The Blockchain Ecosystem

Dror Futter, a Venture Capital and Technology Partner at Rimon, P.C. has authored a comprehensive update on the state of blockchain law, which has been published by The Journal of PLI Press, the quarterly journal of the Practicing Law Institute The Current, (Winter 2018 Edition; Vol. 2, No. 1, Winter 2018 – Page 21.   The article summarizes developments in the blockchain ecosystem to date, draws attention to considerations that participants in that ecosystem should take into account and also highlights many currently unanswered legal questions.

In addition to a growing blockchain practice, Mr. Futter focuses his practice on startup companies and their investors, and has worked with a wide range of technology companies.  You can read the entire article right here: Blockchain Law ICO Regulation and Other Legal Considerations in the Blockchain Ecosystem and if you need more information you can contact Mr. Futter directly or if you want to know more about his practice click here.  Of course, you can always contact me, Joe Rosenbaum, or any of the Rimon lawyers with whom you regularly work.

 

Global Social Media Handbook

I am proud to be among the 22 legal professionals, including 7 of my colleagues at Rimon, who contributed and co-authored a new book entitled Handbook on Global Social Media Law for Business Lawyers, published by ABA Publishing. This comprehensive work, sponsored by the Business Law Section of the American Bar Association, was co-edited by Valerie Surgenor, a partner in the Glasgow, Scotland, law firm MacRoberts LLP and John Isaza, my friend and partner here at Rimon, P.C.   Although principally focused on the United States, there are contributions from foreign lawyers in key regions around the world, including Canada, the European Union, Australia, Russia and Asia.

The Handbook deals with national and international law principles and emerging issues related to social media law, ethics, compliance and governance, including cybersecurity, cyber terrorism and risk management in a social media environment (e.g., hacking, corporate espionage, data loss and data breach); intellectual property issues in social media;  defamation, “fake news” and social media;  implementation of a social media crisis plan; use of social media as a tool in recruitment of employees and the privacy implications to employers;  promotional, endorsement and social media disclosure guidelines promulgated by the Federal Trade Commission in the US; and recent trends in UK and European social media legislation and regulation.  There is a separate chapter that discusses information and records management within the context of social media.

If you are interested, you can order a copy directly from the ABA (Handbook on Global Social Media Law for Business Lawyers) and of course, if you need more information or want to discuss your particular requirements with knowledgeable and experienced professionals, feel free to reach out to me, Joe Rosenbaum, or to any of the lawyers at Rimon with whom you work with regularly.

 

US-EU Data Transfer Privacy Shield

Being referred to by the European Union as the most important change in data privacy regulation in 20 years, the new EU General Data Protection Regulation (GDPR) comes into effect on May 25, 2018.  There is even a ‘countdown’ clock on the website and under the GDPR, “Personal Data” means information relating to an identified or identifiable natural person (including email addresses, telephone numbers, addresses and IP addresses).   While the European Commission has determined a number of countries already meet the ‘adequate protection’ test, the United States is not one of them!

As most readers of Legal Bytes already know, personal data cannot be transferred to from the EU to a non-European Union/European Economic Area country, unless that country can ensure “adequate levels of protection” for such personal data.

As background, in July of 2016, a new framework for the movement of personal data between the EU and the US was finalized – EU-U.S. and Swiss-U.S. Privacy Shield Frameworks – which was put into place in an effort to meet the requirements of the EU Data Directive.   However, critics noting the holes in that framework, have generated increasing concern as the 2018 effective date of the new EU GDPR approaches.   A few months ago, immediately following the inauguration ceremony, President Trump issued United States’ Executive Order 13768 (January 25, 2017) that has created even greater concern.  While it is possible a new or refined agreement and framework may be put into place in the months leading up to 2018, there is no certainty.

What do you need to know? What should you consider doing now?   My colleague Jill Williamson has written an article which has been published in Risk & Compliance Magazine, entitled “The Fragile Framework of the Privacy Shield“.   If you want to know more about the privacy and data protection implications of the new framework, its potential risks to your business and what you should be considering as you look to the future, feel free to contact Jill Williamson directly.  Of course, you can always contact me, Joe Rosenbaum, or any of the Rimon lawyers with whom you regularly work.

Dear WikiLeaks, Here We Come. Sincerely, The Wall Street Journal.

The Wall Street Journal just announced it has established a secure mechanism that allows “newsworthy” materials to be uploaded to its separate, but internal, secure servers. The new service, Safehouse, is a logical outgrowth of the age-old newsgathering function. That noted, one can only imagine everyone scratching their heads saying, “What took you so long?” considering the international notoriety garnered by the most visible recent leak-gathering organization, WikiLeaks.

Legal Bytes was certainly not alone in highlighting the WikiLeaks phenomenon (see IMHO – Wiki Wiki True to Its Meaning), so it’s a bit surprising that traditional news organizations had not previously moved aggressively into the digital technology age with their news-gathering activities. That said, kudos to the industry for opting to enter the digital age on the input side of the process and create competition in this arena, just as competition among journalists has existed for centuries.

The presumption is the WSJ upload process will be secure and apparently anonymous – the accumulation of anonymous and pseudonymous tips, leaks and leads has long been part of every investigative reporter’s and journalist’s job. Other news organizations are also rumored to be working on similar services, although not having done an investigation myself, others perhaps may have already launched. The WSJ service will reportedly provide encrypted digital file transmissions and, according to the Safehouse website, will seek to minimize the amount of technical information (read that to mean, traceable information) that the service receives on its servers.

Joseph I. (“Joe”) Rosenbaum is a partner in the New York office of Rimon, global chair of its Advertising Technology & Media law group – oh, and is the editor, publisher and often author of posts on Legal Bytes.

IMHO – Wiki Wiki True to Its Meaning

According to Tech Terms, “wiki” comes from the Hawaiian phrase “wiki wiki,” which means “super fast.” I guess if you have thousands of users launching denial of service attacks (see below) against targeted web sites – well “super fast” spells super trouble. Which has prompted me to write this article “IMHO” (in my humble opinion) – IMHO being a social media nod to the kewl gnu SMS lingo.

So, doesn’t it seem as if this WikiLeaks thing has gotten out of hand? Now in fairness, in my view there are intelligent points being made on both sides of the issues – national security is important; so is freedom of the press and speech. There are also rights and responsibilities on both sides of the issues – private censorship is not something that sits well with those of us who value the right to hear and voice differing opinions and thoughts; yet using a “free speech” argument to allow someone to scream fire in a crowded theatre – even when none exists – can cause harm to innocent people and is, again in my view, irresponsible, if not illegal.

So if you have been following this Wikileaks issue, you already know about the leak of U.S. diplomatic cables by or through WikiLeaks, and unless you have been living under a rock, you have also noticed the arrest of WikiLeaks founder, Julian Assange. All of this has resulted in a dramatic and well-publicized series of “cyber attacks” from “hacktivists” primarily using a disruptive technique known as “denial of service attacks.”

Curiously, the arrest of Mr. Assange in London has nothing to do with the current controversy over confidential and sensitive material that is giving rise to the tensions across the Internet. Mr. Assange’s legal problems stem from an international warrant issued by Sweden, where he is accused of rape, molestation and unlawful coercion by two women in connection with sexual encounters he reportedly had while he was in Sweden last summer. Mr. Assange apparently confirmed the encounters, he has denied the allegations of assault, and he has not yet been formally charged in either of the women’s cases.

The disruptions on the Internet and outcry against his treatment (or the treatment of his company) are not about his personal problems, but rather have taken on a life of their own as a poster child for the principle of “information needs to be free.” Somehow, WikiLeaks has become a symbol, a rallying cry, for the cause of free speech and information transparency, being championed by activists around the world, the activities of some of whom has allegedly already resulted in:

  • The Swedish government website http://regeringsen.se was offline for several hours, and arms of the Swedish postal service, the websites of Swedish prosecutors, and at least one lawyer, were the targets of attacks.
  • Both MasterCard and Visa, whose banking and financial institution members stopped accepting payment transactions in support of either WikiLeaks or Mr. Assange’s defense, were subject to attack (e.g., reportedly Visa’s website and MasterCard’s “secure code” system was affected – in the case of MasterCard, apparently preventing some online transactions from being processed for several hours.
  • Just today we read of allegations and reports that Sarah Palin’s credit card information and the website of her political action committee were hacked because she referred to Mr. Assange on ABC News yesterday as “an anti-American operative with blood on his hands,” and U.S. Senator Lieberman’s website was impaired and anonymous SPAM faxes sent to the Senator’s office after he called for an investigation of The New York Times, which had published articles with details of the diplomatic cables leaked by WikiLeaks.

As Mr. Spock, the iconic “Star Trek” character played by Leonard Nimoy, might have remarked well into the future: “Fascinating!” Well the future is now.

So what should you do? First you should read my partner, Douglas J. Wood’s recent opinion piece on Corporate Counsel, entitled “Say Hello to the World’s New Sovereign Nations: Facebook, Google and RIM.”  (subscription required) When you finish, head straight to YouTube and watch the clip (my title) “There’s a War Out There” from the incredibly prescient motion picture “Sneakers,” with Ben Kingsley and Robert Redford. You might also grab a copy of An Army of Davids: How Markets and Technology Empower Ordinary People to Beat Big Media, Big Government, and Other Goliaths, by Glenn Reynolds. Oh, and in case anyone is thinking about my Legal Bytes post more than a year ago, entitled FTC (Revised) Endorsement Guides Go Into Effect, rest assured I have no interest (other than intellectual) in either my partner’s publication, the motion picture production, or the book or publishing company noted.

It is likely, some of the “attacks” may lead to criminal prosecution or civil litigation, or both. It is also likely that companies and governments may rethink their security and dependence on digital technology, as well as their activities and responses to events such as these. Protests of this nature, irrespective of one’s view or one’s “side,” are now occurring on a scale, orchestrated by individuals dispersed throughout the globe, in a manner that might make taking to the streets or holding passive sit-ins or hunger strikes in the halls of legislative bodies passé. Further, the effects of such activities on innocent people should not be underestimated. While the United States holds dear the Constitutional rights of free speech and freedom of the press, that does not include the right to create panic or harm or injury to others. There is a line between voicing one’s support and opinion, freely heard in the blogosphere, and illegal conduct that damages persons and property.

So after reading this and the references cited, ask yourself the following question: Is this a technology problem? A political problem? A national security problem? A public relations problem? A legal problem? It is probably worth noting, since my partner Doug Wood mentioned it after reading a draft, that the freedoms of speech and the press (and assembly, etc.) that are embedded in the U.S. Constitution are not the norm around the world. We often lose sight of the fact that these rights (and the passion and zealousness with which we cherish them and defend them) are not the global norm – yet. But, technology has enabled activities and communication unimaginable in the past. It can be a force for good or bad – sometimes both. Now comes the revolution? Fascinating! But that’s just my opinion.

Joseph I. (“Joe”) Rosenbaum is a partner in the New York office of Rimon, global chair of its Advertising Technology & Media law group – oh, and is the editor, publisher and often author of posts on Legal Bytes.

When Pressing Suits, Judges Tell Jurors Neither Social Nor Media is OK

A few months ago, Legal Bytes reported some important developments and judicial rulings concerning social media and freedom of the press in the United States (see, Freedom of the Press = Freedom to Tweet). But lest you be lulled into a false sense of security, freedom of the press only applies to the ‘press’ and not to jurors.

You have all seen the motion picture and television courtroom scenes played out numerous times. Evidence is admitted or not admissible. The jury is admonished to disregard certain remarks or testimony as inadmissible or irrelevant. Jurors are told they must reach a verdict on only the evidence that is allowable during the trial – nothing else. Now decades ago, a jury was told not to watch accounts of a case on television, or to listen to such on the radio, or to read newspaper articles about the case. Juries could be sequestered – squirreled away out of sight and, theoretically, out of harmful evidence’s way – until the verdict was rendered and justice done.

But today, with a mobile phone, PDA or any one of literally hundreds of devices – some no larger than a credit card – one can ‘tweet’ (www.Twitter.com), one can post to your or someone else’s wall (www.Facebook.com), one can upload photos (www.flickr.com) or videos (www.YouTube.com) or post to one’s own blog (www.LegalBytes.com). All from the convenience of the palm of your hand, purse or jacket pocket. One can also surf, search, ask and obtain answers across the web, almost instantaneously, with the press of a few buttons or the wave of one’s fingers across a touch screen. The interactive two-way communication and searches for independent information is at odds with our jury system that limits the juror’s knowledge base for decision-making purposes to what’s in her or his head when they walk in along with the evidence that is presented and deemed admissible by the court. Everything else is off limits – at least for administering justice. Although not the subject of this two-part blog posting, Legal Bytes has also covered the growing issue of whether a mindless application of disqualification criteria makes sense simply because you have a ‘friend’ or someone is ‘following’ you among the other thousands or millions of individuals on some social media platform (See, Florida Judges Can’t Have Friends).

But now back to our story. Just this past December, the Judicial Conference Committee on Court Administration and Case Management issued its “Proposed Model Jury Instructions – The Use of Electronic Technology to Conduct Research on or Communicate about a Case”. I know this will surprise you, but the basic do’s and don’ts they proposed are:

  • Thou shalt not undertake any independent research, use any outside reference works, dictionaries, surf the web, or use any digital or other means to try and get information about the case or anything related to the case.
  • Thou shalt not communicate with anyone about the case – anyone – not even other jurors. No mobile phones, email, Blackberry, iPhone, SMS text messaging, tweets, blogging, chat rooms or social media platforms. None, nada, zilch, zero, null, never. Period.
  • Thou shalt decide the case solely on the admissible evidence presented in the courtroom.

Sound familiar? While many of us recognize there are sophisticated rules and regulations established to ensure evidence is presented in a fair manner, consistent with the system of justice – protecting the rights of the accused and the accuser, the plaintiff and the defendant – jurors often are curious – curious about questions that aren’t asked or answered during the course of a trial. In motion pictures or television, we get to go behind the scenes. We can often see what the jury cannot. But real juries may not appreciate, under the constraints of a particular case, why some information is simply not available to them, some questions not permissible, some witnesses never called and some answers never provided. It’s far too tempting to try and find out and with today’s digital technology – well, it’s not that hard to do so – sometimes even believing one can escape detection when doing so.

So stay tuned. In the next installment of this post, Legal Bytes will take you on a brief tour of some court decisions over the last few years, starting from simple emails and online surfing by jurors, to jurors who post blogs in the middle of jury deliberations, to tweets before, during and after multimillion dollar civil trials. Yes, we even have jurors communicating to each other on Facebook during a trial. You just can’t make this up.

While the next installment is pending, if you need to know more – how social media can help or hurt your company in litigation – remember that Rimon has teams of litigators who not only know digital (e-)discovery, forensic evidence, security and other technology applicable to legal proceedings, but also know social media – increasingly relevant, for good or bad, in dispute proceedings. Need us to press your suit and avoid being taken to the cleaners? Contact me, Joseph I. Rosenbaum or any Rimon attorney with whom you regularly work and stay tuned for Part II – Jurors Behave, or We’ll Throw the Facebook at You!

Freedom of the Press = Freedom to Tweet

Twitter keeps hitting the newswires—in this instance, in a matter involving freedom of the press. You might have heard from time to time, especially in high-profile or emotionally charged cases, about judges who have used their power to control proceedings by restricting the use of certain communications equipment and mechanisms from within their courtrooms (e.g., use of mobile phones, video recording equipment, etc.).

From Pennsylvania comes an order from a Dauphin County judge refusing to bar reporters from sending Tweets during the course of a public and high-profile trial. In response to a motion by the defendants counsel, Judge Lewis, in a brief order, noted that “. . . to impose the proposed restriction would be premature and that the restriction itself is overly broad.”

In this particular case, the defendants were concerned that reporters, using Twitter inside the courtroom, would broadcast witnesses testimony, which could then be read or seen by other witnesses who were yet to testify. While refusing to ban Twitter to reporters, the judge did order the witnesses to avoid reading or listening to reports concerning the trial.

As icing on the cake, our own Rimon lawyers, Tom McGough, Mark Tamburri and Tom Pohl, won the order on behalf of the Associated Press and Pittsburgh Post-Gazette. Yes, Virginia, there is a place for social media in jurisprudence.

If you remember, Twitter was also the subject of some controversy in Pittsburgh during the G20 Summit last year. In that case, involving freedom of speech, police in Pittsburgh arrested a man who was using Twitter to send messages about the movements of police officers as protests were unfolding. Although the police sought to charge the man with aiding an illegal protest, the man was broadcasting what was easily visible in plain sight.

While commercial cases often involve money or intellectual property rights, or rights of publicity or privacy, cases are emerging that involve fundamental Constitutional rights. The law will need to move quickly into the digital and social media age in order to keep up. Some courts and judges are doing just that!

Need to know more? Contact me, Joseph I. Rosenbaum, or any Rimon attorney with whom you regularly work.

Privacy: FTC Announces the First in a Series of Public Roundtables

Earlier today the Federal Trade Commission announced details of the first of a series of Public Roundtables being held to deal with continuing efforts to examine, evaluate and determine if, and to what extent, regulation may be needed in connection with consumer privacy. In its announcement, the FTC specifically cites its intention to review privacy practices related to social networking, cloud computing, online behavioral advertising, mobile marketing, and the collection and use of information by retailers, data brokers and third-party applications.

The FTC’s announcement acknowledges the beneficial uses of information and technological innovation, while seeking to balance those against the need to protect consumer privacy. The first full-day session will be held Monday, December 7, 2009, at the FTC Conference Center at 601 New Jersey Avenue, N.W., Washington, D.C., and no registration is required. Those who cannot attend in person are welcome to go to FTC.gov and will be able to view the proceedings as a webcast.

The FTC has invited individuals and organizations to participate and/or to suggest topics. To participate, your request can be submitted directly to the FTC by email sent to privacyroundtable@ftc.gov on or before October 30th, and comments surrounding the issues to be discussed can be submitted on or before November 6th. The FTC has prepared a list of specific questions it intends to use in opening the dialog at this first in its series of public roundtable discussions and has invited written comments, as well as research submissions. Details can be found at the Privacy Roundtable Workshop page of the FTC’s website. Comments can be mailed to the FTC, or you can check the FTC website for instructions as to submitting comments electronically. Of course, Rimon stands ready to assist clients in preparing comments or providing representation, and if we can be of assistance, don’t hesitate to contact us. If you need to know more, please feel free to call me or the Rimon attorney with whom you regularly work.

Could the Government Seize Control of the Internet?

The text of the Cybersecurity Act of 2009 (the “Act”) is now available, and individuals, organizations and associations, and, of course, lawyers, are now starting to digest its contents.

This legislation, introduced by Sens. Jay Rockefeller (D-W.Va.) and Olympia Snowe (R-Maine), would appear to give the federal government sweeping and unprecedented authority over the Internet. Section 2 of the bill starts off with a lengthy series of observations about horrible things and consultants’ wisdom concerning our vulnerability to “attack.” Curiously, it is unclear exactly how the bill and the powers to be granted the government will correct that issue. But I digress.

So when the title of this post says “the Internet,” you’re kidding, right? Of course, you must mean government-operated networks or defense or intelligence systems, right? Well . . . not really. Hmm. Then you must mean those critical infrastructure systems related to national defense – you know, communications and transportation systems? Well . . . not exactly. You see the bill includes, within the meaning of systems and networks covered by the Act, “State, local, and nongovernmental information systems and networks in the United States designated by the President as critical infrastructure information systems and networks.” In other words, we’ll know what they are when the President tells us what they are. Comforting for federal legislation, isn’t it?

“Non-governmental” includes financial institutions – then again, the government already owns a chunk of those anyway – wired and wireless carriers, electricity grids, gas and power systems, and air and rail transportation systems, to name a few. All of these are currently in the hands of private companies and management. Go ahead, name some systems that aren’t directly or indirectly critical or connected to critical systems – my refrigerator, for instance, or your digital music account.

There is even a section in the Act that proposes to enable the President, with almost no restriction, to shut down all message traffic on the Internet in an “emergency,” and to order the disconnection of all critical infrastructure systems in furtherance of national security. Now if that amount of authority, without any guidance or parameters built into the legislation, isn’t enough, here’s more. The bill also gives the Secretary of Commerce the right to access all relevant data concerning these critical infrastructure networks without regard to any provision of law, regulation, rule, or policy that would otherwise temper or restrict such access. No standards. No limits on what data or why. No opportunity for judicial review, much less intervention.

Curiously, just this past June, the Government Accountability Office (GAO), in testimony before Congress entitled Cybersecurity: Continued Federal Efforts Are Needed to Protect Critical Systems and Information, noted that continuing efforts to remedy systems security and network vulnerability needed far less dramatic remediation – fixing things like correcting insufficient access controls, better network management, inadequate or poor audit procedures, ineffective information security programs, and in some cases, simply adding encryption where none exists today. Critics of the Act have questioned whether granting the President far-reaching and ambiguous power is proper, but just as significantly, whether they will actually deal with the problem.

As with many legislative initiatives, this appears to deal with the aftermath of a cyber-attack, not at preventing one from ever occurring. Has it occurred to anyone that mandating standards for security, updating and maintaining security where appropriate, and simply requiring government or other critical systems to practice security measures that have been known for years or even decades, is much more likely to allow the nation to avoid and withstand a cyber-attack?

One can only wonder whether placing control of the Internet in the hands of the government might actually make vulnerability to a devastating cyber-attack greater. When the ‘net was first conceived, it was precisely it’s dispersion, diversity and lack of central control that was at its core, and its endearing and enduring characteristic. No one point of control, no single point of vulnerability. Redundancy, multiple pathways, mirror image reflections and files ensured that if one part was crippled, others would continue to function. True, times change, technology changes, and, so too, must our defense mechanisms and postures. But one has to wonder whether centralizing command and control in an emergency might not just give the bad guys a single point of vulnerability and failure to concentrate on, instead of making it more difficult – precisely when we need the Internet the most. Food for thought.

For information about security (can you say PCI compliance?) or privacy (GLB anyone?) or data breach assistance (is your identity safe?) look up Joseph I. Rosenbaum, send me an email, or contact the Rimon attorney with whom you regularly work. We are happy to help.

Your Medical Information; Just A Mouse Click Away – From Hackers?

This post was written by Adam Snukal.

Kathleen Sebelius, Secretary of the Department of Health and Human Services (“HHS”), hadn’t been on the job even two months when she found herself a defendant in a class-action lawsuit brought in the Southern District of New York. A registered nurse had brought the action against Ms. Sebelius, as well as the White House Office of Health Reform Director and the Administrator of the Centers for Medicare & Medicaid Services, alleging that certain provisions of the American Recovery and Reinvestment Act (“ARRA”) violate privacy rules central to the Health Insurance Portability and Accountability Act (“HIPAA”) and the federal Privacy Act.

The suit claims that pursuant to the ARRA, the development and implementation of a new health care information technology system that will create an electronic medical records database by 2014 will include Americans who are not covered by either Medicare or Medicaid (according to the lawsuit, Medicare and Medicaid only cover approximately 23 percent of the American population). This system, according to the complaint, poses a major threat to individual privacy, placing individuals’ personal health information “just a mouse click away from being accessible to an intruder.”

The action takes issue with ARRA’s provision allowing HHS to determine what constitutes the “minimum necessary” amount of personal health information allowed to be disclosed under HIPAA. According to the suit, “This technology will be used to deprive the Plaintiff and others of their fundamental right to privacy by requiring that their medical records be released by their health care providers and upon entry into the Health Information Technology maintained under the supervision of the Secretary will be made available without the permission of the Plaintiff to an unknown and potentially unlimited number of persons.” The action seeks an injunction to prevent distribution of payments for the purchasing of the electronic health care systems.

The standard of “minimum necessary” is a central tenet of the HIPAA laws, which require that when a health care provider uses or discloses personal health information, or requests personal health information from others, the provider must undertake reasonable efforts to limit itself to “the minimum necessary amount of PHI to accomplish the intended purpose of the use, disclosure, or request.” Under this standard, providers must develop policies and procedures that limit information uses, disclosures and requests to those necessary to carry out the organization’s work. That includes identification of those within the provider’s workforce that need access to carry out their duties, and reasonable efforts to limit access accordingly. HHS has been clear that the minimum necessary standard that health care providers are required to follow calls for the employment of a “reasonableness” analysis, so that a provider’s functions are not unduly restricted.

Few elements of HIPAA have generated more controversy than this standard, but if this court elects to embrace that standard, the likelihood of the success of this action on its merits may seem remote. HIPAA places a heavy emphasis on maintaining the privacy of an individual’s personal health information, and if the ARRA regulations applicable to the manner by which health information electronic systems are permitted to collect and share personal health information are consistent with HIPAA’s standard of reasonableness, there will be a substantial burden of proof for the plaintiffs to overcome.

If you need to know, you need to contact Adam Snukal—or you can always contact your favorite Rimon attorney who will be more than happy to help you.