1. E-Security By Leif Gamertsfelder Senior Associate Deacons leif.gamertsfelder@deacons.com.au Phone: 02 9330 8448

2. Introduction E-security and liability issues Evidence and computer forensic issues Extraterritorial issues

3. E-Security Issues “Manufacturers” “Firewalls” “Service provider supplies online procurement services to manufacturers” Internet “Firewall”

4. E-Security Issues ‒ Cybercrime issues ‒ Corporations Act ‒ Trade Practices Act ‒ Privacy Act ‒ Contract ‒ Negligence ‒ ASX Listing Rule 3.1 ‒ Evidence Issues

5. Proceedings against hackers Civil or criminal proceedings can be brought against hackers. Possible civil proceedings include actions under contract, privacy, confidentiality or tort (eg, trespass) law. Possible criminal actions include the specific computer related offences under Federal or State law. Is it worth it?

6. Proceedings against hackers (cont) While it is important to consider each case on its merits to determine whether a hacker should be prosecuted, the matter may be a distraction in the majority of cases. Generally, more important liability issues are a company’s own liability if a hacker penetrates security architecture and ability to recover loss or damage from vendors, its consultants or networked parties.

7. Proceedings against others A company may be able to recover losses from:  vendors of security products or security service consultants  other companies (eg sharing an extranet link) A company’s ability to do so will largely be determined by the contract they enter with each of these parties and consideration of:  exclusion clauses  disclaimers  limitation of liability  Downstream liability is a more important issue

8. Proceedings against others (cont)  Warranties/indemnities  Insurance clauses  The enforceability of these clauses  The type of obligation that the other company actually assumes, ie:  reasonable steps?  a higher obligation?  what representations were made?

9. Cybercrime New offences relating to propagation of viruses, Denial of Service (DoS), unauthorised access to data etc Criminal Code applies to body corporates in addition to individuals Fault elements may be attributed to body corporate Intention, knowledge or recklessness - Authorisation/permission  express, tacit or implicit authorisation or permission to commit the offence  authorisation may be proven where a corporate culture existed within a body corporate that directed, encouraged, tolerated/led to non-compliance with relevant provision

10. Cybercrime (cont) NB – a “corporate culture’ in this context means an attitude, policy, rule, course of conduct or practice existing within the body corporate generally or in the part of the body corporate in which the relevant activities take place Possible applicable offences – unauthorised access to data, propagation of viruses “Reasonable steps” will be a touchstone in these cases

11. Corporations Act If an e-security breach has occurred due to a failure by a company to take reasonable steps to implement robust e- security architecture, ASIC/shareholders may want to know what steps (if any) the directors took to prevent the breach of network security Under the Corporations Act, Directors and officers have a duty to exercise reasonable care and due diligence in exercising their duties (s180)

12. Business Judgment Rule – 180(2) Director or other officers have a defence under Corporations Act and at common law and equity where: judgment is made in good faith and for a proper purpose they do not have a material personal intent in the subject matter of the judgment inform themselves about the subject matter of the judgment to the extent they reasonably believe to be appropriate rationally believe that the judgment is in the best interests of the corporation

13. Corporations Act In order to comply with their obligations under the Corporations Act, directors and officers need to ensure that they take reasonable steps to (among other things):  familiarise themselves with the general security issues facing the company and the importance of security to business lines  guide and monitor management in respect to security issues/monitor implementation

14. Corporations Act (Cont)  obtain appropriate information to make informed decisions (including duty to obtain expert advice)  participate in meetings about security policy/strategy and make informed decisions  Consider ROI issues

15. Limiting liability – reliance on others Directors (not officers) who:  rely on information given or prepared by: –an employee whom the director believes on reasonable grounds to be reliable and competent; –a professional adviser/expert in relation to certain matters; –another director or officer in relation to certain matters; or –a Committee of directors in relation to certain matters

16. Limiting Liability - reliance on others (cont)  Reliance was in good faith after making an independent assessment of the information having regard to the director’s knowledge of the corporation and the complexity of its structure and operations  The director’s reliance on the information will be taken to be reasonable

17. Limiting liability – reliance on others  Delegation - s198D & s190  Director is liable unless director reasonably believes that the delegate will act in accordance with the Corporations Act and the Constitution AND  Director believed on reasonable grounds and in good faith and after making proper inquiries that delegate was a reliable and competent person to discharge the relevant powers

18. General points Director’s or officers must make a “judgment” “reasonable steps” is the relevant touchstone Penalties up to $200,000, compensation orders and/or disqualification Issues are determined on the balance of probabilities

19. Privacy Act From 21 December 2001 Organisations must take reasonable steps to, among other things, protect the personal information it holds from misuse and loss and from unauthorised access, modification or disclosure Note the possible impact of the TPA in this area

22. Case Study – Murdoch University  An offshore Malaysian spoofed an email from one lecture to another  Requested exam scrips for upcoming exam Authenticating only in the basis of the email header information the relevant lecturer sent the exam scripts  Student shared info with other students

24. Trade Practices Laws A party may sue a company if that company makes a false representation regarding their e-security practices Need to look at relevant provisions of the commonwealth trade practices act and the fair trading acts of the various states and territories

25. Trade Practices Laws (cont) A party may make a claim for a breach of s 52 in relation to representations a company or its employees have made in relation to the e-security of the company. In limited circumstances a well drafted exclusion clause may protect a company from a s 52 claim Where a company makes a general representation about its e- security, a strong defence may be that the company took reasonable steps in light of current industry standards to protect the system from penetration Need to ensure tight control over “ representations ”

26. Trade Practices Laws (cont) In this context two types of cases could arise:  Consumer cases eg statements about B2C transactions  Corporate cases eg extranet/VPN/DMZ issues NB Important role of s51A here

27. Case Study – Eli Lilly  Pharmaceutical company collected personal info on its website, including email addresses  Subscribers received individualised medication reminders by email  Eli Lilly decided to cease reminders and sent global notice to all 669 subscribers  FTC “even the unintentional release of sensitive medical information is a serious breach of consumers’ trust”

28. Case Study – Eli Lilly  Eli Lilly’s claims of privacy and confidentiality was deceptive because it failed to implement internal measures appropriate under the circumstances, namely: -no training for employees re privacy and information security -did not provide oversight or assistance to employee who sent out the email -no appropriate checks or monitoring  Settlement with FTC contained provision addressing these flaws in e-security  NB interrelationship with TPA, authentication protocols and internal policies

29. Case Study – Ziff Davis  November 2001, Ziff Davis ran website promotion offering free subscriptions  Contestants had to submit name, address, email information and credit card number  Ziff Davis’ online policy stated that: “[We] use reasonable precautions to keep the personal information you disclose to both our magazine and website secure and to only release this information to third parties we believe share our commitment to privacy.” 12,000 individual records were openly accessible via the internet and credit card details were obtained remotely and used fraudulently

30. Case Study – Ziff Davis  The Attorneys General of Vermont, New York and California alleged Ziff Davis had breached various laws which prohibit “unlawful, unfair or fraudulent business practices and untrue or misleading advertising” and commenced an investigation  The AGs and Ziff Davis entered into an assurance of discontinuance containing the following core terms: pay $500 to each consumer who provided credit card details encrypt sensitive data during transmission from consumers control file access through user authentication and application controls monitor and control service activity review applications prior to implementation implement risk identification and response protocols establish management oversight and employee training programs

32. Contract Entities that have contractual relationships with a company which suffers a breach of computer security may sue for breach of contract if it incurs loss or damage as a result This will largely depend on the wording of the relevant contract. Need to consider: Is there an implied or express e-security clause? -What obligation was assumed, ie:  reasonable steps?  a higher obligation? NB Interrelationship with TPA

33. Negligence If, as a result of the vulnerability in an information system of a company, another party suffers loss or damage, this may give rise to an action in negligence. Employers may also be vicariously liable for the security breaches of their employees if those breaches result in loss to a third party. For example, assume that a procurement hub is owned and operated by an IT company which has a contract with a service company

34. E-Security Issues “Manufacturers” “Firewalls” “Service provider supplies online procurement services to manufacturers” Internet “Firewall”

35. Negligence (Cont) The service company in turn contracts with 4 major vehicle manufacturers who actually use the procurement hub The 4 manufacturers have no direct contractual relationship with the IT company, but may sue under negligence if the procurement hub is hacked due to poor e-security and results in a denial of service The 4 manufacturers may suffer huge losses if this causes disruption to their just-in-time production processes A strong defence to such claims will be at hand if the IT company took reasonable steps in light of current industry standards to protect the data/system from penetration

36. ASX listing rules Under ASX listing rule 3.1 a listed company has certain reporting obligations – this is a strict obligation If the reasonable person would consider information as having an impact of the share price, the company must disclose the information to the ASX Note that recent proposals under CLERP 9 seek to increase continuous disclosure obligations for listed companies. Indeed, one proposal is that market operators should require listed entities to respond to externally generated speculation in circumstances where the operator determines that this is having a significant impact on the market for their securities. Criminal and civil penalties apply

37. Workplace Relations Issues Cannot discipline an employee if unjust, unfair or unreasonable Must also provide a workplace free of harassment etc Some reasonable steps need to be taken to implement policies Effective policies must be in place Features of an effective policy are as follows:  clear  well promulgated (avoid ‘one-shot’ policy launches)  reissued (eg, incorporate in logon procedure)  regularly reviewed and updated –information/education sessions held on the policy

38. What are “reasonable steps”  How the organisation stores/holds information  Size of the organisation  Should be proportional to risks faced by the particular organisation (eg cost/benefit issues)  Existence of an e-security strategy  Management buy-in

39. What are “reasonable steps”  Objective, floating standard  Court will consider numerous factors including:  Security policy mandated (and understood) by directors and officers  Policy effectively implemented and monitored by organization  Prevailing industry standards such as AS17799: -generally accepted industry practice -OECD Guidelines for the Security of Information Systems and Networks  Harm likely to be suffered as a result of a breach of e- security

40. Summary flowchart  Identify critical/non-critical systems and assets on the network Identify critical vulnerabilities Identify business operations at risk Audit Security Risk Management Cycle Draft security policies Draft technical security designs Draft incident response/continuity plans Plan Product and custom solutions Configuration management Patches Authentication, access controls etc Implementation Changes to network configuration Compliance with policies System misuse Monitor

41. Evidence Issues  Currently very few standards exist  Code of practice for Legal Admissibility and Evidential Weight of Information Stored Electronically DISC PD 0008:1999, British Standards Institution  Cth AG is currently seeking input from a working group to develop a standard which would encourage more businesses to seek damages for breaches of IT security of other parties and this become a drive for better IT security and generally corporate evidence collection in cybercrime matters  Commissioner Ryan’s Future Directions Report

42. Handling Digital Evidence Electronic evidence is the keystone of any security incident whether it is allegedly perpetrated by insiders or outsiders Management needs to ensure that ‘chain of custody’ issues are addressed Chain of custody = forensic computing Elements of forensic computing: ID of digital evidence preservation of digital evidence analysis of digital evidence presentation of digital evidence During this process company must ensure minimum handling of original, account for any change, compliance with rules of evidence & experts do not exceed their knowledge

43. Handling Digital Evidence Rook v Maynard –Unauthorised access and viewing of personal files on DSS system –Trace placed by management –Trace logged each use of defendant’s machine to obtain information in the Dept’s information systems –Output of the trace program was crucial prosecution evidence –Defence argued that trace output was inaccurate as it was incomplete –Court held that output was incomplete but accurate to the extent it could be compared to data on the information systems

44. Handling Digital Evidence Rook v Maynard Interesting to note that both lower and higher courts made trips to DSS to view the manner in which the relevant information system and trace operated Clearly demonstrates digital evidence can often be a fragile element of any case. Internal protocols must be followed if breaches of rules governing the use of information systems are to be dealt with successfully

45. The End