I.                    Introduction

The Internet facilitates the widespread and instantaneous flow of information across international borders.  While the advent of this method of transnational communication has truly created a “global economy,” at the same time, it has engendered problems for companies and their insurers which seek to assess risk and implement information safeguards, particularly in the face of divergent data privacy laws which vary from region to region or may not even exist in certain jurisdictions.  The Asia-Pacific region typifies such a lack of uniformity.  At the same time, the emerging economies in this rapidly growing part of the world have generated promising targets for computer hackers. 

75% of Asia-Pacific enterprises have experienced cyber attacks in the past 12 months.  Perhaps not surprisingly, a 2010 study by Symantec reported that almost half of all Asia-Pacific-based businesses (and 67% in Singapore) ranked cyber risk and information security as their top concern—more so than natural disasters, terrorism, and traditional crime combined.  Cyber attacks and data breaches are on the radar of CEOs and risk managers for good reason: the average cost for a large company to remediate a data breach in Australia increased to nearly $2 million in 2010, which is slightly up from 2009.  See Ponemon Institute/Symantec 2010 Annual Study: Australian Cost of a Data Breach (May 2011).  Notwithstanding the prevalence of such attacks, it is far more likely that a cyber security program is managed as a part of a company’s traditional business risks, with traditional coverages being contorted to cover various components of cyber risk (i.e. property loss, liability to third-parties, business interruption, etc.), rather than by way of a dedicated cyber-specific insurance program.  Still, in light of recent developments, it is virtually certain that companies soon will begin looking to transfer such risk via more efficient and targeted technology insurance forms and policies.   

Read the rest of this entry »

Doug Pollack of IDExperts recently published a blog post on cyber insurance that caught my eye. Insofar as IDExperts is a respected provider of cyber breach response services, I assumed the article would address technical issues. Upon reading the piece, however, I was disappointed to find that the article addressed insurance-related matters, including criteria for the selection of insurance products and programs, a topic typically the province of risk managers, brokers, underwriters and lawyers. Hmmm…

At the outset, the article addresses technical issues, as the author correctly suggests that “privacy, compliance and legal officers should work closely with their risk manager to ensure that the organization is getting a policy that meets its needs.” Having hooked me with that truism, I was looking forward to reading on. But that is where the technical commentary (and our common perspective) ends. From there, the author moves on to express his views (and, in my counter-view, misconceptions) on cyber insurance products and how they should operate.

Read the rest of this entry »

First published on September 22, 2011 at e-Discovery Law Review
Monetary sanctions, attorneys fees, and adverse inference jury instructions are the more common type of sanctions imposed on litigants for the spoliation of evidence, or not producing relevant documents. Recently, however, a court has increased the severity and impact of sanctions by applying them not only to current litigation, but also to a party’s future litigation, with the effects lingering for years to come.

The Underlying Suit

“Any competent electronic discovery effort would have located this email.” These words were written in an opinion by a United States District Judge in the Eastern District of Texas in Green v. Blitz U.S.A., Inc., No. 2:07-CV-372 (E.D. Tex., Mar. 1, 2011) Green involved a product liability suit in which the requirement of a flame arrester was in dispute. The jury returned a defense verdict, and the plaintiff collected a low settlement amount as part of a high-low settlement agreement. During discovery in a subsequent case with the same defendant and plaintiff’s counsel, counsel learned of documents that were not produced in Green. The plaintiff then filed a motion for sanctions against the defendant in Green and a motion to re-open the Green case. While the court denied the motion to re-open because the statute of limitations had expired, the court did impose sanctions for the discovery abuse.

Read the rest of this entry »

We are pleased to announce that Cyberinquirer is among the group of initial nominees for the Top Insurance Law Blogs of 2011!

Each year, LexisNexis honors a select group of blogs that set the online standard for a given industry.  And, as we write this, LexisNexis is in the process of selecting the Top 50 Blogs for the LexisNexis Insurance Law Community.   The selection will be based on LexisNexis’s review of various insurance law-related sites as well as comments from its members. And here’s where the shameless plug for Cyberinquirer come in…

In order to vote forCyberinquirer (and for those of you who will, thanks in advance for doing so!), you will need to be a registered LexisNexis Community member and be logged in. If you have not registered previously, follow this link to create a new registration or use the sign-in credentials from your favorite social media site. Registration is free. Once you have logged in, scroll to the very bottom of the page. Then add a comment in the box to vote for Cyberinquirer. That’s all there is to it! Please note that voting ends on October 7, 2011.

And, thanks again for supporting us and our geeky hobby.

   Send article as PDF   

The protracted copyright infringement class action by freelance writers seeking compensation for pieces published without authorization in various online databases has hit another roadblock.

In re Literary Works in Electronic Databases Copyright Litigation involves claims for infringement of works as to some of which the copyrights are registered and the vast majority are unregistered. This detail – the registered/non-registered distinction – keeps stymieing resolution of the case. In 2007, after the parties had spent years negotiating a settlement and gaining district court approval, the Second Circuit threw out the settlement, holding that the district court lacked subject matter jurisdiction to approve the settlement because many of the claims to be resolved were based on unregistered works, and registration is a jurisdictional predicate to a copyright infringement suit. The Supreme Court finally reversed in 2010, and the parties went back to the district court and again gained approval of the settlement.

Read the rest of this entry »

The ABA has issued a formal ethics opinion that provides guidance to lawyers whose clients use an employer’s email account to send or receive email from counsel.  In Formal Opinion 11-459, the Standing Committee on Ethics and Professional Responsibility urges lawyers to warn their clients that the confidentiality of electronic communications may be jeopardized if the employer or other third party, such as a hotel or library, has the potential to access email or other correspondence hosted on the third party’s computer system.

When clients use an employer’s computer, smartphone or other telecommunications device, or an employer’s email account, the employer may be able to obtain access to the communications and take advantage of that opportunity in various contexts, such as when the client is engaged in an employment dispute or when the employer is responding to a subpoena or document discovery in litigation.

Read the rest of this entry »

A recent Ninth Circuit opinion on class certification demonstrates both the potentially fact-intensive nature of class action “typicality” issues and the importance of substantive law in determining whether common issues predominate over individual issues.

In Stearns v. Ticketmaster Corp., the Ninth Circuit Court of Appeals reviewed several decisions denying class certification to various plaintiffs challenging an allegedly deceptive internet scheme involving Ticketmaster and its one-time affiliate, Entertainment Publications, Inc. (“EPI”). At issue is a link on Ticketmaster’s website to EPI’s Entertainment Rewards program, which allows members paying a monthly fee to download printable coupons.

Read the rest of this entry »

We at Cyberinquirer will be taking a break this weekend. I am heading to NYC for a memorial in honor of our dear friend John Keohane, who perished that awful day at the age of 41. Many of you may have known John from his days with CIGNA, ACE and Zurich. He is still missed by his colleagues, friends and family and always will be. What a tragedy.

   Send article as PDF   

The Clerk for the U.S. District Court for the Eastern District of Pennsylvania recently ruled that there is a heavy presumption that prevailing parties may recover certain e-discovery costs under 28 U.S.C. § 1920. Federal Rule of Civil Procedure 54(d)(1) allows prevailing parties to submit bills of costs for certain expenses, enumerated in 28 U.S.C. § 1920, for taxation by the Clerk against the non-prevailing parties. For example, that statute provides for the taxation of costs related to obtaining copies of transcripts and printing. More significantly, the statute provides for the taxation of “[f]ees for exemplification and the cost of making copies of any materials where the copies are necessarily obtained for use in the case.” 28 U.S.C. § 1920(4). While the term “exemplification” is undefined, federal district clerks have traditionally awarded, as exemplification and copying costs, those costs related to the production of paper documents, photographs, models, maps, blow-ups, charts, and diagrams.

Read the rest of this entry »

In a recent decision, a Pennsylvania trial court concluded that no privilege exists to prevent access to non-public social website information of personal injury claimants. Rather, the “paramount ideal” of pursuing truth favors liberal discovery of relevant information on social media sites.

In Zimmerman v. Weis Markets, No. CV-09-1535 (C.P. Northumberland Cty., May 19, 2011), the court rejected a personal injury plaintiff’s objections to providing non-public portions of plaintiff’s Facebook and MySpace pages, after the defendant demonstrated that the public portions of those pages included recent photographs and comments that appeared to contradict the plaintiff’s claims of physical and emotional distress. The court agreed with the rationale stated in other recent cases holding that an individual who voluntarily posts photos and information on social networking sites does so with the intention of sharing, and thus cannot later claim any expectation of privacy. The court noted that the privacy policies of Facebook and MySpace disclose that any information posted may become publicly available at the user’s own risk.

Read the rest of this entry »

Just as lawyers now routinely conduct due diligence on opposing parties’ social media pages. some lawyers also are monitoring postings by jurors on social media sites.

In a recent ethics opinion issued by the New York County Lawyers’ Association Committee on Professional Ethics (No. 743, 5/18/11), the committee concluded that an attorney may review jurors’ postings on publicly available social networking sites during trial. But they must not “friend” or “tweet” jurors, subscribe to their Twitter accounts, or otherwise contact them, either directly or through others.

Read the rest of this entry »

Well, this result seemed almost inevitable.  After all, who gets away with misleading a court?  Right?  But is the amount of the sanction sufficient?  Righthaven was ordered to pay a measly $5,000.  Is that amount really going to punish Righthaven in any significant way?

Righthaven LLC is a copyright holding company, founded in March 2010, which acquires the rights to newspaper content from its partner newspapers (most notably, Stephens Media, which owns the Las Vegas Review Journal). Upon finding that content has been copied to online sites without permission, Righthaven initiates litigation against the site owners, alleging copyright infringement.
Read the rest of this entry »

In addition to being a trademark geek, I could be accurately accused of also being a tech geek. A “geek” is someone who loves using, and helping other people use, technology to help simplify his or her life. Best Buy, capitalizing on this endearing term for electronic lovers, created the Geek Squad, a tech support service. Their distinctive orange and black cars marked with their trademarked logo can be called out to provide in-home support or they are just a phone call away to help you with your technological needs.

There’s not too many other words other than geek that convey the nerdy type of people who love technology, but Best Buy is taking action against others who use “geek” for this purpose in their slogans.  In a recent lawsuit against Newegg.com, Best Buy claimed trademark infringement over Newegg’s slogan “Geek On,” saying that the similarity between the motto, in addition to using orange and black in their logo, breaches their rights.  And this is neither the first, nor the last, time that Best Buy will sue companies over this issue.

Read the rest of this entry »

The yellow fever outbreak of summer 1798 was the worst in Philadelphia’s history. Over 5,000 residents were infected, and nearly 1,300 died, causing even President Washington to flee. On the night of September 1st, 1798, the vault at Carpenter Hall was breached and the then-massive amount of $162,821 went missing. This first bank robbery in the United States, attributed as an “inside job”, ushered in an era of robberies that turned criminals into celebrities. Jesse James, Bonnie and Clyde, and John Dillinger have become legends. At present, the risk of yellow fever has been mitigated due to vaccines. The risk of bank vaults being physically robbed similarly has been reduced.

Read the rest of this entry »

It has become common practice for lawyers to mine social media pages of parties and witnesses for discovery purposes. The posts and photos may show a party to be lying about the extent of his or her claimed injury or disability, or they could undermine or support other claims. Facebook and other social media sites also have become fertile ground for cutting edge ethical questions posed to state Bar ethics committees.

In a recent ethics opinion issued by the San Diego County Bar Association, a lawyer asked if it was proper to “friend” request high-ranking employees of a company the lawyer was suing on behalf of a former employee pursuing a wrongful discharge case. The lawyer believed that these high-ranking employees were dissatisfied with the company and likely had been posting negative information on their social media pages that were accessible only to those persons who had been accepted as “friends”.

Read the rest of this entry »

During the last decade, individuals and business have changed the way they manage their data by moving this data management offsite – otherwise known as cloud computing. This differs from the old model of information management that, more or less, mirrored the pre-computing era, meaning that an employee’s file might be kept in a cabinet in a Human Resources (“HR”) office or stored on a company’s in-house server. With cloud computing, however, that same employee file may be stored hundreds or thousands of miles away from the HR officer who needs to review it – or the IT officer tasked with preserving that data for potential litigation.

As discussed more fully in Rick Bortnick’s prior posts (here and here), cloud computing outsources data and software management, migrating it from the local to the global by providing instant access over the internet. According to the National Institute of Standards and Technology, cloud computing has five primary characteristics: (1) “on-demand self-service,” or the ability to call up stored data or capabilities as needed; (2) broad network access through a variety of platforms; (3) pooling resources providing “location independence”; (4) “rapid elasticity” in the distribution of computing capabilities, and (5) “measured service,” or service-appropriate control and optimization by the cloud system manager rather than the local user. It is the pooling of resources and the measured service managed by third-parties that pose the greatest risks during e-discovery.
  Read the rest of this entry »

A: They are some of the Google Search Terms that have brought readers to our site this week.  

A list of this week’s Top Google Search Terms leading to Cyberinquirer, and some other cute cyber-related gags that have qualified for our “Weekend Funnies” post, are set out below. I was flattered to see my name appear on the search list unaccompanied by terms like “lawyer” or “cyber geek” or “unhygenic”.  Here’s the list: Read the rest of this entry »

Computer hacking is a constantly evolving and growing threat.  While recent high-profile network security breaches at companies such as Epsilon and Sony (with crisis management and other costs estimated to range from $1 billion to multiples thereof in the case of Sony) have helped raise awareness about the need to adequately protect personal identifiable information, the problem has existed for decades. 

Yet the situation has only recently begun to receive proper attention from the media, government officials, businesses, and certain segments of the insurance industry.  Of course, the cost of a security breach may have something to do with that.  According to a study from Marsh and the Ponemon Institute, the typical data breach in FY 2010 resulted in companies and their insurers have to pay an average of $7.2 million to deal with and remedy the situation. 

One particularly alluring target for hackers has been educational institutions.  While schools and universities may not immediately appear to be obvious targets, the statistics confirm that attacks against educational institutions are on the rise. 

In 2007, educational institutions accounted for 25% of all reported data breaches.  This number jumped to 33% in 2008.  See Sarah Stephens & Shannan Fort, Cyber Liability & Higher Education, Aon Professional Risk Solutions White Paper (December 2008) Read the rest of this entry »

We would like to thank our devoted readers for making our site the world’s 3,364,537 most popular website as ranked by www.mostpopularwebsites.net! Considering that there are billions of websites online today, the fact that our site merits a specific ranking is a big deal to us. As you will see, we have proudly posted our newly discovered status on the left column of the site.  It’s a dangerous job, but somebody has to do it!

Clearly, our popularity is due to the nature of our substantive, high-caliber content posted on a regular basis (“regular” being defined in the context of a not-for-profit blog with busy contributors who, generally speaking, require the pulling of only a few teeth to motivate the production of articles). We admit, however, that we have occasionally found ourselves grappling with the conflicting desires of (1) maintaining serious, topical high-quality posts on cyber law and insurance related topics; and (2) posting random, funny, goofy stuff,  just for the heck of it. This inclination hits us at odd times…like an afternoon at the office when we should, instead, be putting the finishing touches on a mediation brief. In this post, we have therefore attempted to strike a compromise post that is both informative, random AND goofy. Intrigued? Then please read on. Read the rest of this entry »

It seems Righthaven hasn’t been able to catch a break since my December 2010 post.  Righthaven LLC is a copyright holding company founded in early 2010, which acquires newspaper content from its partner newspapers after finding that the content has been copied to online sites without permission, in order to engage in litigation against the site owners for copyright infringement. 

Just last week, in a suit filed against Democratic Underground (“D.U.”), Righthaven sought damages because D.U. used four paragraphs of a 34 paragraph Las Vegas Review Journal article (recall that the Journal and its contents belong to Stephens Media).  The post included a link to the full article, as well as citing the Journal. 

U.S. District Court Judge Roger Hunt dismissed the lawsuit, holding that a “copyright owner [here, Stephens Media] could not assign a bare right to sue.”  In addition, the court came down hard on Righthaven because it failed to advise, as required by law, that Stephens Media had a pecuniary interest in the lawsuits (Righthaven and Stephens Media were sharing the profits received from these lawsuits).  Judge Hunt seemed disgusted with Righthaven’s behavior and gave Righthaven two weeks “to show cause … why [Righthaven] should not be sanctioned for this flagrant misrepresentation to the court.”  Judge Hunt accused Righthaven of trying to “manufacture standing” in all of its cases.  (Click here for the Court’s full decision.) Read the rest of this entry »

Today, data breaches are a frequent occurrence. Often with the disclosure of each breach comes an announcement of credit report monitoring for affected individuals for a certain time period. So what does credit monitoring really provide? Identity protection, peace of mind or simply customer goodwill?

Credit report monitoring is the checking of one’s credit history in order to detect suspicious activity or changes. Companies that provide credit monitoring typically will alert the individual to activity tied to his or her social security number, such as credit inquiries, delinquencies, negative information, employment changes and new accounts. So why does credit monitoring fail to provide identity theft protection?

1.  First, individuals can receive a free credit report on an annual basis. The three credit reporting agencies, Equifax, Experian and TransUnion, have set up the following internet website, through which individuals can request free copies of their annual credit reports: https://www.annualcreditreport.com/cra/index.jsp.

2.  Secondly, criminals will wait at least one year and one day in the brokering or use of stolen data if the company that sustained the privacy breach offers one year credit monitoring.

3.  Third, credit monitoring primarily serves to alert, after the fact, the opening of new accounts. In turn, it typically does not warn the individual of changes with their existing credit. Hence, to the extent the persons’ current credit ratings have been adversely affected by the malicious acts of a third-party, they may go unreported and be unknown to the person whose credit has been impacted.

4.  Fourth and most importantly, credit monitoring fails to protect against the malevolent conduct listed below, as outlined by the non-profit Identity Theft Resource Center: 

Read the rest of this entry »

Faced with revitalizing a deteriorated economy, formulating a national budget, and the aftermath of Osama Bin Laden’s death, President Barack Obama has his hands full. Yet, in the midst of all the issues commanding the White House’s attention, the Obama Administration somehow has found time to address the threats to our nation’s cyber security.

According to Business Insurance, on Thursday, May 12, 2011, the Obama Administration proposed cyber security legislation to improve protection for individuals and the federal government’s computer and network systems. The proposed legislation would address national data breach reporting by creating simpler and standardized reporting requirements for the 47 states that contain such requirements. The proposal would also synchronize penalties for computer crimes with other crimes. Additionally, the government, through the Department of Homeland Security, would become directly involved in assisting the industry as well as state and local governments in policing and enforcing cyber security. The proposed legislation encourages the state and local governments to share information with the Department of Homeland Security about cyber threats or related incidents by providing them with immunity for doing so.  
 
Read the rest of this entry »

Following the publication of our original post on the implications of a cyber attack on investors’ securities portfolios (see here), we have been asked by scores of readers whether securities fraud litigation arising from cyber crime has ensued. Not surprisingly, the answer is “yes.”

Indeed, we have located at least two such cases, one a putative securities fraud class action against a payment processing company and the second an SEC initiated action against a private investor. The results may (or may not) surprise you, depending on your perspective of trial courts’ levels of judicial activism and willingness to render substantive decisions at early stages of litigation.

 In re: Heartland Payment Systems, No. 09-1043 (D.N.J. Dec. 07, 2009) remains the paradigm for such litigation. To facilitate its payment processing services, Heartland Payment Systems (“Heartland”) stored millions of credit and debit card numbers on its internal computer network. In December 2007, hackers launched a Structured Query Language Attack (“SQL attack”) on Heartland’s payroll management system. To its credit, Heartland was able to successfully avert the attack before any personally identifiable information was stolen. At the same time, however, the company failed to detect malicious software (“malware”) which had been placed on the network by the SQL attack.  The malware infected Heartland’s payment processing system, ultimately enabling the hackers to steal 130 million consumer credit and debit card numbers.  Heartland did not discover the breach until January 2009, at which time it notified government authorities and publicly disclosed the event.  Over the course of the following month, Heartland’s stock price dropped over $15 per share. Perhaps not surprisingly, shareholder class actions ensued.

In their complaint, plaintiffs alleged that Heartland and its officers and directors had made material misrepresentations and omissions about the December 2007 SQL attack. Specifically, plaintiffs claimed that the defendants concealed the SQL attack and misrepresented the general state of Heartland’s data security.  Plaintiffs further alleged that the defendants’ conduct was fraudulent because they were aware that Heartland’s network had been breached, yet they had not fully remedied the problem Read the rest of this entry »

I am proud to be a Co-Chair of the 2nd Annual NetDiligence Cyber Risk & Privacy Liability Forum which will take place June 9-10, 2011, at the historic Philadelphia Union League. Last year’s program was a huge success and the program planners are expecting the turnout to be even bigger this year.

NetDiligence and HB Conferences have teamed up to pull together thought leaders in the cyber/privacy industry to address the most urgent subjects. The program is fully accredited for continuing education and is priced at a level firms and companies will find attractive.

Over the course of a day an a half, we will present 45 industry-leading experts. I will help moderate the Conference, together with my Co-Chairs, Oliver Brew of Hiscox USA, Toby Merrill of ACE Professional Risk and Meredith Schnur of Wells Fargo Insurance Services USA. Also featured will be a keynote address by Jeffrey L. Seglin, nationally syndicated columnist of The Right Thing and author of The Right Thing: Conscience, Profit and Personal Responsibility in Today’s Business.

 For program and registration information, go to http://litigationconferences.com/?p=17865. I look forward to seeing you there!

   Send article as PDF   

Cyber crime is costing the United Kingdom more than £27  billion a year ($43.5 million), according to a recent study published by Britain’s Office of Cyber Security and Information Assurance.  The report, entitled “The Cost of Cyber Crime,” concluded that digital crime was a widespread, pervasive threat to U.K. businesses.

Theft of intellectual property, such as designs, formulas and other company secrets from businesses costs £9.2 billion, with firms specializing in pharmaceuticals, biotechnology, electronics, IT and chemicals being hit hardest.  The pharmaceutical industry loses about £1.8 billion a year in IP theft, followed by electronics and electrical equipment makers and the software sector.  In terms of non-IP industrial espionage, financial services are the biggest loser, with yearly losses of more than 2 billion, followed by mining and aerospace. 

Read the rest of this entry »

On January 20, 2011, a federal class action lawsuit was filed against MySpace in the United States District Court for the Eastern District of New York. If successful, this new lawsuit could have dramatic implications for social networking sites and their users. Either way, it provides another opportunity to make a couple of privacy-related points for employers.

The MySpace lawsuit was filed on behalf of all former and current users of MySpace, who seek damages for the alleged improper and voluntary disclosure of personal and private information and data in response to foreign court search warrants without the knowledge or authorization of the MySpace users. The class alleges that search warrants issued by state judges for certain information have no force and effect when they are issued to MySpace’s California headquarters from other states, but that MySpace nevertheless provided responsive information and data voluntarily.

Read the rest of this entry »

Whether you own a website where you allow blogs and comments to be posted, or if you are the blogger/poster, listen up. 

For those of you who haven’t heard of Righthaven LLC, they are to the blogging world what editors are to the Law Review world…cite-checking and anti-plagiarism “proponents” (let’s call ‘em that, for argument’s sake).  Righthaven’s been making quite a splash and has gained popularity among news chains since its coming into existence in the spring of 2010.  According to David Kravets’ article, “Righthaven Expands Troll Operation With Newspaper Giant”[1], Righthaven has filed over 180 lawsuits and has settled over 70 of them already.  Its major suppliers of copyrighted material include Stephens Media (owners of Las Vegas Review-Journal), MediaNews Group (owners of San Jose Mercury News and the Denver Post), and WEHCO Media (owners of Arkansas Democrat-Gazette and Chattanooga Times Free Fress), to name a few.[2] Owned by Net Sortie Systems LLC and SI Content Monitor LLC, Righthaven is the brain-child of Las Vegas-based IP attorney, Steven Gibson.[3] Righthaven’s clients assign their rights in the content to Righthaven, who then sues for copyright infringement.[4] 

In order to analyze the problems faced by the parties to such lawsuits, we’ll have to discuss the U.S. Copyright Act, as well as the Digital Millennium Copyright Act (“DMCA”).

Read the rest of this entry »

We wrote to Google and asked what information was required to subpoena Gmail in order to determine the identity of an email customer. Google’s response is below:

Dear Ms. Pengelley:

The information requested relates to services offered by Google Inc., a U.S. company organized and operating in the U.S., and governed by U.S. laws.  As such, we ask that your request be directed to Google Inc. – Attn: Legal Department, and communicated through the proper legal channel.  Please direct further communications to Google Inc. – Attn: Legal Department – at 1600 Amphitheatre Parkway, Mountain View, California, 94043, US, Fax: + 1 650.469.0622, or by email at lis-global@google.com.

Read the rest of this entry »

Since the weekend is soon to be upon us, we thought that you might enjoy some light entertainment! We feel justified in posting these because they are, technically speaking, cyber-related…this week we’ve adopted the “social media” cartoon theme. We would like to extend our special thanks to the authors who created these posts and put smiles on our faces! Enjoy! 

Read the rest of this entry »

We have all heard a story about some unfortunate personal injury lawyer who forgot to remind his client that ‘what happens in Vegas stays on YouTube’. Personal injury and family lawyers are becoming highly attuned to the crucial role that social media websites can play in civil litigation.

Yet when it comes to cases involving property damage, it appears that lawyers and other subrogation professionals have overlooked the potential utility of these sites in advancing their case. This post highlights some important ways in which YouTube can play a role in a subrogated claim for property damage.

1.   A Search Engine for Video Evidence

YouTube is the second largest search engine in the world. As of March, 2010, twenty-four hours of video was being uploaded to YouTube every minute. To put this in perspective, consider that more video is uploaded to YouTube in 60 days than all three major news networks have created in 60 years. [1] What does this mean? If you have a property damage claim, stop for a minute and think about whether it was an event that was likely to warrant a second glance. Were there flames? An explosion? Did a massive wall of water sweep over the property, obliterating all before it? In that case, it is likely that someone not only had taken that second glance, but pulled out his or her cell phone, recorded a video clip, and posted it on YouTube. Check it out. Simply enter the loss date, location and a one-word description into YouTube’s search engine and you may discover valuable evidence that can provide crucial insights into the loss.

Read the rest of this entry »

A “trend” is generally defined as a general course, drift or prevailing tendency.   In the battle between the potential privacy rights of a social networking site user and the desire of a lawsuit party to have full access to the private portions of that user’s profile, the trend favoring full and unfettered access has become clearer with a decision just issued by the Pennsylvania Court of Common Pleas in the case of McMillen v. Hummingbird Speedway, Inc.

In McMillen, the plaintiff was injured during a stock car race, and sued for damages after being rear-ended during a cooling down lap.   He alleged significant physical injuries and overall loss of general health and vitality, as well as an “inability to enjoy certain pleasures of life.” During the lawsuit, the defendants requested that plaintiff identify the name of all sites to which he belonged, and to identify his user name(s), login name(s), and passwords. Plaintiff responded by stating that he belonged to Facebook and MySpace, but he refused to give the other requested information based on confidentiality and privacy grounds.

Read the rest of this entry »

It’s that time of year again! On June 9-10, 2011, our very own Richard Bortnick will be co-chairing the 2nd Annual NetDiligence Cyber Risk & Privacy Liability Forum at The Union League, 140 South Broad Street in Philadelphia, PA.  

Topics include:

• State of the Cyber Nation
• State and Federal Regulatory Update
• Coverage Analysis: GL vs. Network Security
• Liability Surrounding Social Media Sites and Tools
• Design and Implementation of an Incident Response Plan
• Claims, Claims, Claims: A Privacy Breach Dissected

If you are interested in attending, you can register at this link.

   Send article as PDF   

This is a story about Beverly Stayart and her efforts to sue Yahoo! and other search engines for linking her name to online content that she felt was offensive.

 Although this lawsuit is rather striking, the case record does not reveal any particularly striking or unusual facts about Beverly, herself.

She is not a celebrity, or at least, was not one when she started this litigation. She has an M.B.A. from the University of Chicago, she has written a few papers about genealogy research that appear on the internet, and she is passionate about the environment. She is interested in the plight of wild horses, wolves and baby seals and has vigorously protested against their mistreatment. She has published two poems about baby seals on a Danish website.

Like many people, Beverly was curious about what she would find when she put her name into Yahoo’s search engine. To her chagrin, upon running a search of her name in 2008, she discovered that in addition to the expected search results, Yahoo! returned results that linked her name to online pharmaceutical companies promoting sexual dysfunction drugs Viagra, Cialis and Levitra, pornographic websites that contained spyware, and links that directed her to other websites promoting “sexual escapades”.

Read the rest of this entry »

There have been a recent flurry of blog posts and media stories warning internet users about the potential dangers of posting their whereabouts on social networking sites, as such personal information is being used by opportunists to facilitate crimes. For example, just in the last month, three men in Nashua, New Hampshire allegedly used information they obtained from users’ Facebook status updates to learn when the users would not be home and thereupon broke into their vacant and vulnerable residences. Although Facebook has denied any link between its site and the crimes, the Nashua police believe that detailed information about the posters’ travel plans provided the thieves with sufficient information to know when the homes would be unoccupied.

Of course, the incidence of such crimes has not been widely disseminated through traditional media sources, such as newspapers, radio and television. As such, most Americans are unaware of this increasing phenomena. At the same time, internet users are more widely and more frequently publishing their personal information, including their travel and vacation plans, on social networking and other public sites. Moreover, beyond the routine “tweets” and run-of-the-mill social networking status updates, new applications for cellular phones and PDAs are being created to facilitate geographical updates. These applications such as “Foursquare,” “Gowalla” and “Facebook Places,” enable users to instantly identify their current physical location on the profiles they have created on social networking sites. Needless to say, allowing geographical information to freely be disclosed to the public can provide opportunists with even more accurate information about the whereabouts of their victims and their distance from an unoccupied and vulnerable residence.

Read the rest of this entry »

Data security breaches pose a serious threat to a corporation’s financial stability as well as to its credibility in the marketplace. Most notably, the 2007 TJX data security breach, where 45 million credit card and debit card numbers were stolen, cost the company over $4 billion. For many corporations, the solution is to purchase a cyber liability insurance policy, which provides insurance coverage in the event of such a breach.

The risk of data security breaches has also affected students of universities throughout the nation. In June of last year, Cornell University officials informed 45,000 members of the school’s community that their personal information, including their names and social security numbers, was stolen after a University-owned laptop was stolen. Due to such breaches, college officials nationwide have begun purchasing cyber liability insurance policies to offset the financial burdens of a data security breach.

Read the rest of this entry »

Fifty years ago, a superhero leaped tall buildings in a single bound and used x-ray vision to catch evil criminals.   Today, some of the world’s most threatening criminals are computer hackers.  Superman may not be able to save us from cataclysmic cyber attacks, but we can rest a little easier knowing seven cyber guardians are holding keys to one of society’s most valuable commodities—the internet.  

ICAAN, the Internet Corporation for Assigned Names and Numbers, has provided “keys” to the internet to seven members of the global community. As discussed in prior posts, ICAAN is a non-profit watchdog group that helped establish Domain Name System Security Extensions,  or DNSSEC.   The DNSSEC—which just became enabled this year— is a critical security technology that lies at the core of the internet’s global addressing system.  It protects the very heart of the internet by ensuring that users reach the intended web address.

Read the rest of this entry »

Google, Facebook, Twitter, Foursquare—millions of Americans, including myself, depend on these cyber sites as their gateway to information and communication in the outside world.  What we may not realize, or choose to ignore for convenience’s sake, is that this gateway lies on a two-way street. The information that we seek using websites such as Google and what we communicate on Facebook and Twitter provide companies with vital data to better market their products to us.  This use of information is referred to as “data mining. ”

An example of data mining can be seen in the advertisements that pop up on the side of your Facebook home page.  Such ads are often relevant to the information posted on your “Profile” page, such as advertisements promoting products from your college alma mater. 

At the outset, data mining seems like a win-win situation for both the consumer and the seller—the consumer is marketed with a product in which they are seemingly interested and the company has utilized its advertising budget in an informed, cost-effective manner.  At the same time, however, the threat of an invasion of privacy is real and has the attention of members of Congress and federal officials to create legislation regulating the way in which, and the extent to which, our personal information is shared with third parties. 

Read the rest of this entry »

Are you a Member of the Cyberinquirer community? If so, do you receive the Cyberinquirer RSS feeds by email?

We’ve received reports from a number of Cyberinquirer Members lamenting that they do not receive the Cyberinquirer feeds and do not know when a new article is posted. If you’d like to receive these notifications, you need to sign up in the “Subscribe” box to the right of this post. Joining as a Member, while laudatory, isn’t enough if you want the feeds.

As to those of you who read our blog but haven’t signed up as a Member, well, what are you waiting for? Please join us and feel free to publish constructive substantive comments in the Members’ Forum or with respect to a particular posting. Or, even better, submit your own cyber articles for publication. The more people who get involved, the better for all of us. This is a community blog, not just Pamela’s and mine. Let’s make good use of it! To those of you who already participate, thank you kindly and cheers.

Rick

   Send article as PDF   

Your employee is being paid millions of dollars each year to perform his job. Right in the middle of today’s tasks, as he is about to receive instruction from his supervisor, your employee takes out his cell phone and posts a “tweet” on his feelings about his performance to all of his friends who have signed up to follow his twitter board. Would you have a problem with that?

At least two employers did. News surfaced last week that Eric Mangini, head coach of the NFL’s Cleveland Browns, has threatened to fine players for tweeting about events at training camp, and particularly during team meetings. This on the heels of the well-publicized action taken last year by the NBA’s Milwaukee Bucks. In that case, Bucks forward Charlie Villanueva apparently posted a message to his Twitter feed from his cell phone when he went into the locker room at halftime of a basketball game against the Boston Celtics. According to reports, the tweet that was posted from Villanueva’s “CV31” screen name read: “In da locker room, snuck to post my twitt. We’re playing the Celtics, tie ball game at da half. Coach wants more toughness. I gotta step up.”

Read the rest of this entry »

One of the difficult things to predict with regard to the use of social media in the employment setting continues to be the extent to which traditional legal claims apply equally to new social media outlets.   We continue to advise employers that it is imperative to ensure that care is also taken to create policies and train employees on the use of social media in and out of the office setting, and not to let the informality and ease of the Internet lull employers into a false sense of security.   On July 22, 2010, a New York Supreme Court Judge applied the tort of defamation to statements on Facebook in a case that offers an important message to employers.

The case of Finkel v. Dauber (New York Supreme Court, Nassau County) centered on statements posted by a Facebook group known as “90 Cents Short of a Dollar.” Plaintiff alleged that she was defamed by the group’s postings that stated “unbeknownst to many, [plaintiff] acquired AIDS while on a cruise to Africa” and then “persisted to screw a baboon which caused the epidemic to spread.”   The postings further defamed plaintiff, she alleged, by stating “[w]hile in Africa she was seen fucking a horse.”   And other intelligent banter.

Read the rest of this entry »

On July 23, 2010, the United States Court of Appeals for the Eighth Circuit issued an important decision in Eyeblaster, Inc. v. Federal Ins. Co., 2010, U.S. App. LEXIS 15152, No. Civ. A. 08-3640, finding concurrent coverage under both a General Liability (“CGL”) insurance policy and a separate Information and Network Technology Errors and Omissions Liability (“E&O”) policy in circumstances where an online marketing company installed software on a consumer’s computer system, allegedly corrupting the computer’s software operating system.

Eyeblaster Inc. (“Eyeblaster”), the policyholder, is a company that creates, delivers and manages online interactive advertising. For the period December 5, 2006, to December 5, 2007, it was insured under two concurrent policies issued by Federal Insurance Company (“Federal”): (1) a CGL policy covering occurrences which cause damage to tangible property, and (2) an E&O policy which covered claims for financial loss caused by a wrongful act in connection with a product’s failure to perform its intended function or serve its intended purpose, resulting in damage to intangible property. As to the latter policy, intangible property included software, data and other electronic information. Both policies were “duty to defend” forms.

Read the rest of this entry »

Interviewing for your first job as a teenager is as exciting as it is intimidating. Thoughts of what to do with your first paycheck consume your mind as you rehearse your best “do-you-want-fries-with-that” smile. The interview proceeds flawlessly and you start to count the dollar signs as you await the job offer. But imagine your surprise when you are informed that you did not get the job because your background check revealed that you are over $75,000 in debt and five years behind in your child support payments for your eleven year old child…a terrifying thought considering you are only 16 years old.

Adults aren’t the only victims of identity theft. Child identity theft is an increasing and understated crime. A child’s Social Security Number (“SSN”) is the perfect target, as the theft typically goes undetected until years after the crime has taken place. Indeed, the crime might not be discovered until the rightful owner/victim uses his or her SSN for the first time years later. This revelation often occurs when the victim applies for his or her first job or financial aid before college.

The scheme works as follows: businesses are using various techniques to search the Internet for dormant SSNs. These numbers often belong to long-term inmates, dead people or children. Obtaining them is not as difficult as one may think, as SSNs are distributed systematically depending on age, geographical location and when the number is issued. Once it has been determined that no one is actively using the number to obtain credit, the numbers are offered for sale.

Read the rest of this entry »

Lest one question the severity of the evolving challenges in our rapidly growing cyber world, President Obama has crystallized it succinctly: (1) “cyber threat is one of the most serious economic and national security challenges we face as a nation;” and (2) “America’s economic prosperity in the 21st century will depend on cybersecurity.” In other words, President Obama has declared cybersecurity to be a national security priority.

While that’s obviously good news, the follow-up question is “how are we doing in meeting the associated demands?” Regrettably, not so well, it seems.

Speaking before cybersecurity and privacy experts from government, law enforcement, the private sector, academia and privacy and civil liberties groups, President Obama, Homeland Security Secretary Janet Napolitano, Commerce Secretary Gary Locke, Cyber Coordinator Howard Schmidt and other Administration officials uniformly acknowledged that far more work needs to be done to protect digital communications and information infrastructure and make it more difficult and costly for cybercrimimals.

Read the rest of this entry »

“A lawyer is never entirely comfortable with a friendly divorce, anymore than a good mortician wants to finish his job and then have the patient sit up on the table.”  Jean Kerr

A new company out of Dallas, DivorceApps.com, is selling applications aimed at helping people navigate the legal waters of divorce. A Texas family lawyer, Michelle May O’Neil, started the company in March of this year. Two apps currently are for sale on iphones at a cost of $9.99 USD.  Applications that are currently available online are described as follows:

(1) Cost and Prep Application: A system that 1) tracks the information that will be required either by legal counsel or the other side of the case and 2) helps the user track the costs of divorce. For example, the “Divorce Cost” portion of the application provides a scroll down list of categories that enables the user to gain a better understanding of the costs of divorce. The “Scroll Down” component of the application allows the user to scroll through the categories of information to determine the documents and information that will be applicable to their case.

(2) Estate Divider Application: The “Estate Divider” is a system that purports to allow a user to work through the overall division of their Estate. The user can:

Read the rest of this entry »

Apparently feeling that they’ve resolved the longstanding issue of illegal immigration and can move on to the next crisis, Immigration and Customs Enforcement (“ICE”) and the U.S. Justice Department have identified a new enemy in their ongoing stuggle to protect truth, justice and the American way: Internet sites that sell counterfeit goods and pirated movies.

Indeed, just this month, government officials announced that they have shut down nine websites as part of their newly announced initiative, “Operation In Our Sites,” which is intended to protect Hollywood’s intellectual property. Officials estimated that nearly 7 million pirated movies and shows per month were downloaded from the offending websites.

The announcement was held on a soundstage at The Walt Disney Studios in Burbank, CA. Neither Johnny Depp nor Captain Hook reportedly was present.

Read the rest of this entry »

We’ve all heard the story of the clerk at the local gas station who was double-swiping credit cards in order to make fraudulent copies. Online banking, restaurants, clothing retailers…every industry is potentially a target. Yet the industry that was the subject of more credit card thefts than any other sector in 2009?  Hotels.

To the point, SpiderLabs (an affiliate of Trustwave, a data-security consulting firm) has published a study which reports that 38% of the credit card hacking events in 2009 involved the hospitality industry.  Over one-third of all thefts of credit card numbers occurred at hotels. Much to my surprise, given the wealth of reporting on the subject, the financial services industry lagged well behind at a comparatively minor 19%. Retail followed at 14.2% while restaurants and bars were fourth at 13%.

I guess I shouldn’t have been surprised, though, as my own credit card number was stolen several years back while i was staying at a business travelers’ hotel in New York City. I had gone to the City for a Cinco de Mayo event sponsored by a major international insurer. Several days later, I received a call from my credit card company asking if I had bought gasoline on Long Island or a $5000 television at a big box retailer. While I do buy gasoline, I hadn’t been on Long Island. And while I certainly would have loved a $5000 television (or, for economy’s sake, something less pricey), I hadn’t bought that either. The conclusion was simple: my credit card number had been stolen when I used it at the New York hotel.

So, why hotels? According to security analysts, they’re generally easy targets. The large chain hotels may employ sophisticated security technology or other protections. Or they may not. In either case, how about smaller or private owned, non-chain hotels? The next time you check into a hotel, ask what security methods they use to protect credit card information. You probably won’t like the answer. The credit card number that you provide at check-in may sit in a folder or a file maintained right at the front desk. Who would prevent someone from simply lifting the file? Especially in the middle of the night. The single desk clerk on overnight duty?

Read the rest of this entry »

We are pleased to announce that Cyberinquirer has been nominated by LexisNexis’s Insurance Law Community Staff as one of the Top 50 Insurance Blogs for 2009. According to the LexisNexis site, “When [LexisNexis] considers a blog for membership in ILC’s annual Top 50, we look for frequent posts, timely topics, and quality writing. Only the best may gain admission. Our readers have come to expect nothing less, and we wouldn’t have it any other way.”

The comment period for nominations closes on July 9. Once the nominees have been set, LexisNexis will open a voting period of undisclosed length.  Needless to say, Pamela and I are thrilled to have been considered, and we hope we continue to meet the standard described by LexisNexis’s assessment of the Top 50 Blogs.  One of our important aims is to promote recognition of the enhanced exposures and liabilities inherent in a technological society and the role of cyber/tech insurance products.  Again, thank you to our readers and members for your support!

   Send article as PDF   

I was recently introduced to a great new Scrabble word: “meme”. According to wikipedia, my source for all things “e-”, a meme, in reference to the Internet, is ‘the propagation of a digital file or hyperlink’ that contains content consisting of a saying or joke, a rumor, an altered or original image, a complete website, a video clip or animation, or an offbeat news story, among many other possibilities. In other words, an Internet meme is an inside joke that is shared between a large number of Internet users.

Internet memes have a tendency to evolve and spread extremely swiftly, sometimes going in and out of popularity in just days. They are spread organically, voluntarily, and peer to peer, rather than by compulsion, predetermined path, or completely automated means. The term ‘meme’ can refer to the content that spreads from user to user, the idea behind the content, or the phenomenon of its spread.

Ally McBeal fans may now appreciate the reference to the dancing ‘oogachucka’  baby. In an effort to be a bit more up-to-date in my meme references, I’ve embedded some of them, below.  If you’re seeing them for the first time, you may experience the ‘lightbulb effect’ – that is, you’ll actually get the joke behind certain late night comedy skits that just didn’t seem all that funny.

Read the rest of this entry »

His name is Ghyslain Raza, but you may know of him as “Star Wars Kid”, a portly 15-year-old student at a Quebec private high school who had filmed himself wielding a mock light saber, pretending to be a Star Wars character in combat. The two-minute video was supposed to be private, but he left it lying around at his school where three students, who did not know the teenager, came across the video, posted it on the Internet on April 14, 2003, adding a message inviting people to make insulting remarks about the clip.

Unfortunately for him, it wasn’t just his friends who found the footage so amusing. The video went ‘viral’. One Web log that posted the video was allegedly downloaded 1.1 million times, and by October 2004 one Internet site dedicated to the video had recorded 76 million visits. According to UK marketing firm The Viral Factory, it became the most downloaded video of 2006. So mortified was the teenager that he dropped out of school and finished the semester at a psychiatric ward. According to the student, “It was simply unbearable, totally. It was impossible to attend class.”  More than 35 other revised versions of the video clip, created by other people, have found their way to the Internet, with additional sound and visual effects.

This is an extreme but far from unique example of the devastation wrought by cyber-bullying, the term given to internet conduct in which students harass other students by e-mail and on the internet. Given the potentially devastating consequences of cyberbullying, should schools have the power to discipline their students engaging in this form of harmful conduct?

A major issue confronting school boards is that cyberbullying usually does not take place at school, although its effects can later reverberate among students during school hours. Students may post offensive material from home, or other times outside of school hours, but the targets are fellow classmates. Is it appropriate for a school board to discipline a student for posting such material simply because the postings are being accessed by other students at school or target other students?  At the same time, with power comes responsibility – if school boards have the power to discipline students for their behavior outside of school, are schools then to be mandated with the responsibility to essentially monitor and censor the world-wide web? Just how far should a school board’s jurisdiction extend regarding inappropriate off-school student e-conduct?

Read the rest of this entry »