The Texas Bar Journal’s year-end update on Cybersecurity & Data Privacy law was once again provided by Shawn Tuma and addressed the following issues:
- Lawyers’ Cybersecurity and Data Breach Obligations that are required under Texas law and the ABA’s Ethics Opinion 483 titled Lawyers’ Obligations After
an Electronic Data Breach or Cyberattack
- Whether an IT service provider’s locking a customer out of its computer violates the Texas “hacking” law
- Whether a woman viewing pictures on her boyfriend’s iPhone violates the Texas “hacking” law
In my newsfeed are articles in prominent publications discussing the problems with the federal Computer Fraud and Abuse Act from very different perspectives.
In the “the CFAA is dangerous for security researchers” corner we have White Hat Hackers and the Internet of Bodies, in Law360, discussing how precarious the CFAA (and presumably, the state hacking laws such as Texas’ Breach of Computer Security / Harmful Access by Computer laws) and Digital Millenium Copyright Act can be for security researchers.
In the “the CFAA prevents companies from defending themselves” corner we have New Bill Would Allow Hacking Victims to ‘Hack Back’, in The Hill, discussing The Active Cyber Defense Certainty Act (ACDC). ACDC (what a great acronym!) would allow companies more latitude in defending themselves against those intruding into their networks by permitting them to use techniques described as “active defense,” under certain conditions, though not permitting companies to counterattack.
Now, instead of thinking about these two measures in isolation, think of them together. What if we were to get both of them passed into law? What if we got one or the other?
This reminds me of a piece I wrote about the CFAA and the broader national policy discussion a few years ago, Hunter Moore or Aaron Swartz: Do we hate the CFAA? Do we love the CFAA? Do we even have a clue? In that piece I stated,
The CFAA has become a national lightening rod with many loving it, many hating it, and far too many loving it and hating it at the same time, without even realizing it. Before we go any further, however, consider this quote:
The CFAA was tailor-made to punish precisely the kind of behavior that [guess who?] is charged with: breaking into other people’s accounts and disseminating their … information.
Quick! Who is that referring to? Hunter Moore? Edward Snowden? Aaron Swartz? Sandra Teague?
I used this overly simplified example to try and make a point that, philosophically, we as a nation need to stop looking at each of these cases and laws in isolation and need to look at the bigger picture of how it all fits together. Picking and choosing based upon our own personal likes and dislikes due to the emotional tug of the facts is no way to develop, maintain, and mature a body of law on any subject matter — much less one as complicated as cyber.
Take this discussion and add into the mix new security-based laws such as NYDFS and then mix in the 48 states + HIPAA, GLBA, etc. breach notification laws, the conundrum of cybersecurity law schizophrenia, and then see what we have to work with. Does it all make sense?
What do you think? Where do we begin? Who needs to be involved in working this out? What are the first questions we need to ask?
Before leaving his employment at Merritt Hawkins & Associates (MHA), Larry Gresham allegedly accessed MHA’s computer network and copied 400 of MHA’s proprietary files and then deleted hundreds of files in an attempt to hide his activities. A jury found Gresham’s actions violated the Harmful Access by Computer Act (HACA), Texas unauthorized access law (i.e., “hacking law”). The Fifth Circuit affirmed the jury’s verdict. Merritt Hawkins & Associates, L.L.C. v. Gresham, 2017 WL 2662840 (5th Cir. June 21, 2017).
Here are three key points from this case about the Texas Harmful Access by Computer Act (civil) or Breach of Computer Security (criminal) laws:
- An employee may violate HACA / BCS by accessing his employer’s computer system without its “effective consent” (i.e., (a) by using it for a purpose other than that for which consent was given, (b) in violation of a clear and conspicuous prohibition, or (c) in violation of an express agreement) and taking data to use for non-company business related purposes.
- An award of $50,000 in damages for the missing and stolen computer files was supported by sufficient evidence, in the following form:
- the owner of the company’s testimony that he would have to pay an employee at least $100 an hour to recreate every file that was deleted and that it would be more expensive to search the company’s database to see if any files remained, even though he admitted that it was difficult to calculate the damages, especially for those that were taken but not deleted;
- a computer forensics expert testified that he billed the company over $60,000 for his work assessing the damage to its computer system, excluding litigation costs; and
- the company’s IT employee testified about the expenses he incurred and the hours he worked trying to restore the computer files.
- “A prevailing party on a Harmful Access by Computer claim ‘is entitled’ to attorneys’ fees.” Tex. Civ. Prac. & Rem. Code § 143.002.
See these resources for more information about the Texas Harmful Access by Computer Act and Breach of Computer Security laws:
- Peeping Toms in the New Millennium: Digital Dos and Don’ts, Honorable Emily Miskel, Mark I. Unger, Kristal C. Thomson
- Guide to Using Computer Hacking Laws in Texas: Federal Computer Fraud and Abuse Act and Texas Computer Crimes Laws, Shawn Tuma
- Texas Broadens Unauthorized Access of Computer Law to Specifically Address Insider Misuse
- 3 Key Takeaways About Texas’ Unauthorized Access Law
Shawn Tuma (@shawnetuma) is an attorney with an internationally recognized reputation in cybersecurity, computer fraud, and data privacy law. He is a Cybersecurity & Data Privacy Attorney at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, around the world.
There are many ways to honor someone. For me, one of the greatest privileges is knowing that others have found some value or usefulness in my work, especially by referencing it to others. What is unfortunate, however, is when you did not learn about it for quite some time and realize you never properly thanked them!
So . . . here I am in a meeting with an attorney and her clients to discuss my consulting with them (behind the scenes) to help the attorney with various cyber issues that are involved in the case. Now you already know that I consider myself to be fairly knowledgeable in the area of cyber law but even in this area, there is still a lot out there I do not know. An issue about the Wiretap Act comes up — specifically, the Texas version of the Wiretap Act — and I do not have a good answer for the question.
So . . . I change the subject momentarily while I do what any reasonable Texas attorney should do; I use my iPad to discretely pull up Judge Emily Miskel’s (@emilymiskel) very well-respected article that discusses this issue, Peeping Toms in the New Millennium: Digital Dos and Don’ts, that she co-authored with Mark I. Unger (@miunger) and Kristal C. Thomson.
In perusing Peeping Toms in the New Millennium (while maintaining normal conversation) I not only found the answer to the question that I was looking for, but I also discovered that the article included a reference to one of my blog posts, 3 Key Takeaways About Texas’ Unauthorized Access Law, that discusses the case Miller v. Talley Dunn Gallery, LLC.
Given the tremendous respect that I have for Judge Emily Miskel and Mark Unger (I have not met Kristal but she is in good company!), I was both humbled and honored. So, now, here is my proper “THANK YOU!”
Finally, if you’re like me (and Judge Miskel, and Mark, and presumably Kristal) and you geek out on this kind of stuff and want further reading, let me direct you to my original blog post that discusses the Texas Breach of Computer Security and Harmful Access by Computer Act laws, which are explained in more detail than you could ever ask for starting on page 25 of this guide: Federal Computer Fraud and Abuse Act and Texas Computer Crime Laws.
Shawn Tuma (@shawnetuma) is a business lawyer with an internationally recognized reputation in cybersecurity, computer fraud, and data privacy law. He is a Cybersecurity & Data Privacy Partner at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, around the world.