Source: https://ridethelightning.senseient.com/2015/03/index.html
Timestamp: 2019-04-18 12:19:39+00:00

Document:
CBR Online reported that CipherCloud has revealed that 64% of organizations consider regulatory compliance and information security standards as the top reasons for securing data in the cloud. Its "Cloud Adoption & Risk Report in North America & Europe" report examines the kinds of data security challenges facing 2000 global companies, and identifies the steps are being taken to mitigate these risks in the cloud.
Data encryption (81%) led tokenization (19%) at enterprises with a cloud security deployment. North American enterprises were found to encrypt in 85% of cloud security deployments, while European enterprises encrypted in 78% of cases.
The leading adopters of cloud data protection were the healthcare industry with 38%, followed by Finance with 25%. These sectors were found to have the biggest focus on protecting electronic and personally identifiable information - no doubt due to strict data privacy requirements from governments and sector specific guidelines.
Tokenization was found to only be favored by only one sector, Government, while other sectors focused their data protection efforts on encryption. This is due to the function preservation and the ability to search, sort and filter data with an encryption system.
This story blends nicely with my statement in yesterday's post that law firms won't get truly serious about data protection until there are federal laws and/or regulations with teeth.
According to a New York Times story, the reluctance of law firms to discuss or acknowledge data breaches has frustrated law enforcement and clients for years. The report was issued last month and indicated that law firm security is often below the standards for other industries.
Federal authorities are urging law firms to be more open about reporting incidents. Good luck with that. I have frequently observed that law firms are loathe to admit to data breaches, no doubt having nightmares involving a massive client exodus after the revelation of a breach. Without a law that has teeth, I don't expect that to change - even though the law firms may be ethically required to report the breaches to clients. They don't fear the bar disciplinary authorities nearly as much as they fear the loss of clients.
Citigroup issued a statement last week distancing itself from the report. A person briefed on the matter but not authorized to speak publicly said the bank had stopped distributing it.
“The analysis relied on and cited previously published reports. We have apologized to several of the parties mentioned for not giving them an opportunity to respond prior to its publication in light of the sensitive nature of the events described,” said Danielle Romero-Apsilos, a Citigroup spokeswoman. Do you think there might have been some pressure applied to bury the report? I sure do.
The bank’s report mentioned incidents involving two smaller firms - Puckett & Faraj and Gipson, Hoffman & Pancione. Puckett, a Washington-area firm, was hacked in 2012 by activists associated with the group Anonymous, who were angered by the firm’s representation of a United States soldier who pleaded guilty in connection with his role in the death of 24 Iraqi civilians. Gipson, based in Los Angeles, said in 2010 it was hacked that year because of a software piracy lawsuit it had filed against the Chinese government.
The National Law Review reported on March 25th that the Sixth Circuit affirmed a decision in Colosi v. Jones Lang LaSalle Americas, Inc. which held that the cost of imaging a computer hard drive is a taxable cost recoverable by a prevailing party under 28 U.S.C. § 1920(4). That section allows a court to reimburse the prevailing party for the "cost of making copies of any materials where the copies are necessarily obtained for use in the case."
In Colosi, the party opposing the taxation of costs for computer imaging pointed to the Third Circuit’s decision in Race Tires America, Inc. v. Hoosier Racing Tire Corp.
That decision adopted a narrow view of § 1920(4), rejected the taxation of a variety of eDiscovery-related costs, and allowed costs sought in that case for “only the scanning of hard copy documents, the conversion of native files to TIFF, and the transfer of VHS tapes to DVD.” The Colosi Court, while commending the concern in Race Tires about expanding § 1920(4) to encompass a wide variety of eDiscovery expenses not contemplated by Congress, rejected the Race Tires analysis as “overly restrictive.” The Sixth Circuit concluded that the appropriate analysis under § 1920(4) only required answering the “context-dependent question of whether the prevailing party necessarily obtained its copies for use in the case.” In Colosi, the Court emphasized that the producing party tendered its entire computer in response to the production request and demanded that the requesting party use a vendor to make an image. The Court therefore determined that the image of the computer was “for use in the case” and taxable as costs under a plain reading of § 1920(4).
While the two cases reached different conclusions on taxing costs for computer imaging, their analysis was consistent. The Sixth Circuit upheld the costs in Colosi because the entire computer was tendered for production and the image was therefore “for use in the case.” While Race Tires criticized the notion of taxing costs for computer imaging, it did so in reference to imaging that came earlier in the eDiscovery process and that was more analogous to collection and search than to production.
The Colosi decision is significant because of its focus on a plain reading of §1920(4) and the conclusion that “making copies” generally encompasses forensic imaging. As the article notes, litigants are likely to face continued uncertainty regarding taxation of costs for eDiscovery and other technology-related activities unless and until they are addressed more specifically in § 1920.
And it is past time that we address this and many other laws/rules that lag so far behind the technology we commonly employ . . . .
Network World recently reported that some Cisco customers have taken steps to evade the NSA's tampering with Cisco equipment while it is en route to them.
The NSA's Tailored Access Operations (TAO) group, as revealed by Edward Snowden, was inserting backdoor surveillance tools into routers, servers and networking equipment before the equipment was repackaged and sent to customers outside the U.S.
Cisco has begun shipping equipment to addresses that are unrelated to a customer, said John Stewart, Cisco’s chief security and trust officer, during a panel session at the Cisco Live conference in Melbourne. Hopefully, that makes it hard for the NSA to target an individual company.
One of the leaked Snowden documents, dated June 2010, has two photos of an NSA interdiction operation, with a box that says Cisco on the side.
In May 2014, Cisco CEO John Chambers sent a letter to President Obama, arguing that the NSA’s alleged actions undermine trust with its customers and more broadly hurt the U.S. technology industry. Cisco also stated that it does not work with any government to intentionally weaken its products.
Ah, the games we play to foil our own government - and who knows what devices are purchased from foreign sources and intercepted in a similar fashion? These days only a fool would buy a flash drive made in China - so be careful of those flash drives that are handed out liberally by vendors as tchotchke at conferences!
Last week marked the first time that John and I served on the faculty of a Sedona Conference Institute, in this case The Sedona Conference Institute on eDiscovery: Staying Ahead of the eDiscovery Curve and Keeping Pace with the New Rules, in Nashville Tennessee.
Because audience interaction is integral to the conference, another rule commands that we engage in dialogue and not debate. That struck me as a fine rule and audience members and speakers strictly adhered to it.
Also, a rule forbids attributing quotes to individuals to facilitate speaking one's mind freely. Since everyone seemed to be speaking (and responding to others) very frankly, that rule was also welcome.
There was also a large Stetson hat in the room to collect $20 bills (to be donated to a local charity) from any individual whose cell phone emitted a ring tone. This was the first conference I've ever been to where cell phone silence was universal!
It was a splendid conference, full of useful information, practical tips, audience/faculty interaction and high quality written materials and presentations. A number of attendees commented that it was the best CLE they had ever attended. So bravo Sedona and keep up the good work!
Bloody stupid, as my English friends would say. It never ceases to amaze me that people think they can be naughty on work computers. Three judges were fired and a fourth resigned (the smartest of the lot) before the investigation was over.
CBS news was one of many sources carrying the story.
The fired judges were Timothy Bowles, Warren Grant and Peter Bullock. The U.K.'s Judicial Conduct Investigations Office said that the judges' actions constituted an "inexcusable misuse of their judicial IT accounts" and were "wholly unacceptable conduct for a judicial office holder."
To our own judges: Let's keep that sort of behavior on the other side of the pond . . .
If you're looking for the perfect soporific, this may be it. The FCC released its rules for protecting net neutrality on March 12th - and it's a whopping 400 pages. To give you the short list, now that the Federal Communications Commission is going to regulate broadband providers as a public utility, these rules will apply.
No Paid Prioritization: Broadband providers may not favor some lawful Internet traffic over other lawful traffic in exchange for consideration of any kind - in other words, no "fast lanes." This rule also bans ISPs from prioritizing content and services of their affiliates.
The FCC doesn't always make me happy, but I hereby award it a gold star for a job well done (thus far) in protecting net neutrality.
How Long Can Your License Plate Data Be Retained By the Police?
The answer varies by state, but I am pleased to say that my own state of Virginia has just imposed a very SHORT data retention limit on automated license plate readers - just seven days unless there is an active, ongoing criminal investigation. That law will take effect on July 1st.
As ars technica reported, New Hampshire has banned the devices themselves (Live Free or Die - I guess they mean it) and Maine has imposed a 21-day limit. However, many jurisdictions have no limit at all - so sometimes the data is kept forever.
The Virginia bill's author was my friend Chap Peterson - way to go Chap!
As The Washington Post reported, "Hello Barbie" has now been dubbed "Creepy Barbie" by many - parents and privacy advocates are trying to keep her from hitting the shelves this fall. Mattel's doll records a child's voice with an embedded microphone triggered by pressing a button on the doll. Audio recordings are sent to a server where the conversation will be processed to compose Barbie's responses.
Over time, she will remember pet names and other information about the child. Privacy advocates are worried about conversations being recorded and analyzed - and who might have access to the data.
Mattel, which has faced falling Barbie sales, and ToyTalk, a start-up that created the technology, say privacy and security have been their top priority. While privacy experts worry (and this is a mild worry) that children may be encouraged to ask for more Barbie-related products, ToyTalk's CEO says that "the data is never used for anything to do with marketing . . . "
There was a bit of humor at the New York toy fair where Hello Barbie was shown off. A Mattel representative chatting with her mentioned that she liked being onstage. Later, when she asked Hello Barbie what she should be when she grew up, the doll replied, "Well you told me you like being onstage. So maybe a dancer? Or a politician? Or a dancing politician?
See? Already the doll is smart enough to know that being a politician requires dancing. I am impressed by the programming . . .
California law firm Ziprick and Cramer sent a letter to clients on February 27th advising them that on or around January 25, 2015, the firm was infected by a new variant of the Cryptolocker virus which infected one of their workstations (encrypting its data) and then traveled to the server where data was encrypted on shared folders. The firm indicated that its backup was intact.
Though a ransom demand had not yet been made, the firm said it would not pay any ransom "which would only encourage and fund such criminals in their illegal activities." The firm reported the cyberattack to the FBI and offered clients one year of free credit monitoring.
Legal Tech News reported that CryptoFortress, a new variant, has the ability to encrypt files over network shares even if they are not mapped to a drive letter. This is certainly not good news . . . .

References: v. 
 § 1920
 v. 
 § 1920
 § 1920
 § 1920
 § 1920
 §1920
 § 1920