It Takes The Supreme Court A While To Really Get Moving

Posted on by TSA Press

Cramming for the CCPA

Cramming for the CCPA

The California Consumer Privacy Act, the most significant privacy regulation ever enacted in the United States, takes effect in January 2020. Join us for a free webinar to learn more.

The California Consumer Privacy Act, the most significant privacy regulation ever enacted in the United States, takes effect in January 2020. Join us for a free webinar to learn more.

Who Stole My Face? The Risks Of Law Enforcement Use Of Facial Recognition Software

Posted on by TSA Press

(Image via Getty)

Last week, RIT philosophy professor and expert on the ethical and privacy implications of technology, Evan Selinger, spoke to a group of lawyers in Rochester, New York, about the dangers presented by facial recognition software. The presentation, “Who Stole My Face? The Privacy Implications of Facial Recognition Technology,” was hosted by the committee that I chair for the Monroe County Bar Association, the Technology and Law Practice Committee, and was the brainchild of committee member Aleksander Nikolic, a Rochester IP attorney.

During his talk, Selinger contended that facial recognition technology should be banned across the board until regulations are enacted that are designed to control when and how it is used, and by whom. As he explains in a recent New York Times Op-Ed that he coauthored, facial recognition technology is unique in its invasiveness and in its potential for causing harm:

Facial recognition is truly a one-of-a-kind technology — and we should treat it as such. Our faces are central to our identities, online and off, and they are difficult to hide. People look to our faces for insight into our innermost feelings and dispositions. Our faces are also easier to capture than biometricsClose X like fingerprints and DNA, which require physical contact or samples. And facial recognition technology is easy to use and accessible, ready to plug into police body cameras and other systems.

According to Selinger, the use of facial recognition technology by law enforcement is particularly problematic due to its invasiveness and increasing pervasiveness. In that same article, Selinger outlines the risks presented when law enforcement officers seek to use facial recognition tools as part of their investigatory, screening, and crime prevention arsenals:

The essential and unavoidable risks of deploying these tools are becoming apparent. A majority of Americans have functionally been put in a perpetual police lineup simply for getting a driver’s license: Their D.M.V. images are turned into faceprints for government tracking with few limits. Immigration and Customs Enforcement officials are using facial recognition technology to scan state driver’s license databases without citizens’ knowing. Detroit aspires to use facial recognition for round-the-clock monitoring. Americans are losing due-process protections, and even law-abiding citizens cannot confidently engage in free association, free movement and free speech without fear of being tracked.

Another particularly concerning issue with facial recognition technology is that its underlying programming often results in biased outcomes that can have life-altering effects for those being screened by it. For example, as explained in an ACLU blog post on the issue, a study conducted by the ACLU revealed bias in the programming behind Amazon’s facial surveillance technology, Rekognition.

In the study, the software was used to compare photos of members of Congress to mugshots of people who had been arrested for a crime. Rekognition incorrectly identified 28 matches between members of Congress and the mugshots. As explained in the blog post, some members of Congress were affected by these errors more often than others:

The false matches were disproportionately of people of color, including six members of the Congressional Black Caucus, among them civil rights legend Rep. John Lewis (D-Ga.). These results demonstrate why Congress should join the ACLU in calling for a moratorium on law enforcement use of face surveillance.

The same software has also been shown to have a gender bias and has incorrectly identified women as men.

Because of these issues, some lawmakers are fighting back and are introducing bills designed to combat the bias inherent in facial recognition software. For example, in October, U.S. Congressional Representative Brenda Lawrence announced her plan to introduce legislation that would mandate the study of the racial biases found in facial recognition systems. And, in July U.S. Congressional Representative Rashida Tlaib introduced the “No Biometric Barriers Act of 2019,” which proposed a ban on the use of facial recognition technology at housing units funded by the Department of Housing and Urban Development, largely due to bias concerns.

Similarly, four cities have already imposed bans on the use of facial recognition tools by law enforcement including San Francisco, Somerville, Berkeley, and Oakland. And a statewide ban is in the works in California.

In his article, Selinger contends that the legislation passed thus far is a step in the right direction, but more drastic measures are required in order to combat the threat posed by the use of facial surveillance software by law enforcement and other public entities:

We support a wide-ranging ban on this powerful technology. But even limited prohibitions on its use in police body cams, D.M.V. databases, public housing and schools would be an important start.

Of course, the likelihood that far-reaching bans will be imposed prior to facial surveillance becoming ubiquitous is minimal. Let’s face it, the genie’s already out of the bottle and the legislative process tends to move at a snail’s pace, while technology is advancing at rates never before seen.

Facial recognition technology is already so pervasive that it’s going to be incredibly difficult to unring that bell. The implications of our newfound reality are already quite apparent and many assert that facial recognition technology is being misused by public and private entities alike. For evidence of that trend, you need look no further than the $35 billion class-action lawsuit currently pending against Facebook based on its alleged misuse of facial recognition data.

Who knows what extremes we’ll go to camouflage ourselves in a world where facial surveillance is the norm? There are already lines of clothing and other devices being released that are designed to confuse facial surveillance technology. No doubt there’s more of that to come. In fact, the very thought gives the 1997 movie Face/Off  newfound relevance. No wonder there’s a reboot in the works.

The bottom line: The future is already here, folks, and we’re all hapless participants in this reckless social experiment. Welcome to our newfound reality.

Niki BlackNicole Black is a Rochester, New York attorney and the Legal Technology Evangelist at MyCase, web-based law practice management software. She’s been blogging since 2005, has written a weekly column for the Daily Record since 2007, is the author of Cloud Computing for Lawyers, co-authors Social Media for Lawyers: the Next Frontier, and co-authors Criminal Law in New York. She’s easily distracted by the potential of bright and shiny tech gadgets, along with good food and wine. You can follow her on Twitter @nikiblack and she can be reached at niki.black@mycase.com.

How Does A Lawyer Get Competent in Tech? I Asked Twitter and Got 100+ Answers | LawSites

Posted on by TSA Press

When I give presentations on lawyers’ ethical duty to be competent in technology, audience members often come up to me afterwards and ask something to the effect of, “Ok, I get it, but how do I become competent in technology?”

Preparing for another such talk this week, I thought I’d put the question to Twitter, asking others what their number one piece of advice would be for a lawyer wanting to become more competent in technology.

The more than 100 responses were so good that I decided to collect them here and share them with others who did not follow the thread. They range from “play World of Warcraft” to “learn the basics.”

So here goes.

Tightrope Walking The Digital Supply Chain (Part II)

Posted on by TSA Press

(Image via Getty)

Ed. note: This is the second article in a two-part series about a heightened need for vigilance by companies around the cybersecurity of their supply chains in light of recent activity around the False Claims Act (FCA).  Part one addressed the legal landscape of the FCA as related to cyber risk and government supply chains and part two will address proactive steps that companies can take to reduce their FCA threat profile. 

The False Claims Act or FCA (31 U.S.C. §§ 3729 – 3733) was enacted by Congress in 1863 in response to concerns about the sale of fraudulent goods to the Union Army.  Today, the FCA is implicated if a company’s products or services introduce potential cybersecurity risks for requisitioning government agencies and those risks are not properly addressed when raised.

This craggy terrain calls for increased vigilance by companies selling hardware and software to government entities. “Business leaders should think carefully about what it means to managing the security supply chain and to manage your security towards outcomes,” remarked Chris Johnson, Global Compliance Lead for Google Cloud at CyberTalks, presented by CyberScoop in Washington, D.C., on October 24, 2019.

While companies like Nisos (disclosure: I work here) help assess supply chain vulnerabilities by performing attack simulations, vulnerability assessments, and threat investigations, it is imperative that companies adopt internal best practices to stay out of the crosshairs of the FCA.  “Strong, proactive steps are the first lines of defense of your business from the whistleblower claims,” according to Chris Brewster, Administrative Counsel of the House of Representatives.

The Best Defense is a Strong Offense

The following are recommendations from National Institute of Standards and Technology and other industry experts on how to create a defensible perimeter around a corporate supply chain:

  • Get clear on government requirements: Before entering into a contract, government contractors should scrutinize and document cybersecurity requirements and assess the company’s ability to comply with those requirements, according to DLA Piper. Negotiate the terms of the contract carefully and ensure that language describing compliance activities, employee training, and data protection procedures accurately reflects company practices.
  • Command and control third-party software and components: Be prescriptive about security requirements associated with third-party wares in all contracts. Once a vendor is accepted in the formal supply chain, open up discussions about vulnerabilities and security gaps software when possible and unpack, inspect, and x-ray parts before definitively accepting them.
  • Make security inextricable: Establish a secure software development lifecycle process for all software.  Implement training for all engineers and employees in charge of supply chain cybersecurity and bake awareness and compliance into the overall employee experience.  According to the Compliance Resource Center, organizations should educate employees on state law requirements pertaining to civil or criminal FCA penalties, whistleblower rights, and internal requirements for preventing, detecting, and reporting fraud waste and abuse.  “By conducting employee training that emphasizes compliance and encouraging early internal reporting of potential issues before they ripen into FCA claims, companies can significantly reduce their threat profile,” advises Brewster.
  • Increase automation: When possible, automate manufacturing and testing regimes to reduce the risk of human error.
  • Document and track risk: Document activities and controls related to cybersecurity, such as operational assessments, analyses regarding whether the company possesses information that requires protection, and any correspondence with the government regarding exceptions, waivers, or applicability of cybersecurity requirements, according to DLA Piper.
  • Open the lines of communication: Establish a transparent culture where potential whistleblowers are taken seriously.  Ensure that managers and HR are prepared to receive and respond to insider concerns before insiders take their concerns to regulators or lawyers.
  • Demonstrate diligence in HR documentation: Executives and managers should be on guard for disgruntled employees who may have incentives to commit fraud in order to make false whistleblower accusations after termination.  While individuals who commit fraud as a whistleblower are barred from recovery for their own fraud, the cost and feat of proving the fraud are often high hurdles for a business.  Mitigate against this potential threat by documenting employee performance, negative reviews, and reasons for termination.  Establishing a protective backdrop in this manner can help refute allegations that the employee was terminated as retaliation for trying to prevent a false claim from being reported to the government.
  • Establish a ”security handshake” for software and hardware: Secure booting processes should look for authentication codes and the system should not boot if codes are not recognized. Programs should capture “as built” component identity data for each assembly and automatically link the component identity data to sourcing information.
  • Procure legacy support for products and platforms: Assure a continuous supply of authorized IP and parts to maintain continuity over systems. When legacy systems no longer have adequate support options, consider the vulnerabilities posed by the inability to patch or remediate.
  • Limit access by third-party service vendors: Limit software access to as few vendors as possible. Limit hardware vendors’ physical access to mechanical systems and restrict access to control systems. Implement strong controls around physical access including maintenance of visitor logs and on-site supervision of vendors.

Recent FCA cases mark the increased vigilance required of government contractors, especially around cybersecurity requirements in supply chains.  Implementing front-end measures like strong compliance programs, proper vetting of contract requirements, documenting HR issues, and limiting vendor access can substantially lower your company’s risk profile.  Equally important is the need to adopt a culture of compliance which attends to insider concerns before they evolve into FCA claims and send companies down the slippery slope of litigation.

Jennifer DeTrani is General Counsel and EVP of Nisos, a technology-enabled cybersecurity firm.  She co-founded a secure messaging platform, Wickr, where she served as General Counsel for five years.  You can connect with Jennifer on Wickr (dtrain), LinkedIn or by email at dtrain@nisos.com.

California AG’s Legal Battle With Ashford University Rages On

Posted on by TSA Press

(Photo via iStock)

San Diego Superior Court Judge Eddie C. Sturgeon jokingly boasted at one point during a series of hearings last Friday that even though some Los Angeles courts were setting trials as far out as 2021, he was only scheduling for 2020.

Then the attorneys in the People of the State of California v. Ashford University case came forward for their case management conference.

A lawyer for Ashford said that since there were roughly 40 more depositions to be completed in the case filed in late 2017, a trial date for April 2021 should be set.

A deputy attorney general suggested even that timeline may be ambitious given some of the litigation issues needing to be ironed out.

Sturgeon set a trial date for late April 2021.

The complaint filed by California Attorney General Xavier Becerra’s office alleged for-profit Ashford and its then San Diego-based parent company, Bridgepoint Education, made false promises and provided students with inaccurate information to get them to enroll.

The AG also accused the defendants of illegal debt collection practices against students who were having difficulty paying their bills.

“The People seek an injunction preventing further misconduct, restitution for victims, civil penalties, the Attorney General’s costs of suit, and other relief that the Court deems just, proper and equitable,” the AG’s office wrote in a recent case management statement.

Ashford and its renamed parent company, Zovio Inc., called the AG’s complaint “politically-motivated.”

“The allegations of any pattern or practice of condoned misrepresentations, fraudulent conduct, and misleading advertising are unfounded and false,” the defendants wrote in the recent case management statement. “At all times relevant to this action, Defendants acted in good faith, having implemented a corporate compliance program and other safeguards — which were carefully designed and implemented based on the model for compliance programs established under federal regulations — to prevent, detect, and remedy the type of conduct being challenged by the AG in this case.”

The defendants also highlighted that prior to the AG filing its suit, they entered into settlement agreements with the state of Iowa and the U.S. Consumer Financial Protection Bureau “that addressed virtually the identical issues raised in the complaint.”

In 2014, Ashford and Bridgepoint Education agreed to pay Iowa $7.25 million to settle allegations that they violated the state’s Consumer Fraud Act.

“The company also must comply with minimum standards in its future representations and disclosures to prospective and current students nationwide,” the Iowa Attorney General’s Office said.

Two years later, the company agreed to forgive loans and issue refunds totaling $23.5 million to resolve the Consumer Financial Protection Bureau’s findings that Bridgepoint deceived students into taking out loans that cost more than advertised. Bridgepoint also agreed to pay the bureau an $8 million civil penalty.

The bureau’s release about the consent order noted that the California Attorney General’s Office assisted with the investigation.

The AG acknowledged in the recent case management statement in the San Diego case that it did assist with CFPB with its investigation, including participating in two settlement meetings.

“Defendants ultimately chose to approach the CFPB alone with a settlement proposal which CFPB accepted,” the AG’s office wrote. “The People were not a party to and had no standing to object to Defendants’ settlements with the Iowa Attorney General or the CFPB. Furthermore, this case covers different issues than Defendants’ settlements with the Iowa Attorney General’s Office and CFPB.”

Since the filing of the California AG’s case, Bridgepoint not only changed its name to Zovio, but also moved its headquarters to Arizona earlier this year. In addition, Ashford is working to convert from a for-profit to a nonprofit.

In the meantime, the school and its parent company will continue contending with the California AG’s suit.

Lyle Moran is a freelance writer in San Diego who handles both journalism and content writing projects. He previously reported for the Los Angeles Daily Journal, San Diego Daily Transcript, Associated Press, and Lowell Sun. He can be reached at lmoransun@gmail.com and found on Twitter @lylemoran.

Jay Powell Takes Literal “Same Sh!t, Different Day” Approach To Today’s Congressional Testimony

Posted on by TSA Press

Big Pow is back on The Hill for a second day of questions, and he is making it clear he has a whole lot of nothing new to say.

How To Get Your Small Firm Financial House In Order

Posted on by TSA Press

(Image via Getty)

It’s probably true that some people go to law school because — as rumor has it anyway — no math is required. What is indisputable is that nobody goes to law school hoping to spend their time on accounting and bookkeeping matters. Too boring. But as anyone who has ever tried to run a small legal practice (or any business for that matter) knows, the boring stuff matters.

In today’s fiercely competitive legal services market, it is imperative that smaller law firms get their bookkeeping, billing, and financial houses in order.  Proper accounting is not mere beancounting — it’s crucial for tracking the success of your practice.

Join our free webinar on December 13th at 1 p.m. ET and learn how to leverage cutting-edge technology bring your small or medium-sized practice the “Biglaw” advantage of back-office efficiencies and vital financial insights like the profitability of particular client relationships, practice areas, and matter types.

Learn how to monitor costs and revenues to maximize your profit margins.  Our webinar will be moderated by legal technology maven Bob Ambrogi who will be joined by T.C Whittaker, CPA MBA, of PwC.

Click here to register.

Brett Kavanaugh Doing A FedSoc Event Hosted By Facebook Is Kinda Why We Live In Hell

Posted on by TSA Press

(Photo by Win McNamee /Getty Images)

The normalization of alleged attempted rapist Brett Kavanaugh continues in all the ways these bad people get reintegrated into polite society. Kavanaugh enjoys the support of roughly half of the country who either believe that a childhood calendar exonerates the man of serious charges, or just straight up don’t care about how he treats women. His colleagues, who happen to be justices on the United States Supreme Court, say positive things about him in public as they try to forge a working relationship with a man who can, on a whim, take away the rights of vulnerable people. The press that covers him, with a few notable and heroic exceptions, has largely been made to understand that fighting Kavanaugh makes it harder for them to do their jobs, so accepting him is just much easier.

Kavanaugh should be toxic. In addition to the credible attempted rape allegations, there’s the issue of the 83 ethics complaints filed against him and dismissed because nobody can hold a Supreme Court justice accountable, except through impeachment. There’s the record of lying under oath at confirmation hearings; his closeness with disgraced judge Alex Kozinski; and, oh yeah, he sneeringly promised to use his position as Supreme Court justice to exact revenge against his enemies.

Instead of treating him like the drunk uncle who shouldn’t be left alone with the children at Thanksgiving, the Federalist Society is honoring him at an event tonight at their annual National Lawyer’s Convention. This is classic FedSoc: As long as you are committed to taking away the rights of women and minorities, anything you do in your private life that is hurtful to women or minorities is also okay.

In a reasonable world, we would view Supreme Court justices speaking to partisan organizations as incredibly problematic. The Federalist Society is a partisan, agenda-driven organization which has actively promoted legal arguments designed to upend precedent and crush individual rights. Even if one agrees with Federalist Society teachings, a sitting Supreme Court justice should not be giving them aid and succor by appearing at their national events.

Of course, we’re talking about Brett Kavanaugh here. This is a man who does ex-parte photo ops with people who have current business in front of the Supreme Court. Expecting Kavanaugh to not appear at a FedSoc event is like expecting a dog to not root around in the trash when it spends half of the day licking its butt anyway.

The wrinkle with this appearance is that tonight’s FedSoc event is in part sponsored by Facebook. Sorry, “FACEBOOK.”

Facebook has a long history of supporting Kavanaugh because one of its bigwigs — Joel Kaplan, vice president of global affairs — is reportedly close friends with Kavanaugh. That’s really all it takes. Credible allegations of sexual misconduct, documented history of being untruthful under oath, partisan hackery, and revenge threats against his enemies aside, Kavanaugh has a “buddy” inside Facebook, so of course the company will support Kavanaugh and an organization that thinks the original intent of slavers is the most scared foundation of Constitutional law.

I’m sure it doesn’t hurt that, should Facebook fail in its efforts to hand another election to Donald Trump, the company will be facing a legal reckoning under a Democratic administration. Facebook will likely challenge any new regulations in court. And nearly any court challenge could wind up on the desk of Brett Kavanaugh, speaking for a conservative super-majority.

Demand Justice is trying to launch a protest campaign against Facebook’s support of Kavanaugh, led by employees of Facebook.

“Facebook should not be sponsoring the rehabbing of Brett Kavanaugh’s reputation when Dr. Blasey Ford remains unable to resume a normal life after bravely coming forward last year,” said Katie O’Connor, senior counsel for Demand Justice. “You can claim to respect survivors of sexual assault or you can pay for a celebration of Brett Kavanaugh, but you can’t do both.”

People are trying.

The Federalist Society is the nexus point of a little bubble where the legal vanguard of white supremacist logic gets to mingle and swap notes with fellow culture warriors. These are the people who bring you ethno-nationalist Steven Menashi (who is being confirmed today, by the way). These are the people who bring you the zealotry of Amy Coney Barrett. These are the people who bring you torture defenders like James Ho.

Brett Kavanaugh is the perfect symbol for the entire organization: A white man of unexamined privilege who gets dangerously angry when anybody tries to hold him to account for his past actions. He is the embodiment of everything that is wrong. Of course they are honoring him. His mere existence as a Supreme Court justice is a triumph for every white man who ever thought he could drown out the cries of his victims merely by turning up the music a little louder.

It should be a great night for these people. They’ve won.

But we don’t have to treat their victory, their supremacy, and their smugness as “normal.” It is not normal. I will never treat them as normal. I will never stop fighting these people, even to the point where I’m regarded as the weird one.

Elie Mystal is the Executive Editor of Above the Law and a contributor at The Nation. He can be reached @ElieNYC on Twitter, or at elie@abovethelaw.com. He will resist.