IT Policy | Audit | Investigate Cyber Crime

Deception | Impersonation by Online Investigators

Computer Crime | Admission of Evidence

Law enforcement officials, including tax auditors and probation officers, are monitoring social networks like Twitter and Foursquare for information about criminals and deadbeats. AP , "For federal fugitive, Facebook becomes invitation to extradition," Dallas Morning News, Mar 17, 2010.

A California tax agent, for example, tracked down a delinquent taxpayer who works as a sail rigger by reading about his whereabouts on an online discussion board used by sailing folks.  Laura Saunders, "Is 'Friending' in Your Future? Better Pay Your Taxes First," Wall Street Journal, Aug 27, 2009.

Some speculate/allege that some law enforcement officers misidentify themselves in web forums.  Query whether an officer who impersonates someone online or in text chat is acting illegally or committing a crime.  The terms of service of many social media sites forbid deception or misrepresentation of the user's identity.

Key case:  A jury convicted cyberbully mom Lori Drew of a misdemeanor crime for impersonating a teenage boy on Myspace, in violation of Myspace's terms of service.  Drew’s misbehavior contributed to a girl’s suicide.  The jury believed Drew violated the federal Computer Fraud and Abuse Act (CFAA), which generally forbids accessing an Internet computer without authority (or exceeding authority in the computer) and taking data or causing damage.  However, the judge in the case overturned Drew’s conviction on the grounds that the CFAA is too vague, and provides too little guidance to prosecutors, to support a misdemeanor crime based on violation of web service terms.  So Drew got off without punishment. US v. Lori Drew

Lori Drew was just a misguided mother, not a professional.  Would an agent of government (such as a police detective) or a private investigator (such as a computer forensics expert) be held to a higher standard than Drew?  That is not clear.  Under the reasoning of the Lori Drew case, misrepresentation by a law officer, in violation of web terms of service, might be a sufficiently clear abuse of authority in a computer (i.e., the web server) to constitute a crime.

Would a lawyer, who is acting as an investigator in, for instance, a divorce case, be violating law if he misrepresents himself on a social network?  Sharon D. Nelson, Esq., argues the answer is yes.  She says the lawyer would be violating his ethical prohibition against deception.  (Update:  The New York City Bar Association's ethics committee agrees with Ms. Nelson in its Formal Opinion 2010-2.)

A related issue is whether evidence gathered in violation of terms of service is inadmissible in court.  See the Connecticut rules of evidence, as one example. Sec. 52-184a states: "No evidence obtained illegally by the use of any electronic device is admissible in any court of this state."  In an investigation in a social network, the illegally used "electronic device" might be the computer of the investigator, or it might be the server the investigator accessed without authority because she entered under false pretenses.

Although the CFAA may be too vague to support a misdemeanor conviction of a masquerading mother, it may be adequate to prevent admission (in some jurisdictions like Connecticut) of evidence collected by a tricky professional investigator.

Any investigator is wise to study terms and contracts covering their access to computers and Web 2.0 social media.

Update October 2010:  California legislation now punishes malicious online impersonation.

–Benjamin Wright, Senior Instructor on the Law of Investigations - SANS Institute

Danger | Litigation | Data Breach

Policy

Management of risk in an enterprise – in particular the legal risk growing out of IT insecurity – is not a stable state of existence.  It is a process, a never-ending process.

To ignore or mishandle this risk management process exposes the modern enterprise (public agency, private corporation, nonprofit institution) to growing peril.  So observes a wise man named Nick Gifford.

Gifford is the author of Information Security: Managing the Legal Risks, a book that is disrupting my thinking about cyber security law.  I am indebted to Mr. Gifford for his ideas.

Lawsuits are happening.  The data breach at TJX cost the company a quarter billion dollars after all the fees, remediation, investigations, legal settlements and so on are accounted for. 

More lawsuits are coming.  Gifford surveys the different headings of law – negligence, breach of contract (think non-disclosure agreements) and on and on – that aggressive plaintiff lawyers and regulatory authorities will exploit as the inevitable data security disasters materialize in the coming months and years.

Hear this wise man: “In short . . . a tidal wave of information security based threats is gathering momentum and heading in our direction. . . . In our litigious society . . . legal actions based on a wide variety of heads of claim . . . will be flying in all directions.” (Pages 314 - 315)

Gifford’s prescription is not the implementation of an easy checklist.  It’s the implementation of a hard checklist.  Sure, any enterprise that processes information should install sound security technology like firewalls.  Sure, it should insert smart language into contracts to shift risk or to ensure vendors take security seriously.  Those steps are relatively easy.

But the more powerful checklist Gifford recommends entails a change in skillsets and corporate culture.  He says the lawyers, executives, IT professionals and risk managers who set and execute policy need to adopt a “radical shift in thinking and behaviour.” (Page 316) They need to cross out of their respective disciplines, break out of their intellectual silos and recognize risks they are not trained to recognize.  When they comprehend the big picture – the waterfront of looming legal and public image risk -- they see that the greatest “security dividend” comes not from implementing a new firewall (mere technology) or inserting a few amendments to contract or policy documents (mere lawyer wordsmanship).  It comes from enlightened risk analysis and policy leadership.

What is enlightened risk analysis and policy leadership?  Here's an example.  After ChoicePoint’s public reputation suffered severely on the heels of a data breach in 2004 (it paid a $15 million fine to the Federal Trade Commission), the company reassessed the data security risk in its business.  Then it initiated a dramatic new policy:  It withdrew from a profitable line of business (selling sensitive personal data to certain small businesses like debt collectors, private investigators, and check-cashing outfits)!  Such a bold, executive move – directly impacting the corporate bottom line – is very difficult for any enterprise.  

I am not finished studying, and learning from, Information Security: Managing the Legal Risks, published by CCH Australia Limited.  I recommend the book highly.

–Benjamin Wright

Mr. Wright teaches social media, information assurance and other IT law at the SANS Institute.

e-Legal Disclaimers | Hazards and Product Defects

Web 2.0 Comments, Notices and Liability

Does a corporation have legal notice of comments made on web social networking services?  Arguably, public comments can be warnings to the maker of a product that the product is defective or hazardous or needs to be reported to regulatory authorities.

However, to stay cognizant of all relevant social media messages can be very difficult for a corporation, much more difficult than to stay aware of all comments that arrive via a customer service telephone line or via paper mail delivered to a postal address.

Some have feared that Web 2.0 services like Google’s Sidewiki  allow consumers to submit informal comments about a brand that could have legal implications for the brand owner.  Sidewiki allows web users to leave comments in relation to a web page -- comments that are not stored, published or controlled by the web page owner.  The comments are stored by Google, and made visible to other Sidewiki users.  

For example, when Sidewiki user Ralph visits the site http://legal-beagle.typepad.com, he can leave in Sidewiki the comment “insightful analysis of Internet law.”  Then, when other Sidewiki users visit http://legal-beagle.typepad.com, they can see Ralph’s comment and can leave their own comments about that page in Sidewiki.

Here is a screenshot of a Sidewiki comment I left in relation to a press release on the US Department of Justice (law enforcement) web site:




Some have speculated that Web 2.0 technologies like Sidewiki can legally impact brand owners like pharmaceutical companies.  Pharma companies have legal obligations and safety/compliance programs built around the information they know about “adverse events” related to their drugs (e.g., patient took medicine X and hair started to grow on her tongue) and “off-label” uses of their drugs (e.g., doctors saying, “you can use heart medicine X to grow hair on your bald head.”). 

So the pharma companies have debated whether, with respect to Sidewiki as it points to their web pages, they should block it, monitor it, interact with it and so on.

In principle, my feeling is that no company can control or monitor everything that is said about its products on the web.  Hence, it should be able to publish appropriate disclaimers/notices to the effect that it does monitor/sponsor online discussion at xyz domain, but it can’t and doesn’t try to keep up with all discussions everywhere.  My feeling is that a notice published on the web can be broadly effective.  Without necessarily being published in the Sidewiki service, such notices can be generally effective with respect to comments in Sidewiki.

Still, Google seems to have been listening to this debate.  It has modified Sidewiki so that webmasters may, through Google’s Webmaster tools, publish general statements (like legal notices or disclaimers) that would appear as an official webmaster statement in Sidewiki for the web page in question. Screenshot:

 

--Benjamin Wright

Mr. Wright teaches Internet and eCommerce law at the SANS Institute.