FTC Launches New Office of Technology

On February 17, 2023, the Federal Trade Commission announced the launch of their new Office of Technology. The Office of Technology will assist the FTC by strengthening and supporting law enforcement investigations and actions, advising and engaging with staff and the Commission on policy and research initiatives, and engaging with the public and relevant experts to identify market trends, emerging technologies and best practices. The Office will have dedicated staff and resources and be headed by Chief Technology Officer Stephanie T. Nguyen.

Article By Hunton Andrews Kurth’s Privacy and Cybersecurity Practice Group

For more privacy and cybersecurity legal news, click here to visit the National Law Review.

Copyright © 2023, Hunton Andrews Kurth LLP. All Rights Reserved.

MAXIMUM PRESSURE: Stratics Networks Hit With Massive DOJ Complaint Related to RVM Use by Customers and The Heat is Really On Platforms Right Now

So just last month the covered the story of Phone Burner being absolutely destroyed by a recent FCC order directing carriers to stop carrying its traffic. It be came the most read story EVER on TCPAWorld.com.

This one might be even bigger.

Before I get to the punchline, bear with me for a second.

Ringless voicemail.

I have been saying for many years that these things are covered by the TCPA. The Courts have said it. The FCC has said it.

But the ringless voicemail providers, by and large, refused to get the message. As recently as late last year I still have people coming to me telling me that this platform or that service was telling them that the TCPA does not apply to ringless voicemail. And I have personally heard sales pitches within the last couple of years where a ringless voicemail provider told potential customers the TCPA does not apply to the technology.

Lies, lies and more lies. And I hate lies.

The argument for RVM not being covered by the TCPA is a dreadful one. Some lawyer–NOT ME– long ago prepared a white paper suggesting that because voicemail is a title III information service and not a title II communication service that, somehow, that means the direct drop process to leave a voicemail also wasn’t a communication. Its nuts. Totally irrational. And beyond that, it was just dumb.

There was a better rationale for the argument–that the messages traversed business class landlines and not cellular networks–but that argument, too, has been rejected in recent years.

Anyhoo, RVM are definitely covered by the TCPA and that is a fact that has been known for many years. But that did not stop one major RVM provider from–allegedly–allowing its users to blast folks without consent.

And here is where we get to the big news: On Friday the Department of Justice filed a massive complaint–on referral from the FTC–against a debt relief company that was allegedly violating the TSR by sending RVMs without consent and failing to include content required by the TSR in the message.

Please notice that the complaint was NOT just filed against the debt relief company. It was filed against Stratics Networks–the wholesale carrier that permitted the traffic and also, apparently, supplied the RVM platform that was used to send the messages. But the complaint was also filed against the intermediary VOIP service provider, Netlatitude, Inc.–and its president Kurt S. Hannigan personally (!),  that provided access to the debt relief company through Stratics (or perhaps vice versa.)

The actual wrongdoers were apparently a debt relief company called Tek Ventures, LLC, doing business as Provident Solutions and a marketing company hired by Provident–Atlas Marketing Partners, Inc.

A bunch of other players, including INDIVIDUALS are also named as the FTC and DOJ really came to play with a sledgehammer here.

Each of these companies (and people) are alleged to have done something a bit different wrong. And its worth seeing how the government is going after each member of the alleged illegal robocall ring.

Of most interest to me–and I suspect most of you–is the case against Stratics. Like Phone Burner, Stratics is a very well known platform out there. Big footprint. And it is perceived to be a fairly compliant player.

Out of the gate, some of the allegations of the Complaint seek to impose a MUCH broader set of requirements on a carrier than have ever been seen before. For instance, the DOJ complains:

  • Despite acknowledging in its terms and conditions of service that its customers must “obtain the prior written consent from each recipient to contact such recipient” “[w]here required by applicable law or regulation,” Stratics Networks did not have evidence of such consent and did not request or require that its customers submit such evidence;

  • Stratics Networks has access to the prerecorded messages its customers upload to its RVM platform and reserves the right to audit its customers’ accounts in its terms and conditions of service, but it does not conduct due diligence to ensure that the messages actually identified the seller or caller, or to prohibit the transmission of prerecorded messages that failed to do so, or to ensure that that the call recipient had given express consent to receive the call; and

  • Stratics did not “require[]” and “ensur[e] that users  obtain prior express written consent from recipients, scrub lists of uploaded phone numbers against the DNC Registry, or otherwise comply with the TSR as a condition of using the platform.

But, so what?

A carrier owes no duty to at law to review the content of messages sent over its network. Gees, it would be a huge violation of privacy if it did. And sure an RVM platform may have access to the voicemails that were uploaded but since when is it required to review those and provide compliance advice? That’s just plain nuts.

Further, the fact that Stratics required consent for users of its platform is plenty. Folks use AUPs and disclosures to assure their platforms are not being misused. Since when does the law require them to actually possess consent–or “require” and “ensure” compliance– before allowing someone to use their network? Since never. And its just nuts for the FTC and DOJ to suggest otherwise.

Outside of really extreme cases, a carrier is still just a carrier. And a platform is still just a platform. Sure there can be times when these companies are so involved with messages–or know (we’ll get to that) of abuses–such that they are responsible as if they had sent them. But in the ordinary course these folks have NO DUTY to ensure…. anything.

So I’m a bit perturbed by the insinuation that these allegations, alone, make Stratics blameworthy. They speak to duties that do not exist in the law. If the DOJ and FTC doesn’t like the current state of the law they should take it up with Congress (or, in the case of the FTC, start an NPRM process, hint hint.)

But other allegations are more damaging–particularly those related to the knowledge Stratics had about the use of its platform. And, here again, we see the ITG playing a big role.

Per the Complaint, “Stratics Networks received numerous Traceback Requests from USTelecom’s ITG alerting it to suspected illegal robocall traffic delivered via Stratics Networks’ RVM platform service and seeking its assistance in identifying the source(s) (i.e., upstream carrier or originating end-user) of these “likely illegal” robocalls, including over 30 such requests between August 2019 and February 2021.”

Now 30 requests may seem like a lot, but you have to keep in mind how active the ITG is. They’re firing off a ton of “tickets” every single day. So I’m not convinced that 30 tickets over a year and a half is really that big of a deal. Plus, these tickets are directed at the content of user messages traversing the Stratics network–it does not mean that any of these were actually Stratics customers. (BTW, the DOJ was kind enough to name a bunch of the ticket sources: “Atlas Marketing, Telecord, Telesero, Health Innovations, National Homebuyers, Elite Processing, Deltracon, Technest Limited, Shamoon Ahmad, Progressive Promoting, Nitzke Enterprize, Care Advocacy Solutions, and PubClub.” Hope your name isn’t in there!)

So, again, I don’t love the government’s case so far. But it does get stronger. For instance:

  • In some instances, even when Stratics Networks did identify the RVM customers responsible for these illegal robocalls, Stratics Networks allowed these RVM customers to open additional accounts and/or continue utilizing its RVM platform service for several weeks or months without suspending or terminating their RVM accounts.

  • In some instances, Stratics Networks did not suspend these RVM customers’ accounts until after it received a civil investigative demand from the FTC in November 2020 inquiring about prerecorded messages delivered using its RVM platform service.

Ok, now the government is getting closer. The case law is reasonably clear that where a carrier or platform knows of illegal traffic on its network it does need to take some action to prevent it. If Stratics allowed customers who were committing violations to open new accounts or run new campaigns that could be a problem, unless it did extra heightened diligence to assure compliance.

But now, the big allegations:

  • Several of US Telecom’s ITG’s Traceback Requests to Stratics Networks concerned robocalls delivered over Stratics Networks’ RVM platform as part of the Atlas Defendants’ debt relief telemarketing campaign, including Traceback Requests Stratics Networks received between April and June 2020. These Traceback Requests indicated that they concerned a “DebtReduction-Hardship” or “DebtReduction CoronaHardship” campaign, and they noted that the robocalls delivered prerecorded messages offering preapproved loans and did not identify the caller.

  • Notwithstanding Stratics Networks’ representation to US Telecom’s ITG in response to a April 29, 2020 traceback request that it “ha[d] taken immediate action and triggered a full investigation” into the Traceback Request and “also suspended traffic,” Stratics Networks permitted Atlas Marketing to continue using its RVM platform service to deliver millions more robocalls for over five more months;

  • After April 29, 2020, Stratics Networks permitted Atlas Marketing to use its RVM service to deliver more than 23 million additional ringless voicemail robocalls to American consumers.

Ok so Stratics allowed 23 million voicemails by Atlas after telling the ITG it would suspend its traffic. Now that could be a problem. Especially if those 23MM voicemails violated the TSR and TCPA (although that fact is, perhaps tellingly, left out of the complaint.)

Notice the timing here also. ITG tickets went out in April, 2020. A CID followed in October, 2020. And then the complaint was filed in February, 2023 two and a half years later.

So all of you carriers and platforms that have received ITG tickets followed by CIDs, keep this in mind. Even if a year or more has passed, the FTC might still be working the case.

So what did Netlatitude do wrong? Well this appears to be a volume play. Specifically the FTC is concerned that Netlatitude allowed Atlas to send “136,000 robocalls” using Stratics Networks’ SIP termination service on just two days in September 2020.

Again, I kind of want to shrug at that. While high volume traffic can be a red flag, there is ZERO requirement a carrier decline to carry traffic merely because there might be a lot of it.

Netlatitude also apparently received several ITG tickets but it is not clear that they had anything to do with Atlas. So I am very fuzzy as to why Netlatitude is in the case–except that Stratics apparently pointed the finger at Netlatitude and its President.

As to the debt relief companies, the claims here are wide and varied. First, there is a claim of straight consumer deception. They allegedly promised consumers they’d be out of debt in two years and that monthly payments would be used in a way that turned out not to be true. Ok. Makes sense.

Next they allegedly sent voicemails that did not identify the sender and sent calls to numbers on the DNC list without consent. Again, pretty straightforward.

They also allegedly received a fee prior to providing debt relief, which is also not permitted. So… if true, open and shut case. I think.

In the end the government is asking for a bunch of stuff. Most damaging for Stratics is the injunctive relief provision:

A. Enter a permanent injunction to prevent future violations of the TSR and the FTC Act by Defendants;

B. Award monetary and other relief within the Court’s power to grant;

C. Award Plaintiff monetary civil penalties for every violation of the Telemarketing Sales Rule; and

D. Award Plaintiff such other and additional relief the Court may determine to
be just and proper

Lots of big take aways here. We already knew that carriers and platforms can’t turn a blind eye to bad traffic on their networks, but in this case the government seeks to go much further and impose duties on these companies to “require” and “ensure” only lawful traffic traverses their networks. That is just craziness and I think a lot of carriers will fold up shop if they suddenly become strictly liable for misconduct on their networks. Indeed, just 8 years ago carriers were completely beyond liability for traffic on their network and now they are to be treated as always liable for it? That is unfair and absurd.

Obviously those of you in the debt relief game need to pay careful attention here as well. NO cheating allowed. If you make a representation it has to be true. And don’t charge that fee up front–can get you into trouble.

Notice also that NONE of these claims are brought under the TCPA. But some could have been. The TCPA also prevents the use of RVMs to to cell phones without the proper level of consent. And the TCPA bans solicitations to residential numbers on the DNC list. I presume the DOJ didn’t want to tangle with any additional issues here–or perhaps the FTC did not want to tread on the FCC’s toes by moving into TCPA issues. Unclear to me.

But what IS clear to me is that this complaint is a huge deal and should really have every carrier and platform out there asking itself what the future may hold…

Read the complaint here: Complaint Against Stratics, et al.

© 2023 Troutman Firm

8 Best Lawyer Forums Online

Though unorthodox for a traditional profession like the law, remote work is becoming a more realistic option for lawyers all over the country. With the help of tools like legal practice management software and options to practice law in multiple states, lawyers everywhere are tackling the challenges of remote work.

But one obstacle that remains is networking. Remote lawyers need to put extra work into maintaining professional connections and building an online presence, both of which are made easier with online forums designed specifically for legal professionals.

What Is an Online Forum?

An online forum is an internet space dedicated to conversation using questions, answers, responses, and prompts. Typically, online forums are asynchronous — users post a question, then other users respond at their leisure.

Posts in forums are archived and arranged into categories like post date, popularity, and more. Discussions can last for hours, days, months, or possibly years, as long as users continue to contribute.

Why Should Lawyers Use Online Forums?

After the rapid shift to remote work during the COVID-19 pandemic, plenty of industries saw the value of allowing employees to work from home – including law firms. More and more lawyers are working remotely, but that could come at the cost of networking.

Networking doesn’t have to mean interactions that take place over coffee, lunch, cocktails, golf excursions, or big events. In the strictest sense, networking is any meeting between people, whether in a group or one on one, online or in-person, which can be done using online forums.

Online forums dedicated to lawyers and the legal industry are an effective way to facilitate networking opportunities when in-person meetings aren’t an option. Getting involved in online forums help lawyers discuss industry topics with experts and thought leaders, stay current on trends and technology, and learn valuable tips from other lawyers.

Top 8 Online Forums for Lawyers

Curious about online forums? Here are the best options for lawyers and legal professionals to engage with other legal professionals and build a network as a remote attorney:

1. Quora

Quora is a broad forum that covers a variety of topics in question-and-answer formats, including the legal industry. You can easily search for questions or topics that are trending in the legal industry and contribute expert answers to boost your credibility. The more answers you provide, and the more other users engage with you, the closer you can get to becoming a thought leader in the space.

2. Bar Association Forums

Bar association forums are always a benefit to lawyers, remote or otherwise. There are plenty of options to choose from, including local bar associations or forums dedicated to your practice area. Best of all, you’ll be engaging with other knowledgeable legal professionals to connect and network.

3. Social Media Groups

Social media channels like Facebook and LinkedIn have dedicated groups that bring together users based on interests or industries, such as the legal industry. These two platforms are among the best for getting into a private or public group and enhancing your online presence. Keep in mind that you are representing yourself as a lawyer in these groups, so use a professional social media account, not your personal one.

The Thomson Reuters Legal Community is an exclusive option for customers of Thomson Reuters that brings together a virtual community of lawyers to network and engage in group settings. You can connect with lawyers from all different practice areas, both locally and nationally, and gain valuable insights from industry experts.

5. The Lawyerist Community

The Lawyerist is an online community dedicated to small firm lawyers to provide coaching, podcasts, books, guides, and other insights. The company has its own online lawyer forum – The Lawyerist Community – on Facebook to discuss law firm best practices, trends, and ideas.

6. Reddit

Reddit has some of the best online forums for a range of different topics, from broad subjects like sports to niche communities dedicated to obscure literature. There’s also a legal forum, r/LawFirm, that’s an informal community for lawyers to discuss running a law firm and the legal industry as a whole. There’s also a lawyer subreddit that you can join if you’re licensed.

7. Slack

Slack is a top-rated collaboration platform that offers individual channels for groups of users. There are several communities dedicated to the law, including LawyerSmack, which is comprised of private attorneys.

8. Law School Alumni Forums

Some law schools have online forums for alumni to stay connected with faculty and colleagues. While not every school offers an online forum for networking, if yours does, you can build vital industry contacts and further your practice. You’ll also get updates on news, trends, and in-person network events by participating in the forum.

Outlook on Online Forums

Remote and hybrid working models are the “new normal,” even for lawyers. Now that law firms and lawyers have seen the benefits in productivity, work-life balance, and enhanced communication afforded by remote work, there’s no going back.

Still, lawyer networking is essential for lawyers to grow their practice, no matter if it’s online or in-person. Along with joining forums to engage in discussions with other industry professionals, you can enhance your remote work with law practice management software. The right law firm software empowers lawyers to manage their practice from anywhere.

Start Networking Remotely

Networking is a big part of successful client acquisition for lawyers. Though it takes a little more work to keep up with networking as a lawyer working remotely, online lawyer forums can keep you connected to other industry professionals. And because you can engage with lawyers all over the country, you can find even more opportunities online than in person at networking events.

© Copyright 2023 PracticePanther

DOL Issues Guidance on Handling Telework Under FLSA, FMLA

The U.S. Department of Labor (DOL) has issued guidance on the application of the Fair Labor Standards Act (FLSA) and Family and Medical Leave Act (FMLA) to employees who telework from home or from another location away from the employer’s facility.

The Field Assistance Bulletin (FAB) 2023-1, released on February 9, 2023, is directed to agency officials responsible for enforcement and provides employers a glimpse into how the DOL applies existing law and regulations to common remote-work scenarios. FAB 2023-1 addresses FLSA regulations governing “hours worked,” rules related to break time and privacy for nursing employees, and FMLA eligibility factors.

Hours Worked

In the FAB, the DOL reviews the rules governing compensability of work time, explaining that, regardless of work location, short breaks (typically, 20 minutes or less) generally are counted as compensable hours worked, whereas, longer breaks “during which an employee is completely relieved from duty, and which are long enough to enable [the employee] to use the time effectively for [their] own purposes[,] are not hours worked.” Examples of short breaks, whether at home or in the office, include when an employee takes a bathroom or coffee break or gets up to stretch their legs.

Longer rest breaks and periods of time, when employees are completely relieved from duty and able to use the time for their own purposes, are not considered work time. Just as would be the case when an employee is working in the office, if during remote work an employee’s 30-minute lunch break is interrupted by several work-related phone calls, that 30-minute period would be counted as hours worked. Conversely, if an employee working from home takes a three-hour break to pick up their child or to perform household chores, that time does not count as work time under the FLSA. In short, the FAB reiterates the telework guidance set forth by the DOL in a Q&A series published during the height of the COVID-19 pandemic.

The FAB emphasizes that, regardless of whether an employee performs duties at home, at the worksite, or at some other location, if the employer knows or has reason to believe that work is being performed, the time must be counted as hours worked. Importantly, the FAB notes that an employer may satisfy its obligation to exercise reasonable diligence to acquire knowledge regarding employees’ unscheduled hours of work by providing a reasonable reporting procedure for employees to use when they work non-scheduled time and paying employees for all hours worked. This guidance was addressed in greater detail in FAB 2020-5.

Guidelines for Nursing Employees

The FAB further clarifies that, under the FLSA, an employer’s obligation to provide employees “reasonable break time,” as well as an appropriate place to express breast milk, extends to employees who are teleworking or working at an off-site location. Just as an employer has an obligation to provide an “appropriate place” for an employee to express milk while working at a client site, the employer should ensure a teleworking employee has privacy from a “computer camera, security camera, or web conferencing platform” to express milk.

Employers are not required to pay employees for otherwise unpaid breaks simply because the employee is expressing breast milk during the break, but if an employee is working while pumping (or if the pumping occurs during an otherwise paid break), they must be paid for that time. For example, in most cases, if a remote employee attends a call or videoconference off camera while pumping, that employee would be considered on duty and must be paid for that time.

The recently enacted PUMP Act expanded existing employer obligations under the FLSA to cover exempt employees, as well as non-exempt employees. The DOL has published more guidance on breast milk pumping during work.

Eligibility Under FMLA

The DOL also addresses FMLA eligibility requirements for remote employees both in terms of hours worked (employee must work 1,250 hours in the previously 12 months) and the small worksite exception (employee must work at a worksite with at least 50 employees in a 75-mile radius).

As with the FLSA, it is important for employers to have a system to track their remote workers’ hours. With respect to hours worked, the FAB reiterates that the 1,250 hours determination for remote worker is based on compensable hours of work under FLSA principles.

With respect to the worksite size determination, the FMLA regulations explain that an employee’s personal residence is not a worksite. Instead, whether a remote employee is FMLA-eligible is based on the size of the worksite from which “they report to” or “their assignments are made.” If a remote employee reports into or receives assignments from a site with 50 or more employees working at that site (or reporting to or receiving assignments from that site) or within 75 miles, then that employee would meet that eligibility factor.

The DOL provided two examples of this rule:

  • When both a store employee and their supervisor are working from their homes temporarily due to a weather emergency, for FMLA eligibility purposes, the store remains their worksite.

  • When remote employees are working in various cities more than 75 miles away from the company headquarters but receiving assignments from a manager working at the headquarters, for FMLA-eligibility determination, the company’s headquarters would be considered the workplace for the remote employees.

Employers are reminded to review state and local wage and hour laws, paid and unpaid leave laws, and lactation accommodation laws.

Jackson Lewis P.C. © 2023

SUPERBOWL CIPA SUNDAY: Does Samsung’s Website Chat Feature Violate CIPA?

Happy CIPA and Super Bowl Sunday TCPA World!

So, Samsung is under the spotlight with a new CIPA case brought by a self-proclaimed “tester.” You know like Rosa Parks?? Back to that in a bit.

The California Invasion of Privacy Act (“CIPA”) prohibits both wiretapping and eavesdropping of electronic communications without the consent of all parties to the communication. The Plaintiff’s bar is zoning in to CIPA with the Javier ruling.

If you recall, Javier found that “[T]hough written in terms of wiretapping, Section 631(a) applies to Internet communications. It makes liable anyone who ‘reads, or attempts to read, or to learn the contents’ of a communication ‘without the consent of all parties to the communication.’ Javier v. Assurance IQ, LLC, 2022 WL 1744107, at *1 (9th Cir. 2022).

Here, Plaintiff Garcia claims that Defendant both wiretaps the conversations of all website visitors and allows a third party to eavesdrop on the conversations in real time during transmission. Garcia v. Samsung Electronics America, Inc.

To enable the wiretapping, Plaintiff claims that Defendant has covertly embedded software code that functions as a device and contrivance into its website that automatically intercepts, records and creates transcripts of all conversations using the website chat feature.

To enable the eavesdropping, Defendant allows at least one independent third-party vendor to secretly intercept (during transmission and in real time), eavesdrop upon, and store transcripts of Defendant’s chat communications with unsuspecting website visitors – even when such conversations are private and deeply personal.

But Plaintiff currently proceeds in an individual action but if Samsung does not take appropriate steps to fully remedy the harm caused by its wrongful conduct, then Garcia will file an amended Complaint on behalf of a class of similarly aggrieved consumers.

Now back to Civil Rights.

According to this Complaint, Garcia is like Rosa Parks, you know, the civil rights activist. Why?

Well, because “Civil rights icon Rosa Parks was acting as a “tester” when she initiated the Montgomery Bus Boycott in 1955, as she voluntarily subjected herself to an illegal practice to obtain standing to challenge the practice in Court.”

Because Wiretapping and civil rights are similar right??

Disgusted.

The Plaintiff’s bar has no problem muddying the waters to appeal to the courts.

Do better.

CIPA is some dangerous stuff. Websites use chat features to engage with consumers all the time. It seems like it is easier to communicate via chat or text than to sit on a call waiting for an agent – assuming you get an agent. But maybe not?

Stay safe out there TCPA World!

Til next time Countess!! back to the game, GO EAGLES!!! #Phillyproud

© 2023 Troutman Firm

Breaking News – Hermès Makes History With First NFT Trademark Trial Victory

A New York City jury just returned a verdict in favor of Hermès in a historic dispute between the luxury fashion house and digital artist Mason Rothschild over Hermès’ alleged trademark rights relating to Hermès’ famous Birkin handbag. The jury awarded Hermès $133,000 in total damages for trademark infringement, dilution, and cybersquatting.

The jury finding that the First Amendment did not shield Rothschild from liability in connection with his MetaBirkins NFTs project is significant, particularly as this matter involved the first trial by jury to consider the interplay of free speech and trademark protection in the context of NFTs. This decision, which may be appealed, provides guidance for artists, brands, and others seeking ingress into metaverse, including to what extent “real world” intellectual property rights apply to and may be enforced in virtual worlds.

Haute-ly Contested NFTs

Throughout the dispute over this past year, the parties have contested each other’s characterization of the MetaBirkins NFTs. To Hermès, the MetaBirkins NFTs are merely the instruments of a “digital speculator” looking to exploit one of its most exclusive assets via NFTs. In contrast, Rothschild argues that the MetaBirkins NFTs project, a series of 100 NFT images that depict a range of reimagined Hermès Birkin bags featuring a variety of colorful fur, is digital art and a commentary on the famed BIRKIN bag, consumerism, and animal cruelty within the fashion industry. As a result, he argues that the MetaBirkins NFTs are artistic works that should be shielded from liability under the free speech principles of the First Amendment of the Constitution. The nine-member jury disagreed, finding that the MetaBirkins NFTs were more like commodities that are subject to trademark and other laws, rather than artwork. A factor that may have influenced the jury’s decision was evidence suggesting that Rothschild may have seen the MetaBirkins NFTs as a “cash cow.” This may have cast doubt on the authenticity of his characterization of the MetaBirkins NFTs as an art project.

The Test is Yet to Come

Although the jury found the MetaBirkins NFTs to be infringing, the final disposition of this dispute remains pending with the possibility of appeal. Given the importance of the issues at stake, the outcome of this case is bound to be subject to debate regardless of any appeal.

Moreover, while no NFT-specific legal test appears to have emerged from this case and the legal landscape for IP in the Metaverse (and beyond) continues to lack clear guidance, this case has nonetheless provided insight on how courts (and juries) may view the interplay of IP and NFTs. The ultimate outcome of this landmark case is likely to form the basis of the emerging law involving IP rights and NFTs.

© 2023 ArentFox Schiff LLP
For more Intellectual Property Legal News, click here to visit the National Law Review

What’s New in 5G – February 2023

The next-generation of wireless technologies – known as 5G – is expected to revolutionize business and consumer connectivity, offering network speeds that are up to 100 times faster than 4G LTE, reducing latency to nearly zero, and allowing networks to handle 100 times the number of connected devices, enabling the “Internet of Things.”  Leading policymakers – federal regulators and legislators – are making it a top priority to ensure that the wireless industry has the tools it needs to maintain U.S. leadership in commercial 5G deployments.  This blog provides monthly updates on FCC actions and Congressional efforts to win the race to 5G.

Regulatory Actions and Initiatives

Spectrum

  • The FCC grants relief to a 600 MHz licensee serving Tribal Nations, giving it more time to complete and deploy its wireless network.

    • On January 4, 2023, the FCC’s Wireless Telecommunications Bureau (“WTB”) released an Order granting a third request by Pine Cellular Phones, Inc. (“Pine Cellular”) to extend its construction deadline for one of its 600 MHz licenses by one year from January 9, 2023 to January 9, 2024.  In 2019, Pine Cellular was a winning bidder in the Broadcast Incentive Auction (Auction No. 1002) of two 600 MHz licenses.  After the licenses were awarded, the FCC prohibited the use of funding from the Universal Service Fund for equipment and services deemed to pose a national security risk.  Pine Cellular planned to rely on that now-prohibited equipment to meet its construction requirement, but it has since been unable to acquire and install compliant equipment due, in part, to global supply chain issues.  The WTB granted Pine Cellular’s request because it recognized that the only way for Pine Cellular to fulfill its construction requirement is to remove and replace all prohibited equipment in its network and that termination of the license would not facilitate the provision of wireless broadband service, particularly to the Choctaw Nation, which is covered by Pine Cellular’s license.

  • The FCC grants additional licenses for spectrum in the 2.5 GHz band for commercial wireless services.

    • The WTB released a Public Notice on January 5, 2023, announcing the grant of four additional licenses for spectrum in the 2.5 GHz band, the auction for which concluded on August 29, 2022.  A list of the licenses, sorted by licensee, is available here.  And list of the same licenses, sorted by market, is available here.

  • The FCC takes further action to enable commercial operations through spectrum sharing in the 3.5 GHz band.

    • On January 10, 2023, the WTB and Office of Engineering and Technology (“OET”) released a Public Notice approving the new Environmental Sensing Capability (“ESC”) sensor deployment and coverage plans of Federated Wireless in the 3.5 GHz band.  Federated Wireless is now authorized to operate its ESC sensors to protect federal incumbents in Alaska and must, among other things, operate in conjunction with at least one Spectrum Access System (“SAS”), which manages non-federal access to the 3.5 GHz band, that has been approved for commercial deployment.

    • In addition, the WTB and OET released a Public Notice on January 12, 2023, certifying that the SAS operated by RED Technologies SAS (“RED”) has satisfied the FCC’s testing requirements and been approved to begin its initial commercial deployment (“ICD”), subject to certain conditions.  After RED operates its ICD, it is required to submit a report, and assuming that the report is satisfactory, RED will then receive authorization to operate for a five-year term.

  • The FCC revises its framework for making public safety spectrum in the 4.9 GHz band available for commercial wireless services.

    • On January 18, 2023, the FCC released an Order and Further Notice of Proposed Rulemaking establishing rules that provide for a nationwide Band Manager for public safety operations in the 4940-4990 MHz (“4.9 GHz”) band.  The Order replaces the previous framework for the 4.9 GHz band, which allowed states to lease the spectrum to third parties, including commercial entities, through a designated statewide lessor.  The new framework will allow the Band Manager to coordinate all use of the spectrum nationwide, including by making it available for secondary, non-public safety use – such as commercial 5G wireless services – by allowing non-public safety entities to lease unused 4.9 GHz band spectrum.  The Further Notice seeks comment on implementing the new leasing framework and selecting the Band Manager.  Comments and reply comments on the Further Notice will be due 30 days and 60 days, respectively, after publication in the Federal Register.

Other Agency Actions

  • The Federal Aviation Administration proposes requirements to help foster coexistence between 5G operations in the C-band and aircraft relying on radio altimeters.

    • On January 22, 2023, a Notice of Proposed Rulemaking issued by the Federal Aviation Administration (“FAA”) was published in the Federal Register.  The Notice proposes to update the FAA’s existing Airworthiness Directive (“AD”) regarding the coexistence of licensees of spectrum in the 3.7-4.2 GHz band (“C-band”) and radio altimeters.  Specifically, the FAA proposes interference tolerance requirements for radio altimeters and requirements that all aircraft operating under its rules meet power spectral density requirements to operate in the contiguous U.S. after February 2, 2024.  The FAA has determined that radio altimeter tolerant airplanes will not experience unsafe conditions at any airport identified by the FAA as a 5G market.  It has also determined that any 5G C-band provider that maintains the mitigated actions, which are based on the power levels to which Verizon and AT&T previously agreed, will not have an effect on the safety of transport and commuter airplanes with radio altimeters that meet the interference tolerance requirements.  The FAA will assess changes in the agreed-upon power levels.  Comments on the FAA’s proposals are due February 10, 2023.

  • The Department of Defense seeks comment on developing a spectrum roadmap.

    • On January 4, 2023, the Department of Defense (“DoD”) released a Request for Information seeking input to support the development of a Next-Generation Electromagnetic Spectrum Strategic Roadmap, which Congress requested of DoD in a June 2022 letter.  Among other things, DoD requests input on its ability to use commercial systems for its operations and spectrum sharing.  The deadline for providing input is February 10, 2023 at 2:00 pm ET.

5G Networks and Equipment

  • The FCC reminds rip-and-replace funding recipients of their reporting obligations.

    • On January 11, 2023, the FCC’s Wireline Competition Bureau released a Public Notice reminding parties that receive funding from the FCC’s Reimbursement Program to remove and replace equipment that poses a national security risk of their obligation to file their Reimbursement Program spending reports.  The spending reports, which, among other things, must include a detailed accounting of the covered equipment and services that have been removed and replaced, are due by February 10, 2023.

©1994-2023 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. All Rights Reserved.

NIST Releases New Framework for Managing AI and Promoting Trustworthy and Responsible Use and Development

On January 26, 2023, the National Institute of Standards and Technology (“NIST”) released the Artificial Intelligence Risk Management Framework (“AI RMF 1.0”), which provides a set of guidelines for organizations that design, develop, deploy or use AI to manage its many risks and promote trustworthy and responsible use and development of AI systems.

The AI RMF 1.0 provides guidance as to how organizations may evaluate AI risks (e.g., intellectual property, bias, privacy and cybersecurity) and trustworthiness. The AI RMF 1.0 outlines the characteristics of trustworthy AI systems, which are valid, reliable, safe, secure, resilient, accountable, transparent, explainable, interpretable, privacy enhanced and fair with their harmful biases managed. It also describes four high-level functions, with associated actions and outcomes to help organizations better understand and manage AI:

  • The Govern function addresses evaluation of AI technologies’ policies, processes and procedures, including their compliance with legal and regulatory requirements and transparent and trustworthy implementation.
  • The Map function provides context for organizations to frame risks relating to AI systems, including AI system impacts and interdependencies.
  • The Measure function uses quantitative, qualitative or mixed-method tools, techniques and methodologies to analyze, benchmark and monitor AI risk and related impacts, including tracking metrics to determine trustworthy characteristics, social impact and human-AI configurations.
  • The Manage function entails allocating risk resources to mapped and measured risks consistent with the Govern function. The Manage function includes determining how to treat risks and develop plans to respond to, recover from and communicate about incidents and events.

NIST released a draft AI Risk Management Framework Playbook to accompany the AI RMF 1.0. NIST plans to release an updated version of the Playbook in the Spring of 2023 and launch a new Trustworthy and Responsible AI Resource Center to help organizations put AI RMF 1.0 into practice. NIST has also provided a Roadmap of its priorities to advance the AI RMF.

Copyright © 2023, Hunton Andrews Kurth LLP. All Rights Reserved.
For more Technology Legal News, click here to visit the National Law Review.

University of Texas at Austin Permanently Blocks TikTok on Network

On Tuesday, January 17, 2023, the University of Texas at Austin announced that it has blocked TikTok access across the university’s networks. According to the announcement to its users, “You are no longer able to access TikTok on any device if you are connected to the university via its wired or WIFI networks.” The measure was in response to Governor Greg Abbott’s December 7, 2022, directive to all state agencies to eliminate TikTok from state networks. Following the directive, the University removed TikTok from university-issued devices, including cell phones, laptops and work stations.

Copyright © 2023 Robinson & Cole LLP. All rights reserved.

For  more Cybersecurity Legal News, click here to visit the National Law Review.

Another Lesson for Higher Education Institutions about the Importance of Cybersecurity Investment

Key Takeaway

A Massachusetts class action claim underscores that institutions of higher education will continue to be targets for cybercriminals – and class action plaintiffs know it.

Background

On January 4, 2023, in Jackson v. Suffolk University, No. 23-cv-10019, Jackson (Plaintiff) filed a proposed class action lawsuit in the U.S. District Court for the District of Massachusetts against her alma matter, Suffolk University (Suffolk), arising from a data breach affecting thousands of current and former Suffolk students.

The complaint alleges that an unauthorized party gained access to Suffolk’s computer network on or about July 9, 2022.  After learning of the unauthorized access, Suffolk engaged cybersecurity experts to assist in an investigation. Suffolk completed the investigation on November 14, 2022.  The investigation concluded that an unauthorized third party gained access to and/or exfiltrated files containing personally identifiable information (PII) for students who enrolled after 2002.

The complaint further alleges that the PII exposed in the data breach included students’ full names, Social Security Numbers, Driver License numbers, state identification numbers, financial account information, and Protected Health Information.  While Suffolk did not release the total number of students affected by the data breach, the complaint alleges that approximately 36,000 Massachusetts residents were affected.  No information was provided about affected out-of-state residents.

Colleges and Universities are Prime Targets for Cybercriminals

Unfortunately, Suffolk’s data breach is not an outlier.  Colleges and universities present a wealth of opportunities for cyber criminals because they house massive amounts of sensitive data, including employee and student personal and financial information, medical records, and confidential and proprietary data.  Given how stolen data can be sold through open and anonymous forums on the Dark Web, colleges and universities will continue to remain prime targets for cybercriminals.

Recognizing this, the FBI issued a warning for higher education institutions in March 2021, informing them that cybercriminals have been targeting institutions of higher education with ransomware attacks.  In May 2022, the FBI issued a second alert, warning that cyber bad actors continue to conduct attacks against colleges and universities.

Suffolk Allegedly Breached Data Protection Duty

In the complaint, Plaintiff alleges that Suffolk did not follow industry and government guidelines to protect student PII.  In particular, Plaintiff alleges that Suffolk’s failure to protect student PII is prohibited by the Federal Trade Commission Act, 15 U.S.C.A. § 45 and that Suffolk failed to comply with the Financial Privacy Rule of the Gramm-Leach-Bliley Act (GLBA),  15 U.S.C.A. § 6801.  Further, the suit alleges that Suffolk violated the Massachusetts Right to Privacy Law, Mass. Gen. Laws Ann. ch. 214, § 1B, as well as its common law duties.

How Much Cybersecurity is Enough?

To mitigate cyber risk, colleges and university must not only follow applicable government guidelines but also  consider following industry best practices to protect student PII.

In particular, GLBA requires a covered organization to designate a qualified individual to oversee its information security program and conduct risk assessments that continually assess internal and external risks to the security, confidentiality and integrity of personal information.  After the risk assessment, the organization must address the identified risks and document the specific safeguards intended to address those risks.  See 16 CFR § 314.4.  

Suffolk, as well as other colleges and universities, may also want to look to Massachusetts law for guidance about how to further invest in its cybersecurity program.  Massachusetts was an early leader among U.S. states when, in 2007, it enacted the “Regulations to safeguard personal information of commonwealth residents” (Mass. Gen. Laws ch. 93H § 2) (Data Security Law).  The Data Security Law – still among the most prescriptive general data security state law – sets forth a list of minimum requirements that, while not specific to colleges and universities, serves as a good cybersecurity checklist for all organizations:

  1. Designation of one or more employees responsible for the WISP.
  2. Assessments of risks to the security, confidentiality and/or integrity of organizational Information and the effectiveness of the current safeguards for limiting those risks, including ongoing employee and independent contractor training, compliance with the WISP and tools for detecting and preventing security system failures.
  3. Employee security policies relating to protection of organizational Information outside of business premises.
  4. Disciplinary measures for violations of the WISP and related policies.
  5. Access control measures that prevent terminated employees from accessing organizational Information.
  6. Management of service providers that access organizational Information as part of providing services directly to the organization, including retaining service providers capable of protecting organizational Information consistent with the Data Security Regulations and other applicable laws and requiring service providers by contract to implement and maintain appropriate measures to protect organizational Information.
  7. Physical access restrictions for records containing organizational Information and storage of those records in locked facilities, storage areas or containers.
  8. Regular monitoring of the WISP to ensure that it is preventing unauthorized access to or use of organizational Information and upgrading the WISP as necessary to limit risks.
  9. Review the WISP at least annually or more often if business practices that relate to the protection of organizational Information materially change.
  10. Documentation of responsive actions taken in connection with any “breach of security” and mandatory post-incident review of those actions to evaluate the need for changes to business practices relating to protection of organizational Information.

An organization not implementing any of these controls should consider documenting the decision-making process as a defensive measure.  In implementing these requirements and recommendations, colleges and universities can best position themselves to thwart cybercriminals and plaintiffs alike.

© Copyright 2023 Squire Patton Boggs (US) LLP