Electronic Data Records Law | How to Win E-Discovery

Metadata | Email Discovery Control

Logs and Audit Trails for Data Privacy and Internal Control

Filtering Attorney Work Product

Electronic records such as email serve as memorials of business actions and as evidence of legal responsibility.  But they are also vulnerable to abuse by privacy infringers or trade secret thieves.

One key to protecting e-records is metadata.  Meta-data comprises all the ancillary notes and audit trail surrounding a given record (a given e-mail) . . . the system logs showing when a record was created, who accessed it and when, how and when it was changed, to whom it was forwarded and possibly much more.  Metadata can illuminate an auditor or detective about the status, the history or the security of the record in question.

For records containing personally identifiable information (PII), good meta-data can be invaluable as an instrument of privacy.  Metadata can deter a snoop.  A busybody in a hospital  who wants to peek at a celebrity’s patient record will think twice before doing so if he knows the system will create an audit trail showing what he saw and when he saw it.  Further, in the investigation of a hacker incident, system logs can inform whether (for instance) the crook accessed credit card record X or social security number Y.  Armed with this information, an investigator can evaluate whether the hacker did or did not actually breach the security of record X or record Y.

Example: In the wake of a security breach at one of its hotels, Best Western International was able to evaluate the breach and narrow the universe of affected credit card numbers by inspecting specific logs on the computer in question. 

Accordingly, a well-crafted e-mail archival system will maintain extensive meta-data about each electronic mail record.  The M+Archive product for instance keeps tabs on who viewed a record, when it was printed and so on. 

Be all that as it may, sometimes system logs are undesirable.  For example, when an attorney turns over records in an eDiscovery request, she normally should not turn over metadata that constitutes her own work product.  As she reviews individual emails in an archival system, the system may be keeping meta-records showing which records she accessed, when she accessed them and how often.  Those records are probably her attorney work product, which normally is excluded from disclosure in the discovery phase of litigation.  She should normally screen out any such work product when she turns over required emails to another party.

I spoke to Ranjit Sarai, e-discovery expert at Messaging Architects. “The management of meta-data in an enterprise archival system can be tricky,” he said. “Normally you want the system to be making meta records for security and accountability purposes.  But sometimes ediscovery lawyers want to turn this logging feature off, or they want to filter out their work product metadata before delivering records to an adversary.  We have experience helping an attorney understand the options and craft a solution for her particular case.”

–Ben Wright

Mr. Wright often serves as a public speaker on the law of electronic records and investigations.

Data Loss Prevention Strategy

Transparency as Compliance with Data Security Regulation

How are data holders to comply with the swelling riot of data security laws?  These laws include breach notification laws, which require that individuals and/or government be notified when the security of private data has been compromised.  Perfect compliance is impossible.

Almost all the states have adopted breach notice laws – though they are not uniform – and legislatures are expanding the scope of the laws.  

The original law from California (effective six years ago) focused on identity information – name plus social security number, driver’s license number or financial account number.  Then the California legislature expanded its law to also include breaches of medical data. That expansion became effective January 1, 2009.  Result?  In the first five months of 2009, California authorities were notified of a whopping 823 healthcare data breaches, mostly through self-reporting by healthcare entities. That’s just one industry, in one state, in five months.  And California authorities anticipate that the flow of notices will rise as people in the healthcare community become better aware of the new law. 

A data breach can occur in myriad ways:  a misdirected fax or e-mail, a hacking incident or snooping by an employee.

Meanwhile, we see floods of breach notices issued in other states and other industries – retail, nonprofit, colleges, financial, professional services, water districts, school districts, county government, municipal government, state government, federal government.  No organization is immune.  As these laws sit longer on the books, the flow of notices grows larger and larger.

Why are there so many notices?  The reason is that the laws assume that 100% data privacy can reasonably be achieved.  They further assume that any shortcoming (or suspected shortcoming) of data privacy should be an unusual event within well-managed enterprises.  The assumptions are wrong.  
The expectations of the public, and especially the expectations of policy makers, are out of touch with the reality of modern data management.  These outsized expectations contribute to a growing risk of monetary liability on the part of data holders.

So what are data holders to do?  Obviously they need to invest in data security, training and investigation – and they have been.  But banks, schools, utilities, clinics, hospitals, merchants and government agencies can throw massive investments at this problem and never meet present expectations.

Wise organizations will start talking in public about data security.  I recently recommended to a municipal power utility that it convene public forums on the topic, and involve community leaders such as representatives from the city council and the state's attorney general's office.  Organizations like a power utility need to inform the public about how challenging and expensive it is in reality to protect 100% of the data 100% of the time.  They need to explain in detail why it is impossible to close off all security risks while performing their regular services to the public.  And they need to seek input from stakeholders.

No, mere publicity and public dialog will not absolve organizations from issuing breach notices in compliance with law.  

But transparency – candid, open disclosure of problems in advance can influence how harshly authorities, such as courts, attorneys general or consumer protection agencies, interpret and enforce these demanding laws.  Our legal system has long held that organizations will be treated more leniently when they display diligence toward compliance with difficult laws.

Update:  Even e-mail security vendor McAfee inadvertently broadcast via e-mail a spreadsheet containing details (including dietary preferences) of some 1408 conference attendees.

Update:  A data leakage audit of a Boston CPA firm revealed that staff made an astonishing 3200 data security slip-ups over the course of the 38-day audit.  This is a firm that believed it possessed the required policies and technology to protect data. Jackie Noblett, “One Firm’s Story: Your Data Isn’t As Secure As You Think,” Boston Business Journal, Dec. 26, 2008.

Another update:  A survey shows that mere accidents by employees account for far more data security breaches than do malicious actions by insiders.

One more update:  IT Security breaches soared in Canada in 2009.  The Globe and Mail, September 29, 2009.
 
–Benjamin Wright

At the SANS Institute, Mr. Wright teaches computer security law, where he stresses that a cyber-security program must include effective public communications. 

Privacy | Data Leakage Law

Identity Theft Legal Damages

Must a data holder pay money if it is the victim of a data compromise?  To that question the Connecticut Attorney General has a novel answer.

Background on Legal Liability

Few judicial decisions hold data holders liable for damages suffered by data subjects after a security breach.  The best example of such a decision is Bell v. Michigan Council 25 AFSCME [Michigan Ct. of Appeals, unpublished op. 2/15/05].  It held a small labor union accountable to members who became victims of identity theft after a thief stole their Social Security Numbers (SSN) and other data from the union. The damages amounted to approximately a quarter million dollars.

That result required the union members to go to court and prove negligence.

Sometimes state legislatures enact a law that specifically requires a data holder to pay the costs of others in the wake of a breach.  A good example of such a special law is Minnesota’s HF 1758 (Plastic Card Security Act), which sometimes requires credit card merchants to reimburse the costs of card issuers when they replace cards after a breach at the merchant.

Politician Demands Liability ... and That's Not Necessarily Good or Bad

Now, in a breach at Countrywide Financial Corp (owned by Bank of America), the Connecticut state attorney general seeks liability without the support of a court decision or special legislation.  He did not sue in court.

It appears the AG has simply demanded, in public, that Countrywide agree it will compensate anyone hurt by the breach. Countrywide is a large company, vulnerable to public pressure like this. Countrywide has agreed, and the AG is seeking to get that agreement in writing.

A state attorney general is a politician charged with advancing the interests of consumers.  Here, Attorney General Richard Blumenthal is doing that not through traditional legal proceedings, but through his bully pulpit.

Background: Countrywide suffered a breach when an employee downloaded records on as many as 2 million Countrywide customers/prospects and offered them for sale to mortgage brokers who wanted them for sales leads. E. Scott Reckard, “Mortgage firm Countrywide, in response to alleged data breach, offers free credit monitoring,” Los Angeles Times, Sept. 10, 2008. Countrywide says it has no evidence that anyone has suffered identity theft from this incident.

Update: The expansion of legal liability for compromises of e-data security will be a deterrent to the adoption of electronic medical records (aka personal health records or PHRs).  As the new Obama administration promotes electronic healthcare records, doctor's offices and clinics will have reason to resist.  The reasoning of medical offices could go like this: "The Department of Heath and Human Services says that if I implement e-patient records, I must implement reasonable safeguards to protect patient data.  The implication is that if I make a mistake, I could be forced to pay money.   Why should I expose my business to punishment by innovative privacy advocates like the Connecticut Attorney General?  If a hacker invades or breaks into my e-records, an aggressive consumer advocate, like a plaintiff lawyer, might find a novel way to hold me liable.  I'm better off with paper.  If someone abuses my old-fashioned paper records, there is unlikely to be an audit trail of the incident (i.e., a smoking gun electronic log showing that the wrong person opened the file).  Furthermore, the compromise of paper records is less sexy and newsworthy than the hacking of electronic records.  Consumer watchdogs like the Connecticut AG are less likely to make a big deal out of a garden-variety story about an unauthorized person looking at paper records in a manila file folder."  The federal government has not yet proposed measures for protecting the security of PHRs.  Ben Worthen, "New Epidemic Fears:  Hackers," Wall Street Journal, Aug. 4, 2009.

–Benjamin Wright

Mr. Wright teaches computer investigation law at the SANS Institute.

Private Data (or Personally Identifiable Information) Definition

Data Leakage Law

The key to avoiding liability for data leakage is due diligence. As a broad generalization, the law of data security rewards those who are diligent, who exercise due care to prevent a compromise of privacy. Hence, if a data holder is diligent, but still suffers a mishap, it is less likely to be held legally liable when a data subject decides to sue.

For example, Guin v. Brazos Higher Education held a loan processor was not liable for a compromise of data security, in part because the processor had taken reasonable steps to protect the data (including a written security policy and risk assessment).

Reasonable steps, or due diligence, can include application of latest technology, such as filters that inspect outgoing data transmissions and scrub or block those that appear suspicious.  An e-mail filter would have been helpful to the Palm Beach County health department when an employee inadvertently broadcast a list of HIV/AIDS patients to 800 county employees.

When employing such filters, however, an issue is to know what to filter.  Obvious targets for filtering are Social Security Numbers and credit card numbers. But privacy is a context-specific abstraction. To understand which data are and are not private, organizations have to be sensitive.  For example, a person’s name plus postal address are normally not considered private.  That information is commonly published in directories like telephone books. However, as one of my SANS Institute students taught me, a public housing authority is wise to consider the name plus postal address of its residents to be private. The reason is that some residents are sensitive about living in public housing, and consider their postal address (at a public housing location) to be private!

Update: Netflix (the movie rental company) learned how context-specific PII can be.  Netflix gave "anonymized" data about the viewing interests of its users to researchers so they could help develop better algorithms for suggesting to users new movies they'd like to see.  But academics have shown that most any information about a person (such as movies watched) can be used to identify the person if it is matched with enough context (data on time, location and so on are good examples of context that can turn anonymized data into PII).  So Netflix’s research project drew a lawsuit saying the data it exposed to researchers was actually PII.  The project also attracted attention from government watchdog Federal Trade Commission.  Netflix settled the lawsuit and ceased that particular line of research.

--Benjamin Wright, computer security law instructor for SANS Institute (CLE and CPE).

Payment Card Issuers Over-reacted to TJX

Federal Trade Commission Misunderstands Card Data Privacy.

Rethink PCI Law.

The TJX credit card data break-in is reputed to be the largest in history. On the heels of the incident, many credit card issuers replaced cards believed to be compromised. To replace cards is expensive (not to mention disruptive to consumers), and many card issuers demanded, through lawsuits and otherwise, that TJX reimburse them. December 2007 TJX settled one class action lawsuit with issuers of affected VISA cards, agreeing to pay $41 million. Dow Jones Newswires, "TJX Gets Over 95% Acceptance Of VISA Settlement Agreement," December 20, 2007. May 2008 TJX said it had support for settlement with Mastercard issuers for $24 million.

The Federal Trade Commission concluded that TJX had maintained inadequate controls to protect credit card data and had therefore committed unfair trade practices. Consequently, the Commission has punished TJX by requiring it to adopt new controls (in the vein of the PCI - Payment Card Industry Data Security Standard) and file extensive paperwork with the government for years to show that the controls are in place.

That's the background. Now think about this . . . August 2008 federal authorities announced indictments of the ring of criminals at the heart of the TJX heist. The ring had stolen data from both TJX and many other retailers. According to authorities, the criminals used stolen data to withdraw tens of thousands of dollars at a time from automated teller machines. Their ATM withdrawals added up to hundreds of thousands of dollars.

Further, last year six people were convicted in Florida for using data, apparently stolen from TJX, to buy gift cards and goods worth AT LEAST ONE MILLION DOLLARS. Jon Swartz, "11 Charged in TJX Identity Theft," USA Today, August 6, 2008.

Do you see an imbalance here? TJX settles with VISA & Mastercard issuers for $65 million, whereas the actual reported fraud is only a tiny fraction of that amount. Further, when card issuers canceled all those cards, they alarmed and inconvienced millions of cardholders to excess.