Payment Card Industry Takes a Swipe at Virtual Security

Someone in the payment instrument, payment processing, or payment systems environment must be living under a rock if he or she has not heard of or been affected by the Data Security Standards (DSS), or “PCI-DSS” as it has been referred to in the industry, promulgated and released by the Security Standards Council of the Payment Card Industry Association (PCI). Although the original impetus for the credit-card-driven security standards was combating identity theft and credit card fraud in the wake of the data breaches and compromised (or potentially compromised) databases containing sensitive consumer payment account information, the standards have become the de facto starting point for any compliance security standard in the payment industry.

Last week, the PCI Security Standards Council released new comprehensive guidelines for PCI compliance in virtual card holder data environments dealing with consumer payment system and payment transaction security in a virtual environment. Reed Smith lawyers who work in this area consistently and who have a wealth of experience with information security and financial services, have put together a client alert entitled: "Is the PCI Security Standards Counsel Preparing for Cloudy Weather?"

Credit, debit and prepaid cards; smart cards and chip cards; gift cards and stored value cards; co-branded cards and loyalty rewards programs; corporate cards, fleet cards and purchasing cards; data protection and privacy; information security, identity theft and data breaches; micro, digital and virtual payment systems – E Commerce; The Fair Credit Reporting Act; Regulation E; Regulation Z; Credit Card Act of 2009 (see Credit Card Act of 2009: Act I, Scene 1 or just search the Legal Bytes blog)! Do any of these terms apply to you? Talk to us. It’s what we do. Contact any of the lawyers listed in the Alert, contact me, or contact the lawyer at Reed Smith with whom you routinely work, and we will make sure we help you or connect you to someone at Reed Smith who will be happy to do so.

China Announces State Internet Information Office

This post was written by Joseph I. Rosenbaum, Frederick H. Lah, Zack Dong and Amy S. Mushahwar.

On May 4, 2011, the Chinese government announced it was establishing the State Internet Information Office, an office dedicated to managing Internet information. According to the announcement, this office will be responsible for directing, coordinating, and supervising online content management. The office will also have enforcement authority over those in violation of China's laws and regulations (see, for example, China sets up office for Internet information management). While there are reports that many believe the purpose of the new office will be to censor political and social dissidents (see, China Creates New Agency for Patrolling the Internet, the office may also have a key role in thwarting illegal spamming and other dubious data practices.

Further, many see the establishment of this office as another step forward for the Chinese in terms of establishing their own data-protection regime. China has long been considered as lagging behind other countries in terms of their data-protection standards (quite possibly by design), and with no comprehensive data privacy law, businesses have had little guidance concerning the handling of personal data. China published the draft Personal Information Protection Measures in 2005, but those Measures have not yet been adopted and little progress seems to have been made since then. However, in February 2011, China issued a draft of the "Information Security Technology - Guide of Personal Information Protection" ("Guidelines") to address the lack of guidance and standards surrounding online information practices in China. The Guidelines include standards with respect to collecting, processing, and using data, and there are provisions related to the transfer of data to third parties. While the Guidelines are technically non-binding, they still provide important guidance for businesses in China on how to protect the online information of China's citizens. With the Guidelines still under review, Reed Smith lawyers will continue to monitor developments to see what form the Guidelines will take in the future.

If you have or are considering a presence in China, you need to know and be attentive to many things, if you are to succeed in the Chinese marketplace. That’s why you should contact Frederick H. Lah in our Princeton office, Zack Dong in our Beijing office, Amy S. Mushahwar in our Washington, D.C., office, me, or the Reed Smith lawyer with whom you regularly work. When you need legal guidance or have questions about regulations that apply online, on the Web, and across the Internet, in almost any part of the world, let us know. We are here to help.

Deep Throat Gains Respectability in the Digital Age

Check out the International Law Office to see its authorized, customized article, “Investigative journalism enters the digital era”  of our prior blog posting, “Dear WikiLeaks, Here We Come. Sincerely, The Wall Street Journal.” Thanks, ILO!

Do Not Track - Diving Deeper Into the Quicksand

Coming on the heels of a bill aimed at preventing children from being tracked, introduced by Rep. Ed Markey (D-Mass.) (see, Rep. Markey Releases a Kids Do Not Track Discussion Draft Bill): Today, Jay D. Rockefeller (D-W.Va.), Chair of the Commerce, Science & Transportation Committee in the U.S. Senate, introduced a Do Not Track Online bill that would empower the FTC to promulgate rules "that establish standards for the implementation of a mechanism by which an individual can simply and easily indicate whether the individual prefers to have personal information collected by providers of online services, including by providers of mobile applications and services . . . "

A copy of the proposed legislation is available here for you to download and read Do Not Track Online Act of 2011 – Proposed Rockefeller Bill (PDF). Of course, if you need legal guidance, advice or representation as these bills are introduced and make their way through the legislative process, don’t hesitate to call us. We are here to help.

The Tip of the Iceberg - 'Do Not Track' Kids Bill Proposed

After several months of anticipation, Rep. Ed Markey (D-Mass.) released his Kids "Do Not Track" discussion draft bill. At face value, this bill appears to have a narrow focus of online behavioral activities toward children, which we normally define under the Children's Online Privacy Protection Act ("COPPA") as any individual younger than 13. However, such is not the case. This bill would amend COPPA to expand some marketing provisions to teens under age 18, and may, in effect, require better age screens, given teen savvy (and their propensity to lie about their age).

If enacted, this bill has the potential to create complications when marketing to the crucial college age and young adult market as more sophisticated age screens will require all to enter information that they might not want to share online.

To read the entire Reed Smith Alert and find out more, just check out Rep. Markey Releases a Kids Do Not Track Discussion Draft Bill.

ILO Publishes 'Twitter Settles with FTC - Gets 20 Years' Probation!'

On April 5, 2011, the International Law Office published a customized version of the March 14, 2011 blog on Legal Bytes, Twitter Settles with FTC - Gets 20 Years' Probation! You can read it online or download your own copy of the ILO posting here: ILO Posts Twitter Settlement news.

Italian Courts Order Yahoo! Italia To Keep the Links Missing

I picked up an interesting article published today in the International Law Office, and since the article is listed in the category of Information Technology, I thought some Legal Bytes readers with international interests and activities that are "content," "search" or "link" related might not see it.

The article summarizes a case in which Yahoo! Italia was held responsible for failing to remove links to infringing versions of a motion picture – thus, in the court's view, resulting in contributory liability. What is also of interest is that the Italian court ordered Yahoo! in Italy to not only remove links to websites that "served" the allegedly infringing content, but also to remove any other websites that contained links to the websites serving that content – even if those websites had other links or provided other legitimate content, features and functions. Such a decision could have far-ranging implications since it goes to the heart of the ripple effect that linking has on legitimate content-sharing. It also raises the chilling specter of restricting access to otherwise legitimate, non-infringing content, features and functions based on a finding that there is a link to infringing material.

While one can make the case that such strong enforcement helps deter and ultimately prevent infringement, the breadth of the decision and the fact that a rights-holder can simply send a notice without requiring formal "proof" of infringement, means every link to every website that connects to an offending website could potentially be forced to de-link, and arguably bears some liability for contributory infringement. Think of the connections on social media, embedded players and links on the web – Wow!

If you want to read the entire article, you can access it right here Yahoo! Italia liable for searchable content. And as always, if you need advice from a U.S. lawyer who has done work with Italian companies and legal colleagues in Italy, call me, Joseph I. ("Joe") Rosenbaum, or any of the Reed Smith attorneys with whom you regularly work.

Darwin Was Right. It's All About Biology!

I have been stupid. It's everywhere and I couldn't see it. I'm looking at trying to invest my hard-earned dollars and wondering about the future of mobile and social media and technology. Hmmmm, maybe I should pour some money into that sector of the economy. But how to decide – price-to-earnings ratio, market multiple, return on equity, assets, sales? Then it dawned on me. Shhhh .. . I'll let you in on a secret I discovered. It's biology – natural selection, evolution, survival of the fittest – Charles Darwin was right.

Think about it. Sony says "It's in our DNA." Twitter is for the birds. Social media is in your Face(book). Think it stops there? No way. Apple – the original sin. Gone viral – my anti-virus software has been in use for years. Make a firewall to stop it from spreading. Cookies? Baked to perfection! Who gives a Hoot(suite)? Oh and if you think the Droid or Android are not part of the mix, just watch Star Wars for those artificial parts, artificial intelligence and artificial sweeteners. 

My blog has gone viral along with YouTube videos. Word of mouth marketing – even the blog conjures up images of Steve McQueen in a very old movie ("The Blob"– who remembers, raise your hands). Hear the buzz – not the sound of bees, but rather the web browsers. Firefox? How about the wireless photographic memory cards from Eye-fi? Did I mention cloud computing – is that cloud 9 or should I get off my cloud as the Rolling Stones asked me to do many years ago?

Not convinced yet? Just the other day researchers at IBM announced that they have developed a nanoparticle that has the ability to target and destroy bacteria that has otherwise proved to be resistant to antibiotics. Now I originally thought a nanoparticle was something harvested from Ork, the planet made famous by Robin Williams in the television series "Mork & Mindy." But apparently, nanoparticles are itsy bitsy particles, so small you could fit tens of thousands of them on the head of a pin.    

So all you investment advisors, financial analysts, brokers and day traders, watch out. Pick the biologically named company of choice or, better yet, start a company, and watch it evolve, grow, mature and hopefully not crash before I sell. I personally am not surprised that Jim Beam has been around since 1795! 

Federal Grand Jury Seeks To Open Pandora's Box

Knock Knock. Who's there? Andover. Andover who? Andover those records Pandora.

So Pandora Media, Inc., the company that brings us the popular Pandora® Internet Radio, has reportedly received a subpoena from a federal grand jury looking into the practice of information-sharing involving smart phone applications. Pandora did indicate, however, it had been advised it was not a target of the grand jury investigation, and that it believed the legal request for the production of information had been served on an "industry-wide basis" to many other smart phone application publishers. Not much else is known about either the specific subpoenas (or is the correct Latin, "subpoenae"?) or the nature or focus of the federal investigation; but guessing that it relates to the sharing of information about location-based target-marketing practices, and the disclosure of information by and among ad publishing networks, can't be far from the target.

The Advertising Technology & Media law practice group, in conjunction with our global regulatory practice and litigators when we need them, has experience in dealing with such subpoenae (or is the correct English "subpoenas"?). Think about knowing how to respond before you get served – with a subpoena or on a platter. OK. I'm still in the April Fool's Day spirit. What can I say?

I See Paris, I See France: Google's Street View Draws French Fine

On December 20, 2010, a Legal Bytes blog entitled Look! Out the Window! It's a Peeping Tom! No, It's Google Street View noted the problems Google was facing as a result of a faux pas in connection with its Street View automobiles roaming the streets equipped with cameras. As we reported earlier, Google's picture-capturing vehicles appear to have accidentally gathered data over unsecured Wi-Fi systems in more than one country and city around the globe – including France.

Although Google agreed to delete the Wi-Fi data collected accidentally and has apologized, if one picture is worth a thousand words, France has apparently decided that Google's pictures were worth about €100,000. This is reportedly the highest fine imposed by the CNIL (the National Commission for Information Freedom – the French data-protection regulatory body) since it was given the authority to levy financial penalties in 2004. The financial sanctions were levied because Google's activities were considered to be "unfair collection" of data under French law, data that Google was able to collect for economic advantage. The "accident" resulted from some "sniffing" programming code that ostensibly carelessly found its way into the equipment capturing Street View data in the cars as they roamed highways and byways.

While other countries are considering fines and investigations that are on-going, some countries (e.g., the United States) have apparently dropped the investigations or are not considering penalties at this time. This is not the last we will hear of location-based or geo-targeted information raising an uproar, as people "check in" and the surveillance society becomes closer to reality than we often care to admit. The law and regulation are not harmonized around the globe, and many regulators and laws don't even adequately address the problem – often created because, like so many other issues in our digital world, some information is being shared voluntarily, some is not, and some is a blend.

As always, if you need advice and counsel about your own advertising and marketing efforts, or privacy and data protection guidance from legal representatives who deal with these issues – in the United States and around the globe – every day, feel free to call me, Joseph I. ("Joe") Rosenbaum, or any of the Reed Smith attorneys with whom you regularly work.

Look! Out the Window! It's a Peeping Tom! No, It's Google Street View.

The recorded legal enforcement of privacy dates back to at least 1361, when Justices of the Peace Act in England provided for the arrest of Peeping Toms and eavesdroppers. In the 1760s, English Parliamentarian William Pitt wrote: "The poorest man may in his cottage bid defiance to all the force of the Crown. It may be frail; its roof may shake; the wind may blow though it; the storms may enter; the rain may enter – but the King of England cannot enter; all his forces dare not cross the threshold of the ruined tenement." Translation: One's home is one's castle.

The right to be free from unlawful searches and seizures and intrusions into one's home is among the earliest expressions of the legal right to privacy. Today, privacy has been woven into the fabric of the laws and regulations of most countries throughout the world. The Preamble to the Australian Constitution states: "A free and democratic society requires respect for the autonomy of individuals, and limits on the power of both state and private organizations to intrude on that autonomy. Privacy is a key value which underpins human dignity and other key values such as freedom of association and freedom of speech. Privacy is a basic human right and the reasonable expectation of every person." The 1948 Universal Declaration of Human Rights may well be the first multi-national, international legal document moving privacy to the level of a legally enforceable principle, noting that no one should be subject to arbitrary interference with privacy, family, home or communication, nor attacks on honor or reputation, and that each individual should have the right to legal protection against such interference or attack. In 1965, the Organization of American States proclaimed the American Declaration of the Rights and Duties of Man, which called for protection of numerous human rights, including the right of privacy.

We've come a long way. Today, Google's Peeping Toms are roving street cars equipped with cameras and are allegedly violating privacy rights left and right as they roam through your neighborhood. If you hadn't heard, Google reported earlier this year that in the course of its Street View automobiles roaming the streets of cities in more than 30 countries, its picture-capturing vehicles had also accidentally gathered data over unsecured Wi-Fi systems. Oops! Some of Google's woes stem from mistakenly collecting data it allegedly should not have, although many privacy advocates and some regulators are protesting the actual picture-taking itself – even though the streets are public – not just the inadvertent capture of such data. Google has agreed to delete Wi-Fi data collected accidentally and has apologized (e.g., New Zealand, United Kingdom) for collecting personal data (e.g., personal emails, passwords) from wireless networks.

Although this past October (2010), the FTC in the United States indicated its inquiry into violations of privacy by Google's Street View cars was ended – noting that Google had made efforts to increase its privacy and security processes and compliance procedures – Google is still facing a slew of questions, objections and government inquiries. Inquiries remain pending from attorneys general in a number of U.S. states, and at last count, about six or seven actual or putative class-action suits were pending.

In Germany, regulators have forced Google to agree to allow individuals to opt out of Street View and, when doing so, there will be computer-generated pixilation of their houses, instead of a photo, effectively blurring detail. Even with Google's recent actions to bolster its compliance and sensitivity to privacy concerns, German investigators may still pursue investigations and violations. Indeed, investigations are also underway in Australia, France, Ireland, Italy and Spain.

In the "you can't make this up" category on the subject, Legal Bytes recently saw a report that a woman in Japan is suing Google for about $7,000 for psychological damages because images of her underwear have appeared on the clothes washing/drying line outside her home displayed on Google Maps. Mainichi news service in Japan reports that part of her allegations state: "I was overwhelmed with anxiety that I might be the target of a sex crime. It caused me to lose my job and I had to change my residence."

When do public photographs become grist for the Peeping Tom mills? What about government surveillance? Satellite photos? Drone imagery? I, for one, am giving up sunbathing on the roof from now on!

Privacy is a dynamic and evolving concept – one not uniformly dealt with or perceived around the world, or even within nations. Privacy is often blurred with identity issues or security principles, in some cases overlapping and in others just emotionally charged rhetoric. Witness the recent FTC and Department of Commerce reports, each ostensibly dealing with "privacy." You can read about it on blogs posted by our Global Regulatory Enforcement Group, as well as right here on Legal Bytes (see, 'Tis The Season To Issue Privacy Reports - NTIA Green Paper, Protecting Consumer Privacy - FTC Issues Staff Report and Privacy & Data Security Bills After the Midterm Elections), or search "privacy" in the search box in the left side navigation bar. But there is no substitute for getting the advice, counsel and guidance about your own particular situation from legal representatives who deal with these issues – in the United States and around the globe. So if you do need assistance, call me, Joseph I. ("Joe") Rosenbaum, global chair of Reed Smith's Advertising Technology & Media law practice, or any of the Reed Smith attorneys with whom you regularly work.

'Tis The Season To Issue Privacy Reports - NTIA Green Paper

Just a few moments ago, in their own words: "The Commerce Department Office of the Secretary, leveraging the expertise of the National Telecommunications and Information Administration ("NTIA"), the Patent and Trademark Office ("PTO"), the National Institute of Standards and Technology ("NIST"), and the International Trade Administration ("ITA"), has created an Internet Policy Task Force to conduct a comprehensive review of the nexus between privacy policy, copyright, global free flow of information, cybersecurity, and innovation in the Internet economy." That introduction prefaced the release by the NTIA of its "Green Paper" (which you can download and read), Commercial Data Privacy and Innovation in the Internet Economy: A Dynamic Policy Framework.  The Federal Register notice of this paper will seek public comments, noting that they will be due on or before January 28, 2011. 

While Legal Bytes and Reed Smith will digest the report more thoroughly and report to you in the days and weeks ahead, the report at first blush focuses on four major themes:

  • Support for Fair Information Practices Principles (FIPPS), noting the need and importance of greater transparency, consumer control and data security
  • Support for self regulation
  • Creation of a national Privacy Policy Office to coordinate voluntary, enforceable, self-regulatory programs
  • The need for greater harmonization of privacy laws and self regulation internationally

Stay tuned for further information and analysis, but if you want to be part of the conversation; if you feel you should have a voice in the discussion and are considering submitting comments; or if you simply want to better understand the implications, the interplay between this report and the recently released FTC report (see Protecting Consumer Privacy - FTC Issues Staff Report)posted on Legal Bytes December 2, 2010), please don't hesitate to contact me, Joe Rosenbaum, or any of the Reed Smith attorneys with whom you regularly work.

Protecting Consumer Privacy - FTC Issues Staff Report

This post was written by Paul Bond, Chris Cwalina, Amy Mushahwar and Fred Lah.

The FTC just released its long-awaited Protecting Consumer Privacy in an Era of Rapid Change. This preliminary staff report proposes a major change in U.S. privacy law. The FTC is accepting comments on this report until January 31, 2011, and if you could be affected by these changes and would like to submit comments, or if you are considering submitting comments to the report (or perhaps you aren't sure if you should), Reed Smith can help. While we are still reviewing the 123-page report in depth, we wanted to share a few thoughts from an initial reading.

The report proposes a major change in the framework of U.S. privacy law, stating bluntly: "Industry must do better." The report notes, among other things:

  • Notice-and-consent doesn't work. People don't read or understand privacy notices as now written. The Commission's view is that privacy policies have become "long" and "incomprehensible."
  • Waiting for harm to consumers isn't an effective way to enforce privacy norms. Harm has traditionally meant economic or physical harm. Privacy harms include reputational harms and even the emotional harm of having one's information "out there," or "fear of being monitored." The new framework must address and allay these anxieties; however, there is some disagreement among the Commissioners. Commissioner J. Thomas Rosch, in his concurrence, notes "the Commission could overstep its bounds" if it were to begin analyzing these more intangible harms when assessing consumer injury.
  • Industry self-regulation is too little, too late, and has failed to provide adequate and meaningful protection.

The report challenges a number of privacy and security assumptions. The report:

  • Casts severe doubt on claims that de-identified information need not be protected, citing multiple instances and methods by which personally identifiable information (PII) can be culled from "non-name" information (e.g., IP addresses, other unique identifiers). The distinction between PII and non-PII is, the report says, "of decreasing relevance." Consequently, the scope of the report is very broad and applies to "all commercial entities that collect or use consumer data that can be reasonably linked to a specific consumer, computer or other device."
  • Purports to apply in the online and offline world, and not only to companies that work directly with consumers.
  • Suggests that consumers must be made aware of and consent to onward transfers of information to non-affiliates no matter what the industry, universalizing the consumer notice requirements that previously only applied to certain highly regulated industries (e.g., telecommunications, education, health care, financial services), or certain types of sensitive data (e.g., credit data, bank accounts, medical records).
  • Distinguishes between "commonly accepted data practices" and all other data practices. Borrowing from GLBA and HIPAA, using data to aid law enforcement, or in response to judicial process or to prevent fraud, would not require notice to or consent of consumers, but ALL other data practices (e.g., behavioral advertising and deep packet inspection that are explicitly named as not commonly accepted data practices) would require notice and consent in a form easy to read and understand, ideally provided to the consumer when the consumer enters his or her personal data. The report suggests opt-in consent be obtained prior to implementing any material changes to company policy that would apply to data collected under a prior privacy policy.
  • Suggests that to promote a free and competitive market, the privacy practices of companies need to be more transparent to consumers, and that consumers be given "reasonable access" to their data.
  • Notes that appropriate data-retention periods should be a legal requirement. The report sites geolocation data as especially important to phase out.
  • Endorses a "Do Not Track" mechanism, recognizing that such a mechanism would be far more complex than the National Do Not Call registry. The FTC supports either legislation or self-regulatory efforts to develop a system whereby a consumer could opt not to be "tracked." The FTC has expressed a distinction between "tracking" and "interest-based" advertising. And, in later discussions regarding the report, the FTC has stated that it will treat first-party advertising more favorably than third-party ad servers. The FTC has not decided on the technical mechanism for creating such a registry, but it recognizes a browser-based solution – similar to the privacy plug-in on the Firefox browser or incognito mode in Google Chrome. The FTC has not indicated if opt-in or opt-out would be the default browser setting for any browser privacy technology deployed.

So what should businesses do?

First, companies should carefully review the report and all the questions made open for public comment. These are listed in Appendix A to the report, but additional questions are posed in the Commissioner dissent statements.

Second, companies should strongly consider commenting on the report. In our experience, the FTC will listen and often address business concerns. But you must be heard. Trade associations are a good place to start, but individual company voices are important, especially if you have unique issues that should be addressed.

Third, now is a good time for you to pull back and consider your privacy policies, practices and programs, and the extent to which privacy is incorporated into your everyday business practices. The report suggests every company should adopt "privacy by design," "building privacy protections into everyday business practices," "assigning personnel to oversee privacy issues, training employees on privacy issues, and conducting privacy reviews when developing new products and services."

You can read and obtain a copy of the FTC's full report here

If you need help, want more information, want to comment, or simply require some guidance – whether counsel or representation – in an area that is of critical importance to businesses and consumers, please don’t hesitate to contact Paul Bond, Chris Cwalina, Amy Mushahwar, Fred Lah or me, Joe Rosenbaum, or any of the Reed Smith attorneys with whom you regularly work.

Internet Communications - Encryption Is Not Enough

Most of us have come to enjoy the convenience of secure communications over the Internet, enabling us to feel comfortable that a broad range of commercial transactions, and remote access through virtual private networks (VPNs), as well as the transmission and retrieval of data from the Cloud, are secure – at least reasonably so. However, such communications may be less secure than people think. It has recently come to light that the processes used to authenticate the identity of the party (or organization) with whom one is communicating may actually be deeply flawed. In almost all cases, businesses and individuals alike unwittingly trust a large number of "certificate authorities" (so-called “CAs”) to essentially authenticate or vouch for the identity of the endpoints of secure communications over the Internet. 

CAs hail from across the globe. Some are private entities while others are associated with, or operated by, governments – in some cases perhaps a government one may not wish to trust. Still other CAs may simply be incompetent. No matter which is the case, it is clear that these CAs have the power to facilitate man-in-the-middle wiretap exploits and "phishing" through imposter servers. Isn’t it time for general counsel and IT to work together to shore up the authentication processes, because Encryption is Not Enough...

If you aren’t sure your communications are secure, or if you simply don’t know enough to determine the right questions to ask, contact Steven B. Roosa directly, or the Reed Smith attorney with whom you regularly work.

U.S. Supreme Court Case Tests Privacy in Employment Context

This post was written by Paul Bond.

Companies routinely issue communications devices to employees for on-the-job use. Employees routinely use such devices to conduct personal business, wasting company resources and sometimes violating company codes of conduct. Under what circumstances may a company monitor messages to and from an employer-issued device? That question is currently before the U.S. Supreme Court in the case City of Ontario v. Quon.

The CSO Breakfast Club, an organization of Chief Information Security Officers from around the country, recently interviewed Reed Smith attorney Paul Bond about the potential ramifications of the case. 

The City issued Sergeant Quon a pager for work use and he signed an agreement acknowledging he had no expectation of privacy in his communications. When Sergeant Quon kept going over his character quota, a supervisor told him the supervisor would not audit communications, provided Sergeant Quon paid for the overages. A departmental audit revealed that Sergeant Quon was regularly sending highly inappropriate texts to his wife, girlfriend, and a fellow officer. All of them sued the City for violations of their constitutional rights to privacy. The Supreme Court briefing and a transcript of the spirited oral argument are available at SCOTUS Wiki, (neither Legal Bytes nor Reed Smith can vouch for the accuracy of the material or analysis on this external link).

Employers are watching this case closely to see if the nation's highest court will provide any guidance on the ground-rules for monitoring employee use (and abuse) of company-issued communications devices; but whether you want to stay in tune with developments or you need help in this area, contact Paul Bond. Of course, you can always call me, Joseph I. Rosenbaum, or any Reed Smith attorney with whom you regularly work.

LifeLock CEO May Not Be Giving Out His Social Security Number Anymore

Todd Davis, the CEO of LifeLock is not the first CEO to appear in advertising, but was probably the first to prominently display his U.S. Social Security Number in full-page ads in major newspapers and billboards across the country. Although these ads disappeared a while ago, the action brought by the Federal Trade Commission and the Attorneys General of 35 states of the United States, has now resulted in a settlement valued at $11 million. FYI, the states involved were: Alaska, Arizona, California, Delaware, Florida, Hawaii, Idaho, Illinois, Indiana, Iowa, Kentucky, Maine, Maryland, Massachusetts, Michigan, Missouri, Mississippi, Montana, Nebraska, Nevada, New Mexico, New York, North Carolina, North Dakota, Ohio, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Vermont, Virginia, Washington, and West Virginia. The settlement resolves claims that LifeLock’s advertising was deceptive and misleading and misrepresented the types of services consumers could expect if they become victims of identity theft and their personal information was compromised.

While LifeLock does provide some measure of identity-theft protection, it was apparently not as robust and comprehensive as the advertising might lead a consumer to believe (personal information would be “useless to a criminal”). As a result of the action, not only has LifeLock promised to make changes (or has already made changes) to address the FTC complaint - in its business practices as well as its advertising - but the complaint also named CEO Davis and his co-founder Robert J. Maynard, Jr., who both will be barred from making the same misrepresentations as LifeLock. The $11 million received from LifeLock will provide refunds to consumers who signed up for the service. Information about eligibility and how the redress program will work can be obtained directly from the FTC - LifeLock Redress Program.

FTC Chairman Leibowitz stated: “Consumers received far less protection than they were promised," noting further that LifeLock’s service was ineffective against identity theft involving existing credit cards or bank accounts. Despite the advertised claims, according to the FTC, LifeLock often did not encrypt data in storage or transmission, didn’t install any antivirus protection software on computers used by employees, and failed to even require strong password protection for employees’ access to systems and files.

The documents were filed by the FTC in the U.S. District Court for the District of Arizona, and you can obtain a full copy of the original Complaint and the Stipulated Final Judgments against LifeLock, Davis and Maynard, right here: Federal Trade Commission v. LifeLock.

The Advertising Technology & Media law practice has lawyers and the resources of Reed Smith’s litigation and regulatory enforcement team to help clients seeking to prevent legal and regulatory problems and, if necessary, defend you if they arise. We have a team of data security and identity-theft lawyers with hands-on experience who know how to respond if a data breach occurs and can counsel you in complying with federal and state requirements. Need to know more? Call Joe Rosenbaum, or any of the lawyers at Reed Smith with whom you work - and, by the way, don’t give out your Social Security Number.

Isn't Technology Supposed to Help Us? Help Us Work Smarter?

If you have been reading Legal Bytes regularly, you know that Lois Thomson here at Reed Smith has been one of the primary people supporting my efforts to transform "legal-ese" into understandable English – no trivial task for those of you who are interacting or have ever interacted with lawyers. So it is with great joy that I was not only able to have her write a post for Legal Bytes, but that I also finally got to edit her article. Hopefully she will smile and agree it's been helpful. So, Lois, thank you, and here is your relevant and very timely note for all the world to see:

"I looked at an email I received from my friend, Robert, and wondered why the subject line was a reply regarding an issue of Legal Bytes that I had proofread for Joe Rosenbaum. 'Are you aware that you have been sending these to me?' Robert's message read. 'It seems like that might have been a mistake.'

"Ouch! A mistake indeed! You see, when Joe sends his documents to me to review, I proof them and make my suggested changes. I then simply hit the forward button to return them to him. Now as many of you email-program (e.g., Outlook) users already know, to make life easier (that's ostensibly what technology is supposed to do), once I start to type in "ro," Rosenbaum, Joseph I.'s name should automatically populate the 'To' field. Oops. Not this time. Instead, my friend Robert's name came up, and without looking – as I'm guessing so many of us routinely do – I hit enter and sent it off, pleased I had been so timely and responsive. Unfortunately, I was responding to my friend Robert, who may happily read Legal Bytes, but not, I suspect, the artist's proof!

"Fortunately, Joe and Robert were gracious about the whole thing and in this case, both felt no harm was done. But what if the message had been from your lawyer or doctor or a rabbi or priest, or was some other communication that was not ultimately meant for public consumption. It was a simple but powerful reminder to me (and one that Joe felt was important enough to ask me to pass it on to you), that while automated tools can make routine tasks like 'field completion' simpler, they can also lead to problems if we rely on them without thinking. Hmmmm, now why can't I remember phone numbers anymore – is it because they are all programmed into every device I own, so that I no longer have to think?"

A helpful reminder that while automated tools are great, they are just that – tools. If we aren't careful, the tools can work against us and not for us, and can create embarrassment at best, liability at worst. Thank you Lois (and Robert).

Need to know more? Contact me, Joseph I. Rosenbaum, or any Reed Smith attorney with whom you regularly work. Need proofreading skills? If you don't work for Reed Smith, don't call Lois. She's busy helping us every day. Thanks again, Lois.

HITECH Means High Stakes in First-Ever State HIPAA Lawsuit

Yesterday, the Attorney General of the State of Connecticut filed suit against the Connecticut subsidiary of Health Net, charging it with violations of the privacy and security requirements of HIPAA. The action, filed yesterday in the United States District Court in Connecticut, comes on the heels of a security breach involving medical records and Social Security numbers. The suit also names United Health Group Inc. and Oxford Health Plans LLC, who acquired Health Net of Connecticut but who were not involved in the data breach.

If you forgot, last year the Health Information Technology for Economic and Clinical Health Act (HITECH), for the first time authorized individual state attorneys’ general to enforce the security and data privacy regulations under HIPAA, and this appears to be the first such action.

The lawsuit claims that Health Net in Connecticut failed to provide adequate security for the medical and financial records of hundreds of thousands of enrolled individuals, and failed to notify them promptly in connection with the breach. The breach, which took place last May, involved the disappearance of a computer hard drive. Health Net eventually reported the breach, posting a notice on its website and starting a staggered process of mailing letters to consumers November 30, 2009, almost six months after the security breach. For those of you involved in the collection, handling, maintenance, or use of personal, financial and medical information covered by HIPAA, new federal rules under the HITECH Act require "timely" notification of certain breaches, rules that have a compliance deadline of February 22, 2010.

Health Net attributed the delay in reporting to its inability to determine exactly what was on the computer hard drive that disappeared, thus not being sure if a notice was even required. One can only surmise that the mere fact that Health Net didn’t know what information was contained on a removable computer hard drive made its reasoning less than satisfactory to the Connecticut State Attorney General. Although Health Net appears to have conceded that the data was not encrypted, it did indicate that the data should not be visible without the use of specific software. However, Kroll Inc., a computer forensic firm retained by Health Net to investigate the breach, reported the data could be viewable with commonly available software.

Privacy, security and data protection of non-public, personally identifiable and sensitive information (e.g., health, financial data) are increasingly subject to stricter rules and regulations. The use of the Internet and web, making digital information more susceptible to undetected duplication, transmission and access – not to mention the obvious fact that carrying millions of pages of records would be impossible, while walking out with a single hard disk or CD-ROM on which the same data and information has been scanned or stored in digital form – can be virtually undetectable.  

Do you know of any law firm that has a team of privacy and data security, identity theft and data breach legal professionals? A firm that has health care, financial services and insurance specialists, as well as lawyers steeped in digital technology, information security and e-commerce? A firm that has transactional, regulatory compliance and policy-oriented lawyers who can audit current practices and policies, assist in developing mechanisms needed to satisfy regulatory requirements, and provide legal support to help avoid a legal problem, and also regulatory, compliance and litigation professionals who can represent and defend clients if a problem arises? Now you do – Reed Smith. If you need more information, contact me, Joseph I. (“Joe”) Rosenbaum, or Mark Melodia or Paul Bond, or the Reed Smith attorney with whom you regularly work, if you need legal advice, information or support on this subject.

Will Net Neutrality Compromise Net Profits?

Earlier today, Julius Genachowski, Chairman of the Federal Communications Commission (FCC), telegraphed the Commission’s plans to open a formal rule-making process on the issue of “net neutrality.” It’s likely the specifics regarding hearings and a timetable for any proposed rulemaking procedures will be on the agenda for the FCC's October meeting.

While many of the major carriers – including wireless carriers who have typically been out of the fray when it comes to the Web – have argued against both the need and the wisdom of competitive regulation amongst carriers, open Internet advocates, many of whom were ardent campaign contributors and supporters of President Obama, have been aggressively pushing for regulation. Companies such as Amazon.com and Google, have long argued for rules that would prohibit carriers from denying their right to give consumers complete freedom of choice when it comes to both the content they receive and the devices they use to receive it. While not necessarily quibbling with what appears, on its face, to be a reasonable and market driven approach, opponents point out that the government stay away from intervening in yet another major marketplace – this time one, they argue, that isn’t broken. Further, and perhaps more significantly, companies such as ATT and Verizon, now joined by ATT Wireless, Verizon Wireless, Sprint (Sprint Nextel) and T-Mobile (Deutsche Telekom) argue that forcing carriers to open up their networks without corresponding economic counterbalances in place will force them to either raise consumer prices to keep up with virtually unrestricted broadband demand, but may require them to limit availability and accessibility for capacity and technological reasons. Wireless carriers may have special reasons to be concerned given current pricing models and the technological limits of current bandwidth capacity. That said, the major cable television, fiber optic and DSL-based Internet providers have long had to cope with government regulation and requirements.

Back in the days following the breakup of AT&T’s telephone monopoly (anyone remember Judge Green and his landmark 1983 rulings?), the regional and local companies spawned by carving up the nations’ previously regulated monopoly – the so-called ‘Baby Bells’ - worried about long-distance carriers (including the remaining long distance carrier, AT&T) making deals for preferential treatment over interconnections. Thus the principle of equal (“neutral”) treatment for interconnectivity arose. When cable companies started offering Internet service – previously the domain of phone-line intensive telephone companies (remember dial-up?) – they tried to convince everyone that neutrality didn’t apply to them. They carried information, and weren’t, after all, common carriers.

OK. Fast forward to the market response. Phone companies decided to get into the content business! Cable companies are offering Internet and VOIP services, telephone companies are offering entertainment, programming and information services, wireless phone services stream video content and provide messaging of news, sports scores and applications galore (oh, they do still carry voice traffic when you need to make a call).

So back to 2009 and the future. According to Commissioner Genachowski: "This is not about government regulation of the Internet," adding that "We will do as much as we need to do, and no more, to ensure that the Internet remains an unfettered platform for competition, creativity, and entrepreneurial activity." That said, his proposal would add a fifth principle to the FCC’s existing four that relate to the Internet. To wit, that carriers will not be permitted to be selective about the content they carry (subject, of course, to their continued ability to block illegal content) and will be required to be transparent about how they are managing the carriage of content across their networks. Violations and allegations of discriminatory practices would still be reviewed by the FCC as and when the facts of each specific case arise. You can read or download the complete statement of Commissioner Genachowski’s prepared statement today, entitled “Preserving a Free and Open Internet: A Platform for Innovation, Opportunity, and Prosperity,” right here.

Clearly if you are a small Internet application provider or software developer that has traditionally had to pay for access through a carrier, open, non-discriminatory access would prove a major boon. Then again, Internet carriers – wired and wireless - have invested huge amounts of capital in building their own proprietary networks. Since there is no evidence that there is a lack of competition, why should the government tell any of them what they should or should not carry on their networks? Indeed, since the early 1990s, when the Web evolved from a glimmer in the eye of Tim Berners-Lee, to a reality, there have been so few real complaints (and so few complaints from consumers, even as competitors bash each other about), why fix something that doesn’t appear to be or have been broken for almost two decades?

Confused as to how the FCC proceedings might or might not affect your business? Thinking about participating in the dialog or submitting comments to the FCC? Let Reed Smith help you. To stay informed, keep your mouse tuned to Legal Bytes, and if you need to know more, please feel free to call me or the Reed Smith attorney with whom you regularly work.

A Pirate's Life (Not) For Me: France Strikes Out Internet Piracy

This post was written by Andrew Boortz and Joseph Rosenbaum.

Over the last several months, France’s Parliament has been focusing on the issue of Internet piracy. In May, both houses of the French parliament passed the so-called “three strikes” law which would have given an independent body the ability to disconnect file-sharers from their ISPs. In June, the law was declared unconstitutional by the Constitutional Council because, under French law, the power to force such disconnection could only come through issuance of a court order. In response, French President Nicolas Sarkozy gave the first Presidential speech to the French Parliament in 150 years and passionately defended regulation of Internet piracy. 

After President Sarkozy's speech, the French Senate drafted and passed a modified version of the “three strikes” law which would allow alleged infringers to present their case to a French court, prior to losing their Internet connection. Judges in these hearings would have the power to: (1) order disconnection of the alleged infringer's Internet access; (2) fine the alleged infringer up to €300,000; and/or (3) sentence the alleged infringer to a two-year prison term. Just yesterday (September 15th), the French National Assembly gave preliminary approval to the measure by a vote of 285-225 and now, a joint committee will unify the Senate and Assembly versions and present a final bill to both houses for a vote on September 22nd.

In looking back over the piracy-related events of this year, it may well turn out that 2009 will be remembered as a watershed year in the struggle between Internet pirates and rights holders.  With the Jammie Thomas and Joel Tenenbaum verdicts in the States, the pseudo-shuttering of the Pirate Bay in Sweden, the implementation of a self-imposed, self-regulatory “three strikes” policy by Ireland’s largest ISP (created under threat of massive litigation) and now France’s revised and revitalized new “three strikes” law, the global community is indeed tilting towards greater sanctions and regulation of Internet piracy.

This raises questions for technology innovators. For example, Facebook, which according to a CNN report out today has a social network population nearly as large as the population of the United States, will soon launch a voice chat feature.  Most likely, the feature could be used to stream media across the globe as well as the nation? Would Facebook be liable for creation and distribution of such a feature, which is similar to that which created liability for the Pirate Bay creators for their torrent-tracking website?

Need help? Confused by the torrent of information, technology and legal rights?  Need to know more? Contact Andrew (“Drew”) Boortz, in our Washington, D.C. office, call me or contact the Reed Smith attorney with whom you regularly work.

Identity Theft: Don't Just Yell 'Stop Thief.' Audit Something!

It was 1998 and identity theft had not yet hit the radar screens as heavily as it would during the course of the next decade. Who could predict? So when I received a call from Albert J. Marcella, Jr. Professor of Management in the School of Business and Technology, Department of Management, at Webster University in St. Louis, who said he was putting together an "audit oriented" publication for The Institute of Internal Auditors to guide professionals who were becoming increasingly concerned about online identity theft, I naturally wondered what I could contribute to that effort.

So we spent a great deal of time collaborating about what we knew, speculated about what we did not know, and tried to put the work in context—specifically, guidance for corporate auditors and security management professionals on what they needed to know as sensitive, personally identifiable information migrated online. The result, of which my contribution played only a small part, was a book entitled www.STOPTHIEF.net, Protecting Your Identity on the Web, published in November 1999 by The Institute of Internal Auditors.

Identity theft, not a brand new crime even then, had a new face in our online, digital interconnected world. And, it was growing and pervasive, and its implications—if for no other reason than the sheer magnitude of the potential risks and the speed at which they would materialize on or through the Internet—were unprecedented and were becoming global.

I now know what I could not have known then—that more than 40 states have passed identity theft statutes and that the Privacy Rights Clearinghouse website, which takes pride in cataloging such things, estimates that as of a day or two ago, 263,247,398 records containing sensitive personal information were involved in security breaches in the United States since January 2005—six years after the publication became available.

To appreciate the foresight and to learn about those audit guidelines and benchmarks, you have to buy the book. But to read my personal piece of that collaborative effort—an end-piece summary of the legal implications entitled "Technology, the Internet and Cyberspace: Challenges to National and International Privacy", you just have to read Legal Bytes.

Better to Lose Face Than Facebook

Facebook, the very informal and ostensibly open social network, hinting at an apology for what its CEO acknowledged were “overly formal and protective” Terms of Service, did an abrupt about-face recently, retracting them and reverting to its old Terms of Service—presumably reacting to a sea of complaints from just about everyone. Complaints? Over legal terms—does anyone still read them? Well, they do, and they didn’t like what they read—particularly the part that claimed unrestricted, perpetual ownership of your personal data, even if you decide to delete your entire account and go away. 

While we respect Facebook’s right to better manage, control, and disclose to consumers how and for what purpose it treats and handles personal data, it highlights a number of things the online world continues to teach us. First, don’t assume those innocuous changes buried somewhere in terms of service, terms of use, privacy policies, codes of conduct, rules of the road, or whatever you choose to call them, aren’t being scrutinized—by consumers, by your customers, by the media and, lest we forget, by regulators and legislators. While Facebook has not admitted it was caught a bit red-faced, it is taking your feedback in a “Facebook Bill of Rights and Responsibilities” group to which you can contribute your thoughts. For those in the know, Facebook’s population has grown to more than 175 million users—does that make it the sixth-largest country in the world? Hmm, I wonder if that country has a growing budget deficit too; we’ll have to wait for the State of the Reunion speech, when results are posted, to find out.

California's a Trendsetter----This Time it's Privacy

No longer merely the source of new fashion trends or technology movements (or McDonald’s), California is quickly becoming the thought leader in protecting consumer privacy. Two new laws, one which deals with personal information given to third parties for marketing (SB27) and another which obligates businesses to adhere to certain security requirements for using and storing personal information, both came into effect January 1, 2005. The new law requires businesses with 20 or more employees to give consumers detailed disclosures about not only what customer information they have shared with third parties, but also the contact information for and descriptions of those parties. Want to avoid the disclosure obligations? Simple. Allow your customers a free opt-out election from having their personal information shared. That said, you will still have to let your customers know how and to whom they can inquire about these requirements – even if your business offers the opt-out choice to consumers. By the way, if you are already subject to the stricter requirements of California’s financial privacy act, you are exempt. While there are some additional exemptions, they are narrow, and anyone doing business in California shouldn’t be too quick to conclude they are exempt without consulting legal counsel. California’s Office of Privacy Protection has drafted a set of recommended practices which attempts to harmonize the requirements of this new act with the California online privacy act, the state’s financial privacy provisions, the federal Gramm-Leach-Bliley Act, HIPAA, and European Union privacy directives. Good luck.

Do you or your contractors have sensitive personal information (e.g., names and addresses in combination with social security numbers and PIN numbers) that could lead to identity or financial theft if compromised? What about medical information about a person’s diagnosis and treatment? Start ensuring you have “reasonable” practices to protect that information from unauthorized access, use, modification and disclosure—and it doesn’t matter if the information is on paper or in electronic form. Both are covered. While the legislative history makes it clear that no one particular standard is “the standard” for “reasonable” security, a company will need to designate a specific individual who is responsible for the company’s security program, and will need to establish a security task force—including a compliance officer and legal counsel. To avoid running afoul of the standards, not only must practices and a task force be implemented, but companies will also have to demonstrate they periodically test and monitor how the security measures are working, make risk assessment, and fine-tune their security measures to keep them updated appropriately. Need employee training? Need help implementing background checks, confidentiality agreements, encryption and record retention/destruction requirements, and disciplinary measures? Call the lawyers at Reed Smith. We can help.

Remember California’s security breach notification law (we told you about this and you get another prize if you can identify the back-issue in which we did so)? That law requires businesses to disclose security lapses. This new law creates a new duty and standard of care. Lawsuits arising from breaches in security (you remember California’s Business and Professions Code section 17200) can now use AB1950 as a discovery prod to determine if your business has used and effectively maintains reasonable security measures.

Consider this: California has already passed more than a dozen laws to protect privacy—many of which have now spawned federal legislation, some already passed and others in process. SB186 bans unsolicited e-mail and AB1769 bans text messaging advertisements to cell phones and pagers. AB1733 mandates consent from customers before a wireless carrier can list their phone numbers in a 411 directory, and SB1436 restricts keystroke monitoring software, website tracking software, and software that attempts to control personal computers.