Security

Subscribe to Security

On May 11, 2016, President Obama signed into law the Defend Trade Secrets Act (DTSA). Unlike other forms of intellectual property, trade secrets issues have been addressed mainly through state law. The DTSA provides a new federal court civil remedy for acts of trade secret misappropriation, among other key provisions:

Ex Parte Seizure of Property

The most controversial aspect of the DTSA is the ex parte seizure provision, which permits a court to order the seizure of property if deemed necessary to prevent the propagation or dissemination of the trade secret. A party seeking an ex parte seizure will have to demonstrate that “extraordinary circumstances” exist warranting the seizure. The ex parte provision also allows a defendant to seek damages for abusive or wrongfully-acquired seizure orders.

Jurisdiction

The DTSA provides that the U.S. district courts have original jurisdiction over civil actions brought under the law. Such jurisdiction is not exclusive. To establish jurisdiction in federal court, a plaintiff will have to show that the trade secret is “related to a product or service used in, or intended for use in, interstate or foreign commerce.” …
Continue Reading President Obama Signs the Defend Trade Secrets Act into Law: What You Need to Know Now

As published in State Bar of Michigan Health Care Law Section

“In recent years, the likelihood of suffering a data breach has risen significantly for American companies across numerous industries. Health care providers, in particular, have been targeted due to the value of the sensitive information they hold regarding their patients and employees, including birth…

Audit. A simple enough word, which basically means “to count.” Yet few words can evoke fear as much as this one word. No one asks their love “How do I love thee? Let me audit the ways,” nor do we tell our children to “Audit your blessings.” And while audits are not inherently unreasonable, their use should be reasonable and relevant. And due to the negative connotation of the word, many IT vendors are even couching their audit notices in “kinder” terms, characterizing the reviews as customer-benefitting and the like. But just as Shakespeare noted about misnamed flowers, an audit by any other name doesn’t change anything, and still holds risk.

Software audits are on the rise, and with most users reporting some under-licensing situations (and the requisite payment of additional license and support fees), this upward trend will only continue as more IT providers focus on this “low hanging fruit” revenue source. An increasing number of IT solutions providers are asking (or sometimes just telling) their customers to submit to an audit, albeit many times called by a different name, and taking increasingly aggressive approaches. The IT industry and the industries of its customers are taking notice, as in many cases, what is portrayed as a simple review will end up with tens or hundreds of thousands of dollars of exposure in the form of license and maintenance fees.
Continue Reading Software Audits: A Rose by any Other Name…

Last week, the European Commission unveiled the latest documentation related to the EU-U.S. Privacy Shield intended to restore trust in transatlantic data transfer and establish a mechanism for U.S. companies to once again transfer data from the EU with confidence. We wrote last month about the initial announcement of the Privacy Shield but expressed caution…

In a February 19th speech at the annual SEC Speaks conference, Stephanie Avakian, Deputy Director of the SEC’s Division of Enforcement, explained what the SEC expects of entities that experience a cyber intrusion and how the SEC decides whether to investigate such entities.

With respect to responding to cyber intrusion, the SEC’s stated expectations are high level and axiomatic. Entities are expected to (1) assess the situation, (2) address the problem and (3) minimize the damage. Ms. Avakian emphasized the importance of quickly involving authorities such as the FBI or Department of Homeland Security.

Ms. Avakian also expressed awareness of the practical impediments to self-reporting cyber intrusions to the SEC. Specifically, entities may be hesitant to do so for fear of triggering an investigation and enforcement action regarding their policies/procedures and implementation thereof. To assuage this concern, Ms. Avakian noted that the SEC’s goals in the cybersecurity area are to prevent hacking, protect customer data and ensure the smooth operation of America’s financial system. In other words, the SEC—at least from a priority standpoint—is on the same side as the entities that may fall prey to a cyber intrusion. In the case of registrants, when investigating cyber intrusions the SEC will focus on whether a registrant had policies and procedures reasonably designed to protect customer data and related remediation action plans. In the case of public companies, the SEC is not looking to second-guess good-faith decisions regarding data privacy, and would likely not bring an enforcement action against a cyber intrusion victim absent a “significant” disclosure issue. Ms. Avakian also pointed out that entities who self-disclose cyber intrusions will be rewarded with cooperation credit.  …
Continue Reading SEC Speaks: How the SEC Decides Whether to Investigate Breached Entities

Politicians in both the European Union and United States touted Tuesday’s agreement on a new “Privacy Shield” for EU-U.S. data transfers as a resolution to the data transfer quagmire that has faced companies since the EU-U.S. Safe Harbor was invalidated in October. While this new deal is a promising step in the right direction for companies that transfer data from the EU to the United States, there are still many questions about exactly what the requirements of the new Privacy Shield will be, how an American company can ensure compliance with those requirements and (perhaps most importantly) whether the European Court of Justice will validate the new rules.

Indeed, the deal heralded by politicians on both sides of the Atlantic appears to be only a high-level agreement—they expect to document the actual terms over the next few weeks (the Article 29 Working Party (WP29), the body made up of representatives of individual European Member States’ data protection authorities, has called for it to be fully documented by the end of February). Thus, we anticipate quite a bit more negotiation on the precise scope and language of the requirements. Meanwhile, WP29, which had been assessing data transfer mechanisms like standard contractual clauses and model contracts for possible flaws that would lead to enforcement actions, announced that it will not take enforcement actions based on its concerns about these mechanisms while it awaits the details of the new transfer deal. …
Continue Reading Privacy Shield Offers Hope on EU-U.S. Data Transfer—For Now

In a well-reasoned and encouraging decision to Internet businesses, the Northern District of Illinois recently found that even operating one of the largest, most popular websites in the world is not enough to create personal jurisdiction everywhere the site can be accessed. See Gullen v. Facebook, Inc., Case No. 15-cv-07681 (Jan. 21, 2016…

President Obama signed an executive order enabling the administration to mete out harsh penalties against foreigners who perpetuate malicious cyberattacks that significantly threaten the national security, foreign policy, economic health or financial stability of the United States.

After a marked increase in the frequency and sophistication of high-profile foreign cyberattacks targeting U.S. businesses, companies have requested the U.S. government to strengthen its deterrents for cyberattacks, especially for those that are state-sponsored.  The order expands the set of tools available to the government by declaring “significant malicious cyber-enabled activities” a “national emergency” and empowering the Treasury Department to freeze assets and impose other sanctions on foreigners participating in cyberattacks.  These sanctions are calculated to deter cyberattacks by removing attackers’ economic incentives.…

Continue Reading United States Establishes Sanctions Program to Combat Foreign Cyberattacks