Procuring IoT: Data Integrity and Security

Update  (10/29/16): The Librarian of Congress has exercised his statutory authority to exempt bona fide security researchers from certain copyright requirements, including on consumer-oriented IOT products .

Update (10/26/16):  Important articles by the NY Times, Krebs on Security, Cloud Security Alliance, Wall Street Journal and Wired.

Repost of my original post below.

{workplace_tech_law}

The Internet of Things (IoT) is undoubtedly going to play a major role in the workplace.  Because an employer has a number of critical employee-related interests in securing IoT data, including protecting securing otherwise private employee and business information as well as protecting trade secrets, employment lawyers should be in the conversation with the technology acquisition and development teams as they develop an IoT acquisition policy.  Here is how to create such a policy.

View original post 550 more words

Large-Scale Data Breaches and Executives

Executives are highly targeted for social engineering and other efforts to gain access to their information.   Whether the data is from the recent-Yahoo breach (or any other breach), there is an active market for information, including information from your employees and executives.   This information can be used to access accounts, build a spear-phishing profile, gather intelligence on execs or simply embarass them.  Some thoughts:

Continue reading “Large-Scale Data Breaches and Executives”

The EU GDPR for US Employers: Practice Tips

The new EU GDPR will be a game changer for a number of multinational employers.  Here are a few practice pointers for US-based enterprises with European HR data:

Continue reading “The EU GDPR for US Employers: Practice Tips”

‘Unpacking the Complexities’ of Algorithmic Bias

I’ve argued in detail in this blog (here and here) that management-side employment lawyers must get deep under the hood of expert systems designed to perform evaluative functions on candidates and employees (such as expert HR systems).  At each step of development — arguably from the earliest design phase — lawyers must be equipped to understand the potential bias that might creep into algorithmic decision-making and help design systems that are as bias-free as possible.

Here are two important articles for readers on the subject (and why they are relevant):

Continue reading “‘Unpacking the Complexities’ of Algorithmic Bias”

Attacks Against Verification-Code-to-Cell Two-Factor Authentication

This blog has advocated for the use of two-factor authentication.  Recently, however, it was revealed that several high profile social media accounts were hacked, despite using two factor authentication.

What happened?

Update: See Wired’s new piece on the subject: So Hey You Should Stop Using Texts for     Two-Factor Authentication

Update:  See Joint investigation of Ashley Madison by the Privacy Commissioner of Canada and the Australian Privacy Commissioner at Paragraph 72, arguing that multiple iterations of the same factor is not multi-factor.

Continue reading “Attacks Against Verification-Code-to-Cell Two-Factor Authentication”

The New Defend Trade Secrets Act (DTSA): An Employer’s Guide

The new Defend Trade Secrets Act (DTSA)  is designed to create a federal standard for trade secret protection – and includes remedies that permit federal judicial seizure of stolen trade secrets.  DTSA fills an important gap in the statutory framework that employers have available to them to retrieve trade secrets stolen by departing employees, such as the  CFAA (.pdf), the Economic Espionage Act and the patchwork of state trade secret laws (.pdf).

Here is what employment lawyers need to know and do now:

Continue reading “The New Defend Trade Secrets Act (DTSA): An Employer’s Guide”

“Live Blog”: Data Breach War Room / Breach Preparation

As mentioned, I am a panelist at today’s “Data Breach War Room / Breach Preparation” at iTechLaw’s 2016 World Technology Conference in Miami.  I will be “live blogging” the key lessons from today’s workshop.  My co-panelists, Meg Strickler, Jon Neiditz and Mark Mermelstein, will have the chance to review this content, but until they do, I am solely responsible for its content.   Here goes:

Continue reading ““Live Blog”: Data Breach War Room / Breach Preparation”