Category: Technology

Nineteen States Have Banned TikTok on Government-Issued Devices

Governors of numerous states have issued Executive Orders in the past several weeks banning TikTok from government-issued devices and many have already implemented a ban, with others considering similar measures. There is also bi-partisan support of a ban in the Senate, which unanimously approved a bill last week that would ban the app from devices issued by federal agencies. There is already a ban prohibiting military personnel from downloading the app on government-issued devices.

The bans are in response to the national security concerns that TikTok poses to U.S. citizens [View related posts].

To date, 19 states have issued some sort of ban on the use of TikTok on government-issued devices, including some Executive Orders banning the use of TikTok statewide on all government-issued devices. Other state officials have implemented a ban within an individual state department, such as the Louisiana Secretary of State’s Office. In 2020, Nebraska was the first state to issue a ban. Other states that have banned TikTok use in some way are: South Dakota, North Dakota, Maryland, South Carolina, Texas, New Hampshire, Utah, Louisiana, West Virginia, Georgia, Oklahoma, Idaho, Iowa, Tennessee, Alabama, Virginia, and Montana.

Indiana’s Attorney General filed suit against TikTok alleging that the app collects and uses individuals’ sensitive and personal information, but deceives consumers into believing that the information is secure. We anticipate that both the federal government and additional state governments will continue to assess the risk and issue bans on its use in the next few weeks.

Copyright © 2022 Robinson & Cole LLP. All rights reserved.
For more Cybersecurity Legal News, click here to visit the National Law Review.

Office of Science and Technology Policy Requests Public Input on Biotechnology Regulation

  • The Office of Science and Technology Policy (OSTP) issued a request for information (RFI) today in which it invites public comment on the Coordinated Framework for the Regulation of Biotechnology (the “Coordinated Framework”).
  • The Coordinated Framework, which is a Federal regulatory policy for ensuring the safety of biotechnology products, was first issued in 1986, updated in 1992— to affirm that federal regulation should focus on characteristics of the product and the environment into which it being introduced, and not on the process by which it is produced—and then updated again in 2017 to clarify the roles of EPA, FDA, and USDA. And, in September of this year, Executive Order 14081 directed the three agencies to clarify and streamline regulations to support the safe of use of biotechnology products.
  • Accordingly, the RFI requests comment on seven questions related to the Coordinated Framework. The questions include a request for comment on identification of any regulatory gaps, inefficiencies, or uncertainties; data or information to improve any identified issues; and new or emerging biotechnology products that the agencies should be prepared to address. Comments to the RFI are due by February 3, 2023. Also, on January 12, 2023, OTSP will host a virtual event in which it will listen to public feedback on the RFI.

Article By Food and Drug Law at Keller and Heckman

For more food, drug, and biotechnology legal news, click here to visit the National Law Review.

© 2022 Keller and Heckman LLP

Ankura CTIX FLASH Update – December 13, 2022

Malware Activity

Uber Discloses New Data Breach Related to Third-Party Vendor

Uber has disclosed a new data breach that is related to the security breach of Teqtivity, a third-party vendor that Uber uses for asset management and tracking services. A threat actor named “UberLeaks” began leaking allegedly stolen data from Uber and Uber Eats on December 10, 2022, on a hacking forum. The exposed data includes Windows domain login names and email addresses, corporate reports, IT asset management information, data destruction reports, multiple archives of apparent source code associated with mobile device management (MDM) platforms, and more. One document in particular contained over 77,000 Uber employee email addresses and Windows Active Directory information. UberLeaks posted the alleged stolen information in four (4) separate postings regarding Uber MDM, Uber Eats MDM, Teqtivity MDM, and TripActions MDM platforms. The actor included one (1) member of the Lapsus$ threat group in each post, but Uber confirmed that Lapsus$ is not related to this December breach despite being previously linked to the company’s cyberattack in September 2022. Uber confirmed that this breach is not related to the security incident that took place in September and that the code identified is not owned by Uber. Teqtivity published a data breach notification on December 12, 2022, that stated the company is aware of “customer data that was compromised due to unauthorized access to our systems by a malicious third party” and that the third-party obtained access to its AWS backup server that housed company code and data files. Teqtivity also noted that its ongoing investigation identified the following exposed information: first name, last name, work email address, work location details, device serial number, device make, device model, and technical specs. The company confirmed that home address, banking information, and government identification numbers are not collected or retained. Uber and Teqtivity are both in the midst of ongoing investigations into this data breach. CTIX analysts will provide updates on the matter once available.

Threat Actor Activity

PLAY Ransomware Claims Responsibility for Antwerp Cyberattack

After last week’s ransomware attack on the city of Antwerp, a threat organization has claimed responsibility and has begun making demands. The threat group, tracked as PLAY ransomware, is an up-and-coming ransomware operation that has been posting leaked information since November 2022, according to an available posting on their leak site. Samples of the threat group’s ransomware variants have shown activity dating back to June 2022, which is around the time PLAY ransomware targeted the Argentina Court of Cordoba (August). While PLAY’s ransomware attack crippled several sectors of Antwerp, it appears to have had a significant impact on residential facilities throughout the city, as stated by officials. According to PLAY NEWS, PLAY’s ransomware leak site, the publication date for the exfiltrated data is Monday, December 19, 2022, if the undisclosed ransom is not paid. PLAY threat actors claim to have 557 gigabytes (GB) worth of Antwerp-related data including but not limited to personal identifiable information, passports, identification cards, and financial documents. CTIX continues to monitor the developing situation and will provide additional updates as more information is released.

Vulnerabilities

Fortinet Patches Critical RCE Vulnerability in FortiOS SSL-VPN Products

After observing active exploitation attempts in-the-wild, the network security solutions manufacturer Fortinet has patched a critical vulnerability affecting their FortiOS SSL-VPN products. The flaw, tracked as CVE-2022-42475, was given a CVSS score of 9.3/10 and is a heap-based buffer overflow, which could allow unauthenticated attackers to perform arbitrary remote code execution (RCE) if successfully exploited. Specifically, the vulnerability exists within the FortiOS sslvpnd product, which enables individual users to safely access an organization’s network, client-server applications, and internal network utilities and directories without the need for specialized software. The vulnerability was first discovered by researchers from the French cybersecurity firm Olympe Cyberdefense who warned users to monitor their logs for suspicious activity until a patch was released. Although very few technical details about the exploitation have been divulged, Fortinet did share lists of suspicious artifacts and IPs. Based on research by Ankura CTIX analysts, the IPs released by Fortinet are located around the globe and are not associated with known threat actors at this time. To prevent exploitation, all Fortinet administrators leveraging FortiOS sslvpnd should ensure that they download and install the latest patch. If organizations cannot immediately patch their systems due to the business interruption it would cause, Olympe Cyberdefense suggests “customers monitor logs, disable the VPN-SSL functionality, and create access rules to limit connections from specific IP addresses.” A list of the affected products and their solutions, as well as the indicators of compromise can be found in the Fortinet advisory linked below.

The semi-weekly Ankura Cyber Threat Investigations and Expert Services (CTIX) FLASH Update is designed to provide timely and relevant cyber intelligence pertaining to current or emerging cyber events. The preceding is a collection of cyber threat intelligence leads assembled over the past few days and typically includes high level intelligence pertaining to recent threat group/actor activity and newly identified vulnerabilities impacting a wide range of industries and victims. 

Article By Ankura Cyber Threat Investigations and Expert Services

For more cybersecurity legal news, click here to visit the National Law Review.

Copyright © 2022 Ankura Consulting Group, LLC. All rights reserved.

Easy Ways to Build Your Professional Brand

Whether or not you realize it, you have a professional brand, and it’s up to you to maximize and leverage it.

Every day, people are searching for you online. They may go to your web bio, but more than likely, they’re probably going to LinkedIn as well to check you out.

LinkedIn paints a much more robust picture of you and your professional background than your web site bio because it enables you to showcase your entire professional history and body of work.

Think of LinkedIn as your own mini website and blog.

So LinkedIn is a huge part of managing your brand. It would be very wise to focus on building your presence on LinkedIn, and it is free.

Also, Googling yourself regularly and setting up Google alerts to make sure that you’re aware of what’s being said about you, and manage your online reputation.

Speaking engagements can be incredibly powerful to underscore your subject matter expertise and stay top of mind with those who need someone like you. If you feel uncomfortable doing them live, do webinars.

There is a ripple effect with speaking engagements, which is that you likely will get asked to do another speaking engagement when people see that you are on the speaking circuit and that you are good at it.

Not everyone is comfortable being on video like I am, but that’s also an option. A podcast is another great way to build your brand, make strong relationships and you don’t have to be on camera.

There’s a lot of other things you can do, such as writing articles, blog posts, client alerts, email blasts and email newsletters – these are all great ways to showcase your thought leadership expertise and stay top of mind with your clients, prospects and referral sources.

There’s also trade association memberships and committee involvement – they are an effective way to get to know people in your industry, as long as you’re going to commit to them, because the worst thing you can do is to not do a good job on these committees.

You don’t have to do all of these things, or several of them at once, and you should only do the ones that you like to do because you will be more successful at them.

A Word About Self Confidence

Don’t let anyone else dim your light, most of all you.

It’s time to build your confidence about posting on LinkedIn and showing up in other kinds of marketing. We each have value to provide to others and we need to believe that.

Every time I post I get nervous about how it will be received, especially posting videos.

But we all over estimate the extent to which others are thinking about us because guess what? They’re thinking about themselves way more. So stop worrying about what everyone else thinks!

You won’t be everyone’s cup of tea and that’s okay.

The right people will gravitate toward you and appreciate your posts even if they don’t tell you or actually post a like on your content.

I keep posting because I believe in my posts and I’m coming from a place of genuineness. Trying to help people is enough for me to keep showing up and posting.

So believe in yourself and silence the naysayers and that negative voice that you have about yourself. Each of us has an inner critic and if we’re not careful, we can start to believe what it has to say. Your success on LinkedIn and elsewhere depends on your ability to silence your inner critic.

Don’t let other people (or yourself) dim your light and be YOU. That’s your superpower.

How do you find the confidence to show up on LinkedIn and in other places?

Article By Stefanie M. Marrone of Stefanie Marrone Consulting

For more legal marketing news, click here to visit the National Law Review.

Copyright © 2022, Stefanie M. Marrone. All Rights Reserved.

Quantifying Cryptocurrency Claims in Bankruptcy: Does the Dollar Still Reign Supreme?

In the past six months, four major players in the crypto space have filed for chapter 11 bankruptcy protection: Celsius Network, Voyager Digital, FTX, and BlockFi, and more may be forthcoming.  Together, the debtors in these four bankruptcy cases are beholden to hundreds of thousands of creditors.  The bulk of the claims in these cases are customer claims related to cryptocurrency held on the debtors’ respective platforms.  These customer claimants deposited or “stored” fiat currency and cryptocurrencies on the debtors’ platforms.  Some of these funds allegedly were commingled or rehypothecated, leaving customer accounts severely underfunded when liquidity crunches arose at the various entities.  The total amount of such claims is estimated to be in the billions — that is, if these claims ultimately are measured in United States Dollars (“USD”).

Crypto-watchers and bankruptcy lawyers alike have speculated how customer claims based on digital assets such as cryptocurrencies should be valued and measured under bankruptcy law.  Given the volatility of cryptocurrency prices, this determination may have a significant effect on recoveries, as well as the viability of the “payment-in-kind” distribution mechanics proposed in Voyager, Celsius, and BlockFi.  A number of creditors appearing pro se in these proceedings have expressed a desire to keep their mix of cryptocurrencies through these proposed “in-kind” distributions.

However, a crypto-centric approach to valuing claims and making distributions raises a number of issues for consideration.  For example, measuring customer claims in cryptocurrency and making “in-kind” distributions of these assets could lead to creditors within the same class receiving recoveries of disparate USD value as the result of the fluctuation in cryptocurrency prices. Moreover, as has been discussed in the Celsius proceedings, the administrative burden associated with maintaining, accounting for, and distributing a wide variety of cryptocurrencies as part of a recovery scheme would likely prove complex.  Equity holders also might challenge the confirmability of a plan where valuations and recoveries are based on cryptocurrency rather than USD, as a dramatic rise in cryptocurrency values could return some value to equity.

Like most issues at the intersection of insolvency and cryptocurrency, there is little precedent to guide creditors through the uncertainties, but a recent dispute in the Celsius bankruptcy proceedings as to whether a debtor is required to schedule claims in USD, or whether cryptocurrency claims can be scheduled “in-kind,” may serve as a preview of things to come.

I.          General Background

Celsius Network (“Celsius” and, together with its affiliated debtors and debtors in possession, the “Debtors”), self-described as one of the “largest and most sophisticated” cryptocurrency-based finance platforms and lenders that claimed over 1.7 million users worldwide,1 filed petitions under Chapter 11 of the Bankruptcy Code on July 13, 2022.2  On October 5, 2022, the Debtors filed their schedules of assets and liabilities (“Schedules”).  Each Debtor’s schedule of unsecured creditors’ claims (Schedule E/F) lists the claims of the Debtors’ customers by the number of various forms of cryptocurrency coins and account types, rather than in USD.3

On October 25, 2022, a group of beneficial holders, investment advisors, and managers of beneficial holders (collectively, the “Series B Preferred Holders”) of the Series B Preferred Shares issued by debtor Celsius Network Limited filed a motion seeking entry of an order directing the Debtors to amend their Schedules to reflect customer claims valued in USD, in addition to cryptocurrency coin counts.4

II.         Arguments

a.         Series B Preferred Holders

Broadly, pursuant to Bankruptcy Rule 1009(a),5 the Series B Preferred Holders sought to have the Debtors amend their Schedule E/F to “dollarize” creditors’ claims, i.e., value customer claims in their dollar value as of the petition date.  As filed, the Series B Preferred Holders asserted that the Debtors’ schedules were “improper, misleading, and fail[ed] to comply” with the Bankruptcy Rules “because they schedule[d] customer claims in cryptocurrency coin counts, rather than in lawful currency of the United States as of the Petition Date.”6  The Series B Preferred Holders asserted that such amended schedules are essential to the Debtors’ ability to structure, solicit, and confirm a plan of reorganization under the requirements of Section 1129, including whether “(i) claims are impaired or unimpaired, (ii) holders of similarly situated claims are receiving the same treatment, and (iii) the plan meets the requirements of the ‘absolute priority rule.’”7  In support of their arguments that USD valuation of a customer’s claim should be required, the Series B Preferred Holders relied on provisions of the Bankruptcy Rules, Bankruptcy Code, and Official Forms.  The Series B Preferred Holders stressed that the motion “takes no position regarding the form of distribution customers” should receive under the Debtors’ plan, but rather that the Debtors must “add the [USD] amount of each customer claim in Schedules E/F to the cryptocurrency coin counts.”8

The Series B Preferred Holders also asserted that the requirement to denominate claims in USD is consistent with Section 502(b) of the Bankruptcy Code, which provides that when a debtor or party-in-interest objects to a claim, the court determines the amount of the claim in USD as of the debtor’s petition date.

b.         Debtors’ Response

The Debtors had previously indicated that they were not seeking to dollarize its customers’ claims; rather, the Debtors represented that they intend to return cryptocurrency assets to its customers “in kind.”9  The Debtors stated that they interpreted Bankruptcy Rule 9009(a)(1)-(2) and General Order M-386, dated November 24, 2009 (the “General Order M-386”) to allow the Debtors to remove the dollar symbol when scheduling claims regarding cryptocurrency coin counts.10  This approach, the Debtors argue, lessens confusion for its customer case and decreases administrative expense for the estate.11

Further, the Debtors argued that the Series B Preferred Holders’ reliance on Section 502(b) was misplaced because the application of such section is inapplicable at this stage of the proceedings where no claims objection has taken place.12

The Committee of Unsecured Creditors (“UCC”) agreed with the Debtors’ approach, stating that it “makes sense” for account holders to validate their scheduled claims by cryptocurrency type and that it wished to be consulted on the petition date prices used by the Debtors if they filed an amendment to the schedules.13

III.        Analysis

a.         Bankruptcy Code & Rules & Forms

Bankruptcy Rule 1007(b)(1) requires that a debtor’s schedules of assets and liabilities must be “prepared as prescribed by the appropriate Official Forms.”14  The relevant official form that a debtor must use to prepare its schedule of assets and liabilities is Official Form 206, which contains a USD symbol to denote the amount of liabilities that a debtor must list.15  Specifically, Official Form 206 provides:

As seen above, Official Form 206 does “hardwire” a dollar sign (“$”) into the boxes provided for claim amounts.  Bankruptcy Rule 9009 states that the official forms are to “be used without alteration, except as otherwise provided in the rules, [or] in a particular Official Form.”16  Bankruptcy Rule 9009 permits “certain minor changes not affecting wording or the order of presenting information,” including “expand[ing] the prescribed areas for responses in order to permit complete responses” and “delet[ing] space not needed for responses.”17  Lastly, General Order M-386 permits “such revisions as are necessary under the circumstances of the individual case or cases.”18 The introduction to General Order M-386 states that standard forms were adopted to “expedite court review and entry of such orders” and that courts will expect use of the standard forms “with only such revisions as are necessary under the circumstances of the individual case or cases.”19

b.         Section 502(b)

Bankruptcy Code Section 502(b) provides that if there is an objection to a claim, the court “shall determine the amount of such claim in lawful currency of the United States as of the [petition] date . . . .”20  This “prevents the value of a claim from fluctuating by setting the claim as of the petition date and converting it to the United States dollars.”21  Acknowledging the “novel phenomenon” of dollarizing claims in cryptocurrency, the Series B Preferred Holders analogize this to cases where courts have required claims asserted in or based on in foreign currency or amounts of gold should be valued in USD.  However, these cases were decided in the context of a claims objection. The Celsius Debtors argued that these cases have limited utility in the context of a motion for an order directing the Debtors to amend their schedules pursuant to Bankruptcy Rule 1009(a).22

IV.        The Court’s Order

Ahead of the hearing regarding the motion for an order directing the Debtors to amend their schedules, the Debtors and the Series B Preferred Holders were able to consensually resolve the motion and filed a revised proposed order prior to the hearing on the motions on November 15.23  The Debtors agreed to amend their schedules by filing a conversion table within three days of the entry of the order, in consultation with the UCC and Series B Preferred Holders, that reflects the Debtors’ view of the rate of conversion of all cryptocurrencies listed in the Debtors’ schedules to USD as of the petition date.  The idea is that the conversion table could be used by customers as a reference for calculating the USD value of their claim, to the extent needed for filing a proof of claim.  The conversion table is not binding – the order preserves the rights of all parties to contest the conversion rates and does not require a party-in-interest to file an objection that is not stated in USD “solely on the basis that such claims should be reflected in [USD].”24  The order also requires the Debtors to file updated schedules “dollarizing” its account holders’ cryptocurrency holdings to the extent required by any future court order or judicial determination.

On November 17, 2022, the court entered the revised proposed order.25

V.         Cash Is Still King?

Other bankruptcy courts have taken similar approaches as the Celsius court in this issue.  An earlier cryptocurrency case, In re Cred Inc., the debtors did not schedule cryptocurrency claims in USD, but included a conversion table in their filed schedules, which set forth a conversion rate to USD as of the petition date.26  Debtors in other cases, such as Voyager Digital, scheduled the amounts of their customer claims as “undetermined” and listed them in Schedule F in cryptocurrency.27  BlockFi, which filed for bankruptcy on November 28, 2022, already has filed a proposed plan that would distribute its cryptocurrencies to its customers in–kind in exchange for their claims against the BlockFi debtors.28  To date, neither BlockFi nor FTX have filed their schedules, and it remains to be seen whether they will follow the pattern established in Celsius and Voyager.

For creditors and equity holders, whether claims are measured in USD or the applicable cryptocurrency is only the beginning of what will likely be a long and contentious road to recovery.  It remains to be seen whether any of these debtors will be able to confirm a viable restructuring plan that relies on any sort of “in-kind” distribution of cryptocurrencies.  Further issues are likely to arise in the claims resolution process even further down the road as claimants and liquidation trustees (or plan administrators) wrestle with how to value claims based on such a volatile asset, subject to ever-increasing regulatory scrutiny.  However, for the time being, the bankruptcy process continues to run on USD.

FOOTNOTES

1 Declaration of Alex Mashinsky, CEO of the Debtors ¶¶ 1, 9, 20, In re Celsius Network LLC, Case No. 22-10964 (MG) (Bankr. S.D.N.Y. 2022) [ECF No. 23].

2 Id. at ¶ 131.

3 Debtors’ Schedules of Assets and Liabilities and Statements of Financial Affairs, In re Celsius Network LLC, Case No. 22-10964 (MG) (Bankr. S.D.N.Y. 2022) [ECF No. 974]; see also Schedule E/F, Case No. 22-10967 [Docket No. 5]; Case No. 22-10970 [Docket No. 5]; Case No. 22-10968 [Docket No. 5]; Case No. 22-10965 [Docket No. 6]; Case No. 22-10966 [Docket No. 7]; Case No. 22-10964 [Docket No. 974]; Case No. 22-10969 [Docket No. 5]; Case No. 22- 10971 [Docket No. 5].

4 Series B Preferred Holders Motion to Direct Debtors to Amend Schedules, In re Celsius Network LLC, Case No. 22-10964 (MG) (Bankr. S.D.N.Y. 2022) [ECF No. 1183].

5 “On motion of a party in interest, after notice and a hearing, the court may order any . . . schedule . . . to be amended and the clerk shall give notice of the amendment to entities designated by the court.” Fed. R. Bankr. P. 1009(a).

6 Series B Preferred Holders Motion to Direct Debtors to Amend Schedules ¶ 1.

7 Id. ¶ 3 (citing 11 U.S.C. §§ 1123(a)(2)-(4), 1129(a)(1), 1129(b)).

8 Series B Preferred Holders’ Reply ¶ 10, In re Celsius Network LLC, Case No. 22-10964 (MG) (Bankr. S.D.N.Y. 2022) [ECF No. 1334].

9 See 8/16/22 Hr’g Tr. at 35:5-7 (“The company is not seeking to dollarize claims on the petition date and give people back a recovery in fiat.”); id. at 42:11-16 (“[The UCC is] pleased that the company is not focused on dollarization of claims . . . an in-kind recovery is absolutely critical.”).

10 General Order M-386 is a resolution of the Board of Judges for the Southern District of New York, which provides for “a standard form for orders to establish deadlines for the filing of proofs of claim . . . in chapter 11 cases” to “thereby expedite court review and entry of such orders.”

11 Debtors’ Objection to Series B Preferred Holders’ Motion ¶ 9, In re Celsius Network LLC, Case No. 22-10964 (MG) (Bankr. S.D.N.Y. 2022) [ECF No. 1304].

12 Id. ¶ 12 (citing In re Mohr, 425 B.R. 457, 464 (Bankr. S.D. Ohio)).

13 Id. at 42:12-16 (“We are pleased to hear that the company is not focused on dollarization of claims . . . receiving an in-kind recover is 16 absolutely critical.”); UCC Statement and Reservation of Rights ¶ 6, In re Celsius Network LLC, Case No. 22-10964 (MG) (Bankr. S.D.N.Y. 2022) [ECF No. 1303].

14 Fed. R. Bankr. P. 1007(b)(1).

15 See Official Form 206, Part 2, Line 4 (using the USD sign into Form 206 for scheduling the debtor’s liabilities).

16 Fed. R. Bankr. P. 9009(a).

17 Id.

18 General Order M-386 ¶ 9.

19 General Order M-386 ¶ 2 (unnumbered, preliminary statement).

20 11 U.S.C. § 502(b).

21 In re Aaura, Inc., No. 06 B 01853, 2006 WL 2568048, at *4, n.5 (Bankr. N.D. Ill. Sept. 1, 2006).

22 In re USGen New Eng., Inc., 429 B.R. 437, 492 (Bankr. D. Md. 2010) (using the exchange rate in effect on the petition date, in the context of a claims objection, to convert the claim to USD), aff’d sub nom. TransCanada Pipelines Ltd. v. USGen New Eng., Inc., 458 B.R. 195 (D. Md. 2011); Aaura, 2006 WL 2568048, at *5 (“Section 502(b) converts Aaura’s obligation to repay the obligation in gold into a claim against the estate in dollars, but it makes this transformation only as of the petition date, not retroactive to the date on which Aaura first became liable.”); Matter of Axona Intern. Credit & Com. Ltd., 88 B.R. 597, 608 n.19 (Bankr. S.D.N.Y. 1988) (noting Section 502(b) refers to the petition date as “the appropriate date for conversion of foreign currency claims”), aff’d sub nom. In re Axona Intern. Credit & Com. Ltd., 115 B.R. 442 (S.D.N.Y. 1990); ABC Dev. Learning Ctrs. (USA), Inc. v. RCS Capital Dev., LLC (In re RCS Capital Dev., LLC), No. AZ-12-1381-JuTaAh, 2013 Bankr. LEXIS 4666, at *38-39 (B.A.P. 9th Cir. July 16, 2013) (same).

23 Notice of Proposed Order, In re Celsius Network LLC, Case No. 22-10964 (MG) (Bankr. S.D.N.Y. 2022) [ECF No. 1342].

24 Id. at ¶¶ 7, 8.

25 Order Pursuant to Bankruptcy Rule 1099 Directing the Debtors to Amend Their Schedules in Certain Circumstances, In re Celsius Network LLC, Case No. 22-10964 (MG) (Bankr. S.D.N.Y. 2022) [ECF No. 1387].

26 Schedules at 12, In re Cred Inc., Case No. 20-128336 (JTD) (Bankr. D. Del. 2021) [ECF No. 443].

27 Schedules, In re Voyager Digital Holdings, Inc., Case No. 22-10943 (MEW) (Bankr. S.D.N.Y. Aug. 18, 2022) [ECF No. 311].

28 Joint Plan of Reorganization § IV.B.1.a, In re BlockFi Inc., Case No. 19361 (MBK) (Bankr. D.N.J. 2022) [ECF No. 22].

Article By Cadwalader, Wickersham & Taft LLP

For more financial legal news, click here to visit the National Law Review.

© Copyright 2022 Cadwalader, Wickersham & Taft LLP

How Many Websites Now Have Cookie Banners?

A “cookie banner” refers to a pop-up notice on a website that discusses the site’s use of cookies. There is little standardization concerning how cookie banners are deployed. For example, websites can position them in different places on the screen (e.g., across the top of the screen, across the bottom of the screen, in a corner of the screen, or centered on the screen). Cookie banners also utilize different language to describe what cookies are and use different terms to describe options consumers may have in relation to the deployment of cookies. Some cookie banners require that a consumer interact with the banner (e.g., accept, cancel, or click out of) before the consumer can visit a website; other cookie banners are designed to disappear from view after several seconds.

As of October 2022, 45% of Fortune 500 websites were utilizing a cookie banner.[1] That represents an 11-point increase since 2021.[2]

[1] Greenberg Traurig LLP reviewed the publicly available privacy notices and practices of 555 companies (the Survey Population). The Survey Population comprises companies that had been ranked within the Fortune 500 at some point in the past five years as well as additional companies selected from industries that are underrepresented in the Fortune 500. While the Survey Population does not fully match the current Fortune 500 as a result of industry consolidation and shifts in company capitalization, we believe that the aggregate statistics rendered from the Survey Population are representative of mature companies. Greenberg Traurig’s latest survey was conducted between September and October 2022.

[2] Greenberg Traurig LLP conducted a survey in December 2020 which showed that 34.2% of websites had cookie banners.

Article By David A. Zetoony of Greenberg Traurig, LLP

For more communications, media, and internet legal news, click here to visit the National Law Review.

©2022 Greenberg Traurig, LLP. All rights reserved.

ANOTHER TRILLION DOLLAR CASE:? TikTok Hit in MASSIVE CIPA Suit Over Its Business Model of Profiting from Advertising by Collecting and Monetizing User Data

Data privacy lawsuits are EXPLODING and one of our country’s most popular mobile app — TikTok’s privacy issues keep piling up.

Following its recent $92 million class-action data privacy settlement for its alleged violation of Illinois Biometric Information Privacy Act (BIPA), TikTok is now facing a CIPA and Federal Wire Tap class action for collecting users’ data via its in-app browser without Plaintiff and class member’s consent.

The complaint alleges “[n]owhere in [Tik Tok’s] Terms of Service or the privacy policies is it disclosed that Defendants compel their users to use an in-app browser that installs JavaScipt code into the external websites that users visit from the TikTok app which then provides TikTok with a complete record of every keystroke, every tap on any button, link, image or other component on any website, and details about the elements the users clicked. “

Despite being a free app, TikTok makes billions in revenue by collecting users’ data without their consent.

“The world’s most valuable resource is no longer oil, but data.”

While we’ve discussed before, many companies do collect data for legitimate purposes with consent. However this new complaint alleges a very specific type of data collection practice without the TikTok user’s OR the third party website operator’s consent.

TikTok allegedly relies on selling digital advertising spots for income and the algorithm used to determine what advertisements to display on a user’s home page, utilizes tracking software to understand a users’ interest and habits. In order to drive this business, TikTok presents users with links to third-party websites in TikTok’s in-app browser without a user  (or the third party website operator) knowing this is occurring via TikTok’s in-app browser. The user’s keystrokes is simultaneously being intercepted and recorded.

“Specifically, when a user attempts to access a website, by clicking a link while using the TikTok app, the website does not open via the default browser.  Instead, unbeknownst to the user, the link is opened inside the TikTok app, in [Tik Tok’s] in-app browser.  Thus, the user views the third-party website without leaving the TikTok app. “

The Tik-Tok in-app browser does not just track purchase information, it allegedly tracks detailed private and sensitive information – including information about  a person’s physical and mental health.

For example, health providers and pharmacies, such as Planned Parenthood, have a digital presence on TikTok, with videos that appear on users’ feeds.

Once a user clicks on this link, they are directed to Planned Parenthood’s main webpage via TikTok’s in-app browser. While the user is assured that his or her information is “privacy and anonymous,” TikTok is allegedly intercepting it and monetizing it to send targeted advertisements to the user – without the user’s or Planned Parenthood’s consent.

The complaint not only details out the global privacy concerns regarding TikTok’s privacy practices (including FTC investigations, outright ban preventing U.S. military from using it, TikTok’s BIPA lawsuit, and an uptick in privacy advocate concerns) it also specifically calls out the concerns around collecting reproductive health information after the demise of Roe v. Wade this year:

“TikTok’s acquisition of this sensitive information is especially concerning given the Supreme Court’s recent reversal of Roe v. Wade and the subsequent criminalization of abortion in several states.  Almost immediately after the precedent-overturning decision was issued, anxieties arose regarding data privacy in the context of commonly used period and ovulation tracking apps.  The potential of governments to acquire digital data to support prosecution cases for abortions was quickly flagged as a well-founded concern.”

Esh. The allegations are alarming and the 76 page complaint can be read here: TikTok.

In any event, the class is alleged as:

“Nationwide Class: All natural persons in the United State whose used the TikTok app to visit websites external to the app, via the in-app browser.

California Subclass: All natural persons residing in California whose used the TikTok app to visit websites external to the app, via the in-app browser.”

The complaint alleges California law applies to all class members – like the Meta CIPA complaint we will have to wait and see how a nationwide class can be brought related to a CA statute.

On the CIPA claim, the Plaintiff – Austin Recht – seeks an unspecific amount of damages for the class but the demand is $5,000 per violation or 3x the amount of damages sustained by Plaintiff and the class in an amount to be proven at trial.

We’ll obviously continue to keep an eye out on this.

Article By Puja J. Amin of Troutman Firm

For more communications and media legal news, click here to visit the National Law Review.

© 2022 Troutman Firm

Following the Recent Regulatory Trends, NLRB General Counsel Seeks to Limit Employers’ Use of Artificial Intelligence in the Workplace

On October 31, 2022, the General Counsel of the National Labor Relations Board (“NLRB” or “Board”) released Memorandum GC 23-02 urging the Board to interpret existing Board law to adopt a new legal framework to find electronic monitoring and automated or algorithmic management practices illegal if such monitoring or management practices interfere with protected activities under Section 7 of the National Labor Relations Act (“Act”).  The Board’s General Counsel stated in the Memorandum that “[c]lose, constant surveillance and management through electronic means threaten employees’ basic ability to exercise their rights,” and urged the Board to find that an employer violates the Act where the employer’s electronic monitoring and management practices, when viewed as a whole, would tend to “interfere with or prevent a reasonable employee from engaging in activity protected by the Act.”  Given that position, it appears that the General Counsel believes that nearly all electronic monitoring and automated or algorithmic management practices violate the Act.

Under the General Counsel’s proposed framework, an employer can avoid a violation of the Act if it can demonstrate that its business needs require the electronic monitoring and management practices and the practices “outweigh” employees’ Section 7 rights.  Not only must the employer be able to make this showing, it must also demonstrate that it provided the employees advance notice of the technology used, the reason for its use, and how it uses the information obtained.  An employer is relieved of this obligation, according to the General Counsel, only if it can show “special circumstances” justifying “covert use” of the technology.

In GC 23-02, the General Counsel signaled to NLRB Regions that they should scrutinize a broad range of “automated management” and “algorithmic management” technologies, defined as “a diverse set of technological tools and techniques to remotely manage workforces, relying on data collection and surveillance of workers to enable automated or semi-automated decision-making.”  Technologies subject to this scrutiny include those used during working time, such as wearable devices, security cameras, and radio-frequency identification badges that record workers’ conversations and track the movements of employees, GPS tracking devices and cameras that keep track of the productivity and location of employees who are out on the road, and computer software that takes screenshots, webcam photos, or audio recordings.  Also subject to scrutiny are technologies employers may use to track employees while they are off duty, such as employer-issued phones and wearable devices, and applications installed on employees’ personal devices.  Finally, the General Counsel noted that an employer that uses such technologies to hire employees, such as online cognitive assessments and reviews of social media, “pry into job applicants’ private lives.”  Thus, these pre-hire practices may also violate of the Act.  Technologies such as resume readers and other automated selection tools used during hiring and promotion may also be subject to GC 23-02.

GC 23-02 follows the wave of recent federal guidance from the White House, the Equal Employment Opportunity Commission, and local laws that attempt to define, regulate, and monitor the use of artificial intelligence in decision-making capacities.  Like these regulations and guidance, GC 23-02 raises more questions than it answers.  For example, GC 23-02 does not identify the standards for determining whether business needs “outweigh” employees’ Section 7 rights, or what constitutes “special circumstances” that an employer must show to avoid scrutiny under the Act.

While GC 23-02 sets forth the General Counsel’s proposal and thus is not legally binding, it does signal that there will likely be disputes in the future over artificial intelligence in the employment context.

Article By Steven M. Swirsky, Adam S. Forman, Nathaniel M. Glasser, Neresa A. De Biasi, and Ridhi D. Madia of Epstein Becker & Green, P.C.

For more labor law legal news, click here to visit the National Law Review.

©2022 Epstein Becker & Green, P.C. All rights reserved.

Attorney Mindfulness When Addressing Emails and Texts: ABA Formal Opinion Provides Ethical Guidance to Lawyers on Electronic Communications

In their roles as advisors, advocates, counselors, negotiators, and client representatives, lawyers communicate extensively though electronic means, particularly email and increasingly text messages. However, the fact that use of these electronic communication tools is commonplace in legal practice doesn’t mean that attorneys shouldn’t exercise caution when crafting their communications. The American Bar Association (“ABA”) Standing Committee on Ethics and Professional Responsibility published a formal opinion this month that advises lawyers to refrain generally from including their clients on emails and texts sent to opposing counsel.

ABA Formal Opinion 503 focuses on ABA Model Rule 4.2, often referred to as the “no-contact” rule. Under this model rule, a lawyer who is representing a client may not communicate about the subject of the representation with a represented person absent the consent of that person’s lawyer unless the law or court order authorizes such as communication. Most states’ codes of professional legal ethics draw heavily upon the ABA Model Rules, so many states have similar “no-contact” rules for lawyers.

The new formal opinion states that lawyers would not be deemed to violate ABA Model Rule 4.2 if they send a “reply all” response to a group email or text sent by an opposing counsel, even if that communication includes the opposing counsel’s client. The opinion states that, “[a]bsent special circumstances, lawyers who copy their clients on emails or other forms of electronic communication to counsel representing another person in the matter impliedly consent to a ‘reply all’ response from the receiving counsel,” the opinion said. “Accordingly, the reply all communication would not violate Model Rule 4.2.”

As a practical matter, Formal Opinion 503 provides a number of options to lawyers who wish to avoid creating an implied presumption of consent to such “reply all” communications from opposing counsel to their clients. These options include:

  • forwarding the electronic communication separately to the client without including opposing counsel as an addressee,
  • informing receiving counsel expressly and in advance that including the client on the electronic communication does not constitute a consent to a “reply all” response, or
  • sending the communication through other means (such as a mailed hard copy letter) where different norms are in place regarding responding to all addressees.

The full text of ABA Formal Opinion 503 is available here.

Article By Electronic Discovery at K&L Gates

For more law office management legal news, click here to visit the National Law Review.

Copyright 2022 K & L Gates

Five Data Quality Nightmares That Haunt Marketers and How Avoid Them

In this spooky season of vampires, witches and scary clowns, we’d like to add one more to the mix – data quality nightmares – which can be more frightful than a marathon of Freddy Kreuger movies to some of us.

We need data about our clients and prospects in order to create strategic programs that can lead to new business and increased visibility, but maintaining that data on an ongoing basis can quickly turn into a nightmare without the right resources.

Having good quality data is important for success in so many areas of your organization, including:

  • Communicating effectively with core constituencies
  • Successfully planning and executing events
  • Segmenting your target markets, clients or customers
  • Providing superior customer service
  • Understanding the needs of clients or customers
  • Effectively developing new business
  • Improving delivery and reducing costs of postal mailings

The reality is that your data will never be perfect, but there are ways you can address and improve it. The longer you wait to improve your data management, the scarier it will become. Here are some of the most common data quality nightmares we see and how to avoid them:

Data Quality Nightmare 1: Duplicate data

Is your CRM a graveyard for thousands of duplicate company and individual contacts? Data comes from all directions, so it’s important to ensure that data isn’t being duplicated. Dupes make it difficult to coordinate efforts and activities. Duplicate data occurs when customer information appears more than once in the database, or multiple variations of the same individual appear.

Secondly, duplicate data can damage your brand image. It is unlikely that a contact who receives the same information twice will be happy about it. This is an easy way to frustrate customers and prospects and can make your business appear disorganized.

Data Quality Nightmare 2: Missing or incomplete data

Are your contact details ‘ghosting you’? Without good data you can’t target or segment, and your communications and invitations won’t reach the right audiences.

Similar to inaccurate data, incomplete data can also have a negative impact on your business performance.

One way that organizations can help control this data quality nightmare, is by making certain form fields a required entry. That way, data entries will be more consistent and complete.

Data Quality Nightmare 3: Incorrect or inconsistent data

Does incorrect or inconsistent data give you nightmares? Bad CRM data leads to missed opportunities for new customers, and it could create issues for your sales cycle. There is almost no point in engaging with contacts in your database if the information is incorrect.

There are multiple ways to encourage good data habits, depending on your system and method of contact entry. If your firm relies on manual data entry, implement a firmwide Data Standards Guide to inform users how data should be entered (e.g., does your firm spell out or abbreviate job titles?). It can also be helpful to use system validation rules wherever possible to require certain information in new records such as last name, city and email address to ensure your contacts are relevant.

Data Quality Nightmare 4: Too much data

Are you in the ‘zombie zone’ trying blindly to figure out what to do with too much data and/or disparate data from disconnected systems?

Having too much data can be overwhelming – and unnecessary. It’s important to set parameters on what information you truly need about your clients and prospects, and then maintain only that information going forward. This will streamline the process and make everyone’s jobs easier by avoiding data quality nightmares.

Data Quality Nightmare 5: Lack of data quality resources

Does your team run screaming from data quality projects leaving you with a data disaster?

To encourage ongoing system adoption and utilization, data quality and maintenance must be top priorities. Resources must be dedicated – including time, money and people. Processes and procedures need to be put in place to maintain ongoing quality. Most importantly, training and communication are essential to ensure that end users don’t create unnecessary duplicates or introduce more bad data into the system.

Data Quality Doesn’t Have to Be Scary

While it’s easy to become scared by nightmare data, it’s important to put it in perspective. Focus on discreet data and projects that yield real ROI such as:

  • Start with your most relevant records like current clients. Begin cleaning your top 100 to 500 along with associated key contacts.
  • Review frequently used lists to ensure your communications and invitations are reaching the right recipients.
  • Vet bounced emails after each campaign, or better yet, regularly run lists through an automated data process to identify bad emails before a campaign to ensure that information actually reaches your targets in a timely manner.
  • Tackle time-sensitive one-off projects. For instance, an upcoming event often provides a good opportunity to get users engaged in cleanup efforts, particularly if the event is important to them.

It’s also important to remember that because data degrades so rapidly, data cleaning can’t be a one-time initiative. Once your team begins regularly maintaining your data, the cleanup will get easier over time. And remember, because data cleaning never really ends, the good news is that this means you have forever to get better at it.

Article By Christina R. Fritsch JD of CLIENTSFirst Consulting

For more business of law legal news, click here to visit the National Law Review.

© Copyright 2022 CLIENTSFirst Consulting