Published on: | by

Digital currency security and privacy laws are changing with time. We have mentioned transparency issues in previous articles. The fact that Bitcoin’s blockchain transactions are public and generally accessible can be beneficial when it comes to government investigations. Yet, it may not be the most secure platform for cryptocurrency transactions especially for legitimate businesses. So, in short, we should realize that government surveillance and subsequent investigation may be part of the deal.

The Bitcoin blockchain automatically records all transactions to show when, where, or how the digital currency was bought or sold. It does not show the true name of the associated individuals but that information can be obtained from digital currency exchanges (e.g., Coinbase), third-party wallet providers, or third-party intermediaries. In fact, state or federal anti-money-laundering laws require them to store customer records for identification purposes. So, for example, if a government agency wanted to identify the customer, it could issue a warrant without obtaining a court order. Then, the third-party recipient – i.e., a digital currency exchange like Coinbase, Abra, or Uphold – would be obligated to respond within a certain deadline. Now, if the government agency has no probable cause to issue the subpoena or warrant, then there may be a problem. There are two notable cases on this point. First, is United States v. Gratkowski, No. 19-50492 (5th Cir. 2020), where the district court held that the government was allowed to subpoena Bitcoin records from a digital currency exchange without a warrant. Second, is Harper v. Rettig, et al., where the plaintiff sued the Internal Revenue Service (“IRS”) for violating his Fourth Amendment right against unreasonable searches and seizures when it issued an informal demand letter to the digital currency exchange to obtain his financial records. Plaintiff argued that he was unlawfully subject to the government’s investigation since there was no evidence to prove he had committed a violation. Plaintiff also argued that his rights were violated under the Fifth Amendment’s Due Process Clause since the government agency seized his private financial records without prior notice. The government argued the “Third-Party Doctrine” was applicable, and as such, it should be allowed to access any kind of information that was shared with the digital currency exchanges. The Third-Party Doctrine holds that there is no reasonable expectation of privacy when an individual shares information with another party – e.g., Internet Service Provider, Digital Currency Exchange. These cases clearly show that there will certainly be an ongoing clash regarding cryptocurrency security and privacy regulations. On one hand, the government agencies will be overseeing the transactions to ensure legal compliance. On the other hand, consumers will protect their rights pursuant to the applicable state, federal, or international laws.

The government has, and will probably, continue to investigate websites for criminal activities. The government can use special tools or techniques – e.g., forensic software – to evaluate and obtain suspicious addresses from the blockchain. The next step is to send subpoenas towards third-party digital currency exchanges to trace cryptocurrency payments back to the user. The government agents can obtain more information from the digital currency exchange and determine whether they should obtain a search warrant. If so, then they can legally search the suspect’s home or other properties for more incriminating evidence. We have mentioned the Third-Party Doctrine carves out an exception to the Fourth Amendment’s principle against unreasonable searches and seizures. The courts have held that a user who submits information to a third-party digital currency exchange may not protect his privacy by using the Fourth Amendment. However, some litigants have argued that digital currency transactions are similar to cellphone location records which are protected by the Fourth Amendment under Carpenter v. United States (2018) 138 S. Ct. 2206. The district courts have rejected that comparison because cellphone location records are automatically gathered as a result of communications between the individual’s cellphone and communication service provider’s cell towers. However, the digital currency financial records are gathered as a result of the user’s voluntary transactions.

Continue Reading ›

Published on: | by

Bitcoin has become a popular digital currency in the past several years. Its price has fluctuated tremendously in the past five years. And now, everyone is rushing into buying it by using various applications such as Coinbase. As always, the bad actors (i.e., hackers) are on the prowl to exploit weaknesses. These weaknesses include the lack of preventive measures such as encryption and backups to secure the wallets. Therefore, once the wallet has been hacked, there isn’t much the victim can do to regain the digital currencies.

It is important to remember that Bitcoin transactions are transparent. In other words, all Bitcoin transactions are public, traceable, and stored on the blockchain network. Bitcoin addresses are the only indicators that show where they are stored and transmitted. Our research indicates that you should be able to protect your privacy if you use a new Bitcoin address every time you receive payment. Technology experts recommend that it may be prudent to use several wallets for different objectives – i.e., you can have a software and hardware wallet that can be used for a different reason. This way, there would not be a direct link between the cryptocurrency transactions.

Technology experts recommend not posting a Bitcoin address on a public domain such as a social media platform. The whole point is to avoid publishing information regarding your digital currency transactions since it could let third parties identify your Bitcoin address. It must be noted that Bitcoin’s network is a so-called “peer-to-peer” network that can be used by the general public. Also, in this kind of network, the user’s Internet Protocol (“IP”) address can be logged without your knowledge or consent. Therefore, it’s important to use some kind of masking software (e.g., ToR) or other technology to hide your computer’s IP address. ToR, which is also called “The Onion Router” provides a way for its users to mask their identities. It was originally designed for the military but it has been used by civilians for several years.

Continue Reading ›

Published on: | by

Digital currencies have become prevalent around the globe in recent times. There are various enterprises that are involved in the mining process which is now more difficult especially because it needs more computing power. Bitcoin’s price volatility is a major issue which has scared away investors. However, more importantly, are the security and privacy issues.

Digital currencies are usually stored in software or hardware wallets. These wallets allow the owners to store their digital currencies. There are studies that indicate hardware wallets are not as secure since hackers can use malware to intercept communications between the wallet and computer.

Hackers are always after valuable digital currencies. They are constantly trying to figure out a way to steal Bitcoin, or other kinds of cryptocurrencies, in a clandestine manner. For example, in 2014, Mt. Gox was hacked by an anonymous group and 850,000 Bitcoins were extracted without being found. There are other exchanges such as Coinbase, Binance, Kraken, or Gemini which can be targeted by the so-called “bad actors.” The hackers will use the necessary tools and techniques to shut down the major exchanges. These tools or techniques can be DDoS attacks which can cripple the computer network system. These types of attacks have been used to bring down the networks of private and public organizations.

Continue Reading ›

Published on: | by

Predictive policing has been used to calculate and forecast future crimes. Yes, although it sounds quite futuristic, but it has been used by various private and public organizations. The City of Santa Cruz, California was one of the first state governments that tried to implement this technology in an effort to stop crime. Predictive policing works by using machine-learning algorithms to calculate the possibility of future crimes. It uses mathematics and data analytics to evaluate information and make systematic predictions. It can also use artificial intelligence technology to reach the results. However, after some time, its public officials stopped their efforts to prevent racial inequality. Predictive policing raises several legal issues that will be addressed in this article.

First, there could be a problem with negligent police activity. We know that, once access is granted to a database of private or confidential information, it is highly probable that someone will abuse it. In other words, an agent may use that information in the wrong way. The technology has not proven to be effective in the sense that crime can be predicted. So, the police officers may engage in activities that would constitute harassment instead of protecting the public. C.C.P. § 527.6 defines harassment as “unlawful violence, a credible threat of violence, or a knowing and willful course of conduct directed at a specific person that seriously alarms, annoys, or harasses the person, and that serves no legitimate purpose. The course of conduct must be that which would cause a reasonable person to suffer substantial emotional distress, and must actually cause substantial emotional distress to the petitioner.” So far, predictive policing’s technology has not been able to specify who, when, where, what, how, or why future crimes can take place. It has not been able to tell the specific location of the future crime. So, for these reasons, it could be abused that could lead to negligent policing activities.

Second, there could be a problem when the private or confidential information is used to violate someone’s privacy. Invasion of privacy is a cause of action where the plaintiff sues the defendant for violating his or her privacy rights. The elements for public disclosure of private facts are as follows: (1) defendant publicized a matter regarding the private life of the plaintiff; (2) the publicized matter would be highly offensive to a reasonable person; and (3) it is not of legitimate concern to the public. In addition, invasion of privacy may occur if there is an intrusion upon someone’s seclusion. The prima facie elements for this cause of action are: (1) defendant intruded into plaintiff’s private affairs, seclusion, or solitude; and (2) the intrusion was objectionable to a reasonable person.

Continue Reading ›

Published on: | by

The National Security Agency (“NSA”) along with other government agencies (e.g., FBI, CIA) have expanded their surveillance programs after several terrorist attacks took place on domestic soil. It is a known fact that the federal government is systematically tracking domestic and international calls of its citizens. The surveillance program does not end there but also expands to text messages, internet browsing, and emails.

There is information that indicates the President’s Surveillance Program (“The Program”) was designed to assess, evaluate, gather, and analyze a tremendous amount of information with or without subpoenas or warrants. The Program is intended to disrupt actual or potential terrorist attacks that could be instigated by known or unknown criminals. The government has setup a massive collaboration effort with major telecommunication companies to gather information that would usually not be subject to surveillance. The telecommunication service providers have given access to the NSA to install surveillance equipment (e.g., “fiber-optic splitter”) which makes an exact copy of the data that’s passing through their systems and sends it to the government. Also, other special equipment such as the “Narus Semantic Traffic Analyzer” has been installed on the telecommunication systems to conduct deep packet inspections. These analyzers are capable of assessing and sifting through large data segments (e.g., 10 gigabits) and internet traffic.

These pervasive surveillance programs were authorized by President Bush after September 11, 2001. There is real time access to internet traffic and telephone records that was not previously available for previous surveillance programs. Also, the electronic information is being gathered in real time and stored on secure databases.

Continue Reading ›

Published on: | by

The governments of many countries have initiated surveillance programs to protect national security. These programs were allegedly designed and instigated to fight against terrorism and other criminal activities. For example, the British Government has setup a similar program to the United States government’s PRISM  program which is called TEMPORA. The GCHQ, which stands for Government Communications Headquarters, is the British government’s spy agency that operates similar to the United States National Security Agency (“NSA”). There is information that confirms the GCHQ has placed data interceptors on fiber optic cables to analyze internet communications. There is also information that confirms approximately 10 gigabits of data per second (or 21 petabytes of data per day) is being reviewed per day by this spy agency. Its agents are charged with the task of storing all sorts of information – e.g., electronic information with correlating metadata – on computer servers for as long as thirty days. This spy agency uses a technique called Massive Volume Reduction (“MVR”) to conduct its analysis.

Government spy agencies share their intelligence with other nation’s agencies as part of a partnership program. In fact, several years ago, The Guardian publicized this massive information gathering after it was reported by Edward Snowden. It seems the GCHQ is operating under two principles: (1) Mastering the Internet; and (2) Global Telecoms Exploitation. These surveillance programs are meant to gather as much information as possible for evaluation and assessment. However, it seems these principles have not been opened up for public debate and are being carried out without warrants.

The government spy agencies are gathering phone records, email message content, social media communications, and other types of information in an effort to curtail criminal violations. Their targets may include the unsuspecting innocent and suspicious or guilty individuals. Therefore, there are two schools of thought here. First, the spy agencies should carry out their intelligence gathering to prevent another international tragedy such as 9/11. Second, the spy agencies should be subject to certain limitations and should be forced to obtain lawful warrants before conducting surveillance. On the other side, the government officials argue that this type of unprecedented wiretapping is necessary to properly safeguard the country from terrorists.

Continue Reading ›

Published on: | by

The United States government has implemented surveillance programs to promote national security. These programs are designed to gather and process electronic information that could arguably assist government agencies in their efforts to enhance national security. However, there is an argument being made that the federal government is using the resources of major communication service providers to obtain records of citizens without legal justification. In other words, the government is engaging in unlawful surveillance programs without probable cause.

What kind of programs have been implemented?

The National Security Agency (“NSA”) has been intercepting internet communications for several years without fully disclosing the nature and extent of its surveillance programs to the general public. It’s also collecting other types of communication records such as phone records and related electronic information. There is evidence that proves AT&T is cooperating with government surveillance programs. The evidence seems to indicate the telecommunication giant has installed fiberoptic splitters to copy and send information to the government. Experts have argued this kind of activity is beyond “wiretapping” since it’s surveilling the entire communication channels without a warrant. So, in essence, the government is engaging in the mass collection of telephone metadata of all domestic customers. The government officials have argued that this type of broad surveillance is justified under the USA Patriot Act which is meant to deter and punish terrorism and enhance law enforcement investigations for the following reasons:

Continue Reading ›

Published on: | by

Cybersecurity risk management has become a more challenging endeavor recently. It was never an easy task for commercial enterprises, but now that we’re facing a global pandemic and economic recession, there are additional challenges. At this point, most of our personal information is being transmitted and stored on the internet. Third-party cloud service providers have become a useful variable in the equation but they can also become a liability if there is a cybersecurity incident. Therefore, cybersecurity risk management has become more difficult especially since commercial enterprises share personal or confidential information with third parties.

The fact that our personal information is no longer in our possession or control makes cybersecurity risk management more challenging. Now, if, our personal information was stored in one location, and as such, was in one company’s possession, life would have been easier. However, multiple vendors, and third-party service providers gain access to our confidential information. So, the level of liability rises to a different stage since there is additional potential responsibilities that must be managed. In addition, some companies have allowed their employees to work from home and this business model makes it more difficult to manage cybersecurity risks. In other words, remote employees can become the proverbial “weakest link” which can be quite dangerous for the commercial enterprise.

A problem in the cybersecurity risk management formula is that change is never ending. The constant change in technology and law makes it more difficult for companies and their information technology managers to keep up. Our law firm’s cybersecurity lawyers generally recommend working with computer technology experts on a regular basis. This way, they can develop the necessary policies on their networks. They should identify the risks by understanding the cybersecurity rules and regulations. An information technology manager should implement internal and external policies to secure the network which usually holds confidential information. For example, the network should have a secure software or hardware firewall, encryption algorithm, and multi-factor authentication system. The information technology manager should develop and implement regular training sessions for employees.

Continue Reading ›

Published on: | by

Cybersecurity risk management requires proper due diligence on the company’s cybersecurity program. This is an important aspect because the company’s executives owe a fiduciary duty towards their shareholders and customers. In other words, a company’s manager or director should take every reasonable measure to ensure the safety and security of the company’s intellectual properties, trade secrets, and other sensitive or confidential information. As such, a claim or cause of action for breach of fiduciary duty can seriously hinder business operations and should be avoided by any means necessary.

We recommend properly assessing internal and external threats such as disgruntled employees or third-party contractors who were given access to the computer network system. It’s certainly possible for a disgruntled employee to insert a flash drive which yields malware into the network server to cause a malfunction. Therefore, it is important to have the right security measures implemented on the computer network system. For example, our cybersecurity lawyers recommend installing an Intrusion Detection System (“IDS”) to detect unauthorized access to sensitive or confidential files. It is important to review and understand the laws related to workplace monitoring because it could trigger workplace privacy right violations. There are state and federal laws that would impact the legal rights and responsibilities of employers and employees so it’s important to understand them. In fact, companies that fall under the definition of “critical infrastructure” organizations pursuant to Executive Order 13636 should consider implementing insider threat programs as a precautionary measure.

It’s recommended to have an enterprise risk assessment program that involves cybersecurity experts and lawyers. These computer and legal experts should join forces to establish a program that addresses the key issues – e.g., data privacy, data protection, insider threats, breach notification protocols. It’s important to have a plan before the so-called “cyber incident” so the key players will know their responsibilities. This way, when an incident takes place, there will be a preexisting protocol for everyone. Moreover, having access to a cybersecurity attorney is crucial to the company’s legal and ethical responsibilities. Our law firm advises its clients regarding the relevant state, federal, and international rules and regulations as we have the necessary background and expertise in internet, technology, and cybersecurity laws.

Continue Reading ›

Published on: | by

Cybersecurity risk management is a key component in avoiding cybersecurity incidents. Our law firm assists clients with breach response plans pursuant to the rules and regulations. An Incident Response Plan (“IRP”) should be carefully created to address cybersecurity incidents. There are strategic challenges with implementing an effective IRP within the organization but there could also be legal challenges. Hence, we encourage clients to implement a cybersecurity framework that can effectively prevent breaches. This can be done by working with qualified legal and computer experts.

We encourage clients to coordinate communications with their employees and representatives. The company’s partners and affiliates should also be aware of the breach notification and prevention protocols. This is especially important if the company has various locations and satellite offices. The company must act quickly when it finds out about a breach so that it can follow the rules and regulations. In fact, the European Union’s General Data Protection Regulation (a/k/a “GDPR”) mandates breach notification to the proper authorities within three days. In addition, in California, the law imposes a 72-hour breach notification obligation under the California Consumer Privacy Act (“CCPA”) which became effective on January 1, 2020.

We encourage clients to develop different types of response plans for various cybersecurity incidents. There are different types of breach that can take place on the computer network. In general, the bad actors compromise the computer network to steal personal information. However, availability attacks have also increased which in essence deny access to the system. For example, installing ransomware on the computers or launching a Distributed Denial of Service (“DDoS”) attack on the computer network can accomplish this task. There could be serious legal consequences if the company cannot properly protect its network which yields private and confidential information – e.g., intellectual property, trade secrets. There are various state, federal, and international laws in this context. For example, the Philippines Data Privacy Act defines a “security incident” as an event or occurrence that affects or tends to affect data protection or may compromise availability, integrity, or confidentiality.

Continue Reading ›