Electronic Data Records Law | How to Win E-Discovery

Internet Terms, Contracts, Disclaimers

Financial Derivatives Yield Unexpected Incentives

Hedge Fund Public Disclaimer of Liability-Responsibility?

Web Notice to Pre-empt Complaints | EMail Disclaimer | Contract Enforcement | Battle of the Forms

The World Wide Web is changing contract and commercial law practices.  As a global medium for broadcasting terms, notices, conditions, and disclaimers, the web empowers business innovators preemptively to warn their trading partners of risk and to disclaim responsibility to prospective counterparties.  Business innovators might therefore use the web to reduce their legal risk.

This blog post presents an advanced idea.  To explain it will require space, so please hang with me as I lay out my argument.  First I will explain how forward-thinking traders like hedge funds can be exposed to new legal liability.  Then I will explain a method for containing that exposure, a method that could apply to more than just hedge funds and financial markets.  

The legal desire to warn others and disclaim liability is acute in the cutthroat world of financial derivatives and structured finance.  Derivatives (which are fueled by efficient digital
technology), especially credit default swaps (CDS), allow aggressive traders to assume unconventional, counterintuitive positions – positions that may surprise and even anger other parties.  Three examples:

1. George Soros says some of the bondholders in the AbitibiBowater and General Motors bankruptcies perversely preferred to dissolve the companies rather than reorganize them on account of the bondholders’ positions in credit default swaps.  “CDS are instruments of destruction that ought to be outlawed,” he proclaimed (emphasis added).  Further, to hold both a bond and a corresponding CDS simultaneously “is like buying life insurance on someone else’s life and owning a license to kill him.” George Soros, “My three steps to financial reform,” Financial Times, June 17, 2009.

2. Some analysts complain about a Fidelity mutual fund that simultaneously held both bonds issued by the distressed Six Flags company and hedged CDS positions relative to those bonds.  According to the analysts, the mutual fund turned down a reasonable restructuring offer for the Six Flags company.  Strangely, the mutual fund preferred that Six Flags sink into bankruptcy where bondholders as bondholders would receive less.  The Economist magazine goes on to observe, “By purchasing a material amount of a firm’s debt in conjunction with a disproportionately large number of CDS contracts, rapacious lenders (mostly hedge funds) can render bankruptcy more attractive than solvency.” “CDSs and bankruptcy: No empty threat,” The Economist, June 20, 2009, p. 79 (emphasis added to highlight that the Economist thinks the mutual fund's behavior was bad and presumably should be punished).

3. Amherst Holdings, a Texas investment firm, “ambushed” some big banks.  The banks were counterparties to which Amherst had sold CDSs so that the banks could hedge their losses on bonds they owned representing defaulting mortgages.  From the sale of the CDSs, Amherst and its associates earned multimillion dollar fees from the banks.  Under the terms of the CDSs, team Amherst would have to pay handsomely as the losses from the defaulting mortgages were allocated under the bonds to the banks.  But then Amherst executed a maneuver that prevented the banks from collecting under the CDSs.  It used a little-known legal loophole to arrange (with the party that services the bonds) for the bonds to be paid in full! The banks were not prepared for this scenario. The result was that team Amherst did not have to pay as expected under the CDSs.  On balance, Amherst made money, and the banks lost the substantial fees they had paid team Amherst for the CDSs.  Some of the banks have complained to industry trade associations that Amherst acted improperly.  Zuckerman, Ng & Rappaport, “A Daring Trade Has Wall Street Seething,” Wall Street Journal, June 12, 2009. Deutsche Bank averred that a maneuver like Amherst’s might be illegal.

In each of these three stories, counterparties or other investors felt the successful traders had acted unfairly, possibly deceptively and perhaps even illegally.

When large sums of money are lost unexpectedly, losers are prone to seek legal or political redress. They might try to claim, for example, that they were victims of fraud or that they were entitled to more disclosure of the other party’s intention, position, or strategy.

Web Notice to Pre-empt Complaints

But in anticipation of the possibility of such legal claims, unconventional traders might take steps long in advance.  They might pre-empt such claims by issuing a general warning and disclaimer. They might conspicuously publish on their Web pages a notice like this:

“Notice. This is notice published by ABC Hedge Fund (the “Fund”) to the attention of any party that may have a direct or indirect relationship to the Fund’s investments, including but not limited to an investor, a counterparty or the issuer of debt, equity or other rights, interests or securities.  Please be advised that the Fund may assume or take advantage of innovative, unconventional or surprising positions.  While the Fund shall always stay in full compliance with all applicable laws, please be alert that the Fund may aggressively pursue trading or investment strategies that are novel or counterintuitive.  Except to the extent the Fund otherwise explicitly agrees in writing, the Fund disclaims responsibility to (a) inform others of its intentions, trading positions or investment strategies, or (b) look out for the interests of others or divine their intentions, strategies or expectations.”

Publication of such a notice/disclaimer would create electronic records suggesting that prospective “victims” had been warned in advance.

How effective might such a notice be?  Although the legal effect of any kind of disclaimer can rarely be certain for all circumstances, support is growing for the proposition that general-distribution legal notices can be delivered by way of publication on the web.  Observe four angles on the topic:

A.  Historically newspapers were the accepted medium for publishing general legal notices to the public – notices of auctions, bankruptcies, forfeitures, zoning changes and public procurement.  But newspapers are dying, while the web becomes more popular.  The law is coming to learn it is easier to use search engines to find a notice on the web than to hunt for it by poring over old newspapers in a library.  Thus many organizations such as government agencies that must publish legal notices are shifting from expensive advertisements in newspapers to cheap postings on their web pages.  Emery P. Dalesio, Associated Press, “Move to online public notices looms over papers,’ USA Today, May 22, 2009.

B.  Google maintains that its users are legally aware of and contractually subject to the terms of its privacy policy, even if they have not actually seen those terms and even if those terms are not available as a direct, conspicuous link from google.com.  (Google.com is the primary entry point for users of the Google search engine.)

C.  In LeRoy Greer v. 1-800-FLOWERS.com a Texas court held that the legal terms published by a florist on its web page were binding on a consumer transaction executed over the telephone.

D.  Suzanne Shell published aggressive copyright terms on her web site. Then, citing those terms, she sued the Internet Archive for using an automated spider to make copies of her web pages in violation of the terms.  She had published those terms in plain English, which automated spiders cannot read, rather than in the more technically elegant robots.txt format, which is designed for spiders.  To some technologists, Ms. Shell's method of publication seemed outrageous and technologically regressive because it did not accommodate spider technology.  However, the Internet Archive handed Ms. Shell a measure of victory.  The Internet Archive settled and apologized to her – rather than risk finding out whether a court would enforce her terms.  Legally speaking there is little precedent to preclude a web site owner from assertively publishing terms that might be binding on certain other people who have not actually read them with their eyes.

Web-published notices and disclaimers might help all kinds of organizations, not just financial traders, step closer to their legal, compliance and electronic commerce goals.  US banks, for instance, might publish notices to their commercial customers to help them understand their risks and responsibilities for electronic funds transfers under UCC 4A.


EMail Disclaimer

One way to cultivate evidence that trading partners were aware of a disclaimer would be to link to it from the signature at the bottom of all outgoing emails.  Electronic mail records can come in very handy in a lawsuit, political dispute or white collar investigation.  E-mail is a common medium for effecting "novation" in the derivatives market.

Contract Enforcement

Traditional (Western) notions of contract enforcement by a court don’t apply in all places at all times.  For example, Chinese authorities are questioning the enforcement of complex, oil-related derivative contracts entered by companies like China Eastern Airlines Corp.  Chinese firms may not perform (make payments) under contracts as Western banks expected. They (or other Chinese authorities) may try to aborgate the contracts. James T. Areddy et al, “Beijing Backs Derivatives Fight,” Wall St. J., Sept. 8, 2009.

Globalization and other factors thus make contract performance more a matter of politics, reputation and public relations.  

In this environment, savvy traders (contracting parties) can use the web to bolster their positions with publicity and transparency.  They can publicly explain complex contract terms and their commitment to performing under those terms.  They can openly agree that any of their counter parties can publish and discuss all of their letters, e-mails, chat messages and other communications related to their contract performance.  They can ask trading partners to openly, publicly acknowledge their own commitment to the terms and to publicity.  

The Financial Times reports that Hong Kong lawyer Mushtaq Kapasi suggests the Western banks were unfair in dealing with Chinese companies because the banks had more information about the derivatives landscape than did the companies. Sundeep Tucker & Robert Cookson, "China's losses from foreign derivatives turn political," Fin. Times, 15 Sept 09. To prevent allegations of unfairness like this, commercial parties like the Western banks could (for example) publish on the web extensive videos -- in Chinese and many other languages -- explaining in detail how derivatives work and how to gather all the necessary information to be a sophisticated player in the market.  


Battle of the Forms

Web publication of legal terms for derivatives (and other structured finance) trades can also help a financial firm whose traders sometimes fail to follow procedures for confirming particular trades and establishing the terms that control those trades.  (A former professional in the Lehman Brothers legal department claims the legal terms for the firm's derivatives transactions were often confused or wrong.)  Publication of terms (with a statement that they always apply to the exclusion of any other terms) does not guarantee that they will control, but under "battle of the forms" law, such publication might cause the terms to control.   

–Benjamin Wright

Mr. Wright provides training (CPE) on cyber law, defense, ethics and investigations under the SANS Institute, where for years he as been educating professionals on e-contracts and computer banking lawsuits.

As the notice on the left column of this blog reminds you, Mr. Wright is not providing legal advice to anyone here.  If you need legal advice, you should consult your lawyer.

PII Security Legislation

Safeguard Anonymous Private Data?

Patterns of Behavior Are Protected Identifiers?

Privacy as a legal concept is in crisis. The law of privacy is becoming so expansive that the scope of the law is confusing, and literal compliance can entail strange and arduous effort.

Connecticut Legislation

Consider Connecticut’s new Public Act No. 08-167. Section 1(a) says, “Any person in possession of personal information of another person shall safeguard the data, computer files and documents containing the information from misuse by third parties . . .” Then, Section 1(c) explains:

“As used in this section, ‘personal information’ means information capable of being associated with a particular individual through one or more identifiers, including, but not limited to, a Social Security number, a driver's license number, a state identification card number, an account number, a credit or debit card number, a passport number, an alien registration number or a health insurance identification number, and does not include publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media.”

That seems like a breathtakingly broad definition.

Observe that it considers any “account number” as an identifier that triggers the requirement for security in Section 1(a). Public Act No. 08-167 does not define “account number,” which can make for surprising results for all kinds of organizations that collect money, including small ones like neighborhood parent-teacher associations. 

Surprising Case Example - Health Club Locker Number 

For example, suppose a small health club keeps track of membership payments according to locker numbers, which are viewable in the locker room. That practice may be a mistake under Connecticut’s law because anyone walking through the locker room could learn that my locker number, i.e., my account number, is “57". That unit of identifying information might be misused by, say, a snoopy debt collector who is investigating how much I spend on luxuries like club membership. Knowing my name and locker number, he could telephone the health club and say, “This is Ben Wright, and my locker number is 57.  Can you tell me how much I owe on my club membership this month?”

So, to say it in different words:  This little health club has opened itself to a lawsuit in Connecticut by doing something (making account number and locker number the same thing) that would seem to be perfectly natural and insignificant to anyone but the most paranoid of lawyers.

Behavior Patterns as Identifiers?

Although Connecticut’s law itemizes some identifiers like “account numbers” and Social Security numbers, its definition of personal information reaches wider than the itemized list.  The law regulates any and all “information capable of being associated” with a person through an “identifier.”

What kinds of information can be used to identify people by way of an “identifier?” What about patterns of behavior and patterns of social relationship? Could patterns of activity be “identifiers?” I don’t see why not.

Academic researchers have demonstrated that so-called anonymous data about human behavior can be used to identify individuals. For instance, researchers started with “anonymized” data from one Web 2.0 service, Twitter.  From this data, they ascertained the identities of individual Twitter users.  How did they do it? They drew on behavior data from another Web 2.0 service, Flickr.  By comparing maps of relationships from unnamed Twitter users with maps of relationships for known Flickr users, the researchers uncovered the identities of the Twitter users!

From the perspective of privacy, this research is chilling.

Is All Data About a Person Private?

Responding to this research, a privacy advocate is naturally inclined to say that no one should keep any data about anyone. 

While that response may be excessive, it does accurately reflect the privacy concern when anyone retains information about the patterns of behavior of individuals.

Another Case Example - Identifying People by Writing Style

So given how information about behavior patterns can serve as the “identifiers” of an individual . . . let's consider the following application of Connecticut law.  Suppose a small nonprofit in Connecticut works with volunteers to develop and publish opinions on controversial civil rights topics, such as abortion or homosexual marriage.  The organization attributes the opinions only to itself, without identifying the volunteers involved in writing them.  

Sally is one of those writer volunteers. The organization publishes a controversial opinion based largely on prose composed by Sally. Could the organization be violating Connecticut law simply by publishing Sally’s written words? Logically, the answer could be yes. Here’s the logic . . .

Examples of Sally’s writing – on non-controversial topics – appear in association with her name in many public places such as blogs, libraries, Facebook pages, LinkedIn comments, letters to the editor and so on.  

Research shows that people can be identified according to their writing style – syntax, word choice and so on.  In fact, researchers today track “anonymous” terrorists according to the style of their writing, records and communication on the web.

Hence, when the civil rights organization publishes Sally’s words, even with her name removed, it is failing to safeguard her personal information.  It is opening her to embarrassment and ridicule by people who disagree. Adversaries could analyze the patterns of behavior exhibited in the published words and ascertain that Sally is the author!  

In other words, in the legislative terms of Public Act No. 08-167, the organization failed to protect her personal identifying information (i.e., the patterns of her unique writing style woven into her text) from being "misused" to criticize her personally. 

What Does This Mean in Practice?

So what could the organization have done to comply with Connecticut law?  Before publishing Sally's words, the organization could have removed from the words the “identifier” linking to Sally by hiring a team of third-party writers to rearrange the words into anonymous writing style.

Shiver my timbers. Thats a lot of work for a small nonprofit, just to comply with Connecticut privacy law.  The regulation chills free speech.  Is that really what the Connecticut legislature had in mind?

Society faces an emerging conflict between the civil right of privacy and the civil right of free speech.

Global Impact of Strange Legislation

Notice that the foregoing conundrums arise from legislation enacted by just one small US state.  But in our Internet-connected world, the data privacy law of Connecticut can be applicable to the activities of an organization in Australia or Hong Kong.  Further, nothing prevents the legislature of Arizona, Pennsylvania, Michigan or name-your-jurisdiction from adopting law that is similarly strange and broad in scope -- all the while using words and standards that differ from Connecticut's.  

Full compliance with data privacy law has become very difficult.

–Benjamin Wright

Mr. Wright teaches data law, including electronic data discovery (EDD) at the SANS Institute.

Porn | Employee Computers

Hostile Workplace Lawsuits in the Age of Networked Computers

In the workplace, electronic pornography is legal poison.  A singular lawsuit against the Chicago Police Department demonstrates the value of technical measures to filter, screen or block porn (including lewd spam).

In a hostile workplace lawsuit against an employer (whether private sector or government), the existence of porn on work computers or in work e-mail systems can be highly prejudicial.  Even though the employer objected to porn and enforced an explicit policy against it, its presence can reflect horribly on the employer as a case goes to a public courtroom.

In Williams v. City of Chicago (US Dist Ct, N.D. Illinois, E Div 03C2994, Jul 13, 2004), e-pornography backed the police department into an indefensible position.  Officer Williams had complained more than once about a sexually offensive work environment, including both foul comments by co-workers and nasty images on computers (e-mail and otherwise).

The department had a formal policy against such behavior, and Ms. Williams' supervisors endeavored to uphold that policy.

In pursuit of the policy, supervisors had promptly investigated and responded to her complaints, including removal of pornography.  The city argued that on account of its good policy it should be entitled to "summary judgment" in the case. Under summary judgment, the city would win the case before it went to the jury.

However, the court ruled there was insufficient evidence to award summary judgment to the city. In other words, the court said the case should go to a jury for decision.   According to the court: "If the jury determines that pornography was so prevalent that the City should have known about it, the jury could conclude that the City was negligent in discovering the harassment.  Similarly, if the jury determines that the City knew about the pornography because others had complained about it, the jury could conclude that the City was negligent in remedying the harassment."

Wow.  How can the police department (or a sherrif's office) withstand a jury trial focused on the amount of pornography on the department's computers?  Such a public trial would be highly embarrassing, even if the department eventually won the case!  The local media would have a field day.  At this point, the city has strong incentive to settle – at considerable expense – with Ms. Williams.  (I can't tell from the court's opinion whether the city did settle with Mr. Williams, but I'll bet it did.)

Behold the city's unenviable position.  Even after it settles, its problem remains.  The continued presence of Internet pornography can prejudice the city in future cases brought by future employee-plaintiffs, just as it did in Ms. Williams' case.  A case could rise directly from sexual harassment allegations, or from allegations of retaliation following a complaint about porn.

I therefore argue an employer like this police department has good reason to seek technical measures to mitigate its problem.  Although technical filters and blocks are imperfect, they can materially reduce the quantity of pornography in workplace e-mail and systems.

–-Benjamin Wright

 Mr. Wright teaches Internet Records and Security Law for the SANS Institute, where he covers topics like investigations into cybertheft and HR allegations.