Source: http://ivebeenmugged.typepad.com/my_weblog/2015/05/index.html
Timestamp: 2017-06-25 15:30:08
Document Index: 277794567

Matched Legal Cases: ['§ 215', '§ 215', '§ 215', '§ 215', '§ 215', '§ 215', '§ 215', '§ 215', '§ 215']

May 2015 - I've Been Mugged Blog
Earlier reports have proven true. Five banks have plead guilty and will pay more than $5.5 billion in total penalties to U.S. and European regulators to settle charges that traders rigged foreign exchange markets. USA Today reported:
"Five major banks Wednesday agreed to plead guilty to criminal charges and pay more than $5.5 billion in collective penalties... The Department of Justice, the Federal Reserve and other U.S. and European authorities and regulators said corporate units of Citicorp, JPMorgan Chase, London-based Barclays, and Royal Bank of Scotland acknowledged their traders rigged foreign exchange prices of U.S. dollars and euros from Dec. 2007 to Jan. 2013... UBS also acknowledged involvement in the rate-rigging. However, the Swiss banking giant received conditional immunity from criminal prosecution because it was the first to report foreign-exchange misconduct to DOJ investigators."
U.S. Attorney General Loretta Lynch described in the Justice Department announcement the wrongdoing:
"Starting as early as December 2007, currency traders at several multinational banks formed a group dubbed “The Cartel.” It is perhaps fitting that those traders chose that name, as it aptly describes the brazenly illegal behavior they were engaged in on a near-daily basis. For more than five years, traders in “The Cartel” used a private electronic chatroom to manipulate the spot market’s exchange rate between euros and dollars using coded language to conceal their collusion. They acted as partners – rather than competitors – in an effort to push the exchange rate in directions favorable to their banks but detrimental to many others. The prices the market sets for those currencies influence virtually every sector of every economy in the world, and their actions inflated the banks’ profits while harming countless consumers, investors and institutions around the globe – from pension funds to major corporations, and including the banks’ own customers..."
The fines by bank:
"... to pay criminal fines totaling more than $2.5 billion – the largest set of antitrust fines ever obtained in the history of the Department of Justice. And the fine that Citicorp alone will pay – $925 million – is the largest single fine ever imposed for a violation of the Sherman Act... Switzerland’s UBS AG, has agreed to plead guilty and pay a $203 million criminal penalty for breaching the non-prosecution agreement it entered in December 2012 regarding manipulation of the London Interbank Offered Rate, or LIBOR – a benchmark interest rate used worldwide. he breach of the NPA was based in part on UBS’s fraudulent and deceptive currency trading and sales practices related to foreign exchange markets, its collusion with other participants in the FX markets and its failure to take adequate action to prevent unlawful conduct after prior civil, criminal and regulatory resolutions. In other words, UBS promised, in other resolutions, not to commit additional crimes – but it did."
The announcement did not state which, if any, bank executives would go to prison for the wrongdoing. The announcement did not state what portion, if any, of the fines would be tax-deductible. Previously, penalties and fines paid by some banks have been tax-deductible. Some experts and politicians have stated that better disclosures are needed for settlement agreements.
Posted at 09:30 AM in Banks, Corporate Responsibility, Court Cases, Europe, Federal / U.S. Government, Fraud, Government | Permalink
Posted at 09:00 AM in Corporate Responsibility, Fraud, Mobile, Prepaid Cards, Retail, Scams & Threats | Permalink
Posted at 08:30 AM in Banks, Corporate Responsibility, Europe, Federal / U.S. Government | Permalink
On Thursday, a federal appeals court ruled that the bulk collection of Americans' phone data by the National Security Agency (NSA) violated the USA Patriot Act. The Washington Post reported:
"... a unanimous three-judge panel of the U.S. Court of Appeals for the 2nd Circuit overturned a lower court and determined that the government had stretched the meaning of the statute to enable “sweeping surveillance” of Americans’ data in “staggering” volumes... The NSA’s mass collection of phone records for counterterrorism purposes — launched after the Sept. 11, 2001, terrorist attacks... Under the program, the NSA collects “metadata” — or records of times, dates and durations of all calls — but not call content."
The NSA's massive phone collection program was revealed in June 2013 by former NSA agency contractor Edward Snowden. The U.S. Government argued that the phone records data collection program, underway since at least May 2006, was necessary to identify:
"... terrorism suspects. A series of judges on the secretive Foreign Intelligence Surveillance Court have agreed."
The plaintiffs in the original lawsuit and appellants were the American Civil Liberties Union, American Civil Liberties Union Foundation, New York Civil Liberties Union, and New York Civil Liberties Union Foundation. Named in the appeal lawsuit were James R. Clapper (Director of National Intelligence), Michael S. Rogers (Director of the National Security Agency and Chief of the Central Security Service), Ashton B. Carter (Secretary of Defense), Loretta E. Lynch (Attorney General of the United States), and James B. Comey (Director of the Federal Bureau of Investigation).
The Court opinion stated in part:
"This appeal concerns the legality of the bulk telephone metadata collection program (the “telephone metadata program”), under which the National Security Agency (“NSA”) collects in bulk “on an ongoing daily basis” the metadata associated with telephone calls made by and to Americans, and aggregates those metadata into a repository or data bank that can later be queried. Appellants challenge the program on statutory and constitutional grounds. Because we find that the program exceeds the scope of what Congress has authorized, we vacate the decision below dismissing the complaint without reaching appellants’ constitutional arguments.."
Telephone metadata does not include what people said during a phone call. Metadata includes only the date, time, call duration (in minutes), caller's phone number, and recipient's phone number. With smartphones, the metadata may also include the caller's geo-location, the recipient's geo-location, and a phone identifier. The Court opinion also stated:
"The district court held that § 215 of the PATRIOT Act impliedly precludes judicial review; that plaintiffs/appellants’ statutory claims regarding the scope of § 215 would in any event fail on the merits; and that § 215 does not violate the Fourth or First Amendments to the United States Constitution. We disagree in part, and hold that § 215 and the statutory scheme to which it relates do not preclude judicial review, and that the bulk telephone metadata program is not authorized by § 215."
The Court decision summarized some important history Americans should know:
"In the early 1970s, in a climate not altogether unlike today’s, the intelligence‐gathering and surveillance activities of the NSA, the FBI, and the CIA came under public scrutiny. The Supreme Court struck down certain warrantless surveillance procedures that the government had argued were lawful as an exercise of the President’s power to protect national security, remarking on “the inherent vagueness of the domestic security concept [and] the necessarily broad and continuing nature of intelligence gathering.” United States v. U.S. Dist. Court for the E. Dist. of Mich. (Keith), 407 U.S. 297, 320 (1972). In response to that decision and to allegations that those agencies were abusing their power in order to spy on Americans, the Senate established the Select Committee to Study Governmental Operations with Respect to Intelligence Activities (the “Church Committee”) to investigate whether the intelligence agencies had engaged in unlawful behavior and whether legislation was necessary to govern their activities. The Church Committee expressed concerns that the privacy rights of U.S. citizens had been violated by activities that had been conducted under the rubric of foreign intelligence collection. The findings of the Church Committee, along with the Supreme Court’s decision in Keith and the allegations of abuse by the intelligence agencies, prompted Congress in 1978 to enact comprehensive legislation aimed at curtailing abuses and delineating the procedures to be employed in conducting surveillance in foreign intelligence investigations. That legislation, the Foreign Intelligence Surveillance Act of 1978 (“FISA”)... established a special court, the Foreign Intelligence Surveillance Court (“FISC”), to review the government’s applications for orders permitting electronic surveillance... Unlike ordinary Article III courts, the FISC conducts its usually ex parte proceedings in secret; its decisions are not, in the ordinary course, disseminated publicly..."
To balance the competing needs of citizens' privacy and intelligence gathering:
"... Congress has amended FISA, most significantly, after the terrorist attacks of September 11, 2001, in the PATRIOT Act. See USA PATRIOT ACT of 2001, Pub. L. No. 107‐56, 115 Stat. 272 (2001). The government argues that § 215 of that Act authorizes the telephone metadata program..."
"We are faced today with a controversy similar to that which led to the Keith decision and the enactment of FISA. We must confront the question whether a surveillance program that the government has put in place to protect national security is lawful. That program involves the bulk collection by the government of telephone metadata created by telephone companies in the normal course of their business... "
The court recognized that while law enforcement has historically used metadata, new technologies have changed things:
"We recognize that metadata exist in more traditional formats, too, and that law enforcement and others have always been able to utilize metadata for investigative purposes. For example, just as telephone metadata may reveal the charitable organizations that an individual supports, observation of the outside of an envelope sent at the end of the year through the United States Postal Service to such an organization might well permit similar inferences, without requiring an examination of the envelope’s contents. But the structured format of telephone and other technology‐related metadata, and the vast new technological capacity for large‐scale and automated review and analysis, distinguish the type of metadata at issue here from more traditional forms. The more metadata the government collects and analyzes, furthermore, the greater the capacity for such metadata to reveal ever more private and previously unascertainable information about individuals... in today’s technologically based world, it is virtually impossible for an ordinary citizen to avoid creating metadata about himself..."
The Court opinion discussed secrecy and the Administrative Procedure Act (APA):
"The government has pointed to no affirmative evidence, whether “clear and convincing” or “fairly discernible,” that suggests that Congress intended to preclude judicial review. Indeed, the government’s argument from secrecy suggests that Congress did not contemplate a situation in which targets of § 215 orders would become aware of those orders... That Congress may not have anticipated that individuals... would become aware of the orders, and thus be in a position to seek judicial review, is not evidence that Congress affirmatively decided to revoke the right to judicial review otherwise provided by the APA... The government’s argument also ignores the fact that, in certain (albeit limited) instances, the statute does indeed contemplate disclosure. If a judge finds that “there is no reason to believe that disclosure may endanger the national security of the United States, interfere with a criminal, counterterrorism, or counterintelligence investigation, interfere with diplomatic relations, or endanger the life or physical safety of any person,” he may grant a petition to modify or set aside a nondisclosure order... Such a petition could presumably only be brought by a § 215 order recipient, because only the recipient, not the target, would know of the order before such disclosure. But this provision indicates that Congress did not expect that all § 215 orders would remain secret indefinitely..."
Download the U.S. Court of Appeals decision (Docket No. 14‐42‐cv, Adobe PDF). A copy is also available here.
Posted at 08:30 AM in Court Cases, Federal / U.S. Government, Government, Privacy, Surveillance | Permalink
In April, the U.S. Federal Communications Commission (FCC) announced that AT&T Services, the telephone giant, will pay $25 million to settle consumer privacy violations at the company's call centers in Mexico, Colombia, and the Philippines. The FCC announcement described how the insider breach happened:
"The data breaches involved the unauthorized disclosure of almost 280,000 U.S. customers’ names, full or partial Social Security numbers, and unauthorized access to protected account-related data, known as customer proprietary network information (CPNI)... According to an investigation by the FCC’s Enforcement Bureau, these data breaches occurred when employees at call centers used by AT&T in Mexico, Colombia, and the Philippines accessed customer records without authorization. These employees accessed CPNI while obtaining other personal information that was used to request handset unlock codes for AT&T mobile phones, and then provided that information to unauthorized third parties who appear to have been trafficking in stolen cell phones..."
The data breach in the Mexico call center lasted 168 days and began between November 2013 and April 2014. The FCC Enforcement Bureau began its investigation in May 2014:
"... three call center employees were paid by third parties to obtain customer information — specifically, names and at least the last four digits of customers’ Social Security numbers — that could then be used to submit online requests for cellular handset unlock codes. The three call center employees accessed more than 68,000 accounts without customer authorization, which they then provided to third parties who used that information to submit 290,803 handset unlock requests through AT&T’s online customer unlock request portal."
"... approximately 40 employees at the Colombian and Philippine facilities had also accessed customer names, telephone numbers, and at least the last four digits of customer Social Security numbers to obtain unlock codes for AT&T mobile phones. Approximately 211,000 customer accounts were accessed..."
The FCC announcement stated that AT&T's failure to reasonably secure customers’ personal information violated a carrier’s duty under Section 222 of the Communications Act. The breach also constituted an unjust and unreasonable practice in violation of Section 201 of the Act. Terms of the settlement agreement require AT&T to:
Pay a $25 million civil penalty,
Notify all customers whose accounts were accessed,
Provide credit monitoring services to all consumers affected,
Improve its privacy and data security practices: appoint a senior compliance manager, implement an information security program
Conduct a privacy risk assessment,
Prepare an appropriate compliance manual, and
Regularly train employees on the company’s privacy policies and the applicable privacy legal
AT&T is also required to provide regular compliance reports to the FCC. FCC Chairman Tom Wheeler said about the breach:
“As the nation's expert agency on communications networks, the Commission cannot — and will not — stand idly by when a carrier’s lax data security practices expose the personal information of hundreds of thousands of the most vulnerable Americans to identity theft and fraud... the Commission will exercise its full authority against companies that fail to safeguard the personal information of their customers.”
According to its website, AT&T has more than 120 million wireless customers, 12.2 million U-verse high-speed Internet customers, and 3.5 million business customers. Total company revenues were $128.8 billion in 2013. Total workforces in 2014 was 243,620 employees. Download the AT&T Consent Decree with the FCC (Adobe PDF).
The breach announcement and settlement highlight the extent to which consumers' sensitive personal information is transmitted around the world, and the vulnerability of that information at offshore facilities. When companies move jobs to other countries, that often requires the transmission of consumer information to facilities in those countries.
Also, the breach emphasizes the fact that criminals have done their homework. They have identified both the corporations that are high-value targets with large amounts of consumer information, and the offshore locations. I applaud the FCC's actions and expect to hear more.
[Editor's note: in the interest of full disclosure, I am an AT&T mobile customer. I also received a breach notice from the company. I will share more about that in an upcoming blog post.]
Posted at 08:30 AM in Corporate Responsibility, Court Cases, Data Breaches, Federal / U.S. Government, Identity Theft, Mobile, Outsourcing, Privacy | Permalink
Posted at 08:30 AM in Corporate Responsibility, Court Cases, Federal / U.S. Government, Mobile, Privacy, Retail | Permalink