Electronic Data Records Law | How to Win E-Discovery

Public Relations of a Data Security Breach?

Professional Education - Technology

[Update:  I've an evaluating Google Buzz as a vehicle for crisis communications, such as public announcements and interaction following an information security incident.]

Public communications are an under-appreciated facet of cybersecurity.  Over the years, I have increasingly emphasized public communications in my SANS LEG523 course on the law of information security (which includes e-discovery, record retention and internal investigations). 

Public communications is much more than just press releases and press conferences.  It embraces a wide array of public statements related to IT security -- policies, disclaimers, web notices, contracts, network terms & conditions, blogs, filings submitted to regulators, interactions with law enforcement, breach notices to consumers, declarations made in courts of law, and much, much more. 

For instance, observe how central publicity is to the pivotal IT security lawsuit PlainsCapital Bank v. Hillary Machinery.

If anything could summarize my 5-day LEG523 course, it would be this:  Words count, and words need to selected carefully.  The words your enterprise utters to the world can have an astonishing impact on legal liability, public reputation, regulatory compliance, the cooperation (or not) of law enforcement and so on.  Silence also counts, and silence is often a bad idea. 

No other training course in the world will shake up your thinking about information and computer security as much as LEG523. 

I'd be happy to answer questions about the course.

Learn more and register.

--Benjamin Wright, Senior Legal Issues Instructor, SANS Institute

Employee Privacy on Social Network

Trespassing in Cyberspace

Computer Investigation Law

Investigators engaged in electronic discovery should be mindful of posted terms, conditions, EULAs, labels, notices, warnings, banners, contracts, agreements and no-trespassing signs.  They can have legal effect in the electronic world, and may be binding on an investigator who encounters them. 

Consider Pietrylo v. Hillstone Restaurant Group.  

While off-duty, restaurant employees maintained a password-protected MySpace forum, labeled as “talk about all the crap/drama/and gossip occurring in our workplace, without having to worry about outside eyes prying in.”  Pietrylo created and maintained the forum, explicitly designated it as “invitation only,” and distributed passwords to a limited number of employees.  One of these employees gave her password (whether voluntarily or otherwise is unclear) to restaurant management.  Management accessed the forum, and discovered . . .

Internet Terms, Contracts, Disclaimers

Financial Derivatives Yield Unexpected Incentives

Hedge Fund Public Disclaimer of Liability-Responsibility?

Web Notice to Pre-empt Complaints | EMail Disclaimer | Contract Enforcement | Battle of the Forms

The World Wide Web is changing contract and commercial law practices.  As a global medium for broadcasting terms, notices, conditions, and disclaimers, the web empowers business innovators preemptively to warn their trading partners of risk and to disclaim responsibility to prospective counterparties.  Business innovators might therefore use the web to reduce their legal risk.

This blog post presents an advanced idea.  To explain it will require space, so please hang with me as I lay out my argument.  First I will explain how forward-thinking traders like hedge funds can be exposed to new legal liability.  Then I will explain a method for containing that exposure, a method that could apply to more than just hedge funds and financial markets.  

The legal desire to warn others and disclaim liability is acute in the cutthroat world of financial derivatives and structured finance.  Derivatives (which are fueled by efficient digital
technology), especially credit default swaps (CDS), allow aggressive traders to assume unconventional, counterintuitive positions – positions that may surprise and even anger other parties.  Three examples:

1. George Soros says some of the bondholders in the AbitibiBowater and General Motors bankruptcies perversely preferred to dissolve the companies rather than reorganize them on account of the bondholders’ positions in credit default swaps.  “CDS are instruments of destruction that ought to be outlawed,” he proclaimed (emphasis added).  Further, to hold both a bond and a corresponding CDS simultaneously “is like buying life insurance on someone else’s life and owning a license to kill him.” George Soros, “My three steps to financial reform,” Financial Times, June 17, 2009.

2. Some analysts complain about a Fidelity mutual fund that simultaneously held both bonds issued by the distressed Six Flags company and hedged CDS positions relative to those bonds.  According to the analysts, the mutual fund turned down a reasonable restructuring offer for the Six Flags company.  Strangely, the mutual fund preferred that Six Flags sink into bankruptcy where bondholders as bondholders would receive less.  The Economist magazine goes on to observe, “By purchasing a material amount of a firm’s debt in conjunction with a disproportionately large number of CDS contracts, rapacious lenders (mostly hedge funds) can render bankruptcy more attractive than solvency.” “CDSs and bankruptcy: No empty threat,” The Economist, June 20, 2009, p. 79 (emphasis added to highlight that the Economist thinks the mutual fund's behavior was bad and presumably should be punished).