Attackers potentially gained access to customers' personal information (shutterstock)

Excellus Blue Cross Blue Shield’s big data breach and the security lessons we all need to learn

Guest Post by Debbie Fletcher

There are two possible conversations that could be kicked off by the news of the major data breach at Excellus Blue Cross Blue Shield in which more than 10 million customer accounts were exposed. The first possible conversation is about internet security and what businesses and organizations of all sizes need to be doing in order to better protect the customers that have entrusted them with personal and financial information. The second possible conversation is about whether or not it is technically ironic that Blue Shield failed to prevent an attack.

Continue reading

Would increasing CFAA penalties via the CISA Amendment really even help? I don’t think so.

As the Cybersecurity Information Sharing Act (CISA) is making its way through the Senate, it has stirred up more controversy with Senator Sheldon Whitehouse’s proposed amendment to the Computer Fraud and Abuse Act (CFAA), that he argues, would give law enforcement more tools to fight hackers. The Amendment would provide for increased sentences (up to 20 years) of those who harm computers connected to “critical infrastructure.”

Continue reading

Rocky Dhir & Shawn Tuma - Cybersecurity at State Bar of Texas - Texas Bar TV

Rocky Dhir Interviews Shawn Tuma About Cybersecurity for Lawyers at State Bar of Texas 2015 Annual Meeting

I had the wonderful opportunity to visit with and get to know Rocky Dhir (@rockydhir) at the State Bar of Texas 2015 Annual Meeting in San Antonio. Rocky is the Founder and CEO of Atlas Legal Research, LP (@atlaslegal), “the world’s leading legal outsourcing company.”

Rocky and I did a brief interview where we talked about a lot of things — but also cybersecurity and, more specifically, cybersecurity for law firms. Rocky is a pro at this and he does them all of the time for the State Bar of Texas’ Texas Bar TV channel — and it really showed, but I had a great time doing it and, in the end, that’s what matters, right?

Thanks Rocky!

Bleak Cybersecurity Future: Data Breaches on Track to Cost Companies $2.1 Trillion

I recently posted about how corporate general counsel now view cybersecurity as a top 3 concern. At this rate, it will soon be their #1 concern. A recent article in Corporate Counsel gives several reasons for why this problem will only continue to increase in volume, expense, and overall risk to companies:

  1. Companies continue to move more infrastructure online
  2. The annual cost of data breaches is projected to rise to $2.1 trillion by 2019
  3. Cybercriminals are more often hacking for profit instead of for “causes” as with hacktivism
  4. Nearly 60 percent of data breaches in 2015 are anticipated to be in North America
  5. The average cost of a data breach is projected to exceed $150 million by 2020
  6. Companies are developing quantum computers with so much power they will render ineffective all currently known defenses

Not only should corporate general counsel be concerned about cybersecurity, but so too should companies’ officers and directors because there is a growing trend toward liability for them as well.

Read more: Data Breaches on Track to Cost Companies $2.1 Trillion | Corporate Counsel.

Does the CFAA Apply to Lenovo’s SuperFish Malware Lawsuits?

For me personally, the timeline of events surrounding the discovery of Lenovo’s SuperFish malware is ironic. Just a couple of days before it was discovered, I had a telephone call with a friend named Jon Stanley. Jon is someone I consider to be an elder statesman of the CFAA as he has been digging deep into the law for a long time — much longer than I have — and our call was basically to chat about all things CFAA-related. (to get a glimpse of what it’s like to talk to Jon, check this out)

One of the things we talked about was our favorite CFAA opinions and Jon told me his was Shaw v. Toshiba, 91 F.Supp.2d 926 (E.D. Tx. 1999). I had skimmed the high points a few years back but never really taken the time to go through it slowly and enjoy it like a snifter of brandy, so after we hung up, I pulled it up and began reading.

I immediately turned to the point that Jon and I discussed which is where the court focused on the silliness of folks trying to argue the Computer Fraud and Abuse Act is a “hacking” law – ha, the court knocked it out of the park! “[T]his Court does not see a blanket exemption for manufacturers in Title 18 U.S.C. § 1030; nor does it see the term ‘hacking’ anywhere in this statute.” Id. at 936. I love that statement — I have never seen the term “hacking” in there either and, to hear people continue referring to it that way makes me wonder if they also refer to the mail and wire fraud statute as intending to keep the crooked city slickers from taking advantage of honest country folk. (seriously, see page 1)

How does this apply to the Lenovo SuperFish Malware?

So now you’re probably wondering where I’m going with this, right? And, what it has to do with the Lenovo SuperFish malware?

Ok, did you catch the first part of that quote? The part about a “blanket exemption for manufacturers”?

The issue in Shaw was whether a computer manufacturer’s sale of laptop computers containing devices with defective microcode that erroneously caused the corruption or destruction of data without notice was a violation of the CFAA, because the instructions given by the defective microcode were an unauthorized transmission. Toshiba argued several things but, most applicable here, that “Congress never intended for the CFAA to reach manufacturers; rather, the CFAA is geared toward criminalizing computer ‘hacking.'” In other words, Toshiba argued that, because it was a manufacturer that did all of its “stuff” before the computer was shipped and sold to Shaw, its activities were not prohibited by the CFAA. The Court disagreed with Toshiba’s narrow interpretation:

Perhaps. But it seems more plausible that Congress, grappling with technology that literally changes every day, drafted a statute capable of encompassing a wide range of computer activity designed to damage computer systems–from computer hacking to time bombs to defective microcode.

Brilliant. Ultimately, the Court denied Toshiba’s Motion for Summary Judgment and allowed the case to proceed. 

 The lawsuits against Lenovo have already started to drop and will surely continue coming. While I have not read the individual complaints, I’d say it’s a safe bet there are some CFAA claims in there — and if not, maybe they should give Shaw v. Toshiba a read (and not just for pleasure).

So, here’s a little test for you: if they do bring a CFAA claim, do they have to plead the $5,000 loss? 

Hey Jon, by the way, thank you!

Shawn Tuma (@shawnetuma) is a cybersecurity lawyer business leaders trust to help solve problems with cutting-edge issues involving cyber risk and compliance, computer fraud, data breach and privacy, and intellectual property law. He is a partner at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes across the United States and, through the Mackrell International Law Network, around the world.


Low Hanging Fruit Can Make a Pretty Good Cybersecurity Pie

“Cybersecurity” just sounds like something that must be really complicated, right?

Sure it does — it sounds exotic and cool — and complicated. And yes, when you get into the weeds of technical things that hackers (actually, crackers) do to monkey around with computers, it can be mind-boggling.

But, must you really understand all of those things to have some basic cybersecurity protection to help improve the odds for your company?

phishingThink about this:

  • How much would your company’s cybersecurity odds improve if nobody in your company ever clicked on a phishing email?
  • If 75% wouldn’t?
  • If 50% more wouldn’t, after being taught how to think about them, than would have before?
  • How hard would it really be to take one day a month and have a lunch-and-learn for your workforce to help teach them how to think about and recognize such attacks, as well as other similar techniques the bad guys use?

piePhishing scams, weak passwords, infected usb devices — those aren’t the exotic things that people think about when they hear the word “cybersecurity.” They are the easy(ier) things — the low hanging fruit in the grand cybersecurity scheme. But don’t forget, even that low-hanging fruit can go a long way toward making a really good cybersecurity pie and save you and your company a whole lot of heartburn!


Chaos? Plan Ahead!

New Podcast: #DtSR Episode 130 – Where Law and Cyber Collide

I really appreciate the #DtSR Gang [Rafal Los (@Wh1t3Rabbit), James Jardine (@JardineSoftware), and Michael Santarcangelo (@Catalyst)] inviting me to tag along for another episode of the Down the Security Rabbit Hole podcast.

In this episode we discuss the following:

  • Traveler’s Insurance files suit against a web development company for failing to provide adequate security, resulting in a breach of one of its customers
  • FTC goes after LabMD for a data breach
  • Social media company TopFace pays a ransom to hackers

Go HERE for more details and to listen to the Podcast!