Cyber Security – ePrivacyNow

Why Pasig Pass is a mere surveillance application not a CONTACT TRACING Solution

Mayor Vico Sotto has done great things for the city of Pasig and his trust rating is at the highest now for all mayors in Metro Manila and recently the City of Pasig has mandated to have a contact tracing application rolled out for the city’s populace may it be visiting or residents of the city and the establishment as well. When you visit an establishment e.g., Grocery, Supermarket or any building in Pasig and if you don’t have a Pasig Pass the guards will deny you on entering the establishment.

For the ordinary citizen it can be a good app since you can now enter an establishment without filling a health declaration and what is needed is only a QR code but what is lacking for Pasig Pass is the health declaration that is supposed to be the essence of contact tracing if you have symptom of COVID19. This alone violates privacy of the individual and it also defeat the purpose of contact tracing.

If we examine the promise of PasigPass we may presume that it was just copied on a template without even thinking of any process with regards to contact tracing. Let us look at the promise of Pasig Pass on its Privacy Notice:

Information Collection

We may collect, store and transfer the following information:

name and address
contact information including email address.
demographic information such as postcode, preferences and interests
other information relevant to individual’s request and/or offers.

But what is the 4^th bullet for? Other information relevant to individual’s request and offers? We must remember that the only purpose of this kind of applications are contact tracing. Meaning that if a person visits an establishment and has acquired COVID the LGU can tag the establishment as a RED ZONE and if the establishment has no trace of COVID then it is in GREEN Zone. In RA10173 or the Data Privacy of 2012 it is explicit that any applications, process or project that collects personal data must adhere to three principles which are: TRANSPARENCY, LEGITIMATE PURPOSE and PROPORTIONALITY.

An individual can request for his / her data because the data subject has the right to his or her information in the context of contact tracing. If this kind of applications are being used on other purpose it violates its sole purpose.

They also mentioned:

Purpose of Collected Data

You consent that your collected Personal Information may be used:

To help improve our data and services and customize user experience;
To participate in and facilitate transactions;
To engage in data mining and build up activities;
To deliver the products and services that you have requested;
To perform research and analysis about your use of, or interest in, our products, services, or content, or products, services or content offered by others;
To communicate about relevant services, ads and/or advisories through whichever means are available to the City Government;
To provide better customer experience to the City Government clients and improve, develop, identify and implement services;
To follow safety, security, public service or legal requirements and processes;
To process information for statistical, analytical, and research purposes; and
To identify and prevent errors and inefficiencies due to misuse of the platform;
To enforce our terms and conditions;

The purpose stated above clearly violates the data privacy act!!!!

This only means that PasigPass is not really a contact tracing application but a city-wide application for other services of the LGU. And when a city restricts entry to an establishment to buy his food then it also discriminates people on entry because not everyone has a smart phone or even an internet connection.

For this kind of application. We must educate the head of the LGU on Data Privacy, Cyber Crime and Business Resiliency because if the city is in violation of RA10173 or RA10173 then the Mayor which is the head of the LGU will be liable for these Republic Acts. I believe that the good mayor has good intentions, but ignorance of the law and implementation of a sloppy project will be a cause of a lowering of his trust rating.

Let’s continue on the Data Sharing:

Our Disclosure of your Personal Information to Third Parties

We may share your personal information with third parties only in the ways that are described in this Privacy Statement:

we may provide your information to our sub-processors who perform functions on our behalf;
third party contractors may have access to our databases. These contractors sign a standard confidentiality agreement and data sharing agreement;
we may share your data with any parent company, subsidiaries, joint ventures, other entities under a common control or third party acquirers. We expect these other entities will honor this Privacy Policy;
we may allow a potential acquirer or merger partner to review our databases, although we would restrict their use and disclosure of this data during the diligence phase;
as required by law enforcement, government officials, or other third parties pursuant to a subpoena, court order, or other legal process or requirement applicable to our Agency;
we may transfer personal information to third parties for any legally permissible purpose at our sole discretion; and
we may share your information with third parties with your consent or direction to do so.

The above statements I assume is a copy to other privacy notice in the web. The statements must be explicit on who they are sharing this data. We also must remember that this is a privacy notice meaning this is a promise not a policy. A policy is internal to the organization on fair use, data sharing, security policies etc…

And when an organization says:

we may transfer personal information to third parties for any legally permissible purpose at our sole discretion; and
we may share your information with third parties with your consent or direction to do so.

We as citizens must know the relationship of these entities. Who are they? What is the relationship of these entities to the LGU? Who really is the Personal Information Controller and Processor? Sharing means there is a joint controller who are these? Is there a custodian of the data? And what merger-partner are they talking about? Will these data be used on election and other purpose?

As citizen we need to be mindful of our personal data and our rights as individual. Because the 8 universal rights of data privacy e.g. access, information, data portability, complain, block, indemnify etc.. are based on 4 domains which are also on the bill of rights in our constitution:

And also, on the privacy notice there is no contact information of the Data Protection Officer so in fact even if you want to exercise your right to be removed on the system you cannot do so because you cannot even email them for such request.

We must remember that all of this rights and principles has a process flow on data mapping which is illustrated below. The flow of data must comply to both data privacy principles (transparency, legitimate purpose and proportionality) and the 8 Rights of a Data Subject.

To end, LGUs or any other organization doing a privacy notice must keep in mind the criteria of good privacy notice / promise:

Must be freely given
Must be specific
- purpose specification as a safeguard against function creep,
- granularity in consent requests, and
- clear separation of information related to obtaining consent for data processing activities from information about other matters.
Must be informed
- adequate information about the processing must be communicated to the data subject “in an intelligible and easily accessible form, using clear and plain language” prior to obtaining their consent
Consent must be unambiguous

And if the above criteria are not met any data subject can easily file a complaint to a privacy commission which in this case is the National Privacy Commission.

The new flavor in Contact Tracing – QR Code

The Philippines is UNIQUE on its efforts on combating COVID19 specifically on contact tracing. When we say unique the Philippines is the only country that has not done any effort in developing their own digital contact tracing applications.

And there are various applications that was donated by 3^rd party developers that is being implemented at the moment in municipalities and other enterprises that serves as gatekeeper and contact tracing services using QR Code e.g. eSalvar, Davao QR, Traze etc…

One can just fathom on the busines model of these applications popping out. Was it really donated with no extra cost? Were these applications bought by the city council / national government? Since there is a presumed donation the application must be owned by the government and source code must be escrowed to protect the veracity and integrity of the source code in case there are breaches from internal and external factors. Before the donation were these applications had undergone a privacy impact assessment and a vulnerability and penetration testing? There are so many questions to ask with regards to project and data governance and DICT / DOH and NPC must be at the forefront to protect the data of the citizenry.

Previously, we did an analysis on Stay Safe and COVID Kaya that was featured in the ASEAN region and was picked up by different news agency e.g. Rappler, Philippine Star, Inquirer, GMA7, ABS-CBN, CNN etc. The study was based on the technical analysis / cybersecurity best practices and we found out that both are borderline SPYWARE and yet the government has not done any action on these applications on securing and making citizen safe on surveillance on this contact tracing applications.

Let’s take a look on the analysis that we did previously on Stay Safe and COVID Kaya it can read and write on your:

Contact List
SMS
Camera
Audio
Location thru triangulation on Cell Site and GPS location
Phone logs
Storage
Pictures and Videos
Calendar
It can also change your phone settings

After a few months the flavor for LGUs is the implementation of QR Codes like eSalvar in Naga, DQR in Davao and Traze that is being used on Airports. This contact tracing applications doesn’t use Bluetooth anymore but only QR Codes when you enter an establishment it serves as a gatekeeper for health declaration. But there is still some noise on implementing these technologies yet QR codes has been there for a long time and these QR are used on Retail establishment to transfer money or pay bills / merchant that can be seen on Paymaya and GCASH transactions.

Let us review some privacy notice, executive order and resolutions on the three application on QR Code and its implications:

Davao QR which is being mandated by Mayor Sarah Duterte to be used implies that DQR must be used by all citizens in Davao when you travel, going to the establishment to buy groceries / food and going in and out of the city
In effect it serves as a National ID for the citizens of Davao
The city also announced that the QR Code will be mandatory beginning November 7. The Davao Mayor said during her special hour on the Davao City Disaster Radio on Tuesday, November 3, that those without QR codes will be apprehended.

eSalvar was recently in the news due to the filing of privacy case in Naga
eSalvar uses the same tech alongside DQR and all establishment is being forced to use the application
eSalvar was developed by a 3^rd Party named Nueca Tech
Establishments feel they are being forced to use the application and they feel that it is violating their right to privacy.

Traze on the other hand is being managed and maintained by Cosmotech Inc which is a an HRIS systems integrator
Traze is being used on airports
Since this is being managed and owned by Cosmotech Inc. they are functioning as Data Controllers with regards to the ownership and manner of collection of data.
Traze collects data from individuals, partners and transportation vessels based on the following:
1. INVIDUALS
  1. User name/ ID
  2. Last Name, First Name
  3. Alias
  4. Cell phone number
  5. Address/ city/ country
  6. E-mail Address
  7. Scanned or visited establishments, businesses, government agencies
2. PARTNERS, ESTABLISHMENTS, GOVERNMENT AGENCIES, DELIVERY CREW AND BARANGAY
  1. Company/ government agency/establishment’s name
  2. Telephone/ cell phone number
  3. Address/location/ city/ country
  4. E-mail Address
  5. Registered By
  6. Scanned visitors, clients and other individuals
3. LAND TRANSPORTATION, AIRPLANES, TRAINS AND SHIP/VESSEL
  1. Transportation’s name/ operator’s name
  2. Telephone/ cell phone number
  3. E-mail Address
  4. City/ Country
  5. Port of embarkation/ station/airport, flight number, route or place of operation, plate number
  6. Scanned passengers, visitors, clients and other individuals

Based on the facts gathered on these QR Code implementation on both Naga and Davao it violated some Privacy Laws stated on the Bill of Rights in our constitution specifically on article 3 section 2 and on the Republic Act that was made into law in 2012 RA 10173 or famously known as Data Privacy Act.

While TRAZE violated RA10173 because it doesn’t have any personality in contact tracing merely for the fact that it has no legitimate purpose on being a data controller or even a data processor. The only personality that Cosmotech Inc. can be is a vendor. The entity doesn’t have any right to citizen data since it should be part of the e-governments task and its entities must be accountable to the public.

The basic principles of DPA are transparency, legitimate purpose and proportionality / fairness. When we say transparency, it is like looking in a mirror and making our promise stand. So, integrity is an issue here while we can assume that an LGU has legitimate purpose to do contact tracing it is only for the sole purpose that collection of data must be legitimately done and collected on purpose of contact tracing not functioning as a national id.

This data being collected cannot be used on other purpose e.g. election, people profiling and others. When we are done with contact tracing these data must be destroyed and the citizen must have evidence that an end-to-end destruction was done up to the entities that they have shared with e.g. WHO, DOH, DILG etc…

The principles of TLP in Data Privacy should be upheld to highest level because as Judge Brandeis of the US Supreme Court has said in the 1928 case – the highest and noblest of rights is the right to be let alone (Privacy).

We cannot put in our privacy statement / notice something like these:

We also need to adhere to the basic rights on privacy stated in GDPR, RA10173 (Data Privacy Act of 2012) and United Nations. Data Subjects or the citizenry has rights to:

Right to be informed
Right to damages
Right to access
Right to object
Right to Erasure / Blocking (to be forgotten)
Right to file a complaint
Right to rectify
Right to Data Portability

Our data subjects must be able to choose that is why the liberty to participate in this kind of process must have a buy-in with data subjects and they have the eight universal rights to do so. Another misconception of government in Asia right now specifically in the Philippines is that when a head of city or government does a resolution or pronounced policies it is the end of the road on the implementation. The legal team must understand the relationship of data subjects, data controller and processor because this will be the basis of contracts.

We need to understand that a city / municipality has the sole legitimate purpose being a data controller because they decide the manner of collection. There should also be an outsourcing agreement, service level agreement or a data processing agreement on data processor being initiated by the LGU. When they share data to the national government or other entities which is not under the LGU they need to have data sharing agreements with these entities. The 3^rd parties with different purpose are considered as joint controllers (National Government and other 3^rd parties).

Let’s dwell a little bit on the data sharing agreements when an LGU drafts its resolution and mandates enterprises to comply and use these applications the LGU needs to have a data sharing agreement on all enterprise. I mean ALL enterprise that they will collect in behalf of the city government so if there are no such document an enterprise doesn’t have any regulatory obligation to the LGU but they have a regulatory obligation to DOLE since there is a circular on the Department of Labor and Employment for any company to have an aggregated list to be submitted to DOLE on a monthly basis which we presume that they are sharing to DOH. We need to take note DOH only not DILG since the Department of Health has the sole responsibility on RA 11332 which is required to submit any information to the Government to enable contact tracing of suspected, probable, and confirmed COVID-19 patient due to epidemic or pandemic. The keyword here is CONFIRMED.

On the other hand what legal document does the application developers who donated their application to government should have in possession? It is a deed of donation and an escrow agreement and since they developed the application we are also presuming they are maintaining the application and they are being paid as operating expense to maintain the application and if they are maintaining the application we need to have a managed service agreement on the application developer.

We need to remember that the anti-thesis of privacy is surveillance and the right to privacy is one of the most important rights of a human being. People needs to have liberty to choose and participate in government initiative to curtail COVID but it should be voluntary, proportionate, fair and transparent.

The Sensitivity of Location Data on Digital Contact Tracing

Let me have a stab on location data that will be part of the 2^nd edition of the Social and Privacy Impact of Contact Tracing .

In the global standard such as the Global Data Protection Regulation (GDPR) compliance applies whenever the use of location data involves processing of personal data. It means that any data processed in an electronic form or by an electronic communication service / channel indicating geographic position of the terminal (phone, car, tablet, laptops) in public using GPS or a Cell Tower triangulation. In EU there is a directive which is called EPrivacy that deals with IOT devices and it also defined that a terminal using GPS needs to be protected and can be linked on the rights of the data subjects in any Data Privacy Act. In the Philippines and in other countries there is no EPrivacy Directive, but it can be related to the eCommerce Law which is RA 8792, Data Privacy Act of 2012 / RA 10173 and the CyberCrime Law of 2012 / RA 10175.

IOT in the context of EPrivacy Directive requires an individual to give an opt-in consent to use location data to provide a value-added service.

The information requirement for the location data needs to be itemized on a privacy notice and the purpose and duration of the processing must be explicitly stated. Since, the nature of the location is always shared to a 3^rd party or a joint controller the process must also be stated on the notice and in the internal policy.

The last important aspect of location data will be based on our ability to withdraw consent. As data subjects we have the right to opt-out and the controller and processor needs to show evidence that indeed the location data has been erased on an end to end manner.

Let us relate this to contact tracing and the solutions being provided by most countries in the world to address corona virus. Digital Contact Tracing as being proposed by most countries such as Singapore, South Korea, Australia among others can be classified as either a Privacy Enhancing Technology (PET) or a Privacy Impacting Technology (PIT). PET can help us solve the problem such as corona virus with Privacy in mind and has implemented Privacy by Design while PIT is impacting our privacy as data subjects on either by Territorial, Information, Bodily or Communication.

These four domains of Privacy define how we act as a person because Territorial and Bodily answers our right as a human being that goes on our bill of rights and even on the 4^th amendment of the US Constitution while the Data Privacy aspects can be answered on Information and Communication. Information Privacy involves the establishment of rules governing the collection and handling of personal data such as credit information, and medical and government records. Which is commonly know right now as Data Privacy / Data Protection.

But let us put our focus on Communication Privacy which covers the security and privacy of mail, telephones, e-mail and other forms of communication including location data.

————————————————————–

Let’s look at the two sources of location data for modelling:

Location data collected by electronic communication service providers (such as mobile telecommunication operators) during the provision of their service; and
Location data collected by application developer or what EU calls Information society service providers’ whose functionality requires the use of such data (e.g., navigation, transportation services, etc.).

The European Data Protection Board or EDPB states that location data collected from electronic communication providers may only be processed within the remits of Articles 6 and 9 of the EPrivacy Directive. This means that these data can only be transmitted to authorities or other third parties if they have been anonymized by the provider or, for data indicating the geographic position of the terminal equipment of a user, which are not traffic data, with the prior consent of the users.

The EDPB also pointed out with emphasis that when it comes to using location data, preference should always be given to the processing of anonymized data rather than personal data.

Anonymization refers to the use of a set of techniques in order to remove the ability to link the data with a natural person against a “reasonability test”. We must consider the aspect of the objective of the problem when it was first hatched and the contextual element that may vary from country to country in the case of contact tracing applications.

In contact tracing accountability is very important so the Controller of any Digital Contact Tracing Application should be clearly defined. In other countries these contact tracing apps are sponsored and made by the government and what is unique in the Philippines is that the Private Sector donated these applications without proper vetting from proper authorities (DICT) that is why there are mistrust on contact tracing. And normally, a contact tracing application is being owned by heath authorities and in the case of the Philippines there are two – the Department of Health (DOH) is using COVID Kaya and IATF / NTF / DILG is using StaySafe and definition of being a controller and processor is vague the parties involve. And If the deployment of these apps involves different actors their roles and responsibilities must be clearly established from the onset and must be explained to the users.

In addition, on the principle of purpose limitation, the purpose must be specific enough to exclude further processing to unrelated to the management of the health crisis (e.g. commercial, surveillance or law enforcement purposes). In the context of a contact tracing application, careful consideration should be given to the principle of data minimization and privacy by design:

Contact tracing apps do not require tracking the location of individual users. Instead, proximity data should be used.
As contact tracing applications can function without direct identification of individuals, mitigating measures should be employed to prevent re-identification.
The collected information should reside on the mobile / terminal of the user and only relevant information should be collected when necessary. (there must be process in place to be triggered by health or local government units)

Recommendations:

According to the PbD and data minimization, the data processed should be reduced to the strict minimum.
The application should not collect unrelated or not needed information, which may include civil status, communication identifiers, messages, call logs, location data, device identifiers, etc.
Data broadcasted by applications must only include some anonymized and pseudonymous identifiers
These identifiers must be renewed regularly with same model on RSA encrypted keys on both private and public tokens
Implementations for contact tracing can follow a centralized or a decentralized approach.
These approaches must provide adequate security measures.
Consideration must be considered weighing privacy in the process that may impact rights of individuals
Cryptographic techniques must be implemented to secure the data stored in servers and the cloud
Authentication between the application and the server must also be performed by using multi-factor authentication
The reporting of users as COVID-19 infected on the application must be subject to proper authorization. If confirmation cannot be obtained in a secure manner, no data processing should take place that presumes the validity of the user’s status.

In the end this kind of applications must be strictly voluntary, and it cannot be forced because contact tracing has a thin line on surveillance systems and Individuals must always have full control over their data and the public should be able to choose freely to use such an application.

Tracing App in the Philippines – Too much Permission.

We are writing a review on the two tracing apps / systems that the Philippine Government are using and mandating LGUs to use. These are Stay Safe and COVID-KAYA. Stay Safe was done Multisys and is being positioned as the official tracing app for IATF / NTF while COVID-KAYA is the official system being used by the Department of Health (DOH) and World Health Organization (WHO). We run Exodus a Privacy App that analyzes the permission of the application in Play Store. These permission are libraries that a developer access and use, the permission is then logged on a file which we call manifest.xml prior to submission to the app store for publishing.

Below are the screenshots for both Stay Safe and COVID-Kaya.

As we can see above the COVID-KAYA has 42 Permisssion and Stay Safe has 16 Permission and 1 Tracker since we are assuming that the database of Stay Safe is using Google Firebase. Permission are not really bad but we as citizen need to ask why are these apps collecting, using and accessing the libraries:

Camera – take pictures and videos without confirmation
Modify System Settings – allows the app to modify systems settings of data. Malicious apps may corrupt system configuration
Read Contacts – allows the app to read data about your contacts stored on your phone, including the frequency with which you have called, emailed or communicated. This permission allows apps to save your contact data and malicious apps may share contact data without your knowledge
Write Contacts – allows the app to modify data about your contacts stored on your phone, this permission allows apps to delete contact data
Get Accounts – allows apps to get the list of accounts known by the phone, this may include any accounts created by applications you have installed.
Access Coarse Location (Network Based) – allows the app to get your approximate location, this location is derived by location services using network location sources such as cell towers and WiFi
Access Fine Location (GPS) – allows the app to get precise location using Global Positioning System
Bluetooth – automatic pairing
Record Audio – allows the app to record audio
Read Phone State – allows the app to access the phone state if you are calling someone. This permission allows the app to determine phone number and device id
Read External Storage – allows the app to read data on SD Card is any

As we stated above we mentioned the types of permission these two applications are using and accessing and we as privacy and security practitioners are concerned on why do they need:

Camera – a tracing app doesn’t need any camera since the tracing is being done on the background using bluetooth and other high frequency
Modify System Settings – why are they modifying system settings this may be a borderline Malware
Read Contacts – Why do they need to read my contact details? The Personal Information on the contacts are sensitive enough if this is breached. We know for a fact that the National Privacy Commission has filed cases on lending apps in 2019 because of this scenario
Write Contacts – This permission should not be touched by the tracing application because they might modify and delete contacts that may even result to identity theft
Get Accounts – we don’t understand this? Why do they need to access other accounts that was created by different application on the phone?
Access Coarse Location (Network Based) – Is this even part of the privacy notice that they can triangulate the location on the cell towers?
Access Fine Location (GPS) – maybe we can ask what model are they using – centralised or decentralised approach
Bluetooth – automatic pairing – this acceptable in order to do contact tracing
Record Audio – Are these apps eavesdropping? This may result to wiretapping that needs a warrant before it is permitted
Read Phone State – Why do they need to monitor if a person is calling?
Read External Storage – and lastly why do they need to read my data on my SD Card?

These are just some questions that we as citizens need to ask….

What is PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) is a set of #cybersecurity regulations for businesses handling credit card data.

Formed in 2004 by Visa, MasterCard, Discover, and American Express, it is administered by the Payment Card Industry Security Standards Council (PCI SSC).

PCI DSS applies to all merchants dealing with cardholder data, regardless of revenue and transaction volume.
Compliance is validated either annually or quarterly, and is performed by a firm-specific Internal Security Assessor (ISA) or an external Qualified Security Assessor (QSA).

There are four levels of compliance for merchants: they all depend on the volume of transactions for a particular brand within a year. Mastercard typically uses the same values as Visa.

Level 4: < 20k transactions/year — Questionnaire (e-commerce only)
Level 3: < 1M transactions/year — Questionnaire
Level 2: < 6M transactions/year — Questionnaire + Quarterly vulnerability scans
Level 1: ≥ 6M transactions/year — Full onsite audit + Vulnerability scans2

For service providers, there are just two levels of compliance. The PCI SSC document defines them as the following:

Level 2: < 300k transactions/year — Questionnaire + Vulnerability scans
Level 1: ≥ 300k transactions/year — Full onsite audit + Vulnerability scans

There are 2 partners of ePrivacyNow that are ISA and QSA these are SISA and QRC Solutions and our Payment Partner AltPaynet(Level 1) has the highest level of certification granted by the payments industry.

For more information on how we can help you, book a consultation with us.

Our Business is evolving… why do you need a board member that has a security and a privacy mindset

Our business environment is evolving and regulation are now part of our everyday life on the enterprise not only on BIG companies that operates in a highly regulated nature but also on small and medium businesses. Through the introduction of the data privacy act and GDPR of EU people are now more conscious of privacy on data processors and their subscribers.

Our management committee and members of the board of directors are more involved than ever in discussions and strategy around their PIIs and cybersecurity and the solutions needed to prevent being the next BIG breach.

The questions we are asking are no longer as simple as “are we secure?” but more to the tune of “are we doing all we can to minimize or transfer the risk, and what do we do in the case of a breach?”

Because of regulation such as the Data Privacy Act (DPA) and EU’s General Data Protection Regulation (GDPR) our management or the board of the directors need to understand more about this regulations and INFOSEC more. Most of the time our CIOs / CTOs and if you have a CISO cannot articulate what the board needs on security and its impact to the business. As IT Executives we need to relay to the board:

The assets and service that they cannot go without – this means their crown jewels
The security drivers and risks.
Risk Assessment and the enterprise response to the risk to ensure survival, continuity and organization’s safety

Our board should ask the questions such as:

Are we demonstrating the appropriate level of due diligence, ownership, and effective management of cyber security risk that we owe to our organization and to our shareholders?
What is our risk appetite if ever a breach happens to us? To what degree are we discussing cyber security risk management in relations to business continuity and the threats to our organization over the past years?
Is our prioritization and level of engagement on the topic of cyber security consistent with our perceived level of overall risk to the organization?
Does our Board need to play a more active role in determining our organizations cyber security strategy? If so, in what way?
Have any of our board members attended formal governance training specific to cyber security risk management? Should this be a requirement/option for some or all board members?

Start your long-term search for this board member now, as it may take a long time to find the candidate with the right qualifications, cultural fit, and of course the availability to take the spot.