David Adler takes center stage in Washington D.C. at ISACA #CSXNA 2017

Trends in Cyber Law
ISACA CSXNA 2017 CYBER LAW

Adler’s topic was Trends in Cyber-Law 2017.

Cyber-Law “governs the digital dissemination of both (digitalized) information and software and legal aspects of information technology more broadly, including information security and electronic commerce. Cyber law  is a term that encapsulates the legal issues related to use of the Internet. It is less a distinct field of law than intellectual property or contract law, as it is a domain covering many areas of law and regulation, such as internet access and usage, privacy, freedom of expression, and jurisdiction.”

Despite the variety of subjects, most legal trends for 2017 are in 5 key areas: Data Sovereignty, Cyber Conflict, Civil Liberties, IoT and Cloud.

The full presentation slide deck is available here.

CSX2017 Trends in Cyberlaw 2017 Adler (Read-Only)

Intellectual Property rights (copyright, patent, trademark, trade secrets) and information technology systems each play a crucial role in business competitiveness. In order to realize the full potential of a company’s intangible business assets, it is necessary to be able to identify, locate and safeguard their disclosure and use. Cyber Security plays a crucial role in managing these internal and external business and legal risks. This “Hot Topics” discussion is a snapshot of developments in law, policy, regulation and court cases focusing on privacy and civil liberties, identity, cyber-conflict, IoT, standards, corporate structuring and the international technology marketplace.

This session covered:

  • Understanding how developments in smart home devices are creating new cyber security challenges
  • Learning how changes in regulatory agency policies and personnel are creating new privacy risks and opportunities
  • Identifying new legal cases affecting business operations
  • Recognizing new business and legal risks in relationships with customers and vendors and how to implement changes to mitigate such risks

For more information contact us here:

www.adler-law.com (866) 734-2568

Privacy & Security Issues In Smart Home and IoT Devices

Comprised of connected devices such as thermostats, automobiles, electricity, televisions, fitness trackers, security/baby-monitoring cameras, medical devices, cell phones and tablets, IoT adoption is penetrating some of the world’s most regulated industries such as healthcare, energy, government, financial services, and retail. The potential size of the IoT market is staggering. Commercial-device-focused GE estimates the “Industrial Internet” market will reach $10-$15 trillion over the next 20 years. Consumer-focused Cisco estimates the “Internet of Everything” will be $19 trillion by 2020.

Several recent examples from researchers and manufacturers have shown just how easily privacy and security can be comprised by these devices. In April of 2014, research on Nest Smart Thermostats by Matthew Burrough and Jonathan Gill at U. of I. at Urbana-Champaign revealed two observations impacting privacy and security.

First, Nest appears to be “offline,” yet responds immediately to cloud-based (online) temperature control changes. Second, by interacting with the thermostat or triggering the motion sensors, persistent connections can be made. Taken together, the potential exists to exploit seemingly reasonable functional expectations (e.g., monitoring temp changes).

These technology and privacy legal issues are only likely to proliferate. Regardless of the outcome, the case highlights lessons for IT departments and others charged with safeguarding data on devices. As a precaution, it is useful to consult with the outside technology counsel to better understand you’re rates, obligations, and any limitations to your responsibilities for disclosure.

Five Best Ways to Protect Your Ideas

Idea

When I first meet a client, I am often asked “How can I protect my ideas?” While it may seem like a simple question, getting the answer right is often tricky. That’s because one can’t actually own an idea, in and of itself. Sounds confusing, I know. The five best ways to protect your ideas are 1) Identify, 2) Organize, 3) Register (or restrict), 4) Monitor, and 5) Enforce. This articles focuses on how to identify the best ways to protect your ideas.

Regardless of industry, Ideas are the keys to any successful business. While one cannot “own” an idea, one can protect one’s Intellectual Property rights that relate to the embodiment or manifestation of that idea. For example, Copyright, Patent, Trademark, Trade Secret and Publicity Rights are all forms of Intellectual Property rights that grant exclusive rights to the owner, both artistic and commercial.

Copyright protects works of creative artistic expression such as books, movies, audio-visual music, paintings, photographs, and importantly, software. Copyright protection requires that a work be “fixed” in tangible format (this includes electronic format) and gives the owner (called the “author”) of such works the exclusive rights to reproduce, distribute, publicly display, publicly perform, and modify a work for a certain period of time.

Patents (utility and design), Trademarks and Trade Secrets protect creative commercial expression sometimes known as “industrial properties,” as they are typically created and used for industrial or commercial purposes.

A Patent protects the invention or discovery of “any new and useful process, machine, article of manufacture, or composition of matter, or any new and useful improvement thereof.” A Patent gives the inventor “the right to exclude others from making, using, offering for sale, or selling” the invention in the United States or “importing” the invention into the United States for a period of time.

A Trademark is any word, name, symbol, or device, or any combination, used, or intended to be used, in commerce to identify and distinguish the goods of one manufacturer or seller from others, and to indicate the source of the goods. In short, a trademark is a brand name or logo that is a distinctive sign which is used to prevent confusion among products in the marketplace. A Trademark enjoys protection indefinitely, as long as it is being used.

An industrial design right protects the form of appearance, style or design of an industrial object from infringement.

A Trade Secret is an item of non-public information concerning the commercial practices or proprietary knowledge of a business. Public disclosure of trade secrets may sometimes be illegal. A Trade secret enjoys protection indefinitely, as long as it is being kept secret.

Some rights are “statutory” in that they exist because they are granted by the Constitution of the United States, e.g. Copyright and Patent. Other rights arise from “use,” e.g. Trademark and Trade Secret rights. Some arise under State law, e.g., Rights of Publicity. Not all types of intellectual property require registration in order to obtain, maintain or enforce one’s rights. However, registration is HIGHLY RECOMMENDED if available, is required in certain circumstances and, even when not required, registration often confers several benefits that enable enforcement, reduce the risk and costs of enforcement, and provide additional incentives and remedies for enforcement.

The term “Intellectual Property” denotes the specific legal rights described above, and not the intellectual work, concept or idea itself. Oftentimes, the largest value of a businesses can be traced to its intangible assets. Knowing how to identify intangible assets and understanding which Intellectual Property rights apply to these assets is critical to the ability to protect and commercialize one’s ideas. Therefore, great care should be given to maintaining and enhancing their power and value. Value can be increased through a carefully planned and executed strategy. Innovative companies that successfully leverage their Intellectual Property rights will stand to benefit most from the opportunities presented by the current economic marketplace and demand for innovation.

 

Focus | Vision | Perspective | Passion

Executives face a confusing and dynamic set of challenges ensuring their business remains legally compliant. Yet few can afford the highly-qualified and versatile legal staff needed to deal with today’s complex legal & regulatory environment.

Adler Law Group was created to provide clients with a competitive advantage by enabling them to leverage their intangible assets and creative content in a way that drives innovation and increases the overall value of the business.

For a FREE, no-obligation 1 hour consultation to learn the best ways to identify, protect and leverage your ideas, please call: (866) 734-2568, click: http://www.adler-law.com, or write: David @ adler-law.com.

Adler Law Group – Providing innovative legal counsel that elevates aspirations to achievements.™

The New Wave of Data-Breach Outrage

You can almost feel it, like a power-line buzz in the air. If 2014 was the year that consumers and legislators woke up to the real threat to privacy and information security, 2015 may be the year that sees a shift in both enforcement and penalties.

On February 5, Anthem, Inc., the country’s second-largest health insurer by market value announced a security breach resulting in unauthorized access to tens of millions of current and former customer and employee accounts, Bloomberg reports.

Of particular concern is that the compromised data included social security numbers and birth dates, etc. Very different than having a credit card number stolen.

Last week, a group of 10 state attorneys general (AGs) sent a letter chastising Anthem for the length of time it took to notify the public of the breach. The letter was written on behalf of Arkansas, Connecticut, Illinois, Kentucky, Maine, Mississippi, Nebraska, Nevada, Pennsylvania and Rhode Island.

Some observers have commented that current encryption technology can limit the amount of data that even “authorized users” can view at one time, making it more difficult to compromise massive amounts of data.

In this situation, the breach occurred through misuse of an authorized user’s credentials, so encryption alone would not have worked. While most companies give universal access to data to some employees (senior level or IT), for the encryption approach to work, no one person or set of credentials should allow access to all data.

In the end, the new “best practices” approach may be a combination of encryption plus controls to limit the amount of data that any one set of credentials can access.

When it comes to addressing data privacy risks, it is often difficult to determine whether you should slow down, change course, signal for help, or simply muddle through. Often, teams tasked with managing privacy need to quickly identify potential issues, assess the risk, and implement controls to steer clear of unneeded exposure. The privacy professionals at the Adler Law Group can help you adopt Privacy Impact Assessments – or similar tools – and standardize a methodology for approaching these challenges by setting objectives, determining scope, allocating resources, and developing practices that will efficiently and effective manage privacy, while keeping pace with the business. For a free consultation, call us at (866) 734-2568, send and email to info@ecommerceattorney.com or visit our web site www.adler-law.com.

DATA PRIVACY DAY 

Do You Understand Your Data Privacy Rights?

Data Privacy Day was started in 2007 in response to widespread lack of understanding about how personal data was being protected. Today, 91% of adults “agree” or “strongly agree” that consumers have lost control over how personal information is collected and used by companies, according to a recent Pew Research Center Survey.

Data is one of the natural resources of the 21st century. It should be treated like all other precious resources. Understanding, responsibility, and accountability are key. Ubiquitous Internet connections, unprecedented processing power and speed combined with staggeringly large databases have the ability to help both the private and public sectors. However, there is a growing split between the benefits of data-driven activities and perceptions of decreased privacy rights needs to be addressed. There is a balance that needs to be found between the responsibility of governments and that of businesses in ensuring an adequate level of protection to citizens and consumers, while supporting technological innovation.

The purpose of Data Privacy Day is raise awareness among digital citizens and empower them with understanding how their data is being collected, stored and consumed. Often, that starts with being educated about the privacy policies of online companies and web properties.

The National Cyber Security Alliance (NCSA) officially kicked off today’s Data Privacy Day events with a broadcast from George Washington University Law School featuring Federal Trade Commissioner Maureen Ohlhausen and privacy and security experts from industry and government.

Whether you are a consumer, an application developer, a technology platform provider, consultant, or enterprise that relies on the collection, analysis and commercialization of data (who doesn’t these days) Adler Law Group can help you navigate this emerging area by 1) assessing and prioritizing privacy risks, 2) creating a baseline understanding of data assets, data flows and contractual commitments, 3) developing internal Privacy Polciies and processes, and 4) creating and delivering training programs for executives and employees that increases awareness and mitigate risk.

AEREO LOSES COPYRIGHT CASE

Technology Continues to Test The Bounds of Copyright Law

The Internet is an unprecedented source of disruption. From retail services (e.g. Amazon) to media and entertainment, almost every industry has been forced to rethink its business model due to the accessibility, ubiquity and democratizing force of the Internet. Aereo was positioned to disrupt the traditional media distribution model by giving consumers greater control over what were otherwise “free” over-the-air transmissions.

The Aereo service was premised on the idea that consumers should be able to watch and record over-the-air broadcast television programming via the Internet. Major broadcast networks that owned the content made accessible through Aereo challenged the model on the grounds that Aereo was violating the exclusive “public performance” right guaranteed by the Copyright Act.

Copyright law provides copyright owners six exclusive rights. One of those rights is the exclusive right to publicly perform the copyrighted work. Because this right is a statutory construct, one must look to the statute to determine its meaning. To “perform” and to perform “publicly” means “to transmit or otherwise communicate a performance or display the work to a place … or to the public, by means of any device or process, whether the members of the public capable of receiving the performance or display receive it in the same place or in separate places and at the same time or at different times.”

While many reacted by asking whether the case would stifle innovation and have a chilling effect on start-ups, this case does highlight the increasing tension between technological advances and copyright law.

From a practical standpoint, one need not be alarmed about the impact of the decision on most types of innovation. For one thing, the Court went to some lengths to craft a reasonably narrow decision, which applies only to broadcast TV retransmitted over the Internet.

As with any type of innovation, there are different types of risk. On the one hand, there is technology risk: the risk that whatever technology is necessary for some business plan simply won’t work. On the other hand, there is legal risk, highlighted by the Aereo decision: the risk that the entrepreneur’s interpretation of some act or case law won’t ultimately prevail. That’s what happened to Aereo.

As an IP lawyer, I am somewhat perplexed. It is hard for me to understand why Aereo made such a bold move. However, at least the district court agreed with Aereo’s interpretation.

Identifying Intellectual Property Issues in Start-Ups – Live Webcast!

Do you work with start-up companies and need a basic understanding of the various intellectual property issues that can arise?

I will be co-presenting in this online seminar that will help you:

  • understand the trademark and copyright problems your client may encounter with branding;
  • learn how to protect your client’s branding once established;
  • familiarize your practice with patents, including what they protect, timing, and strategies to prevent inadvertent loss of patent rights before filing the application;
  • understand trade secrets and the importance of non-disclosure and confidentiality agreements;
  • recognize intellectual property issues relating to technology, including open source code and the cloud;
  • establish a proactive approach toward intellectual property ownership between cofounders, employees, and vendors; understand business names, domain names, promotional issues, and website content concerns.

The program qualifies for 1.5 hours MCLE credit.

I would like to personally invite you to attend the upcoming Law Ed program titled, “Identifying Intellectual Property Issues in Start-Ups,” which I will be co-presenting via live webcast on Tuesday, May 27th.

Presented by the ISBA Business Advice and Financial Planning Section

Co-Sponsored by the ISBA Intellectual Property Section

Proposed Amedments To Computer Fraud & Abuse Act

Enacted by Congress in 1986, the Computer Fraud and Abuse Act (CFAA) builds upon existing computer fraud law (18 U.S.C. § 1030). Initially, the CFAA was intended to limit federal jurisdiction to cases “with a compelling federal interest-i.e., where computers of the federal government or certain financial institutions are involved or where the crime itself is interstate in nature.” Notably, the CFAA criminalized certain computer-related acts such as distribution of malicious software code, propagating denial of service attacks as well as trafficking in passwords and similar items. Recently, the CFAA has gained prominence as a bludgeon used to prosecute a wide-range of activities, some broadly labelled “hacking” and other stretching the boundaries of “unauthorized” computer access.

Two recently introduced bills, one by Representative Zoe Lofgren (D-CA) in the House and one by Senator Ron Wyden (D-OR) in the Senate aim to amend the CFAA in hopes of ameliorating application of the CFAA to claims of breach of terms of service, employment agreements. Additionally, with the nickname “Aaron’s Law,” they also seek to limit what some see as the CFAA’s tendency to allow for overzealous prosecution that they claim characterized Aaron Swartz’s case.

In short the bills would amend the meaning of “exceeds authorized access,” changing it to “access without authorization,” which is defined to mean:

“to obtain information on a protected computer”;
“that the accesser lacks authorization to obtain”; and
“by knowingly circumventing one or more technological or physical measures that are designed to exclude or prevent unauthorized individuals from obtaining that information.”

For a well-documented discussion of the application and boundaries of the CFAA, check out the Electronic Frontier Foundations Legal Treatise on civil and criminal cases involving the Computer Fraud and Abuse Act here.

As businesses become ever more dependent on digital assets and systems, a working knowledge of the legal and regulatory framework that defines and protects those assets is paramount.

If you or your executive teams has questions about securing and protecting digital assets, please feel free to contact David M. Adler for a free consultation. LSGA advises a wide range of businesses on creating, protecting and leveraging digital assets as well as computer, data and information security and privacy.

Please tweet, comment on, and forward is article!

David M. Adler | Adler Law Group
300 Saunders Road, Suite 100
Riverwoods, Illinois 60015
Toll free Phone: (866) 734-2568
http://www.ecommerceattorney.com

*2015 Illinois Super Lawyer http://bit.ly/gFfpAt

Twitter: http://twitter.com/#!/adlerlaw
LinkedIn: http://linkedin.com/in/adlerlaw

In U.S. Regulators, Legislators Fill Privacy Void

Over the last few years privacy, and the lack of comprehensive protection, have made numerous headlines. From overly inquisitive mobile applications that fail to disclose how cell photo data is accessed and shared (Path) to handset manufacturers failures to properly inculcate privacy in the design and manufacturing process (HTC) to security lapses at government databases resulting in exposure of sensitive personal information (South Carolina), consumers, regulators and legislators are waking up to privacy issues.

Recent developments highlight the trend in Privacy

In the U.S. we lack a single comprehensive privacy law, although many state and federal laws address various aspects of collecting, storing and sharing personal information. In the absence of a single, over-arching, mandate, legislators and regulators are stepping into fill at perceived need.

GPS, Location & Privacy

The Geolocation Privacy and Surveillance (GPS) Act addresses use of location data by law enforcement. The bill (not yet law) requires police to obtain a warrant based on probable cause whenever it seeks “location information.” Unfortunately, the term “location information” is very broadly defined, does not distinguish requests for access based on the level of precision, time period, or whether the information is for past or future conduct.

Proposed Federal Privacy Standards

Two bills introduced this year aim to create a baseline level of privacy protection at the federal level. John Kerry (D-MA) and Sen. John McCain (R-AZ) introduced S. 799, the Commercial Privacy Bill of Rights Act of 2011, to create a regulatory framework for the comprehensive protection of personal data for individuals, enforceable by the Federal Trade Commission (FTC). Similarly, Rep. Cliff Stearns (R-FL) is promoting a Consumer Privacy Protection Act (H.R.1528), directed at consumers and focused on restricting the sale or disclosure of personal information.

FTC Protects Privacy Under Mantle of Consumer Protection

As a result of alleged data security failures that led to three data breaches at Wyndham hotels in less than two years, the Federal Trade Commission filed suit against hospitality company Wyndham Worldwide Corporation. The case against Wyndham is part of the FTC’s ongoing efforts to make sure that companies live up to the promises they make about privacy and data security.

Wyndham’s web site privacy policy claimed that, “We recognize the importance of protecting the privacy of individual-specific (personally identifiable) information collected about guests, callers to our central reservation centers, visitors to our Web sites, and members participating in our Loyalty Program …”

The FTC complaint alleges that Wyndham failed to maintain adequate and industry standard security measures by storing credit-card information in unencrypted format, allowing servers to remain unpatched, and failing to use firewalls.

The FTC alleges that these failures led to fraudulent charges on consumers’ accounts, millions of dollars in fraud loss, and the export of hundreds of thousands of consumers’ payment card account information to an Internet domain address registered in Russia.

Most notably, the lawsuit will test whether the Federal Trade Commission has the jurisdiction to compel companies to provide a certain level of cybersecurity in order to safeguard consumer personal information.

Privacy Remains Top Concern

Many companies across many industries, financial services, higher education and healthcare, just to name a few, are facing a wide range of security and privacy concerns, scrambling to implement A defensible security framework and demonstrate compliance. It’s alarming, considering the significant consequences associated with not complying.

Organizations can lose contracts, customers and their reputation. That could put some out of business.

Compliance Preparation & Best Practices

Large organizations can spend many months and millions of dollars on compliance. Your business need not go to such extremes. To prevent getting caught by surprise and to prepare for the compliance journey, I’ve listed below some suggested best practices.

Periodic risk assessments. Evaluate potential damage and disruption caused by unauthorized access, use, disclosure, modification, or destruction of data or systems.

Policies and procedures. Incorporate procedures for detecting, reporting, and responding to security incidents, as well as business continuity plans.

Standardize. Set standards of acceptable information security for networks, facilities, and information systems.

Train Employees. Awareness training for employees, contractors, and other users of information systems is critical. Articulate the security risks associated with activities and define users’ responsibility for complying with policies and procedures.

Test & Evaluate. Periodic assessment of the effectiveness of information security policies, procedures, practices, and controls helps determine weak spots. At a minimum they should be conducted annually, according to Ford.

Respond & Repair. Have a pre-defined process for planning, implementing, evaluating, and documenting remedial actions designed to address legal, PR, HR and related risks in the event of a breach.

THIS IS NOT LEGAL ADVICE. The procedures outlined above are merely suggestions and there is no guarantee that implementation will reduce risk or mitigate liability.

Please contact Leavens, Strand, Glover & Adler at 866-734-2568 for a free consultation to learn how LSGA can help meet your specific needs.

World #Tech #Startup News Roundup

Norway a Hard Place for Tech Startups
Wall Street Journal (blog)
And there are other reasons why Norway is inhospitable to tech startups, according to Lasse Andresen, the chief technology officer of ForgeRock, an online identity management company that shifted its headquarters from Norway to San Francisco last year.

South Korea to launch new stock market to support fund-raising for startups
Washington Post
SEOUL, South Korea — South Korea’s bourse operator says it is opening a new stock market to help startups raise money. Korea Exchange Vice Chairman Choi Hong-sik said Friday the July launch of the KONEX market is intended to incubate small businesses.

Galvanize, Denver Startup Week Win Plaudits from Denver’s Old Guard
Xconomy
Galvanize, the coworking space that’s quickly become the hub for Denver’s top tech startups, and Denver Startup Week both received awards from the Downtown Denver Partnership, one of Colorado’s largest economic vitality groups.

Online education startup EduKart raises $500K in seed funding
VC Circle
The startup was founded by Ishan Gupta (CEO) and Mayank Gupta (COO) (they are not related) in 2011. Ishan had earlier worked with companies like One97 Mobility Fund, Facebook, Helion Venture Partners, Quantum Hi-Tech and Appin Knowledge.

Canada Startup of the Week – Brightsquid
Calgary Herald
Lloyed Lobo covers Calgary’s tech startup community. He is a Partner at Boast Capital and the VP of Community Evangelism at Startup Calgary. If you are working on something that could potentially change the world, we’d like to hear about it.

Life in a chocolate factory versus life in a startup
Boing Boing
Elaine Wherry took a break from working in San Francisco high-tech startups to work at Dandelion Chocolate, the chocolate maker/cafe that her husband co-founded. She calls her tenure at the chocolate factory her life as “an Oompa Loompa.”

Incubator NEST Investments Wants To Help Hong Kong’s Fledgling Startup Industry
TechCrunch
Though Hong Kong is one of the world’s leading financial hubs, its startup industry is still embryonic. Incubator NEST Investments hopes to change that by helping tech companies take advantage of the region’s wealth and resources as they work toward entering the mainland Chinese market.