On Wednesday, February 12, the White House released the National Institute of Standards and Technology’s (NIST) Final Cybersecurity Framework: a set of industry best practices and standards to help owners and operators of critical infrastructure develop better cybersecurity programs. It is accompanied by a Roadmap which discusses NIST’s next steps with the Framework and identifies key areas of development, alignment, and collaboration. The Framework stems from President Obama’s February 2013 Executive Order on cybersecurity, previously covered on October 1, 2013. The overall core of the Framework is essentially unchanged from earlier drafts, also previously discussed on October 28, 2013.
As the world becomes more interconnected, data breaches and cyber-attacks are increasingly becoming an unfortunate reality for many organizations. The stakes are high: a data security breach can disrupt a company’s operations, damage the business’s reputation, cause its stock price to fall, lead to the loss of business, and attract government investigations, agency action, and class action lawsuits. Complicating matters is the fact that a patchwork of state and federal laws can apply to the same data security breach incident.
The National Institute of Standards and Technology (NIST) has just released its Preliminary Cybersecurity Framework: a set of best practices to help owners and operators of critical infrastructure reduce cybersecurity risks. This voluntary framework provides both private and public-sector organizations with a common language for understanding and managing cybersecurity risks internally and externally. The framework stems from President Obama’s February 2013 Executive Order on cybersecurity, previously covered by this blog. The Final Framework is due to be released in February 2014, following a 45-day public comment period on the Preliminary Framework.
Update of Proposed Rule Changes: A Universal Federal Sanctions Standard for the Failure to Preserve ESI Could be a Reality
The United States Courts’ Advisory Committee on Civil Rules (“the Committee”) has proposed various amendments to the Federal Rules of Civil Procedure that, if adopted, will profoundly affect the range and scope of sanctions a court may impose for failures to preserve electronically stored information (“ESI”). F.R.C.P. 37(e), which currently addresses sanctions in those instances, is one of several rules slated for amendment.
The International Organization for Standardization (“ISO”) is forming a new e-discovery committee tasked with the development of standards for e-discovery processes and procedures. The international standard “would provide guidance on measures, spanning from initial creation of [electronically stored information] through its final disposition which an organization can undertake to mitigate risk and expense should electronic discovery become an issue” according to a draft committee charter.
As we reported in the Gibbons E-Discovery Law Alert in May 2012, “Reg FD” could present a potential pitfall for those that post material non-public information via social media platforms. In early December 2012, that “pitfall” became a reality for Netflix Inc. CEO Reed Hastings. In July 2012 Hastings published on his public Facebook page a 43-word post concerning viewership statistics, including that Netflix subscribers had watched one billion hours of video the previous month.
“Did I Just Get a Tweet From Goldman Sachs?!?”: Increased Expansion and Scrutiny of Social Media in the Financial Services Industry
With the increased use of social media by financial services industry participants, more activity and scrutiny can be expected from financial regulators. This is not to mention the litigation from investors that could arise out of, for example, the misinterpreted or well-meaning post from an advisor that simply did not translate to “less than 140 characters.” It appears that there is a trend (amongst at least the larger financial institutions) that a united and pre-approved voice is best for now.
Delivering non-public material information through Internet-based social media, especially social networking sites such as Facebook, LindedIn, and Twitter, means that this information will first reach only a fraction of the investing public — those who “follow” the company using those platforms. As illustrated by the hypothetical below, this may create a potential “Reg FD” issue for a public company. As we addressed in a previous blog, the SEC has recently issued guidance to investment advisers concerning their use of social media. We have also addressed in a previous blog that FINRA, too, has issued Regulatory Notices which make it clear that member firms are expected to have policies and procedures in place that cover the use of social media by the firm and its associated persons. While direct guidance to public companies on the use of social media to report a company’s material financial matters has yet to issue, this post offers suggestions for avoiding pitfalls in this regard.
Broker-dealers and investment advisors face a variety of legal and compliance ramifications resulting from the expanding use of social media for business purposes. It is now commonplace that an entity or individual in the securities industry will employ a combination of social media platforms including Facebook, Twitter, YouTube and LinkedIn to market and network with their investors and potential investors. For example, an investment advisory firm may establish its own Facebook page where industry-related information may be posted, an investment advisor may “tweet” investment and wealth management strategies, or a registered representative may present his experience, licensures or his own opinions on trending stocks on his LinkedIn page.
In a rare New York State appellate decision concerning e-discovery, the First Department took the opportunity to address claims by a subpoenaed nonparty of inaccessibility of electronically stored information (ESI). The case, Tener v. Cremer, 2011 N.Y. Slip op. 6543 (1st Dep’t 2011), involved an alleged defamatory post originating from one of New York University’s computers. Plaintiff served NYU with a subpoena seeking identification of persons who accessed the Internet on a certain date via a certain IP address.