What do we in the United States really want from our cyber laws?

In my newsfeed are articles in prominent publications discussing the problems with the federal Computer Fraud and Abuse Act from very different perspectives.

www.businesscyberrisk.comIn the “the CFAA is dangerous for security researchers” corner we have White Hat Hackers and the Internet of Bodies, in Law360, discussing how precarious the CFAA (and presumably, the state hacking laws such as Texas’ Breach of Computer Security / Harmful Access by Computer laws) and Digital Millenium Copyright Act can be for security researchers.

In the “the CFAA prevents companies from defending themselves” corner we have New Bill Would Allow Hacking Victims to ‘Hack Back’, in The Hill, discussing The Active Cyber Defense Certainty Act (ACDC). ACDC (what a great acronym!) would allow companies more latitude in defending themselves against those intruding into their networks by permitting them to use techniques described as “active defense,” under certain conditions, though not permitting companies to counterattack.

Now, instead of thinking about these two measures in isolation, think of them together. What if we were to get both of them passed into law? What if we got one or the other?

This reminds me of a piece I wrote about the CFAA and the broader national policy discussion a few years ago, Hunter Moore or Aaron Swartz: Do we hate the CFAA? Do we love the CFAA? Do we even have a clue? In that piece I stated,

The CFAA has become a national lightening rod with many loving it, many hating it, and far too many loving it and hating it at the same time, without even realizing it. Before we go any further, however, consider this quote:

The CFAA was tailor-made to punish precisely the kind of behavior that [guess who?] is charged with: breaking into other people’s accounts and disseminating their … information.

Quick! Who is that referring to? Hunter Moore? Edward Snowden? Aaron Swartz? Sandra Teague?

I used this overly simplified example to try and make a point that, philosophically, we as a nation need to stop looking at each of these cases and laws in isolation and need to look at the bigger picture of how it all fits together. Picking and choosing based upon our own personal likes and dislikes due to the emotional tug of the facts is no way to develop, maintain, and mature a body of law on any subject matter — much less one as complicated as cyber.

Take this discussion and add into the mix new security-based laws such as NYDFS and then mix in the 48 states + HIPAA, GLBA, etc. breach notification laws, the conundrum of cybersecurity law schizophrenia, and then see what we have to work with. Does it all make sense?

What do you think? Where do we begin? Who needs to be involved in working this out? What are the first questions we need to ask?

Fifth Circuit: Employee Taking Data to Work for Competitor Violates Texas Hacking Law

former employee = current data thiefBefore leaving his employment at Merritt Hawkins & Associates (MHA), Larry Gresham allegedly accessed MHA’s computer network and copied 400 of MHA’s proprietary files and then deleted hundreds of files in an attempt to hide his activities. A jury found Gresham’s actions violated the Harmful Access by Computer Act (HACA), Texas unauthorized access law (i.e., “hacking law”). The Fifth Circuit affirmed the jury’s verdict. Merritt Hawkins & Associates, L.L.C. v. Gresham, 2017 WL 2662840 (5th Cir. June 21, 2017).

Here are three key points from this case about the Texas Harmful Access by Computer Act (civil) or Breach of Computer Security (criminal) laws:

  1. An employee may violate HACA / BCS by accessing his employer’s computer system without its “effective consent” (i.e., (a) by using it for a purpose other than that for which consent was given, (b) in violation of a clear and conspicuous prohibition, or (c) in violation of an express agreement) and taking data to use for non-company business related purposes.
  2. An award of $50,000 in damages for the missing and stolen computer files was supported by sufficient evidence, in the following form:
    1. the owner of the company’s testimony that he would have to pay an employee at least $100 an hour to recreate every file that was deleted and that it would be more expensive to search the company’s database to see if any files remained, even though he admitted that it was difficult to calculate the damages, especially for those that were taken but not deleted;
    2. a computer forensics expert testified that he billed the company over $60,000 for his work assessing the damage to its computer system, excluding litigation costs; and
    3. the company’s IT employee testified about the expenses he incurred and the hours he worked trying to restore the computer files.
  3. “A prevailing party on a Harmful Access by Computer claim ‘is entitled’ to attorneys’ fees.” Tex. Civ. Prac. & Rem. Code § 143.002.

See these resources for more information about the Texas Harmful Access by Computer Act and Breach of Computer Security laws:

______________________

Shawn Tuma (@shawnetuma) is an attorney with an internationally recognized reputation in cybersecurity, computer fraud, and data privacy law. He is a Cybersecurity & Data Privacy Attorney at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, around the world.

“Thank You” to 2 Legal Leaders that I Respect

There are many ways to honor someone. For me, one of the greatest privileges is knowing that others have found some value or usefulness in my work, especially by referencing it to others. What is unfortunate, however, is when you did not learn about it for quite some time and realize you never properly thanked them!

So . . .  here I am in a meeting with an attorney and her clients to discuss my consulting with them (behind the scenes) to help the attorney with various cyber issues that are involved in the case. Now you already know that I consider myself to be fairly knowledgeable in the area of cyber law but even in this area, there is still a lot out there I do not know. An issue about the Wiretap Act comes up — specifically, the Texas version of the Wiretap Act — and I do not have a good answer for the question.

So . . . I change the subject momentarily while I do what any reasonable Texas attorney should do; I use my iPad to discretely pull up Judge Emily Miskel’s (@emilymiskel) very well-respected article that discusses this issue, Peeping Toms in the New Millennium: Digital Dos and Don’ts, that she co-authored with Mark I. Unger (@miunger) and Kristal C. Thomson.

In perusing Peeping Toms in the New Millennium (while maintaining normal conversation) I not only found the answer to the question that I was looking for, but I also discovered that the article included a reference to one of my blog posts, 3 Key Takeaways About Texas’ Unauthorized Access Law, that discusses the case Miller v. Talley Dunn Gallery, LLC.

Given the tremendous respect that I have for Judge Emily Miskel and Mark Unger (I have not met Kristal but she is in good company!), I was both humbled and honored. So, now, here is my proper “THANK YOU!

Finally, if you’re like me (and Judge Miskel, and Mark, and presumably Kristal) and you geek out on this kind of stuff and want further reading, let me direct you to my original blog post that discusses the Texas Breach of Computer Security and Harmful Access by Computer Act laws, which are explained in more detail than you could ever ask for starting on page 25 of this guide: Federal Computer Fraud and Abuse Act and Texas Computer Crime Laws.

______________________

Shawn Tuma (@shawnetuma) is a business lawyer with an internationally recognized reputation in cybersecurity, computer fraud, and data privacy law. He is a Cybersecurity & Data Privacy Partner at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, around the world.

Insider Misuse of Computers: No Big Deal? It Can Be a Data Breach, Ask Boeing

Insider misuse triggers a breach just like outside hackers.

When a company’s information is compromised because of insider[1] misuse of computers or information, regardless of insider’s intentions, the result for the company and the data subjects of that information is often the same as if it were an attack by an outside adversary – it is a data breach.

Boeing’s insider-triggered data breach.

A Boeing employee emailed his spouse an internal company document containing personally identifiable information for about 36,000 co-workers to get help with formatting the document. His intentions were noble and innocent, he wanted to do a good job on the document and believed his spouse could help. The outcome was much different.

See: Guide to Responding to Data Breaches and Reporting Cybersecurity Incidents to Law Enforcement and Governmental Agencies

Because the sensitive data on its employees left Boeing’s “control” when it passed from an employee to a non-employee, it triggered a data breach. As a result, Boeing had to go through the breach notification process by notifying the 36,000 employees affected, providing them with two years of complimentary credit monitoring services, and notify the attorneys general of Washington, California, North Carolina, and Massachusetts. Read the full story here: Boeing discloses 36,000-employee data breach after email to spouse for help

Why was this a data breach?

In this analysis, you start with the data itself. Was the confidentiality, integrity, or availability of the data compromised? When a company collects, stores, or processes data, it is responsible for the safe keeping of that data, wherever it may be (yes, even if the company entrusts it to another for safekeeping, the company is still responsible). Generally speaking, when that company has employees, contractors, or other workers performing services on its behalf -– insiders — they are treated as being within the company’s control and legal protections of that data and their access to, possession, and use of that data is still within the legal fiction of being within company control. The confidentiality of that data is still intact as long as they are acting within the scope of their permissible role.

Insiders exceeding limitations of access and use of information may trigger breach.

When insiders exceed the boundaries that have been placed upon them by accessing, possessing, or using that data in a manner that is unauthorized by the company, it may result in a data breach, depending upon the particular facts of how it is used, the nature of the data, the type of industry, and any regulatory framework that may apply to that industry. For example, in the healthcare context the HIPAA Privacy Rule would almost certainly classify such a situation as an unlawful use or disclosure, triggering a data breach by the company.

Insiders keeping company information after termination of employment is almost certainly a breach.

When insiders take sensitive company data outside of the company, it will almost certainly trigger a data breach for the company. The most obvious example of this is an employee that retains company data after that employee is no longer employed by the company. Once the employment relationship terminates, the employee’s basic duties to the company also terminate and, unless there is some contractual extension of those duties, the employee possessing that information is no different than the spouse of the Boeing employee possessing the information – it is no longer within the legal fiction of “protections” of the company that maintain its confidentiality. In other words, its confidentiality has now been compromised.

Texas’ breach notification law is triggered by insider misuse.

In most cases, determining whether a breach has occurred will depend on the breach notification laws for the particular jurisdiction where the company does business and where the data subjects of that information reside.[2]

What is a breach of system security under Texas law?

The Texas breach notification law, Breach of Security of Computerized Data,[3] requires any company that conducts business in Texas and owns or licenses computerized data that includes sensitive personal information to disclose any breach of system security, after discovering or receiving notification of the breach, to any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

A “’breach of system security’ means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data.”[4]

Regarding insiders, the law specifically states that “[g]ood faith acquisition of sensitive personal information by an employee or agent of the person for the purposes of the person is not a breach of system security unless the person uses or discloses the sensitive personal information in an unauthorized manner.”[5] In other words, if an insider is authorized to access company SPI for a valid business purpose, and does so, but later uses or discloses that information in an unauthorized manner, it is a data breach under the Texas breach notification statute.

What is sensitive personal information under Texas law?

What is often referred to as personally identifiable information is defined by the Texas data breach notification law as “sensitive personal information” (SPI). The law has a fairly detailed definition of SPI that should be read carefully. A couple of general points will provide an overview of what is and is not protected:

  • Information that is lawfully made available to the public from a federal, state, or local governmental body is not considered sensitive personal information
  • Sensitive personal information does include “an individual’s first name or first initial and last name in combination with any one or more of the following items, if the name in the items are not encrypted:” Social Security number, driver’s license number or other government issued identification number, account or card numbers in combination with the required access or security codes
  • Also included is information that identifies an individual and is related to their health condition, provision of healthcare, or payment for healthcare

Does an employee’s unauthorized taking of company data to use for working for a competitor trigger a data breach under Texas law?

Consider a common scenario in the business world, with a few extra twists for emphasis:

  1. An employee who has had access to and worked with her employer’s customer database containing detailed information and SPI decides to leave the company.
  2. Because she has done most of the work in building up the customer database, she believes she is entitled to have a copy of it for herself so, before giving her notice or actually terminating her employment, she copies the customer database to her personal Dropbox account and saves it to a USB thumb drive.
  3. She then gives her notice, terminates her employment, and goes to work for a competitor.
  4. Once she starts work, she looks for the database but discovers that she lost the USB drive, which was unencrypted, so she downloads the customer database from her Dropbox folder, which also happens to be an openly “shared” folder, freely accessible by anyone on the Internet because she is an amateur photographer and it contains the images she uses to display her work on her blog.
  5. She then begins using her former employer’s customer database without telling her new employer but she does secretly upload the database to her new employer’s computer network.

Texas Broadens Unauthorized Access of Computer Law to Specifically Address Insider Misuse

3 Key Takeaways About Texas’ Unauthorized Access Law

What do you think, data breach or no data breach? In the hypothetical, at which step do you think there became a problem, if any? Please share your answer and reasoning in the comments – this one should be fun!

______________________

Shawn Tuma (@shawnetuma) is a business lawyer with an internationally recognized reputation in cybersecurity, computer fraud, and data privacy law. He is a Cybersecurity & Data Privacy Partner at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, around the world.

[1] The term “insiders” is often used to refer to “privileged users,” that is, users who have at least some rights, or privileges, to access and use the computers whereas the term “outsiders” refers to users who do not have any access rights, or privileges, to access the computers whatsoever. See Shawn E. Tuma, In Search of the Golden Mean: Examining the Impact of the President’s Proposed Changes to the CFAA on Combatting Insider Misuse, 18 SMU Sci. & Tech. L. Rev. 3, p.4 (2015).

[2] See Shawn E. Tuma, Guide to Responding to Data Breaches and Reporting Cybersecurity Incidents to Law Enforcement and Governmental Agencies, Cybersecurity Business Law (2016).

[3] Breach of Security of Computerized Data, Texas Bus. & Comm. Code § 521.053.

[4] Tex. Bus. & Com. Code Ann. § 521.053 (a) (West).

[5] Tex. Bus. & Com. Code Ann. § 521.053 (a) (West).

Is Key Claim Missing from Pastor’s Lawsuit Over Wife’s Nude Pics Emailed to Swinger Site?

Should a claim for [YOU GUESS] have been included in this lawsuit? See my thoughts below and share your thoughts.

The Allegations Behind the Lawsuit

A legal team led by Gloria Allred made news by suing Toyota (and others) on behalf of a Frisco, Texas pastor and his wife, Tim  and Claire Gautreaux, alleging that a Toyota salesman emailed nude pictures of Claire to a swingers’ website from Tim’s phone while in his possession to confirm a preapproval offer that was on an app. Continue reading “Is Key Claim Missing from Pastor’s Lawsuit Over Wife’s Nude Pics Emailed to Swinger Site?”

3 Important Points on Computer Use Policies

IMPORTANT POINT #1: YOUR BUSINESS MUST HAVE A COMPUTER USE POLICY IN PLACE

Computer Use Policies (or Acceptable Use Policies, as they are often referred to) are must haves for today’s businesses. Such policies are a foundational component in how a business creates a culture of security with its workforce by establishing expectations on what are and are not permissible ways to use and safeguard the businesses’ digital assets, as well as third parties’ information that it may be holding. Continue reading “3 Important Points on Computer Use Policies”

3 Key Takeaways About Texas’ Unauthorized Access Law

The Dallas Court of Appeals recently decided a civil case involving claims under Texas’ unauthorized access of computer law that provides some helpful guidance for this relatively new law that has very little case law construing it. The 3 takeaways that follow are the key legal principles that apply to this law as set forth in the case Miller v. Talley Dunn Gallery, LLC, 2016 WL 836775 (Tex. App.–Dallas, Mar. 3, 2016). Continue reading “3 Key Takeaways About Texas’ Unauthorized Access Law”

Texas Broadens Unauthorized Access of Computer Law to Specifically Address Insider Misuse

Not that it was really needed, but Texas just amended its unauthorized access of computers law to specifically address misuse by insiders. I have always read the prior version (one of the broadest) as already prohibiting misuse by insiders. But, that is ok. As someone who regularly explains how these laws work to judges and juries, I can tell you, it never hurts to have something that seems clear be made even more explicit. Belts and suspenders can be a good thing in court and on September 1, 2015, both were cinched up a little more.

3 Key Takeaways About Texas’ Unauthorized Access Law  Continue reading “Texas Broadens Unauthorized Access of Computer Law to Specifically Address Insider Misuse”

Texas’ Amended Data Breach Notification Law

Texas amended its existing data breach notification law which became effective on September 1, 2012. The relevant section of the law is titled “Notification Required Following Breach of Security of Computerized Data” and is found at Section 521.053 of the Texas Business and Commerce Code. The main body of the law provides as follows:

(b)  A person who conducts business in this state and owns or licenses computerized data that includes sensitive personal information shall disclose any breach of system security, after discovering or receiving notification of the breach, to any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person.  The disclosure shall be made as quickly as possible, except as provided by Subsection (d) or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

What is a “breach of system security”?

The law defines “breach of system security” as the “unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data.”

What is “sensitive personal information”?

The law has a fairly detailed definition of “sensitive personal information” that should be read carefully. A couple of general points will provide an overview of what is and is not protected:

  • Information that is lawfully made available to the public from a federal, state, or local governmental body is not considered sensitive personal information
  • Sensitive personal information does include “an individual’s first name or first initial and last name in combination with any one or more of the following items, if the name in the items are not encrypted:” Social Security number, driver’s license number or other government issued identification number, account or card numbers in combination with the required access or security codes
  • Also included is information that at that identifies an individual and is related to their health condition, provision of healthcare, or payment for healthcare

Who does the law apply to?

The law applies to any person (which includes entities) who conducts business in Texas and owns or licenses computerized data that includes sensitive personal information.

Who must be notified?

The law requires notification to “any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person.” This is an incredibly broad class of individuals that is certainly not limited to only Texas citizens and, quite possibly, is not even limited to citizens of the United States.

When must the notification be given?

The notification must be given as quickly as possible after it has been determined that an individual’s sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person. However, the notification may be delayed as necessary to determine the scope of the breach and restore the reasonable integrity of the data system or at the request of law enforcement to avoid compromising an investigation.

What is the penalty for failure notify?

Section 521.151 of the law provides for a penalty for failing to comply with this notification requirement is a civil penalty of up to $100.00 per individual per day for the delayed time but is not to exceed $250,000 for a single breach.

______________________

Shawn Tuma (@shawnetuma) is a business lawyer with an internationally recognized reputation in cybersecurity, computer fraud, and data privacy law. He is a Cybersecurity & Data Privacy Partner at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, around the world.