ALERT: Fraud Scheme Targets Foreign Nationals

GT Law

Foreign nationals are advised to be aware of a reported fraud scheme that is currently being perpetrated in the United States.

Individuals purporting to be officers of U.S. Citizenship and Immigration Services (USCIS) are reportedly telephoning foreign nationals to falsely claim a discrepancy or problem in such individuals’ immigration records and pressure victims to pay a “penalty” to rectify the issue. Victims are told to wire funds to an address the caller provides.

The perpetrators may possess personal information about the victim and may ask victims to provide or confirm immigration information, including an I-94 number, an alien registration number or a visa control number.

Foreign nationals who receive such calls should not forward any funds as instructed by the caller or disclose any personal information. Those targeted by the scheme should contact law enforcement, the Federal Trade Commission Bureau of Consumer Protection, and an attorney.

Article By:

 of

Amendments to SEC Rules Regarding Broker Dealer Financial Responsibility and Reporting Requirements

Katten Muchin

The Securities and Exchange Commission adopted amendments to the financial responsibility requirements for broker dealers under the Securities Exchange Act of 1934 (Exchange Act) designed to safeguard customer securities and funds held by broker dealers. Such requirements include Exchange Act Rule 15c3-1 (Net Capital Rule), Rule 15c3-3 (Customer Protection Rule), Rules 17a-3 and 17a-4 (together, Books and Records Rules) and Rule 17a-11 (Notification Rule, and together with the Net Capital Rule, the Customer Protection Rule and the Books and Records Rules, the Financial Responsibility Rules).

The SEC amended the Customer Protection Rule to: (1) require “carrying broker dealers” that maintain customer securities and funds to maintain new segregated reserve accounts for account holders that are broker dealers; (2) place certain restrictions on cash bank deposits for purposes of the requirement to maintain a reserve to protect customer cash, by excluding cash deposits held at affiliated banks and limiting cash held at non-affiliated banks to an amount no greater than 15 percent of the bank’s equity capital, as reported by the bank in its most recent call report; and (3) establish customer disclosure, notice and affirmative consent requirements (for new accounts) for programs where customer cash in a securities account is “swept” to a money market or bank deposit product.

The SEC amended the Net Capital Rule to: (1) require a broker dealer when calculating net capital to include any liabilities that are assumed by a third party if the broker dealer cannot demonstrate that the third party has the resources to pay the liabilities; (2) require a broker dealer to treat as a liability any capital that is contributed under an agreement giving the investor the option to withdraw it; (3) require a broker dealer to treat as a liability any capital contribution that is withdrawn within a year of its contribution unless the broker dealer receives permission for the withdrawal in writing from its designated examining authority; (4) require a broker dealer to deduct from net capital (with regard to fidelity bonding requirements prescribed by a broker dealer’s self-regulatory organization (SRO)) the excess of any deductible amount over the amount permitted by the SRO’s rules; and (5) clarify that any broker dealer that becomes “insolvent” is required to cease conducting a securities business.

The SEC amended the Books and Records Rules to require large broker dealers (i.e., at least $1,000,000 in aggregate credits or $20,000,000 in capital) to document their market, credit and liquidity risk management controls. Under the amended Notification Rule there are new notification requirements for when a broker dealer’s repurchase and securities lending activities exceed 2,500 percent of tentative net capital (or, alternatively, a broker dealer may report monthly its stock loan and repurchase activity to its designated examining authority, in a form acceptable to such authority). In addition, the amended Notification Rule requires insolvent broker dealers to provide notice to regulatory authorities.

In a separate release, the SEC also amended Exchange Act Rule 17a-5 (Reporting Rule). Under the amended Reporting Rule, a broker dealer that has custody of the customers’ assets must file a “compliance report” with the SEC to verify that it is adhering to broker dealer capital requirements, protecting customer assets it holds and periodically sending account statements to customers. The broker dealer also must engage a Public Company Accounting Oversight Board (PCAOB)-registered independent public accountant to prepare a report based on an examination of certain statements in the broker dealer’s compliance report. A broker dealer that does not have custody of its customers’ assets must file an “exemption report” with the SEC citing its exemption from requirements applicable to carrying broker dealers. The broker dealer also must engage a PCAOB-registered independent public accountant to prepare a report based on a review of certain statements in the broker dealer’s exemption report. A broker dealer that is a member of the Securities Investor Protection Corporation (SIPC) also must file its annual reports with SIPC.

The rule amendments also require a broker dealer to file a new quarterly report, called Form Custody, that contains information about whether and how it maintains custody of its customers’ securities and cash. The SEC intends that examiners will use Form Custody as a starting point to focus their custody examinations. In addition, a broker dealer, regardless of whether it has custody of its clients’ assets, must agree to allow SEC or SRO staff to review the work papers of the independent public accountant if it is requested in writing for purposes of an examination of the broker dealer and must allow the accountant to discuss its findings with the examiners.

The effective date for the amendments to the Financial Responsibility Rules is 60 days after publication in the Federal Register. The effective date for the requirement to file Form Custody and the requirement to file annual reports with SIPC is Dec. 31, 2013. The effective date for the requirements relating to broker dealer annual reports is June 1, 2014.

Click here to read SEC Release No. 34-70072 (Financial Responsibility Rules for Broker Dealers).

Click here to read SEC Release No. 34-70073 (Broker Dealer Reports).

 of

Zappos and It's Effect On "Browswrap" Agreements

Lewis & Roca

Key Takeaways For An Enforceable Terms of Use Agreement

In light of the recent Nevada federal district court decision In re Zappos.com, Inc., ‎Customer Data Security Breach Litigation, companies should review and update their ‎implementation of browsewrap agreements to ensure users are bound to its terms. MDL No. ‎‎2357, 2012 WL 4466660 (D.Nev. Sept. 27, 2012).

A browsewrap agreement refers to the online Terms of Use agreement that binds a web ‎user merely by his continued browsing of the site, even when he is not aware of it. Any ‎somewhat experienced web user is no stranger to the Terms of Use link that leads to the ‎browsewrap agreement. Yet, the users tend to ignore the link’s existence, and rarely think of it ‎as a “contract” with any practical effects. In Zappos, the court questioned the browsewrap ‎agreement’s validity particularly because of this tendency among web users. The court ruled the ‎arbitration clause in Zappos’ browsewrap Terms of Use was unenforceable because the users did ‎not agree to it and Zappos had the right to modify the terms at any time. ‎

Background of the Case

Founded in 1999, Zappos.com is a subsidiary of Amazon.com and one of the nation’s ‎biggest online retailers for footwear and apparel. Currently headquartered in Henderson, ‎Nevada, the company has more than 24 million customer accounts. In mid-January 2012, its ‎computer system experienced a security breach in which hackers attempted to access the ‎company’s customer accounts and personal information.

After Zappos notified its customers about the incident, customers from across the country ‎filed lawsuits against Zappos, seeking relief for damages arising from the breach. The cases were ‎transferred to and consolidated in Nevada. Zappos then sought to enforce the arbitration clause ‎contained in its Terms of Use, which would stay the litigation in federal court and compel the ‎case for arbitration. The court denied Zappos’ motion on two grounds: there was no valid ‎agreement to arbitrate due to the lack of assent by the plaintiffs and the contract was ‎unenforceable because it reserved to Zappos the right to modify the terms at any time and ‎without notice to its users.

Lessons Learned from the Browsewrap

Mutual Assent Must Be Clear 

Arbitration provisions are a matter of contract law, and the traditional elements of a ‎contract must be met even though Zappos’ Terms of Use was presented in electronic, ‎browsewrap form on the website. An essential element of contract formation is mutual assent by ‎the parties to the contract, which the court found was missing in this case as there was no ‎evidence of the plaintiffs’ assent.

The court compared the browsewrap agreement with another popular form of online terms ‎of use agreement, the “clickwrap” agreement. Clickwrap agreements require users to take ‎affirmative actions, such as clicking on an “I Accept” button, to expressly manifest their assent to ‎the terms and conditions.‎

Since Zappos’ browsewrap agreement did not require its users to take similar affirmative ‎action to show their assent to the terms and conditions, there was no direct evidence showing ‎that the plaintiffs consented to or even had actual knowledge of the agreement, including the ‎arbitration clause.‎

Link It Front and Center 

Furthermore, the court found Zappos’ Terms of Use hyperlink was inconspicuous and ‎thus did not provide reasonable notice to its users. The link was a) “buried” in the middle or ‎bottom of each page and became visible when a user scrolls down, b) appeared “in the same size, ‎font, and color as most other non-significant links,” and c) the website did not “direct a user to ‎the Terms of Use when creating an account, logging in to an existing account, or making a ‎purchase.” The court concluded that under ordinary circumstances, users would have no reason ‎to click on the link.‎

Unilateral Right to Modify or Terminate Won’t Work

Another problem with Zappos’ browsewrap agreement was that it was illusory and thus ‎unenforceable. In the agreement, the company “retain[ed] the unilateral, unrestricted right to ‎terminate the arbitration agreement” and had “no obligation to receive consent from, or even ‎notify, the other parties to the contract.” Users would unsuspectingly agree to the changes by ‎continuing to use the site. Under this provision, Zappos could seek to enforce the arbitration ‎clause, as it did here, or not enforce it by modifying the clause without notice to its users when it ‎was no longer in its interest to arbitrate. In either circumstance, the users would still be bound to ‎the agreement.

Implications for Companies

As a result of this decision, companies should carefully reassess the display and content ‎of the online terms of use they adopt to ensure their enforceability. In a narrow sense, the ‎decision means an arbitration clause in a browsewrap agreement similar to Zappos’ may be ‎deemed unenforceable. More broadly, this decision threatens the validity and enforceability of ‎other terms and conditions contained in a browsewrap agreement, which may deprive the ‎company of the agreement’s protection and favorable terms. ‎

Clickwrap agreements seem to provide the solution to Zappos’ problem. The court ‎suggested a clickwrap agreement could obtain a user’s assent to the terms and conditions. A ‎company may implement the clickwrap agreement through account registration or purchase ‎check-out, tailored to the nature of the company’s business and user interaction. The system may ‎require a user to click “I Accept” to secure the user’s assent to be bound by the agreement before ‎he can proceed further on the website. ‎

On the other hand, the court did not conclude that browsewrap agreements are never ‎enforceable. Other courts have held that browsewrap agreements are generally enforceable. ‎Enforceability largely depends on how the company presents the link and terms to the users such ‎that the users would have reasonable notice of the information. Accordingly, a browsewrap ‎agreement may be enforceable if the hyperlink is conspicuously located and displayed. ‎

In addition, companies should communicate and secure a user’s assent to any ‎modification when the user has previously accepted the terms and conditions. The user may ‎consent through another clickwrap agreement showing the modified terms. With a browsewrap ‎agreement, notice of the changes should, at the minimum, be conspicuously displayed on the ‎webpage. ‎

What This Means 

The Zappos decision reflects a change in the public policy on web activities, and users ‎who do not affirmatively agree to the online Terms of Use may no longer be bound. Consumers ‎are increasingly turning to the web for goods and services. In reaction, courts are beginning to ‎look closer into the transactions and resulting issues that occur online. In this process, courts are ‎testing and requiring new standards for these Terms of Use agreements. Companies should be ‎aware of the court’s evolving attitude towards the different types of agreements. You are ‎encouraged to seek legal guidance to properly adapt your implementation of Terms of Use ‎agreements. Failure to update your Terms of Use agreements may leave you exposed to ‎unfavorable terms that the Terms of Use is designed to prevent.‎

Consumer Financial Services Basics 2013 – September 30 – October 01, 2013

The National Law Review is pleased to bring you information about the upcoming  Consumer Financial Services Basics 2013.

CFSB Sept 30 2013

When

September 30 – October 01, 2013

Where

  • University of Maryland
  • Francis King Carey School of Law
  • 500 W Baltimore St
  • Baltimore, MD 21201-1701
  • United States of America

Facing the most comprehensive revision of federal consumer financial services (CFS) law in 75 years, even experienced consumer finance lawyers might feel it is time to get back in the classroom. This live meeting is designed to expose practitioners to key areas of consumer financial services law, whether you need a primer or a refresher.

It is time to take a step back and think through some of these complex issues with a faculty that combines decades of practical experience with law school analysis. The classroom approach is used to review the background, assess the current policy factors, step into the shoes of regulators, and develop an approach that can be used to interpret and evaluate the scores of laws and regulations that affect your clients.

Recent Data Breach Reports: And the Hits Keep on Coming….

Mintz Logo

The ”hits” to data bases, in any event.   Here is a rundown of some of the most recent data breach reports –

Oregon Health & Science University Data Breach Compromises 3,000 Patients’ Records in the Cloud.

Modern Healthcare (subscription may be required) reports that the Oregon Health & Science University announced it is “notifying more than 3,000 of its patients of a breach of their personally identifiable information after their data were placed by OHSU resident physicians on a pair of Google’s cloud-based information-sharing services.” The data breach, which involves “patients’ names, medical record numbers, dates of service, ages, diagnoses and prognoses and their providers’ names” posted to Gmail or Google Drive, was discovered in May by an OHSU faculty member.  According to  Healthcare IT News, this is OHSU’s “fourth big HIPAA breach since 2009 and third big breach just in the past two years, according to data from the Department of Health and Human Services.”

Citigroup Reports Breach of Personal Data in Unredacted Court Filings; Settles with Justice Department

American Banker reports that Citigroup recently admitted having failed to safeguard the personal data (including birthdates and Social Security numbers) of approximately 146,000 customers who filed for bankruptcy between 2007 and 2011. Citi apparently failed to fully redact court records placed on the Public Access to Court Electronic Records (PACER) system. “The redaction issues primarily resluted from a limitation in the technology Citi had used to redact personally identifiable information in the filings,” Citi said in a statement. “As a result of this limitation in technology, personally identifiable information could be exposed and read if electronic versions of the court records were accessed and downloaded from the courts’ online docket system and if the person downloading the information had the technical knowledge and software to restore the redacted information.”

In a settlement with the Justice Department’s U.S. Trustee Program, Citi has agreed to redact the customer information, notify all affected debtors and third parties, and offer all those affected a year of free credit monitoring.

University of Delaware Reports Cyberattack – 72,000 Records Affected

The University of Delaware is notifying the campus community that it has experienced a cyberattack in which files were taken that included confidential personal information of more than 72,000 current and past employees, including student employees. The confidential personal information includes names, addresses, UD IDs (employee identification numbers) and Social Security numbers.

Stanford University Reports Hack – Investigating Scope

Stanford University has announced that its information technology infrastructure has been breached, “similar to incidents reported in recent months by a range of companies and large organizations in the United States,” according to a Stanford press release. Though the school does not yet “know the scope of the intrusion,” an investigation is underway. “We are not aware of any protected health information, personal financial information or Social Security numbers being compromised, and Stanford does not conduct classified research.”

Japan’s Railway Company Apologizes for Unauthorized “Sharing”

The Wall Street Journal reported yesterday (registration may be required) that Japan’s national railway system has apologized for sharing its passengers’ travel habits and other personal information with a pre-paid fare card system without user consent, The Wall Street Journal reports. East Japan Railway admitted to selling the data to Suica—one of the pre-paid card businesses. The data included card holders’ ID numbers, ages, genders and where and when passengers got on and off the train. A transportation ministry official, however, said they will not investigate the issue for privacy violations because the railway company “told us that it wasn’t personal information, as it didn’t include names and addresses of users.” The Ministry of Internal Affairs and Communications is looking into the issue and has set up a team to research the matter, the report states.

Article By:

 of

In Largest Known Data Breach Conspiracy, Five Suspects Indicted in New Jersey

DrinkerBiddle

On July 25, 2013, the United States Attorney for the District of New Jersey announced indictments against five men alleging their participation in a global hacking and data breach scheme in which more than 160 million American and foreign credit card numbers were stolen from corporate victims, including retailers, financial institutions, payment processing firms, an airline, and NASDAQ.  The scheme is the largest of its kind ever prosecuted in the United States.

The Second Superseding Indictment alleges the defendants (four Russian nationals and one Ukrainian national) and other uncharged co-conspirators targeted corporate victims’ networks using “SQL [Structured Query Language] Injection Attacks,” meaning the hackers identified vulnerabilities in their victims’ databases and exploited those weaknesses to penetrate the networks.  Once the defendants had access to the networks, they used malware to create “back doors” to allow them continued access, and used their access to install “sniffers,” programs designed to identify, gather and steal data.

Once the defendants obtained the credit card information, they allegedly sold it to resellers all over the world, who in turn sold the information through online forums or directly to individuals and organizations.  The ultimate purchasers encoded the stolen information on blank cards and used those cards to make purchases or withdraw cash from ATMs.

The defendants allegedly used a number of methods to evade detection.  They used web-hosting services provided by one of the defendants, who unlike traditional internet service providers, did not keep records of users’ activities or share information with law enforcement.  The defendants also communicated through private and encrypted communication channels and tried to meet in person.  They also changed the settings on the victims’ networks in order to disable security mechanisms and used malware to circumvent security software.

Four of the defendants are charged with unauthorized access to computers (18 U.S.C. §§ 1030(a)(2)(C) and (c)(2)(B)(i)) and wire fraud (18 U.S.C. § 1343).  All of the defendants are charged with conspiracy to commit these crimes.

Two of the defendants have been arrested, with one in federal custody and the other awaiting an extradition hearing.  The other three defendants, two of whom have been charged in connection with hacking schemes, remain at large.

This conspiracy is noteworthy for its massive scale, and for the patience the hackers demonstrated in siphoning data from the networks.  The U.S. Attorney “conservatively” estimates more than 160 million credit card numbers were compromised in the attacks, and alleges that the hackers had access to many victims’ computer networks for more than a year.  Many prominent retailers were targets, including convenience store giant 7-Eleven, Inc.; multi-national French retailer Carrefour, S.A.; American department store chain JCPenney, Inc.; New England supermarket chain Hannaford Brothers Co.; and apparel retailer Wet Seal, Inc.  Payment processors were also heavily targeted, including one of the world’s largest credit card processing companies, Heartland Payment Systems, Inc., as well as European payment processor Commidea Ltd.; Euronet, Global Payment Systems and Ingenicard US, Inc. The hackers also targeted financial institutions such as Dexia Bank of Belgium, “Bank A” of the United Arab Emirates; the NASDAQ electronic securities exchange; and JetBlue Airways.  Damages are difficult to estimate with precision, but they total several hundred million dollars at least.  Just three of the corporate victims suffered losses totaling more than $300 million.

Article By:

of

Consumer Financial Services Basics 2013 – September 30 – October 01, 2013

The National Law Review is pleased to bring you information about the upcoming  Consumer Financial Services Basics 2013.

CFSB Sept 30 2013

When

September 30 – October 01, 2013

Where

  • University of Maryland
  • Francis King Carey School of Law
  • 500 W Baltimore St
  • Baltimore, MD 21201-1701
  • United States of America

Facing the most comprehensive revision of federal consumer financial services (CFS) law in 75 years, even experienced consumer finance lawyers might feel it is time to get back in the classroom. This live meeting is designed to expose practitioners to key areas of consumer financial services law, whether you need a primer or a refresher.

It is time to take a step back and think through some of these complex issues with a faculty that combines decades of practical experience with law school analysis. The classroom approach is used to review the background, assess the current policy factors, step into the shoes of regulators, and develop an approach that can be used to interpret and evaluate the scores of laws and regulations that affect your clients.

Federal Trade Commission (FTC) Settles with HTC America Over Charges it Failed to Secure Smartphone Software

RaymondBannerMED

Smartphone manufacturer HTC agreed in February to settle Federal Trade Commission (FTC) charges that the company failed to take reasonable steps to secure software it developed for its mobile devices including smartphones and tablet computers. In its complaint, the FTC charged HTC with violations of the Federal Trade Commission Act.  On July 2 the FTC approved a final order settling these charges.

trade FTC smartphone HTC

The FTC alleged HTC failed to employ reasonable security measures in its software which led to the potential exposure of consumer’s sensitive information. Specifically, the FTC alleged HTC failed to implement adequate privacy and security guidance or training for engineering staff, failed to follow well-known and commonly accepted secure programming practices which would have ensured that applications only had access to users’ information with their consent. Further, the FTC alleged the security flaws exposed consumers to malware which could steal their personal information stored on the device, the user’s geolocation information and the contents of the user’s text messages.

HTC is a manufacturer of smartphones but it also installs its own proprietary software on each device. It is this software that the FTC targeted. While HTC smartphones run Google’s Android operating system, the HTC software allegedly introduced significant vulnerabilities which circumvented some of Android’s security measures.

As part of the settlement consent order, HTC agreed to issue security patches to eliminate the vulnerabilities. HTC also agreed to establish a comprehensive security program to address the security risks identified by the FTC and to protect the security and confidentiality of consumer information stored on or transmitted through a HTC device. HTC further agreed to hire a third party to evaluate its data and privacy security program and to issue reports every two years for the consent order’s 20 year term. The implication of the FTC’s policy makes it clear that companies must affirmatively address both privacy and data security issues in their custom applications and software for consumer use.

Consumer Financial Services Basics 2013 – September 30 – October 01, 2013

The National Law Review is pleased to bring you information about the upcoming  Consumer Financial Services Basics 2013.

CFSB Sept 30 2013

When

September 30 – October 01, 2013

Where

  • University of Maryland
  • Francis King Carey School of Law
  • 500 W Baltimore St
  • Baltimore, MD 21201-1701
  • United States of America

Facing the most comprehensive revision of federal consumer financial services (CFS) law in 75 years, even experienced consumer finance lawyers might feel it is time to get back in the classroom. This live meeting is designed to expose practitioners to key areas of consumer financial services law, whether you need a primer or a refresher.

It is time to take a step back and think through some of these complex issues with a faculty that combines decades of practical experience with law school analysis. The classroom approach is used to review the background, assess the current policy factors, step into the shoes of regulators, and develop an approach that can be used to interpret and evaluate the scores of laws and regulations that affect your clients.

Consumer Financial Services Basics 2013 – September 30 – October 01, 2013

The National Law Review is pleased to bring you information about the upcoming  Consumer Financial Services Basics 2013.

CFSB Sept 30 2013

When

September 30 – October 01, 2013

Where

  • University of Maryland
  • Francis King Carey School of Law
  • 500 W Baltimore St
  • Baltimore, MD 21201-1701
  • United States of America

Facing the most comprehensive revision of federal consumer financial services (CFS) law in 75 years, even experienced consumer finance lawyers might feel it is time to get back in the classroom. This live meeting is designed to expose practitioners to key areas of consumer financial services law, whether you need a primer or a refresher.

It is time to take a step back and think through some of these complex issues with a faculty that combines decades of practical experience with law school analysis. The classroom approach is used to review the background, assess the current policy factors, step into the shoes of regulators, and develop an approach that can be used to interpret and evaluate the scores of laws and regulations that affect your clients.