Last evening I had the pleasure of talking cybersecurity law with a group of CIOs from some pretty sophisticated companies. It was a great discussion and I learned as much as I shared — just the way I like it. During our discussion, the subject of Incident Response Plans came up and I explained why these are now a must-have. Continue reading Cybersecurity: How Long Should An Incident Response Plan Be?
Many thanks to attorney and legal scholar extraordinaire John G. Browning (@) for quoting Shawn Tuma in his article in this month’s D CEO magazine: Why Cybercriminals Are Targeting Law Firms. Continue reading D CEO Magazine: Why Cybercriminals Are Targeting Law Firms
The National Labor Relations Board (NLRB) has continued its assault on businesses and their ability to legitimately protect their computer systems and information against unauthorized non-business use by employees.
A few weeks ago, I wrote 3 Important Points on Computer Policies in which I stressed (1) why your company must have them but (2) that such policy must comply with the NLRB’s Purple Communications case. The NLRB has struck again.
On May 3, 2016, an NLRB Administrative Law Judge struck down as overbroad a Computer Use Policy in Ceasars Entertainment Corporation d/b/a Rio All-Suites Hotel and Casino (NLRB Docket Sheet). The policy, titled Use of Company Systems, Equipment, and Resources, was part of the company handbook and stated that computer resources may not be used to do several things that were listed out and is standard in many similar policies. The NLRB decision (Decision) found that prohibitions against the following was illegal:
- Share confidential information with the general public, including discussing the company, its financial results or prospects, or the performance or value of company stock by using an internet message board to post any message, in whole or in part, or by engaging in an internet or online chatroom
- Convey or display anything fraudulent, pornographic, abusive, profane, offensive, libelous or slanderous
- Send chain letters or other forms of non-business information
- Solicit for personal gain or advancement of personal views
- Violate rules or policies of the Company
The NLRB found that prohibiting the conduct mentioned above made the policy overbroad and could effectively limit employees’ use of their employer’s email system to engage in Section 7 communications during nonworking time. Because of that, it found the employer has engaged in an unfair labor practice prohibited by the National Labor Relations Act.
Welcome to Wonderland.
Shawn Tuma (@shawnetuma) is a business lawyer with an internationally recognized reputation in cybersecurity, computer fraud and data privacy law. He is a Cybersecurity & Data Protection Partner at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, around the world.
Shawn Tuma was a guest the Down the Security Rabbithole podcast where he and hosts Rafal Los (@Wh1t3Rabbit) and Michael Santarcangelo (@Catalyst) discussed recent events in the world of cyber law. Continue reading Cyber Law Update on #DtSR Podcast with Los, Santarcangelo and Tuma
Note: this article was previously posted on Norse’s DarkMatters.
A recent lawsuit provides a nice case study for how businesses’ contracts can play a critical role in their cybersecurity strategy. Before the court is this question: Who was responsible for maintaining cybersecurity safeguards for a bank’s website, the bank or the company that designed and hosted the website? Continue reading Four Security Issues All Business Contracts Should Address