Computer screens against skyscraper backdrop

Should Bar Associations Vet Technology Service Providers for Attorneys?

[Originally published in GPSOLO, Vol. 36, No. 6, November/December 2019, by the American Bar Association. Reproduced with permission. All rights reserved.]

Image Credit: Gerd Altmann from Pixabay1

Bar associations across the country have similar goals: advance the rule of law, serve the legal profession, and promote equal access to justice. Technology can easily support these goals. From online research and billing software, to virtual receptionist and SEO services, technology vendors improve the efficiency and accessibility of attorneys. It is no wonder then that bar associations around the country are promoting technology solutions for their members.

Despite the obvious benefits, bar associations need to be diligent about vetting technology vendors. By promoting one technology provider over another, bar associations could run afoul of advertising laws, tax requirements, and software agreements. In addition, bar associations and their members need to pay close attention to technology vendors’ cybersecurity safeguards to protect client confidences.

This article will briefly address each of these issues in turn and provide a non-exhaustive checklist of considerations before choosing a legal technology provider.

Bar Associations as Influencers

When we think of product endorsements today, we think of social media influencers, bloggers, and vloggers—not bar associations. Yet, bar associations wield incredible influence over the purchasing decisions of their members. Given this influence, bar associations should stay mindful of laws addressing unfair and deceptive advertising, such as Section 5 of the Federal Trade Commission Act (FTC Act), state false advertising laws, and state unfair trade practices acts (little FTC acts).

Continue Reading Should Bar Associations Vet Technology Service Providers for Attorneys?
Lock on a computer screen held to edges by chains

What Is Happening in Children’s Online Privacy?

Children’s online privacy has always been an important topic, but a number of recent developments around the world have many businesses taking it more seriously. In September, Google agreed to pay a record $170 million fine to the U.S. Federal Trade Commission for violating the Children’s Online Privacy Protection Act (COPPA) by illegally collecting personal information from children without parental consent and using it to profit through targeted ads. A few weeks later, China’s own version of COPPA called the “Measures on Online Protection of Children’s Personal Data,” came into force, providing further clarity on protecting children’s personal data online under China’s Cyber Security Law. On October 7, the FTC hosted a public workshop to explore whether to update COPPA, which is over 20 years old and in need of a refresh due to the emergence of new technologies. (Just think of all those smart devices, social media platforms and educational apps and technologies that were not around in 1998). Finally, the California Attorney General recently released proposed regulations to the California Consumer Protection Act, which goes into effect in January 2020, that would require a business that knowingly collects the personal information of children under the age of 13 to establish, document and comply with a reasonable method for determining that the person affirmatively authorizing the sale of the personal information about the child is the parent or guardian of that child.

Many children start using the Internet at an early age, raising privacy issues distinct from those for adults. First, children may not understand what data is being collected about them and how it is used. Second, children can easily fall victim to criminal behavior online by providing seemingly innocuous information to web users who can appropriate such information for malicious purposes. Third, children cannot give the same meaningful consent to data collection and use activities as an adult. 

In the U.S., Congress passed COPPA in 1998 to protect children’s use of the Internet—particularly websites and services targeted toward children. COPPA requires website operators to provide clear and conspicuous notice of the data collection methods employed by the website, including functioning hyperlinks to the website privacy policy on every web page where personal information is collected. It also requires affirmative consent by parents prior to collection of personal information for children under the age of 13. Recognizing that teenagers between the ages of 13 and 18 are not protected under COPPA, many individual states have made efforts to address privacy issues for this age group.

Recognizing the need to update COPPA to keep up with the times, the FTC considered the following topics at the October workshop, among others:

  • How the development of new technologies, the evolving nature of privacy harms, and changes in the way parents and children use websites and online services, affect children’s privacy today;
  • Whether COPPA should permit general audience platforms to rebut the presumption that all users of child-directed content are children, and if so, under what circumstances;
  • Whether COPPA should be amended to better address websites and online services that do not include traditionally child-oriented activities, but that have large numbers of child users.

It remains unclear how these issues and others will be resolved. Eager to tap into the new revenue streams that children represent, many tech companies will try to carve out exceptions to COPPA—openly or not. On the other side, child advocates and politicians such as Senator Edward Markey, one of the original authors of COPPA, are pushing back and even trying to tighten restrictions related to children’s online privacy. 

Sometimes the issues are not so black and white. For instance, many well-intentioned companies—tech and otherwise—that have no interest in marketing to children might still be unable to verify the age of users that visit their websites, resulting in inadvertent marketing to minors. Even those that attempt to verify the age of users may face challenges, given the thousands of websites dedicated to helping users bypass age gates and parental controls. Finally, some age verification techniques may run counter to data minimization and privacy concerns – e.g. the collection of credit card data to verify age, when it is not necessary for the provision of the service. Regardless of what happens with COPPA at the FTC and with new privacy laws that are springing up across the world, companies will need to be extra-cautious about how they approach children’s online privacy—continually reviewing their practices and policies to ensure that they are not running afoul of the multitude of laws and regulations out there. Those that do not run the risk of becoming subject to both regulatory and legal action.

Image of gears directing arrows to shield.

The 2019 Capital One Breach Compared to the 2017 Equifax Breach: Evolving and Improving Attitudes toward Data Security, Breach Detection, and Breach Notification

Image Credit: Khanittha Yajampa via Dreamstime.com

On September 7, 2017, Equifax announced that it had suffered a data breach that exposed the personal data of nearly 147 million people. Two years following the Equifax breach, Capital One also suffered a data breach nearly as massive in scope, affecting approximately 100 million users in the United States and 6 million users in Canada.

A casual observer might think that the two breaches are similar. After all, they both affected a large financial institution and encompassed over a million financial records. The similarities end there, however. Capital One implemented security measures to protect its customer data and engaged in a speedy response to an insider threat. Equifax failed to implement even basic data protection measures and was laggardly in reporting the inevitable breach.

Only time will tell what the full repercussions will be of these two breaches. But based on the facts in front of us, Capital One’s quick response to this breach will ultimately protect more customers in the long run. Comparing the circumstances surrounding the two breaches show a positive trend toward companies taking their customers’ data more seriously and mindfulness of ever-increasing consumer vigilance about their own data.

The Timeline of Each Breach – Head in the Sand v. Speedy Responder

In the case of Equifax, the company detected a breach on July 29, 2017, but failed to notify the public until September—40 days later.

To make matters worse, the breach was not detected until several months after the actual breach, even though the security vulnerability was reportedly known to Equifax. Months prior to the actual breach, a security researcher attempted to inform Equifax about the researcher’s inadvertent and unauthorized access to millions of Equifax customers’ sensitive personal data records. This included social security numbers and birthdates. Although it would have taken a matter of hours or minutes to deploy a fix, Equifax never addressed the reported vulnerability until after the breach had occurred.

In comparison, the Capital One breach occurred when former Amazon Web Services (AWS) employee Paige Thompson stole customer data and posted it to her GitHub, a repository for software development coding and programs. 

On July 17, 2019, a security researcher alerted Capital One to this potential breach, by emailing Capital One through an address exclusively reserved for “ethical” hacker disclosures. Based off the information in this email (i.e., Thompson’s GitHub account), Capital One launched an internal investigation of the breach. That led to detection of the breach on July 19. On July 29, 2019, Capital One announced to the public the details of its investigation.

All told, only 10 days passed from the moment of detection to notification of the public in the Capital One breach. Capital One’s quick response may have been influenced by public resentment of how long it took for Equifax to notify its customers of a breach—long enough for senior executives to collectively sell millions of dollars’ worth of stocks within days of detecting the breach in 2017.

Recently, the FTC announced a settlement with Equifax for at least $575 million for damages relating to its data breach in 2017. While a substantial amount to be sure, many have also criticized perceived inaction by both legislators and the Consumer Financial Protection Bureau (CFPB) in response to the Equifax breach. There is substantial public opinion that Equifax got off easy with an FTC settlement that essentially equates to a “cost of doing business.” 

Better Security Control—Protecting What’s In Your Wallet

Following the announcement of Equifax’s data breach, Equifax was lambasted in media reports for its egregious security practices, in particular, its storage of administrative credentials and passwords in unencrypted plain text files. By using plain text instead of encryption, Equifax exposed its sensitive data to hackers without protection. 

In contrast, Capital One encrypted all customer data as standard practice. Due to the circumstances of the breach, Thompson was also able to decrypt the data. However, Capital One also noted in its press release that it tokenizes select fields that are particularly sensitive, including Social Security numbers and account numbers. Tokenization provides an additional layer of protection by replacing the sensitive field with a unique “token” or “cryptographically generated” placeholder. The original sensitive information is stored in a different location and remains protected. Capital One’s practice of tokenization likely protected over 99% of its held Social Security numbers and bank account numbers. Capital One’s adoption of stronger security measures, beyond basic encryption, shows its awareness of and protection against increasingly sophisticated hacks.

While breach incidents are unfortunately becoming more common, Capital One’s response to its recent breach shows that incident response plans are becoming more robust. Corporate attitudes are trending toward privacy and security teams being an integral part of an organization, as well as investments in technical and operational security controls having great value.

Breaches in the Future?

Looking forward, we can all use the Equifax and Capital One breaches to inform us with respect to all businesses’ privacy and security obligations. As just a few high-level takeaways:

  1. Properly encrypt all personal data held on customers and employees, based on the data’s level of sensitivity.
  2. Assess whether your current privacy and information security team needs additional support and/or training to handle your organization’s size and sensitivity of data.
  3. Implement proper security controls, including access permissions and physical facility controls.
  4. Don’t forget that “insider threats” caused by employee and ex-employee handling of data is just as problematic as outside hacks.
  5. Promptly investigate “ethical hacker” or security researcher notifications about your company’s security.
  6. Have an incident-response plan in place to guide decision-making following a detected breach.

Above all, be prepared! Organizations of all sizes now handle massive amounts of data collected both on physical servers and on cloud databases. It is critical that they understand not just the current minimum data protection obligations imposed upon them, but also learn from past security incidents and realize that the bar for compliance is continually in motion with every breach.

Federal Trade Commission logo

The FTC Ramps Up Privacy Enforcement

Following increased congressional scrutiny over its data privacy enforcement practices in 2018, the FTC has ramped up its enforcement actions in recent months, giving some real bite to current federal privacy laws:

  • On February 27, 2019 the FTC filed a complaint against the operators of lip-syncing app Musical.ly—now known as TikTok – for failing to seek parental consent before collecting the personal information of users under the age of 13. In response to the FTC’s complaint, TikTok agreed to pay a $5.7 million settlement to the agency, marking the largest-ever COPPA fine in US history.
  • Throughout March, the FTC obtained settlements against 4 separate robocall operations: NetDotSolutions, Higher Goals Marketing, Veterans of America, and Pointbreak Media. These cases charged these separate entities for violations of the FTC Act (unfair and deceptive trade practices) and the agency’s Telemarketing Sales Rule (TSR) – including its Do Not Call (DNC) provisions.
  • On March 26, 2019 the FTC announced a broad inquiry into the data collection practices of broadband companies under Section (b) of the FTC Act. The agency issued orders to AT&T Inc., AT&T Mobility LLC, Comcast Cable Communications doing business as Xfinity, Google Fiber Inc., T-Mobile US Inc., Verizon Communications Inc., and Cellco Partnership doing business as Verizon Wireless, seeking information about the collection, retention, and sharing of personal information. The FTC investigation highlights recent consumer concerns about data privacy and tracking by ISPs, following high-level acquisitions of content providers like AOL, Yahoo, and DirectTV. We are watching closely, as this may be the start of one of the first joint privacy-antitrust enforcement actions by the FTC.

These enforcement actions highlight the FTC’s role as the de facto data protection authority for the United States. Yet, the FTC’s mandate extends far beyond data privacy, and includes regulatory authority over false advertising claims, anticompetitive behavior, and merger review. While Congress continues to debate the passage of a federal bipartisan privacy bill, it behooves them to keep in mind the current staff and funding limitations of the FTC in any proposed drafts.