Porter Wright Information Privacy and Data Security Workshop Series

Please join us for this informative series focused on the technical, enforcement, and practical aspects of experiencing and responding to a data security incident. For the complete invitation and details on registration please click here.

IDENTITY THEFT, CORPORATE DATA SECURITY BREACHES AND LAW
ENFORCEMENT: SHOULD I CALL THE COPS?

Learn How to Effectively Utilize Law Enforcement and Private Security Resources to
Protect Yourself and Your Business From Computer Criminals

January 20, 2011
11:30 a.m. - 1:30 p.m.
Lunch will be provided
Capital Club - 41 South High Street, 7th Floor
Columbus, Ohio

Focus issues:
Trends in Identity Theft
What Can Lead to a Data Breach
Law Enforcement
Identity Theft Investigations

 

Data Breach Incidents on the Rise

This week, the Identity Theft Resource Center released its 2010 data breach statistics report for data breaches through June 22, 2010. According to this weekly report, 2010 has already seen 325 reported data breaches exposing approximately 8.3 million records. Considering that the 2009 report shows 498 reported data breaches for all of last year, it looks like 2010 will see an increase in overall data breaches.

Companies collecting personal information should take proactive measures to avoid data breaches. Proactive measures include maintaining an up-to-date security policy, safeguarding sensitive data, encrypting data, turning on and monitoring system logs, and restricting access to only those who need it. (See our previous post for an example of why security implementations should be kept up to date.)

It is also important to have a preemptive response plan in place to deal with a data breach should one occur. A response plan should include means of investigating the data breach, notifying those whose records or information are potentially affected, addressing legal concerns, addressing public relations concerns, making other required notifications (such as those described here), and ensuring the data breach is not ongoing or recurring.

What Border Officials Can Do with Your Laptop And Cellular Phone

Having your laptop or smartphone searched or detained by Customs on your way back from a business trip would be a nightmare for most travelers, including bankers and other finance professionals. However, this scenario is quite possible under new governmental policies.

In 2009, U.S. Customs and Border Protection (“CBP”) and U.S. Immigration and Customs Enforcement (“ICE”) both issued their respective new policies on border searches of electronic devices. This was a coordinated effort of CBP and ICE to update and harmonize their border policies to detect an array of illegal activities, including terrorism, cash smuggling, contraband, child pornography, copyright, and export control violations.

With all the technology innovations that allow business travelers to carry massive amounts of information in small electronic devices, CBP and ICE are facing an enormous challenge. On the one hand, travelers have a legitimate right to carry information on electronic devices. In that respect, there are serious concerns regarding the traveler’s expectation of privacy. On the other hand, the government has a duty to combat illegal activities and to enforce U.S. law at the border. The difficulty is finding the right balance between the government’s duty to enforce the law and the rights of travelers.

The legal basis for ICE and CBP policies is the border search exception to the Fourth Amendment requirement that officers obtain a warrant before searching someone’s property. But, assuming that they have this power, another key issue is exactly what CBP and ICE are allowed to do with one’s laptop. In short, they have authority to search and share information on laptops, disks, drives, tapes, mobile phones, Blackberries, cameras, music players, and any other electronic or digital devices — with or without “reasonable suspicion1” of illegality. Detention of the devices and/or information requires probable cause that an illegal activity is underway or is about to occur.

Searches
CBP searches may be conducted with or without suspicion of an unlawful activity. To the extent practicable, CBP searches should be conducted in the presence of a supervisor. ICE searches should be conducted by an ICE Special Agent, CBP Officer, or Border Patrol Agent. The searches should be conducted in the presence of, or with the knowledge of, the traveler.

Naturally, the guidelines provide for exceptions to the traveler’s presence under certain circumstances where national security or operational considerations are an issue. ICE guidelines specifically state that the traveler’s consent for the search is not needed.

Detention
CBP detention of a device should not exceed five days, but that period can be extended. ICE detention periods may be longer — up to 30 calendar days or longer — if circumstances warrant. CBP is required to issue a Custody Receipt to the owner of the device (CBP Form 6051D) at the time of detention. ICE will also give the owner of the device documentation regarding its custody.

Detention of electronic devices requires probable cause to believe that the device, or its contents, contains evidence of illegality that CBP and ICE are authorized to enforce.

Continue Reading...