Privacy & Information Security Law Blog : Privacy Lawyer & Attorney : Hunton & Williams Law Firm : Personal Data, Information Security

Notwithstanding the study’s findings, it remains impossible for an independent party to provide definitive numbers on breaches, or to assess accurately the causes behind all data security incidents.  Although the vast majority of states require some form of notification of security breaches, formal notification requirements are rare outside the United States.  Even in the U.S., many breach notification laws require notification only of certain types of breaches, such as breaches of data stored in electronic format.  Moreover, as the ITRC report points out, not all of the laws require reporting of the cause of the breach, and the percent of breaches for which no cause was reported exceeds the percent attributed to hackers.  Perhaps most importantly, many breaches—especially those caused by hackers—go undetected.  And under many laws, even those that are detected need not be reported if the breached entity determines that the breach poses no risk of harm to the affected individuals.  As of this writing, the ITRC’s tally for 2010 counts 146 breaches exposing over 2.8 million records.

According to the complaint, in December 2007, a group of hackers now under criminal indictment launched an attack on Heartland’s network, injecting malicious code into Heartland’s computers.  Heartland allegedly discovered this injection of malicious code and took remedial steps that failed to fully eradicate the threat.  Later, in 2008, the hackers used the injected code to steal millions of payment card numbers.  Heartland did not discover the theft until January 2009. 

The plaintiffs argued that Heartland had made various representations to investors that it maintained sufficient security to prevent such hacking.  For example, Heartland’s 2007 Annual Report discussed the company’s network security situation stating that Heartland “place[d] significant emphasis on maintaining a high level of security” and maintained a network configuration that “provides multiple layers of security to isolate our databases from unauthorized access.”

The court disagreed with the plaintiffs’ claim that these statements were untruthful, holding that “there is nothing inconsistent between Defendants’ statements and the fact that Heartland had suffered an … attack.”  The court explained that “[t]he fact that a company has suffered a security breach does not demonstrate that the company did not ‘place significant emphasis on maintaining a high level of security,’” because “[i]t is equally plausible that Heartland did place a high emphasis on security but that the Company’s security systems were nonetheless overcome.” 

With respect to a former Heartland IT employee’s statement that Heartland should have taken various additional steps to secure its network following the 2007 attack, the court found that “one former employee’s opinion that Heartland did not do everything it could have done to address the security breach does not render the statement ‘We place significant emphasis on maintaining a high level of security’ false.” 

In the end, the court dismissed the complaint against Heartland with prejudice, finding that, because the company “did not make any statements to the effect that the company’s network was immune from security breaches or that no security breach had ever occurred, …the statements in the 10-K were not false or misleading.”

The Obama Administration has taken these threats seriously.  On February 10 it initiated a 60-day review of federal cybersecurity efforts to protect vital U.S. computer networks (the Review).  The Review staff has engaged in significant and broad outreach to the government, the private sector and non-governmental organizations.  As the work of the Review draws to a close, its director, Melissa Hathaway, has intimated that it will not result in the naming of a cyber security advisor at the White House level.  This is an important, if controversial, signal.   However, on April 2, 2009, Senator Jay Rockefeller (D-WVA) and Senator Olympia Snow (R-ME) proposed legislation that would establish just such a position, invested with sweeping powers.  The legislation would empower government to set and enforce security standards for industry, and broaden the focus of the government’s cybersecurity efforts to include not only military networks but also private systems that control critical infrastructure, such as electricity and water distribution.  Such new powers raise serious questions for industry and civil liberties.

The Centre for Information Policy Leadership has played a prominent role in these efforts.  Centre Senior Policy Advisor Professor Fred H. Cate has consulted on several occasions with the Review committee, and Paula Bruening served on the Commission. On April 5, Paula was featured as a guest on National Public Radio’s Diane Rehm show, along with Jim Lewis, director of the Commission’s  study, and Paul Kurtz, a cybersecurity consultant and former senior director, Office of Cyberspace Security at the National Security Council. During the hour-long discussion,  guests explained the nature of these cybersecurity threats, considered the challenges faced by government and industry, the consumer’s role, issues of civil liberties, and proposed possible ways to move forward.  To view the discussion, click here.