Electronic Data Records Law | How to Win E-Discovery

Public Relations of a Data Security Breach?

Professional Education - Technology

[Update:  I've an evaluating Google Buzz as a vehicle for crisis communications, such as public announcements and interaction following an information security incident.]

Public communications are an under-appreciated facet of cybersecurity.  Over the years, I have increasingly emphasized public communications in my SANS LEG523 course on the law of information security (which includes e-discovery, record retention and internal investigations). 

Public communications is much more than just press releases and press conferences.  It embraces a wide array of
public statements related to IT security -- policies, disclaimers, web notices, contracts, network terms & conditions, blogs, filings submitted to regulators, interactions with law enforcement, breach notices to consumers, declarations made in courts of law, and much, much more. 

For instance, observe how central publicity is to the pivotal IT security lawsuit PlainsCapital Bank v. Hillary Machinery.

If anything could summarize my 5-day LEG523 course, it would be this:  Words count, and words need to selected carefully.  The words your enterprise utters to the world can have an astonishing impact on legal liability, public reputation, regulatory compliance, the cooperation (or not) of law enforcement and so on.  Silence also counts, and silence is often a bad idea. 

No other training course in the world will shake up your thinking about information and computer security as much as LEG523. 

I'd be happy to answer questions about the course.

Learn more and register.

--Benjamin Wright, Senior Legal Issues Instructor, SANS Institute

Whistleblowers Leak Secrets

Wikileaks.com for Accountability

If a public organization doesn't embrace transparency, transparency will be thrust upon it forcibly.  For any institution, its electronic records are so detailed and subject to revelation in so many ways that the institution must find a way to pre-empt their inopportune public disclosure.  Better to come clean with information now – before the lawsuit (think deposition) or the FOIA request or the hacker break-in brings the information to light.

The climate research unit at the University of East Anglia is learning directly how disconcerting unexpected disclosure can be.  
 Someone – whether an outside hacker spy or an inside whistleblower – has leaked volumes of e-mails, software, source code and programmer notes to the world.  As a world leader on climate modeling, the university is shocked to see its internal discussions hung out for public scrutiny.

Some emails suggest the university's scientists had earlier tried to destroy records to prevent their disclosure under a freedom of information request.  Other records arguably depict programmers manipulating data for key climate modeling software in a deceptive manner.  Some emails appear to show researchers misallocating expenses against a US government research grant.

Some observers speculate all these records had been assembled for a freedom of information request, and after the request was denied, an internal whistleblower elected to liberate them.  Once information leaves the confines of the institution, it's easy to broadcast through channels like Wikileaks.com.

Separately, another institution on which technology has violently imposed transparency is international banking.  An IT staffer at LGT Group stole secret bank customer records and sold them to the German tax authorities, who used them to prosecute tax evaders. “Liechtenstein Under Siege Clings to Bank Secrecy to Outdo Swiss,” Bloomberg.com 2/27/08. 

Then a US Senate investigative committee data-mined Homeland Security records of foreign visitors to uncover a pattern of Swiss bankers coming to the US illegally to solicit deposits from rich American taxpayers.  These unsavory revelations -- made possible by new technology -- has devastated the long-standing industry of secret bank accounts in places like Switzerland.  The US has largely closed down that industry as an avenue for tax evasion and other crime. Kevin McCoy, “IRS: Offshore tax crackdown should produce 'billions',” USA Today, Nov. 17, 2009.

So in this technological age of leaks and sousveillance, what are institutions to do?  Here are three mild examples of proactive transparency: 

* New York City allows web-empowered citizens to track their government's performance on details like response times on calls to the fire department or the street maintenance crews.

* The City lets the same citizens monitor how the city is spending federal stimulus dollars.

* 15 local governments in South Carolina now post their full check registers online so citizens can scrutinize how the governments spend cash and which vendors get how much money.

Update November 29, 2009:  After thinking about it, the University of East Anglia has decided that radical transparency is the only logical policy.  In the wake of the hacker break-in described above, the University has announced it will reveal "all" of its climate data as soon as possible.

–Benjamin Wright

Mr. Wright teaches Data Retention and Security Law at the SANS Institute, where he emphasizes how critical public communications are to good information security.

Related post: Whistleblowers with cameras

Data Loss Prevention Strategy

Transparency as Compliance with Data Security Regulation

How are data holders to comply with the swelling riot of data security laws?  These laws include breach notification laws, which require that individuals and/or government be notified when the security of private data has been compromised.  Perfect compliance is impossible.

Almost all the states have adopted breach notice laws – though they are not uniform – and legislatures are expanding the scope of the laws.  

The original law from California (effective six years ago) focused on identity information – name plus social security number, driver’s license number or financial account number.  Then the California legislature expanded its law to also include breaches of medical data. That expansion became effective January 1, 2009.  Result?  In the first five months of 2009, California authorities were notified of a whopping 823 healthcare data breaches, mostly through self-reporting by healthcare entities. That’s just one industry, in one state, in five months.  And California authorities anticipate that the flow of notices will rise as people in the healthcare community become better aware of the new law. 

A data breach can occur in myriad ways:  a misdirected fax or e-mail, a hacking incident or snooping by an employee.

Meanwhile, we see floods of breach notices issued in other states and other industries – retail, nonprofit, colleges, financial, professional services, water districts, school districts, county government, municipal government, state government, federal government.  No organization is immune.  As these laws sit longer on the books, the flow of notices grows larger and larger.

Why are there so many notices?  The reason is that the laws assume that 100% data privacy can reasonably be achieved.  They further assume that any shortcoming (or suspected shortcoming) of data privacy should be an unusual event within well-managed enterprises.  The assumptions are wrong.  
The expectations of the public, and especially the expectations of policy makers, are out of touch with the reality of modern data management.  These outsized expectations contribute to a growing risk of monetary liability on the part of data holders.

So what are data holders to do?  Obviously they need to invest in data security, training and investigation – and they have been.  But banks, schools, utilities, clinics, hospitals, merchants and government agencies can throw massive investments at this problem and never meet present expectations.