Thoughts from the RSA Conference

As the partners of InfoLawGroup make our way through the sensory overload of the RSA Conference this week, I am reminded (and feel guilty) that it has been a while since I posted here.  I have good excuses - have simply been too busy with work - but after spending several days in the thought-provoking environment that is RSA, I had to break down and write something.  A few observations, from a lawyer's perspective, based on some pervasive themes:

1. We all need to work together, and we can.  Legal, Information Security, Privacy, Compliance, IT, and the affected business units.  Now more than ever, it is essential that ALL the stakeholders join forces, as early as possible, to address security and privacy risks, assess and vet business deals, and put in place appropriate procedures - RFPs, due diligence, contract negotiation - to address the risks.
    
2. Cloud, cloud, cloud, yada, yada, yada.  Hold up - the technology is not new - but usage and the business model have changed dramatically.  I have been having this argument with my information security and technology friends for months.  OK, I get it.  "Cloud" technology in some form or another has been around for 30 or 40 years.  What is new is the massive scale, availability and changes in usage and the business model - in part driven by the economics.  Guess what?  Those business model changes make the legal risks even more pervasive.  Going back to (1) above, all of the stakeholders need to be in the room (or on the phone or videoconference) discussing the issues BEFORE the decision is made to enter into a cloud arrangement.  ANY cloud arrangement.  Not after the RFP is issued.  Not after IS does its due diligence.  Not after the contract negotiations have begun.  And not after the contract is inked.  The same due diligence and attention to risks that would apply in a traditional outsourcing/offshoring relationship must be applied here, too.  The cost savings are illusory if the short-term and/or long-term risks are significant.  Think about the kind of data at issue.  What are the risks?  Evidence preservation, data security, breach response, enforcement rights, indemnification.  And before we even get to those - can the data be transferred across borders in the first place?  Think about it early.  And then talk about it before decisions are made. 

More after the jump.

3. Privacy is the next frontier in Information Security. Wait, what? I have to admit that my initial reaction to this was - seriously? Privacy regulations have been here for some time. That's true, and the privacy profession has been growing for the last 10-15 years. But the privacy profession is in its infancy as compared to information security and IT. Why is the privacy profession growing? In part because the regulatory environment has exploded.  But Information Security and Privacy care about the same  thing -- data management and governance. We can help each other find creative solutions to mitigate risk.
    
4. The regulatory scheme is becoming more complex, at breakneck speed. What regulations do information security professionals and the businesses they serve need to understand and address? Many - international, federal, state, and local. And things are changing constantly.  Just this week the Massachusetts data security regulations became effective.  And last week the FTC filed its notice of appeal of the District Court's ruling that the FTC cannot apply the Red Flags Rule to attorneys.

   Information Security and Privacy, together with Legal, should consider all potentially applicable laws in evaluating security risks. What are those laws? Well, depending on your industry, and where your customers and employees reside, a few, but not all, might include FTCA, GLBA, HIPAA (including the HITECH Act), state data security laws (such as the new Massachusetts data security regulations and Nevada's encryption and PCI law), Sarbanes-Oxley, Red Flags Rule, FACTA Disposal Rule, ECPA, E-Sign, FERPA, the Federal Rules of Civil Procedure and Evidence, the PATRIOT Act, PIPEDA, the EU Data Protection Directive, EU member country laws, other foreign laws across the globe, state breach notification laws, and Social Security number protection statutes.  But there are many more.  And that's not even getting into contractual standards such as PCI-DSS.
    

5. Lawyers need to embrace technology. I was fortunate enough to attend a CLE last week, pre-RSA, hosted by the Entertainment Law and Intellectual Property Section of the Los Angeles County Bar Association.  Roland Trope, who moderated the panel on social networking issues, raised a tremendously important question:  Are lawyers "competent" if they do not keep track of, and understand, changes in technology? The ABA is considering changes to the Model Rules of Professional Conduct to address this question. Some take the position that no changes are necessary and that the requirement can be read into the existing Rules. In any event, what better place than RSA to reflect on that question and the future of the legal profession and its relationship with technology.

That's it for now - back to work, and preparing for my next cloud presentation tomorrow. In the meantime, I encourage our readers - the lawyers, the information security professionals, and the privacy professionals - to weigh in.