when reviewing Calmer Waters’s error-reporting protocols in the current policy. To address this issue, you recommend Calmer Waters ensure the crash diagnostic data:

Peter Petrovna decided to learn about his family’s heritage by taking a DNA test that was provided by an online company, Relatively Speaking. The company sent Peter a test to collect his saliva.  Peter learned the results of his saliva test on the website maintained by Relatively Speaking. The company does not post a privacy notice on its website. What classes of privacy might concern Peter?

According to the EU’s General Data Protection Regulation (GDPR), an independent agency known as a Data Protection Authority (DPA) is tasked with handling violations of their privacy framework. Do any of the U.S. states discussed in the course material have a similar setup as part of their state comprehensive privacy laws?

Quantic, the manufacturer of smart phones known as Q-Phones, allows customers to unlock their phones using their thumb print. Believing the company’s cybersecurity practices are state of the art, Quantic chose not to encrypt these thumb prints for storage purposes. After a successful phishing attack of Quantic, a hacker posted the thumb prints of nearly 500 million Q-Phone customers for sale on the dark web. Under which of the following theories would Quantic likely be required to report this incident as a data breach?