TJX Settles with State Attorneys General for $9.75 Million
The TJX breach saga came a little closer to an end (excluding of course the still-pending case being pursued by a couple of issuing banks) with the announcement of a settlement with 41 State attorneys general that brought actions under their State's respective consumer fraud and deceptive practices laws (a copy of the settlement document can be found: HERE). This is a summary of the TJX settlement.
Monetary Settlement Breakdown
The total monetary settlement amounted to $9.75 million, which is broken down as follows:
- $5.5 million to the Attorneys General for State consumer protection activities related to data security or otherwise, including consumer education and outreach, prevention or monitoring programs, consumer protection enforcement, litigation, local consumer aid funds, consumer protection enforcement funds and public protection funds
- $2.5 million to develop a "data security fund" to be used by the States to research the benefits of data security technology and develop best practices, protocols, policies or model legislation or regulations concerning data security or data security technology, develop and implement programs, education and outreach for consumers with respect to data security, and for other efforts to examine data security matters and to protect consumer privacy
- $1.75 million in fees and costs associated with the States' investigation of the TJX breach
This brings the total reportedly paid out for settling various actions against TJX to approximately $75 million (this does not include forensic expense, attorney fees, etc.).
Information Security Program
In addition to monetary payments, the settlement also requires TJX to "implement and maintain a comprehensive Information Security Program reasonably designed to protect the security, confidentiality and integrity of Personal Information." The general description of the mandated program essentially matches the information security program required pursuant to TJX's consent order with the FTC.
However, this settlement goes beyond the general requirements of the FTC's consent order and mandates specific information security controls and actions, including:
- Replacement of all WEP based wireless systems with WPA wireless systems (or equivalent)
- No storage of sensitive authentication information related to payment cards (e.g. magnetic stripe track data, PIN numbers/PIN Blocks, and CVC2/CVV2/CID numbers)
- Segmentation of TJX networks storing, processing or transmitting Personal Information (including Cardholder Information) from the rest of TJX's network
- "Security password management" for the portions of the TJX computer system that store, process or transmit Personal Information
- Implementation of a security patching protocol for the portions of the TJX computer system that store, process or transmit Personal Information
- Use of Virtual Private Networks/encryption for transmitting Personal Information
- Anti-virus software
- Intrusion detection systems
- Access control measures
The order indicates that the previously mentioned requirements alone do not necessarily amount to reasonable actions to protect Cardholder or Personal Information. The settlement sets a 120 day deadline for TJX to implement the required information security program. TJX must also have a third party security assessor to create a report certifying compliance. The first report of the third party assessor is due 180 days after the settlement agreement date, and subsequent assessments must occur on a biennial basis (although TJX does not need to provide them to that AGs unless requested). TJX's obligations with respect to the information security program (and other requirements of the settlement) are to last for 20 years.
Breach Notification
The settlement requires TJX to provide notice to the relevant attorney general 10 days after it has provided notice to its customers of any breach of personal information. The settlement sets forth several categories of information that must be provided to the attorneys general.
TJX Payment Card Security Advocate
This is where the settlement agreement gets more interesting. As a condition of the settlement, TJX essentially has to advocate for improvements in the security of the payment card system. In particular, TJX must contact Visa and Mastercard and its acquiring bank and volunteer to participate in pilot programs for testing new security-related payment card technology (such as chip-and-PIN technology). TJX also must take steps encourage the payment card industry to achieve "end-to-end" encryption of cardholder data (all the way through the bank authorization process). TJX must take such steps within 180 days and must submit a report to the Attorneys General indicating TJX's progress.
Hannaford's Motion to Dismiss: Victory for Merchants (Part 2)
As detailed in ISC's first post on the Hannaford case, I detailed the District Court's rationale for either dismissing or generally recognizing various legal theories around payment card number security breaches. The net result of the Court's analysis was the existence of three possible theories of recovery for the consumer plaintiffs:
- Breach of implied contract
- Negligence
- Violation of Maine's Unfair Trade Practices Act ("UTPA")
While the partial recognition of these theories of liability might be viewed as a positive development for plaintiffs, based on the Court's analysis of the "cognizable harm" (e.g. damages) elements of each theory, this decision ends up being bad for plaintiffs (or better stated plaintiff law firms desiring to pursue class actions in the wake of a payment card security breach). This post explains the Court's rationale and indicates aspects that may present difficulties for Hannaford on appeal.
"Cognizable Harm" (a.k.a. "damages") While the Court did recognize three causes of action (e.g. implied contract, negligence and the UPTA claim), to recover under each claim the plaintiff must establish that it suffered an injury, either damages or injunctive relief. The plaintiffs had alleged various damage components, including:
(i) customers' "debit cards and credit cards were exposed and subjected to unauthorized charges;"
(ii) their "bank accounts were overdrawn and credit limits exceeded;"
iii) they "were deprived of the use of their cards and access to their funds;"
(iv) they "lost accumulated miles and points toward bonus awards and were unable to earn points during the interval their cards were inactivated;"
(v) those customers "who requested their cards be cancelled were required to pay fees to issuing banks for replacement cards;"
(vi) those customers "who had registered their cards with online sellers were required to cancel and change their registered numbers;"
(vii) their "preauthorized charge relationships were disrupted;"
(viii) they "expend[ed] time, energy and expense to address and resolve these financial disruptions and mitigate the consequences;"
(ix) they "suffered emotional distress;"
(x) their "credit and debit card information is at an increased risk of theft and unauthorized use;" and (xi) some customers "purchased identity theft insurance and credit monitoring services to protect themselves against possible consequences." The Court ultimately rejected each of these damages components, except for a partial recognition of (i).
Court's Analysis
The Court's analysis was very interesting. It first started off by grouping the plaintiffs into various categories. The first category is those plaintiffs that did not have a fraudulent charge actually posted to their account, and only allegedly asuffered emotional distress that their accounts might be in peril. These plaintiffs could not recover under the Maine's Unfair Trade Practices Act because only loss of money or property is recoverable under that Act. In addition, under Maine law emotional distress is not recoverable under a breach of contract claim except in a few limited exceptions. Finally, while emotional distress is recoverable generally under Maine law, it is not recoverable with respect to negligent misrepresentation claims. Maine courts have held that the damages associated with negligent misrepresentation claims are essentially economic in nature and serve to protect economic interests, rather than emotional distress. The Court held that the same applied in this case. Moreover, in a rather conclusory fashion the court held that any preventative expense and time the plaintiffs say they spent "to resolve their emotional distress" are also not recoverable. There may be some problems with the Court's analysis on this count. First off, while the Court recognized that emotional distress was not recoverable for "negligent misrepresentation," it did not address the plaintiff's general "negligence" claim. In fact, the Court indicated that in general emotional distress damages are recoverable under Maine law in most tort actions. Since plaintiffs' negligence claim went beyond failure to notify (and also alleged for example negligent failure to safeguard the plaintiffs' credit card data). Secondly, rather than addressing the alleged preventative measures of each plaintiff (e.g. credit monitoring and identity theft insurance) as individual damage components, the Court characterized those items as "expenses and time that plaintiffs say they spent to resolve their emotional distress by protecting their accounts." By wrapping these items in with emotional distress, the Court was able to dismiss them as unrecoverable emotional distress damages. The mistake may be that these damage components stand on their own, and the Court should have considered them individually (other courts have indicated that such expenses are incurred in anticipation of future harm, and not cognizable harm. It is not clear why the Court did not engage in a similar analysis). The second category, made up of only one consumer, are those consumers with fraudulent charges that have not been reversed or reimbursed. Hannaford argued that this should not be recognized as a cognizable injury because under typical payment card agreements issuing banks agree to remove such charges. The Court rejected this argument indicating that a consumer's potential claim for recovery against issuing banks do not excuse Hannaford's negligence. In addition, such fraudulent charges also equate to a loss of money or property under the UTPA. The last plaintiff category is made of consumers with fraudulent charges that were reversed and are no longer outstanding. The Court indicated that these plaintiffs were complaining about various consequential expenses (see the following alleged damage components identified above: iii, iv., v., vi., vii., xi.). With respect to this category of plaintiff the court held that they were not entitled to any recovery. Under both contract and tort, the court reasoned, these damage elements were not "reasonably forseeable" under Maine law, and were therefore speculative and unrecoverable. This type of rationale is more or less in line with other cases refusing to recognize these damages as anything more than expenses incurred in anticipation of future harm. The court also commented on its rationale for some of the specific damage components. The Court described plaintiffs' time and effort to deal with fraudulent charges and to talk to bank representatives as "ordinary frustrations and inconveniences that everyone confronts in daily life." The court rejected identity theft insurance premiums as a cost component because there was no risk of identity theft from cardholder data that did not include personally identifying information. Fees to open new accounts were held to be unnecessary prophylactic measures when the banks indicated that new accounts were not required. Finally the court analyzed the plaintiffs' plea for injunctive relief. The plaintiffs had asked for Hannaford to identify for each plaintiff what private and confidential financial and personal information had been exposed to theft and to provide credit monitoring for each plaintiff. The court rejected this injunctive relief because all of the individuals had already canceled their cards and therefore had no need for an injunction.
Conclusion
At best, the Court's partial recognition of various causes of action represents a pyrrhic victory/defeat for the plaintiffs' bar. The Court managed to widdle down the potential class size to a small number: those individuals that actually remain responsible for the credit card fraud done using their card number. Considering that in most cases the issuing banks will waive such fraud and not hold the cardholder responsible, it is doubtful that many consumers will fall into this category. What this means practically speaking is that the plaintiffs' bar may have less financial incentive to pursue these cases. A fairly solid foundation of cases has arisen that dismissed consumer class actions based on the damages issue early in the litigation. Surprisingly there has not been a meaningful break through yet. While this case is likely to get appealed, each time another court agrees with the conventional wisdom it gets more difficult for that breakthrough to happen. Unless new laws are passed, consumers may not have a route to recovery after a payment card breach. In all, I am sure this is not the end of the story for the Hannaford case. ISC will stay on top of it.
The TJX Case: It Lives! With a New Theory of Liability: "Unfairness"
However, two financial institutions (Amerifirst Bank and SELCO Community Credit Union - hereinafter "Issuing Banks" or plaintiffs) have pressed forward with an appeal of various dismissals and class certification motions to the U.S Court of Appeals for the First Circuit (the "Appellate Court"). The 1st Circuit's opinion sheds some more (high level) light on the liability risk of payment card data breach security cases. Ultimately, the Appellate Court allowed three theories of liability to proceed, including a previously dismissed theory alleging that TJX's inadequate security amounted to an unfair business practices under Massachusetts's unfair and deceptive business practices law.
The main issue on appeal was the ruling on a motion to dismiss by the U.S District Court for the District of Massachusetts (the "District Court"). TJX and Fifth Third Bank (TJX's merchant bank; collectively referred to as "defendants") had asked the District Court to dismiss all of the counts alleged in the Issuing Bank's complaint, including: (1) negligence; (2) breach of contract; (3) negligent misrepresentation; and (4) unfair or deceptive business practices under chapter 93A (Massachusetts's consumer fraud statute). The District Court dismissed the negligence and breach of contract claim, but allowed the negligent misrepresentation claim and the 93A claim (which was based on negligent misrepresentation) to proceed.
Negligent Misrepresentation
The Appellate Court ultimately refused to dismiss the plaintiff's negligent misrepresentation claim. However, the Court took a different path than the District Court. First, the court noted that the plaintiffs were not alleging any actual misrepresentation, but rather the plaintiff's "negligent misrepresentation" was based purely on the defendants' conduct in performing credit card transactions (in fact, the Appellate Court also referenced the defendants' conduct in the form of entering contracts requiring certain credit card security measures). While conduct can be part of a misrepresentation, the link between the conduct and the implication must be "tight." This link may be established by a combination of words and conduct concerning the alleged misrepresentation.
The Court then pointed to another Massachusetts's State credit card breach lawsuit (Cumis Ins. Soc. Inc. v. BJ Wholesale Club, Inc. 23 Mass. L. Rep. 550 [Mass Super. 2005]) that granted a defendant a motion for summary judgment on the issue of negligent misrepresentation. In that case, the motion was granted because the implied misrepresentation was based purely on conduct.
Based on this the Appellate Court refused to dismiss the negligent misrepresentation count on a motion to dismiss. In its view, the claim was properly pleaded in the complaint, and the proper method for dismissal of the case would be a motion for summary judgment (assuming the plaintiffs could not provide evidence to support their allegations). In its parting words, the Appellate Court ultimately indicated that the claim was "on life support." (e.g. likely to be dismissed on motion for summary judgment).
The Appellate Court also considered the District Court's denial of class certification with respect to the negligent misrepresentation claim, and ultimately upheld the District Court's denial. As such, even if the plaintiffs can establish negligent misrepresentation it appears they will have to do so for each individual plaintiff (rather than a class of plaintiffs).
Chapter 93A "Unfair" or "Deceptive" Trade Practices
The Appellate Court's ruling on the Issuing Banks' 93A claim was actually a bit surprising. The non-surprising aspect was the court's decision to uphold the plaintiff's 93A claim based on negligent misrepresentation. Since the base negligent misrepresentation claim was allowed to stand, the 93A claim based on the misrepresentation also stood, albeit with the same defects according to the Court.
The surprise was the Appellate Court's reversal of the dismissal of the plaintiff's other 93A claim. 93A provides a claim for "unfair" or "deceptive" trade practices as between businesses, and "unfairness" can be established by reference to other appropriate sources of law The plaintiffs had alleged that the defendant's lack of security measures, based on various consent decrees issued by the FTC, amount to a violation of the Federal Trade Commission Act, and therefore an "unfair" practice under 93A. The District Court disagreed and held that consent decrees are not appropriate sources of law for purposes of 93A.
In reversing the dismissal, the Appellate Court recognized that the plaintiffs allegations went beyond consent decrees and relied on an actual FTC complaint against TJX for the very breach at issue, as well as two other security breach complaints alleging that the lack of appropriate security measures equated to an unfair act or practice. The court noted that use of FTC precedent was directly referenced in 93A itself, and that at least one other Massachusetts court had allowed FTC complaints to serve as the basis of 93A actions. The court also noted that "adjudicated" FTC cases were even more potent (although did not clarify whether a "consent decree" amount to an adjudicated FTC case).
Moreover, the Appellate Court rejected TJX's argument that it did not have a close enough business relationship to the Issuing Banks. The Court also refused to limit a 93A actions to "egregious conduct" or "deliberate wrongdoing" at this stage. Rather, this issue was one that would have to be resolved after discovery in the District Court.
Negligence
The District Court dismissed the plaintiffs' negligence claim based on the "economic loss doctrine", which holds that "purely economic losses are unrecoverable in tort and strict liability actions in the absence of personal injury or property damage." On this claim the plaintiffs argued that they had suffered property damage because they had a property interest in the payment card information which the breach rendered worthless. The Appellate Court disagreed. It recognized that electronic data can have value and that value can be lost, but the loss must be as a result of the physical destruction of property. That was not the case for this security breach, and the District Court's dismissal was upheld.
Breach of Contract - Third Party Beneficiary Theory
The Appellate Court upheld the District Court's dismissal of the plaintiff's breach of contract claim. Under this theory, the Issuing Banks argued that they were the intended beneficiary of the contract between Fifth Third and TJX. That contract, however, contained the following express provision disclaiming third party beneficiaries:
This Agreement is for the benefit of, and may be enforced only by, Bank [Fifth Third] and Merchant [TJX] . . . and is not for the benefit of, and may not be enforced by any third party.
The plaintiffs argued that this provision was superseded by the Visa and Mastercard Operating Regulations. The court noted that those regulations do indicate that they prevail in any conflict with the provisions of a merchant account, but in this case the court noted, those provisions did not conflict with the third party beneficiary disclaimer in the TJX merchant agreement. The Appellate Court construed the following language in the Mastercard agreement as disclaiming third party beneficiary rights: [Mastercard] "shall have the sole right to interpret and enforce" [its operating regulations]. The Visa Operating Regulations were more explicit, indicating that those regulations "do not constitute a third-party beneficiary contract as to any entity or person . . . or confer any rights, privileges, or claims of any kind as to any third parties." Note that it does not appear that this type of disclaimer existed in early versions of the Visa Operating Regulations (see the use of third party beneficiary theory in the B.J. Wholesaler's case)
Class Certification
One of the biggest risks for defendants, even where weak theories of liability exist that are likely to yield small recoveries, is the prospect of certification of large plaintiff classes. The District Court held that class certification was not appropriate for the surviving negligent misrepresentation claim and 93A claim (based on negligent misrepresentation). The District Court reasoned that class certification was inappropriate because negligent misrepresentation requires proof that each individual plaintiff relied on the misrepresentation.
The Appellate Court, however, questioned whether the newly revived 93A "unfairness" cause of action would require an individual finding with respect to each plaintiff. The Appellate Court noted that the unfairness theory appears to consider what the defendants did (or failed to do) rather than the Issuing Bank's reliance on any misrepresentation. Ultimately, the Appellate Court did not issue an opinion on the certification of the 93A unfairness claim, and instead remanded the question back to the District Court.
Conclusion
For the most part the Appellate Court's decision represents a victory for TJX, but does open the door to some uncertainty. While the negligent misrepresentation claims (common law and the 93A claim) is viable, class certification has been denied. The plaintiffs have indicated that they will attempt to better define the classes to remedy this defect, but at this point it appears they would have a very difficult road.
The "unfairness" theory under 93A, however, presents a wild card. The "unfairness" doctrine has been used by the FTC to allege that a company's security itself was inherently unreasonable and therefore "unfair." Those FTC cases resulted in consent decrees and therefore the unfairness theory has never been truly tested (one commentator believes it was improperly employed by the FTC). Yet it provides a potential hook, especially in this case where TJX was found to have been in non-compliance with 9 of the 12 PCI requirements. Even so, the question remains whether the Issuing Banks will be able to establish damages under 93A. Notably, considering that most States have a similar deceptive practices laws on the books (although not all of them with private causes of action), this "unfairness" theory could have wider application in the security breach context.
Legally Mandated Encryption.
Two New State Laws Mandate Encryption of Personal Information
Over the past decade a multitude of information security and privacy laws have been passed mandating some level of security over sensitive information. In most instances legislators and regulators have opted for "technology-neutral" laws obligating "appropriate," (e.g. "GLB") "reasonable" (e.g. Cal AB 1950) or "adequate" (e.g. "SOX") information security. However, starting with California's SB1386, many States began bringing encryption into their legal regimes by creating an encryption "safe harbor" for security breach notice laws. Nevada and Massachusetts have now gone further and have passed laws that legally mandate some form of encryption with respect to personal information. This article explores the encryption requirements of the Nevada and Massachusetts laws, and analyzes the factors organizations should consider in complying with such laws.
Nevada's Encryption Law
Nevada's encryption law is brief in its wording, but potentially expansive in its application. The statute provides:
A business in this State shall not transfer any personal information of a customer through an electronic transmission other than a facsimile to a person outside of the secure system of the business unless the business uses encryption to ensure the security of electronic transmission[1].
Compliance with this law is required starting on October 8, 2008.
Massachusetts's Encryption Law
Unlike Nevada's law, recently passed Massachusetts's regulations call for the adoption of a comprehensive information security program.[2] However, in addition to general requirements around information security, the regulations set some minimum controls organizations must implement, including encryption:
(3) To the extent technically feasible, encryption of all transmitted records and files containing personal information that will travel across public networks, and encryption of all data to be transmitted wirelessly; [and]
* * *
(5) Encryption of all personal information stored on laptops or other portable devices[3].
Organizations subject to this law must comply by January 1, 2009.
Analysis
Compliance with mandated encryption laws like those in Nevada and Massachusetts will likely be very challenging from a legal, technical and business standpoint. This section explores the legal factors organizations must consider in attempting to comply with these encryption laws.
1. Geographic Scope
The Nevada and Massachusetts laws take different approaches in defining the geographic scope of their encryption laws. In general, the focus of the Nevada mandatory encryption law is where an organization is doing business, while the applicability of the Massachusetts law is based on the residency associated with personal information.
In Nevada the law applies to "business[es] in this State." The Nevada Supreme Court considers the following factors to determine whether a company is "doing business" in the State: (1) the nature of the company's business functions in the forum state, and (2) the quantity of business conducted in the forum state. Clearly companies with an actual presence in Nevada may be subject to the law. In addition, although applicable in a slightly different context, companies operating a commercial or interactive website may be considered to be "doing business" in Nevada.[4] Significantly, the term "customer" is not defined and the law does not appear to be limited to personal information of Nevada residents.
In Massachusetts, the applicability of the encryption mandate centers around the residency of the individuals whose personal information an organization possesses. The physical presence or extent of business activities within Massachusetts does not matter. Rather, mandated encryption is required if a company "owns, licenses, stores or maintains personal information about a resident of the [Massachusetts] and electronically stores or transmits such information."
2. What Data Must Be Encrypted?
The Nevada and Massachusetts's laws both define "personal information" in a similar manner. Under both laws is that a combination of information must be present to be considered "personal information." In particular, both laws require an individual's first name or first initial and last name, in combination with sensitive data elements such as social security numbers, driver's license numbers or financial account numbers[5].
However, Massachusetts's law is broader in scope than Nevada's because it applies to any resident of Massachusetts (which would include employees, for example) while Nevada only applies to "customers" (undefined term under the law) of the company. In addition, the Massachusetts laws is broader concerning encryption over wireless networks - it mandates that all data (not just personal information) be encrypted if it is to be transmitted wirelessly.
3. When and Where Must Personal Information Be Encrypted?
The Nevada and Massachusetts's laws differ on when and where personal information must be encrypted. In general, Nevada's law requires encryption of personal information while in transmission, while Massachusetts mandates encryption during transmission and in storage on laptops and portable devices.
a. Nevada
Under Nevada's law, transfers of personal information through an electronic transmission outside of the secure system of the business are prohibited unless encrypted to ensure the security of electronic transmission. As such, the law does not appear to require encryption of "hard" documents (e.g. paper). Nor does it appear to require encryption of personal information while just stored on a company's systems, laptops or other portable storage devices. While more research would be required, it also appears that no encryption would be necessary for the physical transfer of personal information stored on storage media at rest (e.g. back up tapes sent via courier to an offsite warehouse); such a transfer would not appear to constitute an "electronic transmission." However, the scope of "electronic transmission" is still unclear. Some commentators, for example, have questioned whether phone calls discussing personal information (especially VOIP-based calls) would need to be encrypted.
Nevada's law excludes electronic transmission in the form facsimiles. The scope of this exclusion depends on how "facsimile" is defined. Obviously then the law would not apply to "traditional" fax transmissions. However, it is not certain whether the exclusion includes fax services provided over email. Moreover, if facsimile is defined in its broader sense as "an exact copy" encryption may not be required for the emailing of a facsimile with personal information created using a scanner (e.g. creating ..jpg file via scanner) or a copy of an electronic file (e.g. a .pdf file) containing personal information. More research, however, is necessary to clarify the meaning of facsimile in this context.
Nevada's law also does not apply to electronic transmissions "outside of the secure system of the business." It appears that the intent in this case was to exclude mandatory encryption for internal electronic transmissions within an organization. Again, however, some ambiguities exist. If a business's internal communications require personal information to be transmitted over any public network (and therefore outside of the "secure system of the business") then those internal communications will likely need to be encrypted (at least while traveling over any public networks). In addition, it is not entirely clear whether internal wireless networks within an organization fall outside of the secure system of the business, or how much or what security constitutes a secure system. In addition, the need to encrypt personal information may be contingent on how the business is defined and how its systems are secured. For example, transfer of personal information between a parent and subsidiary may need to be encrypted if transferred outside of the parent's "secured system" to the subsidiary "secure system" to the extent they are distinct.
Similarly, employees working from remote laptops or home computers that access personal information may trigger encryption requirements. Companies that rely on outsourcers and third party service providers will also likely have to encrypt personal information as well. However, if proper security is established during the transmission (such as a secured virtual private network or other secure transmission lines), perhaps transmissions to third parties and outsourcers could be argued to be within the secure system of the business.
b. Massachusetts
Under Massachusetts's encryption law, the following elements must be included in an organization's security program:
(a) to the extent technically feasible, transmitted records and files containing personal information that will travel across public networks must be encrypted;
(b) to the extent technically feasible, all data to be transmitted wirelessly must be encrypted; and
(c) personal information stored on laptops or other portable devices must be encrypted.
There are several factors to consider concerning when and where personal information and other data must be encrypted.
Foremost, with respect to transmission of personal data, encryption is required only if "technically feasible." This term is not defined in the regulations itself, and it is unclear how it would be applied. Using the plain meaning of the word from Webster's, "feasible" means: "capable of being done or carried out." There are multitudes of encryption solutions that likely could achieve the goals of this law if implemented, and in general organizations are capable of implementing them if they have the right amount of time and resources. Since "anything is possible", to construe feasible in this context as essentially meaning "not impossible" may strip away any meaning behind the phrase "technically feasible."
Another possible interpretation may be that encryption is required if technically feasible given the company's current business structure and goals, and/or technical infrastructure and capabilities. Under this position, it could be argued that encryption is it not "technically feasible" if a company has to completely overhaul or replace major portions of its information technology systems or if encryption and decryption degrades system performance to the financial determinant of the company. Significantly, while section 17.03 of the law makes allowances for the size and resources of the company, there are no such considerations tied to the duties in section 17.04, which set the mandatory encryption duties. As such it is unclear whether the impact on a company's business structure and overall goals can be considered in assessing whether encryption of transmitted personal information is technically feasible.
Feasibility may also be dependent on whether the recipients of the encrypted personal information transmitted by the organization have the ability to implement the technology needed for encryption. While some partners may be set up to work with common encryption methodologies, other less sophisticated outsourcers, service providers or third parties may not have such resources or capabilities. It is unclear unfortunately, whether "technically feasible" refers solely to the company's computing environment or whether the concept of feasibility extends to third party relationships. In all, companies relying on the technical feasibility exception should be very careful in analyzing and justifying its applicability.
The Massachusetts law requires encryption for all personal information traveling over public networks. This would appear to include inter-company data, data sent to service providers and data flowing to employees working at remote locations if any of it goes over the Internet. In addition, the law appears to require encryption of all wireless data (above and beyond personal information) traveling wirelessly, whether or not it travels on a public network. As such all data transmitted on any purely internal wireless networks must be encrypted.
Finally, this law goes beyond the Nevada law and requires encryption of personal data stored on laptops or other portable devices. There is no definition of portable devices, but this is likely to include thumb drives, floppy disks, PDAs and CD-ROMs. It may also include, for example, back-up tapes intended for storage. Significantly, there is no "technically feasible" exception for this requirement.
4. What is the Standard for Encryption?
Although definitions may vary, a general definition of encryption is as follows:
Encryption is the process of transforming information (referred to as plaintext) using an algorithm (called cipher) to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key[6].
While the intent of encryption is to render information unreadable except for the intended recipient, in reality the effectiveness of encryption depends on the methods, standards and practices used. For example, security professionals use the term "strong encryption" to refer the strength the algorithm used to render information unreadable. For example, using a 128-bit key to encrypt information generally provides more protection than a 56-bit key (a 128-bit Advanced Encryption Standard [AES] key can have more than 300,000,000,000,000,000,000,000,000,000,000,000 key combinations). The efficacy of encryption also depends on how an organization manages the keys used to decrypt encrypted information. For example, while it might take literally billions of billions of years to decrypt a strongly encrypted message by brute force, it would take minutes to do so if a company's employee left the decryption key or passphrase exposed on his laptop and a hacker was able to steal it.
One of the most challenging aspects of the Nevada and Massachusetts laws is to determine whether an organization meets the definition and standard (if any) for encryption set by these statutes, and whether the laws require any minimum standards for encryption.
a. Nevada
The Nevada encryption law defines encryption much broader than traditional definitions. Under the Nevada law encryption is defined as:
the use of any protective or disruptive measure, including, without limitation, cryptography, enciphering, encoding or a computer contaminant, to: 1. prevent, impede, delay or disrupt access to any data, information, image, program, signal or sound; 2. cause or make any data, information, image, program, signal or sound unintelligible or unusable; or 3. prevent, impede, delay or disrupt the normal operation or use of any component, device, equipment, system or network.[7]
Noticeably, the Nevada statute does not set any minimum standard or level of encryption. Moreover, there is no specific requirement that the encryption method be reasonable, appropriate or consistent with industry standards. As such, it appears that under Nevada law an organization might be technically compliant even if it uses an encryption algorithm or method that is known to be vulnerable. For example, the Wired Equivalent Privacy (WEP) key encryption algorithm or method, used to encrypt data over many home and business WIFI networks, is now considered broken and information encrypted using it potentially vulnerable. However, it appears that the use of WEP to encrypt an electronic transmission of personal information would still qualify as a "protective or disruptive measure" to "delay" access to such information under the Nevada law. Moreover, issues like proper key management do not appear to factor into the question of compliance.
In fact, the definition of encryption in Nevada is broad enough to include other methods of protecting information which would not typically be considered "encryption" in the information security world. For example, it appears that upon a literal reading of the statute, sending an unencrypted, but password protected spreadsheet with personal information may equate to "encryption" under the Nevada law - the password could be viewed as at least minimally "disrupting" to an unauthorized person gaining access to the data in the spreadsheet.
While the Nevada statute requires organizations to carefully consider whether they have any protection around the personal information they transfer through electronic transmissions, it does provide for some flexibility in achieving compliance. Nonetheless, organizations should, if possible, regardless of the standard set by this law, endeavor to reach current industry standards for encryption because those standards are likely to be used in court if the organization is sued for negligent security.
b. Massachusetts
Although "encryption" is not defined under the Massachusetts law, "encrypted" is defined as:
the transformation of data through the use of an algorithmic process, or an alternative method at least as secure, into a form in which meaning cannot be assigned without the use of a confidential process or key, unless further defined by regulation by the office of consumer affairs and business regulation.
(emphasis supplied)[8]. This definition is closer to a general definition of encryption but also appears to provide some flexibility. However, in contrast to the Nevada law, the definition in this case appears to set a fairly high encryption standard without specifying exact encryption requirements.
The Massachusetts law makes reference to the use of an algorithmic process (e.g. cipher) to transform data into a form which meaning cannot be assigned without the use of a confidential process or key. The standard set here depends on how a court interprets the term "cannot." Theoretically, there is no encryption process or standard that renders data impossible to read - even strong encryption can be vulnerable. A brute force attack for example (trying to decrypt a message by trying every possible combination of keys), does not technically require the use of a confidential process to decrypt a message. If "cannot" means "impossible" in this context then it may also be impossible to comply with this law (at least on a theoretical level).
Significantly, the definition for encryption in Massachusetts's breach notice law may provide some guidance. The breach notice law requires at least 128-bit encryption[9]. Moreover, rather than a "cannot" standard the breach notice law requires encryption render information in a "form in which there is a low probability of assigning meaning" to it. However, it is unclear what impact the breach notice definition of encryption would have on the interpretation of the definition of encryption in the mandatory encryption standard. On one hand, it could be argued that the 128-bit reference suggests a minimum for the mandatory encryption law. The breach notice law might also suggest that encryption need not be impossible to crack for it to be adequate (e.g. low probability of assigning meaning). On the other hand, since the drafters of the mandatory encryption law specifically refrained from adopting the 128-bit definition, it could be argued that their intent was to provide more flexibility and not set a minimum. Regardless, it is unfortunate that Massachusetts's lawmakers could not decide on a single definition for encryption. Nonetheless, a good argument could be made that utilizing "strong encryption" would satisfy the basic requirement of the statute. However, if the "cannot" standard is viewed as being on the very highest end it is probable that "weak encryption" (e.g. encryption standards or techniques known to be insecure) would not satisfy the statute. Under this statute, if encryption using an algorithmic process is to be utilized, organizations can play it safe by attempting to use strong encryption (and updating their systems when formerly strong encryption becomes weak over time).
The Massachusetts law also appears to build some flexibility into the definition of encryption with the reference to "an alternative method at least as secure" that can transform data into a meaningless form. However, besides using an algorithmic process, it is unclear what other methods exist for transforming data in such a way. It is possible that, like the Nevada law, a password protected spreadsheet might constitute such a method. One could argue that without the password (e.g. a confidential process) meaning cannot be assigned to a password protected spreadsheet. However, it is probable that this argument would fail because, even with password protection, the underlying data in the spreadsheet can be read if the password can be circumvented. This goes back to the original point, concerning how strictly the term "cannot" should be interpreted.
Conclusion
Nevada's and Massachusetts's mandatory encryption laws pose significant compliance challenges to organizations. While they are isolated to each State on some level, organizations subject to either State's law, unless they can isolate their information technology system or data by State, may effectively have to encrypt all personal data they store and/or transmit. In addition, the lack of uniformity between the laws may require compliance with the "highest common denominator" - the law that imposes the strictest requirements. While encryption is a useful security technique, it is often very difficult to implement within an information technology system and in coordination with third parties. Large organizations with complex network environments and numerous third party relationships may have to redefine their business processes and expend significant resources to achieve compliance. Smaller organizations, despite potentially having less complex and more isolated computing environments, may have to expend significant monetary resources relative to their revenue base. The ever-changing information security environment can also poses challenges as (formally) "strong encryption" techniques are broken, forcing organizations to change (e.g. WEP for wireless). As with most information security legal compliance issues, organizations should convene multi-disciplinary teams (e.g. lawyers, security professionals and risk managers) to analyze compliance requirements, IT infrastructure and existing business processes, develop a plan to address these laws and implement and regularly review that plan.
[1] Nev. Rev. Stat. § 597.970.
[2] 201 CMR 17.00
[3] 201 CMR 17.04(3) and (5).
[4] See for example Rio Properties, Inc. v. Rio International Interlink, 284 F.3d 1007 (9th Cir. 2002)
[5] Nevada defines "personal information" as:
a natural person's first name or first initial and last name in combination with any one or more of the following data elements, when the name and data elements are not encrypted: 1. social security number; 2. driver's license number or identification card number. 3. account number, credit card number or debit card number, in combination with any required security code, access code or password that would permit access to the person's financial account. The term does not include the last four digits of a social security number or publicly available information that is lawfully made available to the general public.
Massachusetts's law defines "personal information" as:
a Massachusetts resident's first name and last name or first initial and last name in combination with any one or more of the following data elements that relate to such resident: (a) Social Security number; (b) driver's license number or state-issued identification card number; or (c) financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password, that would permit access to a resident's financial account; provided, however, that "Personal information" shall not include information that is lawfully obtained from publicly available information, or from federal, state or local government records lawfully made available to the general public.
[6] http://en.wikipedia.org/wiki/Encryption
[7] Nev. Rev. Stat. § 205.4272.
[8] 201 CMR 17.02
[9] MASS. GEN. LAWS 93H § 1 defines "encrypted'' as:
transformation of data through the use of a 128-bit or higher algorithmic process into a form in which there is a low probability of assigning meaning without use of a confidential process or key, unless further defined by regulation of the department of consumer affairs and business regulation.
Sears Privacy/Security Double Whammy.
After the resolution of some aspects of the TJX matter in 2007, it looks like another huge retailer has stepped on the privacy/security porcupine for 2008.
Privacy: Sears is suffering some bad press for allegedly placing "spyware" on its customer's computers that allows Sears (and Kmart) to track their Internet usage, including websites visited, searches engaged in and the headings of emails (click here for story)
Security: In addition, Sears has been sued in a $5 million class action for an alleged security breach related to its managemyhome.com website. Apparently, the website allowed any user to type in a customer's name, addresss and phone number (or some combination thereof) and get a complete history of that customer's purchasing history at Sears (click here for story)
So, question to my readers, in the ever-increasing world of e-commerce, how much tracking of customer behavior/Internet usage is too much? And when should it be permissible (if ever) to engage in the type of activity Sears was engaged in?
P.S. Copy of the complaint can be found here.
