Richmond Journal of Law and Technology

The first exclusively online law review.

Click Here to Vote: An Overview of the Impact of COVID-19 on Annual Shareholder Meetings

By Tristan Smith

 

While the world continues to reel from the continued impact of COVID-19, the corporate world has also had to make substantial adjustments in how individual corporations conduct business on both a day-to-day and long-term level.[1]  Although corporate work life may be in upheaval as a result of the pandemic, profit margins continue to flourish on Wall St., much to the delight of both c-suite executives and shareholders across industries.[2]  For corporations, the challenges in organizing and conducting in-person work present unique challenges when executives begin planning required annual shareholder meetings to discuss pertinent topics that require shareholder approval.  Recently, we have seen corporations introduce new models to conduct shareholder meetings in response to COVID-19; by analyzing these approaches, it will be possible for legal and business leaders to assess the viability of further changes to in-person meetings on the corporate level as the world hopefully begins to recover.

 

Prior to the pandemic, shareholder meetings were conducted based on a series of corporate policies, industry norms, and state and federal statutes.[3]  A shareholder meeting must be called on a regularly scheduled basis; if a shareholder meeting has not been held within a fifteen month timeframe, any shareholder who holds voting stock has the power to require the corporation to call an annual meeting.[4]  At the annual shareholder meeting, the only required matter of discussion is the election of new directors for the company; however, a number of other issues may also be raised for shareholder approval.[5]  Shareholders can either choose to vote in person or by sending a proxy to vote in their place to the shareholder meeting.[6]  One of the most important elements of the shareholder meeting is the need for the meeting to meet quorum in order for any votes to be taken.[7]  Under most statutes, a quorum is established when at least a majority of shares (50% plus one) is present, although the quorum requirement may be increased or decreased based on individual company’s bylaws.[8]

 

Because of both the importance and the requirement of annual shareholder meetings, corporations have had to adapt in a timely fashion to new models of gathering; indeed, prior to the pandemic, very few companies had any policies or guidelines for hosting virtual shareholder meetings in lieu of in-person gatherings.[9]  Generally, there have been three different models proposed to replace traditional all-in person meetings: 1) switching to a completely virtual meeting, 2) hold an in-person or hybrid form of an annual meeting, or 3) delay the annual meeting.[10]  For the option of switching to an entirely virtual format, corporations will need to review both the company’s charter and bylaws as well as the state law in which the company is incorporated.[11]  For the large number of companies incorporated in Delaware, the Delaware General Corporation Law (DGCL) grants the board authority to institute a virtual shareholder meeting in the place of an in-person gathering.[12] Additionally, California, Connecticut, Georgia, Massachusetts, New Jersey, New York, and North Carolina have issued either executive orders or passed emergency legislation permitting the implementation of virtual shareholder meetings during the state of emergency in their respective states or simply allowing for them with no definite end date.[13]  Several issues arise when converting to an all virtual setting, including selecting a service platform, coordinating presentations of shareholder proposals, and most importantly, determining how votes for directors and proposals will be collected before and during the meeting.[14]  The challenges for hybrid meetings include deciding what representatives from the c-suite and other executives will be physically present versus attending remotely, how to properly screen in-person attendees to ensure the safety of everyone present, and finding host buildings or locations that are equipped to conduct the shareholder meeting in a socially responsible manner.[15] Finally, for companies who choose to simply delay their annual meeting, it is important for them to consult the bylaws to ensure that they are not bound to hold the meeting on a specific day; if so, a bylaw amendment may be required to allow for a delay to take place.[16]

 

However, the decision to move shareholder meetings to a virtual format has not been without drawbacks.  Meetings on average are lasting seven minutes shorter when contrasted with in-person shareholder meetings conducted in 2019; while not a significant amount of time, the reduction has left shareholders with less time to pose questions to corporate executives before taking votes on important issues for the company.[17] Furthermore, only about 80% of United Kingdom companies were implementing electronic options for shareholders to be able to ask questions at all.[18]  These kind of restrictions continue to raise questions about the long-term viability of virtual meetings replacing in-person shareholder gatherings.

 

[1] Lynn S. Paine, COVID-19 is Rewriting the Rules of Corporate Governance, Harvard Business Review (Oct. 6, 2020), https://hbr.org/2020/10/covid-19-is-rewriting-the-rules-of-corporate-governance.

[2] See generally Liz Hoffman, Goldman’s Pandemic Hot Streak Continues in Third Quarter, The Wall St. Journal ( last updated Oct. 14, 2020, 4:07 PM), https://www.wsj.com/articles/goldman-sachss-third-quarter-profit-nearly-doubles-11602675770?mod=hp_lead_pos1; see generally Hugh Son, JPMorgan Beats Analysts’ Profit Estimate as the Bank Sets Aside Less for Loan Losses, CNBC ( last updated Oct. 13, 2020, 12:20 PM), https://www.cnbc.com/2020/10/13/jpm-.html

[3] Alan Palmiter et al., Business Organizations: A Contemporary Approach 400 (West Academic Publishing, 3RD ed. 2019).

[4] Id.

[5] Id.

[6]  Id. at 401.

[7] Id.

[8] Id.

[9] Lynn S. Paine, COVID-19 is Rewriting the Rules of Corporate Governance, Harvard Business Review (Oct. 6, 2020), https://hbr.org/2020/10/covid-19-is-rewriting-the-rules-of-corporate-governance.

[10] Holly Gregory Et al., Considerations for Annual Shareholder Meetings in the Time of COVID-19, Sidley-Austin LLP (April 8, 2020), https://www.sidley.com/en/insights/newsupdates/2020/03/annual-shareholder-meetings-in-the-time-of-covid19.

[11] Id.

[12] Del. Gen. Corp. Law § 211(a)(2) (2020).

[13] Gregory, supra note 11.

[14] Id.

[15] Id.

[16] Id.

[17] U.K. Regulator Finds Companies Often Mute Shareholders in Remote Meetings, The Wall Street Journal (October 7, 2020, 5:30 AM) https:wsj.com/articles/u-k-regulator-finds-companies-often-mute-shareholders-in-remote-meetings-11602063000.

[18] Id.

Image Source: https://www.gazprom.com/f/posts/27/668826/shareholders-1.jpg

Oracle v. Google – Is It Possible to Steal APIs?

By Anna Hargett

The Supreme Court heard its first arguments since the death of Justice Ginsburg last month.[1] The Court appeared divided upon hearing the arguments of Oracle and Google regarding software code copyright.[2] The Court is expected to rule in June on this case,[3] which has been called the “copyright case of the century.”[4]

Oracle alleges that Google infringed upon Oracle’s copyright when Google used thousands of lines of Java code without a license.[5] When Google developed its Android smartphone platform, it used Java code, which is now owned by Oracle.[6] The Java code operates as an application programming interface (“API”) that provides integration across multiple programs that “speak” to Java programs.[7] Based on these facts, the court will decide if copyright protection extends to APIs.[8]

In 2018, the U.S. Court of Appeals for the Federal Circuit ruled in favor of Oracle, holding that Google’s differing format of smartphone integration was not a significant transformation of the code and therefore could not fall under the “fair use” exception.[9] This ruling overturned a San Francisco jury’s finding that allowed Google’s usage of the code under the “fair use” exception.[10]

At argument, Oracle’s legal team harped on the specialization of the Java code, and defended claims by Google that the Java language merely acts as an organization system.[11] E. Joshua Rosencrantz, counsel for Oracle, defended the unique attributes of the code when Chief Justice Roberts analogized the language to the organization and description of a restaurant’s menu.[12] Rosencrantz replied by emphasizing that, “We fill in the blanks 30,000 times over,” and that “each item had its own description that no one else was using.”[13]

Google argued that the API language is not copyrightable.[14] However, counsel for Google focused more on the “fair use” exception, which Google argues would apply if the Court found that the language is protected.[15] The fair use exception would only apply in this case if Google proves that its use of Java was transformative in nature. [16] Google claims that since the code was used to create a new smartphone platform, it was significantly transformative.[17]However, Oracle views the platform change as infringement because it simply moves the same content into a different format.[18] Google also emphasized the fact that API use is commonplace in the industry, and that this method is the “only way” to accomplish this.[19] However, this did not sit well with Justice Gorsuch when he replied that other competitors such as Microsoft and Apple have been able to write their own languages.[20]

Both parties claim that ruling in favor of the opponent will stunt innovation.[21] If Oracle wins, Google claims that it will give software developers too much power by allowing copyrights by the giants in the industry and quelling competitors.[22] If the Court holds for Google’s fair use, or that APIs are not subject to copyright laws, then it will weaken copyright protections for computer programs and disincentivize innovation from that prospective.[23]

How will this decade-long legal battle end?[24] Based on the Justices’ questions, it seems that Oracle may have the upper hand.[25] However, the Court may decline to rule on API copyright altogether by ruling for Google on procedural grounds.[26] Either way, increased litigation in the software industry will likely ensue as a result.[27]

[1] Jan Wolfe & Andrew Chung, U.S. Supreme Court Divided Over Google Bid to End Oracle Copyright Suit, Reuters (Oct. 7, 2020, 6:04 AM), https://www.reuters.com/article/usa-court-google-oracle/us-supreme-court-to-mull-google-bid-to-end-oracle-copyright-suit-idUSKBN26S1H2.

[2] See id.

[3] Id.

[4] Adam Liptak, Supreme Court Hears Copyright Battle Between Oracle and Google, The New York Times (Oct. 7, 2020), https://www.nytimes.com/2020/10/07/us/supreme-court-google-oracle.html.

[5] Wolfe & Chung, supra, note 1.

[6] Ina Fried, 1 Big Thing: Supreme Court to Weigh Software’s Future, Axios Login (Axios, Arlington, V.A.), Oct. 6, 2020, https://www.axios.com/newsletters/axios-login-89adf203-c2b8-4ded-990b-0754b7bf29c3.html.

[7] Id.

[8] Id.

[9] Wolfe & Chung, supra, note 1.

[10] Liptak, supra, note 4.

[11] Id.

[12] Id.

[13] Id.

[14] Timothy B. Lee, Google’s Supreme Court Faceoff with Oracle Was a Disaster for Google, Ars Technica (Oct. 8, 2020, 11:00 AM), https://arstechnica.com/tech-policy/2020/10/googles-supreme-court-faceoff-with-oracle-was-a-disaster-for-google/.

[15] Id.; see 17 U.S.C. § 107 (2020).

[16] Wolfe & Chung, supra, note 1.

[17] Id.

[18] See Liptak, supra, note 4.

[19] Wolfe & Chung, supra, note 1.

[20] Id.

[21] Fried, supra, note 6.

[22] Lee, supra, note 14.

[23] Id.

[24] See Wolfe & Chung, supra, note 1.

[25] See Lee, supra, note 14.

[26] See id.

[27] Id.

Image Source: https://www.abajournal.com/news/article/kavanaugh_first_supreme_court_arguments

Telemedicine, Controlled Substances, and the Pandemic: How a Public Health Emergency Can Further Contribute to Inequalities in Healthcare

By Emma Phillips

The Covid-19 pandemic has drastically changed the American healthcare field in many ways, one being the rise in popularity of telemedicine.  Some of the first examples of modern telemedicine came about in the 1950s and 1960s, when a “closed-circuit television link was established between the Nebraska Psychiatric Institute and Norfolk State Hospital for psychiatric consultations.”[1]  It became a way to link mental professionals across great distances, aiding in their ability to consult psychiatric patients from afar without needing to see and diagnose patients in person.  More recently, even before the Covid pandemic, telemedicine has become popularized through the internet.  Telephone and video appointments with doctors have increased dramatically over the few decades.  Regardless, up until the beginning of the pandemic in 2020, in-person doctor’s visits were still largely regarded as the norm.

One of the reasons that this is the case is the Controlled Substances Act.  Under 21 U.S.C. 829(e), telemedicine conferences are generally not sufficient mediums through which doctors can prescribe controlled substances to their patients- an in-person consultation is required instead.[2]  The intent behind this was clear; the legislature wanted to insure the accuracy of prescription of controlled substances through in-person evaluations, since these substances carry risk of abuse.  Since medical professionals found in-person evaluations to be the most accurate assessment of whether they should prescribe these medications, this provision was written into law.

But the Controlled Substances Act does state instances in which there may be exceptions to this provision, one of which is illustrated in 21 U.S.C. § 802(54)(D).[3] This provision allows that, in the case of a national public health emergency (which is designated under 42 U.S.C. § 247(d)[4]), schedule II-schedule V substances, which include, but are not limited to oxycodone, methadone, and morphine.[5]

The Covid pandemic triggered this exception; in January of 2020, the Secretary of the Department of Health and Human Services issued a Public Emergency Declaration, and the DEA updated its website announcing the change to the telemedicine prescription policy.[6]  The statement stated that this change would be in effect for the duration of the public health emergency, or essentially, the duration of the pandemic.[7]  Essentially, this exception allows the prescription of controlled substances so long as the prescription is issued for a legitimate medical purpose by a practitioner acting in the usual course of her professional practice, the telemedicine communication is conducted using an audio-visual, real-time, two-way interactive communication system,  and the practitioner is acting in accordance with applicable federal and state law.[8]

So what does this mean for the future of telemedicine, and how will this affect patients who depend on medication that qualifies as a controlled substance? A few glaring issues almost immediately come to mind.  First and foremost, 21 U.S.C. § 802(54)(D) contains a provision that allows the exception to be limited to “patients located in [certain] areas, and such controlled substances, as the Secretary, with the concurrence of the Attorney General, designates.”[9]  This essentially allows the for the unequal application of this exception; as time goes on, if restrictions continue to lift, only certain areas may be able to take advantage of it.[10]  Secondly, and more obviously, the fact that a video conference is necessary to obtain a prescription or a refill disproportionately affects lower income communities, who may not have consistent access to internet or a webcam.  By forcing those in this position to choose between going without medication or risking exposure to the virus, the switch to telemedicine during pandemic times creates a massive disadvantage to an already vulnerable population, and this problem is not one that is easily solved.

Ultimately, the ability to prescribe controlled substances via telemedicine during the coronavirus pandemic does help to minimize the risk of infection with the virus to a large proportion of the population.  However, the way the law is structured also exposes many holes in its efficiency and allows for dramatically inequal application of the exception.  If this pandemic is to last much longer, the legislature should take a close look at how this section of the U.S. code can be made more accessible to all communities, and how they can improve upon it in the future, should they need to.

[1] Thomas S. Nesbitt, M.D., M.P.H., The Evolution of Telehealth: Where Have We Been and Where Are We Going? National Center for Biotechnology Information (2012) https://www.ncbi.nlm.nih.gov/books/NBK207141/.

[2] 21 U.S.C. § 829(e).

[3] 21 U.S.C. § 802(54)(D).

[4] 42 U.S.C. § 247(d).

[5] Controlled Substance Schedules (2020) https://www.deadiversion.usdoj.gov/schedules/.

[6] Thomas Sullivan, DEA Allows Controlled Substance Prescriptions to Be Issued Via Telemedicine (Apr. 9, 2020) https://www.policymed.com/2020/04/dea-allows-controlled-substance-prescriptions-to-be-issued-via-telemedicine.html.

[7] Id.

[8] Id.

[9] 21 U.S.C. § 802(54)(D)(ii).

[10] Thomas Sullivan, DEA Allows Controlled Substance Prescriptions to Be Issued Via Telemedicine (Apr. 9, 2020) https://www.policymed.com/2020/04/dea-allows-controlled-substance-prescriptions-to-be-issued-via-telemedicine.html.

Image Source: https://apnews.com/article/189668d9268243b2921a6a0764ddd511

Email Encryption – Just Do It!

By Ken Kajihiro

Email Encryption – Just do it!  Email encryption is quick and easy to install, easy to use, and provides enhanced client confidentiality.  In fact, the American Bar Association states “a lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”[1]  Email encryption will help you ensure client confidentiality.

In 2017, the American Bar Association stated that email encryption may be warranted in some circumstances.[2]  However, in modern times, with COVID-19, cyberattacks have greatly increased, “amplifying the threat to individuals and organizations.”[3]  Thus, email encryption is highly recommended.

Not all law firms and offices have an information technology support department to set up email encryption; however, all law firms and offices have a duty to protect confidential client information.[4]  Inadvertent or unauthorized disclosure could include an intercepted email by someone other than the intended recipient.  Imagine the damage caused if a client’s tax return, medical records, or even credit card payment information were intercepted by an unauthorized party.  Now, imagine the damage caused if a client’s confidential settlement agreement, merger and acquisition information, or intellectual property were intercepted by an unauthorized party.  The damage would be immense.  Email encryption will mitigate the risk of an inadvertent or unauthorized disclosure.

So, what are the options?  Let’s start with the free options.  If your law firm or office uses a Gmail-based email, you have got it easy!  Mailvelope, FlowCrypt, and LockMagic are only a few of the many free Google Extensions for email encryption.[5]  If your law firm or office uses an Outlook-based email, you have got it almost as easy!  Secure/Multipurpose Internet Mail Extensions (S/MIME) or Azure Rights Management Services (RMS) are some of your choices.[6]  Although, these email encryption options are free, they get the job done![7]

Next, the paid options.  Many of the paid options are paid because they combine email encryption with a private email server for maximum client confidentiality.[8]  Paying for a private email server removes the free-email-provider business incentive of making money with your data.[9]  ProtonMail, HushMail, and CounterMail are only a few of the many paid options.[10]  How much do these paid options cost?  Not much.  ProtonMail Professional is approximately $7.00 per month.[11]  HushMail for Law is approximately $10.00 per month.[12]  CounterMail Premium is approximately $5.00 per month.[13]

Overall, between the free options and paying approximately $5.00 to $10.00 per month, email encryption is well worth the time and money to ensure client confidentiality.  Again, email encryption is quick and easy to install, easy to use, and provides enhanced client confidentiality.  Email Encryption – Just do it!

[1] Model Rules of Pro. Conduct r. 1.6(c) (Am. Bar Ass’n 2020).

[2] ABA Comm. on Ethics & Pro. Resp., Formal Op. 17-477, at 5 (2017).

[3] COVID-19 Exploited by Malicious Cyber Actors, Cybersecurity and Infrastructure Security Agency (Apr. 8, 2020), https://us-cert.cisa.gov/ncas/alerts/aa20-099a.

[4] See Model Rules of Pro. Conduct r. 1.6(c) (Am. Bar Ass’n 2020).

[5] Stephanie Faris, Use These 4 Chrome Plugins to Encrypt Your Gmail Messages, Help Desk Geeks (Sept. 1, 2019), https://helpdeskgeek.com/free-tools-review/use-these-4-chrome-plugins-to-encrypt-your-gmail-messages.

[6] Bryan Peace, How to Encrypt Email in Microsoft Outlook, Virtru (Aug. 14, 2019), https://www.virtru.com/blog/encrypt-email-outlook.

[7] For instructions on how to install and use these email encryption methods, conduct a YouTube search for that specific email encryption method.

[8] See Alexander Fox, Are Private Email Services Worth the Money?, Make Tech Easier (June 13, 2019), https://www.maketecheasier.com/private-email-services-worth-the-money.

[9] Free email providers, such as Google, are free because they scan your email for targeted advertising purposes, to which they use to show you a personalized advertisement; although Google does not sell your information to third-parties, these third-parties pay Google to show advertisements to Google users who are most likely to purchase the advertiser’s product.  Privacy Policy: Why You’re Seeing an Ad, Google, https://support.google.com/ads/answer/1634057?p=privpol_whyad&hl=en&visit_id=637374566438757927-831058077&rd=1 (last visited Oct. 6, 2020).

[10] Fox, supra note 8.

[11] Select Your ProtonMail Account Type, ProtonMail, https://protonmail.com/signup?plan=business (last visited Oct. 6, 2020).

[12] Email and Encryption in One Solution, HushMail, https://www.hushmail.com/business/legal/features/?source=website&tag=page_business_legal,btn_features (last visited Oct. 6, 2020).

[13] Services, CounterMail, https://countermail.com/?p=services (last visited Oct. 6, 2020).

Image source: https://www.techadvisor.co.uk/how-to/internet/how-encrypt-email-3636950

New Friend on Social Media or Human Trafficker Looking to Make a Connection?

By Amanda Short

Do you know every person you add on social media? Do you know if your loved ones are adding strangers on social media? Human trafficking is the exploitation of persons for labor, services, or commercial sex.[1] Human trafficking is a form of modern-day slavery as victims are coerced and compelled against their will for the benefit of the trafficker.[2] As the modern age ushered in the use of social media, human traffickers have also adapted their tactics to recruit and sell victims through social media.[3] According to the Polaris Project, human traffickers use the following social media sites for recruitment purposes such as  Facebook, Instagram, Snapchat, and Kik.[4] Traffickers are also known to find victims through dating sites like Tinder, Grinder, and Plenty of Fish.[5]

Human trafficking has been reported in every state in the United States,[6] with a disproportionate effect on children and women.[7] Reports by human trafficking victims and survivors to the National Human Trafficking Hotline increased by 20% from 2018 to 2019.[8] A few common misconceptions about human trafficking are that victims can only be foreign nationals or immigrants from other countries, there must be some type of physical restraint or force to be trafficked, and victims are only coming from poverty situations.[9] The top five recruitment techniques for sex trafficking include an intimate partner or marriage proposition, familial relationship, job offers, posing as a benefactor, and false promises. [10]

As the population has grown to enjoy the many uses of social media, so have human traffickers. 72% of the American public is reported to use some type of social media.[11] Not only are Americans using social media, but these sites are being visited every day by users.[12] Many social media sites include privacy settings, but these settings may still allow strangers to send friend requests and direct messages. In a study by the Pewter Research Center, one in six teens responded that they have been messaged by a person they did not know which incited fear or discomfort.[13]

Human traffickers often use a “loverboy” tactic to attract victims through befriending young girls in public or online.[14]The loverboy trafficker will make the victim feel special through gifts and affection, but the relationship will change drastically once the victim is demanded to provide services.[15] In 2018, the Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA) was enacted by Congress to allow the civil and criminal liability of online marketplaces that knowingly participate in sex trafficking.[16] On April 28, 2020, the 14th Court of Appeals in Texas denied Facebook’s motion to dismiss in response to a suit alleging that Facebook facilitated enabled sex trafficking on its site.[17] The plaintiffs are 13, 14, and 16-year old girls that claim they were recruited by human trafficking pimps on Facebook or Instagram.[18]

You may be wondering what you can do to protect yourself and others from human traffickers and here are some tips from the Department of Homeland Security: (1) set your social media platforms to private so only real friends can see your information; (2) know whom you are talking to on social media sites and refrain from speaking with people who are not real friends; (3) only share photos of yourself that you would want to be seen by family, teachers, and employees; (4) don’t share personal information like your location or contact information; (5) do not meet up with any person you have only met online; and (6) report suspicious activity to law enforcement or a trusted adult if you are a minor.[19] Follow and share these tips to ensure yourself and others are safe from the dangers of human trafficking on social media platforms.

[1] Human Trafficking, U.S Dep’t of Just., https://www.justice.gov/humantrafficking (last visited Oct. 3, 2020).

[2] What is Human Trafficking?, The United States Department of Justice,  https://www.justice.gov/humantrafficking/what-is-human-trafficking(last visited Oct. 3, 2020).

[3]  Social Media in Recruitment, Polaris, https://polarisproject.org/human-trafficking-and-social-media/, (last visited Oct. 3, 2020).

[4] Id.

[5] Id.

[6] 2019 U.S. National Human Trafficking Hotline Statistics, Polaris, https://polarisproject.org/2019-us-national-human-trafficking-hotline-statistics/, (last visited Oct. 3, 2020).

[7]  Id.

[8] Id.  

[9] Common Myths and Misconceptions About Human Trafficking in the U.S., Polaris, https://humantraffickinghotline.org/sites/default/files/Common%20Myths%20and%20Misconceptions.pdf, (last visited Oct. 3, 2020).

[10] 2019 U.S. National Human Trafficking Hotline Statistics, Polaris, https://polarisproject.org/2019-us-national-human-trafficking-hotline-statistics/, (last visited Oct. 3, 2020) (stating the top five recruitment tactics for labor trafficking are job offers, false promises, smuggling-related,  familial relationships, and posing as a benefactor).

[11] Social Media Fact Sheet, Pew Research Ctr. (June 12, 2019), https://www.pewresearch.org/internet/fact-sheet/social-media/.

[12] Id.

[13] Mary Madden et al., Teens, Social Media, and Privacy, Pew Research Ctr. (May 21, 2013), https://www.pewresearch.org/internet/2013/05/21/teens-social-media-and-privacy/.

[14] Michelle Lillie, How Street Traffickers Recruit Young Girls, Human Trafficking Search (2014), https://humantraffickingsearch.org/how-street-traffickers-recruit-young-girls/.

[15] Id.

[16] Tom Jackman, Trump Signs ‘FOSTA’ Bill Targeting Online Sex Trafficking, Enables States and Victims to Pursue Websites, Wash. Post. (Apr. 11, 2018, 11:41 AM), https://www.washingtonpost.com/news/true-crime/wp/2018/04/11/trump-signs-fosta-bill-targeting-online-sex-trafficking-enables-states-and-victims-to-pursue-websites/.

[17] Will Neal, US Court Approves Sex-Trafficking Lawsuits Against Facebook, Organized Crime and Corruption Rep. Project (April 29, 2020, 4:16 PM), https://www.occrp.org/en/daily/12224-us-court-approves-sex-trafficking-lawsuits-against-facebook.

[18] Id.

[19] Online Safety, Homeland Sec., https://www.dhs.gov/blue-campaign/online-safety, (last visited Oct. 3, 2020).

Image Source: https://www.cpomagazine.com/data-privacy/new-research-study-shows-that-social-media-privacy-might-not-be-possible/

Finding, Prosecuting, and Punishing Hackers: Comprehensive Changes Likely Necessary

By Melisa Azak

In the past decade, data breaches have become more common with nearly 38 billion records reached in 2010.[1] To put that number in perspective, if all of those records belonged to American residents, each person would have nearly 116 accounts hacked.[2]

Some of the largest companies in the world have been plagued with how to deal with hackers. Equifax suffered one of the largest breaches in American history with 147 million Americans affected by their 2017 breach, which released highly sensitive information like credit cards, social security numbers, and dates of birth.[3] The company later settled with consumers for $671 million to resolve a multi-district consumer class action litigation, which created a resolution fund to restore “actual out-of-pocket losses related to the breach” as well as “other consumer benefits such as identity restoration services.”[4]

The particular danger of data breaches is that culpable hackers rarely get caught and prosecuted, leaving businesses and governments continuously vulnerable to targeted attacks. The Third Way, a center-left think tank, estimates that only 0.3% of cybercrime complaints are prosecuted and enforced.[5] Further, only one in six victims of cybercrime actually report to law enforcement, making the effective enforcement rate about 0.05%.[6]

And even when hackers are found, diplomatic relations can draw out complex prosecutions. Yevgeniy Aleksandrovich Nikulin, for instance, was found guilty earlier this year of numerous charges including computer intrusion and data theft eight years after he hacked LinkedIn and Drobox in 2012.[7] His defense team argued unsuccessfully that prosecutors relied improperly on misinformation from the Russian government and “asked the jury to consider the possibility that the U.S. government was prosecuting the wrong person.”[8] Nikulin’s case seems to demonstrate a broader tactic by the United States to send a firm message to foreign hackers that although they may rarely be found, they will be severely punished when caught.[9]

However, with breaches becoming more severe and ubiquitous, forceful prosecution may not be enough to stop hackers from obtaining sensitive information and hacking with near impunity. The Third Way recommends the United States adopt ten key strategies in order to meet the growing cybersecurity threat.[10] One of the key goals of the country, the think tank suggests, should be to expand law enforcement’s role in combatting hackers.[11] Currently, state and local law enforcement officers, prosecutors, and judges in digital/cybercrime investigations are grossly underfunded.[12] Further, less than a quarter of publicly funded crime labs offered “dedicated digital evidence support services.”[13] Effectively meeting the cybersecurity threat requires that the country allots more resources to already existing law enforcement organizations to meet the growing threat.

Some other key findings include amping up international efforts by seeking mutual legal assistance treaties and agreements, which are binding documents “typically bilaterally signed between the United States and other countries to formalize the parameters of their criminal justice cooperation.”[14] Given the global nature of successful hacks, these treaties can be “critical tools for sharing data and digital evidence in cyber investigations and prosecutions.”[15]

Another effective tactic may be to adopt the old adage “if you can’t beat them, join them.” A new start-up company called Synack provides ways for companies to discover their security flaws, and then turns those problems over to hackers “who use their powers for good” to see how they can use the flaws to breach the client, better preparing the client for future attacks from hackers who want use their powers for nefarious purposes.[16]

However, too offensive a cyber security approach may raise legal complications. Although the Justice Department officials find that the “the optics would be ‘awfully poor’ if the department prosecuted a company that had retaliated against foreign hackers”, the Computer Fraud and Abuse Act prohibits any form of hacking.[17] Many cybersecurity firms “hack back” by creating “honeypots” or “caches of documents that fool hackers into think they are inside a target’s system” so they can trace the identities of hackers from their digital trails.[18] Considering the growing cyber security threat and the need for new strategies to meet it, the Act may have to be modernized to allow companies to add “hacking back” to their arsenal of tools of cybersecurity defense.[19]

The growing cyber security threat is not unlike 9/11. Before 9/11, the government struggled with “lack of prioritization of the [terrorist] threat, competing priorities and immense bureaucratic challenges.”[20] If the United States wants to avoid repeating history’s mistakes and avoid a “digital” 9/11 incident, it must take an unprecedented, comprehensive approach and meet elusive hackers head on.

[1] Megan Leonhardt, The 10 Biggest Data Hacks of the Decade, Make It, CNBC (Dec. 27, 2019 9:01 AM), https://www.cnbc.com/2019/12/23/the-10-biggest-data-hacks-of-the-decade.html.

[2] Id.

[3] Id.

[4] See Press Release, Equifax Announces Comprehensive Consumer Settlement Arising from 2017 Cybersecurity Incident (Jul. 22, 2019), https://investor.equifax.com/news-and-events/press-releases/2019/07-22-2019-125543228.

[5] Mieke Eoyang et al., To Catch a Hacker: Toward a Comprehensive Strategy to Identify, Pursue, and Punish Malicious Cyber Actors, Third Way 7 (Oct. 29, 2018), https://thirdway.imgix.net/pdfs/override/To_Catch_A_Hacker_Report.pdf.

[6] Id.

[7] Hannah Albarazi, Russian LinkedIn, Dropbox Hacker Gets 7-Year Sentence, Law360 (Sep. 29, 2020 11:26 PM), https://www.law360.com/articles/1315137.

[8] Hannah Albarazi, Russian Convicted in LinkedIn, Dropbox Cyberattacks, Law360 (Jul. 10, 2020 9:13 PM), https://www.law360.com/articles/1291090?scroll=1&related=1.

[9] See supra note 7 (“Assistant U.S. Attorney Michelle Kane sought out a tougher sentence; one that would send a message to other foreign hackers that they cannot act with impunity.”).

[10] See supra note 5 at 2.

[11] Id. at 13–15.

[12] Id. at 15.

[13] Id.

[14] Id. at 20.

[15] Id. at 20–21.

[16] See Kate Fazzini, Why Some of the World’s Top Cybersecurity Hackers Are Being Paid Millions to Use Their Powers for Good, Disrupter 50, CNBC (May 18, 2019 10:00 AM), https://www.cnbc.com/2019/05/17/cybersecurity-hackers-are-paid-millions-to-use-their-powers-for-good.html.

[17] See Nicholas Schmidle, The Digital Vigilantes Who Hack Back, New Yorker (Apr. 30, 2018), https://www.newyorker.com/magazine/2018/05/07/the-digital-vigilantes-who-hack-back.

[18] Id.

[19] Id.

[20] See supra note 5, at 26.

Image Source: https://newconomy.media/news/hacker-claims-to-steal-personal-data-of-840-million-users

Loot Boxes: A New Way to Gamble

By: Megan Haugh

On May 6, 2020, Epic Games announced Fortnite had over 350 million registered players.[1]  Like Minecraft (a video game played monthly by 126 million people),[2] Fortnite is a household name.[3]  Fortnite, similar to Suzanne Collins’s The Hunger Games, is a game of survival.[4]  Fortnite players gather resources, create tools or weapons, and fight to stay alive.[5]  A popular feature in Fortnite—and other mainstream video games—is the “loot box.”[6]  In 2019, the University of York reviewed the most popular video games on Steam (an online video game retailer) and found that seventy-one percent contained these loot boxes.[7]  While today’s popular video games (such as the FIFA franchise, Fortnite, and Overwatch) widely use loot boxes, many people liken the virtual loot box to a Las Vegas slot machine.[8]  Like the gambler who pays to play the slot machine without knowing the outcome, today’s gamer purchases a loot box without knowing the items she will receive.  With many players under the age of eighteen, should the government regulate loot boxes in video games like gambling in casinos?

A loot box is an optional in-game purchase that provides a randomized reward.[9]  The modern loot box is like the old, yellow mystery box in Nintendo’s Super Mario Brothers.[10]  In that video game, a person tapped the mystery box and Mario or Luigi received a randomized special ability (such as shooting fireballs at enemies).[11]  Like the mystery box in Super Mario Brothers, today’s loot box provides a randomized reward, such as a skin (i.e. a new outfit for a player’s avatar) or a catchphrase.[12] The crucial difference between the mystery box in Super Mario Brothers and the loot box in today’s video games is money.  Today, a player must purchase the loot box (with either in-game currency or real currency) to reap the randomized reward.[13]  By 2022, the video game industry anticipates $50 billion in revenue from loot boxes.[14]

As loot box purchases rise, lawmakers are taking notice.[15]  In both Belgium and the Netherlands, lawmakers moved to ban loot boxes.[16]  In Australia, lawmakers suggested that video games with loot boxes receive an “R” rating.[17]  However, people disagree on whether immediate regulatory action is appropriate.[18]  While some advocate for further studies,[19] others (like Republican Senator Josh Hawley) see the correlation between loot boxes and gambling as a justification for immediate regulatory action.[20]  In May of 2019,  Senator Hawley introduced a bill that bans loot box sales to minors.[21]  Conceivably, a minor—lacking impulse control and financial judgement—is more susceptible to the “loot box effect”[22] (i.e. the compulsion to keep playing the odds).  In an NPR interview, Senator Hawley stated “[Video game creators] need to be upfront about what their games are actually doing, and they need to stop practices that intentionally exploit children.”[23]

Compared to traditional gambling, a loot box costs as much as an average lottery ticket.[24]  For example, in Overwatch (a first-person shooter game) a person pays $9.99 for eleven loot boxes.[25]  Unlike a lottery ticket though, a minor can purchase a loot box.  An easily accessible and inexpensive loot box (like the lottery ticket) can trigger addictive behaviors in an individual.[26]  Many players report spending hundreds to thousands of dollars on these in-game purchases.[27]  Some adults even claim that their children used credit cards without their knowledge to purchase loot boxes.[28]  In my opinion, there is no significant difference between the gambler who pays to play the slots and the gamer who purchases a loot box.  In both scenarios, a person is paying to play her odds.  The virtual loot box ought to be regulated.

[1] See @FortniteGame, Twitter (May 6, 2020, 10:01 AM), https://twitter.com/FortniteGame/status/1258079550321446912.

[2] See Tom Warren, Minecraft Still Incredibly Popular as Sales Top 200 Million and 126 Million Play Monthly, The Verge (May 18, 2020, 9:00 AM), https://theverge.com/2020/5/18/21262045/minecraft-sales-monthly-players-statistics-youtube.

[3] See Nick Statt, Fortnite is Now One of the Biggest Games Ever with 350 Million Players, The Verge (May 6, 2020, 1:54 PM), https://theverge.com/2020/5/6/21249497/fortnite-350-million-registered-players-hours-played-april.

[4] See Sarah LeBoeuf, What is ‘Fortnite’?: A Look at the Video Game that has Become a Phenomenon, NBC News (Jun. 30, 2018 8:27 AM), http://nbcnews.com/tech/tech-news/what-fortnite-look-video-game-has-become-phenomenon-n887706.

[5] See id.

[6] See Isobel Asher Hamilton, There’s a Debate Raging in Video Games Over Whether Loot Boxes Should be Classified as Gambling, Business Insider (July 5, 2020, 5:22 AM), https://www.businessinsider.com/classifying-video-game-loot-boxes-as-gambling-2020-7.

[7] See id.

[8] See id.; see also Julie Steinberg, Loot Box Lawsuits Liken Transactions to Slot Machine Gambling, Bloomberg Law(Sept. 1, 2020, 1:57 AM), https://news.bloomberglaw.com/product-liability-and-toxics-law/loot-box-lawsuits-liken-transactions-to-slot-machine-gambling.

[9] See S. 1629, 116th Cong. § 2 (2019).

[10] See Ben Johnson, Loot Boxes are a Lucrative Game of Chance, But are They Gambling, NPR: All Things Considered(Oct. 10, 2019, 5:08 PM), https://www.npr.org/2019/10/10/769044790/loot-boxes-are-a-lucrative-game-of-chance-but-are-they-gambling.

[11] See id.

[12] See id.

[13] See id.

[14] See id.

[15] See id.

[16] See id.

[17] See id.

[18] See Hamilton, supra note 6 (stating “‘We’re really only in the early phases of gathering scientific research evidence about the nature of loot box effects,’ Professor Pete Etchells . . . told Business Insider. ‘What we really need is a clearer and stronger evidence base before legislation is changed.'”)

[19] See id.

[20] See Johnson, supra note 10.

[21] S. 1629, 116th Cong. § 2 (2019).

[22] See Steinberg, supra note 8.

[23] See Johnson, supra note 10.

[24] See id.

[25] See id.

[26] See id.

[27] See id; see also Steinberg, supra note 8.

[28] See Steinberg, supra note 8.

Image Source: https://techcrunch.com/2018/09/17/loot-boxes-face-scrutiny-from-an-international-coalition-of-gambling-authorities/?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_sig=AQAAAK4VebthFFKiNJaXSq2noSSUje6H0QKvGLVhnBlpzlBGYPVDmKi_7ft0v2Kb1s8H1CZbs3A84vrQgF2vS_HXkJN67tJwZyLSi7wmPpAcUwmITpoa9NToAzpVp3b6HcjfCERhgkt2nC-0NjS6VH17EuQjjZw81SHdauvFpeE20fog

COVID-19 Tracking Apps and the Attack on Student Privacy

By: Christopher Vinson

As COVID-19 continued to spread in the United States throughout the summer months, the conversation shifted towards how to safely reopen universities in the fall. In response, universities implemented a variety of safety measures from social distancing to mandatory mask-wearing. Universities have also been keen to utilize technology to help avoid outbreaks among their student populations. One of the more interesting tools used by colleges and universities are apps that can be used for COVID-19 symptom screening and contact tracing.

These apps are seen by many universities as the key to an effective reopening. Many colleges across the nation have either developed their own apps or are using apps developed by third parties. Rutgers University has taken the step of creating their own apps.[1] The apps allow for students, faculty, and staff to self-screen for COVID-19 symptoms before traveling to campus and allow for effective contact tracing to take place.[2]

Other universities have used contact tracing apps developed using tools from Google and Apple.[3] Stockton University in New Jersey has piloted an app that uses Bluetooth to sense whether someone came into close proximity for a specific period of time with someone that contracted COVID-19.[4] A similar app is being used at the University of Alabama at Birmingham.[5] Their app utilizes the signal strength between smartphones to determine whether someone was within six feet for at least fifteen minutes of someone else who contracted COVID-19.[6]

While undoubtedly innovative, the proliferation of these apps has led to increased concerns over privacy. Countries such as Norway have suspended the use of COVID-19 tracking apps.[7] The app used in Norway uploaded live GPS coordinates of its users to a central server.[8] Uploading information to a central server increases the risk of that information being stolen or reused in the future. Additionally, providing the government with live data of their locations understandably worried citizens. The fear is that it may lead to unintended consequences of surveillance outside of COVID-19 tracking.

Even more pressing are the data privacy concerns. A recent study found that thirty out of fifty contact tracing apps available on Google devices access invasive data such as call history, the phone microphone, and the phone camera.[9] Out of those thirty, only sixteen took the additional step of making that data anonymous.[10]The failure to take even the most basic steps for privacy raises serious concerns regarding an individual’s civil rights.

Certain schools are attempting to combat privacy concerns through other methods of location data collection. At the University of California, Irvine, a group of researchers wanted to calm those concerns through the development of an app that repurposes data already collected by the school.[11] Their system would rely on tracking devices connected to the campus Wi-Fi to determine if social distancing was being adhered to.[12]Collecting data in this manner avoids the need to share personal information, further protecting users.[13]

As mentioned above, other schools are hoping to use Bluetooth to assist in COVID-19 tracking.[14] This is more privacy friendly since this information is stored as anonymized beacons only on a user’s cellphone.[15]Further, this system operates without noting where the individual device is exactly located.[16] However, other schools have opted for tracking student locations in real time.[17] Regardless, many of these apps are a condition of enrollment and place students in a position where they have no choice but to download the apps.

All these methods beg the question of whether the desire to curb the spread of COVID-19 is infringing on certain privacy rights. Schools risk being seen as prioritizing their finances over the privacy of their student body. The intrusion may be justified for now in the name of public health, but what will happen with all this data in the future? The potential for serious civil rights violations exists and may cause more trouble for these schools in the future than the benefit derived from reopening today.

[1] Hayley Slusser, Rutgers Creates Application for Coronavirus Symptom Screening, Contact Tracing, The Daily Targum (Sep. 28, 2020), https://www.dailytargum.com/article/2020/09/rutgers-creates-applications-for-coronavirus-symptom-screening-contact.

[2] Id.

[3] See Natalie Schwartz, Colleges Look to Apps that Screen for Virus Symptoms and Trace Contacts, The Education Dive (Aug. 12, 2020), https://www.educationdive.com/news/colleges-look-to-apps-that-screen-for-virus-symptoms-and-trace-contacts/583387/.

[4] Molly Bilinksi, Stockton University Among Colleges Piloting COVID-19 Exposure-Tracing App, The Press of Atlantic City, (Sep. 24, 2020), https://pressofatlanticcity.com/news/local/stockton-university-among-colleges-piloting-covid-19-exposure-tracing-app/article_b4bd39c7-c063-559a-9942-ed17ba781593.html.

[5] Schwartz, supra note 3.

[6] Id.

[7] See Thomas Brewster, COVID-19 Tracking Apps ‘A Privacy Trash Fire’ as Norway Nixes its Own, Forbes (Jun. 16, 2020, 6:26 AM),  https://www.forbes.com/sites/thomasbrewster/2020/06/16/covid-19-tracking-apps-a-privacy-trash-fire-as-norway-nixes-its-own/#6e6ec65341b4.

[8] Id.

[9] See Tanusree Sharma & Masooda Bashir, Use of Apps in the COVID-19 Response and the Loss of Privacy Protection, Nature Med. (May 26, 2020) https://www.nature.com/articles/s41591-020-0928-y#citeas.

[10] Id.

[11] See Schwartz, supra note 3.

[12] See id.

[13] See id.

[14] See Bilinski, supra note 4.

[15] Jeremy Hsu, Contact Tracing Apps Struggle to be Both Effective and Private, IEE Spectrum (Sep. 24, 2020, 10:00 AM),https://spectrum.ieee.org/biomedical/devices/contact-tracing-apps-struggle-to-be-both-effective-and-private; Elisa Miebach, War Between Privacy and Efficiency, Bloomberg Businessweek (Sep 8, 2020, 1:01 AM), https://www.bloomberg.com/news/articles/2020-09-08/coronavirus-pandemic-covid-19-apps-grapple-with-privacy-and-efficiency.

[16] Schwartz, supra note 3.

[17] See id.

Image Source: https://economictimes.indiatimes.com/tech/software/covid-19-tracing-apps-face-privacy-concerns/mired-in-controversies/slideshow/77783271.cms

Zoom Bombing: Are We Truly Safe in Our Digital Meeting Space?

By Joleen Traynor

In the midst of the COVID-19 pandemic, businesses, schools, and other groups have moved to remote learning and work. In the course of this shift, Zoom has been a popular platform for video calls, meetings, and lectures. However, this has introduced a new avenue for hackers and unwelcome parties to hijack these online meetings, a practice known as “Zoom bombing”. This involves hackers joining online meetings throughout the world and sharing disturbing, and even illegal, images and videos with those in the meeting. Zoom bombing “refers to a form of cyber harassment reported by some app users, who have reported that some of their calls have been hijacked by unidentified individuals and trolls who spew hateful language or share graphic images.”[1] “Anyone who has a link to a public meeting can join. Links to public Zooms are traded in Facebook Groups and Discord chats, and are easily discoverable on Twitter and public event pages.”[2] These public meetings are fairly easy to find and access, providing ample opportunities for hijackers to enter meetings. This phenomenon has become so severe so quickly, even the FBI is getting involved. “The FBI has received multiple reports of conferences being disrupted by pornographic and/or hate images and threatening language.”[3]

The sudden explosion in popularity of Zoom is part of the reason this phenomenon exists. “Before the coronavirus pandemic, Zoom had 10 million daily users. By April, it claimed to have 300 million – before backtracking to admit the statistic is really 300 million ‘meeting participants’ per day.”[4] With this increased usage, Zoom has released updated guidelines for safer use of the platform to prevent these Zoom bombing incidents. Zoom recommends taking safety precautions such as creating and using a secure meeting room, creating waiting rooms, and only allowing the host to screen share.[5]

Police departments have also stepped up their game in handling incidents of Zoom bombing. In early September, a nineteen-year-old man was arrested for making threats while interrupting a University of Houston remote class.[6]Another individual was arrested and charged with computer crimes earlier this year in Connecticut.[7] It is important that these threats are taken seriously and swift action is taken against perpetrators.

Finally, users may face an internal threat when using Zoom for meetings. It was recently discovered that Zoom was sharing user information and data with Facebook, “even data on people who are not Facebook users.”[8] Zoom has ceased sharing this information once this was discovered[9], but this just shows that there is still work to be done in order to better secure our online meeting space.

Looking ahead, online meeting and learning spaces will likely be the new normal, at least for the immediate future. In an increasingly digital world, it is more important than ever to secure our online meeting spaces, and to ensure that there are safe, reliable, and secure ways for people to meet and communicate remotely. This is a safety issue that affects us all, and online meetings, on Zoom or otherwise, are likely here to stay.

[1] Dakin Andone, FBI warns video calls are getting hijacked. It’s called ‘Zoombombing’, CNN (Apr. 2, 2020, 5:00 PM), https://www.cnn.com/2020/04/02/us/fbi-warning-zoombombing-trnd/index.html.

[2] Taylor Lorenz, ‘Zoombombing’: When Video Conferences Go Wrong, N.Y. Times (Apr. 7, 2020), https://www.nytimes.com/2020/03/20/style/zoombombing-zoom-trolling.html.

[3] Press Release, FBI, FBI Warns of Teleconferencing and Online Classroom Hijacking During COVID-19 Pandemic (Mar. 30, 2020), https://www.fbi.gov/contact-us/field-offices/boston/news/press-releases/fbi-warns-of-teleconferencing-and-online-classroom-hijacking-during-covid-19-pandemic.

[4] Sebastian Meineck and Paul Schwenn, ‘Zoom Bombers’ Are Still Blasting Private Meetings With Disturbing and Graphic Content, Vice (June 10, 2020, 8:42 AM), https://www.vice.com/en_us/article/m7je5y/zoom-bombers-private-calls-disturbing-content.

[5] Security at Zoom, https://zoom.us/security (last visited Sept. 20, 2020).

[6] Christina Carrega, Texas man arrested for ‘Zoombombing’ a university class lecture with a bomb threat, CNN (Sept. 8, 2020, 5:30 PM), https://www.cnn.com/2020/09/08/us/university-zoombombing-isis-arrest/index.html

[7] Teen Arrested After ‘Zoom Bombing’ High School Classes, NY Post, (April 8, 2020), https://nypost.com/2020/04/08/teen-arrested-after-zoom-bombing-high-school-classes/.

[8] Shannon Bond, A Must For Millions, Zoom Has A Dark Side — And An FBI Warning, NPR (Apr. 3, 2020, 5:00 AM), https://www.npr.org/2020/04/03/826129520/a-must-for-millions-zoom-has-a-dark-side-and-an-fbi-warning.

[9] Id.

Image Source: https://www.theburnin.com/technology/what-is-zoom-bombing-how-to-stop-it-2020-3/

Page 32 of 84

Powered by WordPress & Theme by Anders Norén