IT Policy | Audit | Investigate Cyber Crime

Data Breach Investigation | Constitutionality | Arbitrary, Capricious?

When is Data Loss Known or Discovered?

The investigation of an apparent data security breach requires analysis, diligence and judgment.  Sometimes a snap conclusion that a breach has occurred is not justified by the facts of the case, after they have been weighed fully.

The timeline of a breach investigation is the subject of a dispute between Lucile Packard Children’s Hospital and the California Department of Public Health.   CDPH imposed a $250,000 fine on the hospital for waiting too long before it notified patients of a data breach.  A misbehaving employee stole a PC (containing patient information), which the employee had been authorized to use.
California medical breach notice law requires the hospital to notify patients within five days after discovering the breach.  CDPH maintains:  "Based on interviews and record review, the hospital failed to notify a privacy breach of patients’ protected health information (PHI) to 532 patients within five days after the hospital confirmed the breach on 2/1/10. The hospital failed to send notifications to the patients until 2/19/10."

The hospital is appealing CDPH’s decision.   In its rebuttal, the hospital says:

"Even though the employee had signed written commitments to keep patient information confidential and secure in accordance with legal requirements and hospital policies, the hospital received reports that the now-former employee allegedly removed the computer from hospital premises and took it home." [emphasis added]

Further, the hospital says, "The hospital immediately began a thorough investigation and also reported the matter to law enforcement in an attempt to recover the computer quickly. As soon as the hospital and law enforcement determined the computer was not recoverable, the hospital voluntarily reported the incident to the California Department of Public Health (CDPH) and federal authorities, as well as the families of potentially-affected patients."

So CDPH contents the breach was "confirmed" February 1.   But, apparently, the hospital believed it could not confirm until after a police action failed to recover the computer.   Meanwhile, the hospital may have felt that the likelihood of data abuse was low, perhaps because (a) it was not even sure the employee took the computer (maybe it was just misplaced), (b) the employee was under legal obligation to protect the data and/or (c) the hospital had no evidence to suggest the employee’s purpose was to abuse data.

I don't know all of the facts of this case and therefore I will not pass judgment on either CDPH or the hospital.

Yet I will say that it is irresponsible for data holders to issue breach notices before they have concluded a true breach has occurred.   Unnecessary notices inflict angst and confusion on data subjects.  A mere security vulnerability is not a breach.

To distinguish between a vulnerability and a breach often requires deliberation.   Deliberation can require painstaking collection of facts, coordination with multiple parties such as law enforcement and careful review of the facts, often with input from multiple learned parties, such as outside experts.

The California Legislature made clear it wants notices to be issued quickly.  However, the law should not be interpreted to require rash decision-making.   If the law is interpreted as a hair-trigger requirement for notices before a competent investigation can be concluded, then I question the constitutionality of the law.  That interpretation would render the law arbitrary, capricious, unreasonable, in conflict with the need for due process under the US Constitution.

Update:  I have elaborated on the argument I made here.

–Benjamin Wright

Mr. Wright teaches computer investigations law at the SANS Institute.

How to Conduct a Cyber Investigation

Collecting Evidence in Sequence

In the digital realm, an investigator must be careful lest her work run afoul of the myriad rules and laws that restrain her.  She must be mindful of ethics, and laws on privacy, contract,
property and trespass (e.g., a web site owner might post terms that forbid her from entering the site).   

In e-discovery if her demands for records from another party are too onerous, the demand may be quashed.  (See for example Mirbeau of Geneva Lake, LLC v. City of Lake Geneva.)

So what is a prudent, responsible investigator to do?

Rational Behavior is Preferred

The investigator can often strengthen her probes and requests by ensuring that she systematically develops and collects evidence in a sequential order, and that each step she takes is rationally based on evidence she already possesses.  For instance, before an HR investigator peeks into an employee’s email records, the investigator is wise to document (1) that she has reason to suspect the employee’s records will contain something the investigator needs to see (such as harassing emails), and (2) the evidentiary basis for that suspicion.  

Good records by the investigator will show that she gathered preliminary evidence and deliberated logically before she barged into another person’s records or property.

Canadian Privacy Case Demonstrates the Principle

By way of example, see the decision by the Office of the Privacy Commissioner of Canada (PIPEDA Case Summary #2009-019) involving an investigation by an employer into whether an employee had violated his employment contract.   Somewhat like the laws of some European countries, privacy law in Canada (PIPEDA) generally restrains an employer from reading employee email stored on the employer’s computers.  

However, in this case the Privacy Commissioner observed that PIPEDA provides that "an organization may collect personal information without the knowledge or consent of the individual only if it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province."   The facts in this case showed that the employer conducted – and documented – a predicate investigation before it gazed into the employee’s emails.  The Commissioner found that before accessing the emails, the employer possessed evidence showing that this employee was violating his employment agreement and that information about this violation would likely appear in the employee’s email records.  Accordingly, the Commissioner concluded that the employer was justified when it decided to open the employee’s email records and the employer acted in compliance with PIPEDA.

Principle Applies to Many Kinds of Investigations

Just as an evidence-based style of investigation will help support an internal HR investigation, it will also help support e-discovery in litigation.  Normally when a requesting litigant demands computer records, a court is reluctant to force the responding litigant to search through them because searching is expensive and disruptive.  However, the court is more likely to require the search if the requester has a logical, evidence-based reason to believe that the cost of the search will be proportionate to the case at hand will likely reveal relevant information.  

This principle of e-discovery places a burden on the requesting litigant.  The litigant needs to possess and understand predicate evidence before it asks for more evidence.  

–Benjamin Wright

Attorney Wright trains cyber-investigators at the SANS Institute.

Read more on law of trespass in the data age.