Liability for Data Security Auditors

Posted on June 16, 2009 by Hunton & Williams LLP

A lawsuit that will soon commence in Arizona has the potential to alter the data breach liability landscape by making data security auditors liable for data breaches experienced by the companies they audit.  The case, Merrick Bank Corp. v. Savvis Inc., has its origins in events that began in 2003, when Merrick Bank (“Merrick”) offered to hire CardSystems Solutions (“CardSystems”) to process credit card transactions for its merchant customers.  The offer was contingent upon CardSystems achieving certification under VISA’s Cardholder Information Security Program (“CISP”), which is the predecessor to the Payment Card Industry Data Security Standard (“PCI DSS”).  Savvis audited CardSystems in 2004 and found that it had “implemented sufficient security solutions” and followed “industry best practices.”  VISA certified CardSystems shortly after receiving Savvis’ audit report.  In 2005, CardSystems revealed that it had experienced an information security breach that compromised forty million payment cards.

Claiming $16 million in fraud losses, legal fees and penalties related to the breach, Merrick sued Savvis under theories of negligence and negligent misrepresentation.  After originally being filed in federal court in Missouri (where Savvis is headquartered), the case was transferred to Arizona (where CardSystems operated and eventually filed for bankruptcy due to fallout from the data breach).  If the Arizona court rules in favor of Merrick, data security auditors could for the first time be held professionally liable for their audits of a company’s information security in the same way accountants can incur liability for negligent audits of a company’s financial statements.  Data security auditors would likely increase the price of audits to account for the increased risk.

The filing of Merrick Bank v. Savvis coincides with increased scrutiny of security auditors and of self-regulation of the payment card industry.  Critics have noted that other payment card processors that suffered significant data breaches, such as Heartland Payment Systems, were also listed by VISA as service providers that were compliant with PCI DSS, which is the consolidated industry standard developed by the major payment card companies.  As a result of those breaches, the PCI Security Council announced late last year that it would strengthen oversight of auditors to “make sure no one is rubber-stamping something.”  Some experts believe regulation is possible, pointing to the recent proposed guidance on data encryption standards for personal health information as an example of how the federal government has imposed requirements on information security in a manner previously thought unlikely.
Tags: , , , , , , , , , , ,

White House Releases 60-day Cybersecurity Review Detailing Threats

Posted on May 29, 2009 by Hunton & Williams LLP

The White House today released the report from the 60-day cybersecurity review the President ordered in February. Speaking to a packed audience in the East Room, President Obama outlined the broad range of threats facing the digital infrastructure, focusing not only on national security and organized crime attacks, but also on identity theft and incursions into individual privacy. 

He promised a “new comprehensive approach to securing our nation’s infrastructure,” including appointment of a White House cybersecurity coordinator reporting to both the National Security Council and the National Economic Council. The coordinator would have broad responsibilities, but little direct authority, although the President did promise that the coordinator would have access to him.

The President also indicated that he would be appointing a privacy and civil liberties official reporting to the new cybersecurity coordinator.

The President cautioned, however, that dealing with cybersecurity issues would take time. “Protecting our prosperity and security in this globalized world is going to be a long, difficult struggle demanding patience and persistence over many years. But we need to remember: We’re only at the beginning. The epochs of history are long—the Agricultural Revolution; the Industrial Revolution. By comparison, our Information Age is still in its infancy.”

The President did not say who would be the new coordinator, nor did he provide a timeline for naming the new officials.

Today’s announcement is obviously a significant step towards a broader, higher priority approach from the federal government towards the growing problem of securing information and the systems that process it. While the President stressed that the new approach would include the private sector, he said that the government would not be telling the private industry how to go about securing their infrastructure, nor would the government engage in information monitoring.

According to published press reports, release of the cybersecurity report was delayed six weeks over disagreements within the administration over how the new cybersecurity position would be managed. That delay, the decision not to name the new coordinator, the tone of the President’s announcement, and the tools for fighting cyberattacks that he appeared to rule out suggest that while the administration’s response is serious, it is not necessarily as urgent as some experts have sought.

The Cyberspace Policy Review is available at http://www.whitehouse.gov/assets/documents/Cyberspace_Policy_Review_final.pdf.

The President’s announcement is available at http://www.whitehouse.gov/the_press_office/Remarks-by-the-President-on-Securing-Our-Nations-Cyber-Infrastructure/.

And the unclassified documents on which the review relied are available at: http://www.whitehouse.gov/cyberreview/documents/.

 
Tags: , , , , , , ,