Articles Posted in Technology

Published on: | by

On July 11, 2014, the privacy watchdog, Electronic Privacy Information Center (“EPIC”) filed a formal complaint with the Federal Trade Commission (“FTC”) against Facebook. EPIC alleged that Facebook broke the law by secretly monitoring users’ emotions in response to news feeds. The complaint explains that Facebook deceived users through its psychological experiment because the users did not give prior consent to participate in the experiment and they were not aware that an experiment was taking place. EPIC stated that this could also be a violation of the guidelines for experiments involving humans. In a world where social media and online presence dominate interaction, such social experiments threaten to undermine privacy and expose the most personal information to marketing and commercial techniques.

What Was the Nature of Facebook’s Experiments?

Facebook conducted surveys to determine whether seeing positive or negative updates in news feeds impacted users’ emotions and altered their browsing tendencies. It controlled the newsfeed of nearly 700,000 members to study whether positive and negative news reports impacted online behavior. The findings from this study were reported in the Proceedings of the National Academy of Sciences. The issue underlying the EPIC complaint arose because Facebook did not warn users in their Data Use Policy that it would be using their data for research purposes. Other agencies have also threatened to take action against Facebook. The Center for Digital Democracy and regulators in the United Kingdom have stated an intent to file complaints. Indeed, the United Kingdom’s Information Commissioner’s Office intends to address its concerns with Facebook after it reviews the study and its findings. Facebook responded to these allegations by explaining that all users consent to this type of research when they sign up. Representatives did apologize to the public for the misunderstanding.

Continue Reading ›

Published on: | by

The smartphone has brought a world of possibility to the average consumer’s fingertips. Now, this has come to include mobile banking. With fast-paced lifestyles and long lines at the banks, mobile banking has emerged as a thrilling convenience. However, this convenience brings cybersecurity concerns. Therefore, consumers who have turned to mobile banking for their financial needs must protect their financial privacy from cybersecurity breaches.

What Is Mobile Banking?

Mobile banking allows customers to access their financial institutions and conduct transactions through their mobile devices. Initially, this began with SMS Banking, which allowed customers to conduct various financial transactions by sending and accepting SMS messages or “texts.” In its most basic form, mobile banking allows customers to access their bank accounts and check on financial transactions. However, as the systems have progressed, customers can now make bill payments, transfer funds, and monitor deposits. Indeed, customers can now manage their investment portfolios and rearrange their investments through a smartphone or tablet. This has certainly increased everyday conveniences. However, it has also contributed to the speed with which finances can shift. Although, customers can review and monitor their accounts faster and more regularly, this also means greater security threats for the underlying financial information. This expansive access may lead to greater unauthorized breaches.

Continue Reading ›

Published on: | by

In the aftermath of high profile cybersecurity breaches, businesses and consumers are alert to the real dangers of cyber vulnerability. In response, various government agencies have taken up efforts to protect against future breaches. Thus, consumers and businesses must continue to take steps to protect themselves and their private information. Accordingly, the office of California’s Attorney General has issued Cybersecurity Guidelines aimed at reducing the threat of electronic security leaks. Furthermore, these guidelines set the standard that businesses must meet to protect customer privacy.

What Are Attorney General’s Cybersecurity Guidelines?

The Attorney General outlined the basics steps to “minimize cyber vulnerability.”  First, anyone could be a target. Therefore, assume cybersecurity could affect you and take preemptive steps to protect your network.  Also, it is important to know where you store your data. The guidelines are directed towards small to medium-sized firms.  So, they focus on the importance for businesses to know which third parties hold company information. It is important to be familiar with these third-party security measures. If a data storage company is not taking proper steps to protect cybersecurity, it may be time to seek different storage options or take steps to counter the vulnerabilities. Alternatively, if your business stores information on the cloud, make sure to back up information, and store data only with secure entities. The overall point is that in the event of a breach, the level of preparedness will limit the consequences.  Next, encrypt your data as an added measure of security. It is also helpful to include firewall and antivirus protection on all devices.  Additionally, make sure to conduct banking and other financial transactions with reliable vendors.  Especially when dealing with third party financial information, the safety and security of those transactions are vital to ongoing business.  Finally, it is important to note that these guidelines are the minimum requirements. It is not a comprehensive list and companies must take care to implement personalized measures based on their cybersecurity needs.

Continue Reading ›

Published on: | by

The expansion of cyber consumerism—buying and selling products over the Internet, or engaging in business over the Internet—has called into the question whether international laws are equipped to protect consumers in their online transactions. Indeed, online business often takes place over several countries, implicating the legal standards in those countries. When such transactions involve a party that is more experienced than the other, there is the potential that the experienced party will take advantage of the disparity for financial gain. Accordingly, countries around the world have enacted and adopted legislation to combat the threat of unfair business practices. These provisions aim to protect online transactions to promote successful international business.

What Are Unfair Trading Practices?

Unfair trading practices include fraud, misrepresentations, and unconscionable business acts. Fraud is the act of providing false information in a transaction for personal financial gain at the expense of the other party. Misrepresentation involves providing misleading information about any part of a transaction—for example, the quality of the product in question. Finally, unconscionable acts deal with contract terms or negotiations that are overwhelmingly one-sided. These favor the party with greater bargaining power or business experience. The threat of these practices may arise in all sorts of business contexts—for example, insurance contracts, commercial and residential lease provisions, debt collection efforts, and general purchases.

Continue Reading ›

Published on: | by

Early in 2012, the European Commission proposed a reformation of the European Union’s data protection rules.  The European Commission sought to strengthen online privacy rights and improve Europe’s digital economy. The European Commission pointed to expansive globalization and different levels of implementation by the EU’s 27 member states as reasons to seek uniform online privacy rights. Indeed, each member state has different standards of enforcement for the rules. This leads to expensive administrative costs in maintaining and continuing to implement the different standards. The European Commission predicated that a uniform law across the European Union would lead to savings of approximately 2.3 billion Euros a year. In addition, with a clearer set of regulations to govern data protection, the European Commission hoped to instill more confidence in consumers in online services, leading to a growth in jobs and innovations.

What Were the Terms of the 1995 Data Protection Directive?

The 1995 Data Protection Directive was adopted to regulate the processing of personal data among European Union member states. This Directive has a broad definition for “personal data,” including “any information relating to an identified or identifiable natural person.” Also, the standards within the Directive apply only if the entity controlling personal data is established within the European Union or uses equipment located therein. The standards prohibit the processing of personal data without transparency of purpose, a legitimate purpose, and proportionality. In terms of the requirement for proportionality, a controller can process personal data only to an extent necessary to its purpose—it cannot store that data for a potential future purpose.  However, the 1995 Directive fails to take into account the implications of social networks and cloud computing on online privacy.

Continue Reading ›

Published on: | by

Employees, in the course of their employment, will often have broad access to company files.  If employees are terminated or seek other employment, such access can become problematic.  Indeed, companies store sensitive and commercially valuable information on their servers. Employee misuse of these files can substantially weaken a company’s economic viability and threaten its progress.  In a recent court decision, the United States District Court for the Northern District of California held that a former employee who accessed an employer’s servers using his login information was not liable for unlawful hacking. The court explained that the employee had not violated the Computer Fraud and Abuse Act (“CFAA”) or the California Comprehensive Computer Data Access and Fraud Act (“CDAFA”).

What is the holding in Enki Corporation v. Freedman?

According to the record, Enki Corporation had entered into a contract with Zuora to provide certain consulting and information technology services. As part of these services, Enki installed a computer resource and performance monitor on Zuora’s network. Additionally, Enki contracted with Keith Freedman, a former employee, to provide consulting services for Zuora. Enki subsequently terminated its contract with Freedman when it discovered that Freedman was speaking negatively about Enki’s services. Freedman had also accessed the monitor Enki installed on Zuora’s network using his employee login to download Enki’s proprietary information (e.g., private company files and data) from the servers. The court held that this did not violate the CFAA because Enki had failed to show that Freedman accessed the computer system without authorization. Since the CFAA is aimed at regulated access to protected data, not the misuse of such data, where employers lawfully access servers, there is no CFAA violation. As for the CDAFA claims, the court also did not find a violation because Freedman did not have to “hack” into the system because he did not have to override a computer code. He simply logged in using his employee login information.

Continue Reading ›

Published on: | by

With the advent of virtual currency, consumers can now conduct entire transactions online without the burden of having to seek a common currency. Bitcoin has spread across the world as a popular form of this currency. In turn, transactions can now take place without switching from one form of currency to another (e.g., conversion from U.S. Dollar to Euro). On March 25, 2014, the Internal Revenue Service (“IRS”) issued guidelines regarding its approach to virtual currency, such as Bitcoin. Under these guidelines, the IRS will treat virtual currency as property, not currency, for federal tax purposes. Accordingly, the tax principles that typically apply to property will now apply to transactions involving virtual currency.

What Is Bitcoin?

Bitcoin is a form of virtual currency.  An unknown individual using the alias Satoshi Nakamoto created Bitcoin in 2009. This virtual currency allows for online transactions without bank issued transactions fees. People store their Bitcoins in a “digital wallet” on a personal computer or on the cloud. This serves as an online bank account, which can send and receive Bitcoins. Then, people use this currency to conduct transactions. However, unlike funds stored in a traditional bank account, the Federal Deposit Insurance Corporation (“FDIC”) does not insure Bitcoin wallets. Furthermore, transactions can now take place entirely anonymously. Online consumers do not have to provide bank accounts or other financial information. Therefore, it becomes nearly impossible to trace transactions using virtual currency. Bitcoin is becoming increasingly popular and more merchants accept this currency for all types of transactions. International transactions can also take place without fees from foreign countries or conversion fees. Consumers can also “mine” Bitcoin, which involves competitions to solve complex computer-based math problems to win additional Bitcoins. Bitcoin is also a valuable investment, with people purchasing Bitcoin to profit from increases in its value.

Continue Reading ›

Published on: | by

In recent years, there has been an increase in cyber-attacks directed towards usernames and passwords for online banking accounts.  Through these attacks, outside parties have been able to misuse banking information for fraudulent wire transfers.  Hackers have starting using foreign accounts because it is more difficult to recover funds when dealing with some foreign banks.  Online banking fraud has led to over $40 million in stolen funds from small and mid-size companies.  Recently, the nature of these attacks have become more complex as regulatory agencies, e.g., FDIC, and enforcing agencies, e.g., FBI, scramble to keep up with changing technologies.

How Have Online Cyber-Attacks Changed In Recent Years?

In recent years, online banking fraud has become dramatically more sophisticated.  Now, hackers have the capacity to infect not only small, local sites, but also high-volume webpages all across web.  These hackers infect popular websites with Trojan viruses, which latch onto users’ computers when they visit the website.  The virus then directs to online banking information, such as account numbers and login information, allowing the hackers to access these accounts and conduct fraudulent transactions.  The virus may even have the capacity to record and hold this information itself.  To carry through the cyber-attack, criminals only need to setup funds transfers without the respective bank noticing.  Banks learned to watch for transfer activity from unknown computers, so now hackers steal victims’ IP addresses to avoid detection.  With this information, the transfer looks like a typical transaction from the user’s computer.  The hackers may obtain the ability to take control of a computer and use it to conduct fraudulent transfers.

Continue Reading ›

Published on: | by

The expansion of social media networks has helped connect people and ideas all over the world. However, it has also raised substantial privacy concerns as more people store personal information on the web. Congress has enacted legislation in an effort to circumvent the dangers associated with online networks–for example, the Electronic Communications Privacy Act, the Child Online Privacy Protection Act, and the Stored Communications Act. States have also passed their own legislation to help protect cyber activity within their jurisdiction. For example, California passed “Do Not Track” legislation in November 2013 requiring websites to disclose their tracking practices. These laws, along with several others, work to protect individuals, entities, and their related private information as they continue to operate and conduct business over the Internet. Recently, a federal court applied the Stored Communications Act and found that it is applicable to a user’s wall posts.

What Are The Provisions of the Stored Communications Act?

In 1986, Congress passed the Stored Communications Act (“SCA”) which is codified under 18 U.S.C. §§ 2701 et seq.  The SCA aims to protect privacy interests implicated throughout electronic communications. Various court holdings have interpreted the SCA to apply to non-public electronic communications that take place over electronic communication services in an electronic storage medium. Violations of the SCA may carry potential criminal penalties, including serving time in prison. The penalties and liabilities will generally depend on the circumstances of the violation. The SCA does allow Internet service providers to share “non-content” with another person or entity. This includes log data and recipients’ email addresses. Still, this is a limited exception to the general rules and the SCA is still prohibited with sharing any information with a government entity. The government may compel Internet service providers to provide stored information. For electronically held communications, the government is required to have a probable cause and obtain a search warrant. For communications stored remotely, the government only needs a subpoena or a court order. Hence, remotely stored data enjoys a lower level of protection since it is easier to submit a subpoena rather than to obtain a search warrant.

Continue Reading ›

Published on: | by

In recent years, electronic spam has become a public nuisance. In response, several states, including, but not limited to, California, have enacted statutes to prevent electronic spam. As with most legislation that deals with the constantly-changing nature of the web, these statutes struggle to define the extent of their application while staying current with trends. Therefore, courts are charged with the responsibility of interpreting the intent of these laws.

What Are The Provisions of California’s Anti-Spam Statute?

In fact, California’s Business and Professions Code section 17529.5 prohibits any person or entity from sending commercial email advertisements, or spam, in three defined circumstances. First, spam is prohibited if an email advertisement uses a third-party domain without the third-party’s permission. Second, the statute prohibits email advertisements that use misrepresented information in the header. Finally, it is unlawful to use a subject line that is reasonably likely to mislead a recipient about the content or subject of the message. This section applies if the email is sent from California or if it is sent to a California email address. Accordingly, the reach of California’s legislation into other jurisdictions is also an issue for courts to interpret. Furthermore, a party bringing suit may recover both actual damages and liquidated damages. Liquidated damages are limited to $1,000 for each unlawful email and may go up to $1,000,000.

Continue Reading ›