Category: Internet

The Latest Update on the New Generic Top Level Domain (gTLD) Program

Mintz Logo

It has been a long time since we had any notable updates on the gTLD process to report.  However, after a slow start, the new gTLD program is now in full swing.  On March 22, 2013, ICANN released the first round of Initial Evaluations to the general public. This was the first major milestone of the gTLD program.  As a reminder, there are three possible outcomes of this Initial Evaluation:  1) Pass: the application was found to be consistent with the requirements in the Applicant Guidebook and can advance to the next phase; 2) Eligible for Extended Evaluation: additional information was requested by the Financial, Technical/Operational, Registry Services, or Geographic Names evaluation panels; or 3) Ineligible for Further Review: the application was determined not to meet the relevant criteria in the Applicant Guidebook.  The next round of Initial Evaluations was released on May 24, 2013, bringing the total number of passing applications to 433.  ICANN has also announced that it has ramped up to releasing the results of these Initial Evaluations  in batches of 100 prioritized applications per week.

The most recent results of the Initial Evaluations are available here.  https://gtldresult.icann.org/application-result/applicationstatus/viewstatus

Applicants that passed the Initial Evaluations have now moved onto the contracting phase and pre-delegation testing to determine whether the applicant meets the technical requirements of the program.  However, applicants in string contention will need to wait for the string it is in contention with and resolve that contention before proceeding.

This current progress, however, could potentially be hindered if ICANN choses to implement the recent recommendations from the Governmental Advisory Committee (“GAC”). On April 11th, the GAC released its Beijing Communique, outlining recommendations for new TLDs.  Among the numerous recommendations of the new TLD program, the GAC recommended the following:

  1. The GAC identified several strings that it recommended should not proceed beyond the Initial Evaluation phase.
  2. The GAC requested a written briefing about the ability of the applicant to alter the string applied for in order to address the GAC’s concerns.
  3. The GAC suggested that ICANN reconsider its position on singular and plural strings, since the inclusion of both could lead to potential user confusion.
  4. The GAC recommended six new safeguard should apply to all new gTLDs, including WHOIS verification and checks, mitigation of abusive activities, procedures for maintaining documentation, procedures for handling complaints and stringent consequences for violation of the requirements.
  5. The GAC further advised that ICANN should carefully consider community feedback on applications from interested groups.
  6. The GAC recommended that ICANN should develop clear policies for handling applications for strings such as .WTF, .GRIPE, .SUCKS, .FAIL in order to reduce cyber bullying and misuse.

The full text of the GAC’s recommendations is available here.

For now, however, ICANN appears to be on track to complete Initial Evaluations on all applications by August 2013 and to roll out the first new gTLDs by the end of July.

Article By:

 of

Weighing Going Private or Sale to Carl Icahn, Dell Cuts off Info

McBrayer NEW logo 1-10-13

As Dell Inc. considers its future after a massive loss in value over the past decade, the question may fundamentally be this: are the company’s problems are the result of poor leadership or a relatively straightforward matter of shedding its stock obligations?

Two proposals are on the table. First, founder Michael Dell has proposed taking the company private by buying out the company’s stock for $24.4 billion through a private equity firm called Silver Lake. Second, business magnate Carl Icahn’s Southeastern Asset Management has offered to buy Dell for $12 in cash per share. Unfortunately, it’s not clear how the buyout negotiations are going.

An unquestioned leader in the personal computer industry in the 90s, Dell had lost some $68 billion in stock market value by 2010, reportedly due to a change in its customer base and inability to respond to Apple’s iPhone and iPad products. Sales at Dell continue to shrink, reportedly showing a 79 percent drop in a quarterly profit report filed last week.

As part of the buyout negotiations, Icahn sent a letter on seeking more detailed information from Dell, including data room access for a certain potential lender This week, however, a special committee of Dell’s board of directors sent Icahn a letter refusing access to that information until it can determine whether his offer is “superior” to Michael Dell’s.

Meanwhile, Dell insisted upon more information from Icahn — such as whether his offer is even serious. In its response, the committee specifically asked Icahn to make “an actual acquisition proposal that the Board could evaluate” as opposed to merely offering the board a backup plan in case Michael Dell’s proposal fails to move forward.

“Please understand that unless we receive information that is responsive to our May 13 letter, we are not in a position to evaluate whether your proposal meets that standard,” the special committee reportedly wrote in response to Icahn’s request.

The question on Wall Street is the same as Dell’s: Is the Southeastern Asset Management offer serious? Icahn reportedly already owns 4.5 percent of Dell’s stock, while Southwest, already Dell’s largest outside shareholder, owns 8 percent.

 of

New Trademark Headaches, But Help is On the Way Re: Internet Corporation for Assigned Names and Numbers’ (ICANN) Expansion of Generic Top-Level Domains (gTLDs)

Neal Gerber

For brand owners that have often struggled to keep up with all the infringement and cybersquatting issues in the 22 existing generic top-level domain name registries, or “gTLDs”, like .com, .org, and .net, life is about to become even more challenging. The Internet Corporation for Assigned Names and Numbers’ (ICANN) planned expansion of gTLDs to potentially almost 2,000 in total has the potential to create major trademark enforcement headaches. In order to address some of those concerns and burdens, ICANN has created the Trademark Clearinghouse, which allows brand owners to submit information regarding their registered trademarks into a single database across all the new gTLDs for an annual fee of approximately $150 per trademark per year.

Registration in the Trademark Clearinghouse provides two primary benefits:

  • First, it allows brand owners priority access for registering their trademarks as domain names in any new gTLD that is available to the general public as it launches.1 For example, if Acme Car Sales owns a trademark registration covering the term ACME in any jurisdiction worldwide, as the anticipated .cars registry launches, Acme Car Sales would be able to register acme.cars before others have that opportunity.
  • Second, Clearinghouse registrants will receive notice if anyone tries to register domain names that match their marks. Thus, to take the prior example, if Acme Car Sales decides not to register acme.cars, but a third party proceeds to do so, Acme Car Sales will receive notice of the registration and then can contest it if appropriate.

Although this sounds promising, be aware that the Clearinghouse is not perfect—if Acme Car Sales’ only trademark registration is for “ACME,” the Clearinghouse does not provide any benefits pertaining to domain name registrations that differ even slightly from the trademark registration, such as acmesales.cars, or acmechicago.cars. Additionally, individual registries are permitted to determine on their own how to handle situations where multiple entities own trademark registrations for the same mark.

Despite these shortcomings, the Trademark Clearinghouse presents a good first step toward brand protection in the new gTLD space, and most brand owners will benefit from registration. Registration is now open, and will remain open as long as new gTLDs are being released.

Article By:

 of

The New Generic Top-Level Domains and the New Trademark Clearinghouse: Deciding Whether to Register Your Brands

Mintz Logo

The Internet Corporation for Assigned Names and Numbers (“ICANN”) is the organization that oversees domain names worldwide.  It recently began accepting new applications for expanding the number of generic top-level domains (“gTLDs”) on the Internet. The most popular gTLDs until now have included .com, .info, .org, and .net. With the approval of applications for new gTLDs will come an unlimited number of new opportunities on the Internet for entrepreneurs of all types, including trademark infringers. Thus, trademark owners must make some decisons on how to address this new threat. One possibility is the new Trademark Clearinghouse.

ICANN created the Trademark Clearinghouse (“Clearinghouse”),  which went live on March 26, 2013, in an effort to help trademark owners protect their brands in the midst of this expansion of available gTLDs.  Trademark owners who record their marks with the Clearinghouse under the relevant procedures are entitled to: (1) first priority in registering their recorded marks as second-level domain names under the new gTLDs during the “sunrise” period (which will vary by gTLD but will be at least 30 days before the general public would be permitted to do so), and (2)  receipt of notification when a domain has been registered under any new gTLD that matches the trademark owner’s recorded mark. The ICANN filing fee to record a trademark in the Clearinghouse is $150 (US) for one year, $435 for three years, and $725 for five years.

There is no deadline for recording a trademark with the Clearinghouse, but there are advantages to doing so during the “sunrise” periods. As stated above, recordation during this period provides trademark holders with advanced opportunities to obtain a second-level domain name under one of the new gTLDs before registration is open to the general public, e.g., twinkies.food. In addition, during the “trademark claims period,” which will run for at least 90 days after the initial operating period for general domain name registration under a new gTLD, those seeking registration of a domain name that matches a recorded trademark will be notified of the existence of the recorded mark. There is no mechanism in place which will automatically prevent the registration of a domain name matching a recorded trademark. Thus, although someone seeking to register a domain name which matches a recorded trademark may be notified about the existence of the recorded mark, that someone may still register that domain. Should this happen, the owner of the recorded trademark will be notified of the registration and will then have to make a unilateral decision on what action to take, if any, against the registered domain.

For those who have recorded their marks at the Clearinghouse, ICANN provides two global rights protection mechanisms for dealing with allegedly improper domain registrations: (1) the Uniform Domain Name Dispute Resolution Policy, and (2)  Uniform Rapid Suspension. Each mechanism operates in a slightly different manner.

Since neither recordation with the Clearinghouse nor any other ICANN procedure actually stops registration of a domain name which matches a recorded trademark, reaction by trademark owners to the Clearinghouse has been mixed. Accordingly, each trademark owner will have to engage in its own cost/benefit analysis and weigh the pros and cons of this new system in deciding whether to record any, all, or some of its trademarks.

Twitter: Little Statements with Big Consequences for Companies

McBrayer

Twitter is under attack. In recent months, accounts belonging to media giants CBS, BBC, and NPR have all been temporarily taken over by hackers. The Associated Press is the most recent victim. On April 23, 2013, a false statement about explosions at the White House and the President being injured sent shock waves through the Twitter-sphere. The real surprise is the effect the single tweet had in the real world: the Standard & Poor’s 500 Index dropped so sharply moments after the frightening tweet that $136 billion in market value was wiped out. While the hacking of these massive media outlets make headlines, everyday businesses are not safe from the threat, either. In February of this year, a hacker changed the @BurgerKing feed to resemble that of McDonald’s, putting the McDonald’s logo in place of Burger King’s. The hackers posted offensive claims about company employees and practices. If accounts belonging to well-established companies like these are vulnerable, so is yours. If a tweet can have a profound impact on the nation’s stock market, imagine what an ill-contrived tweet could do to your business.

Business owners may have the knee-jerk reaction to delete their Twitter account, but despite the recent blemishes to its security, Twitter remains one of the most important social media sites out there. Just recently, the Securities Exchange Commission made clear that companies could use social media like Twitter when announcing key information in compliance with Regulation Fair Disclosure. Twitter is not just a marketing or PR tool—Twitter is business. And you should never turn your back on existing business. So instead of hanging up your hashtags, consider some steps that can make your Twitter account safer.

Limit Access

Not every employee should have access to the company’s Twitter account. In fact, hardly anyone should, except a few designated employees like the marketing director or business owner. While those with access may never do anything harmful to the account, the more people who have the log-in information, the more likely it is to fall into the wrong hands.

Create a strong password

I know, you already have too many passwords to remember. But a creative password is your best defense against someone seeking to break into your account. Employers should, at minimum, have unique passwords for their most commonly used media sites; please do not use the same word for your Facebook, LinkedIn, and Twitter account. Once a hacker figures it out, they have control of your entire social media presence.

When creating a password, avoid using anything that would be too common. “Password,” “1234,” or the business’s name should never be the only thing standing between you and a hacker. The longer the password, the better. Use a mix of uppercase and lowercase letters, numbers, and symbols.

Article By:

 of

No “Safe Harbor” for BitTorrent Website Operator

McDermottLogo_2c_rgb

The U.S. Court of Appeals for the Ninth Circuit affirmed a summary judgment ruling in favor of seven film studios finding that the defendant induced third parties to download infringing copies of the plaintiffs’ copyrighted works. Columbia Pictures Industries, Inc., et al.  v. Gary Fung, et al., Case No. 10-55946 (9th Cir., Mar.21, 2013) (Berzon, J.).

Seven film studios—including Columbia Pictures, Disney and Twentieth Century Fox—sued Gary Fung and his company isoHunt Technologies, claiming that Fung induced third parties to download infringing copies of the studios’ copyrighted works through Fung’s websites, such as torrentbox.com and isohunt.com—websites that help users find copies of videos to download and stream through a type of peer-to-peer file sharing network.

The district court found Fung liable for contributory copyright infringement for inducing others to infringe the studios’ copyrights and also found that Fung was not entitled to protection from damages liability under the safe harbor provisions of the Digital Millennium Copyright Act (DMCA).  After a permanent injunction was issued, Fung appealed.

On appeal, Fung challenged the full holding, including the scope of the injunction claiming that it was vague, punitive and an impediment to free speech.  The 9th Circuit, citing the Supreme Court decision in Grokster III (which also dealt with peer-to-peer file sharing technology), analyzed the facts of the present case under the four elements of the Grokster III inducement principle:  the distribution of a device or product, acts of infringement, an object of promoting its use to infringe copyright and causation.

Inducement Liability Under Grokster III

With respect to the first element of the Grokster III inducement liability standard, Fung argued that he did not develop or distribute products, nor did he develop the BitTorrent protocol used by his websites.  The 9th Circuit, however, distinguished copyrights as expression that are not necessarily in the form of products or devices. Thus, the court concluded that a copyright can be infringed through “culpable actions resulting in impermissible reproductions of copyrighted expression,” even if such actions are the provision of services used in accomplishing the infringement.

Fung was not able to rebut the second “acts of infringement” Grokster III factor after the studios presented evidence that Fung’s services were widely used to infringe copyrights by allowing uploading and downloading of copyrighted material. Accordingly, the court found for the studios on the second factor, noting that the “predominant use” of Fung’s services was for copyright infringement.

As to the third Grokster III factor, the court agreed with Fung that mere knowledge of a potential to infringe, or knowledge of actual infringing uses of a product or service, is not enough for liability.  Nevertheless, the court found there was more than enough evidence that Fung offered his services with the object to promote their use to infringe copyrighted material.  Specifically, the court found that the evidence showed Fung actively encouraged uploading files of specific copyrighted material; he provided links for certain movies and urged users to download those movies; he affirmatively responded to requests for help in locating and playing copyrighted materials; and, he even personally instructed users on how to burn infringing files to DVDs.  The court also referenced two points of circumstantial evidence raised by the Grokster III opinion, namely, that Fung took no steps to develop filtering tools to diminish infringing activity and that he generated revenue by selling advertising space on his websites.

Finally, as to causation, the court adopted the studios’ interpretation of causation and held that the acts of infringement by third parties need only be caused by the product distributed or services provided.  This was contrary to Fung’s theory of causation (which was also joined by amicus curiae, Google) wherein Fung claimed that the infringement must be directly caused by a defendant’s inducing messages.

The Digital Millennium Copyright Act “Safe Harbor” Provisions

Fung also asserted affirmative defenses under three of the DMCA’s safe harbor provisions, 17 U.S.C. §512(a), (c) and (d). Although the studios argued that there can never be a DMCA safe harbor defense to contributory copyright liability inducement, the 9th Circuit disagreed, noting that the safe harbor provisions do not exclude vicarious or contributory liability from its protections. Even so, the court denied all of Fung’s safe harbor defenses.

In particular, the court concluded that Fung did not qualify for protection under §512(a) for transitory digital network communications because Fung’s torrent file trackers, not the third party users, were responsible for selecting the copyrighted data to be transmitted.

The court also concluded that § 512(c), relating to information residing on networks or systems at the direction of the users, was also not applicable because Fung had actual and “red flag” knowledge of infringing activity on his system due to his own active encouragement of infringement, as well as the fact that Fung did not dispute evidence that he personally used his isohunt.com website to download infringing material.

According to the 9th Circuit, Fung did not qualify for protection under §512(c) or §512(d) (for providers of information location tools) because Fung received a “financial benefit” from his services by selling ad space and because he had the “right and ability to control” the infringing activity, which was shown through evidence that Fung exerted substantial influence on the activities of the users of his websites.

Finding no available defenses under the DMCA safe harbors, the court affirmed summary judgment for the studios on the issue of liability under contributory copyright infringement.  However, the court found various terms of the lower court’s permanent injunction to be vague and unduly burdensome and remanded to the district court to modify certain employment prohibitions and to provide more specific language for several terms in the injunction.

Article By:

 of

“Actually, Someone Knows You are a Dog”– the Chinese Regulation Efforts on Private Data Protection

Sheppard Mullin 2012

Do you have privacy in the era of information?

“On the Internet, nobody knows you’re a dog.” First published in The New Yorker on July 5, 1993, this widely known and recognized saying has been quoted many times to describe the anonymous feature of Internet. However, now this description has been drifting from the truth.

The truth is that, some people using the Internet may know you better than yourself. When you log on Amazon, not only will the site greet you by name, the homepage will also suggest certain purchases. Surprisingly, you will be interested in at least one third of them. Your addresses have been recorded and Amazon will automatically calculate the delivery period. Besides those online shopping sites, getting visitors’ information is the common practice of online service and/or information providers. Youku and Netflix suggest videos to watch. Weibo and Facebook suggest friends to follow. Douban and IMDB suggest movie tickets to buy and parties to attend.

On one hand, these recommendations might give you convenience in your life and entertainment; while on the other hand, this can be really intruding and make you anxious by knowing you so much. For example, you just bought an apartment and even did not get the keys. However, decoration companies and contractors give you calls telling you the decoration designs for the new apartment have been done. You just submitted some resumes for a job. Even before the interview, insurance companies and training companies give you calls and emails to make sales. Have you wondered how strangers know your private, personal information?

Every time you log on a website, make a call or buy a ticket by showing ID card, computer systems will track you down, and record everything you have clicked and purchased. Data analyzing systems will collect, characterize, store your information, and take further actions based on the information. Some entities even purchase and resell personal data for profit. The reason why personal data become commodities is because direct marketing based on private data is profitable. Marketing communications are only classified as “direct marketing” where they are addressed to a specific person by name or where a phone call is made to a specific person, and the use of private data is the foundation of direct marketing. The newly issued Hong Kong Personal Data (Privacy) Amendment Ordinance contains a number of new provisions regulating the use of personal data in connection with direct marketing activities in Hong Kong, which has come into force since April 1, 2013. Apart from Hong Kong, there are over fifty countries and regions which have laws and regulations protecting personal data.

What is the new trend in China to protect personal data?

In order to safeguard the legitimate rights and interests of Chinese citizens concerning private data protection, the Ministry of Industry and Information Technology of China (“MIIT”) announced the Provisions on the Protection of Personal Information of Telecommunication and Internet Users (Draft for Comments) (“PPI Rules”) and the Provisions on the Registration of True Identity Information of Telephone Users (Draft for Comments) (“RTII Rules”) and sought for public comments. The deadline for submitting comments is May 15, 2013.

The PPI Rules and RTII Rules are a breakthrough with respect to legislation of personal information protection. Although these two rules are not officially a personal information protection law, they are a good beginning and call for a complete set of rules.

The PPI Rules and RTII Rules are designed to protect personal information from two perspectives. While the PPI Rules regulates the collection and utilization of users’ private information, the RTII Rules requests “real-name registration” of telephone users for the prohibition of direct or indirect marketing using no-name telephone numbers. Specifically, the PPI Rules requires that telecommunication service providers and Internet information service providers (“Service Providers”) shall not collect or use the users’ personal information without their consent. Service Providers shall also clearly notify the users of the purpose, method and scope of collection and utilization of the users’ personal information, retention period of such information, ways to access and modify such information, and consequences of refusal to provide such information.

Meanwhile, the “real-name registration” required by RTII Rules is a double-edged sword. Not only are telephone users required to supply their true identity information, some Internet services, for example, the Chinese Twitter Weibo, also require users’ true identity information. On one hand, it will reduce the risk of private information abuse by no-name telephones and Weibo bloggers. One the other hand, the “real-name registration” regime means it is legitimate for telephone and some Internet service providers to collect their users’ information. Although RTII Rules prohibits the sales and illegal provision of users’ information, it doesn’t mean those providers will not utilize the users’ information to make profits and provide such information to government or other compulsive entities. This “real-name registration” may limit the health development of Internet and even harm users’ right to free speech. Is “real-name registration” the only way to protect personal information? This is a controversial topic.

What can enterprises do to avoid violations of personal data protection rules in China?

Putting the controversial topic aside, let’s talk about what the enterprises doing business in China can do regarding new rules to protect personal information. Those enterprises may not be limited to Internet/telecommunication service providers, because the regime may expand in the future to regulate more entities that may get access to citizens’ personal data.

First, the concerned enterprises can log on MITT official websites and submit comments if any. They can make their voice heard since the rules are in the “draft for comments” period.

Second, thorough study of the new rules and other anticipated rules in this area is needed. The concerned enterprises need to provide proper training to their employees regarding the users’ information protection, since this is not only required by the new rules, but the enterprises might also have joint and several obligations with the employees who abuse the users’ information.

Third, proper drafts of disclaimer/declaration/agreement are needed when the enterprises want to collect and utilize the users’ private information. The enterprises need to make sure that they have obtained the users’ consents concerning the information collection and utilization. Proper preparations are needed to avoid future risks.

 of

The “Reasonable” Perils of Data Security Law

Your House Counsel Logo

The following is drawn from the materials to be presented at the 17th Annual America’s Claims Event 2013 conference in the “Cyber-Liability and Data Loss Claims: A Case Study from Notice of Occurrence Through Conclusion” session on June 20, 2013 in Austin, Texas.

NEGLIGENCE. “The omission to do something which a reasonable man, guided by those ordinary considerations which ordinarily regulate human affairs, would do, or the doing of something which a reasonable and prudent man would not do.”1

“When we think about data breaches, we often worry about malicious minded computer hackers exploiting software flaws, or perhaps Internet criminals seeking to enrich themselves at our expense. But the truth is that errors and negligence within the workplace are a significant cause of data breaches that compromise sensitive personal information.”2

According to a recent privacy institute study by the Ponemon Institute, only 8% of the surveyed data breach incidents were due to external cyber attack, while 22% could be attributed in part to malicious employees or other insiders. Loss of laptops or other mobile devices containing sensitive data topped the survey, while mishandling of data “at rest” or “in motion” were also major contributors.3 A later study showed that 39% of surveyed organizations identified negligence as the root cause of their data breaches, while 37% were attributed to malicious or criminal attack.4

Negligent document disposal is a clear source of preventable negligence. On December 7, 2012, at least eight garbage bags were left unattended on a dirt road in Hudson, Florida, containing credit applications to Rock Bottom Auto Sales with names, driver’s license information, and Social Security numbers. Three days later, in Pittsburgh, Pennsylvania, job placement documents were found in a dumpster from the West Pittsburgh Partnership, all containing names and SSN’s.5 For that matter, the Internal Revenue Service in 2008 was found to have disposed of taxpayer documents in regular waste containers and dumpsters, and that a follow-up investigation revealed that IRS officials failed to consistently verify whether contract employees who have access to taxpayer documents had passed background checks.6

Convincing users to back up their laptops has been difficult enough in practice; getting them to encrypt them voluntarily is much more daunting a task. A 2010 Ponemon Institute study, admittedly biased towards large corporations, concluded that of those surveyed typically 46% of the laptops held confidential data, while only 30% had their contents encrypted. A startlingly low 29% of the laptops had backup/imaging software installed, which implies that more than two thirds of all laptops if lost or stolen would leave no backup of work in progress.7

Even though more devices are coming to market with built-in encryption capabilities, these features may simply be left switched off by their users despite the fact that lost laptops, tablets, smartphones, USB “thumb” drives and other portable devices with unencrypted contents continue to provide a wealth of information to identity thieves.

On March 22, 2013, a laptop used by clinicians at the University of Mississippi Medical Center was discovered to be missing. It contained patient names, social security numbers, addresses, diagnoses, birthdates and other personal information, protected only by a password.8

On January 8, 2013, an unencrypted flash drive was stolen from a Hephzibah Georgia middle school teacher’s car, containing student SSN’s and other information.9 TD Bank had two unencrypted backup tapes with customer and their dependent names, SSN’s, addresses, account, credit and debit card numbers go missing while being transported between two TD Bank offices in March 2012, but public notice was not made until March 4, 2013.10

An examination of reported data security incidents with potential or actual data privacy breaches reveals that the scope of what is deemed “reasonable” ranges from ordinary care in the disposal of documents containing personally identifiable information (“PII”) and personal health information (“PHI”), to sophisticated data encryption, access authentication and other highly technical data security practices that the “reasonably prudent” persons, companies and governmental agencies are now expected to employ to protect the personal data that they have collected.

On October 10, 2012, the South Carolina Department of Revenue was informed of a potential cyber attack involving the personal information of taxpayers.11 The origin of the attack was traced to a state Department of Revenue employee who clicked on an embedded link in a “salacious” email and compromised his computer.12 The subsequent investigation revealed that “outdated computers and security flaws at the state’s Department of Revenue allowed international hackers to steal 3.8 million tax records”, according to Governor Nikki R. Haley. Apparently South Carolina did not encrypt Social Security Numbers, and once the outer perimeter security was compromised the hackers were able to log in as tax officials and read the data.13

Users of online services will routinely provide personal information as a matter of course to shop or obtain other services, all of which gets recorded and tracked. Data privacy laws are intended to promote and enforce a number of fair information practices to give individuals the ability to find out what personal information is being kept and by whom, opportunities to correct or remove such information, assurances that reasonable measures will be undertaken to protect such information from disclosure and to properly dispose of such information when appropriate, and may include remedial measures to be undertaken in the event of a data breach.

In the United States, there is no single comprehensive statute for data privacy laws.14 Instead, a number of sector-specific federal laws have been enacted to address the particular sensitivity of information generally recorded by companies in that market sector, and forty six states have enacted data breach notification statutes. If there is a data breach, you may be liable under state law to provide notice to those affected.15 In some jurisdictions, you may be required to provide notice to all consumer credit reporting agencies as well.16

The financial exposure to a data breach by a company may be insurable to some degree using various forms of “cyber liability” insurance, which expand and supplement many forms of more standard insurance coverages underwritten today. Policy premiums for such policies, however, are dependent upon the extent of data security practices implemented.

Conducting a data security risk assessment before encountering a data breach should identify measures that can be taken at the corporate level to provide additional protection not only to sensitive data, but also mitigate the consequences of a security incident where company data is disclosed, lost or stolen. Encrypted data in many cases may not be considered “exposed” for purposes of mandated notice to affected individuals.

In the event of a data security incident, please consider obtaining a data forensic team to not only identify the source and extent of the breach, but to preserve evidence in the event that a potential prosecution may be possible.

We will discuss a data breach case study from inception through enforcement, resolution and potential mitigation through cyber liability insurance at our presentation at ACE 2013. We hope to see you then.

1 BLACK’S LAW DICTIONARY 1184 (4th ed. 1968).

2 Privacy Rights Clearinghouse, Are the Businesses You Frequent or Work For Exposing You to an Identity Thief?, (Mar. 6, 2012), https://www.privacyrights.org/workplace-identity-theft-quiz-alert-2012

3 The Human Factor in Data Protection, 3 PONEMON INSTITUTE LLC (January 2012), available athttp://www.ponemon.org/local/upload/file/The_Human_Factor_in_data_Protection_WP_FINAL.pdf.

4 2011 Cost of Data Breach Study: United States, 7 PONEMON INSTITUTE LLC (March 2012),available at http://   www.ponemon.org/local/upload/file/2011_US_CODB_FINAL_5.pdf.

5 http://www.privacyrights.org/data-breach/new (check Breach Type “PHYS”, Organization Type “BSR” and Year “2012”).

6 Increased Management Oversight of the Sensitive but Unclassified Waste Disposal Process Is Needed to Prevent Inadvertent Disclosure of Personally Identifiable Information, TREASUR INSPECTOR GENERAL FOR TAX ADMINISTRATION (May 8, 2009), http://www.treas.gov/tigta/auditreports/2009reports/200930059fr.pdf.

7 The Billion Dollar Lost Laptop Problem 6 PONEMON INSTITUTE LLC (Sept. 30, 2010), availableat http://newsroom.intel.com/servlet/JiveServlet/download/1544-8-3132/The_Billion_Dollar_Lost_Laptop_Study.pdf.

8 http://www.privacyrights.org/data-breach/new (check Breach Type “PORT”, Organization Type “EDU” and Year “2013”).

9 http://www.privacyrights.org/data-breach/new (check Breach Type “PORT”, Organization Type “EDU” and Year “2013”).

10 http://www.privacyrights.org/data-breach/new (check Breach Type “PORT”, Organization Type “BSF” and Year “2013”).

11 Kara Durrette, SC Department of Revenue hacked; millions of SC residents affected, http://www.midlandsconnect.com/sports/story.aspx?id=817902#.UVyOdheYu7w (posted Oct. 26, 2012, updated Oct. 27, 2012).

12 Matthew J. Schwartz, How South Carolina Failed To Spot Hack Attack, INFORMATION WEEK, Nov. 26, 2012, http://www.informationweek.com/security/attacks/how-south-carolina-failed-to-spot-hack-a/240142543.

13 Robbie Brown, South Carolina Offers Details of Data Theft and Warns It Could Happen Elsewhere, N.Y. TIMES, Nov. 20, 2012, available at http://www.nytimes.com/2012/11/21/us/more-details-of-southcarolina-hacking-episode.html?_r=0.

14 PETER P. SWIRE & KENESA AHMAD, FOUNDATIONS OF INFORMATION PRIVACY AND DATA PROTECTION 41 (International Association of Privacy Professionals) (2012).

15 NYC Administrative Code § 20-117(c) (2013); NY CLS State Technology Law § 208(2) (NY state residents only); 73 Pa. Stat. § 2303 (PA residents).

16 73 Pa. Stat. § 2305; NY CLS State Technology Law §208(7)(b).

Article By:

of

Price Transparency and the Legal Marketplace

consumer_colorlogo (1)

My teenage children don’t know a world without the internet; a place where the sum of all human wisdom is a few clicks away.
Or where it’s really easy to research and buy the latest videogame.

 

Aside from the democratization of information and sharing enabled by the internet, the biggest impact of the web in most people’s lives is how it has transformed the consumer experience.  It has done so in two important ways:  by creating unprecedented levels of transparency and removing friction from the purchase process.   In nearly every industry, a wealth of information is available to consumers prior to making a purchase:  what the options are, differences between products, user feedback, and price transparency.  With full information about products, including price, the internet makes comparison shopping easy.

 

And with all of that information, purchasing is smoothed out as well.  Web services continue to refine the art of removing friction from the purchase process.  Amazon aggressively knocked down reasons to purchasing goods in brick-and-mortar stores.  Uber removed the transactional choke points from cab rides.  iTunes made it easy to buy music on an a la carte basis.  Much of the consumer internet continues to iterate and expand on the winning concept of blending ever-higher levels of information with ever-smoother transaction processing.

 

This online purchasing revolution has also reached beyond everyday consumer goods and services.  Buying insurance, trading stocks, even government licensing – all have been streamlined online.

 

But there’s one notable area that has remained largely impervious: legal services.  Despite some increases in transparency on lawyer backgrounds (Avvo) and do-it-yourself online legal forms (LegalZoom), the legal marketplace has seen nothing approaching the change in consumer empowerment and ease of transacting experienced in virtually all other industries.
It’s not as if legal services is a tiny economic niche.  The market for legal services in the U.S. is worth over $250 billion per year, and nearly 40% of that is made up of consumer legal spending.  Rather, a mixture of byzantine regulation, barriers to market entry, and restrictions on common forms of marketing have kept consumers from experiencing the same form of experimentation and innovation that has transformed the delivery of so many other goods and services:

  • Until the late 1970’s, lawyers in the U.S. could not advertise in any meaningful way, and many states still have laws on the books prohibiting lawyers from using common advertising techniques.
  • Non-lawyers cannot own even a minority interest law firms, preventing outside investment in the industry and removing the ability to offer equity compensation to talented non-lawyer leaders.
  • Except in limited circumstances, attorneys are prevented from participating in services that attempt to match clients with lawyers based on specific legal circumstances.
  • Rules based on the geographic location of an attorney prevent many forms of remote counseling, even when the matter in question is not dependent on a given state’s law.
  • Legal obligations in most states make it difficult for attorneys to offer limited-scope services that attempt to counsel or coach consumers through specific legal issues rather than engage in full-blown client advocacy.

Some of these restrictions are rooted in a learned profession’s reliance on tradition and resistance to rapid change, and much of it stems from a desire to protect clients and ensure the quality of legal work.  But a consequence of the locked-down nature of the industry is that many consumers who would otherwise use legal services do not avail themselves of them.

 

It’s not hard to see why.  There’s no way to shop for a lawyer-reviewed estate plan the way you would for a pair of shoes or a flight to Mexico.  And beyond price transparency, attorneys and law firm have shown little interest in marketing fixed-price, entry-level offerings that work fine for a large percentage of consumers.  Instead of leading with such offers and then upselling to those needing more involved help, the vast majority of lawyers treat every client as being in need of a custom solution.

 

It’s a shame for both consumers and lawyers. Many consumers who choose to do without a lawyer’s help are no doubt getting suboptimal outcomes in their legal matters.  And lawyers, by failing to deliver the transparency and ease of transacting that consumers have become used to, are missing out on a massive, underserved market.

–          Josh King is vice president and general counsel of Avvo.com, the web’s largest legal Q&A platform, directory and marketplace.

Protect Your Trademark Online: Global Trademark Clearinghouse to Begin Accepting Submissions

The National Law Review recently published an article by Karen Artz Ash, Bret J. Danow, Roger P. Furey, Doron S. Goldstein, Peter J. Riebling, and David B. Sherman of Katten Muchin Rosenman LLP regarding Trademarks and the Global Clearinghouse:

Katten Muchin

 

On March 26, 2013, the Internet Corporation for Assigned Names and Numbers (ICANN) will begin to allow trademark owners to submit their marks for inclusion in a newly created Trademark Clearinghouse, which is intended to serve as a single centralized database of verified information that will enable trademark holders throughout the world to better protect their rights on the Internet. This follow-up to “New Generic Top-Level Domain Names: What Brand Owners Need to Know” (June 15, 2012) introduces brand owners (and their licensees, assignees and agents) to several key elements of the Trademark Clearinghouse submission process, and describes the primary benefits that the Trademark Clearinghouse promises to provide to trademark rights holders.

Background

ICANN, the private nonprofit corporation that manages most top-level domains (TLDs) and IP addresses, developed the Trademark Clearinghouse (in connection with Deloitte and IBM) as part of its new generic Top-Level Domain (New gTLD) Program. Generally speaking, the New gTLD Program allows any legal entity to file an application to create a new gTLD—the general domain name address extensions that come after the last dot (such as .com, .net., .org)—and, as a result, has the potential to significantly expand the existing Internet infrastructure by increasing the number of gTLDs to an almost unlimited amount (and simultaneously expanding the potential for online trademark infringement). Amid this expansion, the Trademark Clearinghouse was created to protect trademark rights holders by permitting them to more easily register second-level domain names under new gTLDs (e.g., YOURNAME.example), and to allow gTLD operators and registries to better review and assess trademark claims.

The Submission Process

The Trademark Clearinghouse will initially accept and verify for registration (1) nationally or regionally (i.e., multi-nationally) registered trademarks; (2) court-validated marks; and (3) marks protected by statute or treaty. Trademarks that are the subjects of pending applications or are inactive or invalid may not be registered.

Although the specific type of information and documentation required to verify a trademark record will vary depending on the type of mark, the Trademark Clearinghouse will generally require trademark rights holders to submit information regarding the mark itself, details about any applicable registration, court reference numbers or other documentation evidencing rights, the goods and/or services covered and the corresponding Nice classification(s), the country(ies) in which the mark is protected, the name and contact information of the trademark rights holder, and, for purposes of obtaining applicable Sunrise Services, certain verification of proof of use of the mark, which may include a signed declaration and specimen(s) of trademark use (e.g., labels, tags, containers, advertising and marketing materials). All trademark submissions will be subject to verification by Deloitte Enterprise Risk Services.

This verified trademark data will support the two primary benefits that the Trademark Clearinghouse promises to provide to trademark rights holders: Sunrise Services and “Trademark Claims” for all new gTLDs. The cost charged by ICANN for making a submission to the Trademark Clearinghouse will vary from US$95 to US$150 per year for a single mark, with discounted fees available to trademark rights holders who seek registration for three years (US$435) or five years (US$725). The Trademark Clearinghouse’s submission guidelines and basic fee structure are available for download at its official website.

Sunrise Services

By registering a trademark with the Trademark Clearinghouse, a trademark rights holder will be permitted to register second-level domain names under new gTLDs (e.g., YOURNAME.example) during a “Sunrise” period of at least thirty (30) days before registration of such names is made available to the general public. All new gTLD applicants are subject to this mandatory “Sunrise” period after the registration of the new gTLD with a registry. Access to “Sunrise” registration will provide trademark rights holders with a relatively low-cost means by which to obtain some level of control of, and some ability to safeguard, second-level domain names comprised of their trademarks.

Trademark Claims

Registering a trademark with the Trademark Clearinghouse will also entitle a rights holder to a “Trademark Claims” service following the “Sunrise” period. This “Trademark Claims” service will extend for at least the first sixty (60) days after a new gTLD is open for registration with the general public. At the outset, the “Trademark Claims” service will provide a warning of potential infringement to any third party attempting to register a domain name that matches a trademark registered with the Trademark Clearinghouse. In the event that the third party proceeds to register the domain name despite such a notice, the “Trademark Claims” service would send an automated notification to the trademark holder alerting it to the potential infringement. Although the Trademark Clearinghouse will not bar registration of the potentially infringing domain name, the “Trademark Claims” notice will expeditiously inform the rights holder and enable it to consider whether to take action.

As a practical matter, the “Trademark Claims” service will only identify identical matches to eligible trademarks. In other words, “Trademark Claims” notices will only be generated if the domain name label consists of the complete and identical textual elements of the trademark registered with the Trademark Clearinghouse. As a result, even a domain name containing a plural version of the mark would not be considered an identical match. Typos and “trademark + generic term” domain name labels also would not be considered identical matches. To the extent a trademark contains any special character that cannot be represented in a domain name, e.g., “@” or “!,” such character may be either omitted, replaced by hyphens, or spelled out with appropriate words of the official language(s) of the country/jurisdiction in which the mark is protected. Accordingly, if a trademark rights holder is interested in obtaining additional protection against the use and registration of infringing domain names, it may wish to work with legal counsel and use a private domain name watching service.

Conclusion

The launch of the Trademark Clearinghouse marks a phase of ICANN’s New gTLD Program that would appear to be particularly significant to brand owners and licensees. In view of the numerous ways in which the New gTLD Program promises to alter the existing Internet infrastructure, trademark rights holders may wish to consider the benefits of early registration with the Trademark Clearinghouse and work with counsel to develop other cost-effective strategies to protect their trademarks and other valuable intellectual property rights.

©2013 Katten Muchin Rosenman LLP