Saturday, October 06, 2018

MIRLN --- 16 Sept - 6 Oct 2018 (v21.13)

MIRLN --- 16 Sept - 6 Oct 2018 (v21.13)

permalink

ANNOUNCEMENTS | NEWS | RESOURCES | LOOKING BACK | NOTES

ANNOUNCEMENT

MIRLN began in 1997 and I've have published around 250 times, using an evolving, idiosyncratic approach to stories (not too new, not too obvious, etc.), with an idiosyncratic cross-section of readers (steady at about 3000: techies, lawyers, judges, international types, people in the IC, two former US AGs, etc.). This year probably will be MIRLN's last. (With curated Twitter/RSS feeds you may not miss it at all.) It's been fun; thanks for reading!

NEWS

2018 corporate counsel breach statistics - prepare to groan (RideTheLightning, 17 Sept 2018) - Here's the news in a nutshell: Data breaches of in-house legal departments have doubled in the last year. Assuming that elicited a groan, the source is the 2018 survey by the Association for Corporate Counsel , which reported one-third of in-house counsel offices experienced a data breach in 2017, up from 15 percent in 2016. A related recent ABA Journal article quoted Sterling Miller, general counsel of Marketo Inc., an online marketing technology company: "The possibility that your outside law firm could be breached and your sensitive data stolen is a huge nightmare for in-house lawyers. Outside counsel need to start taking this very seriously. If a breach happens, that law firm is probably no longer working for you and the malpractice claim could be very large." It doesn't really matter whether you are in-house or outside counsel - the odds are that you need to up your security game. That ABA article analyzed the ABA TechReport 2017 and found that "only 26 percent of responding firms had an incident response plan in place to address a security breach, and only two-thirds with 500 lawyers or more had such a plan in place. These plans were not a priority with smaller firms, as 31 percent of firms with 10 to 49 lawyers, 14 percent of firms with two to nine lawyers, and 10 percent of solo practices had such plans."

Roca Labs' anti-review clause violates FTC Act-FTC v. Roca Labs (Eric Goldman, 17 Sept 2018) - Good news: a court ruled that Roca Labs anti-review clause violates the law. It's shocking that Roca Labs chose to defend this practice in court, so it's not surprising that the judge didn't endorse it. Bad news: the court relied on the "unfairness" prong of the FTC Act, and the FTC's unfairness authority can be the basis of FTC overreaching. Good news: the Consumer Review Fairness Act will apply to future cases (this case was initiated before the CRFA's effectiveness), so this topic won't require the FTC to stretch its unfairness authority in the future. Thus, this case reinforces the prevailing wisdom: anti-review clauses are legally toxic; they don't belong in any business' toolkit; and if your contract still contains them, shame on you. * * *

When art created by artificial intelligence sells, who gets paid? (Artsy.net, 17 Sept 2018) - Christie's will auction off an artificial intelligence (AI) artwork for the first time this October, hard on the heels of a pioneering all-AI art exhibition held at New Delhi gallery Nature Morte . While the market is eager to move the work, the field raises questions about ownership, obsolescence, and the art world jobs that algorithms can't do. Many makers of AI art use generative adversarial networks (GANs), technology that allows a computer to study a library of images or sounds, make its own content according to what it has learned, test its own success against the original media, and then try again, improving incrementally through trial and error. The artworks resulting from this back-and-forth between two artificial neural networks-which include prints on paper, videos, and multimedia installations-are often disquietingly lifelike, the flora and fauna of the uncanny valley. Munich-based Mario Klingemann, for instance, trained an algorithm on portraits of Old Masters paintings before exposing it to webcam footage of himself. The process results in a video of melting, many-eyed grotesques that are often compared to the works of Francis Bacon . * * * In press materials for "Gradient Descent," Nature Morte stated that the works are created "entirely by AI in collaboration with artists." Obvious even signed their work with the mathematical equation for the algorithm they used, rather than the collective's name. As much as artists and gallerists may enjoy attributing authorship to AI, and emphasize that they cannot anticipate just what an AI algorithm will produce, legally, there is no doubt as to whether it's the human artist or the AI who owns the finished work. AI is simply a tool artists use, the way a photographer uses a camera or Adobe Photoshop in the creation of their images, says Jessica Fjeld, assistant director of the Cyberlaw Clinic at Harvard Law School. "Humans are deeply involved with every aspect of the creation and training of today's AI technologies, and this will continue to be true tomorrow and for the foreseeable future," Fjeld says. "For me, the far more interesting question is who among these people acquire rights in the outputs, not whether the software itself could have any claim of ownership," she adds.

Congressional Research Service reports now officially publicly available (TechDirt, 18 Sept 2018) - For many, many years we've been writing about the ridiculousness of the Congressional Research Service's reports being kept secret . If you don't know, CRS is a sort of in-house think tank for Congress, that does, careful, thoughtful, non-partisan research on a variety of topics (sometimes tasked by members of Congress, sometimes of its own volition). The reports are usually quite thorough and free of political nonsense. Since the reports are created by the federal government, they are technically in the public domain, but many in Congress (including many who work at CRS itself) have long resisted requests to make those works public. Instead, we were left with relying on members of Congress themselves to occasionally (and selectively) share reports with the public, rather than giving everyone access to the reports. Every year or so, there were efforts made to make all of that research available to the public, and it kept getting rejected . Two years ago, two members of Congress agreed to share all of the reports they had access to with a private site put together by some activists and think tanks, creating EveryCRSReport.com , which was a useful step forward . At the very least, we've now had two years to show that, when these reports are made public, the world does not collapse (many people within CRS feared that making the reports public would lead to more political pressure). Earlier this year, in the Consolidated Appropriations Act of 2018 , there was a nice little line item to officially make CRS reports publicly available . And, this week, it has come to pass. As announced by Librarian of Congress Carla Hayden , there is now an official site to find CRS reports at crsreports.congress.gov . It appears that the available catalog is still limited, but they're hoping to expand backwards to add older reports to the system (a few quick test searches only shows fairly recent reports). But all new reports will be added to the database.

Philippa Ryan: Developing trust through blockchain (ABA Journal, 19 Sept 2018) - Philippa Ryan thinks a lot about trust. A barrister in Australia, she lectures on the subject, and her PhD thesis focused on the breach of trust and the liability of third parties. So when Ryan heard about trustless relationships enabled by blockchain technology, her interest was piqued. However, when she typed "trustless relationships" into her search engine, she says, "the only thing that came up was an ad for Ashley Madison," the notorious dating website for married people looking to keep infidelity discreet. She deleted her search history. Today, Ryan, a lecturer at the University of Technology Sydney, can find more suitable material online. In fact, she's helping fill the gap by writing and speaking around the world on the subject. With knowledge in law and blockchain, she is a leading member of the International Organization for Standardization technical committee on blockchain and distributed ledger technologies. Being a part of Standards Australia and the committee's secretariat, she says the work intends to produce high-level guidelines for governments and technologists to use when legislating or developing the technology around the globe. "What we will be hoping to support is interoperability" between technical and legal systems, says Ryan, 52, who also leads the smart contracts working group at the ISO alongside a German delegation.

- and -

Walmart is betting on the blockchain to improve food safety (TechCrunch, 24 Sept 2018) - Walmart has been working with IBM on a food safety blockchain solution and today it announced it's requiring that all suppliers of leafy green vegetable for Sam's and Walmart upload their data to the blockchain by September 2019 . Most supply chains are bogged down in manual processes. This makes it difficult and time consuming to track down an issue should one like the E. coli romaine lettuce problem from last spring rear its head. By placing a supply chain on the blockchain, it makes the process more traceable, transparent and fully digital. Each node on the blockchain could represent an entity that has handled the food on the way to the store, making it much easier and faster to see if one of the affected farms sold infected supply to a particular location with much greater precision. * * *

- and -

Blockchains for Business Process Management (Cebe's KIT, 1 Oct 2018) - This title is probably a good way to describe most non-cryptocurrency applications of distributed ledgers, and deserves to be adopted. It is the title of a paper (the full title is " Blockchains for Business Process Management -- Challenges and Opportunities "), co-authored by a record 32 researchers and published in the February 2018 the ACM Transactions on Management Information Systems (TMIS). The authors summarize their conclusions as follows: "The BPM and Information Systems communities have a unique opportunity to help shape this fundamental shift toward a distributed, trustworthy infrastructure to promote interorganizational processes."

Law firms can learn from other industries' missteps on cybersecurity awareness and prevention (ABA Journal, 19 Sept 2018; part of the Digital Dangers series) - Equifax. Yahoo. Anthem. Sony. In the past few years, these companies experienced some of the most significant data breaches to date. And all of these companies found themselves subject to intense worldwide media coverage over their failure to secure their information. The industries affected-from health care to entertainment-know all too well that the struggle to secure data in the digital age never ends. While individual businesses within these industries will continue to find themselves vulnerable to breaches, they have an advantage over law firms. They have been fighting this battle for a long time. The legal industry is lagging well behind when it comes to data security, says Rich Santalesa, a member of the boutique cybersecurity firm SmartEdgeLaw Group and of counsel to the New York City-based Bortstein Legal Group. "Law firms as a whole can learn a lot about cybersecurity by looking at other industries," says Santalesa. "Unfortunately, other industries have had to learn their lessons the hard way-by having breaches that have received media attention." Santalesa says data security involves three different, simultaneous focuses: "the technology, the people you have, and needs of the industry in which you work." In addition, data security can't be a one-size-fits-all situation. The cybersecurity needs of a small law firm will be different than the needs of an international firm, just like the needs of Target are different from the needs of a small retail website. However, all law firms, just like all businesses, must pay close attention to the applicable privacy laws, Santalesa says.

- and -

Cybersecurity: Your ethical obligations outlined by legal tech experts (ABA Journal, 25 Sept 2018) - Data breaches are an everyday event, and legal professionals have a specific obligation to protect themselves and their clients from exposure to these threats. The webinar "Darkest Hour? Shining a Light on Cyber Ethical Obligations," is one in a five-part series sponsored by the ABA Cybersecurity Task Force and supported by "The ABA Cybersecurity Handbook: A Resource for Attorneys, Law Firms, and Business Professionals, Second Edition." The first thing lawyers must know is that it's not usually obvious when a firm has been hacked. "The vast majority of the time, (hackers) are using your stolen credentials, as opposed to breaking through technical walls," said panelist Arlan McMillan, chief security officer at Kirkland & Ellis in Chicago. "Then they act like you in the firm's network, accessing all the files you have access to." Another common threat comes through malware in an email, also known as a phishing attack, where an individual is asked to click on a link or open an attachment that has been weaponized in such a way that the attacker gains access to your computer. Nation-state attackers target private businesses in 21 percent of breaches to steal data to advance their espionage activities or interests. And firm employees often don't realize they've been hacked for weeks or months, and they usually find out after being contacted by the FBI. "This is not an IT issue," McMillan said. "This is a risk management issue about how you protect your data." He recommends five steps to improve a firm's security posture: * * *

- and -

Teaming up on cybersecurity (AttorneyAtWork, 26 Sept 2018) - Cybersecurity, the new "IT" word (see what we did there?) has everyone's attention, from small firm lawyers to the BigLaw front office. It's also the focus of the 2018 College of Law Practice Management (COLPM) Futures Conference, "Cybersecurity: This Way There Be Dragons." The Futures Conference, presented with Suffolk University School of Law, will take place Oct. 25-26 in Boston. While the two-day event is chock-full of useful information, one session in particular caught my attention: "Security as a Team Sport: Collaboration - An Essential Tool and a Security Hole." It raises an interesting question: Can all the departments that make up a law firm advance its cybersecurity efforts? Not just IT, but management, finance, human resources, marketing, PR?

Interplanetary spacecraft (Patently-O, 23 Sept 2018) - Patent application publication US 2017/0259946 A1 * * * I'm looking forward to reading the first office action in this case - pretty cool approach for thinking through how to use a hollowed-out asteroid for a manned interplanetary spaceship. In his IDS, inventor Wayne White includes a set of interesting references - including a citation to the Greg Bear's 1985 SciFi novel EON that included an alien hollowed-out asteroid.

Do laws requiring people to report crimes violate the First Amendment? (Eugene Volokh, 26 Sept 2018) - Generally speaking, Americans don't have a legal duty to report crimes they witness or learn about. We must generally testify when subpoenaed, but we need not ourselves alert the authorities. But some states have enacted statutes requiring such reporting (at least as to certain serious crimes); still more require certain job categories (such as teachers, whether in public or private schools) to report certain crimes. Do these laws violate the First Amendment protection against compelled speech? The Supreme Court has generally said that requiring people to say certain things is presumptively unconstitutional; and it has also held , in some contexts, that "compelled statements of 'fact'" are generally treated the same as "compelled statements of opinion." But requirements to convey facts to the government -- in tax returns, census questionnaires, draft registrations, and a vast range of other contexts, federal and state -- are so commonplace that it's not clear that the Supreme Court means to cast them all in doubt. (Recall that if something is treated as a presumptively unconstitutional speech compulsion, the government may rebut that presumption only by showing that the compulsion is the least burdensome means of serving a compelling government interest ; even if there is a compelling interest in collecting federal and state taxes, conducting the census, and so on, courts have never required a showing that the laws are the least burdensome means.) And indeed, when mandatory crime reporting laws have been challenged, state courts have upheld them, generally concluding that compelled reporting of facts to the government doesn't really trigger the compelled speech doctrine. See State v. Grover (Minn. 1989) ("The statute [which requires reporting of suspected child abuse] does not compel the dissemination of an 'ideological point of view,' but only mandates the reporting of information-a requirement not altogether dissimilar from that imposed by the Internal Revenue Code."); White v. State (Tex. Ct. App. 2001) (taking the same view). But in May of this year, the Second Circuit handed down a decision, Burns v. Martuscello , that suggests the laws are unconstitutional after all. In Burns , prison guards placed Burns in involuntary protective custody because he refused to agree to report on future misbehavior by other prisoners. And this penalty, the court held, violated the First Amendment right not to be compelled to speak, even taking into account prisoners' sharply reduced First Amendment rights:

SEC charges firm with deficient cybersecurity procedures (SEC, 26 Sept 2018) - The Securities and Exchange Commission today announced that a Des Moines-based broker-dealer and investment adviser has agreed to pay $1 million to settle charges related to its failures in cybersecurity policies and procedures surrounding a cyber intrusion that compromised personal information of thousands of customers. The SEC charged Voya Financial Advisors Inc. (VFA) with violating the Safeguards Rule and the Identity Theft Red Flags Rule, which are designed to protect confidential customer information and protect customers from the risk of identity theft. This is the first SEC enforcement action charging violations of the Identity Theft Red Flags Rule. According to the SEC's order, cyber intruders impersonated VFA contractors over a six-day period in 2016 by calling VFA's support line and requesting that the contractors' passwords be reset. The intruders used the new passwords to gain access to the personal information of 5,600 VFA customers. The SEC's order finds that the intruders then used the customer information to create new online customer profiles and obtain unauthorized access to account documents for three customers. The order also finds that VFA's failure to terminate the intruders' access stemmed from weaknesses in its cybersecurity procedures, some of which had been exposed during prior similar fraudulent activity. According to the order, VFA also failed to apply its procedures to the systems used by its independent contractors, who make up the largest part of VFA's workforce. "This case is a reminder to brokers and investment advisers that cybersecurity procedures must be reasonably designed to fit their specific business models," said Robert A. Cohen, Chief of the SEC Enforcement Division's Cyber Unit. "They also must review and update the procedures regularly to respond to changes in the risks they face."

Judging judges - how Gavelytics' judicial analytics are reshaping litigation (Robert Ambrogi, 28 Sept 2018) - What if a lawyer could know how a judge is likely to rule in a case or how heavy is a judge's workload? Rick Merrill was a litigator at a large law firm who became frustrated over his inability to get meaningful information about the judges before whom he appeared. So last year, he launched Gavelytics , a California company that uses analytics and artificial intelligence to analyze docket data and provide lawyers with a range of insights about judges' propensities, workloads and leanings. In this episode of LawNext, I visited Gavelytics' office in Santa Monica, where I sat down with Merrill, now the company's CEO, and Justin Brownstone , VP of sales and litigation counsel, to talk about the product one year after its launch, how lawyers use analytics for strategic and competitive purposes, and how analytics and AI are being used more broadly in law. * * *

New Zealand travellers refusing digital search now face $5000 Customs fine (RNZ, 1 Oct 2018) - Travellers who refuse to hand over their phone or laptop passwords to Customs officials can now be slapped with a $5000 fine. The Customs and Excise Act 2018 - which comes into effect today - sets guidelines around how Customs can carry out "digital strip-searches". Previously, Customs could stop anyone at the border and demand to see their electronic devices. However, the law did not specify that people had to also provide a password. The updated law makes clear that travellers must provide access - whether that be a password, pin-code or fingerprint - but officials would need to have a reasonable suspicion of wrongdoing. "It is a file-by-file [search] on your phone. We're not going into 'the cloud'. We'll examine your phone while it's on flight mode," Customs spokesperson Terry Brown said. If people refused to comply, they could be fined up to $5000 and their device would be seized and forensically searched.

- and -

More on the Five Eyes statement on encryption and backdoors (Bruce Schneier, 1 Oct 2018) - Earlier this month, I wrote about a statement by the Five Eyes countries about encryption and back doors. (Short summary: they like them.) One of the weird things about the statement is that it was clearly written from a law-enforcement perspective, though we normally think of the Five Eyes as a consortium of intelligence agencies. Susan Landau examines the details of the statement, explains what's going on, and why the statement is a lot less than what it might seem.

RESOURCES

ICYMI: The Cyber Threat to UK Legal Sector (Nat'l Cyber Security Centre, 19 July 2018) - In common with many other industries, the cyber threat to the UK legal sector is significant and the number of reported incidents has grown substantially over the last few years. According to the 2017 PricewaterhouseCoopers Law Firm survey, 60% of law firms reported an information security incident in the last year, up from 42% in 2014. The financial and reputational impact of cyber attacks on law firms is also significant. The costs arise from the attack itself, the remediation and repairing reputational damage by regaining public trust. The SRA reports that over £11 million of client money was stolen due to cyber crime in 2016-17. There are several factors that make law firms an attractive target for cyber attack - they hold sensitive client information, handle significant funds and are a key enabler in commercial and business transactions. The risk may be greater for law firms that advise particularly sensitive clients or work in locations that are hostile to the UK. For example, firms acting for organisations that engage in work of a controversial nature such as Life Sciences or the energy sector may also be targeted by groups with a political or ideological agenda. The move to offer legal services digitally will not only provide new opportunities but also further avenues for malicious cyber exploitation. The primary threat to the UK legal sector stems from cyber criminals with a financial motive. However, nation states are likely to play an increasingly significant role in cyber attacks at a global level, to gain strategic and economic advantage. There has also been some growth in the hacktivist community targeting law firms to achieve political, economic or ideological ends. The most significant cyber threats that law firms should be aware of are: * * *

LOOKING BACK - MIRLN TEN YEARS AGO

(note: link-rot has affected about 50% of these original URLs)

Oregon: Publishing our laws online is a copyright violation (Ars Technica, 16 April 2008) - The State of Oregon takes exception to Web sites that republish the state's Revised Statutes in full, claiming that the statutes contain copyrighted information in the republication causes the state to lose money it needs to continue putting out the official version of the statutes. Oregon's Legislative Counsel, Dexter Johnson, has therefore requested that legal information site Justia remove the information or (preferably) take out a paid license from the state. All citizens are legally presumed to know the law, so claiming copyright over it might seem like an odd position for a state to take; wouldn't massive copying be a goal rather than a problem? But in his letter to Justia, Johnson makes a more nuanced case. While the text of the law is not copyrighted, the "arrangement and subject-matter compilation of Oregon statutory law, the prefatory and explanatory notes, the leadlines and numbering for each statutory section, the tables, index and annotations and other such incidents" are under copyright. A quick visit to the Legislative Counsel's web site shows that Johnson is serious about two things: order forms and copyright. The only items in red on the entire page are a copyright notice that includes "Oregon Laws, the Oregon Revised Statutes, and all specialty publications" and a set of links to order forms for such scintillating works as Landlord and Tenant Laws of Oregon 2008. The state also makes the complete text of its laws available online, and it welcomes sites like Justia to link these up. Republishing them, though, is strongly frowned upon, and Johnson indicates his hope that "it will not be necessary to litigate this matter" (translation: "we are willing to litigate this matter").

French court eviscerates website immunity for user-generated content (Steptoe & Johnson's E-Commerce Law Week, 24 April 2008) - In France, as in the United States, Internet companies are supposed to enjoy legal protection from suits over content provided by third parties. But, if recent U.S. decisions have chipped away at the immunity available to websites under section 230(c)(1) of the Communications Decency Act, a recent French decision has blown a gaping hole in the defenses available under French law. Article 6-I-2 of the French Law for Confidence in the Digital Economy (LCEN) (which mirrors Article 14 of the EU E-Commerce Directive) states that public providers of "communications services" cannot be held liable for "information stored at the request of a recipient of those services" if the provider "did not have actual knowledge of [the] illegal nature" of the information, or if the provider "acted expeditiously to remove the data or make access impossible" after learning of its illegality. But the Paris Court of First Instance held last month that Bloobox.net was not immune for hosting a user-submitted link on its Fuzz.fr service, and was liable as an editor for its putative involvement in the "organization and presentation" of the link and associated headline. This decision extends a trend in which European courts have increasingly been willing to find Internet companies liable for user-generated content. If this trend continues, websites and Internet providers will be looking at major legal problems in Europe.

Posted by at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)