Tag: Technology

The New Competition – Emerging Legal Technologies Out of Silicon Valley

The National Law Review - Legal Analysis Expertly Written Quickly Found

In January, the National Law Review had pleasure of attending theAnnual Marketing Partner Forum in beautiful Rancho Palos Altos, California. Programing was provided by the Legal Executives Institute at Thomson Reuters and featured over 15 hours of dynamic workshops. Hundreds of  marketing partners, managing partners, in-house counsel and senior-level marketing and business development professionals were in attendance.

The “New Competition” program featured emerging legal technologies within Silicon Valley. Catherine Hammack of Jurispect, Monica Zent of Foxwordy, and Daniel Lewis of Ravel Law each showcased their innovative technologies and shared their thoughts as to where innovation is taking the legal industry in 2015.

“Jurispect will help fundamentally transform how companies operate by providing organizations with a real-time analytical view of both exposure and opportunities to take proactive steps to manage legal and regulatory risk.” – Catherine Hammack

Catherine was present on two momentous occasions in U.S. financial history: as an intern at Arthur Anderson when Enron was indicted, and as a first-day associate at Bingham McCutchen the day Lehman Brothers filed for bankruptcy, and the start of the financial crisis in 2008.  Following her time at Bingham as a financial litigator, she transitioned to join Google’s Policy team, where her perspective on legal services dramatically changed.

Catherine Hammack of Jurispect - Real-time regulatory analytics for better business decisions

As Catherine elaborated in a post-conference interview: “There was a huge gap between the way law firms traditionally provide counsel and the way companies need information to make business decisions.” She was surrounded by engineers and data scientists who were analyzing vasts amounts of data with cutting edge technology.  Catherine became interested in adapting these technologies for managing risk in the legal and regulatory industries.  Inspired by Google’s data-driven decision making policies, she founded Jurispect.

Jurispect is a tool that companies can use to track legal and regulatory changes relevant to their industry, and possibly to identify risks earlier on to help avoid future Enrons and Lehman Brothers. Currently, Jurispect is geared toward companies in the financial services and technology space, and will be expanding into other regulated industries in the very near future.  Key decision makers in the corporate legal, compliance and risk departments of companies are benefitting from Jurispect’s actionable intelligence. The user’s experience is customized: Jurispect’s technology adjusts based on user profile settings and company attributes. As the user continues to utilize Jurispect, its algorithms continuously calibrate to improve the relevancy of information presented to each user.

Jurispect - New Legal technology emerging out of silicon valley

Jurispect’s team of seasoned experts in engineering, data science, product management, marketing, legal and compliance collaborated to develop the latest machine learning and semantic analysis technologies. These technologies are used to aggregate information across regulatory agencies, including sources such as policy statements and enforcement actions.  Jurispect also analyzes information in relevant press releases, and coverage by both industry bodies and mainstream news.  The most time-saving aspect of Jurispect are the results that coalesce into user-friendly reports to highlight the importance and relevance of the regulatory information to their company.  Users can view this intelligence in the form of notifications, trends, and predictive analytics reports.  Jurispect makes data analytics work for legal professionals so they spend less time searching, and more time on higher level competencies.  As Catherine elaborated, “We believe that analytics are quickly becoming central to any technology solution, and the regulatory space is no exception.”

“Foxwordy is ushering in the era of the social age for lawyers and for the legal industry.” – Monica Zent

Monica is an experienced entrepreneur and had already been running a successful alternative law firm practice when she founded Foxwordy. Foxwordy is a private social network that is exclusively for lawyers.  Monica reminded the audience that we are, remarkably, ten years into the social media experience and all attorneys should consider a well rounded social media toolkit that includes Foxwordy, Twitter, and LinkedIn.

Monica Zent of Foxwordy - the first private social network for lawyers

However, as Monica elaborated in a post-conference interview, LinkedIn, for example, “falls short of the needs of professionals like lawyers who are in a space that is regulated; where there’s privacy, [and] professional ethics standards.” As an experienced attorney and social seller, Monica understands that lawyers’ needs are different from other professionals that use the more mainstream and very public social networks, which is why she set out to create Foxwordy.

Foxwordy is currently available to licensed attorneys, those who are licensed but not currently practicing but regularly involved in the business of law, certified paralegals, and will eventually open up to law students. Anyone who fits the above criteria can request membership by going to the homepage, and all potential members go through a vetting process to ensure that they are a member of the legal community.  At its inception, the Foxwordy team expected to see more millennials and solo practitioners taking advantage of the opportunity to network on Foxwordy. Those populations have joined as expected, but what was surprising is how the product resonated across all demographics, positions and segments of the legal industry. Foxwordy has seen general counsels, in-house counsels, solo practitioners, major law firm partners, law school deans, judges, politicians and more become members.

Foxwordy logo -socal media network for lawyers

Foxwordy is currently available to join and will be emerging out of public beta around summertime this year.  As Monica said during her presentation “Time is the new currency”, and what the Foxwordy team has found via two clinical trials is that engaging Foxwordy saves lawyers an average of two hours per day. Membership includes all the core social features such as a profile page, connecting with others, the ability to ask questions and engage anonymously, exchange referrals, and exchange other information and resources. Free members experience all the core functions fully and there is a premium membership that is available with enhanced features and unlimited use of Foxwordy. In the closing thoughts of her post-conference interview, Monica shared that “the ability to engage anonymously and discreetly, yet at the same time collaborate with our legal colleagues and engage with them on a social level has been very powerful.”

“There is an amazing opportunity to use data analytics and technology to create a competitive edge for lawyers amidst all of this information…” – Daniel Lewis

Data analytics and technology has been used in many different fields to predict successful results. In his presentation, Daniel pointed out that fields traditionally considered more art than science have benefitted from the use of data analytics to predict accurate results.

Daniel Lewis of Ravel Law - use data analytics and technology to create a competitive edge for lawyers

Having conducted metrics-based research and advocacy while at the Bipartisan Policy Center, and observing how data-driven decision making was being used in areas like baseball and politics, Daniel was curious why the legal industry had fallen so far behind. Even though the legal field is often considered to be slow moving, there are currently over 11 million opinions in the U.S. judicial system with more than 350,000 new opinions issued per year. There is also a glut of secondary material that has appeared on the scene in the form of legal news sources, white papers, law blogs and more. Inspired by technology’s ability to harness and utilize vast amounts of information, Daniel founded Ravel Law to accommodate the dramatically growing world of legal information.

Ravel Law is optimized for all lawyers across the country. Currently, thousands of associates, partners, and in-house counsel are using Ravel.  Ravel has as also begun working with 30 of the top law schools around the country, with thousands of law students learning how to use it right alongside legal research staples such as Westlaw and LexisNexis.  Professors and students around the country have also independently discovered Ravel and are using and teaching it.  When asked why he works with law schools, Daniel said “We work with schools because students are always the latest generation and have the highest expectations about how technology should work for them.”  Students have given the Ravel team excellent feedback and have grown into a loyal user base over the past few years. Once these students graduate, they introduce Ravel to their firms. Ravel’s user base has been growing very quickly and they have only released a small portion of what their technology is ultimately capable of.

Ravel Law Logo - A New View on Legal Research

Ravel’s team of PhDs and technical advisors from Google, LinkedIn, and Facebook, has coded advanced search algorithms to determine what is relevant, thereby enhancing legal research’s effectiveness and efficiency. Ravel provides insights, rather than simply lists of related materials, by using big data technologies such as machine learning, data visualization, advanced statistics and natural language processing.  In a post-conference follow up Daniel elaborates: “Our visualizations then show how the results connect in context, helping people understand the legal landscape very rapidly as well as find needles in the haystack.” Ravel guides users toward analysis of relevant passages in a particular case, without navigating away from the original case or conducting a new search. Daniel and his colleagues will be launching more new features this year and are looking forward to continuing to “transform how attorneys search and understand all legal information.”

Cyber and Technology Risk Insurance for the Construction Sector

Much Shelist law firm logo

The recent, well-publicized retail store data breach controversies have spawned a number of lawsuits and insurance claims. Not surprisingly, insurers have responded with attempts to fight claims for coverage for such losses. Insurance underwriters are carefully monitoring decisions being handed down by courts in these lawsuits. All of this activity has led to a new emphasis on cyber and technology risk and assessments, as well as on insurance-program strategies.

These developments have ramifications for the construction industry that include, and go well beyond, the data-breach context. Contractors, design professionals and owners may find that in addition to losses caused by data breaches, other types of losses occasioned by technology-related incidents may not be covered by their existing insurance programs.

Specifically, insureds may find themselves with substantial coverage gaps because:

  • data and technology exclusions have been added to general liability policies.

  • such losses typically involve economic losses (as opposed to property damages or personal-injury losses) that insurers argue are not covered by general liability policies.

  • data and technology losses may be the result of manufacturing glitches rather than professional negligence covered by professional liability policies.

Coverage for claims involving glitches, manufacturing errors and data breaches in technology-driven applications — such as Building Information Modeling (BIM), estimating and scheduling programs, and 3D printing — may be uncertain. A number of endorsements are currently available for data breach coverage, but insurers don’t necessarily have the construction industry in mind as they provide these initial products.

In addition, there is no such thing as a “standard” cyber liability policy, endorsement or exclusion. Insurers have their own forms with their own wording, and as seemingly minor differences in language may have a significant impact in coverage, such matters should be run past counsel.

Construction insurance brokers are telling us that insurers are in the process of determining how to respond to cyber and technology risk claims, what products to offer going forward, and how to underwrite and price these products. Keith W. Jurss, a senior vice president in Willis’s National Construction Practice warns:

“As the construction industry continues to identify the unique “cyber” risks that it faces we are identifying gaps in the current suite of “cyber” insurance coverages that are available.  In addition, new exclusionary language related to cyber risk under CGL and other policies adds to the gap.  The insurance industry is slowly beginning to respond with endorsements that give back coverage or new policies designed to address the specific risks of the construction industry.

“As we identify cyber insurance underwriters willing to evaluate the risks specific to the construction industry, we are seeing the development of unique solutions in the market. There is, however, more work required and as construction clients continue to demand solutions the industry will be forced to respond.”

Consequently, this is a time to stay in close touch with qualified construction insurance brokers who understand the sector and have their hands on the pulse of the latest available cyber and technology risk products. As these products become available, clients may also want to consider what cyber and technology risk coverage to require on projects and whether to include these requirements in downstream contracts.

ARTICLE BY

Josh M. Leavitt
OF
Much Shelist, P.C.

Only two more weeks until the Retail Law 2014 Conference – October 15-17, 2014, Charlotte, NC

The National Law Review is pleased to bring you information about the upcoming Retail Law Conference:

Retail Law 2014: At the Intersection of Technology and Retail Law
Retail Law 2014: At the Intersection of Technology and Retail Law

Register Today!

When

October 15-17, 2014

Where

Charlotte, NC

The 2014 Retail Law Conference takes place October 15-17 in Charlotte, NC. This year’s program is stronger than ever with relevant, compelling and interactive sessions focused on the legal issues affecting retailers. In partnership with the Retail Litigation Center (RLC), RILA will host legal counsel from leaders in the retail industry for the fifth annual event.

This year’s Retail Law Conference will feature issues at the intersection of technology and law, how the two spaces interact and the impact that they have on retailers. Topics will likely include:

  • Anatomy of a Data Breach: Prevention & Response
  • Privacy: Understanding New Technologies & Data Collection
  • Advertising Practices: Enforcement & Social Media
  • ADA Implications for New Technologies
  • Legal Implications for Future Payment Technologies
  • Policies & Procedures of The “Omnichannel” Age
  • Patent Litigation “Heat Maps”
  • Union Organizing Campaigns
  • Wage & Hour Litigation
  • EEOC Enforcement
  • Foreign Corrupt Practices Act
  • Corporate Governance & Disclosure
  • Election 2014
  • Dueling Views of The U.S. Supreme Court
  • Legal Ethics

The Retail Law Conference is open to executives from retail and consumer goods product manufacturing companies. All others, such as law firms and service providres, must sponsor in order to attend, and can do so by contacting Tripp Taylor at tripp.taylor@rila.org.

Attend the Retail Law 2014 Conference – October 15-17, 2014, Charlotte, North Carolina

The National Law Review is pleased to bring you information about the upcoming Retail Law Conference:

Retail Law 2014: At the Intersection of Technology and Retail Law
Retail Law 2014: At the Intersection of Technology and Retail Law

Register Today!

When

October 15-17, 2014

Where

Charlotte, NC

The 2014 Retail Law Conference takes place October 15-17 in Charlotte, NC. This year’s program is stronger than ever with relevant, compelling and interactive sessions focused on the legal issues affecting retailers. In partnership with the Retail Litigation Center (RLC), RILA will host legal counsel from leaders in the retail industry for the fifth annual event.

This year’s Retail Law Conference will feature issues at the intersection of technology and law, how the two spaces interact and the impact that they have on retailers. Topics will likely include:

  • Anatomy of a Data Breach: Prevention & Response
  • Privacy: Understanding New Technologies & Data Collection
  • Advertising Practices: Enforcement & Social Media
  • ADA Implications for New Technologies
  • Legal Implications for Future Payment Technologies
  • Policies & Procedures of The “Omnichannel” Age
  • Patent Litigation “Heat Maps”
  • Union Organizing Campaigns
  • Wage & Hour Litigation
  • EEOC Enforcement
  • Foreign Corrupt Practices Act
  • Corporate Governance & Disclosure
  • Election 2014
  • Dueling Views of The U.S. Supreme Court
  • Legal Ethics

The Retail Law Conference is open to executives from retail and consumer goods product manufacturing companies. All others, such as law firms and service providres, must sponsor in order to attend, and can do so by contacting Tripp Taylor at tripp.taylor@rila.org.

Microsoft Ordered to Hand Over Data to the U.S. Government

Proskauer Law firm

In April, Microsoft tried to quash a search warrant from law enforcement agents in the United States (U.S.) that asked the technology company to produce the contents of one of its customer’s emails stored on a server located in Dublin, Ireland. The magistrate court denied Microsoft’s challenge, and Microsoft appealed. On July 31st, the software giant presented its case in the Southern District of New York where it was dealt another loss.

U.S. District Judge Loretta Preska, after two hours of oral argument, affirmed the magistrate court’s decision andordered Microsoft to hand over the user data stored in Ireland in accordance with the original warrant. Microsoft argued that the warrant exceeded U.S. jurisdictional reach. However, the court explained that the decision turned on section 442(1)(a) of Restatement (Third) of Foreign Relations. The provision says that a court can permit a U.S. agency “to order a person subject to its jurisdiction to produce documents, objects or other information relevant to an action or investigation, even if the information or the person in possession of the information is outside the United States.” Because Microsoft is located in the U.S. , the information it controlled abroad could be subject to domestic jurisdiction.

Microsoft had the support of large U.S. technology companies, including Apple, AT&T and Verizon. The larger issue for these companies lies in the U.S. government’s power to seize data and content held in the cloud and stored in locations around the world. When a conflict arises between the data sharing laws of the country where the servers are located and U.S. law, it can put these companies in the difficult position to choose to follow one country’s laws over the other.

Microsoft further argued that the ramifications for international policy are substantial. The company argued that compelling production of foreign stored information was an intrusion upon Irish sovereignty. It said that the decision could be interpreted by foreign countries as a green light to make similar invasions into data stored in the U.S. However, Judge Preska dismissed these concerns as diplomatic issues that were incidental and not of the court’s immediate concern.

The order has been stayed pending appeal.

ARTICLE BY

Rohit Dave
 
OF 
Proskauer Rose LLP

Patent Practitioners: Inventions and the Ecosystem of Ideas

Womble Carlyle Law firm

There are some striking parallels between inventions and living organisms, and between technology in a consumer marketplace and an ecosystem.  Insights gained through the comparisons may be beneficial to inventors, companies, consumers and the patent community.  What are the connections?  To review, living organisms exist in an ecosystem, and flourish or perish according to the laws of nature, with survival of the fittest.  Variations among the organisms occur from generation to generation, and are positively or negatively selected over the passage of time and generations, as organisms evolve.  This begets new species, which occupy environmental niches in the ecosystem, and also begets extinction in which species die off.  Ideas, invention and technology exist in a sort of man-made ecosystem, with the consumer marketplace performing a selection process, the whole experiencing a type of guided evolution.

Human beings have ideas.  We brainstorm them, communicate them to each other, and come up with more ideas.  Humans invent, bringing some of these ideas to fruition.  In turn, humans bring some of these ideas to actual products, which are then put up for sale and use in the consumer marketplace.  This is a sort of test in the ecosystem, as to which products will survive.  Consumers then make choices, purchasing the products they like, for various reasons.  Products that are not purchased and used influence manufacturers to stop making those products.  Products that are purchased and used influence manufacturers to continue making those products, and to develop next-generation variations of those products.  New features are added to next-generation products, and some of these new features are popular, and some are not.  The process of selection as to popularity, and sales volume, of products, is made by the consumers.

Next-generation variations of products are rather like offspring with mutations, in the comparison to living organisms in an ecosystem.  A brand-new, never before seen product is rather like a new species that has suddenly emerged.  Entire product types that become obsolete are rather like the dinosaurs that went extinct long ago.  Even the term “dinosaur”, in colloquial usage, is synonymous with outdated technology (and is also sometimes applied to people who still prefer to use such outdated technology).

Ideas, invention, products and technology thus emerge, develop, thrive or perish, beget variations, and evolve over time in the consumer marketplace.  The ever-present interest by, and purchasing power of, consumers drives the selection process that guides the evolution of products and technology.  The ever-present ingenuity of inventors, and desire for companies to succeed in the marketplace, drives the production and mutation (variation) processes that guide the evolution of products and technology.  The history of technology thus parallels the history of living organisms. 

We patent practitioners are privileged to be chroniclers of inventions.  A study through the body of published patent applications and issued patents illuminates the more recent history of invention and key aspects of technology.  A study of the United States Patent Classification System, as developed and used by the United States Patent and Trademark Office, is rather like studying the taxonomy of living organisms.

How might we apply these insights?  Consider a new product without a marketplace.  Is such a product likely to survive?  Perhaps a new marketplace will emerge for the new product, which could then dominate.  How will other products compete with this new product?  How will consumers decide whether to select and use, or deselect the new product?  Consider competition against a product that is well-established in a marketplace.  What new feature or new product could compel consumers to favor it?  If some branch of technology is headed for obsolescence, why is this?  If some new branch of technology is emerging, how might it fare, and why?  And, for the patent practitioners in the audience, how might we best capture the innovative aspects and the inventions in our drawings, descriptions and claims on behalf of the inventors?  This is all part of the art of patenting.

ARTICLE BY

Christopher M. Hall
 
OF 
Womble Carlyle Sandridge & Rice, PLLC

Attend the Retail Law 2014 Conference – October 15-17, 2014, Charlotte, North Carolina

The National Law Review is pleased to bring you information about the upcoming Retail Law Conference:

Retail Law 2014: At the Intersection of Technology and Retail Law
Retail Law 2014: At the Intersection of Technology and Retail Law

Register Today!

When

October 15-17, 2014

Where

Charlotte, NC

The 2014 Retail Law Conference takes place October 15-17 in Charlotte, NC. This year’s program is stronger than ever with relevant, compelling and interactive sessions focused on the legal issues affecting retailers. In partnership with the Retail Litigation Center (RLC), RILA will host legal counsel from leaders in the retail industry for the fifth annual event.

This year’s Retail Law Conference will feature issues at the intersection of technology and law, how the two spaces interact and the impact that they have on retailers. Topics will likely include:

  • Anatomy of a Data Breach: Prevention & Response
  • Privacy: Understanding New Technologies & Data Collection
  • Advertising Practices: Enforcement & Social Media
  • ADA Implications for New Technologies
  • Legal Implications for Future Payment Technologies
  • Policies & Procedures of The “Omnichannel” Age
  • Patent Litigation “Heat Maps”
  • Union Organizing Campaigns
  • Wage & Hour Litigation
  • EEOC Enforcement
  • Foreign Corrupt Practices Act
  • Corporate Governance & Disclosure
  • Election 2014
  • Dueling Views of The U.S. Supreme Court
  • Legal Ethics

The Retail Law Conference is open to executives from retail and consumer goods product manufacturing companies. All others, such as law firms and service providres, must sponsor in order to attend, and can do so by contacting Tripp Taylor at tripp.taylor@rila.org.

What 2014’s Continued IPO Surge Means for Clean Tech and Renewable Energy Companies

Mintz Levin Law Firm

The year 2014 is on track to be the most active IPO marketin the United States since 2000, with the mid-year total number of IPOs topping last year’s mid-year total by more than 60%.[1] There were 222 US IPOs in 2013, with a total of $55 billion raised, and 2014 has already seen 151 US IPOs, for a total of $32 billion, completed by the mid-year mark. The year 2000 (over 400 IPOs) was the last year of a 10-year boom in US IPOs that reached its peak in 1996 (over 700 IPOs).

What does this mean for emerging energy technology andrenewables companies that might be looking to the capital markets? As of mid-year 2014, there have been six cleantech/renewables IPOs, while there were a total of seven in all of 2013. In both years, these deals have represented a relatively small percentage of total IPOs and still do not match the level of activity in the more traditional energy and oil & gas sector.  In 2014, IPOs were completed by a range of innovative companies, including Aspen Aerogels, TCP International and Opower.

Two unambiguously positive developments for clean energy in 2013 and the first half of 2014 have been the strong market for follow-on offerings and YieldCo IPOs. As was the case in 2013, several larger energy tech companies that are already public completed follow-on offerings to bolster cash for growth in 2014. Following in the footsteps of Tesla, SunEdison, First Solar, and other companies who completed secondary offerings in 2013, Jinko Solar (January 2014), Pattern NRG (May 2014), Plug Power (January and April 2014), Trina Solar (June 2014), and several other public companies capitalized on the continued receptiveness of clean-tech capital markets.

Following on successful YieldCo IPOs in 2013 (NRG Yield, Pattern Energy), there have already been three YieldCo IPOs in 2014: Abengoa Yield, NextEra Energy Partners, and, most recently, Terraform Power. The continued growth of YieldCo deals as well as the growing dollar amount of such offerings is an extremely encouraging sign for the energy and clean-tech sector as a whole, signaling a longer-term market acceptance of the ongoing changes in domestic and global energy consumption. The successful public market financings of these companies – whose strategy typically involves the purchase and operation of existing clean, energy-generating assets – should result in increased access to capital for renewable energy generation assets, as well as related technologies and services across the sector.

If the first half of this year is any indication, 2014 should prove to be a strong year for clean-tech and renewable energy companies opting to pursue the IPO path. The IPOs, follow-on offerings, and YieldCo successes that we’ve seen so far should improve the prospects for forthcoming clean-energy IPOs in the second half of 2014 and beyond.  I expect to see more renewable/clean energy companies follow the IPO route and make the most of the market’s continued receptiveness.

[1]  Please note that there will be some variance in the statistics for IPOs generally. This is because most data sets exclude extremely small initial public offerings and uniquely structured offerings that don’t match up with the more commonly understood public offering for operating companies. The data above is based on information from http://bear.warrington.ufl.edu/ritter/IPOs2012Statistics.pdf and Renaissance Capital www.renaissancecapital.com.

ARTICLE BY:

Sahir Surmeli
OF:
Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C

The National Law Review is Going Back to the Future. New website coming up soon!

The National Law Review is honoring its roots as one of the country’s first nation-wide legal journals by returning to a more journalistic style.   At the same time, we’re adding enhanced features to help our readers more quickly find the nation’s breaking legal news and analysis.

NLR-Transition-3-slide-7-16-14_256

Look for changes over the next few weeks.

Launch date soon!

HEARTBLEED: A Lawyer’s Perspective on the Biggest Programming Error in History

Jackson Lewis Logo

By now you have probably heard about Heartbleed, which is the biggest security threat to the Internet that we have ever seen. The bottom line of Heartbleed is that for the past two years most web sites claiming to besecure, shown by the HTTPS address (the S added to the end of the usual HTTP address was intended to indicate a web secured by encryption), have not been secure at all. Information on those webs could easily have beenbled out by any semi-skilled hacker who discovered the defect. That includes your user names and passwords, maybe even your credit card and bank account information.

For this reason every security expert that I follow, or have talked to about this threat, advises everyone to change ALL of their online passwords. No one knows who might have acquired this information in the past two years. Unfortunately, the nature of this software defect made it possible to steal data in an untraceable manner. Although most web sites have upgraded their software by now, they were exposed for two years. The only safe thing to do is assume your personal information has been compromised.

Change All of Your Passwords

After you go out and change all of your passwords – YES – DO IT NOW – please come back and I will share some information on Heartbleed that you may not find anywhere else. I will share a quick overview of a lawyer’s perspective on a disaster like this and what I think we should do about it.

Rules of the Internet

One of the things e-discovery lawyers like me are very interested in, and concerned about, is data security. Heartblead is the biggest threat anyone has ever seen to our collective online security, so I have made a point of trying to learn everything I could about it. My research is ongoing, but I have already published on detailed report on my personal blog. I have also been pondering policy changes, and changes in the laws governing the Internet that be should made to avoid this kind of breach in the future.

I have been thinking about laws and the Internet since the early 1990s. As I said then, the Internet is not a no-mans-land of irresponsibility. It has laws and is subject to laws, not only laws of countries, but of multiple independent non-profit groups such as ICANN. I first pointed this out out as a young lawyer in my 1996 book for MacMillan, Your Cyber Rights and Responsibilities: The Law of the Internet, Chapter 3 of Que’s Special Edition Using the Internet. Anyone who commits crimes on the Internet must and will be prosecuted, no matter where their bodies are located. The same goes for negligent actors, be they human, corporate, or robot. I fully expect that several law suits will be filed as a result of Heartbleed. Time will tell if any of them succeed. Many of the facts are still unknown.

One Small Group Is to Blame for Heartbleed

The surprising thing I learned in researching Heartbleed is that this huge data breach was caused by a small mistake in software programming by a small unincorporated association called OpenSSL. This is the group that maintains the open source that two-thirds of the Internet relies upon for encryption, in other words, to secure web sites from data breach. It is free software and the people who write the code are unpaid volunteers.

According to the Washington Post, OpenSSL‘s headquarters — to the extent one exists at all — is the home of the group’s only employee, a part timer at that, located on Sugarloaf Mountain, Maryland. He lives and works amid racks of servers and an industrial-grade Internet connection. Craig Timberg, Heartbleed bug puts the chaotic nature of the Internet under the magnifying glass (Washington Post, 4/9/14).

The mistake that caused Heartbleed was made by a lone math student in Münster, Germany. He submitted an add-on to the code that was supposed to correct prior mistakes he had found. His add on contained what he later described as a trivial error. Trivial or not, this is the biggest software coding error of all time based upon impact. What makes the whole thing suspicious is that he made this submission at one minute before midnight on New Year’s Eve 2011.

Once the code was received by OpenSSL, it was reviewed by it before it was added onto the next version of the software. Here is where we learn another surprising fact, it was only reviewed by one person, and he again missed the simple error. Then the revised code with hidden defect was released onto an unsuspecting world. No one detected it until March 2014 when paid Google security employees finally noticed the blunder. So much for the basic crowd sourcing rationale behind the open source software movement.

Conclusion

Placing the reliance of the security of the Internet on only one open source group, OpenSSL, a group with only four core members, is too high a risk in today’s world. It may have made sense back in the early nineties when an open Internet first started, but not now. Heartbleed proves this. This is why I have called upon leaders of the Internet, including open source advocates, privacy experts, academics, governments, political leaders and lawyers to meet to consider various solutions to tighten the security of the Internet. We cannot continue business as usual when it comes to Internet data security.

Article By:

Ralph C. Losey
Of: 
Jackson Lewis P.C.