Subject: [NEXTEL-1] Four Legal Land Mines for CIOs

From: [email-masked]
Date: Fri, 26 Sep 2003 10:01:17 -0400

Four Legal Land Mines for CIOs

Story by Kathleen Melymuka
SEPTEMBER 22, 2003

( COMPUTERWORLD ) - CIOs struggling
with the technical implications of the
Health Insurance Portability and
Accountability Act and the Sarbanes-Oxley
Act may be wondering what other ticking
bombs are hidden under the IT landscape.
We asked lawyers who specialize in
technology to identify some of the more
explosive risks and mitigation strategies.
Here's what they said: Security

In the realm of IT security, there are new
legal risks every day. California Senate Bill
1386, which took effect July 1, requires
that companies conducting business in
that state notify California residents if they
know or reasonably believe there has been
a breach in security that might have put
their personal information at risk. The
purpose of the law is to enable customers
to take protective measures -- such as
informing their credit card companies - to
minimize any damage.

Why you should care

Your company doesn't need to be based in California or even have an office there
to be affected, says Maureen Dorney, an attorney at Gray Cary Ware & Freidenrich
LLP in Palo Alto, Calif. If you have customers in California, own or license data
containing personal information on such residents, or even maintain such data on
behalf of another company, this law affects you. If your company suspects a breach
and fails to quickly notify customers who suffer as a result, the law authorizes
them to institute civil actions against your company to recover damages.

From a legal standpoint, Dorney says, your company is better off notifying
customers even if you're not certain their data has been compromised, because the
customers are expected under law to take action upon notification, and your
liability is lessened.

"But most companies would consider that to be a very unpleasant and damaging
disclosure," she says.  Notification could lead to bad publicity, a dip in stock
price and even shareholder suits over ineffective security. As a result, Dorney
says, "historically, companies have bent over backward" to keep security breaches
secret.
"Two things are going on that the business has to balance: the potential legal
liability and the business realities," she concludes.
What you can do

• Make sure your board of directors understands security risks and approves the
appropriate level of funding to address them properly.

• Work with your legal department to determine whether the law affects your
company.

• Develop or amend information security policies to guide company employees on how
to handle security breaches under the new law, and train employees on the new
requirements.

• See that security policies and procedures are followed.

• Consider implementing encryption technology, which will eliminate the need to
comply with the disclosure requirement.

• Develop a system for coordinating with law enforcement authorities in the event
of a security breach.

Data Retention

Electronic document retention poses problems never dreamed of in the days of paper
and file cabinets, says Cliff Greene, an attorney at Greene Espel PLLP in
Minneapolis. "We're all concerned about the lack of uniform standards governing
preservation issues," he says. The policy question facing every business, he says,
is "whether to keep information a long time for protection or for the most minimal
term because you don't want to have to be litigating ancient history."

Why you should care

If your company becomes involved in a lawsuit, your electronic document-retention
policy suddenly becomes an issue. "A standard part of litigation wars now is to
request all data and e-mail regarding the transaction," says Doug Ey, an attorney
at Helms Mulliss & Wicker PLLC in Charlotte, N.C. If the CIO can't explain the
company's document-retention policy, or if the policy is administered haphazardly
or inconsistently, innocent deletions can seem sinister.

Not only do you need a policy about how long data will be retained, Greene says,
but you also need to know how to effectively suspend that policy when your company
needs to preserve data relevant to litigation. "This can be very difficult," he
says, "because you're not just dealing with main systems, but also with all the
different ways in which data can be stored."
If relevant data is inadvertently destroyed, the company can be charged with
"spoliation of evidence," and consequences can be as severe as if your company had
defied a court order, says Greene. Even knowing when you need to preserve data can
be complicated, he says. In some states, you're notified to do so; in others, just
the threat of a lawsuit requires you to preserve data. And since you're not always
sued in your own state, you need to know the rules in other states as well.

What you can do

• Consult the guidelines of the Sarbanes-Oxley Act and search the Web for
additional document-retention protocols.

• Work with your legal department and business colleagues to develop a policy that
makes sense.

• Make sure the policy is applied consistently regardless of a particular
document's content or location.

• Develop a standard plan for how to effectively suspend the policy to preserve
documents in the face of lawsuits.

Privacy

On June 18, the Federal Trade Commission announced an enforcement action against
Guess Inc.  involving online security. According to the FTC complaint, Guess's
online privacy policy assured customers that their information was safe, but in
reality, its databases were vulnerable to common hacking strategies and the
company had failed to take "reasonable and appropriate measures to secure and
protect the databases."

The FTC concluded that Los Angeles-based Guess hadn't lived up to its privacy
assurances and had therefore violated FTC regulations. It required that Guess
establish a "comprehensive information security program" and specified the
components of that program (see below). If Guess fails to comply, each violation
is punishable by a civil penalty of up to $11,000 per day for as long as the
violation lasts.

Why you should care

What happened to Guess could happen to your company. "When you make public
statement on what kind of security and privacy protection you have, you've created
a contract with the public," Dorney explains. "It can be bad for a company if it
makes promises it can't keep." Private lawsuits and class-action suits are also
possible, she says, adding, "Potentially, there's even fraud if the company made
statements it knew were not true."

What you can do

The steps the FTC required for Guess can serve as guidelines for any prudent
company. Here are some of them:

• Designate an employee to head the online security program.

• Conduct a comprehensive assessment of the risks to personal information
security.

• Design safeguards to control the risks identified in the assessment.

• Monitor the safeguards' effectiveness and adjust them as needed.

• Obtain periodic audits by independent, qualified professionals attesting that
the safeguards adequately protect consumer
information.

Software License Violations

"People expect problems with sexy things like security and privacy, but based on
my experience in lawsuits involving CIOs, the biggest litigation risk is still the
nuts and bolts" such as software piracy or violating a software license, says Ey.
"Too many users using software in too many locations -- that's ground zero for
lawsuits."

Despite the publicity this issue has received, wherever there's a software
license, there's still ample opportunity for a copyright infringement, attorneys
say. "It's an issue of asset management and failure to manage," says Brian Balow,
an attorney at Dickinson Wright PLLC in Detroit. "That is a real and significant
risk all CIOs face."
It can happen easily, Balow says. For example, a bare-bones departmental budget
can lead a manager to copy software. "If the company doesn't have a standard
procedure in place to monitor what they have installed, the CIO has no idea," he
explains. Then a disgruntled employee calls the vendor or the Business Software
Alliance (BSA) and reports the infringement.

Why you should care

The softening economy may be hardening vendors. "I've seen an increase in
activity," Barlow says, adding that companies he knows have recently been
approached directly by Oracle Corp., Microsoft Corp., SAS Institute Inc. and the
BSA.
If they come calling, don't expect a slap on the wrist. "I've never seen them say,
'Stop and we'll let you go,' " Balow says. And your liability can be huge. "We're
talking literally millions of dollars," he adds.

What you can do

• Understand your license agreements.

• Educate upper management about the importance of keeping the company honest, and
enlist their support in the effort.

• Keep a good inventory of software and hardware.

• Ask your big vendors to provide resources for an annual accounting of your
software use, and buy additional licenses as needed. "They're getting what they
want and you're not getting sued," Balow says.

Melymuka is a Computerworld contributing writer. You can contact her at
[email-masked].

http://www.computerworld.com/softwaretopics/software/story/0,10801,85186,00.html?nas=AM-85186

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Buy Ink Cartridges or Refill Kits for your HP, Epson, Canon or Lexmark
Printer at MyInks.com. Free s/h on orders $50 or more to the US & Canada.
http://www.c1tracking.com/l.asp?cid=5511
http://us.click.yahoo.com/mOAaAA/3exGAA/qnsNAA/61FxlB/TM
---------------------------------------------------------------------~->

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/