Month: July 2009

National Data Privacy Law Proposed

Image by Johnny Grim (CC BY-NC-ND 2.0)

With a multitude of states trying to protect their citizens when it comes to breaches of personal data security, it is becoming increasingly difficult to manage compliance with this patchwork of laws.  The Data Accountability and Trust Act (H.R. 2221) proposed in Congress proposed to preempt state laws and make regulation of data security a matter of federal regulation.

If passed in its current form, the procedure and time frame for notifications in the event of data breach would be standardized instead of the differing requirements from state to state. It would also required the Federal Trade Commission to regulate the security practices around personal data.

The most controversial part seems to be the provisions around information brokers (companies that gather personal information about people that are not their customers to sell to third parties.)  It would require these brokers to establish reasonable procedures to verify the accuracy of the personal information it collects. They would also have to provide consumers with access to that information.

Although it is still working its way through the system, it has already been forwarded by the subcommittee to the full House Energy and Commerce Committee.

References:

Webinar Materials for: Preparing for the strictest privacy law in the nation

INSIGHT_headerforweb3

As a follow up to Wednesday’s lunchtime webinar sponsored by Knowledge Management Associates, I wanted to post some materials for those of you that missed it and for those looking for notes and details.

The slidedeck:

KMA Insights Webinar July 2009 — Compliance with MA Privacy Law

 

Massachusetts General Laws Chapter 93H
http://www.mass.gov/legis/laws/mgl/gl-93h-toc.htm

201 CMR 17.00

Click to access 201CMR17amended.pdf

Compliance Building Posts on Mass. Data Privacy
https://www.compliancebuilding.com/tag/mass-data-privacy-law/

Free and Law Firms

free the future of a radical price by Chris Anderson

I just finished reading Chris Anderson’s new book: Free: The Future of a Radical Price. Given that I am a lawyer, I kept thinking about how his concepts apply to law firms.

Let me say a few things up front.

First, this is an excellent book that will make you think about how these concepts apply to your business. For my prior employer, a large law firm I saw lots of trends in the book.

Second, I am part of an example that Chris uses to defend his hypothesis: GeekDad. Chris started GeekDad as the parenting blog for Wired magazine. The blog is led by Ken Denmead as editor who gets a nominal retainer. The rest of the contributors are unpaid volunteers writing for a magazine conglomerate that makes good money selling ads on GeekDad. I am one of those volunteer contributors. (You can see my name in the list of core contributors in right-hand column.)

Third, Chris does not take the position that everything should be free. He merely points out that more things now can be, thanks to the reduced costs of computer power, storage and networking.

Fourth, I paid for the book out of my own pocket. Free, the book is not free. Free, an abridged audio version is free online.

The Long Tail

Free is an extension of his previous book: The Long Tail. In that book he showed how the sale of large quantity of less popular titles can collectively sell as much as the few popular titles. You can make this work when you have cheap storage. Free takes the next step of what happens when your marginal production costs get close to zero.

There are many studies that show there is a big difference between something costing very little and something costing zero. Therefore you will attract a bigger audience if you round down. With electronic distribution, the marginal cost for adding the next customer is close to zero. So Chris says round down.

How Do You Make Money?

Chris outlines 50 different ways that you can make money even when you are giving away some of your product. Chris does not advocate giving away everything, just some of the things when the marginal cost is close to zero. One of the big distinctions is whether your product is atoms or bits. Atoms are expensive to produce and distribute. Bits are not.

He divides the idea of Free into four categories: cross-subsidies (give away the razor, sell the blade); advertising-supported services (from radio and television to websites); freemium (a small subset of users pay for a premium version of something, supporting a free version for the rest); and non-monetary markets (in which participants motivated by non-financial considerations develop things like Wikipedia and GeekDad).

Freemium is the model that Chris seems most in favor of. You give away a limited version of the product, but charge for the full version, add-ons and enhancements. SocialText just adopted that model for their wiki product: Free for 50. You can use a limited version of the product with up to fifty people at no charge. That freemium model got me using it.

Information is Expensive but Wants to be Free

Chris quotes Stewart Brand:

On the one hand information wants to be expensive, because it’s so valuable. The right information in the right place just changes your life. On the other hand, information wants to be free, because the cost of getting it out is getting lower and lower all the time. So you have these two fighting against each other.

What about law firms?

Let’s look at the most extreme examples, Orrick, Herrington and Sutcliffe‘s free business formation contracts and Wilson Sonsini’s Term Sheet Generator. There’s no cost to use the forms and no registration required to download them. Businesses can use them free. Other lawyers can use the forms as if they were their own and use them to serve their own clients. But the free product may help capture business. There are big segments of the legal market that can’t afford to hire these firms. Now, a business using these may be more likely to use the firm because some of the work has already been done. The firms could charge far less to review a completed form than if the firm were to begin the incorporation from scratch. It may offer them a competitive advantage if opposing counsel presents them with one of their own forms.

But those examples are new and few.

There is an incredibly common freemium model adopted by almost every law firm: Client Alerts.

When you had to mail these alerts there was a dollar cost associated with that distribution. To better phrase that, there was a stamp cost associated with distribution. Now distribution are costs are minimal. The costs are the same whether you email it to 500 people or 50,000 people. The same is true with viewing it on the law firm’s website.

I think it is quaint that some law firms still use the “client alert” label. I get more alerts from firms that do not represent me, than I do from the firms that do represent me.

Lawyers and their firms are giving away this valuable legal insight in the hopes that you will hire them to represent you in a matter related to the information in their publication. They use the publications to showcase their expertise, but in the process give away some of their substantive knowledge.

The book is worth reading. You should start thinking about how free may affect your business.

References:

He divides the idea of Free into four categories: cross-subsidies (give away the razor, sell the blade); advertising-supported services (from radio and television to websites); freemium (a small subset of users pay for a premium version of something, supporting a free version for the rest); and non-monetary markets (in which participants motivated by non-financial considerations develop things like Wikipedia and <a href=”http://www.wired.com/geekdad”>GeekDad</a>).

Avery Dennison Settles SEC Case for China FCPA Violation

avery-dennison

Avery Dennison has settled two related Securities and Exchange Commission cases over alleged Foreign Corrupt Practices Act violations. In an administrative action, the SEC imposed a cease-and-desist order against the consumer product company and ordered it to pay $318,470 in disgorgement and interest. In a civil case, Avery agreed to pay a $200,000 penalty. Avery settled both proceedings without admitting or denying the claims.

The SEC had charged that the Reflectives Division of Avery (China) Co. Ltd. paid kickbacks, sightseeing trips, and gifts to Chinese government officials.

  • In January 2004, an Avery China sales manager went to a meeting with government officials and bought each a pair of shoes with a combined value of $500.
  • In May 2004, the subsidiary hired a former government official as a sales manager because his wife was still employed at the government institute and was in charge of two projects the company wanted to pursue.
  • In August 2004, Avery China obtained two contracts to install new graphics on police cars through the Institute. The sales manager agreed that the total sales price of the contracts would be inflated so the additional charges could be paid back to the Institute as a “consulting fee.” Total sales under these contracts were about $677,000, with profits of about $363,000. The kickback payments, which would have been about $41,000, were discovered by another division and halted prior to payment.
  • In December 2002, an Avery salesman hosted a sightseeing trip for five government officials. Two reimbursement requests were used to conceal the expenses for the trip.
  • In August 2004, Avery China paid a kickback to another government owned enterprise to secure a sales contract. Total sales under the contract were about $106,000, with profits of about $61,000. The $2,415 kickback was not paid after it was discovered by company officials.
  • In 2005, Avery China secured a sale to a state-owned end user by agreeing to pay a Chinese official a kickback of nearly $25,000 through a distributor. Avery China realized $273,213 in profit from this transaction, which it inaccurately booked as a sale to the distributor rather than to the end user.
  • In late 2005, during a sales conference hosted by Avery China at a famous tourist destination, a sales manager paid for sightseeing trips for at least four government officials at a cost of $15,000
  • After Avery acquired a company, employees of the acquired company continued their pre-acquisition practice of making illegal petty cash payments to customs or other officials in several foreign countries. Those in illegal payments were approximately $51,000.

A spokesperson for Avery told the FCPA Blog, “What’s important to us is the fact, noted in the SEC’s administrative order, that we discovered the questionable actions. We investigated them and took disciplinary action, and reported them to the Securities Exchange Commission and Department of Justice (DOJ). As the SEC’s administrative order notes, in some cases we prevented them. We believe ethical conduct is critical to our reputation and our success, and we back that up with a rigorous training and reporting process to help employees make the right decisions. Our training includes training on the FCPA.”

References:

2009 Data Breach Investigations Report

verizon-report

285 Million records were compromised in 2008. The Verizon Business RISK Team conducted a study of first hand evidence collected during data breach investigations of 90 confirmed breaches as part of their caseload. This 2008 caseload of more than 285 million records, exceeded the combined total from 2004 to 2007.

2009 Data Breach Investigations Report pdf_logo.

Investigators concluded that 87 percent of breaches could have been avoided through the implementation of simple or intermediate controls. All of these were the standard practices in the industry. In only 13 percent of cases were costly controls (in terms of effort and expense) recommended as the most efficient and effective means of avoiding the breach. Most of these were standard security controls, even though they are costly.

They conclude with these recommendations:

Align process with policy: Many organizations set security policies and procedures yet fail to implement them consistently. Controls focused on accountability and ensuring that policies are carried out can be extremely effective in mitigating the risk of a data breach.

Achieve essential, and then worry about excellent: We find that many organizations achieve very high levels of security in numerous areas but neglect others. Criminals will almost always prefer the easier route. Identifying a set of essential controls and ensuring their implementation across the organization without exception, and then moving on to more
advanced controls where needed is a superior strategy against real-world attacks.

Secure business partner connections: Basic partner-facing security measures as well as security assessments, contractual agreements, and improved management of shared assets are all viewed as beneficial in managing partner-related risk.

Create a data retention plan: Clearly, knowing what information is present within the organization, its purpose within the business model, where it flows, and where it resides is foundational to its protection. Where not necessitated by valid business needs, a strong effort should be made to minimize the retention and replication of data.

Control data with transaction zones: Based on data discovery and classification processes, organizations should separate different areas of risk into transaction zones. These zones allow for more comprehensive control implementations to include but not be limited to stronger access control, logging, monitoring, and alerting.

Monitor event logs: All too often, evidence of events leading to breaches was available to the victim but this information was neither noticed nor acted upon. Processes that provide sensible, efficient, and effective monitoring and response are critical to protecting data.

Create an Incident Response Plan: If and when a breach is suspected to have occurred, the victim organization must be ready to respond. An effective Incident Response Plan helps minimize the scale of a breach and ensures that evidence is collected in the proper manner.

Increase awareness: Delivered effectively, training that educates employees about the risks of data compromise, their role in prevention, and how to respond in the event of an incident can be an important line of defense and discovery.

Engage in mock incident testing: In order to operate efficiently, organizations should undergo routine IR training that covers response strategies, threat identification, threat classification, process definition, proper evidence handling, and mock scenarios.

Join me at 12:30 (July 29, Boston Time) for a free webinar on Preparing for the Strictest Privacy Law in the Nation: MA Privacy Law 201 CMR 17 hosted by Knowledge Management Associates.
INSIGHT_headerforweb3

Ten of the Most Embarrassing Data Breaches

data-theft

I gathered some notable data breaches in preparation for my presentation on the Massachusetts Data Privacy Law as part of my webinar on Wednesday: Preparing for the strictest privacy law in the nation: MA Privacy Law 201 CMR 17. If you wondered why there are so many state laws on data breaches, just take a look at some of these embarrassing data breaches.

Royal Navy

Imagine losing information on everyone who had applied to join the armed forces including passport numbers, medical histories, and bank details. Of course, it was not encrypted. It was just sitting in a laptop in the back of a car. That’s what happened Jan. 9, 2008, in Birmingham, U.K., when a Royal Navy Officer left the laptop in his car and it was promptly stolen.

BBC: Police probe theft of MoD laptop

UK’s Child Benefits Records

Her Majesty’s Revenue and Customs sent discs containing the entire child benefit database unregistered and unencrypted to the National Audit Office. There was no evidence that the discs fell into the wrong hands, but millions of families were told to be on alert for attempts to fraudulently use their details, which include addresses, bank account and National Insurance numbers, as well as children’s names and dates of birth.

BBC: Discs ‘worth £1.5bn’ to criminals

Veteran’s Affairs

The computer and hard drive was stolen from the home of an employee of the Department of Veterans Affairs. It contained details on no less than 26.5 million veterans. The laptop was stolen May 3rd and turned up two months later on the black market only four miles away. The purchaser bought both the laptop and the hard drive off the back of a truck.

New York Times: V.A. Laptop Is Recovered, Its Data Intact

TJX

The retailer had over 45 million customer records compromised. The current theory is that the thieves sat in the company parking lot and tapped into an unsecured wireless router.

Boston Globe:  TJX faces scrutiny by FTC

Ameriprise

Lists containing the personal information of about 230,000 customers and advisers were compromised after a company laptop was stolen from an employee’s parked car. The laptop contained a list of reassigned customer accounts that were unencrypted.

New York Times: Ameriprise Says Stolen Laptop Had Data on 230,000 People

Verisign

Digital certificate issuing company VeriSign suffered a data breach when an employee’s laptop was stolen from their car last month. The laptop contained names, social security numbers, dates of birth, salary details, phone numbers and addresses of of VeriSign employees.

The Gap

A laptop containing unencrypted personal information for 800,000 people who applied for jobs with clothing retailer Gap Inc. was stolen. The laptop was stolen from the offices of a third-party vendor the Gap hired to manage applicant data.

The Register: Data for 800,000 job applicants stolen

Boston Globe

Instead of reporting on data breaches, the Boston Globe and The Worcester Telegram & Gazette suffered their own credit card breach.  The credit card information for as many as 240,000 subscribers might have been inadvertently released.

The New York Times: Credit Data Breach at Two Newspapers

Hannaford Supermarkets

Unauthorized software that was secretly installed on servers in Hannaford Bros. Co.’s supermarkets  enabled a massive data breach that compromised up to 4.2 million credit and debit cards.

Forbes: Malware cited in supermarket data breach

IBM

A vendor lost lost tapes containing sensitive information on IBM employees. The tapes contained sensitive information including dates of birth, Social Security numbers, and addresses. Some of the tapes were not encrypted

InfoWorld: IBM contractor loses employee data

Any others that you think should be on this list? Join the webinar and let us know.

Image is by d70focus: Credit Card Theft http://www.flickr.com/photos/23905174@N00/ / CC BY 2.0

Sticking Your Head in the Sand and the FCPA

dooney and Bourke

Prosecutors told the jury during Frederic Bourke’s trial that instead of doing adequate due diligence for his investment, he’d “stuck his head in the sand.” A jury convicted him conspiring to violate the Foreign Corrupt Practices Act and making false statements to federal investigators.

How did the head of a prominent handbag company end up in this position? What did Bourke do?

He invested in a deal in a country where he knew or should have known that bribes would be paid. He didn’t pay any bribes himself. He didn’t benefit from the bribes. He lost his money in the investment.

Bourke invested in Czech-born Viktor Kozeny’s unsuccessful attempt in 1998 to gain control of Azerbaijan’s state oil company.  Kozeny himself had a shady background and was known as the Prague Pirate. Kozeny’s plan was to bribe senior government officials in Azerbaijan with several hundred million dollars in shares of stock, cash, and other gifts to ensure that those officials would privatize the State Oil Company of the Azerbaijan Republic (SOCAR) in a rigged auction that their investment consortium could win. Prosecutors offered evidence that Bourke “consciously avoided” learning about the bribes by not asking questions about them. Jurors were allowed to convict if they found Bourke knew or took steps to avoid learning of the payments.

The jury looked at the shady deal, the shady partner and in a shady country and must have thought that bribery was obvious. Bourke just chose to ignore the warning signs.

The sentence for Bourke is up to five years in prison for the FCPA violation, and another five for lying to the FBI.

References:

Regulating Private Investment Funds

Capital_BuildingLast week the Subcommittee on Securities, Insurance, and Investment of the United States Senate Committee on Banking, Housing and Urban Affairs held a hearing on regulating private investment funds. [You can see an archive of the hearing.] The video shows lots of empty Senator chairs at the hearing.

Senator Reed pushed his Private Fund Transparency Act. Senator Bunning sees some need for more disclosure, but is skeptical that regulation would do much.

Mr. Donohue’s statement gives a great summary of the history of the regulatory approaches to private investment funds and a summary of the current exemption available to private investment funds.

The questions from the Senators also provided some interesting insight of the legislators and SEC. Mr. Donahue’s pitch for regulation was that the Investment Advisers Act was put in place to regulate people who manage other people’s money. Private fund advisers indirectly manage other people’s money.  He does not like the idea of putting private funds under the Investment Company Act. Senator Reed pointed out that bringing private funds under the SEC registration umbrella would require additional resources and technology.

Senator Bunning cut into Mr. Donohue, wanting to know who in the SEC is “smart enough.” The Senator was highly critical of the SEC.

Senator Bayh focused on the international issues and the EU’s Directive on Alternative Investment Fund Managers. He also wondered if over-regulation could lead to forum shopping by fund managers.

Mr. Singh pushed for “smart regulatory framework.” He pointed out the MFA’s Sound Practices for Hedge Fund Managers (.pdf).

Mr. Chanos pitched the idea of having a special Private Investment Company law specifically tailored for SEC regulation of private investment funds. (In my view, the best approach.)

Mr. Loy gave the view of venture capital funds and how they operate differently than hedge funds. He pointed out that venture capital funds do not provide systemic risk.  Senator Bunning showed a lack of understanding of venture capital.

Mr. Tresnowski presented on behalf of The Private Equity Council and showed the differences between private equity and hedge funds. Senator Bunning also showed a lack of understanding of private equity.

Mr. Bookstabber focused on systemic risk.

Mr. Dear gave the viewpoint of an investor in private funds.  He also pointed out the superior returns they have experienced with private investment funds.

The HITECH Act

Pillsbury Winthrop Shaw Pittman LLP

I sat in a webinar on CyberSecurity Law: The Best Offense is a Good Defense sponsored by Pillsbury Winthrop Shaw Pittman LLP.  One aspect of the presentation was the Health Information Technology for Economic and Clinical Health Act.

This created the first federal data breach notification law.  It also substantially revised HIPAA regulations regarding privacy and security.

A “Breach” means:

  • Unauthorized access, use or disclosure of Public Health Information
  • That compromises the security, privacy or integrity of the Public Health Information
  • Does not include unintentional disclosures if made in good faith and within course and scope of employment or business associate relationship, provided that the Public Health Information is not further acquired, accessed used or disclosed

The difference between the HITECH Act and the state date breach notification laws deals with encryption, not security. It focuses on medical information, not just financial/identification information. Only California and Texas include medical information in data breach notification law.

The regulations from the FTC are very detailed. You must notify each US citizen and resident whose information was acquired by an unauthorized person and FTC. The Burden is on the company to demonstrate that all required notifications are made

Sending the breach notification:

  • By 1st class mail to last known address
  • By email “if specified as preference by the individual” (express affirmative consent required – pre-checked boxes and disclosures in TOS/Privacy Policy are NOT sufficient)
  • May provide notice via telephone or other means if Breach is deemed to require urgency (e.g.,due to possible imminent misuse of PHI)

Notification may be delayed for law enforcement purposes consistent with HIPAA Privacy Rule

If more than 10 individuals, Covered Entity must:

  • post notice on home page (and “landing pages” for existing account holders (FTC))
  • provide notice to major print/broadcast media in relevant geographic area, including tollfree phone number
  • must be prominent, clear and conspicuous, stated in plain language and run multiple times

Jurisdiction is split between the FTC and Health and Human Services. You are still subject to state enforcement of data breaches under state law.

SEC Proposes Measures to Curtail “Pay to Play” Practices

sec-seal

At yesterday’s Open Meeting, the SEC voted unanimously to propose measures intended to curtail “pay to play” practices by investment advisers that seek to manage money for state and local governments. In 1999, the SEC considered a proposal to curb adviser pay to play practices modeled on MSRB Rule G37 that applies to underwriters of municipal bonds. This new proposed rule is both broader in its coverage and narrower in its applicability that the 1999 proposed rule.

The new proposed rule has four primary aspects:

1. Restricting Political Contributions

An investment adviser who makes a political contribution to an elected official in a position to influence the selection of the adviser would be barred for two years from providing advisory services for compensation, either directly or through a fund.

The contribution prohibition would also apply to certain executives and employees of the  investment adviser.

Additionally, the range of restricted officials would include political incumbents and candidates for a position that can influence the selection of an adviser.

There is a de minimis exception that permits contributions of up to $250 per election per candidate if the contributor is entitled to vote for the candidate.

2. Banning Solicitation of Contributions

The proposed rule also would prohibit an adviser from coordinating, or asking another person or political action committee to:

  1. Make a contribution to an elected official (or candidate) who can influence the selection of the adviser.
  2. Make a payment to a political party of the state or locality where the adviser is seeking to provide advisory services to the government.

3. Restricting Indirect Contributions and Solicitations

There would be prohibition on engaging in pay to play conduct indirectly, if that conduct would violate the rule if the adviser did it directly. That would include directing or funding contributions through third parties such as spouses, lawyers or companies affiliated with the adviser.

4. Banning Third-Party Solicitors

There is prohibition on paying a third party, such as a placement agent, to solicit a government client on behalf of the investment adviser.

Comments and Publication

The full text of the proposed rule is not yet available. There will be a 60 day comment period.

References: