By Angela Doughty and Peter McClelland

The following excerpt is part of a series of blog posts on topics that will be discussed at the NCBA Privacy and Data Security Section Annual CLE. If you are interested in learning more, then please join us. Register for the program here.

Imagine it is a Friday afternoon. A doctor at the hospital you work for as in-house counsel or as outside counsel to the hospital calls you in a frenzy. All her computers are locked up by some malicious software demanding a ransom. The ransom note says patient records will be sold if she does not pay the ransom. She asks what she should do next: should she pay the ransom? Should she contact law enforcement? Is she going to need to notify her patients or government officials or the medical board?

The U.S. privacy laws are a patchwork of state and federal regulations. Whether you practice in the privacy and data security space or not, these issues will likely one day affect your organization where you work as in-house counsel or your clients calling you as outside counsel for help. In this digital world we live in, all attorneys can benefit from understanding the basics of how to respond to an alleged security incident.

By Karin McGinnis 

The following excerpt is part of a series of blog posts on topics that will be discussed at the NCBA Privacy and Data Security Section Annual CLE. If you are interested in learning more, then please join us. Register for the program here.

There is a lot of talk, but not a lot of clear law, about artificial intelligence (AI) in the United States. Most resources reflect a common agreement on AI: it is machine based; it is a system; it addresses human objectives; it uses algorithms designed by humans; it makes predictions, recommendations and/or decisions; it is designed to evolve; and while it can do much good, it poses great risks and something should be done about regulating it.

Stakeholders also generally seem to agree on the risks posed by AI. First, the underlying data – both training data and data processed by the AI – may not be accurate. Second, the AI model has to learn to perform its function by processing large volumes of data. Collecting that data can implicate privacy laws (i.e., disclosure and consent), and there are risks for the model if the data set lacks “integrity” (i.e., the data is not sound – garbage in/garbage out). Third, the algorithm could be biased. It is, after all, developed by humans, and humans bring their own presumptions and biases to their work. Fourth, unreliable or biased AI can have serious consequences for individuals, including denial of employment, credit, housing, due process and other rights, including privacy. Consider the now infamous example of Target using AI to determine that a teenage girl was pregnant and sending her coupons in the mail for diapers and other baby items, which were discovered by the teen’s dad. Where AI has been addressed by courts, legislation or federal agencies, the focus has been on balancing these risks against the benefits of AI. Transparency (notice), data integrity, nondiscrimination, validation, impact assessments and continuous monitoring are common themes. The following summarizes some materials reflecting the trajectory of AI regulation in the USA.

Would you like to learn more about issue spotting for privacy considerations when leveraging artificial intelligence? Join us on October 28 for the Annual Privacy and Data Security Section CLE.

By Angela Doughty

Join us as we breeze through the 2021 Privacy and Data Security CLE on October 28, 2021.

The tidal wave of COVID-19 cases was not the only challenge faced in 2021. Blown away by the marked increase in ransomware attacks, both public and private sectors prioritized consumer privacy and data security. Light as rain, the privacy legislation emphasizing consumer choices and business obligations to defend against emerging cybersecurity threats trickled in, while Virginia and Colorado stormed in, passing comprehensive, state-level privacy laws. This whirlwind of legislation with a forecast of more to come, makes it important for all practitioners advising on privacy and data security matters to understand the storm surge of risks created during the 2021 privacy landscape shift.

The SolarWinds of Change 2021 Privacy and Data Security CLE program will update attendees on recent developments in privacy legislation, address ethical considerations in an era of emerging challenges and technology, take artificial intelligence by storm, and provide practical legal guidance on navigating vendor contracting issues based on lessons learned from the SolarWinds incident.

The program will provide 6.0 hours of CLE (including an ethics/professional responsibility hour and technology training hour) and is planned for both in-person and live webcast options. The full agenda and registration details can be found by clicking here.

Mark your calendars for Windsday . . . no, Thursday, October 28, 2021.

By Peter McClelland

In December 2020, as many of us were watching all things political and pandemic, current events eclipsed a serious breaking story. The SolarWinds hack exposed a level of data across the nation that was — to use the oft-turned phrase for 2020 — “unprecedented.” Not to be outdone, 2021 has now given America a data breach through the Microsoft Exchange email software that (conservatively) affected 60,000 organizations, spanning every level of size and sophistication. Read more

By Eva Lorenz and Taylor Ey

SolarWinds made a name for itself as the developer of tools for network monitoring that help small and large companies efficiently run their environment. While not a security-focused company from a product standpoint, the understanding was that the code behind SolarWinds’ tools was protected as intellectual property and that updates were safe to run until it turned out that both of these assumptions were wrong.

How Was the Compromise Detected?

In late 2020, FireEye, a company focused on cybersecurity and internationally involved in helping companies post cyber incident, detected some unusual activity on the FireEye network. FireEye detected it was hacked after the attackers tried to register a device to FireEye’s multi-factor authentication system using stolen credentials. The system then notified the employee, whose credentials were stolen, and alerted the FireEye security team of this new device. This notice triggered an internal investigation to learn who was trying to register this device. FireEye performed in-depth code analysis and determined that the intrusion originated with a SolarWinds product called Orion. Some analysts believe that attacking FireEye was a mistake by the attackers since it sped up detection of the SolarWinds hack.
Read more