Electronic Data Records Law | How to Win E-Discovery

Public Relations of a Data Security Breach?

Professional Education - Technology

[Update:  I've an evaluating Google Buzz as a vehicle for crisis communications, such as public announcements and interaction following an information security incident.]

Public communications are an under-appreciated facet of cybersecurity.  Over the years, I have increasingly emphasized public communications in my SANS LEG523 course on the law of information security (which includes e-discovery, record retention and internal investigations). 

Public communications is much more than just press releases and press conferences.  It embraces a wide array of
public statements related to IT security -- policies, disclaimers, web notices, contracts, network terms & conditions, blogs, filings submitted to regulators, interactions with law enforcement, breach notices to consumers, declarations made in courts of law, and much, much more. 

For instance, observe how central publicity is to the pivotal IT security lawsuit PlainsCapital Bank v. Hillary Machinery.

If anything could summarize my 5-day LEG523 course, it would be this:  Words count, and words need to selected carefully.  The words your enterprise utters to the world can have an astonishing impact on legal liability, public reputation, regulatory compliance, the cooperation (or not) of law enforcement and so on.  Silence also counts, and silence is often a bad idea. 

No other training course in the world will shake up your thinking about information and computer security as much as LEG523. 

I'd be happy to answer questions about the course.

Learn more and register.

--Benjamin Wright, Senior Legal Issues Instructor, SANS Institute

Employee Privacy on Social Network

Trespassing in Cyberspace

Computer Investigation Law

Investigators engaged in electronic discovery should be mindful of posted terms, conditions, EULAs, labels, notices, warnings, banners, contracts, agreements and no-trespassing signs.  They can have legal effect in the electronic world, and may be binding on an investigator who encounters them. 

Consider Pietrylo v. Hillstone Restaurant Group.  

While off-duty, restaurant employees maintained a password-protected MySpace forum, labeled as “talk about all the crap/drama/and gossip occurring in our workplace, without having to worry about outside eyes prying in.”  Pietrylo created and maintained the forum, explicitly designated it as “invitation only,” and distributed passwords to a limited number of employees.  One of these employees gave her password (whether voluntarily or otherwise is unclear) to restaurant management.  Management accessed the forum, and discovered . . .

Internet Terms, Contracts, Disclaimers

Financial Derivatives Yield Unexpected Incentives

Hedge Fund Public Disclaimer of Liability-Responsibility?

Web Notice to Pre-empt Complaints | EMail Disclaimer | Contract Enforcement | Battle of the Forms

The World Wide Web is changing contract and commercial law practices.  As a global medium for broadcasting terms, notices, conditions, and disclaimers, the web empowers business innovators preemptively to warn their trading partners of risk and to disclaim responsibility to prospective counterparties.  Business innovators might therefore use the web to reduce their legal risk.

This blog post presents an advanced idea.  To explain it will require space, so please hang with me as I lay out my argument.  First I will explain how forward-thinking traders like hedge funds can be exposed to new legal liability.  Then I will explain a method for containing that exposure, a method that could apply to more than just hedge funds and financial markets.  

The legal desire to warn others and disclaim liability is acute in the cutthroat world of financial derivatives and structured finance.  Derivatives (which are fueled by efficient digital
technology), especially credit default swaps (CDS), allow aggressive traders to assume unconventional, counterintuitive positions – positions that may surprise and even anger other parties.  Three examples:

1. George Soros says some of the bondholders in the AbitibiBowater and General Motors bankruptcies perversely preferred to dissolve the companies rather than reorganize them on account of the bondholders’ positions in credit default swaps.  “CDS are instruments of destruction that ought to be outlawed,” he proclaimed (emphasis added).  Further, to hold both a bond and a corresponding CDS simultaneously “is like buying life insurance on someone else’s life and owning a license to kill him.” George Soros, “My three steps to financial reform,” Financial Times, June 17, 2009.

2. Some analysts complain about a Fidelity mutual fund that simultaneously held both bonds issued by the distressed Six Flags company and hedged CDS positions relative to those bonds.  According to the analysts, the mutual fund turned down a reasonable restructuring offer for the Six Flags company.  Strangely, the mutual fund preferred that Six Flags sink into bankruptcy where bondholders as bondholders would receive less.  The Economist magazine goes on to observe, “By purchasing a material amount of a firm’s debt in conjunction with a disproportionately large number of CDS contracts, rapacious lenders (mostly hedge funds) can render bankruptcy more attractive than solvency.” “CDSs and bankruptcy: No empty threat,” The Economist, June 20, 2009, p. 79 (emphasis added to highlight that the Economist thinks the mutual fund's behavior was bad and presumably should be punished).

3. Amherst Holdings, a Texas investment firm, “ambushed” some big banks.  The banks were counterparties to which Amherst had sold CDSs so that the banks could hedge their losses on bonds they owned representing defaulting mortgages.  From the sale of the CDSs, Amherst and its associates earned multimillion dollar fees from the banks.  Under the terms of the CDSs, team Amherst would have to pay handsomely as the losses from the defaulting mortgages were allocated under the bonds to the banks.  But then Amherst executed a maneuver that prevented the banks from collecting under the CDSs.  It used a little-known legal loophole to arrange (with the party that services the bonds) for the bonds to be paid in full! The banks were not prepared for this scenario. The result was that team Amherst did not have to pay as expected under the CDSs.  On balance, Amherst made money, and the banks lost the substantial fees they had paid team Amherst for the CDSs.  Some of the banks have complained to industry trade associations that Amherst acted improperly.  Zuckerman, Ng & Rappaport, “A Daring Trade Has Wall Street Seething,” Wall Street Journal, June 12, 2009. Deutsche Bank averred that a maneuver like Amherst’s might be illegal.

In each of these three stories, counterparties or other investors felt the successful traders had acted unfairly, possibly deceptively and perhaps even illegally.

When large sums of money are lost unexpectedly, losers are prone to seek legal or political redress. They might try to claim, for example, that they were victims of fraud or that they were entitled to more disclosure of the other party’s intention, position, or strategy.

Web Notice to Pre-empt Complaints

But in anticipation of the possibility of such legal claims, unconventional traders might take steps long in advance.  They might pre-empt such claims by issuing a general warning and disclaimer. They might conspicuously publish on their Web pages a notice like this:

“Notice. This is notice published by ABC Hedge Fund (the “Fund”) to the attention of any party that may have a direct or indirect relationship to the Fund’s investments, including but not limited to an investor, a counterparty or the issuer of debt, equity or other rights, interests or securities.  Please be advised that the Fund may assume or take advantage of innovative, unconventional or surprising positions.  While the Fund shall always stay in full compliance with all applicable laws, please be alert that the Fund may aggressively pursue trading or investment strategies that are novel or counterintuitive.  Except to the extent the Fund otherwise explicitly agrees in writing, the Fund disclaims responsibility to (a) inform others of its intentions, trading positions or investment strategies, or (b) look out for the interests of others or divine their intentions, strategies or expectations.”

Publication of such a notice/disclaimer would create electronic records suggesting that prospective “victims” had been warned in advance.

How effective might such a notice be?  Although the legal effect of any kind of disclaimer can rarely be certain for all circumstances, support is growing for the proposition that general-distribution legal notices can be delivered by way of publication on the web.  Observe four angles on the topic:

A.  Historically newspapers were the accepted medium for publishing general legal notices to the public – notices of auctions, bankruptcies, forfeitures, zoning changes and public procurement.  But newspapers are dying, while the web becomes more popular.  The law is coming to learn it is easier to use search engines to find a notice on the web than to hunt for it by poring over old newspapers in a library.  Thus many organizations such as government agencies that must publish legal notices are shifting from expensive advertisements in newspapers to cheap postings on their web pages.  Emery P. Dalesio, Associated Press, “Move to online public notices looms over papers,’ USA Today, May 22, 2009.

B.  Google maintains that its users are legally aware of and contractually subject to the terms of its privacy policy, even if they have not actually seen those terms and even if those terms are not available as a direct, conspicuous link from google.com.  (Google.com is the primary entry point for users of the Google search engine.)

C.  In LeRoy Greer v. 1-800-FLOWERS.com a Texas court held that the legal terms published by a florist on its web page were binding on a consumer transaction executed over the telephone.

D.  Suzanne Shell published aggressive copyright terms on her web site. Then, citing those terms, she sued the Internet Archive for using an automated spider to make copies of her web pages in violation of the terms.  She had published those terms in plain English, which automated spiders cannot read, rather than in the more technically elegant robots.txt format, which is designed for spiders.  To some technologists, Ms. Shell's method of publication seemed outrageous and technologically regressive because it did not accommodate spider technology.  However, the Internet Archive handed Ms. Shell a measure of victory.  The Internet Archive settled and apologized to her – rather than risk finding out whether a court would enforce her terms.  Legally speaking there is little precedent to preclude a web site owner from assertively publishing terms that might be binding on certain other people who have not actually read them with their eyes.

Web-published notices and disclaimers might help all kinds of organizations, not just financial traders, step closer to their legal, compliance and electronic commerce goals.  US banks, for instance, might publish notices to their commercial customers to help them understand their risks and responsibilities for electronic funds transfers under UCC 4A.


EMail Disclaimer

One way to cultivate evidence that trading partners were aware of a disclaimer would be to link to it from the signature at the bottom of all outgoing emails.  Electronic mail records can come in very handy in a lawsuit, political dispute or white collar investigation.  E-mail is a common medium for effecting "novation" in the derivatives market.

Contract Enforcement

Traditional (Western) notions of contract enforcement by a court don’t apply in all places at all times.  For example, Chinese authorities are questioning the enforcement of complex, oil-related derivative contracts entered by companies like China Eastern Airlines Corp.  Chinese firms may not perform (make payments) under contracts as Western banks expected. They (or other Chinese authorities) may try to aborgate the contracts. James T. Areddy et al, “Beijing Backs Derivatives Fight,” Wall St. J., Sept. 8, 2009.

Globalization and other factors thus make contract performance more a matter of politics, reputation and public relations.  

In this environment, savvy traders (contracting parties) can use the web to bolster their positions with publicity and transparency.  They can publicly explain complex contract terms and their commitment to performing under those terms.  They can openly agree that any of their counter parties can publish and discuss all of their letters, e-mails, chat messages and other communications related to their contract performance.  They can ask trading partners to openly, publicly acknowledge their own commitment to the terms and to publicity.  

The Financial Times reports that Hong Kong lawyer Mushtaq Kapasi suggests the Western banks were unfair in dealing with Chinese companies because the banks had more information about the derivatives landscape than did the companies. Sundeep Tucker & Robert Cookson, "China's losses from foreign derivatives turn political," Fin. Times, 15 Sept 09. To prevent allegations of unfairness like this, commercial parties like the Western banks could (for example) publish on the web extensive videos -- in Chinese and many other languages -- explaining in detail how derivatives work and how to gather all the necessary information to be a sophisticated player in the market.  


Battle of the Forms

Web publication of legal terms for derivatives (and other structured finance) trades can also help a financial firm whose traders sometimes fail to follow procedures for confirming particular trades and establishing the terms that control those trades.  (A former professional in the Lehman Brothers legal department claims the legal terms for the firm's derivatives transactions were often confused or wrong.)  Publication of terms (with a statement that they always apply to the exclusion of any other terms) does not guarantee that they will control, but under "battle of the forms" law, such publication might cause the terms to control.   

–Benjamin Wright

Mr. Wright provides training (CPE) on cyber law, defense, ethics and investigations under the SANS Institute, where for years he as been educating professionals on e-contracts and computer banking lawsuits.

As the notice on the left column of this blog reminds you, Mr. Wright is not providing legal advice to anyone here.  If you need legal advice, you should consult your lawyer.