An RSS Feed from melniklegal.com

Interest in Cyber Security of Financial Services Firms Continues to Increase

Fri, 08 Aug 2014 10:29:28 EST

As news of data breaches continue to mount, federal and state regulators are becoming increasingly interested in the steps companies are taking to secure the information entrusted to them by consumers as well as other companies. This year we have seen an increased focus on the financial services sector, which suffered large losses in the wake of the data breach at Target. This was then followed by data breaches at Neiman Marcus, Michaels, PF Changs, among many many others.

Some of the recent examples include:

FFIEC - The Federal Financial Institutions Examination Council has launched a pilot program to assess the cyber security preparedness of 500 community banks. This announcement coincides with the launching of a web page on June 24, 2014 on cyber security, which is meant to serve as "a central repository for current and future FFIEC-related materials on cyber security." As the FFIEC explains, "Regulators are particularly focusing on risk management and oversight, threat intelligence and collaboration, cyber security controls, service provider and vendor risk management, and cyber incident management and resilience."[1]

New York Department of Financial Services - In May 2014, the New York Department of Financial Services (NYDFS) issued a "Report on Cyber Security in the Banking Sector." The Report notes that, "Although large-scale denial-of-services attacks against major financial institutions generate the most headlines, community and regional banks, credit unions, money transmitters, and third-party service providers (such as credit card and payment processors) have experienced attempted breaches in recent years."[3] After conducting a preliminary survey of 154 financial services institutions in 2013, the Department now "plans to expand its IT examination procedures to focus more fully on cyber security." These "revised examination procedures will include additional questions in the areas of IT management and governance, incident response and event management, access controls, network security, vendor management, and disaster recovery." Those providing services to these entities should also expect to see more questions regarding cyber security now that regulators are becoming more interested in vendor practices.

SEC - Cyber security has been a focal point at the Securities and Exchange Commission for a few years. But, the SEC's Office of Compliance Inspections and Examinations announced in a Risk Alert on April 15, 2014 that it is undertaking cyber security examinations of more than 50 registered broker-dealers and registered investment advisers.[2] The OCIE will be focusing on the entity�s cyber security governance, identification and assessment of cyber security risks, protection of networks and information, risks associated with remote customer access and funds transfer requests, risks associated with vendors and other third parties, detection of unauthorized activity, and experiences with certain cyber security threats.

---------------------------------------
[1] Press Release, FFEIC, FFIEC Launches Cybersecurity Web Page, Promotes Awareness of Cybersecurity Activities, June 24, 2014, https://www.ffiec.gov/press/pr062414.htm.

[2] SEC, National Exam Program Risk Alert, Vol. IV, Iss. 2 (April 15, 2014), https://www.sec.gov/ocie/announcement/Cybersecurity+Risk+Alert++%2526+Appendix+-+4.15.14.pdf.

[3] NY State Department of Financial Services, Report on Cyber Security in the Banking Sector (May 2014), https://www.dfs.ny.gov/about/press2014/pr140505_cyber_security.pdf.
---------------------------------------

Posted by Tatiana Melnik on August 8, 2014

IBM and the EEOC Experiment with BYOD

Sun, 13 Oct 2013 22:11:49 EST

Many companies are moving to a BYOD system. And the move is understandable given anticipated employee efficiency and productivity increases as well as cost savings for employers. On the other hand, companies also need to be aware of the problems that can arise when moving to a BYOD environment, including employee push back and increased security concerns.

BYOD Can Garner Cost Savings - A BYOD Case Study

In 2012, the U.S. Equal Employment Opportunity Commission (EEOC) undertook a BYOD pilot, during which the EEOC was able to significantly reduce the information technology budget for BlackBerry mobile devices. The EEOC explained,

Last year [2011], the EEOC was paying $800,000 for its Government issued BlackBerry devices. Subsequently, the EEOC�s FY2012 IT budget was cut from $17.6 million to $15 million, nearly a 15% reduction. The EEOC�s Chief Information Officer, Kimberly Hancher, significantly reduced contractor services, eliminated some software maintenance, and slashed the agency�s budget for mobile devices -- leaving only $400,000 allocated for Fiscal Year 2012. . . . [As a result of several cost saving measures discussed below,] FY 2012 costs were reduced by roughly $240,000[.]

Importantly, before implementing changes, the EEOC evaluated use of existing devices. Specifically, the EEOC found that,

75% of our users never made phone calls from their BlackBerrys � Email is the killer app. They either used the phone on their desk or they used their personal cell phone to make calls because it�s just easier. We also found there were a number of zero-use devices. People have them parked in their desk drawer, and the only time they use it is when they travel.

After evaluating the existing environment, the EEOC was able to form a plan to implement several cost saving measures, including pressing their "wireless carrier, a GSA Networx contract provider, to help cut costs or risk losing the EEOC�s BlackBerry business." The EEOC also eliminated zero-use devices and moved the remaining BlackBerry devices to a bundled rate plan with shared minutes.

But, moving to a BYOD environment can also be problematic. While employees desire to use their own devices, they may also push back on a company's efforts to monitor and track the devices. Moreover, as IBM learned in its implementation, employees must be trained on best practices to protect their devices and avoid security pitfalls.

IBM Experiments with BYOD

IBM is a sophisticated technology company whose storied history of innovation dates back to 1880. IBM holds more patents than any other U.S. based IT company and has lead the list of top patent recipients for 19 consecutive years. Yet, when IBM adopted a BYOD policy in 2010, similar to other companies, it too encountered technology challenges

In an interview with the MIT Technology Review in 2012, Jeanette Horan, IBM's Chief Technology Officer, reported that her IT department was bogged down with security issues brought about by employees using certain apps (e.g., Dropbox), forwarding internal e-mail to public e-mail services, and creating open Wi-Fi hotspots with their mobile devices.

According to the MIT Technology Review, Horan's team "surveyed several hundred employees using mobile devices, [and found that] many were 'blissfully unaware' of what popular apps could be security risks." In general, her team "found a tremendous lack of awareness as to what constitutes a risk."

Given the lack of awareness among IBM employees of security risks associated with mobile apps and time spent addressing these concerns, "[t]he trend toward employee-owned devices isn�t saving IBM any money . . . Instead, [Horan] says, it has created new challenges for her department of 5,000 people, because employees� devices are full of software that IBM doesn�t control."

BYOD Is Not For Everyone

It is important for companies to recognize that a bring your own device approach is not appropriate for every company. True, IBM, the EEOC, and many other organizations have managed to make BYOD work for them. But, that does not mean that this approach is the best approach for every organization. As is clear from IBM's experience, companies may not see an immediate cost savings from moving to a BYOD environment. On the other hand, companies could realize immediate cost savings by eliminating zero-use devices as did the EEOC.

Resources and Supporting Materials

White House Digital Government - Bring Your Own Device - A Toolkit to Support Federal Agencies Implementing Bring Your Own Device (BYOD) Programs (August 23, 2012)

Includes three BYOD Case Studies:

Alcohol and Tobacco Tax and Trade Bureau (TTB) Virtual Desktop Implementation
U.S. Equal Employment Opportunity Commission (EEOC) BYOD Pilot
State of Delaware BYOD Program

Includes Sample Policies

Sample #1: Policy and Guidelines for Government-Provided Mobile Device Usage
Sample #2: Bring Your Own Device � Policy and Rules of Behavior
Sample #3: Mobile Information Technology Device Policy
Sample #4: Wireless Communication Reimbursement Program
Sample #5: Portable Wireless Network Access Device Policy
**Disclaimer - inclusion does not constitute endorsement or approval.

https://www.whitehouse.gov/digitalgov/bring-your-own-device or PDF copy

Brian Bergstein, IBM Faces the Perils of "Bring Your Own Device": After letting its employees use their own phones and tablets for work, the company confronted a flood of insecure apps from the open Web, MIT Technology Review (May 21, 2012).

IBM Press Release, IBM Breaks U.S. Patent Record; Tops Patent List for 19th Consecutive Year: IBM inventors received more than 6,000 patents in 2011. Jan 11. 2012.

And the Data Breach Train Keeps Rolling

Tue, 15 Oct 2013 20:13:04 EST

In the last few days, two hospitals have announced data breaches involving protected health information.

The first data breach incident, announced on October 1, 2013, involved St. Mary's Janesville Hospital, a 50-bed facility serving residents of Rock County Wisconsin.

According the press release posted on the facility's website:

Circumstances: Laptop was stolen from an employee's car
Incident date: August 26 or 27, 2013
When discovered (by hospital): August 27, 2013
How discovered: Presumably when employee notified hospital
Patient notification date: September 30, 2013
Public notice date: October 1, 2013

Number of patients' impacted: 629
When/where patients' received treatment: Patients who were treated in the emergency department of St. Mary's Janesville Hospital between January 1, 2013 and August 26, 2013
Stolen information included: May have included patient name, date of birth, medical record and account numbers, provider and department of service, bed and room number, date and time of service, visit history, complaint, diagnosis, procedures, test results, vaccines, if administered, and medications. The laptop did not contain any Social Security numbers, addresses, credit card numbers, or financial information of any kind.

St. Mary's advised in its press release that the hospital "inspected all laptops to ensure they all have encryption software" and that the hospital "will actively be monitoring consistency of laptop encryption and conducting monthly audits to ensure compliance with [the hospital's] encryption policies." But, given this public notice and the notification to patients, it appears that the stolen laptop was either not encrypted or that the PHI was stored in the unencrypted portion of the laptop.

St. Mary's has partnered with ID Experts to provide the impacted patients with identity theft monitoring services for one year.

The second data breach incident was announced on October 2, 2013 by UnityPoint Health, a healthcare system providing services throughout Iowa and Illinois. According to the UnityPoint's press release (which appears to have been released to the media, but which could not be located on the system's website at https://unitypoint.org):

Circumstances: UnityPoint's electronic medical record (EMR) system was accessed by an unauthorized individual using the login details from authorized individuals
Incident date: Records accessed over a period from February 2013 - August 2013
When discovered (by hospital): On or around August 8, 2013
How discovered: Incident discovered during a "regular audit", when "UnityPoint detected a pattern of unusual access to certain patient data in its hospital EMR system"
Patient notification date: Sometime on or before October 2, 2013
Public notice date: October 2, 2013
Number of patients' impacted: 1,800

When/where patients' received treatment: Patients treated at UnityPoint Health system offices/locations anytime prior to when UnityPoint "shut off the unauthorized access by forcing a password reset"

Stolen information included: Names, home addresses, dates of birth, medical and health insurance account numbers, and health information related to patient treatment. For less than ten percent of impacted patients, patient Social Security number and/or Driver�s License number may have been viewed. For four impacted patients, the unauthorized user also accessed information about the patients� financially responsible party.

UnityPoint is offering credit monitoring services to the impacted individuals.

Materials

Press Release from UnityPoint Health (retrieved from the Sioux City Journal here)
Press Release from St. Mary's Janesville Hospital

Family Stumped by Fired Live-In Nanny Who Won't Leave

Sun, 29 Jun 2014 15:55:50 EST

The Importance of Running Background Checks.

Employers generally recognize that there is a need to run background checks on prospective employees. But, sometimes after an interview or because of a time crunch, this simple detail is overlooked. A story reported by ABC News out of California on June 26, 2014 on a nanny who refuses to work and leave the premises serves as a good reminder of the need to run comprehensive background checks on prospective employees.[1] As reported by Sarah Figalora,

A California family is stumped about what to do with a live-in nanny they say refuses to work, refuses to be fired and refuses to leave.

In fact, Marcella Bracamonte claims that the nanny, Diane Stretton, has threatened to sue the family for wrongful firing and elder abuse. . . .

Bracamonte called the police, but the cops declined to do anything, saying it was a civil matter. Lt. John Moore of the Upland Police Department confirmed to ABC News that there is no immediate action that can be taken against Stretton, saying "generally, once somebody has established residency, you have to go through a formal eviction process.�

Bracamonte soon realized that this was not Stretton�s first time with legal matters. Stretton reportedly has been involved in 36 lawsuits, landing herself on California�s Vexatious Litigant Lists for repeatedly abusing the legal system.

While the experience of the Bracamonte family is certainly unusual, it serves as a good example of the need to run thorough background checks on employees and to double check references. Employees do misbehave and are often the cause of data breaches and other security lapses. See for example, Former Employee of a Florida Medical Center Pleads Guilty to Identity Theft.

Aside from issues related to identity theft, employees with access to company funds have also been prosecuted for embezzlement. For example, in the dental space, it is often stated that three out of five dental practices are being embezzled from. Further, in a 2012 Ponemon Institute report, the organization found that "[o]n average, it takes 87 days to first recognize that insider fraud has occurred and more than three months (105 days) to get at the root cause of the fraud [and that according] to 73 percent of respondents, an employee�s malfeasance has caused financial loss and possibly brand damage."[2] With the costs of data breach notification and remediation increasing, these are pretty frightening statistics that all business owners should take to heart (particularly those where employees have misused information to commit identity theft).

While running background checks is important, they must also be done in accordance with both federal and state legal requirements. It is important to remember that any background check must be job-related and consistent with business necessity.The Federal Trade Commission and the Equal Employment Opportunity Commission (EEOC) have been particularly active in this space recently, because of their concerns that employers are using criminal background checks to exclude applicants. As the EEOC and the FTC have clarified:

Except for certain restrictions related to medical and genetic information (see below), it's not illegal for an employer to ask questions about an applicant's or employee's background, or to require a background check.

However, any time you use an applicant's or employee's background information to make an employment decision, regardless of how you got the information, you must comply with federal laws that protect applicants and employees from discrimination. That includes discrimination based on race, color, national origin, sex, or religion; disability; genetic information (including family medical history); and age (40 or older). These laws are enforced by the Equal Employment Opportunity Commission (EEOC).

In addition, when you run background checks through a company in the business of compiling background information, you must comply with the Fair Credit Reporting Act (FCRA). The Federal Trade Commission (FTC) enforces the FCRA.[3]

Aside from federal laws, many states also have laws addressing pre-employment background screening. In Florida, for example, Chapter 435 of the Florida Statutes addresses employment screening. Some states also have laws addressing whether social media information may be used as part of pre-employment screening.

A Few Outside Resources:

Privacy Rights Clearinghouse - Employment Background Checks: A Jobseeker's Guide - https://www.privacyrights.org/employment-background-checks-jobseekers-guide

FTC - Consumer Information: Employee Background Checks - https://www.consumer.ftc.gov/media/video-0026-employee-background-checks

EEOC

Background Checks - What Employers Need to Know - https://www.eeoc.gov/eeoc/publications/background_checks_employers.cfm
Pre-Employment Inquiries and Arrest & Conviction - https://www.eeoc.gov/laws/practices/inquiries_arrest_conviction.cfm.

-----------------------------
[1] Sarah Figalora, Family Stumped by Fired Live-In Nanny Who Won't Leave, ABC News, Good Morning America, June 26, 2014, https://abcnews.go.com/US/family-stumped-fired-live-nanny-leave/story?id=24316229.

[2] Press Release, Ponemon Institute, Ponemon Survey Indicates the Growing Threat of Insider Fraud Not a Top Security Priority for Organizations, Proves a Costly Mistake (Feb. 28, 2013), available at https://www.ponemon.org/news-2/49.

[3] EEOC, Background Checks - What Employers Need to Know, A joint publication of the Equal Employment Opportunity Commission and the Federal Trade Commission, https://www.eeoc.gov/eeoc/publications/background_checks_employers.cfm (last visited June 29, 2014).
---------------------

Posted by: Tatiana Melnik on June 29, 2014

Target's Data Breach Costs Reach $148 Million

Wed, 06 Aug 2014 09:51:19 EST

In a Press Release issued on August 5, 2014, Target Corporation announced that its costs to address the December 2013 data breach have reached approximately $148 million. This number is "partially offset by a $38 million insurance receivable,"[1] of the $100 million network security insurance coverage available.[2]

The Company further noted that, "[e]xpenses for the quarter include an increase to the accrual for estimated probable losses for what the Company believes to be the vast majority of actual and potential breach-related claims, including claims by payment card networks." In its 10-Q report from May 29, 2014, Target advised that it expects these claims to "include amounts for incremental counterfeit fraud losses and non-ordinary course operating expenses (such as card reissuance costs) that the payment card networks believe they or their issuing banks have incurred."[3] Interestingly, Target specifically noted that, "[w]hile an independent third-party assessor found the portion of [its] network that handles payment card data to be compliant with applicable data security standards in the fall of 2013, the forensic investigator working on behalf of the payment card networks claimed that [Target was] not in compliance with those standards at the time of the Data Breach."[4]

As of May 29, Target also had more than 100 actions filed against the Company "on behalf of guests, payment card issuing banks, shareholders or others seeking damages or other related relief, allegedly arising out of the Data Breach."[5] Additionally, Target reported that "State and federal agencies, including the State Attorneys General, the Federal Trade Commission and the SEC are investigating events related to the Data Breach, including how it occurred, its consequences and [Target's] responses."[6]

On July 24, 2014, U.S. District Judge Paul Magnuson, U.S. District Court, District of Minnesota, rejected Target's motion to stay discovery in a multidistrict litigation over the data breach. Target requested the stay pending the court's decision on a motion to dismiss that Target intends to file, noting that, "any motions to dismiss will be fully briefed by the end of October in the bank cases and the end of November in the consumer cases."[7] Judge Magnuson ruled that, "[g]iven the Court's practice of issuing rulings on dispositive motions within one month of the hearing date, if not sooner, discovery will have proceeded for only a few months by the time the Court rules on Defendants' motions. Ninety days' worth of discovery does not impose such a burdensome expense to warrant disturbing the case's schedule."[8] Discovery is scheduled to begin in September 2014.

A few comments.... Data breach remediation is clearly expensive. The Target incident is also a good reflection of what we continue to see in the market for both payment card and protected health information related data breaches - numerous class actions combined with federal and state government investigations. Additionally, as noted by Target in its 10-Q report, a third-party vendor found Target in compliance "with applicable data security standards" (presumably PCI-DSS) in fall 2013, but "the forensic investigator working on behalf of the payment card networks claimed that [Target was] not in compliance with those standards at the time of the Data Breach." Organizations storing personally identifiable information, whether it be credit card data or medical records, must carefully assess their risk on a continuous basis.

-------------------------------------------

[1] SEC, Form 8-K, Target Corporation, Aug. 5, 2014, available at https://investors.target.com/phoenix.zhtml?c=65828&p=irol-sec.

[2] SEC, Form 10-Q, Target Corporation, May 29, 2014, p. 9, available at https://investors.target.com/phoenix.zhtml?c=65828&p=irol-sec.

[3] Id. at 8.

[4] Id. at 8.

[5] Id. at 9.

[6] Id. at 9.

[7] In re: Target Corporation Customer Data Security Breach Litigation, MDL No. 14-2522, Order, July 24, 2014 (Court Order denying Defendants� Motion to Stay Discovery (Docket No. 125)), available at https://www.mnd.uscourts.gov/MDL-Target/Orders/2014/2014-0724-14MDL2522-Order.pdf.

[8] Id.

-------------------------------------------

Posted by Tatiana Melnik on August 6, 2014