Electronic Data Records Law | How to Win E-Discovery

EFT Law | 4A-202 | 4A-203

Uniform Commercial Code Article 4A | Electronic Banking

Brian Krebs is publicizing many chilling stories of cybertheft, where small-to-medium enterprises lose money from their online accounts maintained at regional banks.  Lawsuits abound.

In good part, the electronic funds transfer (EFT) relationship between a bank and its business (commercial) customer is governed by Uniform Commercial Code Article 4A.  What are the rules when an unidentified computer thief wires money out of a businesses account?  This chart summarizes what Article 4A says on the topic.




Following is an article I published in 1993, where I argued that UCC 4A properly balanced the interests of banks and their business customers.  I’ve edited the only slightly from what I wrote in 1993. 

The rash of stories that Krebs is publicizing is unprecedented in the 20-some-odd-year history of UCC 4A.  In light of this rash, I am re-evaluating what I wrote in 1993.  Notice that the hypothetical case I discussed below involved $5 million, whereas the cases Krebs exposes involve only tens or hundreds of thousands of dollars.  The corporate victims of today's heist are less able to acquire expertise in IT security.

I’m not finished with my re-evaluation, but here's what I wrote . . .

UCC 4A's Delicate Balance

Hypothetical Question: Suppose a precocious 17-year-old uses her PC to send an electronic payment order to bank, relieves a corporate bank of $5 million, and vanishes with the cash.  Neither the bank nor the corporate customer knows who committed the crime or how.  Who should eat the loss . . .

Whistleblowers and Digital Records Force Transparent Governance

Public Disclosure Defuses Scandal

Publish FOIA Response?

Technology motivates any publicly accountable organization (nonprofit, corporation, government) to adopt a radically open style of governance.

Owing to email, data logs, text messages and the like, the quantity of official business records ascends skyward, while the granularity of those records grows ever more fine.  Detailed within these innumerable records are the secrets of the organization.

Stored this way, secrets are dangerous.

Keeping secrets –- or just withholding information -- is becoming harder and harder.  Secrets and records can leak out by way of FOIA, spies, gossip, hackers, mistakes, e-discovery, whistleblowers, external surveillance, or just the natural course of events (sousveillance). In finance, a "trusted" banker will leak to a friend secrets about exotic instruments like credit default swaps, which are so new that the law has yet to establish "insider trading" rules applicable to them.  Kara Scannell, "Trader's 'Nice Little Kiss' Tests Reach of Regulations," Wall Street Journal, March 31, 2010.

A leak is dangerous.

The leak is an invitation for an adversary to allege malfeasance.  When a secret leaks, the adversary's storyline becomes (a) the organization possessed information that the public needed, (b) the organization wrongfully withheld the information and (c) the public now knows the information only because a righteous force external to the organization brought it to light.

For a smart organization, the best posture is to preempt the leaking.  Before the leak happens, it should embrace transparency and publish (most all of) its records and activities onto the public Internet.  It should expose its information to independent review and debate.  Authors Tapscott and Ticoll admiringly call such an organization the naked corporation.

False Statement?

Take for example the story of the small, grassroots political action committee named “Take Back Your City,” which is promoting a vote by citizens against red light cameras in the municipality of College Station, Texas.  Through freedom of information act, the PAC obtained extensive email records regarding the city government’s use of the cameras.  In this trove of information, the PAC found what it believes is smoking gun evidence that the city is engaged in false, illegal political advertising about the effectiveness of the cameras.  The city claims – in a flyer to be inserted in monthly utility bills -- that the cameras have reduced traffic accidents, but the PAC says an internal city email contradicts that claim.  The PAC attached the email as evidence to a formal complaint it filed with the Texas Ethics Commission. 

Whether this complaint will result in ethics sanctions against the city (or more particularly the city manager cited in the complaint), I don’t know.  But the city’s defense would be easier had it been more open and transparent with its records.  When it gave the email records to the PAC, it could have also posted them all on its web page as well.  (Why not? The city had already gone to the trouble to compile them.)  Then, when it prepared its flyer for the utility bills, it could have made its point about accident reductions while also saying, “Each citizen can draw his or her own conclusions.  The city has posted on its web page exhaustive records regarding traffic cameras.” 

Such openness takes the punch out of allegations that the city lied.  Effectively, it enables the city to say, “We drew a conclusion from the data and told citizens our conclusion, but our statements to citizens were more than just that.  We also made all the data available to the citizens and told them they could read it themselves and draw their own conclusions.  We've opened the data to third party review.”

Investigating Leaks

Another lesson in transparency derives from the contrast in styles between the board of directors at Hewlett-Packard Company and the town council at Watertown, Massachusetts.

When HP saw that someone on its board was leaking company secrets, it assumed cloak-and-dagger
  mode. It didn’t talk about the problem.  It secretly hired private investigators to spy on members of its board as well as reporters in the media.  The private eyes violated the privacy of the directors by hijacking their telephone calling records.  AT&T discovered the hijacking and reported it to its customer, Tom Perkins, one of the directors targeted by the spying. The result was an embarrassing, debilitating scandal, with lawsuits, criminal complaints, an SEC investigation, a congressional investigation, and the end of career for two of the company’s top lawyers.

HP followed the old-fashioned, closed approach to resolving a crisis.  But in this Internet age -- where clandestine activities are hard to keep clandestine -- that approach led to disaster.

Compare the youtube video below.  It shows the town council dealing with the same problem as the HP board – insider leaks.  The leaks pertained to closed-door deliberations about contracts.  But rather than spying on its members in the dark of night, the Watertown council brought the issue into the open.  It discussed the topic in public, video-broadcast session! 

Notice that Watertown’s transparency immediately deters future leaks.  The leaker has to be thinking, “My leaks are attracting negative attention.  Now all the citizens are on alert, and some knowledgeable witness watching out there may come forward with embarrassing information that reveals me as the leaker.  I’d best stop leaking.”



By being transparent, the council uses the Internet as its enforcer, and it avoids the risk of a HP-style scandal.  Legal compliance meets modern public communications.

–Benjamin Wright

At the SANS Institute, Mr. Wright stresses that, in the wake of a data security incident, the delivery of a effective public message is as important as the technical and legal response.

Medical Technology Regulation

Telemedicine Licensure and Data Security

Technology perennially introduces problems for compliance with law and regulation.  But often technology can help alleviate those problems by fostering transparency and accountability.

Take for instance telemedicine, a promising family of technologies for making healthcare more affordable and accessible. Telemedicine allows, for example, a geographically remote physician to examine and treat a patient.  It can do wonders for a patient in a rural clinic who needs attention from a specialist in a distant city.  But telemedicine raises medical license issues for a physician in, say, Illinois who is treating a patient in Wyoming.  If the Illinois specialist must become licensed in each state where her patients happen to be at the time she delivers care, then red tape will impede her practice of telemedicine.

Telemedicine also raises data security issues.  On the Internet, data security law is bewilderingly confusing because authorities have recently issued a cacophony of new and very demanding laws, regulations and standards.  Often these rules are poorly written and reflect expectations that are unrealistic in our networked society.  Assorted guidance like HIPAA, state privacy regulations, breach notification laws, "20 Critical Security Controls", PCI-DSS and others purport to tell us how to protect data that might be involved in a telemedicine transaction.  But full, strict compliance with all these requirements is sparse if not impossible in the real world, as demonstrated by the daily parade of stories about how private data has leaked out of hospitals, corporations, universities, government agencies (federal, state, local and foreign) and every other organization under the sun.

So do these legal problems mean telemedicine is doomed?  No.  Just as Internet technology looks like a dark cloud to anyone seeking literal compliance with all applicable laws, information technology itself provides a silver lining.  Technology engenders the transparency and accountability that are favored in law.

The Internet allows a practitioner of telemedicine to explain to regulators – and to prospective patients – what she is doing, the value of it and the risks associated with it.  It enables the specialist doctor in Illinois to publicize, via web postings, how she is helping patients

in numerous other states, how she is taking rational steps (such as involving local doctors) to avoid or limit any medical injury in target states, and how she is endeavoring (albeit imperfectly) to protect private data.  Through the Internet, she can invite any regulators or members of the public who have reservations or constructive suggestions about her activities to contact her and discuss.

IT further allows the specialist's telemedicine system to store copious, detailed records of what care was provided, when and how, including the good faith methods used to minimize any unlicensed practice of medicine and to safeguard the patient’s private data.  Good records could even include full recordings of interactive videoconferences between patient and doctor.  Good records are the basis for third-party review and accountability to the public.

Together, electronic transparency and accountability avoid a core evil that regulations abhor: a cover-up.  So often, it is deception or cover-up that transforms a legally ambiguous situation into a violation of law.  Here are four examples:

1. When computer crime experts differentiate good “white hat” computer security research from bad “black hat” hacking, a decisive factor is whether the suspect engaged in any trickery or concealment.

2. Martha Stewart did not go to jail for insider trading, though she did have inside information at the time of making a stock trade. She went to jail for attempting a cover-up of that trade, that is, obstructing an investigation into whether she had traded on insider information.

3. Arthur Andersen was not criminally convicted for the audit work it performed for Enron.  Rather, a jury convicted Andersen for a cover-up, that is, destroying records that might be needed to review the audit work.

4. Law normally does not require a mere witness to crime to report it.  But if the witness takes any step to prevent others from uncovering the crime, then the witness is herself guilty of the crime known as “misprision of a felony.”

Let me say all this another way:  When literal compliance with complex law is difficult, parties are wise to talk candidly about the problem in public and about their good faith effort to comply.  Candid communication can diminish expectations for strict compliance and can soften the law’s interpretation and enforcement.

I’m not saying that public relations and record keeping are all that's necessary to comply with law on the Internet.  But when a person makes a sincere attempt to comply with otherwise conflicting, unrealistic or outdated regulations, transparency and accountability can weigh heavily in favor of a conclusion that the person effectively did comply.

Update 1:  The technologies to support telemedicine are advancing to include more than just microphones and video cameras.  Biomedical, Inc. has created a digestible computer chip, which will can transmit medical information from inside a patient.  Don Clark, "Take Two Digital Pills and Call Me in the Morning," Wall Street Journal,  Aug. 4, 2009.  Imagine a patient who ingests such a pill at home; the pill relays information to a device connected to the patient's home computer, which forwards it via the Internet to a remote physician.

Update 2: As cheap new technologies enable consumers at home to collect floods of data about their vital signs, issues will arise concerning the unauthorized practice of medicine.  A person (possibly a remote physician who is not licensed in the consumer's state) or a software program may help the consumer interpret the data.  Would this help constitute unauthorized practice of medicine, if the person or software explicitly disclaims giving medical advice or diagnosing disease and recommends that the consumer consult a licensed physician?  

A few years ago, Texas lawyers questioned whether self-help software was engaged in the unauthorized practice of law.  The legislature then enacted special legislation to declare that software is 
not engaged in unauthorized practice -- so long as the software conspicuously states it is not a substitute for the advice of an attorney.

Some worry that healthcare reform in the US will lead to a shortage of doctors.  Kirch, "How to Fix the Doctor Shortage," Wall St. J., Jan. 5, 2010.  If a shortage does materialize, state regulators may be less inclined to conclude that help from software or remote physicians constitutes the unauthorized practice of medicine.  Regulators may feel that software and remote physicians can help to reduce the wait times for people who really need an in-person visit with a doctor.

–-Benjamin Wright

Mr. Wright the law of data security and investigations at the SANS Institute.

Update:  Interview of Mr. Wright regarding telemedicine regulation.