Proposed Amedments To Computer Fraud & Abuse Act

Enacted by Congress in 1986, the Computer Fraud and Abuse Act (CFAA) builds upon existing computer fraud law (18 U.S.C. § 1030). Initially, the CFAA was intended to limit federal jurisdiction to cases “with a compelling federal interest-i.e., where computers of the federal government or certain financial institutions are involved or where the crime itself is interstate in nature.” Notably, the CFAA criminalized certain computer-related acts such as distribution of malicious software code, propagating denial of service attacks as well as trafficking in passwords and similar items. Recently, the CFAA has gained prominence as a bludgeon used to prosecute a wide-range of activities, some broadly labelled “hacking” and other stretching the boundaries of “unauthorized” computer access.

Two recently introduced bills, one by Representative Zoe Lofgren (D-CA) in the House and one by Senator Ron Wyden (D-OR) in the Senate aim to amend the CFAA in hopes of ameliorating application of the CFAA to claims of breach of terms of service, employment agreements. Additionally, with the nickname “Aaron’s Law,” they also seek to limit what some see as the CFAA’s tendency to allow for overzealous prosecution that they claim characterized Aaron Swartz’s case.

In short the bills would amend the meaning of “exceeds authorized access,” changing it to “access without authorization,” which is defined to mean:

“to obtain information on a protected computer”;
“that the accesser lacks authorization to obtain”; and
“by knowingly circumventing one or more technological or physical measures that are designed to exclude or prevent unauthorized individuals from obtaining that information.”

For a well-documented discussion of the application and boundaries of the CFAA, check out the Electronic Frontier Foundations Legal Treatise on civil and criminal cases involving the Computer Fraud and Abuse Act here.

As businesses become ever more dependent on digital assets and systems, a working knowledge of the legal and regulatory framework that defines and protects those assets is paramount.

If you or your executive teams has questions about securing and protecting digital assets, please feel free to contact David M. Adler for a free consultation. LSGA advises a wide range of businesses on creating, protecting and leveraging digital assets as well as computer, data and information security and privacy.

Please tweet, comment on, and forward is article!

David M. Adler | Adler Law Group
300 Saunders Road, Suite 100
Riverwoods, Illinois 60015
Toll free Phone: (866) 734-2568
http://www.ecommerceattorney.com

*2015 Illinois Super Lawyer http://bit.ly/gFfpAt

Twitter: http://twitter.com/#!/adlerlaw
LinkedIn: http://linkedin.com/in/adlerlaw

In U.S. Regulators, Legislators Fill Privacy Void

Over the last few years privacy, and the lack of comprehensive protection, have made numerous headlines. From overly inquisitive mobile applications that fail to disclose how cell photo data is accessed and shared (Path) to handset manufacturers failures to properly inculcate privacy in the design and manufacturing process (HTC) to security lapses at government databases resulting in exposure of sensitive personal information (South Carolina), consumers, regulators and legislators are waking up to privacy issues.

Recent developments highlight the trend in Privacy

In the U.S. we lack a single comprehensive privacy law, although many state and federal laws address various aspects of collecting, storing and sharing personal information. In the absence of a single, over-arching, mandate, legislators and regulators are stepping into fill at perceived need.

GPS, Location & Privacy

The Geolocation Privacy and Surveillance (GPS) Act addresses use of location data by law enforcement. The bill (not yet law) requires police to obtain a warrant based on probable cause whenever it seeks “location information.” Unfortunately, the term “location information” is very broadly defined, does not distinguish requests for access based on the level of precision, time period, or whether the information is for past or future conduct.

Proposed Federal Privacy Standards

Two bills introduced this year aim to create a baseline level of privacy protection at the federal level. John Kerry (D-MA) and Sen. John McCain (R-AZ) introduced S. 799, the Commercial Privacy Bill of Rights Act of 2011, to create a regulatory framework for the comprehensive protection of personal data for individuals, enforceable by the Federal Trade Commission (FTC). Similarly, Rep. Cliff Stearns (R-FL) is promoting a Consumer Privacy Protection Act (H.R.1528), directed at consumers and focused on restricting the sale or disclosure of personal information.

FTC Protects Privacy Under Mantle of Consumer Protection

As a result of alleged data security failures that led to three data breaches at Wyndham hotels in less than two years, the Federal Trade Commission filed suit against hospitality company Wyndham Worldwide Corporation. The case against Wyndham is part of the FTC’s ongoing efforts to make sure that companies live up to the promises they make about privacy and data security.

Wyndham’s web site privacy policy claimed that, “We recognize the importance of protecting the privacy of individual-specific (personally identifiable) information collected about guests, callers to our central reservation centers, visitors to our Web sites, and members participating in our Loyalty Program …”

The FTC complaint alleges that Wyndham failed to maintain adequate and industry standard security measures by storing credit-card information in unencrypted format, allowing servers to remain unpatched, and failing to use firewalls.

The FTC alleges that these failures led to fraudulent charges on consumers’ accounts, millions of dollars in fraud loss, and the export of hundreds of thousands of consumers’ payment card account information to an Internet domain address registered in Russia.

Most notably, the lawsuit will test whether the Federal Trade Commission has the jurisdiction to compel companies to provide a certain level of cybersecurity in order to safeguard consumer personal information.

Privacy Remains Top Concern

Many companies across many industries, financial services, higher education and healthcare, just to name a few, are facing a wide range of security and privacy concerns, scrambling to implement A defensible security framework and demonstrate compliance. It’s alarming, considering the significant consequences associated with not complying.

Organizations can lose contracts, customers and their reputation. That could put some out of business.

Compliance Preparation & Best Practices

Large organizations can spend many months and millions of dollars on compliance. Your business need not go to such extremes. To prevent getting caught by surprise and to prepare for the compliance journey, I’ve listed below some suggested best practices.

Periodic risk assessments. Evaluate potential damage and disruption caused by unauthorized access, use, disclosure, modification, or destruction of data or systems.

Policies and procedures. Incorporate procedures for detecting, reporting, and responding to security incidents, as well as business continuity plans.

Standardize. Set standards of acceptable information security for networks, facilities, and information systems.

Train Employees. Awareness training for employees, contractors, and other users of information systems is critical. Articulate the security risks associated with activities and define users’ responsibility for complying with policies and procedures.

Test & Evaluate. Periodic assessment of the effectiveness of information security policies, procedures, practices, and controls helps determine weak spots. At a minimum they should be conducted annually, according to Ford.

Respond & Repair. Have a pre-defined process for planning, implementing, evaluating, and documenting remedial actions designed to address legal, PR, HR and related risks in the event of a breach.

THIS IS NOT LEGAL ADVICE. The procedures outlined above are merely suggestions and there is no guarantee that implementation will reduce risk or mitigate liability.

Please contact Leavens, Strand, Glover & Adler at 866-734-2568 for a free consultation to learn how LSGA can help meet your specific needs.

Three Things I Learned About Personal Cybersecurity At RSAConference That You Should Be Doing Right Now

Image representing CloudFlare as depicted in C...
Image via CrunchBase

I just returned from RSAConference 2013 where I had the privilege and honor of giving a presentation of the legal risks caused by social media in the workplace. As a speaker-attendee, I had the priceless benefit of access to all the other speakers and programs held during the conference.

One such program I attended was “We Were Hacked: Here’s What You Should Know”. The speakers, Matthew Prince (@eastdakota) CEO of CloudFlare, and Mat Honan (@mat) writer for Wired Magazine, shared their common experience as targets of high profile hacks. Hearing the details from them first hand, including information from interviews with the hackers themselves, I learned how easy it is to be the victim of hacking and how it’s the little things that create exploitable seams in our information security barriers.

Rather than rewrite their stories, I thought I would share three simple lessons I learned that I’ve already implemented and you should too. Besides, Matt does a better job telling his own story which can be found here.

Here are the three things I learned about how you can protect yourself and others in your organization.

First, security attacks go after the “low hanging fruit” and that often means figuring out a way to exploit your personal email address. With so many web-based services and so much login information to remember, many of us use our personal email as our username for everything from the web sites on which we comment, to our online photo gallery, to our online banking service. Unfortunately, this is probably the address we use for password recovery if we forget. Given that our digital lives are easily mapped, hackers already have one piece of the two-piece login puzzle: they know your user name.

TIP NO. 1: Use a private, obscure email address for your more sensitive information.

Second, once a hacker has accessed your accounts, your computer and your files, the fun has just begun for them. As Matt Honan described, these often adolescent script kiddies simply don’t understand the value of your stored memories and other information. In his case, all the photos of his children were permanently deleted. Regardless of a hacker attack, stuff happens and you don’t want to lose everything because you we’re too lazy to back up.

TIP NO. 2: Back Up your digital life, early and often.

Third, today’s’ Internet is an interdependent ecosystem. Just because you or your organization takes security seriously, doesn’t mean that other do as well. Your internal systems are not enough. Like it or not, the seams of your security perimeter are intertwined and permeated by the services and systems of customers and vendors. For most consumers, the there is a Hobbesian choice of Security v. Convenience. Multiple login usernames and super long passwords are difficult to remember and tedious to use. As a result, most people choose the least secure means of authentication on the assumption that using astringent password is enough. Unfortunately, some people don’t even bothers with that. A recent ZoneAlarm study found that “password” was the fourth most commonly used password by consumers.

Google, Facebook and others have started using two-factor authentication. Two-factor authentication requires that one enter a code after entering the username/password combo. The code is sent via, text message, voice call or email. This greatly reduces the chances of unauthorized access because hackers would need to have your phone, in addition to your username/password combo.

TIP NO. 3: Whenever possible enable two-factor authentication.

Please understand that there is no “magic bullet” when it comes to Cybersecurity. Taking these precautions does not guarantee that you won’t be attached or that your account information won’t be accessed. However, these are important and easy steps that you can take to improve your personal data security.

Please comment and follow!

 

World Information, Data & Cyber Security News & Legal Roundup

German cybersecurity agency prods users to ditch IE

Computerworld – Germany’s cybersecurity agency on Monday urged users to drop Internet Explorer (IE) and switch to a rival, like Chrome or Firefox, until Microsoft patches a new critical bug in its browser.

Democratic senators call for ‘cybersecurity’ executive order
CNET

Senators call for ‘cybersecurity’ executive order. This summer’s partisan sparring that derailed a federal cybersecurity law has resumed, with Democrats proposing an executive order and Republicans saying it would levy “more mandates.”

Cybersecurity scholarships to be offered
UPI.com

“The nation is in dire need of people who are capable of handling the cybersecurity challenges we face,” professor of computing and information sciences Xinming “Simon” Ou said. “We are lagging behind in the number of experts we have versus the threats.

Cybersecurity: Kay Bailey Hutchison condemns Obama’s ‘heavy handed …
Houston Chronicle (blog)

Amid escalating partisan rhetoric over the bipartisan goal of protecting U.S. computer systems from terrorist attacks, Texas Kay Bailey Hutchison criticized President Obama for a “heavy handed, regulatory regime” that would be created.

National Cyber Security Alliance Announces Theme for Data Privacy Day
The Herald | HeraldOnline.com

18, 2012 /PRNewswire-USNewswire/ — The National Cyber Security Alliance (NCSA), a non-profit public-private partnership focused on helping all digital citizens stay safer and more secure online and official coordinator of Data Privacy Day (DPD), today …

When it comes to cybersecurity law, where do we draw the line?
ZDNet

Over the past few years, the Obama administration and Congress have taken a variety of legislative runs at creating comprehensive cybersecurity law. See Also: How cybersecurity is like Star Trek’s transporter.

Cyber security biggest challenge for universal credit, says David Freud
ComputerWeekly.com

Cyber security is the biggest challenge for the government’s universal credit roll-out, welfare reform minister David Freud has told a select committee. Speaking to a select committee, pensions minister Ian Duncan Smith said government had consulted …

NetLib teams with CIS to fight cyber security
Mass High Tech

Neil Weicher wants to win the battle in cyber security. NetLib, a Stamford, Conn.-based provider of encryption software founded by Weicher, has partnered with the Center for Internet Security, a non-profit focused on cyber security readiness.

UK spy agency tests Britons’ cyber skills
Reuters

The Government Communications Headquarters (GCHQ) said those aged 16 or over and not already working in cyber security could apply to test their ability to guard a computer network but only 150 contestants at most would be eventually allowed.

Former FBI Cybersecurity Official Steven Chabinsky Thinks FBI is Doing Great …
ticklethewire.com

The FBI’s former top attorney for cybersecurity, Steven Chabinsky, who stepped down this month, thinks the FBI is doing a great job battling the problem, but told the Washington Post that the “federal government” has taken a “failed approach”.

Social Media Legal News Roundup

1. Content & Marketing

MutualMind Signs Agreement With LexisNexis to Offer Advanced Social Media
MarketWatch (press release)

PRNewswire via COMTEX/ — MutualMind, an award-winning social media technology developer based in Dallas, Texas, announced an agreement today with LexisNexis, a leading provider of legal content and technology solutions.

Facebook: Should Law Firms Bother?
Business 2 Community

While consumer brands have embraced Facebook as a key tool in building deeper customer engagement, the biggest social network largely remains terra incognita in the legal world. The sector has certainly harnessed professional networking sites.

2. International

Bahrain may act against social media abuse
Trade Arabia

Legal action could be taken against people in Bahrain, who incite violence and spread sectarianism on social media, said a top official. The initiative comes as a new code of honour for social media users is set to be launched by the Bahrain Bloc.

3. Law Enforcement

Infographic: How police investigators are using social media
Police News

An overwhelming majority of investigators using social media for investigative purposes are “self taught,” according to a new survey of 1200 Federal, state, and local law enforcement professionals.

Social media for investigators: Why Police departments should invest in training
Police News

That’s but one of the many conclusions found in a comprehensive new survey — conducted in a partnership between PoliceOne and LexisNexis Risk Solutions — focused on the impact of social media on law enforcement in criminal investigations. Among the …

4. Employees & Workplace

What your social media profile is telling future employers? (Take our poll)
Plain Dealer

The State of Maryland already has passed a law forbidding employers from asking job candidates for their passwords to Facebook and other social media sites, and California is considering a similar law. 01fgSCREEN2.jpg View full size · The Society for …

Social Media in the Workplace – July 2012
JD Supra (press release)

With an understanding of some of the relevant issues, employers can implement meaningful and reasonable policies and guidelines for employees and respond appropriately and legally to social media issues that arise. Below are a few of the discrete issues …

5. Financial Services

Quest IRA, Inc. Develops New Interactive Website & Social Media Campaign
Equities.com

The trick for us is trying to provide legally correct information, in such a way that is easy to understand, to the American public so that investors truly understand their options with retirement savings.” “Internet, the online experience and social media are the 21st Century.”

The New Social Metrics
Bank Technology News

Below are methodologies and metrics for determining the ROI of these specific social media use cases. The metrics roll up to three major categories of benefits: revenue impact, operational efficiencies, and legal and compliance risk avoidance.

David M. Adler, Esq. is an attorney, author, educator, entrepreneur and partner with Leavens, Strand, Glover & Adler, LLC, a boutique law firm in Chicago, Illinois created with a specific mission: provide businesses with a competitive advantage by enabling them to leverage their intangible assets and creative content in order to drive innovation and increase overall business value.

We meet this challenge by providing legal counsel on issues related to creation, protection and commercialization of intangible assets, our comprehensive understating of the relevant law, our team of seasoned professionals and our client service philosophy.

World Social Media Legal News Roundup

Newsmakers Q&A | Law slow to address workers’ social-media privacy
Columbus Dispatch

Colorado shooting: Public calls on Christian Bale to swoop in
Los Angeles Times

July 21, 2012, 12:04 p.m.. People are calling upon the caped crusader in the wake of the Colorado theater shooting with the 21st century bat signal: social media.

Afghan social media war steps up with new campaign
Reuters UK

And with the government mulling a media law to tighten its grip over the fledgling but lively Afghan press corps, Nai hoped social media could help safeguard political and social freedoms, as occurred during the wave of uprisings across the Middle East.

A social media win on merger
Philadelphia Inquirer

It’s a bracing lesson, on a local stage, in the power of social media to create community around an issue and ratchet up pressure on key players – in this case, the members of the Abington board and its president and CEO, Laurence Merlis. “It’s amazing to me just how fast word spread,” …. A community-conscious and activist community, with a high concentration of concerned, committed people who work in industries such as law, medicine, public relations, and journalism.

Valley reacts via social media regarding Colorado shooting
KGBT-TV

Once new information began streaming in about the shooting, over 100 viewers began responding to the Action 4 News Facebook page and Twitter feed. As the day progressed, over 500 comments came into valleycentral.com andAction 4 social media

Media Wise Parents to the rescue
Windsor This Week
Media Wise Parents helps parents, educators and churches become more aware with social media and the internet. Tweet · Bookmark and … It’s certainly in my background with law and marketing, it’s always something that interests me.

We Want To Hear From You: Take This Two-Minute Social Media Survey
Business Insider

This Is The Gun Used In The Colorado Shooting That Everyone Can’t Believe Is Actually Legal

In Focus: Social Media & Law Enforcement

Busted! Police Turn to Social Media to Fight Crime
CNBC.com (blog)

Law enforcement is taking to social media because criminals are changing their behavior and using social media to facilitate crime. In response, law enforcement officials are using it to track down criminals and as a predictive policing tool, said Haywood.

Role of Social Media in Law Enforcement Significant and Growing
Business Wire (press release)

WASHINGTON–(BUSINESS WIRE)–LexisNexis® Risk Solutions today announced the results of a comprehensive survey focused on the impact of social media on law enforcement in criminal investigations.

Police Make Wide Use Of Social Tools
InformationWeek (blog)

The survey, of more than 1200 law enforcement professionals with federal, state, and local agencies, found that 83% of the respondents are using social media, particularly Facebook and YouTube, to further their investigations.

Crime Busters Embrace Social Media
BusinessNewsDaily

It’s not just prospective customers, partners or employers who may be scanning the social media landscape to glean information about you and your organization. The long arm of the law has joined the party as well, a new survey shows.

How Law Enforcement Is Using Social Media (Infographic)
Law enforcement officials are using social media to solve crimes and will continue to do so in greater numbers. In an online survey conducted by LexisNexis Risk Solutions, four out of five law enforcement officials used social media.

Privacy Legal News Roundup

Trying to beat the heat? Peruse these top Privacy stories from around the web.

The Internet needs its own ‘declaration of independence’
Christian Science Monitor
A new ‘Declaration of Internet Freedom’ should spark a much-needed discussion about online rights and privacy.

Homeowners Bill of Rights passes in California
Examiner.com
According to Assembly Speaker John Perez (D-Los Angeles), the key provisions of the Homeowners Bill of Rights legislation include: “a requirement that a person or team of persons employed by a lender to be a single point of contact for the homeowner.

Facebook Joins California Mobile App Privacy Program
InformationWeek
California launched its mobile app privacy program in February 2012, just one day before the White House announced its proposed Consumer Privacy Bill of Rights. From the outset, the state announced that the six companies with the biggest mobile app …

How California’s New Homeowners’ Bill Of Rights Protects Against Wrongful Foreclosures.
ThinkProgress
The “Homeowners’ Bill of Rights,” pushed by state Attorney General Kamala Harris (D), aims to extend to the state level many of the protections ensured by the mortgage fraud settlement between six big banks and the federal government and states.

Descendants of the signers to read the Declaration of Independence on July 4
American Civil Liberties Union News and Information (blog)
“My professional career has been dedicated to advancing people’s rights and liberties as outlined in the Declaration and in the Constitution and its Bill of Rights,” said Murphy, the Director of the American Civil Liberties Union’s Washington …

Independence Day: Ghosts of SCOTUS on the fundamental right to privacy
Network World
While the Constitution may not specifically state the right to privacy, the Bill of Rights most assuredly protects aspects of privacy. In 1965, the Supreme Court ruled 7-2 on the landmark case, Griswold v. Connecticut, and the Justices referenced the …

Cash-Strapped Consumer And Privacy Groups Petition Commerce Dept For Better Participation.
techPresident
That’s the department that’s organizing the workshops that are meant to convene all U.S. stakeholders to develop a code of conduct to implement the administration’s Privacy Bill of Rights. The first workshop is taking place inside the Beltway on July …

Why Kansas City is getting Internet 100 times faster than everyone else
Alaska Dispatch
Yesterday, an impressive coalition of companies and Internet and human rights activists endorsed a Declaration of Internet Freedom that aims to start a discussion about the basic principles that should underlie online access. Among the 20000 groups or …

Celebrate your independence: You have rights as a taxpayer
Savannah Morning News
Years after the War the Bill of Rights was drafted and 10 amendments were added to our Constitution. … Privacy and confidentiality: The IRS may not discuss any of the facts and information given to them with anyone except in accordance with the law.

Do you have information or data privacy and security concerns? Contact David Adler at Leavens, Strand, Glover & Adler for a free consultation.