Saturday, November 12, 2011

MIRLN --- 23 October – 12 November 2011 (v14.15)

MIRLN --- 23 October - 12 November 2011 (v14.15) --- by Vince Polley and KnowConnect PLLC (supplemented by related Tweets: http://twitter.com/vpolley #mirln)

NEWS | NOTED PODCASTS | DIFFERENT | LOOKING BACK | NOTES

Lawmakers' Websites Improving, Report Finds (Hillicon Valley, 24 Oct 2011) - The overall quality of congressional websites is on the rise, but many still lack basic educational and transparency features, according to a new report. House websites - including member, committee and leadership office sites - saw some degree of improvement from 2009 to 2011, while the Senate saw a small decline, according to the report released Monday outlining best practices in online communications on Capitol Hill. New members elected in 2010 were also found to have developed much better websites in their first year in office compared with their Senate counterparts, the Congressional Management Foundation (CMF) found. Roughly 61 percent of websites from House freshmen earned high marks for their sites from CMF, versus just 31 percent for new senators. The CMF singled out several lawmakers and committees for excellent online communications, with top marks going to Sen. Mark Begich (D-Alaska) for best Senate member website, and Rep. Paul Ryan (R-Wis.) for best House member website. According to the report, many member websites still do not offer basic information about their activities, the work of Congress or the legislative process. Forty percent of lawmakers did not post information on bills members have sponsored or co-sponsored in the current session of Congress, and 44 percent did not post information on the legislator's voting record, according to the report. Forty-seven percent did not post information on how a bill becomes a law, and 67 percent did not provide guidance for communicating with the member office. Lawmakers did take better advantage of social media tools, however, as the use of such technology by congressional offices rose exponentially.

top

FBI Going to Court More Often to Get Personal Internet-Usage Data (Washington Post, 25 Oct) - The FBI is increasingly going to court to get personal e-mail and Internet usage information as service providers balk at disclosing customer data without a judge's orders. Investigators once routinely used administrative subpoenas, called national security letters, seeking information about who sent and received e-mail and what Web sites individuals visited. The letters can be issued by FBI field offices on their own authority, and they obligate the recipients to keep the requests secret. But more recently, many service providers receiving national security letters have limited the information they give to customers' names, addresses, length of service and phone billing records. "Beginning in late 2009, certain electronic communications service providers no longer honored" more expansive requests, FBI officials wrote in August, in response to questions from the Senate Judiciary Committee. This marked a shift from comments made last year by Obama administration officials, who asserted then that most service providers were disclosing sufficient information when presented with national security letters. Investigators seeking more expansive information over the past two years have turned to court orders called business record requests. In the first three months of this year, more than 80 percent of all business record requests were for Internet records that would previously have been obtained through national security letters, the FBI said. The FBI made more than four times as many business records requests in 2010 than in 2009: 96 compared with 21, according to Justice Department reports.

top

Nasdaq Server Breach: 3 Expected Findings (Information Week, 25 Oct 2011) - Remember the Nasdaq breach? [Reported in MIRLN 14.05 ] It's worse than previously thought. Last week, two experts with knowledge of Nasdaq OMX Group's internal investigation said that while attackers hadn't directly attacked trading servers, they had installed malware on sensitive systems, which enabled them to spy on dozens of company directors. "God knows exactly what they have done. The long-term impact of such [an] attack is still unknown," cyber security expert Tom Kellermann, CTO of AirPatrol, told Reuters, which reported the experts' findings. In February 2011, Nasdaq OMX Group had confirmed that its servers had been breached, and suspicious files found on servers associated with Directors Desk, which is a Web-based collaboration and communications tool for senior executives and board members to share confidential information. The product has about 10,000 users, according to the company's website. At the time, Nasdaq said that it had discovered the attack in October 2010, immediately removed the suspicious files, and launched an investigation, saying "at this point there is no evidence that any Directors Desk customer information was accessed or acquired by hackers." But it wasn't clear how long the malicious files may have resided on Nasdaq's systems. Indeed, based on past breaches, many businesses fail to spot when they've been hacked, at least right away. Interestingly, Nasdaq didn't immediately inform customers about the breach, after the FBI--which is investigating the matter, together with the National Security Agency--asked it to delay doing so, so as to not impede its investigation. Furthermore, because of that investigation, Nasdaq hasn't publicly released many details about the attack. But based on recent news reports, as well as likely attack scenarios, we'll likely see these three findings * * *

top

Make or Buy in the Age of the Free-Agent Lawyer (ABA Journal, 26 Oct 2011) - At all stages of a company's life cycle, leadership continually asks the classic "Make or Buy" question. When should a company hire and develop expertise internally, and when does it make more sense to outsource tasks and purchase professional services? When it comes to legal needs, every company has its own pressure points. Mature companies mostly tie in-house headcount to revenue metrics or benchmark against industry norms. Start-ups are more interesting to follow with respect to make or buy decisions, because their behavior usually reflects a cultural choice. Case in point, the fastest growing company in the United States, GroupOn, didn't hire its first General Counsel until June, 2011. Based on GroupOn's revenue history and the huge amount of private equity in play, that's pretty late in the game. Given GroupOn's truly unique culture, which feeds on humor and independent thinking, I suspect that leadership was in no rush to build a law department. The need for policies and procedures does not necessarily equate to a desire for policies and procedures. Eventually, however, most $1 billion-plus companies hire at least one attorney to manage legal services delivery, and of course, many have law departments of significant size. In the "New Normal," the make or buy question expands. For companies with law departments, the objective for chief legal officers goes well beyond the old school notion of justifying additional headcount and then lobbying for it. Instead, progressive law departments are asking simply, "how can we make more in-house?" Taking more work inside does not automatically equate to hiring more attorneys. Instead, an evolving range of options are now in play. For example, many larger law departments have developed brand new job descriptions for tech-savvy operations professionals. This is the kind of quasi-legal role envisioned by Richard Susskind in The End of Lawyers? The objective in creating this position is to incorporate large-scale cost savings via the proper use of knowledge management systems, eBilling software, content providers and more. [Editor: Interesting; Come to think of it, I guess that much of my practice is as such an "adjunct".]

top

When Secrets Aren't Safe With Journalists (NYT OpEd by Chris Soghoian, 26 Oct 2011) - Brave journalists have defied court orders and have even been jailed rather than compromise their ethical duty to protect sources. But as governments increasingly record their citizens' every communication - even wiretapping journalists and searching their computers - the safety of anonymous sources will depend not only on journalists' ethics, but on their computer skills. Sadly, operational computer security is still not taught in most journalism schools, and poor data security practices remain widespread in news organizations. Confidential information is sent over regular phone lines and via text messages and e-mail, all of which are easy to intercept. Few journalists use secure-communication tools, even ones that are widely available and easy to use. Government officials often attempt to get journalists to reveal their sources by obtaining subpoenas and compelling testimony and the required telecommunications records. But sometimes that's not even necessary, because sources have already been exposed by their own lax communications. And then there is illicit monitoring - I believe that American journalists should assume that their communications are being monitored by their government - and possibly other governments as well. As an expert on privacy and government surveillance, I regularly speak with journalists at major news organizations, here and abroad. Of the hundreds of conversations I've had with journalists over the past few years, I can count on one hand the number who mentioned using some kind of intercept-resistant encrypted communication tools. Even when journalists try to do the right thing, they still make dangerous mistakes, like relying on Skype. Skype is slightly more secure than phones but is by no means safe from snooping - which can be done with commercially available interception software.

top

A "Wow": CEO Pushes Reg FD Limits on Twitter (CorporateCounsel.net, 27 Oct 2011) - This blog from Dominic Jones of IR Web Report is a "must" read. I'm going to tease it out by excerpting the first few paragraphs below: ALAN Meckler, CEO of WebMediaBrands Inc. (NASDAQ: WEBM), may be single-handedly redefining how corporate executives in the buttoned-down world of public companies communicate with their investors. The 64-year-old media entrepreneur, whose company owns interests in a number of online businesses and blogs, has been using Twitter to talk about his micro-cap company in ways that have stunned some observers and even drawn questions from the SEC. While some in the conservative world of corporate disclosure have speculated about how Twitter might meet the SEC's Reg FD requirements , Meckler appears to have made up his mind that Twitter is as good a channel as any to break news about everything from pending acquisitions to his next quarter's results. The result is that investors in WEBM are being treated to a new level of access to their chief executive and board chairman, as well as unprecedented commentary and news about the company's business in a real-time, abbreviated format that was previously unheard of.

top

Insulin Pump Hack Delivers Fatal Dosage Over the Air (The Register, 27 Oct 2011) - In a hack fitting of a James Bond movie, a security researcher has devised an attack that hijacks nearby insulin pumps, enabling him to surreptitiously deliver fatal doses to diabetic patients who rely on them. The attack on wireless insulin pumps made by medical devices giant Medtronic was demonstrated Tuesday at the Hacker Halted conference in Miami. It was delivered by McAfee's Barnaby Jack, the same researcher who last year showed how to take control of two widely used models of automatic teller machines so he could to cause them to spit out a steady stream of dollar bills. Jack's latest hack works on most recent Medtronic insulin pumps, because they contain tiny radio transmitters that allow patients and doctors to adjust their functions. It builds on research presented earlier this year that allowed the wireless commandeering of the devices when an attacker was within a few feet of the patient, and knew the serial number of his pump. Software and a special antenna designed by Jack allows him to locate and seize control of any device within 300 feet, even when he doesn't know the serial number.

top

NIST Publishes Guide for Monitoring Security in Information Systems (BeSpacific, 28 Oct 2011) - Information Security Continuous Monitoring (ISCM) for Information Systems and Organizations (NIST Special Publication [SP] 800-137): "Information security continuous monitoring (ISCM) is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. This publication specifically addresses assessment and analysis of security control effectiveness and of organizational security status in accordance with organizational risk tolerance. Security control effectiveness is measured by correctness of implementation and by how adequately the implemented controls meet organizational needs in accordance with current risk tolerance (i.e., is the control implemented in accordance with the security plan to address threats and is the security plan adequate).3 Organizational security status is determined using metrics established by the organization to best convey the security posture of an organization's information and information systems, along with organizational resilience given known threat information."

top

Data Breach Mitigation Costs Were Cognizable Damages (CCH Financial Privacy Law Guide, 31 Oct 2011) - The U.S. Court of Appeals for the First Circuit determined that out-of-pocket mitigation costs of credit and debit card replacement and credit insurance incurred by data breach victims were reasonably foreseeable expenses and, therefore, constituted a cognizable harm under Maine law. The breach involved a Maine-based supermarket chain operator's electronic payment processing system that resulted in the theft of 4.2 million credit and debit card numbers. The First Circuit reversed a federal district court's dismissal of negligence and implied contract claims arising from the data breach, in which it had determined that the alleged injuries were too unforeseeable and speculative to be cognizable under Maine law. Anderson v. Hannaford Brothers Co. [Analysis by Edwards Wildman here: http://www.edwardswildman.com/newsstand/detail.aspx?news=2659&elq_mid=16289&elq_cid=996107 ]

top

Regulating Network Neutrality (Media Law Prof Blog, 31 Oct 2011) - Eric Null, Cardozo Law School, has published The Difficulty with Regulating Network Neutrality, at 29 Cardozo Arts and Entertainment Law Journal 459 (2011). Here is the abstract: Network neutrality is, and has been, an essential design element of the Internet. Increasingly, there has been pressure to move from a neutral network to a network that is optimized for particular functions (such as video streaming), and technology has responded to that call through the creation of a powerful technology called Deep-Packet Inspection. DPI allows access providers to directly violate the neutrality principle because it provides a mechanism for unequal treatment of content. The tension between network neutrality and DPI is significant - so much so that the Federal Communications Commission ("FCC") has intervened. The FCC recently published its final Report and Order for Preserving the Open Internet in the Federal Register, which establishes a general principle that neutrality should be safeguarded. Despite this safeguard, the FCC provided for a reasonable network management exception to neutrality, which allows access providers to treat content unequally if the provider is reasonably managing its network. The reasonable network management exception is a broad exception. However, a broad exception, potentially overbroad, may not be the most prudent form for regulating network neutrality. To determine what form is appropriate for network neutrality regulation, one should engage in a rules-versus-standards analysis specifically in this context. There is no obvious choice, but context can provide useful background when determining whether to regulate with rules or standards. Network neutrality regulation should be written as a rule, not a standard. Establishing a rule-like regulation will deter non-neutral behavior by access providers, and will preserve the Internet's neutral architecture and the benefits that equal treatment of content provides. In addition, rule-like regulations reduce the burden placed on enforcers, typically users, of the regulation. For these reasons, the reasonable network management exception should also be worded like a rule; those arguing for a broad, standard-like exception have not successfully demonstrated why a broad exception is required. Paper is here .

top

UK Cops Using Fake Mobile Phone Tower to Intercept Calls, Shut Off Phones (Wired, 31 Oct 2011) - Britain's largest police force has been using covert surveillance technology that can masquerade as a mobile phone network to intercept communications and unique IDs from phones or even transmit a signal to shut off phones remotely, according to the Guardian. The system, made by Datong in the United Kingdom, was purchased by the London Metropolitan police, which paid $230,000 to Datong for "ICT hardware" in 2008 and 2009. The portable device, which is the size of a suitcase, pretends to be a legitimate cell phone tower that emits a signal to dupe thousands of mobile phones in a targeted area. Authorities can then intercept SMS messages, phone calls and phone data, such as unique IMSI and IMEI identity codes that allow authorities to track phone users' movements in real-time, without having to request location data from a mobile phone carrier. In the case of intercepted communications, it is not clear whether the network works as a blackhole where intercepted messages go to die, or whether it works as a proper man-in-the-middle attack, by which the fake tower forwards the data to a real tower to provide uninterrupted service for the user. In addition to intercepting calls and messages, the system can be used to effectively cut off phone communication, such as in a war zone where phones might be used as a trigger for an explosive device, or for crowd control during demonstrations and riots where participants use phones to organize. A spokesman for the U.S. Secret Service verified to CNET that the agency has done business with Datong, but would not say what sort of technology it bought from the company. The FBI is known to use a similar technology called Triggerfish, which also pretends to be a legitimate cell tower base station to trick mobile phones into connecting to it. The Triggerfish system, however, collects only location and other identifying information, and does not intercept phone calls, text messages, and other data. [Related Wired article on FBI's use of such towers here .]

top

Homeland Security Reviews Social Media Guidelines (AP, 31 Oct 2011) - The wave of uprisings across North Africa and the Middle East that have overturned three governments in the past year have prompted the U.S. government to begin developing guidelines for culling intelligence from social media networks, a top Homeland Security official said Monday. Department of Homeland Security Undersecretary Caryn Wagner said the use of such technology in uprisings that started in December in Tunisia shocked some officials into attention and prompted questions of whether the U.S. needs to do a better job of monitoring domestic social networking activity. "We're still trying to figure out how you use things like Twitter as a source," she said. "How do you establish trends and how do you then capture that in an intelligence product?" Wagner said the department is establishing guidelines on gleaning information from sites such as Twitter and Facebook for law enforcement purposes. Wagner says those protocols are being developed under strict laws meant to prevent spying on U.S. citizens and protect privacy, including rules dictating the length of time the information can be stored and differences between domestic and international surveillance. Wagner said the Homeland Security department, established after the 9/11 attacks, is not actively monitoring any social networks. But when the department receives information about a potential threat, contractors are then asked to look for certain references within "open source" information, which is available to anyone on the Internet.

top

- and -

CIA Following Twitter, Facebook (AP, 4 Nov 2011) - In an anonymous industrial park in Virginia, in an unassuming brick building, the CIA is following tweets - up to 5 million a day. At the agency's Open Source Center, a team known affectionately as the "vengeful librarians" also pores over Facebook, newspapers, TV news channels, local radio stations, Internet chat rooms - anything overseas that anyone can access and contribute to openly. From Arabic to Mandarin Chinese, from an angry tweet to a thoughtful blog, the analysts gather the information, often in native tongue. They cross-reference it with the local newspaper or a clandestinely intercepted phone conversation. From there, they build a picture sought by the highest levels at the White House, giving a real-time peek, for example, at the mood of a region after the Navy SEAL raid that killed Osama bin Laden or perhaps a prediction of which Mideast nation seems ripe for revolt. Yes, they saw the uprising in Egypt coming; they just didn't know exactly when revolution might hit, said the center's director, Doug Naquin. The center already had "predicted that social media in places like Egypt could be a game-changer and a threat to the regime," he said in a recent interview with The Associated Press at the center. CIA officials said it was the first such visit by a reporter the agency has ever granted. The CIA facility was set up in response to a recommendation by the 9/11 Commission, with its first priority to focus on counterterrorism and counterproliferation. But its several hundred analysts - the actual number is classified - track a broad range, from Chinese Internet access to the mood on the street in Pakistan. The center's analysis ends up in President Barack Obama's daily intelligence briefing in one form or another, almost every day.

top

Our Pleasure to Serve You: More Lawyers Look to Social Networking Sites to Notify Defendants (ABA Journal, Oct 2011) - Although Jessica Mpafe had not seen her husband in years, she assumed he moved back to West Africa's Ivory Coast. Mpafe of Minnesota had no physical address to serve him with divorce papers. So she asked the court whether she could send the notice by general delivery, where the post office holds mail until the recipient calls for it. Kevin S. Burke, the Hennepin County, Minn., judge presiding over the case, thought that would be a waste of postage. "General delivery made sense 100 years ago, but let's be real," says Burke, implying that few use it anymore. Nor did the judge trust publishing legal notices in a trade paper when the defendant can't be located. "Nobody, particularly poor people, is going to look at the legal newspaper to notice that their spouse wants to get divorced," Burke says. On May 10 the judge wrote an order authorizing Mpafe to serve notice of process to her husband by email, "Facebook, Myspace or any other social networking site." His order stated that while the court allowed service by publication in a legal newspaper, it was unlikely the respondent would see it. "The traditional way to get service by publication is antiquated and is prohibitively expensive," Judge Burke wrote. "Service is critical, and technology provides a cheaper and hopefully more effective way of finding respondent." It was something of a radical move. While courts in Australia, Canada, New Zealand and the United Kingdom embrace electronic legal notice, it's rare in the United States. Many state and federal statutes disallow electronic service of process, lawyers say. In federal cases, some attorneys cite Federal Rule of Civil Procedure 4(f)(3), which allows service only for foreign defendants "by other means not prohibited by international agreement, as the court orders." In a 2002 case, the 9th U.S. Circuit Court of Appeals at San Francisco upheld a default judgment against Rio International Interlink, a Costa Rican gambling website that was served electronically after traditional methods failed. The trademark infringement action was brought by Rio Properties Inc., a Las Vegas hotel and casino. The defendant, wrote Judge Stephen S. Trott, "had neither an office nor a door; it had only a computer terminal. ... When faced with an international e-business scofflaw playing hide-and-seek with the federal court, email may be the only means of effecting service of process."

top

Open Secret: Cisco Site Shares Privacy Approach (ABA Journal, Oct 2011) - Safeguarding information from the onslaught of rapidly advancing technologies that track, store and share sensitive data is one of the greatest concerns among businesses and law firms. Internet giant Cisco Systems feels it has found a collaborative approach to privacy, and it's sharing its story right out there on the Web. "Privacy is an evolving area and there's going to be a lot of changes to come. So let's share our best practices," says Van Dang, Cisco's deputy general counsel. Dang recently launched a cloud-based privacy portal on her company's website so clients and corporations can explore Cisco's privacy and compliance programs, as well as comment about their own best practices. The portal contains compliance reference materials such as agreement templates and security checklists, and it also promotes Cisco products. The portal hosts a community forum to encourage feedback, and it links to law firm and industry blogs on privacy and security issues. Dang hopes to eventually build a fully interactive platform that allows law firms to create and add their own content directly on the site. Developed during a nine-week flurry by Dang and a team of Cisco professionals last winter, the project is intended to help legal departments and law firms offer greater client and consumer protection with fewer resources, while creating collaborative industry standards for best practices. The Cisco privacy portal is here .

top

- and -

TRUSTe to Issue Free Privacy Policy Creation Starter Kit for Mobile Developers (ReadWriteWeb, 2 Nov 2011) - Internet privacy solutions provider TRUSTe is concerned that mobile apps do not have built-in privacy solutions. TRUSTe claims that 77% of all mobile applications lack privacy policies that can allow users to decide how they want to share data third parties. As such, TRUSTe is coming out with a free privacy policy for mobile developers later this month. Essentially what TRUSTe is coming out with is a privacy policy wizard or starter kit for mobile developers that do not have policies in place for their apps. Developers are led through a set of questions defining what their apps do and do not do in terms of privacy and at the end of the quiz, TRUSTe gives them a line of code that links to the apps privacy policy. The free version does not give a developer a certified TRUSTe privacy seal and there is potential for abuse of the system by creating a privacy policy with an app that does not follow those guidelines.

top

Keeping Up with the Joneses-How Far Does the 'Reasonable Expectation of Privacy' Go? (ABA Journal, by Erwin Chemerinsky, 1 Nov 2011) - One of the most difficult, and potentially most important cases of the U.S. Supreme Court term will be argued on Nov. 8. United States v. Jones involves the question of whether it is a search or seizure within the meaning of the Fourth Amendment when the police plant a GPS device on a person's vehicle and monitor it for 24 hours a day, for 28 days. Since Katz v. United States, decided in 1967, the Supreme Court has defined the protections of the Fourth Amendment in terms of the "reasonable expectation of privacy." But how does that apply in this situation? On the one hand, the court has long held that people have no expectation of privacy for their public activities. The police could have followed Jones' car on public streets for a month, perhaps by using undercover officers, and no one would have contended that there was a search or seizure that required a warrant. On the other hand, people have the expectation that police are not planting a device on their car to monitor their every move. As technology develops, police are gaining more ability to follow anyone at any time. A great deal of personal information can be learned by following someone for weeks. Yet, said Chief Judge Alex Kozinski of the 9th U.S. Circuit Court of Appeals, "There is something creepy and un-American about such clandestine and underhanded behavior." Kozinski, dissenting from denial of en banc rehearing in the 2010 case, United States v. Pineda-Moreno, added, "To those of us who have lived under a totalitarian regime, there is an eerie feeling of déjà vu." [Editor: excellent, readable explication of the case.]

top

- and -

Judges Weigh Phone Tracking (WSJ, 9 Nov 2011) - State and federal authorities follow the movements of thousands of Americans each year by secretly monitoring the location of their cellphones, often with little judicial oversight, in a practice facing legal challenges. Electronic tracking, used by police to investigate such crimes as drug dealing and murder, has become as routine as "looking for fingerprint evidence or DNA evidence," said Gregg Rossman, a prosecutor in Broward County, Fla. The use of cellphone tracking by authorities is among the most common types of electronic surveillance, exceeding wiretaps and the use of GPS tracking, according to a survey of local, state and federal authorities by The Wall Street Journal. The widening practice also presents one of the biggest privacy questions in a generation: Do police need a search warrant to follow a person's minute-by-minute movements using satellite or cellphone technology? Al Gidari, a partner at law firm Perkins Coie whose clients include mobile carriers, told Congress last year that wireless service providers receive an "astronomical" number of requests for user records-including location. "It is not uncommon for law enforcement to ask for a phone to be" tracked every 15 minutes, he said. Little is known about the practice because tracking requests are typically sealed from public view. While search warrants are generally delivered to people whose property is being searched, most people whose phones are targeted never learn about it. They typically find out only if they are charged with a crime and their tracking data are used as evidence against them. The Journal identified more than 1,000 instances of cellphone tracking in several large U.S. cities last year through open-records requests and court documents. The data showed that the practice is a widely and increasingly used police tool. Magistrate Stephen Smith of Houston, Texas, who approves such surveillance orders, has been studying the available data and estimates that federal courts alone issue 20,000 to 30,000 cellphone tracking orders annually. By comparison, federal and state courts approved 3,194 wiretaps in 2010, according to federal records.

top

Safe in the Cloud? Online Service Risks Need Care and Coverage (ABA Journal, 1 Nov 2011) - Document security, always a law practice issue, has come to the forefront as law firms and their clients consider using online-based software for business uses. Most often called cloud computing or software as a service, the process involves using the Internet to access useful applications. Rather than purchasing and installing the necessary software for a firm's private computer system, users upload information onto the Internet-"the cloud"-where it is stored with a software service. "Certain levels of security will depend on the company you are dealing with and on the underlying cloud provider," says Arlen Tanner, an attorney at Shook, Hardy & Bacon in Kansas City, Mo., who specializes in business records management. "Most cloud-based services are small startup companies leasing space on a large cloud, such as from Google, Amazon, Microsoft or IBM. Cloud service providers like Dropbox, for example, store your data on storage they lease from a major cloud provider." Lawyers whose security measures prove inadequate for protecting client confidences are vulnerable to malpractice lawsuits. Liability depends on whether a lawyer has reasonable practices in place to protect against a breach of client confidences. A firm's current malpractice insurance coverage for "errors and omission could cover some aspects of damages arising from a data breach depending on the factual circumstances, but it most likely doesn't cover the type of expenses that can arise in the aftermath," says Brant Weidner, a claims manager for Beazley Group in Chicago, a Lloyd's of London syndicate offering lawyers' professional liability insurance, including specialty lines for cyber- and data-related losses. "The fixes that clients demand or the law requires when a breach occurs are very specific and expensive." Weidner advises asking insurers what losses are covered for cyberattacks. "Lawyers should have coverage specifically designed to deal with the losses that can arise in the event of a data breach: That means notifying clients that data has been disclosed, credit monitoring if necessary, and hiring a computer security expert to figure out why there was a breach. There is also the possibility of civil fines for violations. All of these costs can have not only financial but also professional consequences," he says. "Beyond the costs," Weidner says, "firms also need to consider whether they have exercised reasonable care, and they need to know what reasonable care looks like."

top

- and -

New Study Finds 67 Percent of Cloud Servers are Perceived Vulnerable or Potentially at Risk by IT Personnel (Ponemon Institute, 2 Nov 2011) - Dome9 Security ™, the leading provider of cloud security management for public and private clouds, as well as for dedicated and virtual private servers (VPS), and the Ponemon Institute, a privacy and information management research firm, today announced the results of a first-of-its-kind cloud security study, which found that 67 percent of IT security respondents report that their organization is very vulnerable or vulnerable because cloud ports and firewalls are not adequately secured. Furthermore, 54 percent of respondents said their organizations' IT personnel are not knowledgeable or have no knowledge about the potential risk of open firewall ports in their cloud environments. The study "Cloud Security: Managing Firewall Risks" was independently conducted by the Ponemon Institute, one of the world's foremost authorities on data security and privacy, and was sponsored by Dome9 Security. The research was conducted to determine the challenges organizations face when managing access and securing firewalls and ports in cloud environments. The study analyzed responses from 682 IT and IT security practitioners in the United States working in organizations that use hosted or cloud servers (dedicated or virtual private servers). On average, respondents have more than 10 years of IT or IT security experience, and 40 percent come from organizations with 5,000 employees or more in globally dispersed locations. "We believe this is the first study to look at the risk to cloud security because of unsecured ports and firewalls, and the results are very revealing," said Dr. Larry Ponemon, founder and chairman of the Ponemon Institute. "It is commonly accepted that organizations believe they struggle with security in the cloud, but this study gets to a root of the problem. For example, more than half of the respondents said it is very likely or likely that administrative cloud server ports left open for access expose the organization to increased hacker attacks and security exploits. Nineteen percent say these exploits have already happened." For a copy of the study, see: http://www.dome9.com/resources/ponemon-cloud-security-study

top

Facebook: Monitoring Juror Social Media Networking Sites; "Friending" Employees of Adverse Parties (ABA Journal, Nov 2011) - You are representing a client in a personal injury matter. During pre trial voir dire proceedings and during the trial itself, can you search for and monitor jurors' and potential jurors' Twitter accounts and social network Internet postings? What are your obligations should you uncover evidence of juror misconduct? You represent a client in a wrongful discharge matter against the client's former employer. You have reason to believe that certain high-level employees of the employer are dissatisfied and may be likely to post unfavorable comments about the employer on their private social networking pages. Can you send a "friend" request to these employees to gain access to their private social media pages? Since the publication of the last Eye on Ethics column on Facebook, November of 2010, "Facebook: State Bar Opinions Address Information Gathering," there have been some new state bar opinions that have addressed various issues that relate to social networking. The topics covered include monitoring jurors' social network and Internet postings, and whether a lawyer can "friend" high-level employees of an adverse represented party. [Editor: usefully parses recent NY County Opinion, and another by the San Diego County Bar.]

top

- and -

Case of Fake Facebook Profile Can Proceed, Judge Rules (Law.com, 3 Nov 2011) - A woman accused of impersonating her boyfriend on a fake Facebook page and posting inflammatory comments can be prosecuted for identity theft, a judge ruled Wednesday in a case that could have wider implications for cyber-speech. Dana Thornton was indicted last year on one count of fourth-degree identity theft, a crime punishable by a maximum 18-month prison term upon conviction. Assistant Prosecutor Robert Schwartz said she created the Facebook page using photos and personal information about her ex-boyfriend, a police detective in northern New Jersey, and posted comments purported to be from him. According to grand jury testimony recited in court Wednesday, among the comments posted on the page were that the ex-boyfriend, a narcotics detective, was "high all the time," had herpes and frequented prostitutes and escort services. At issue is a New Jersey law that makes it illegal to impersonate someone "for the purpose of obtaining a benefit for himself or another or to injure or defraud another." Bradley Shear, a Bethesda, Md., lawyer who works on online issues, said he expects to see more cases like this one in the near future. The New Jersey case could be a difficult prosecution, he said, because of the way the state's law is written. "This specific situation sounds like it may be better handled in civil rather than criminal court," he said. "It's very tough to say this is a violation of the law." It is, however, a violation of Facebook's terms of service, he said. So far, only California and New York have laws specifically banning online identity theft. Shear said those states are leading the way largely because of the large number of celebrities who live in them. But he said such laws can get tricky to enforce because it's legally thorny when the alleged offender is out of state.

top

- and -

Judge Orders Exchange of Facebook and Dating Website Passwords in Custody Fight (ABA Journal, 8 Nov 2011) - A Connecticut judge has ordered lawyers representing a divorcing couple to exchange passwords to their clients' Facebook and dating websites. Judge Kenneth Schluger ordered the password exchange in the divorce of Stephen and Courtney Gallion, according to the Forbes blog The Not-So Private Parts . The judge cautioned in a Sept. 30 order that the exchange should be carried out by the lawyers, and neither spouse may post messages purporting to be the other. Stephen Gallion's lawyer, Gary Traystman, told the blog his client believes the social networking accounts will provide evidence about Courtney Gallion's ability to take care of their children. Stephen Gallion is arguing for full custody. According to the story, other judges have issued similar orders. "In 'normal' discovery, a litigant is usually asked to turn over 'responsive material,' not the keys to access all that material and more," the story says, "but it seems that judges are applying different standards to social networking accounts."

top

Out of the Crowd: Public-Supplied Info Gains Ground in Courts (ABA Journal, 1 Nov 2011) - In past years it wasn't uncommon for a law firm, hired to defend a lucrative patent, to send associates and law clerks on time-consuming, poorly directed missions to scour old filings and Internet databases in search of prior art to determine the origins of the invention in question. No more. Lawyers and clients are harnessing the collective search power of online global communities to uncover a single piece of existing artwork that could turn a multimillion-dollar lawsuit. They're crowdsourcing. Article One Partners develops patent studies that typically run six weeks, and asks targeted communities of scientists and other specialists to find relevant artwork for rewards that range from $5,000 to $50,000, depending on the nature of the dispute. The company then filters the submissions, sends the top selections to the client, and announces the winner of the best entry on its website. Crowdsourcing isn't just for the patent set. Consumer reviews on a social media website provided important evidence in a trademark dispute in June when fast-food chain Chipotle sued another establishment called Chipotles for infringement. One key factor in the court's decision to grant the plaintiff injunctive relief was the actual confusion among consumers demonstrated on customer review sites Urbanspoon and Yelp, where reviews erroneously linked the plaintiff and defendant. "The case gives a good example of how companies (and their competitors) should be aware of how their brands appear in social media," wrote Chicago-based intellectual property lawyer Evan Brown on Internet Cases: A Blog About Law and Technology. Although the Arkansas federal court considered consumer reviews in the Chipotle dispute, crowdsourcing for admissible evidence may be a stretch in future cases as courts are likely to find user comments posted online as hearsay, particularly online user comments with no verifiable identity attached, Brown added. And it's unlikely that an online consumer company like Yelp would comply in a civil suit to turn over commenters' credentials or IP addresses for verification. However, those concerns didn't stop London's Metropolitan Police from posting images taken from British surveillance cameras of alleged rioters on the photo-sharing website Flickr this summer, asking the public to identify people in the photos for arrest. In this way, crowdsourcing was a digital version of circulating wanted posters and collecting the responses-only on a much more visible lamppost.

top

Why Parents Help Their Children Lie to Facebook About Age: Unintended Consequences of the 'Children's Online Privacy Protection Act' (Berkman's community members danah boyd, Eszter Hargittai, Jason Schultz, and John Palfrey; 1 Nov 2011) - Facebook, like many communication services and social media sites, uses its Terms of Service (ToS) to forbid children under the age of 13 from creating an account. Such prohibitions are not uncommon in response to the Children's Online Privacy Protection Act (COPPA), which seeks to empower parents by requiring commercial Web site operators to obtain parental consent before collecting data from children under 13. Given economic costs, social concerns, and technical issues, most general-purpose sites opt to restrict underage access through their ToS. Yet in spite of such restrictions, research suggests that millions of underage users circumvent this rule and sign up for accounts on Facebook. Given strong evidence of parental concern about children's online activity, this raises questions of whether or not parents understand ToS restrictions for children, how they view children's practices of circumventing age restrictions, and how they feel about children's access being regulated. In this paper, we provide survey data that show that many parents know that their underage children are on Facebook in violation of the site's restrictions and that they are often complicit in helping their children join the site. Our data suggest that, by creating a context in which companies choose to restrict access to children, COPPA inadvertently undermines parents' ability to make choices and protect their children's data. Our data have significant implications for policy-makers, particularly in light of ongoing discussions surrounding COPPA and other age-based privacy laws.

top

Feds Drop Plan to Lie in Public-Record Act Requests (Wired, 3 Nov 2011) - Bowing to political pressure, the Justice Department abruptly dropped proposed revisions to Freedom of Information Act rules Thursday that would have authorized the government to inform the public that requested records do not exist even if they do. The proposal would have granted the government a new option to state that documents relevant to a FOIA request did not exist. According to the Justice Department's proposal, if the government believes records should be withheld, the government agency to which the request was made "will respond to the request as if the excluded records did not exist." Under normal practice, which seems Orwellian enough, the government may assert that it can neither confirm nor deny that relevant records exist if the matter involves national security. Civil rights groups, and a host of lawmakers from both sides of the spectrum, had blasted the Justice Department's original proposal .

top

Hyperlinks and the First Amendment (MLPB, 3 Nov 2011) - Anjali Dala, Yale University, Yale Information Society Project, has published Protecting Hyperlinks and Preserving First Amendment Values on the Internet in volume 13 of the University of Pennsylvania Journal of Constitutional Law (May 2011). Here is the abstract: Hyperlinks are critical to communication in part because they facilitate access to information. They provide visitors on one website a way to navigate to internally referenced words, phrases, arguments, and ideas. In addition to being vehicles for communication, this article contends that hyperlinks are communicative in and of themselves. They signal user preferences, democratize the national dialogue, indicate credibility, function as a signature on a virtual petition and help establish virtual associations. This Article presents the first comprehensive examination of First Amendment concerns related to hyperlinks and argues that any judicial or legislative regulation of hyperlinks should be reviewed under a strict scrutiny standard. Nearly 50 years ago, the Supreme Court recognized a constitutional privilege to disseminate information in New York Times v. Sullivan. In Sullivan, the Court extended a constitutional privilege to newspapers because of their role as an incredibly important, unique medium of communication. The same sentiment should extend to protect new media as they emerge. This Article concludes by discussing how a strict scrutiny standard should be applied to claims alleging trademark infringement, e-trespass, copyright infringement, contributory infringement, and contract violation as a result of hyperlink use. Article here .

top

Ninth Circuit Affirms Google's Section 230 Win Over a Negative Business Review (Eric Goldman, 3 Nov 2011) - The Blacks sued Google over a negative third party review of their business published in an unspecified Google property. This lawsuit was obviously preempted by 47 USC 230 from the get-go, so I easily fit my prediction of the case's outcome into a tweet . In August 2010, the district court dismissed the lawsuit on Section 230 grounds in an efficient opinion. The Ninth Circuit didn't find this case any more challenging than the district court did. In a brief unpublished memo opinion, the court upheld the district court's ruling. The main substantive sentence of the Ninth Circuit's opinion: The district court properly dismissed plaintiffs' action as precluded by section 230(c)(1) of the Communications Decency Act ("CDA") because plaintiffs seek to impose liability on Google for content created by a third party. See Fair Hous. Council of San Fernando Valley v. Roommates.com, LLC, 521 F.3d 1157, 1162 (9th Cir. 2008) (en banc) ("Section 230 of the CDA immunizes providers of interactive computer services against liability arising from content created by third parties . . . ."); Carafano v. Metrosplash.com, Inc., 339 F.3d 1119, 1122 (9th Cir. 2003) ("Through [section 230 of the CDA], Congress granted most Internet services immunity from liability for publishing false or defamatory material so long as the information was provided by another party."). Black v. Google, Inc. , 10-16992 (9th Cir. Nov. 1, 2011).

top

Surveillance System May Have Recorded Courthouse Conversations in Violation of Federal Law (ABA Journal, 4 Nov 2011) - A security system installed in June in one or more courthouses in Baldwin County, Ala., included a number of cameras that also recorded audio placed in high-risk areas such as exits and hallways. However, until yesterday no one apparently told lawyers who routinely look for a quiet spot in public areas to confer with clients, according to the Press-Register. Local defense attorneys expressed outrage at the potential breach of attorney-client privilege and the Baldwin County Commission said it had disabled the audio portion of the cameras this week "out of an abundance of caution," the newspaper reports. District Attorney Hallie Dixon said she learned of the audio issue last week and insisted on the shutdown. The county sheriff says the U.S. Attorney's office and the Federal Bureau of Investigation are reviewing the matter. "Just about every lawyer I have talked to has been shocked and outraged," said Daniel Mitchell, a local defense lawyer. "We all knew there were cameras, but no one ever notified anyone that there was more than video monitoring. Our bar association certainly didn't know about it."

top

Apple's Siri Could Get You into Hot Water Behind the Wheel (SiliconValley.com, 7 Nov 2011) - Siri may be a seductively smart companion. But let the new iPhone's voice-activated Gal Friday sit beside you as you drive up Highway 101 and you might get into trouble with the law. Or maybe not. Police say you can talk to Siri while driving. Just don't touch her. "It's legal to talk to Siri, as long as the phone's not in your hand," says San Jose police Lt. Chris Monahan. "But if you ask for directions and she puts them up on her screen for you to read, then California's vehicle code says you're breaking the law." But in an example of the law being a few steps behind the technology it's trying to address, the bill's author says that because Siri is not "a person" the law may not apply at all. "I'm a legislator, not a judge or a law enforcement official," said state Sen. Joe Simitian, D-Palo Alto, who wrote the hands-free and texting laws enacted in 2008 and 2009. "But I don't see how asking Siri for driving instructions and then looking down at the text on the phone is any more of a violation of existing law than reading your GPS device. The law talks about communicating with any 'person.' And if there's one thing we know for sure, it's that Siri is not a person."

top

FTC Settles with Online Advertiser over Flash Cookie Use (WSJ, 8 Nov 2011) - In a case that raises questions about the use of "supercookies" to track users online, the Federal Trade Commission said Tuesday that it reached a settlement with an online advertiser the commission had charged with deceiving customers by using a type of tracker called a Flash cookie. According to the FTC complaint, ScanScout, an advertising network that places video ads on websites, instructed its consumers via its privacy policy page that they could opt out of receiving targeted ads by "changing your browser settings to prevent the receipt of cookies." That turned out not to be the case. ScanScout uses Flash cookies, technology that cannot be removed by changing browser settings for ordinary cookies. The FTC called ScanScout's claims "deceptive." The practice, according to the complaint, ran from at least April 2007 to December 2010. As part of the settlement ScanScout must place a prominent notice on its website saying that the company collects information about user activities, with a link that takes consumers to a mechanism that allows them to prevent the company from collecting more information about the user.

top

Employers Demanding the Right to Remotely Wipe Employees' Phones? (Eric Goldman, 9 Nov 2011) - I got the following email from one of my students (I edited a little to increase the anonymity): "Recently, my spouse's company announced that it is going to implement a new policy regarding those employees using their mobile devices to check company email. These phones are personal phones, and not provided by the company. What they are proposing is that my spouse sign a release that states that the Company has the right to remotely wipe the phone (restoring it to factory settings) if they feel that any of their trade secrets have been compromised, or if the spouse loses/misplaces the phone. My problem with this is that these are personal phones with personal information not connected to her work. Does her company have the right to wield such power, or is this over doing it?" This was the first time I'd ever heard of such a provision. Has this become a new standard, or is this company over-the-top hyper-protective of its trade secrets? As an employee, I would not sign such a release. Further, if I were the employer, I would be reluctant to rely on the release, even if signed, to actually wipe a former employee's phone. If the employee challenged the wipe in court, I would imagine many judges would be reluctant to enforce the release, motivating them to look for reasons not to do so. If nothing else, there's a major due process problem (in the equity sense, not the legal sense). The company is the judge, jury and executioner without ever proving trade secret misappropriation, and carrying out the remote wipe could cause catastrophic data losses for the employee (and possibly for a subsequent employer). This just seems like a bad idea all around. Please email me if you've seen a provision like this in the field before or if you know of any cases/statutes that address the situation. In the email, let me know if I can repost your email here. [Editor: I know of a few law firms that are taking a similar approach.]

top

NOTED PODCASTS

Curation: Beyond the Buzzword (IT Conversations, 26 minutes) - According to Eric Schmidt, "Between the dawn of civilization through 2003, mankind created five exabytes of information. Now that much amount of information is created every two days." Curator Steve Rosenbaum does not seem impressed by this mass of unorganized information. According to Rosenbaum, what humans need is a way to categorize, find, and sort information qualitatively. however, we emphasizes, that this is a job that, at the moment, requires a human instead of a computer. Alluding to our reflexive need to check our emails and the tendency of Google and other search engines to give us far too much information, Rosenbaum dismisses the past standard of 'Content is King.' He instead stresses the importance of curation and human influence on sorting and choosing information. The problem, in his opinion, is combining this quality with computer efficiency. With his own examples of curation, which include a book and a documentary about September 11, 2001, Steve Rosenbaum stresses the importance of creating collections of information, works of art, and culture, and liberating it in a flexible architecture that allows us to consume that information in a way that most makes sense for us. He also discusses the use of modern technology and tablet technology to present new opportunities in dealing with massive amounts of information. [Editor: the idea the "books" are the end-result of terrific curation reminds me of "The Young Lady's Illustrated Primer", an unusual book that is the center point of Neal Stephenson's 2000 novel "The Diamond Age".]

top

Artificial Intelligence - A Legal Perspective (Sanford, Center for Internet & Society, 106minute podcast) - Although we are still waiting on promises of "strong AI" capable of approximating human thought, the widespread use of artificial intelligence has the potential to reshape medicine, finance, war, and other important aspects of society. The Center for Internet and Society, along with the Stanford Law and Technology Association (SLATA), and the Stanford Technology Law Review (STLR) bring together four scholars who have begun to examine the near term, short term, and long term ramifications of artificial intelligence for law and society. This panel follows up on our Legal Challenges in an Age of Robotics panel from November 2009.

top

DIFFERENT

Artists File Lawsuits, Seeking Royalties (NYT, 2 Nov 2011) - When the taxi baron Robert Scull sold part of his art collection in a 1973 auction that helped inaugurate today's money-soused contemporary-art market, several artists watched the proceedings from a standing-room-only section in the back. There, Robert Rauschenberg saw his 1958 painting "Thaw," originally sold to Scull for $900, bring down the gavel at $85,000. At the end of the Sotheby Parke Bernet sale in New York, Rauschenberg shoved Scull and yelled that he didn't work so hard "just for you to make that profit." The uproar that followed in part inspired the California Resale Royalties Act, requiring anyone reselling a piece of fine art who lives in the state, or who sells the art there for $1,000 or more, to pay the artist 5 percent of the resale price. That law is now at the center of three class-action suits brought this month by artists who include Chuck Close and Laddie John Dill and the estate of the sculptor Robert Graham. They have filed suit against the auction powerhouses Sotheby's and Christie's and the online auction site eBay for failure to pay royalties. The suits do not specify damages, nor do they list particular sales of art by California residents. Rather, as Eric George, the lawyer who filed them, explained, the complaints seek to force the auction houses to reveal the identities or locations of sellers, information that is often kept secret. Sotheby's responded to the suit with a terse statement: "We believe the claim is meritless, and it will be vigorously defended." Christie's said that it "views the California Resale Royalties Act as subject to serious legal challenges" and that it "looks forward to addressing these issues in court." The law has so far survived two legal challenges, and experts in art law are divided about whether it might be vulnerable on constitutional grounds. The larger issue of whether visual artists should receive a cut of future sales remains a subject of vigorous debate. Dozens of countries already have a version of a resale royalties law, generally referred to by the French phrase droit de suite. Starting in 2012, Britain and other members of the European Union will adhere to a uniform standard that applies to both living artists and those who have died within the past 70 years. Indeed, Christie's, on its Web site, informs prospective clients that it collects the royalty mandated in Europe at the time of the sale.

top

LOOKING BACK - MIRLN TEN YEARS AGO

POLICE MAKE DOUGHNUT RUN VIA CHOPPER (AP, 5 October 2001) -- Albuquerque police have taken doughnut runs to new heights, swooping down in an official helicopter for a late-night snack. "If they violated policy or procedure, they're going to get disciplined for it," said Lt. Bob Huntsman, department spokesman. "We've worked too hard to make this a professional unit to let lack of common sense tear us down." Keith Turner, who works near a Krispy Kreme doughnut shop, said he was on a break with other people early Thursday when a police helicopter circled and landed in a dirt field nearby. "I was like, `No, they'd better not go and get doughnuts,"' Turner said. As the helicopter idled, someone got out and went into the store, returning 10 or 15 minutes later with a Krispy Kreme box, he said. http://www.salon.com/people/wire/2001/10/05/doughnuts/index.html

top

REPORT: ONLINE BILL PAYMENT GAINING GROUND (Ecommerce Times, 15 October 2001) Although less than 9 percent of those surveyed used online bill payment services, many more are interested in using those services in the future, said a report by the Yankee Group. This year, 8.7 percent of consumers surveyed paid their bills over the Internet, up from 5.1 percent in 2000, Yankee said. "Considering the growth we've seen in the past, it's not a bad growth rate," Yankee director Paul Hughes told the E-Commerce Times. Hughes said that banks, credit-card companies and others have been pushing hard to get customers to pay their bills online, offering incentives like frequent-flyer miles and Web certificates to get people to sign up for e-billing programs. Yankee said that among consumers who used electronic bill-payment services, 28.7 percent cited the convenience of not having to write checks as the primary benefit. Another 14.9 percent said saving time was their main motivation. Hughes said BellSouth, AT&T and American Express are among large billers that have been successful at marketing their online billing services and making them easier to use. Concerns about security are "starting to wane, which is good," said Hughes. http://www.ecommercetimes.com/perl/story/14151.html

top

NOTES

MIRLN (Misc. IT Related Legal News) is a free e-newsletter published every three weeks by Vince Polley at KnowConnect PLLC. You can subscribe to the MIRLN distribution list by sending email to Vince Polley ( mailto:vpolley@knowconnect.com?subject=MIRLN ) with the word "MIRLN" in the subject line. Unsubscribe by sending email to Vince with the words "MIRLN REMOVAL" in the subject line.

Recent MIRLN issues are archived at www.knowconnect.com/mirln . Get supplemental information through Twitter: http://twitter.com/vpolley #mirln.

SOURCES (inter alia):

1. The Filter, a publication of the Berkman Center for Internet & Society at Harvard Law School, http://cyber.law.harvard.edu

2. InsideHigherEd - http://www.insidehighered.com/

3. SANS Newsbites, sans@sans.org

4. NewsScan and Innovation, http://www.newsscan.com

5. BNA's Internet Law News, http://ecommercecenter.bna.com

6. Crypto-Gram, http://www.schneier.com/crypto-gram.html

7. McGuire Wood's Technology & Business Articles of Note

8. Steptoe & Johnson's E-Commerce Law Week

9. Eric Goldman's Technology and Marketing Law Blog, http://blog.ericgoldman.org/

10. Readers' submissions, and the editor's discoveries.

This work is licensed under the Creative Commons Attribution-Share Alike 3.0 United States License. To view a copy of this license, visit or send a letter to Creative Commons, 543 Howard Street, 5th Floor, San Francisco, California, 94105, USA.

PRIVACY NOTICE: Addresses and other personal information provided during the subscription process will be kept confidential, and will not be used for any other purpose. top

Posted by at No comments:

Saturday, October 22, 2011

MIRLN --- 1-22 October 2011 (v14.14)

MIRLN --- 1-22 October 2011 (v14.14) --- by Vince Polley and KnowConnect PLLC (supplemented by related Tweets: http://twitter.com/vpolley #mirln)

NEWS | RESOURCES | FUN | LOOKING BACK | NOTES

DHS Creates New Senior Cyber Position In NPPD (FederalNewsRadio, 22 Sept 2011) - The Homeland Security Department continues to shift cybersecurity oversight chairs. Suzanne Spaulding is the new deputy undersecretary for the department's National Protection and Programs Directorate (NPPD), according to an email from Rand Beers, DHS under secretary of NPPD, obtained by Federal News Radio. Spaulding replaces Phil Reitinger, who left June 3. Reitinger joined Sony as its chief information security officer in August. "Suzanne brings a wealth of experience, having spent nearly 25 years working on national security issues in the public and private sectors," Beers wrote in the email to staff. "As deputy undersecretary, Suzanne will focus on efforts to reduce risk and enhance the resiliency of critical infrastructure, secure federal facilities, and advance identity management and verification." In her new role, Spaulding will oversee the US-VISIT program, infrastructure protection, the Federal Protective Service and the Office of Risk Management and Analysis. Spaulding is expected to start in early October, Beers said. Along with naming Spaulding, Beers said Greg Schaffer will move into a new position, the deputy undersecretary for cybersecurity on an interim basis. "This position will help the directorate ensure robust operations and strengthened partnerships in the constantly evolving field of cybersecurity," Beers said. Schaffer has been the acting deputy undersecretary and will assume the role of acting deputy undersecretary for cybersecurity until a permanent person is announced in the coming weeks. Spaulding comes to DHS after serving as a principal for the Bingham Consulting Group in Washington. She also was the minority staff director for the House Permanent Select Committee on Intelligence and was the general counsel for the Senate Select Committee on Intelligence. Additionally, Spaulding spent six years at the CIA and served as senior counsel and legislative director for former Sen. Arlen Specter (D-Pa.). [Editor: Suzanne is extremely capable and her background has prepared her well for this role. She's also been very active in the ABA and with the Standing Committee on Law & National Security, where I served with her from 2002-2009.]

top

Orwell's Armchair (by Derek Bambauer, forthcoming U. Chicago Law Review) - Abstract: "America has begun to censor the Internet. Defying conventional scholarly wisdom that Supreme Court precedent bars Internet censorship, federal and state governments are increasingly using indirect methods to engage in "soft" blocking of on-line material. This Article assesses these methods and makes a controversial claim: hard censorship, such as the PROTECT IP Act, is normatively preferable to indirect restrictions. It introduces a taxonomy of five censorship strategies: direct control, deputizing intermediaries, payment, pretext, and persuasion. It next makes three core claims. First, only one strategy - deputizing intermediaries - is limited significantly by current law. Government retains considerable freedom of action to employ the other methods, and has begun to do so. Second, the Article employs a process-based methodology to argue that indirect censorship strategies are less legitimate than direct regulation. Lastly, it proposes using specialized legislation if the U.S. decides to conduct Internet censorship, and sets out key components that a statute must include to be legitimate, with the goal of aligning censorship with prior restraint doctrine. It concludes by assessing how soft Internet censorship affects current scholarly debates over the state's role in shaping information on-line, sounding a skeptical note about government's potential to balance communication." [Editor: recommended by Chris Soghoian]

top

EU Cloud Vendors Liable For Breaches (SC Magazine, 29 Sept 2011) - The European Union will introduce rules that make cloud providers legally liable for data breaches. The Binding Safe Processor Rules (BSPR) will require cloud service providers in the EU to agree to becoming legally liable should any data offences occur at their data centres, lawyers said yesterday. It will effectively act as an accreditation scheme for cloud providers, meaning it will need vendors to sign up to the initiative. Eduardo Ustaran, partner at law firm Field Fisher Waterhouse and driving force behind the new rules, said service providers would likely to sign up because it would give them a selling point. If they refused, they would be seen as unsafe, he said. Vendors must prove their security models were adequate to get accredited. Verizon Business had pushed for the EU to enshrine the BSPR concept in data protection law.

top

Federal Reserve Wants to Read Your Facebook Posts (FCW, 30 Sept 2011) - Complaints on Twitter or Facebook about jobs or rising food prices may become fodder for the Federal Reserve Bank of New York's assessments of the world's current economic conditions. The bank has issued a request for proposals seeking a contractor to help gauge the nation's economic mood by sampling conversations on social media platforms such as Facebook, Twitter, YouTube and blogs. The bank said it wants a Sentiment Analysis and Social Media Monitoring Solution to gather and report data from around the world, in multiple languages, on a continuous basis. The proposal calls for "Social Media Listening Platforms" to be created to "monitor billions of conversations" and generate text analytics. Bank officials state in the RFP that they want to stay current on public opinion, and social media monitoring provides a means to do that. "Social media platforms are changing the way organizations are communicating to the public," the request states. "Conversations are happening all the time and everywhere. There is need for the Communications Group to be timely and proactively aware of the reactions and opinions expressed by the general public as it relates to the Federal Reserve and its actions on a variety of subjects."

top

Law School Lets You Apply For College From Smart Phones (Atlanta TV, 3 Oct 2011) - John Marshall School of Law in Atlanta has taken the act of applying to school and brought it into the new age of technology. John Marshall has introduced a mobile application that allows potential students to apply for law school from the palm of their hand. Prospective students can visit m.johnmarshall.edu from their mobile device from their smart phone or their tablet to apply. "We want students to be able to come to a law school forum, tour our campus, talk to us and apply immediately. If they have to wait until they get home and turn on a computer, they may not apply," Alan Boyer, Associate Dean of Recruitment and Marketing said in a statement released Monday. Students who use their mobile device over the next few weeks to apply to John Marshall will also get a waiver of the customary $50 application fee.

top

Stream Away (Inside Higher Ed, 5 Oct 2011) - A federal judge on Monday threw out a lawsuit by an educational media trade group and one of its constituents against the University of California over the legality of streaming copyrighted videos on secure course websites. While the case was dismissed largely on technical grounds, U.S. District Court Judge Consuelo B. Marshall indicated that streaming a copyrighted work on a secure website is no different from holding a screening in a classroom. "The type of access that students and/or faculty may have, whether overseas or at a coffee shop, does not take the viewing of the DVD out of the educational context," Marshall wrote in her decision. Because the only rights-holding plaintiff in the case, Ambrose Video Publishing, had licensed UCLA to "publicly perform" its videos in the classroom, streaming it on a secure site was also permissible, the judge said. However, legal experts say the decision hardly resolved the central question of whether streaming copyrighted videos in online classrooms is protected under the fair use provisions to U.S. copyright law. The Association for Information and Media Equipment (AIME), along with Ambrose, brought the suit late last year after it found out that the University of California at Los Angeles was facilitating online streaming for its courses. The case attracted a great deal of attention from fair use advocates, who argued -- as did the university -- that allowing students to stream videos via password-protected course websites was no different from convening a group viewing in a classroom, which they argued was covered under fair use. AIME has countered that in order to convert the videos into digital versions that could be streamed, UCLA was copying the videos' content unlawfully.

top

- and -

Judge Suggests DMCA Allows DVD Ripping if You Own the DVD (ArsTechnica, 5 Oct 2011) - A Monday ruling suggests that educational institutions are entitled to stream legally purchased DVDs on campus without the permission of copyright holders. A federal judge dismissed a lawsuit charging UCLA with violating the Digital Millennium Copyright Act and other provisions of copyright law by ripping DVDs and streaming them to students. "UCLA is pleased that the court dismissed the plaintiffs' lawsuit challenging UCLA's practice of streaming previously purchased video content for educational purposes," said Scott Waugh, UCLA executive vice chancellor and provost. "The court ruling acknowledges what UCLA has long believed, that streaming licensed DVDs related to coursework to UCLA students over UCLA's secure network is an appropriate educational use." The lawsuit was brought by a trade association of educational video publishers called the Association for Information Media and Equipment (AIME), and one of its members, Ambrose Video Publishing. The plaintiffs allege that around January 2006, UCLA purchased video streaming software that included a DVD-ripping capability, and began streaming DVDs it had purchased-including some belonging to Ambrose-to members of the UCLA community. Ambrose and AIME sued in December 2010, alleging copyright infringement, breach of contract, and other harms. They argued that UCLA violated the anti-circumvention provisions of the DMCA when it ripped Ambrose's copy-protected DVDs. They also argued that its DVDs are sold under a licensing agreement that prohibits rebroadcast and public display. And they noted that Ambrose was just one of many copyright holders whose works were included in UCLA's 2,500-work streaming library. UCLA countered that copyright's fair use doctrine gives educators broad latitude to publicly perform copyrighted works as part of their instructional activities. They also noted that Ambrose's own catalog states that "All purchases by schools and libraries include public performance rights." As for the DMCA claim, UCLA argued that because the school was the lawful owner of the DVDs at issue, it had a right to access the DVDs and therefore could not have run afoul of the ban on circumventing access-control measures. Judge Consuelo B. Marshall sided with UCLA. He noted that the plaintiffs conceded that UCLA had the right to show its DVDs in the classroom, and ruled that UCLA's streaming service was functionally equivalent. "The type of access that students and/or faculty may have, whether overseas or at a coffee shop, does not take the viewing of the DVD out of the educational context," he wrote. Marshall also ruled that UCLA's copies of the DVDs were incidental to its lawful streaming service, and was therefore fair use. Case is Association For Information Media and Equipment v. University of California

top

How New Labor Guidelines Could Affect Your Social Media Policy (Mashable, 5 Oct 2011) - While social media has been around for a while, there are still aspects of it that are very new, such as policy development. Such policies have to stand the test of time and evolve as the workplace - and the social media platforms and their usage - changes. In August, the National Labor Relations Board (NLRB) released a report on the outcome of investigations into 14 cases involving the use of social media and employers' social media policies. The NLRB is an independent agency in the U.S. government that protects employees' rights to join together to improve wages and working conditions, with or without a union. Here's an overview of the report and some pointers on what your company should consider when it comes to social media policy development.

top

Arrested in Seattle, Computer Security Expert Creates Searchable Website of Police Dashcam Video Log (ABA Journal, 5 Oct 2011) - Arrested three years ago in Seattle when a police officer apparently didn't appreciate his "brainiac" attitude after he was questioned about swatting giant sponge golfballs from bar to bar during a pub crawl, a computer security expert has fought back bigtime. Once the obstruction case against him was dismissed, Eric Rachner pursued a public-disclosure claim against the city's police department over its failure to provide all video camera footage of his arrest, winning a $60,000 judgment. And today he filed suit against the department again, asserting claims in his King County Superior Court complaint (PDF) for false arrest, obstruction of justice, malicious prosecution and "spoliation of video evidence," reports the Seattle Times. But that's not all. Tomorrow the 35-year-old Rachner plans to activate a website that he says will allow arrested citizens and their attorneys to see whether there is any video from the dashboard cameras that police are supposed to activate during arrests. As part of the judgment in his favor in the disclosure suit, Rachner and his lawyer, Cleveland Stockmeyer, were given copies of the department's log of every dashcam arrest video shot by Seattle patrol officers between July 2008 and August of this year. By checking the log, other arrestees and their counsel "might find, as we did in Eric's case, that the video and the police reports were so at odds that they might as well have been from different incidents," Stockmeyer tells the Times. Much of Rachner's latest suit focuses on what he contends is a widespread practice of the department of failing to provide requested dashcam footage not only to arrestees who request it but even to federal investigators. The department, he alleges in the suit, "has had a policy and custom to falsely conceal video when it is requested." Other videos, he claims, have been lost and officers sometimes don't activate the dashcams when they are supposed to, all of which results in a loss of evidence. A local television station filed suit against the police last month, the newspaper says, after learning Rachner had dashcam logs that had been withheld from a reporter.

top

A Citizen's Guide to Reporting on #OccupyWallStreet (Berkman's CMLP, 7 Oct 2011) - We at the Citizen Media Law Project have taken great interest in the ongoing "Occupy Wall Street" protest in New York. Much of what we know about the protest has come from independent reporters and citizen journalists covering the story from the ground. Knowing this, we are alarmed to hear reports of policearresting reporters during the protest. This, of course, could greatly discourage press coverage of this story. In order to encourage citizen reporting from the ground in New York, and to dispel the uncertainties as to the rights of those covering the protest, we have created this special question-and-answer guide regarding covering the protest in New York as a special addendum to our CMLP Legal Guide. For more general information, you can also refer to our guide's section on New York law. Note: This guide specifically addresses the law as it pertains to New York City and the protests currently occurring in Zuccotti Park. The information provided below will not apply with respect to the other #occupy protests throughout the country. While we tried our best to present the law as it generally applies in New York, specific facts and circumstances often alter outcomes in specific cases. Also, this post provides the law as it exists in October of 2011. We do not intend to update this post as the law changes, so if you find yourself returning to this at a later time please note that the law may have changed. PDF version of the CMLP guide here.

top

Pentagon Website Covers Guantanamo Trials (Robert Ambrogi, 7 Oct 2011) - The Department of Defense has launched a website, Military Commissions, devoted to coverage of trials by the military courts in operation at Guantanamo to try accused terrorists. Notably, the site allows users to view and download documents and court filings from the commission cases against specific individuals and to obtain summaries of the charges against them. The site also provides a description of military commissions and how they work. It includes an interesting chart that compares the rules and procedures in military commissions with those in courts-martial and Article III courts. There is also a collection of significant court opinions relating to military commissions and of current and historical documents pertaining to the commissions. There is even a section providing details on travel to Guantanamo Bay. The Pentagon created the site, it says, to help "provide fair and transparent trials of those persons subject to trial by Military Commissions while protecting national security interests."

top

FOIA and the Question of Secret Law (Lawfare, 7 Oct 2011) - Charlie Savage of the New York Times has filed this FOIA suit in an effort to acquire a classified report issued by DOJ and ODNI to Congress "pertaining to intelligence collection authorities" under section 215 of the USA PATRIOT Act (permitting the government to obtain from the FISC an order for the production of "any tangible things" upon a showing of "reasonable grounds" in relation to an international terrorism or counterintelligence investigation). The report appears to have sparked fierce objections from Senators Ron Wyden and Mark Udall, who have asserted in floor debate that the government has a troubling "secret" interpretation of the PATRIOT Act. The suit itself presents the question whether legal analysis, as distinct from details of the program itself, warrants protection under FOIA exemption 1. The complain calls for release of at least a redacted version of the DOJ/ODNI report, if not the whole thing. If successful, of course, this strategy could have significant implications across a range of settings involving internal government legal advice.

top

FBI To Launch Nationwide Facial Recognition Service (NextGov, 7 Oct 2011) - The FBI by mid-January will activate a nationwide facial recognition service in select states that will allow local police to identify unknown subjects in photos, bureau officials told NextGov. The federal government is embarking on a multiyear, $1 billion dollar overhaul of the FBI's existing fingerprint database to more quickly and accurately identify suspects, partly through applying other biometric markers, such as iris scans and voice recordings. Often law enforcement authorities will "have a photo of a person and for whatever reason they just don't know who it is [but they know] this is clearly the missing link to our case," said Nick Megna, a unit chief at the FBI's criminal justice information services division. The new facial recognition service can help provide that missing link by retrieving a list of mug shots ranked in order of similarity to the features of the subject in the photo. Today, an agent would have to already know the name of an individual to pull up the suspect's mug shot from among the 10 million shots stored in the bureau's existing Integrated Automated Fingerprint Identification System. Using the new Next-Generation Identification system that is under development, law enforcement analysts will be able to upload a photo of an unknown person; choose a desired number of results from two to 50 mug shots; and, within 15 minutes, receive identified mugs to inspect for potential matches. Users typically will request 20 candidates, Megna said. The service does not provide a direct match. Michigan, Washington, Florida and North Carolina will participate in a test of the new search tool this winter before it is offered to criminal justice professionals across the country in 2014 as part of NGI. The project, which was awarded to Lockheed Martin Corp. in 2008, already has upgraded the FBI's fingerprint matching service. Local authorities have the choice to file mug shots with the FBI as part of the booking process. The bureau expects its collection of shots to rival its repository of 70 million fingerprints once more officers are aware of the facial search's capabilities. [Editor: reminds me of the premise behind CBS's interesting new show " Person of Interest".]

top

Publisher Claims Ownership of Time-Zone Data (Wired, 9 Oct 2011) - The publisher of a database chronicling historical time-zone data is claiming copyright ownership of those facts, and is suing two researchers for re-purposing it in a free-to-use database relied on by millions of computers. The researchers' publicly available database was being hosted on a server at the Maryland-based National Institutes of Health, which apparently has removed the data at the request of Massachusetts-based publishing house, Astrolabe. The publisher markets its programs to astrology buffs "seeking to determine the historical time at any given time in any particular location, world-wide," and claims ownership to the data in its "AC International Atlas" and "ACS American Atlas" software programs. Astrolabe's federal lawsuit, filed last week, is among the boldest claims of copyright infringement since 2005. That's when Bikram Choudhury, the hot-yoga guru, claimed copyright to his yoga positions. Choudhury had sent cease-and-desist letters ordering studios to stop teaching what he claimed were his copyrighted yoga poses. In an out-of-court settlement, the targeted studios agreed they would not capitalize off of the Bikram brand name. But they were not prohibited from teaching his style of yoga, which was based off of an art form thousands of years old. The suit also faces the tough challenge of overcoming a 1991 Supreme Court decision, concerning a company that harvested listings from a phone company's telephone book and re-published them. The court ruled that "copyright does not extend to facts contained in [a] compilation." Astrolabe claims Arthur Olson, a computer scientist at the National Institutes of Health, and Paul Eggert, a computer scientist at the University of California at Los Angeles, have " unlawfully reproduced the works" (.pdf) and distributed them without permission from the copyright holder. The allegedly infringing database credits the Astrolabe database.

top

US Power Plants Vulnerable to Cyberattack (FT, 11 Oct 2011) - Hundreds of thousands of people in darkness, hospitals in chaos, a banking system under siege - a cyberattack on the US electricity grid could have catastrophic consequences. When federal researchers discovered that outside hackers could take control of the generators used to produce electricity in the US and destroy them, analysts warned that a coordinated assault on the grid could blackout large regions and cause devastation akin to scores of hurricanes striking at once. Regulators asked utilities to fix that design flaw, as they have with others discovered later. Now, four years since that first warning, experts say that power plants - along with financial institutions, transportation systems and other infrastructure - have become even more vulnerable. "The next Pearl Harbor we confront could very well be a cyberattack that cripples our power systems, our grid, our security systems, our financial systems, our governmental system," Leon Panetta, US defence secretary, said at his June confirmation hearing. The economic damage from a single wave of cyberattacks on critical infrastructure could exceed $700bn - or the cumulative toll of 50 major hurricanes ripping into the nation simultaneously, wrote Stanton Sloane when he was chief executive of SRA International. Skeptics argue that the dangers are being talked up by those eager to be hired to help. Other countries, such as the UK, are also exposed, but officials agree that the US is the most vulnerable to cyberattack because its companies and people are so dependent on the internet. [M]ost alarming for the US defence establishment is the lack of security around the electricity grid. Many power plants, as well as factory floors and pipelines, rely on automation equipment that can be reprogrammed remotely yet do not require even the authentication imposed on average computer users, said John Pollet of Red Tiger Security, which has carried out security assessments on more than 150 facilities: "There is a systemic problem" across all manufacturers of the gear. Some control systems can be located with special Google searches and then ordered to shut down or speed up, potentially blowing up a power or water treatment plant, presentations at Black Hat hackers conference showed in August. Many of these control systems were designed before the age of widespread internet connections.

top

- and -

Cybercrime Becomes Bigger Threat to Energy Industry than Terrorists (FuelFix, 13 Oct 2011) - In years past, discussions about security in the energy industry usually focused on protecting refineries from terrorist attacks and overseas workers from kidnapping. Today, the greater threat is the digital theft of competitive information or technical data by outside hackers or unscrupulous employees, speakers at an FBI-sponsored event on energy security said Wednesday. "The shift from physical security to data security has been a significant one for all of us," said Russell Cancilla, Vice President and Chief Security Officer at Baker Hughes. "Theft of intellectual property, state-sponsored corporate espionage, those kinds of things have grown exponentially in recent years." A few well-known incidents in the energy industry occurred in 2008, when computer systems owned by oil companies including ConocoPhillips, Marathon Oil and Exxon Mobil were reportedly hacked by outside forces seeking oil and gas lease bidding information. Sections of the U.S. power grid were also probed by outside forces in recent years, although it does not appear any damage was done. But the energy industry tends to be tight-lipped about such breaches. [Editor: Baker Hughes seems to have evolved their thinking since March's MIRLN 14.04.]

top

- and -

SEC Asks Companies to Disclose Cyber Attacks (Reuters, 13 Oct 2011) - U.S. securities regulators formally asked public companies for the first time to disclose cyber attacks against them, following a rash of high-profile Internet crimes. The Securities and Exchange Commission issued guidelines on Thursday that laid out the kind of information companies should disclose, such as cyber events that could lead to financial losses. Senator John Rockefeller had asked the SEC to issue guidelines amid concern that it was becoming hard for investors to assess security risks if companies failed to mention data breaches in their public filings. "Intellectual property worth billions of dollars has been stolen by cyber criminals, and investors have been kept completely in the dark. This guidance changes everything," Rockefeller said in a statement. "It will allow the market to evaluate companies in part based on their ability to keep their networks secure. We want an informed market and informed consumers, and this is how we do it," Rockefeller said in a statement. There is a growing sense of urgency about cyber security following breaches at Google Inc, Lockheed Martin Corp, the Pentagon's No. 1 supplier, Citigroup, the International Monetary Fund and others. Tom Kellermann, chief technology officer of security firm AirPatrol Corp, said that the SEC guidance tells companies to report cyber attacks and disclose steps to remediate problems. "They must also incorporate cyber events into their material risk reports," said Kellermann, who has advised U.S. President Obama on cyber policy. The SEC gets into specifics, telling companies what type of data they might need to provide investors. "Examples of estimates that may be affected by cyber incidents include estimates of warranty liability, allowances for product returns, capitalized software costs, inventory, litigation, and deferred revenue," it says. SEC guidance here: www.sec.gov/divisions/corpfin/guidance/cfguidance-topic2.htm [Editor: there's much to criticize in the guidance - e.g., the seeming requirement fully to disclose exploited vulnerabilities, which might still be exploited - but I think this is a move in the right direction. See article from Hogan Lovells.]

top

RSA Details March Cyberattack, Blames "Nation State" for SecurId Breach (Ars Technica, 12 Oct 2011) - At EMC's RSA Conference Europe in London today, RSA executives shared more details on the cyber attack that stole information on the company's SecurID authentication tokens in March. RSA executive chairman Noviello said at a press conference that two separate hacker groups worked in collaboration with a foreign government, ZDNet UK reports. He would not disclose the parties involved, but said "we can only conclude it was a nation-state sponsored attack." According to RSA executives, no customers' networks were breached as a result of the SecurID data stolen. RSA president Tom Heiser said during a presentation at the conference it was clear that the attack was intended to go after military contractors' data. The coordinated effort, which used a series of spear phishing attacks against RSA employees to penetrate the company's network, posing as people they trusted. The phishing attack installed a "zero-day" exploit to establish a foothold. IDG reported that the exploit used an Excel spreadsheet with an embedded malicious Adobe Flash file. The foothold, and the tag-team attack that followed, were used to gain access to the SecurID data. However, RSA's chief security officer Eddie Schwartz said during the press conference that the intrusion was detected before any customers were attacked. According to RSA executives, the data was used in only one attack on a customer, and that attack was unsuccessful. No other customers were affected, according to RSA, despite reports that several defense contractors, including Lockheed Martin, had experienced breaches.

top

Does Keystroke Monitoring Violate ECPA? (Steptoe, 13 Oct 2011) - A recent federal court decision points out two of the many critical ambiguities in the Electronic Communications Privacy Act (ECPA): what constitutes an "interception" under the Wiretap Act portion of ECPA, and when is an email in "electronic storage" and therefore protected by the Stored Communications Act portion of ECPA? The court in Rene v. G.F. Fishers Inc. held that the use of keystroke logging software to monitor signals sent from a keyboard to a personal computer was not an interception of an electronic communication because it did not occur on "a system affecting interstate or foreign commerce." But the court found that the same actions could violate Indiana's wiretapping law, underscoring again how state laws may be more privacy-protective than ECPA. The court also held that unopened emails in a person's inbox are in "electronic storage" within the meaning of the SCA, and reserved judgment on whether opened emails were also in electronic storage. The storage question is one that has befuddled courts for years.

top

Judge Royce Lambert: No Warrant Needed For Cell Phone Location Data (BLT, 13 Oct 2011) - Prosecutors do not need a warrant to compel a cellular phone service provider to turn over data about call location, a federal judge in Washington said in a ruling unsealed Wednesday. The ruling examines the government's attempt to get data from the undisclosed service provider amid a U.S. Attorney's Office investigation of an armed robbery of an armored truck. Chief Judge Royce Lamberth of U.S. District Court for the District of Columbia redacted the name of the service provider, the target phone number and the name of its alleged user. Lamberth ruled in part for prosecutors, reviving the government's push to obtain cell phone data. The judge reversed a magistrate judge's ruling from August. But Lamberth did not rubberstamp the government's request, submitted under the Stored Communications Act. Instead, he said prosecutors must present additional evidence to prove the requested data is material to the armed robbery investigation. The burden is lower than the one a warrant would require. The dispute gave the court the opportunity to explore the scope of a controversial Washington federal appeals court ruling about the propriety of warrantless GPS surveillance. In ruling against the government in the armed robbery matter, Magistrate Judge John Facciola said the D.C. Circuit's decision in Jones required the government to obtain a warrant to compel the disclosure of the requested cellular data. Lamberth said that Facciola concluded that cell phone data-including the location of the tower that transmitted a call-is "tantamount to the sort of continuous GPS surveillance" at issue in the GPS case. A "reasonable cellular phone customer presumably realizes that his calls are all transmitted by nearby cell-site towers, and that cellular phone companies have access to and likely store data regarding the cell-site towers used to place a customer's calls," Lamberth said. Lamberth said a person's "decision to place a cellular phone call and thus provide information regarding his location to the phone company thus defeats an individual's privacy interest in that information." Lambert's Ruling here.

top

People Are Starting To Leave Their Facebook Passwords In Their Will (Business Insider, 13 Oct 2011) - One in 10 people in the United Kingdom leave their passwords to sites such asFacebook, Flickr, andTumblr in their will, according to a story in the Guardian. Facebook makes it difficult for living members to get the passwords of their deceased relatives. As a result, a "growing numbers of people want their digital identities to be controlled after they are gone," Emma Barnett writes. "They also want their families to have access to personal photos and home videos which are now more commonly being stored in the cloud, rather in a physical album at home." The trend is increasing because people in Britain and all over the world have noticed Facebook walls of the deceased becoming easy targets for hacking and spammers. The European Union is also considering laws that would give living relatives easier access. But for now, an increasing number of wills will include a strange series of letters and numbers (or, you know, something like noah1234).

top

Three Emerging Cyber Threats (Bruce Schneier, 15 Oct 2011) - Last month, I participated in a panel at the Information Systems Forum in Berlin. The moderator asked us what the top three emerging threats were in cyberspace. I went last, and decided to focus on the top three threats that are not criminal: (1) The Rise of Big Data. By this I mean industries that trade on our data. These include traditional credit bureaus and data brokers, but also data-collection companies like Facebook and Google. They're collecting more and more data about everyone, often without their knowledge and explicit consent, and selling it far and wide: to both other corporate users and to government. Big data is becoming a powerful industry, resisting any calls to regulate its behavior. (2) Ill-Conceived Regulations from Law Enforcement. We're seeing increasing calls to regulate cyberspace in the mistaken belief that this will fight crime. I'm thinking about data retention laws, Internet kill switches, and calls to eliminate anonymity. None of these will work, and they'll all make us less safe. (3) The Cyberwar Arms Race. I'm not worried about cyberwar, but I am worried about the proliferation of cyber weapons. Arms races are fundamentally destabilizing, especially when their development can be so easily hidden. I worry about cyberweapons being triggered by accident, cyberweapons getting into the wrong hands and being triggered on purpose, and the inability to reliably trace a cyberweapon leading to increased distrust. Plus, arms races are expensive.

top

How the Top 50 Nonprofits Do Social Media (PhilanTopic, 17 Oct 2011) - We love a good infographic -- especially when it relates to things that interest us, like nonprofits and social media. This one, from craigslist founder Craig Newmark and the folks at craigconnects, kept us busy for a while. Based on an informal audit conducted in August and September, the infographic is intended to answer questions like: Do the highest-earning nonprofits use social media more effectively than nonprofits that earn less? Are those same nonprofits the most "engaging"? How are people using social media to respond to and interacting with large nonprofits? Here are a few key findings:

  • 92 percent of the top 50 nonprofits promote at least one social media presence on their homepage;
  • PBS has the most followers (840,653) on Twitter;
  • The American Cancer Society follows the most people/orgs (200,522) on Twitter;
  • Food for the Poor is the most "talkative" nonprofit on Facebook, with 220 posts over the two-month survey period;
  • The nonprofit with the highest net income, the YMCA, only posted 19 times to Facebook over the two-month survey period but has more than 24,000 fans.
top

- and -

Feds' Social Media Use Increases (NextGov, 18 Oct 2011) - Federal employees are increasingly turning to social media websites for work and personal use, particularly as more agencies lift restrictions on access, according to a new survey. The new Social Media in the Public Sector study, released Tuesday by Market Connections, found that just 19 percent of agencies ban access to some or all social media websites like Facebook, Twitter and LinkedIn. This is down sharply from 2010, when 55 percent of agencies banned access. The survey, which was conducted in September and drew nearly 900 public sector participants, including 352 federal employees and 272 government contractors, found that 74 percent of all respondents access social media websites at work, while 92 percent access them at home and 70 percent access them on mobile devices. The most widely used mobile devices by feds were the iPhone (53 percent), Blackberry (42 percent), Android (39 percent) and iPad (27 percent). LinkedIn and Twitter showed the biggest gains among social media websites used by federal respondents. Use of LinkedIn by feds, for example, grew from 32 percent in 2010 to 70 percent this year, while Twitter use increased from 30 percent last year to 55 percent this year. Eighty-six percent of federal respondents said they use Facebook, up from 72 percent last year, while 80 percent said they use YouTube, up from 61 percent in 2010, the survey found. Government-specific social networking websites also saw a boost in federal participation. According to the survey, 35 percent of federal workers and 55 percent of contractors said they use GovLoop, while GovTwit is being used by 30 percent of both government and contractor employees. Meanwhile, 37 percent of federal respondents said they are permitted to use social media as representatives of their agency, versus just 9 percent last year. Federal respondents said social media was most useful in helping inform decision making (100 percent), communicating externally with citizens and other agencies (81 percent), communicating with colleagues (78 percent), research (64 percent) and promotion/marketing (61 percent), the survey found.

top

- and -

Why I Deleted My Facebook Account (Bitter Lawyer, 18 Oct 2011) - Two weeks ago today, I did something that I thought was fairly non-controversial (I was wrong, apparently). I deactivated my Facebook account. And not just the half-hearted deactivation option Facebook offers, whereby your account remains saved and can be reactivated at any time-I actually completely deleted my account. Here's the really crazy part: I've spent the last 14 days fielding hundreds of emails from family, friends, and periphery ranging from mere curiosity to utter disbelief that I'm no longer on Facebook. No one can understand why I would ever want to disconnect myself from the (unfortunately) ubiquitous social network. Well, here's why. [Editor: isn't there some irony in the fact that she's blogging about escaping too-much-sharing with the "Screen People"? Still, I take her point.]

top

Los Angeles To Google: We Won't Pay For LAPD Seats (Business Insider, 18 Oct 2011) - One of Google's flagship government customers is trying to get out of paying for part of its contract, saying that Google has been too slow to meet its revised security requirements. Two years ago, Google got the City of LA to switch 30,000 employees from its old email system, Lotus Groupwise, to Gmail. But the deployment is going slower than expected because of additional security requirements by the LA Police Department. The LA Times reported on these problems back in April. Now, an August 2011 letter from Los Angeles CTO Randi Levin shows what the city is demanding. That letter says that CSC has been "unable to complete and comply with all LAPD security requirements" and other agencies that keep criminal records. So the city of LA is refusing to pay for those seats, and asking Google to do the work for free. "There will be no charge to the City for any Google licenses for the LAPD," proposes the letter. LA also wants Google to pay for the Groupwise licenses used by the LAPD through November 12, 2012.

top

Spanish Court Reverses Course: Says Linking To Infringing Material Is A Crime (TechDirt, 19 Oct 2011) - We've noted over and over again that Spanish courts have quite reasonably interpreted Spain's copyright law to mean that a site that just links to infringing content is not liable for the infringement. This makes a lot of sense. You should not blame a third party for the actions of its users. Yet the entertainment industry has made these rulings out to be an absolutely horrible miscarriage of justice, and have -- with the support of the US government -- pushed hard for draconian new copyright laws within the country. While public outcry (and leaked State Dept. cables showing that the US was really behind it) helped derail the effort the first time around, supporters are still trying to push it through. However, while the existing law stands, it's a bit surprising to see that one Spanish court has gone completely in the other direction and found the operators of a couple sites to be guilty of criminal copyright infringement, for which they may face a year in jail, in addition to fines. The lawyer for one of the guys suggests that this ruling is a result of politics, not the law. It's hard not to think that way given how it appears to fly in the face of most other decisions in Spain. I would imagine that there's still going to be an appeal in the case before it's really settled.

top

-but-

Supreme Court of Canada Stands Up for the Internet: No Liability for Linking (Michael Geist, 19 Oct 2011) - The Supreme Court of Canada today issued its much anticipated ruling in Crookes v. Newton, a case that focused on the issue of liability for linking to allegedly defamatory content. The court provided a huge win for the Internet as it clearly understood the significance of linking to freedom of expression and the way the Internet functions by ruling that there is no liability for a mere hyperlink. The key quote from the majority, written by Justice Abella: "I would conclude that a hyperlink, by itself, should never be seen as "publication" of the content to which it refers." This is an enormous win for the Internet since it rightly recognizes that links are just digital references that should not be viewed as republication of the underlying content.

top

Cyber Attacks and Warfare (Media Law Prof Blog, 19 Oct 2011) - Michael Gervais, Yale Law School, has published Cyber Attacks and the Laws of War. Here is the abstract:

"In the past few decades, cyber attacks have evolved from boastful hacking to sophisticated cyber assaults that are integrated into the modern military machine. As the tools of cyber attacks become more accessible and dangerous, it's necessary for state and non-state cyber attackers to understand what limitations they face under international law. 

This paper confronts the major law-of-war issues faced by scholars and policymakers in the realm of cyber attacks, and explores how the key concepts of international law ought to apply. 

This paper makes a number of original contributions to the literature on cyber war and on the broader subject of the laws of war. I show that many of the conceptual problems in applying international humanitarian law to cyber attacks are parallel to the problems in applying international humanitarian law to conventional uses of force. The differences are in degree, not of kind. Moreover, I explore the types of cyber attacks that states can undertake to abide by international law, and which ones fall short." Paper here.

top

French Cookies Are Beginning to Taste Like British Biscuits (Steptoe, 20 Oct 2011) - By the sound of things, French data protection regulators thought their lawmakers were acting a bit kooky when, as we previously reported, they passed an ordinance providing that consent for the installation of cookies by a website can be inferred by browser settings. In a public statement last month, the Commission Nationale de l'Informatique et des Libertés, France's data protection agency, stated its intention to strictly apply active consent requirements in enforcing the ordinance. Specifically, it said that browser settings allowing all cookies, without making a distinction between their purposes, cannot be deemed a valid consent expressed by the user. This new statement reflects a stricter reading of the requirements of amended EU privacy law than what was apparently expressed by French lawmakers in August, and it would appear to bring France's treatment of cookies more in line with the UK's approach.

top

RESOURCES

Find the Person Behind an Email Address (Digital Inspiration) - You get an email from a person with whom you have never interacted before and therefore, before you reply to that message, you would like to know something more about him or her. How do you do this without directly asking the other person? Web search engines are obviously the most popular place for performing reverse email lookups but if the person you're trying to research doesn't have a website or has never interacted with his email address on public forums before, Google will probably be of little help. No worries, here are few tips and online services that may still help you uncover the identity of that unknown email sender. [Editor: Interesting; the TinEye tool looks scary, and worked when I searched for one of my own head-shots; we're not too far away from full-bore facial recognition tools.]

top

FUN

Wilful vs. Willful (Volokh Conspiracy, 19 Oct 2011) - A student saw "wilful" used in an opinion, and asked whether it was a typo. How things have changed in a few decades! Here's a Google Ngrams graph comparing the use of "wilful" (blue) and "willful" (red) in Google's American English sources * * * "Wilful" was once the only common spelling (and still remains the dominant spelling in British English, again according to Google Ngrams ). But then things changed, and now "willful" is considerably more common. Indeed, a quick Westlaw query suggests that "willful" is 10 times more common in 2011 court opinions. It's thus probably wiser to use "willful," unless one knows that one's audience (say, a judge) has a contrary preference; using the more common spelling is more likely to convey your message without needlessly distracting the reader. Interestingly, the first two references I found for "wilful [sic]" in court cases were in 1962 and 1963, though in those years judicial usage was nearly evenly split between "wilful" and "willful." Those references were the only such "sic" references until 1971, but it the last few years, there have been more than 10 "wilful [sic]" references in court cases per year, which further reflects how dominant "willful" has become.

top

LOOKING BACK

CAMERAS SCANNED FANS FOR CRIMINALS (St. Petersburg Times, 31 Jan. 2001) Were you one of the 100,000 fans and workers to pass through the stadium turnstiles at Sunday's Super Bowl? Did you smile for the camera? Each and every face that entered Raymond James Stadium for the big game was captured by a video camera connected to a law enforcement control room inside the stadium and checked electronically against the computer files of known criminals, terrorists and con artists of the Tampa Police Department, the FBI and other state and local law enforcement agencies. Sunday's Super Bowl was the first major sporting event to adopt the face-matching surveillance system. But the designers of the system expect other security-sensitive sporting events, ranging from the upcoming 2002 Winter Olympics in Salt Lake City to the hooligan-plagued soccer leagues in parts of Europe, to express great interest. http://www.sptimes.com/News/013101/TampaBay/Cameras_scanned_fans_.shtml

top

U.S. CONGRESS EYES VIRTUAL ASSEMBLY OPTIONS Spooked by anthrax in the U.S. Capitol Building, lawmakers are considering an option proposed by the Democratic Leadership Council to convene "an electronic Congress." The DLC says a Web site "could easily be built" that would allow Congress and their staffers to debate, draft legislation and vote over the Internet. Such a site likely would use biometrics or "human verification" procedures to restrict access, and "the best system might require members to spread around the country to go to the nearest state capitol or city hall to use special kiosks there." The proposal, contained in an article titled "Legislating by Any Means Necessary," suggests that the site could be open to the public on "a read-only basis, so citizens could watch their representatives much as they can now on C-SPAN." A DLC staffer who worked on the report says, "This was supposed to be a conversation starter. We put this out there not as a full-baked proposal, not as an end-to-end solution." (Wired News 25 Oct 2001) http://www.wired.com/news/politics/0,1283,47841,00.html

top

NOTES

MIRLN (Misc. IT Related Legal News) is a free e-newsletter published every three weeks by Vince Polley at KnowConnect PLLC. You can subscribe to the MIRLN distribution list by sending email to Vince Polley ( mailto:vpolley@knowconnect.com?subject=MIRLN) with the word "MIRLN" in the subject line. Unsubscribe by sending email to Vince with the words "MIRLN REMOVAL" in the subject line.

Recent MIRLN issues are archived at www.knowconnect.com/mirln. Get supplemental information through Twitter: http://twitter.com/vpolley #mirln.

SOURCES (inter alia):

1. The Filter, a publication of the Berkman Center for Internet & Society at Harvard Law School, http://cyber.law.harvard.edu

2. InsideHigherEd - http://www.insidehighered.com/

3. SANS Newsbites, sans@sans.org

4. NewsScan and Innovation, http://www.newsscan.com

5. BNA's Internet Law News, http://ecommercecenter.bna.com

6. Crypto-Gram, http://www.schneier.com/crypto-gram.html

7. McGuire Wood's Technology & Business Articles of Note

8. Steptoe & Johnson's E-Commerce Law Week

9. Eric Goldman's Technology and Marketing Law Blog, http://blog.ericgoldman.org/

10. Readers' submissions, and the editor's discoveries.

This work is licensed under the Creative Commons Attribution-Share Alike 3.0 United States License. To view a copy of this license, visit or send a letter to Creative Commons, 543 Howard Street, 5th Floor, San Francisco, California, 94105, USA.

PRIVACY NOTICE: Addresses and other personal information provided during the subscription process will be kept confidential, and will not be used for any other purpose. top

Posted by at No comments:
Subscribe to: Posts (Atom)