Remember 2015 when an incoming CISO infamously announced he was quitting Yahoo? In retrospect we know he was failing to disclose their breaches, trying to sneak out the back door yet avoid charges of misconduct.

His abrupt departure, after just one year in his first ever attempt to be a CISO, was announced very loudly as an intention to lead Facebook instead, because he said it was the best in the world at protecting people’s information (and soon after promising privacy where there would be none).

In fact his track record delivered the exact opposite, and regulators are not pleased.

Not only did Facebook flounder under this CISO’s outspoken and high-profile yet vapid command — leading to the largest breaches in history — it pushed back at regulators and then failed even to rise above a basic test of “key data protection principles“.

The decision follows an inquiry by the Data Protection Commissioner (DPC) into a series of 12 data breach notifications received by DPC the between June and December 2018,

The regulator found that Meta Platforms Ireland infringed Article 5(2), and 24(1) of the GDPR data protection law, which require organisations to put measures in place to meet key data protection principles.

The DPC found that Meta “failed to have in place appropriate technical and organisational measures which would enable it to readily demonstrate the security measures that it implemented in practice to protect EU users’ data”.

In other words, more and more people agree that CISO should probably go to jail.

Today the government is announcing that executives whose companies fail to cooperate with Ofcom’s information requests could now face prosecution or jail time.

As much as people like to talk up Apple as a privacy advocate, it’s rarely a bright line with an either/or position.

Buried in a macOS 12.3 release (with general availability two days ago) was an important change to the data flow of user files.

Deprecations.

The kernel extensions used by the Dropbox desktop app and Microsoft OneDrive are no longer available. Both service providers have replacements for this functionality currently in beta. (85890896)

That means macOS 12.3 no longer allows opening any files stored in the cloud through third-party applications; users must instead download all files with Apple’s macOS Finder before opening them with any other applications.

That basically kills the entire access model of a product like Dropbox “Smart Sync“, which is built on the premise someone can avoid downloading files to a local system, managing permissions entirely through an app instead.

Stop worrying about hard drive limits. Sync only what you need, and access all your files seamlessly from your desktop or mobile.

There are privacy implications here, as well as control issues, and it will be interesting to see whether Apple can justify the changes within a context of privacy.

On a related note, macOS 12.3 security content also discloses a huge number of major flaws such as “bypass login” and “execute arbitrary code with kernel privileges” and “malicious application may be able to gain root”.

Lots of good reasons to not download files to a local system, let alone give the OS any more access than necessary.