Mark Rasch Mark Rasch is a lawyer and computer security and privacy expert in Bethesda, Maryland. where he helps develop strategy and messaging for the Information Security team.
Rasch’s career spans more than 35 years of corporate and government cybersecurity, computer privacy, regulatory compliance, computer forensics and incident response. He is trained as a lawyer and was the Chief Security Evangelist for Verizon Enterprise Solutions (VES). He is recognized author of numerous security- and privacy-related articles. Prior to joining Verizon, he taught courses in cybersecurity, law, policy and technology at various colleges and Universities including the University of Maryland, George Mason University, Georgetown University, and the American University School of law and was active with the American Bar Association’s Privacy and Cybersecurity Committees and the Computers, Freedom and Privacy Conference.
Rasch had worked as cyberlaw editor for SecurityCurrent.com, as Chief Privacy Officer for SAIC, and as Director or Managing Director at various information security consulting companies, including CSC, FTI Consulting, Solutionary, Predictive Systems, and Global Integrity Corp.
Earlier in his career, Rasch was with the U.S. Department of Justice where he led the department’s efforts to investigate and prosecute cyber and high-technology crime, starting the computer crime unit within the Criminal Division’s Fraud Section, efforts which eventually led to the creation of the Computer Crime and Intellectual Property Section of the Criminal Division. He was responsible for various high-profile computer crime prosecutions, including Kevin Mitnick, Kevin Poulsen and Robert Tappan Morris.
Prior to joining Verizon, Mark was a frequent commentator in the media on issues related to information security, appearing on BBC, CBC, Fox News, CNN, NBC News, ABC News, the New York Times, the Wall Street Journal and many other outlets.
Mark Rasch
California Federal Court Weighs In (Again) on Social Media Scraping
Social media sites such as Facebook and LinkedIn have collected personal information on hundreds of millions of subscribers. They have also promised those subscribers that their data will only be shared or used for particular purposes—agreements that are not only enforceable but also are required to be upheld under various ... Read More
Security Boulevard
Hang up the Phone: MFA’s Insecure Reliance on SMS
It’s hard enough to get people to use multi-factor authentication (MFA)—you know, something you know, you have and you are. Most websites, email accounts and other devices are secured (if at all) with a simple user ID (or email address) and password—and frequently with insecure, reusable, stored and retransmitted credentials ... Read More
Security Boulevard
Court Greenlights Accenture/Marriott Breach Suit
A court has ruled that Accenture, as a service provider to Starwood, owed a duty to prevent data breaches to Starwood’s customers In September 2018, Bethesda, Maryland-based Marriott International’s subsidiary chain Starwood learned it had been the victim of a massive data breach involving millions of customer records. The data ... Read More
Security Boulevard
VA High Court: License Plate Database Not Personal Data
Mark Rasch | | Data Privacy, license plate reader, personal data, personally identifiable information, privacy laws
Regulations related to the collection, storage and use of personal data don’t apply to the collection of license plate readings, a court has found, calling privacy regs into question As you drive to George Mason University in Fairfax, Virginia, you may very well pass a blue and grey Fairfax County ... Read More
Security Boulevard
Incident Response: Pay a Ransom, Go to Jail
Companies that find their files, data or networks locked by a malicious actor demanding an extortion payment now have a new worry in their incident response: The U.S. Department of Treasury. On Oct. 1, the Treasury Department’s Office of Foreign Asset Control (OFAC) issued an advisory warning companies affected by ... Read More
Security Boulevard
The High Cost of Reporting a Non-Reportable Data Breach
Can a company be sued for reporting a data breach in which the data was never used and destroyed? In May, cloud provider Blackbaud was the victim of a ransomware attack designed to lock it out of accessing its own data and servers. The company notified law enforcement, used its ... Read More
Security Boulevard
U.S. Requires Servers to Ban TikTok, WeChat Traffic
On Sunday, Sept. 20, Chinese company ByteDance’s TikTok and WeChat die. President Trump’s executive order, which prohibits any “transactions” with ByteDance thereafter, has now been clarified to note that “transactions” include both the transfer of data to and from TikTok, as well as the hosting or downloading of the applications ... Read More
Security Boulevard
Is a Ransomware Attack a Reportable Data Breach?
One question that vexes security engineers, incident responders and lawyers is whether a ransomware attack constitutes a reportable data breach under any of the various data breach disclosure laws, regulations or other requirements. As with anything else in the law, the simple answer is, “it depends.” Once More Into the ... Read More
Security Boulevard
Garbage In, Gospel Out: The Security Problem of Data Accuracy
The accuracy or integrity of data is only as good as its source In two separate incidents, one in Colorado and one in Washington, D.C., police at gunpoint stopped people who were not committing any crimes, ordered young families out of their cars at gunpoint and further ordered them to ... Read More
Security Boulevard
TikTok and National Security: The Need for a Comprehensive U.S. Privacy Law
Last week, President Donald Trump threatened to ban the popular social media platform TikTok, whose corporate owner is a Chinese company with alleged ties to the Chinese Communist Party. Trump’s stated grounds for seeking to ban the popular application was that the app threatens U.S. national security. But exactly how? ... Read More
Security Boulevard

