The National Labor Relations Board (NLRB) recently took the unprecedented position that an employer violated federal law by failing to engage its employees’ union in collective bargaining regarding its response to a data breach. The U.S. Postal Service (USPS) was the target of a 2014 data breach affecting over 800,000 of its current and former employees. The NLRB filed complaints against the USPS claiming that it executed its response to the breach without engaging in collective bargaining with the union. That’s a violation of National Labor Relations Act (NLRA) provisions mandating collective bargaining for any issue that relates to the “wages, hours, and other terms and conditions of employment,” the NLRA alleged.
The NLRB complaints specifically allege that the USPS violated the NLRA by failing to collectively bargain with the union about the impact of the breach on union members. The USPS also allegedly violated the NLRA by unilaterally providing a remedy for the breach (one year of credit monitoring services and fraud insurance at no cost to employees) without giving prior notice to the union and providing it with an opportunity to negotiate the remedy. The NLRB complaints arose from charges filed by the American Postal Workers Union and the National Rural Letter Carriers’ Association regarding the manner in which the USPS handled the breach.
This marks the first time the NLRB has suggested that data breach response and notification measures affecting employees relate “to the wages, hours, and other terms and conditions of employment” under the NLRA. If the NLRB’s position is found to have merit, that potentially makes the breach response process more complicated and costly for unionized organizations. Union negotiations would need to be conducted at the same time the organization is dealing with fallout from the data breach, such as repairing damage to internal systems, investigating the breach, and complying with breach notification laws. Union negotiations could put tremendous pressure on organizations trying to comply with data breach laws that require notification within a short time period after discovery of the breach. There is also a heightened risk of leaks to the press if organizations must notify unions before giving formal notification as required by law.
The NLRB’s complaints against the USPS reinforce the urgency of developing well-crafted breach response plans. Union organizations might wish to add items to their response plans that engage employee unions in the response process. Another precautionary measure is to solicit the input of the union in developing acceptable breach response protocols before a breach occurs rather than in the midst of a crisis situation.
Target. Home Depot. Neiman Marcus. This isn’t a list of places to shop. These companies were hit with some of the biggest data breach incidents of 2014. And, as the recent hack on Sony Pictures Entertainment demonstrates, it’s not just the customer information that gets compromised in cyberattacks—employees can also be the victims.
In November, hackers broke into Sony’s computer systems and stole personal information of over 47,000 current and former employees, celebrities, and freelancers. The information included personal emails, budgets, salary information, human resource records, and other private (and embarrassing) documents. Some of the stolen information was leaked online, including a spreadsheet containing names, birth dates, and Social Security numbers of over 3,000 employees. Buzzfeed reports that the 40 gb data dump contains email exchanges between Sony and its employees regarding very sensitive matters, such as their medical treatments, disciplinary action, and inter-office romance.
The ease with which the hackers did their dirty work is eye-opening. The attack was carried out with widely available malware. It didn’t help that Sony’s security measures were shockingly subpar. Sony had failed to encrypt the leaked files. One of the stolen files containing login credentials to Sony computers and servers and other online accounts was quite obviously named “Passwords.”
Sony apparently made a conscious decision not to beef up its security. In 2007, Sony’s then-executive director information security, Jason Spaltro, said in an interview that it was a “valid business decision to accept the risk” of a security breach, and that he would not invest $10 million to avoid a possible $1 million in loss. A team of just 11 employees was responsible for maintaining the security systems for Sony’s 7,000 employees. A September 2014 security audit report showed gaps in Sony’s security procedures, such as failure to monitor one firewall and more than 100 other devices.
In the aftermath of the attack, Sony is facing four lawsuits. Three of the lawsuits allege that Sony failed to take adequate precautions to guard against known weaknesses in the security of its computer systems. Another lawsuit accuses Sony of waiting too long to notify employees that their personal data had been stolen.
What should companies do to protect themselves against a data breach like Sony’s? Be sure to develop administrative, physical, and technical safeguards over personal information handled by your company. At minimum, use encryption technology. If a third party handles personal information of your employees or customers, contractually require them to exercise reasonable care and to report security breaches immediately. Another precautionary measure is to conduct periodic security audits and risk analyses of information systems.
If a data breach involves a business located in Hawaii or one that does business in Hawai‘i and maintains or possesses personal information of Hawaii residents, Hawaii law requires the business to notify persons affected by the breach. If notice is provided to 1,000 persons or more at once, the State Office of Consumer Protection and credit reporting agencies must also be notified. Companies should prepare data breach procedures in advance so that a clearly charted process for complying with applicable notification laws is available in the chaos ensuing after a data breach incident.
Photo by Ian Lamont (CC BY 2.0) via Flickr
You’ve probably heard of BYOD (Bring Your Own Device). But do you know about BYOC? It stands for Bring Your Own Cloud, and it’s more prevalent than you might think.
Cloud storage services like DropBox, Google Drive, and SkyDrive sport features that are attractive to an increasingly mobile workforce. They provide gigabytes of storage for free. Files in the cloud are accessible anywhere with an internet connection. Changes to a file in a cloud account are synced across all devices with access to the account. It’s not difficult to see why cloud services are gaining popularity among individuals and companies alike.
Therein lies the problem. Because personal cloud accounts are so handy and easy to set up, an employee can create a security risk for a company in a matter of minutes. An employee can essentially connect the organization to the cloud without the company’s knowledge via a private cloud account. This enables the transfer of confidential company data to a location outside the company’s reach.
ComRent International, LLC v. Palatini, 2013 WL 5761319 (E.D. Pa. Oct. 24, 2013), involved such a scenario. ComRent hired Clayton Taylor to serve as a vice president of product development. Taylor primarily worked on matters related to Experium, a company that he co-founded and of which he was a minority owner. Taylor set up a Google Drive account to store, access, and edit all of Experium’s intellectual property and confidential commercial information. Only Taylor knew the username and password necessary for the account. When ComRent hired an engineering firm to consult on options for the future of Experium, Taylor refused to grant the firm access to any of Experium’s intellectual property, believing that ComRent might appropriate the intellectual property for itself. As a result, ComRent terminated Taylor and filed a lawsuit seeking access to the Google Drive account containing Experium’s corporate files.
Here are some tips for avoiding problems with unauthorized use of personal cloud storage accounts by employees.
Set a Policy: Remaining silent—and therefore ambiguous—about the organization’s stance on cloud storage can lead employees to believe they may use personal cloud accounts for work purposes without letting management know. To eliminate such misconceptions, set a policy on whether or not the organization will use cloud storage. If the decision is yes, then adopt measures to ensure responsible use of cloud storage. If the decision is no, then clearly communicate to employees that storing work data in a personal cloud account is against company policy.
Maintain Control: If an organization decides to use cloud storage, it should retain control over the information necessary to access the cloud storage account (e.g., login credentials). It is advisable to create an account under the organization’s name for official work purposes instead of allowing employees to use their personal accounts.
Restrict Unauthorized Cloud Services: Consider restricting access to private cloud storage sites from any device that can also access company data, including mobile devices, through the use of blacklists, proxies, and other network security measures. This will prevent the transfer of work files to a private cloud account. Organizations with BYOD programs might find it challenging to eliminate all access to private cloud services, but it is worthwhile consulting with the IT department about the feasibility of implementing such restrictions.
Retain Ownership: Make it clear that company information remains property of the company regardless of where it is stored. It’s also a good idea to have employees sign written non-disclosure agreements.
Stay safe in the cloud!
LinkedIn announced on June 6 that it experienced a data breach compromising the passwords of some of its members. Ten days later, LinkedIn got hit with a class action lawsuit. The lawsuit was filed in a California federal district court. You can read the complaint here.
A few key points about the lawsuit:
- The plaintiffs consist of two classes — (1) anyone in the U.S. who had a LinkedIn account on or before June 6, 2012, and (2) anyone in class #1 who paid for a premium account.
- In simple terms, adding “salt” to a password means assigning random values to a password to make it more difficult to decipher. For example, if the password were “JohnDoe,” you could salt it by adding the characters “5a6b7c,” giving you “JohnDoe5a6b7c.”
- Hashing refers to the process of running a password into a cryptographic function to convert it into an unreadable and encrypted format. The plaintiffs say that LinkedIn used an outdated hashing function that was first published by the NSA in 1995.
- The plaintiffs say that LinkedIn should have at least salted the passwords before running them through the hash function. Better yet, LinkedIn should have salted the passwords, input them into the hash function, salt the resulting hash value, and then run the hash value through a hash function. Then, LinkedIn should have stored the fully encrypted password on a separate and secure server apart from all other user information.
- The lawsuit brings claims based on California’s unfair competition law, California’s Consumers Legal Remedies Act, breach of contract, breach of implied covenant of good faith and fair dealing, breach of implied contract, and negligence.
- The plaintiffs in the first class (all LinkedIn users) say they were in the form of loss of value in their personal information. (Whether the court will accept that damage theory is questionable.) Those in the second class (premium members who paid fees) say they were injured in the form of the fees they paid to LinkedIn for premium membership.