Digital Media and Data Privacy Law Blog

We don’t usually talk about four-year-old court decisions in the first instance here.  But the Ninth Circuit has issued a pair of noteworthy opinions interpreting the Computer Fraud and Abuse Act in the last few weeks.  And to understand those it will help to understand United States v. Nosal, 676 F.3d 854 (9th Cir. 2012), an en banc opinion authored by Judge Kozinski.

Facts

The facts are mercifully short.  David Nosal used to work for Korn/Ferry, an executive search firm.  Shortly after he left the company, he convinced some of his former colleagues who were still working for ... Read More 

Like many people, Aaron Graham and Eric Jordan carried cell phones around in 2011. Unlike most people, Graham and Jordan were convicted of crimes arising from their participation in a series of armed robberies[1] in that period, and were soon sorry that they had their cell phones on them when those robberies happened.  Sitting en banc, the U.S. Court of Appeals for the Fourth Circuit just made them sorry last Tuesday in United States v. Graham, No. 12-4659 (4th Cir. May 31, 2016).

Because in their investigation, federal agents sought the cell-site location information (or “CSLI” as ... Read More 

I’ve long thought that sending faxes was a pretty silly means of communication.  Don’t send me a fax.  I don’t want it.  At some point I’m hoping that even my kids’ doctor’s office will get dragged into the 20^th century and drop their insistence on faxing.  In the meantime a pdf will be fine, thanks.  In addition to the many reasons faxes are antiquated and annoying, the SEC has just provided us another reason to avoid them: they encourage violations of Reg. S-P!

The Rule

Reg. S-P’s Safeguards Rule requires that every broker-dealer registered with the SEC adopt policies and ... Read More 

You may be too young for this to have been a big thing to you, but almost 30 years ago, D.C. Circuit Judge Robert Bork was nominated to the Supreme Court, and Washington, D.C. went into a tizzy.  Coming as it did just a year after Antonin Scalia joined the Court in 1986, Judge Bork’s nomination had many people very excited and very motivated: some to have him on the Court, and some to keep him off.  In the midst of this hooha, a writer at the Washington City Paper thought it would be cool if Bork’s local video store would share a list of the judge’s rentals.  It did.  And at the time it was completely ... Read More 

If you’ve ever attended the SEC Speaks conference, you know that the official program is an intensely uninteresting collection of short speeches by SEC officials who don’t have a lot of incentives to say groundbreaking things.  But occasionally there are exceptions.  I think Deputy Director Stephanie Avakian’s discussion of cybersecurity cases on Friday was one of those.

Avakian broke those cases down into three categories.

1. Failures of registered entities to safeguard information.  She cited the R.T. Jones Capital Equities Management case from September of last year as an ...

The FCC has been flexing its muscles in 2015 when it comes to enforcing data security requirements.  In April, it reached a $25 million settlement with AT&T Services, Inc. for failing to safeguard customers’ personal information.  In July, it reached a $3.5 million settlement with TerraCom, Inc. and YourTel America, Inc. to resolve similar claims.  Earlier this month, the FCC announced it had reached a $595,000 settlement with Cox Communications, Inc. (“Cox”) to resolve the Enforcement Bureau’s investigation into whether Cox failed to properly protect its customers’ ... Read More 

Lawyers and compliance professionals constantly tout the importance of internal information security policies, particularly in light of data privacy problems that are reported almost daily in the media.  Admittedly, drafting such policies as a proactive measure can be a pain because there is always a tendency to worry that, unless you’ve suffered a data breach, you are the proverbial “solution in search of a problem.”

But it’s not.  In fact, in some cases, it’s actually required.  HIPAA (for protected health information), Gramm-Leach-Bliley (for financial ... Read More 

Over the last couple years, the SEC’s cybersecurity bark has been worse than its bite.  Its Office of Compliance, Inspections, and Examinations issued examination priorities in 2014.  Commissioner Aguilar warned public company boards that they had better get smart about the topic a few months later.  The results of OCIE’s cybersecurity exam sweep were released in March of this year.  And the Investment Management Division said words, not many words, about investment advisers’ responsibilities in this area in July.

Alleged Facts

What it hasn’t done recently is sue somebody ... Read More 

Ed. Note: This entry is cross posted from Cady Bar the Door, David Smyth's blog offering Insight & Commentary on SEC Enforcement Actions and White Collar Crime.

Lots of agencies and organizations want to boss you around about cybersecurity.  In April, the SEC and the Justice Department published more directions on the issue.  We’ll cover the very brief guidance issued by the SEC’s Division of Investment Management first, and then turn to DOJ in a later post.

First, as with everyone else, the IM Division thinks cybersecurity is very, very important for investment companies and ... Read More 

I haven’t yet turned to a life of crime, so far be it from me to criticize actual criminals’ profit-maximizing strategies. It’s easy for me to nitpick, but I’m not the one strapping on my mask and trying to earn a (dis)honest dollar every day. But have a look at this Reuters story from Tuesday. 

In it, we learn that the SEC and the Secret Service are investigating a sophisticated computer hacking group known as “FIN4” that allegedly “has tried to hack into email accounts at more than 100 companies, looking for confidential information on mergers and other market-moving ... Read More