Cyberlaw

How should damages be assessed for privacy and cybersecurity breaches

2023-04-10T17:27:00.003+10:00

Listen to this podcast where I discuss how damages should be assessed in privacy and cybersecurity lawsuits.

The Lawyers Weekly Show host Jerome Doraisamy speaks with Professor John Swinson, who teaches cyber security law and privacy law at The University of Queensland, about growing awareness of data and cyber security issues and subsequent legal claims.

Amended Privacy Law in Australia

2022-11-29T17:11:00.003+10:00

AUSTRALIAN PRIVACY AMENDMENT BILL. The Privacy Legislation Amendment (Enforcement and Other Measures) Bill 2022 has now passed both houses of Parliament, and will be presented to the Governor General for assent. The amendment adds substantial penalties for serious or repeated breaches of the Australian Privacy Act.

Domain Name Disputes

2022-11-06T19:01:00.000+10:00

With the recent introduction of "direct registration" in the Australian domain name space (e.g. anyone with a connection to Australia can register domain names such as lawprofessor.au or telstra.au), I predict that there will be a sudden uptick of auDRP disputes. Even though .au did not launch until October 2022, as at today, three auDRP complaints have already been lodged: cointre.au, rockypoint.au and magnaflow.au.

Some law firms are specialising in this area, such as Cooper Mills.

Law Firm Phishing

2022-09-03T10:31:00.001+10:00

A good article about how a NY law firm (Debevoise) attacked a phishing website but attacking the domain name.

https://www.reuters.com/legal/litigation/debevoise-fries-phishers-cyberpiracy-case-take-heed-law-firms-2022-08-31/

Some WIPO decisions regarding Australian law firms:

https://www.wipo.int/amc/en/domains/decisions/text/2017/d2017-1721.html

https://www.wipo.int/amc/en/domains/search/text.jsp?case=D2015-1452

Google not a publisher of newspaper article that is indexed in search engine results

2022-08-17T13:53:00.002+10:00

Google LLC v Defteros [2022] HCA 27, decided 17 August 2022 by High Court of Australia.

The High Court decided that for the purposes of defamation law, Google is not a publisher of a newspaper article when providing a link to the article in search engine results and a short summary of the article.

"The question which arises here is whether providing search results which, in response to an enquiry, direct the attention of a person to the webpage of another and assist them in accessing it amounts to an act of participation in the communication of defamatory matter. ...

It is not suggested that [Google] itself communicated the defamatory matter in the Underworld article, which appeared on The Age's website. Unlike the defendants in the innocent dissemination cases, [Google] did not do so by selling, distributing or otherwise disseminating the matter complained of. ...

The question of whether the appellant could be said to participate comes down to the assistance provided by the hyperlink to move to another webpage. This is not a strong basis for liability and it finds no support in existing authority in Australia or recent cases elsewhere."

Facebook Data Leak

2022-08-15T12:09:00.003+10:00

An interesting detailed article about the Facebook data leak:

https://www.digitalshadows.com/blog-and-research/the-facebook-data-leak-explained/

The leak took place in 2019.

"Initially, attackers offered the data at quite a steep price. As the data began circulating in open and gated cybercriminal forums in 2020, a listing on Russian-speaking cybercriminal forum XSS in August 2020 advertised the sale of this data for “only” USD 25,000 (see Figure 2). Listings were identified across several other forums, such as Raidforums. The sheer size of the data leakage and the wide geography it covered (106 countries) made the data a gold mine for cybercriminals. Therefore, these listings often caught the interest of multiple threat actors."

Proposed Digital Services Act

2022-07-25T12:00:00.001+10:00

An Australian senator proposes a Digital Services Act relating to blockchain technology.

https://www.andrewbragg.com/post/address-at-blockchain-week-2022

NY NFT Trademark Lawsuit by Hemmes regarding Birkin bag NFT art

2022-07-11T02:30:00.025+10:00

A decision from Judge Rakoff from the SDNY regarding a motion to dismiss in a case involving NFTs. See https://images.law.com/contrib/content/uploads/documents/389/164932/Hermes-v.-Rotschild.Rakoff-order-on-MTD-1.pdf

The court denied the motion to dismiss.

Mr Rotschild, the defendant, created a digital image of the Hermes Birkin bag, with a baby fetus inside the bag. It sold for $23,500. He also created images of faux fur Birkin bags, and 100 numbered NFTs that sold for about the price of a real world Birkin bag.

Hemmes sued Rotschild for trademark infringement. Rotschild says the NFTs are art that have First Amendment protection. He also said that his use of MetaBirkin for the title of his art had First Amendment protection.

The court said that there were too many factual issues to determine (e.g. is the NFT art?) to dismiss the case against Rotschild without having a trial.

The Top Ten Developments in US Patent Law over the past 50 years

2022-07-10T09:32:00.002+10:00

Professor Don Chisum is a leader in U.S. patent law. He has recently written this excellent article:

Fifty Years of Patent Law: The Top Ten Developments

https://chisum-patent-academy.com/wp-content/uploads/ChisumTop10in50Article6July2022.pdf

Well worth reading if you are interested in patent law and the business of patents.

Lawsuit in Victoria against Google over false reviews for artifical plant company

2022-07-09T09:33:00.016+10:00

The Age newspaper has this story regarding false reviews of an artificial patents business, that alleged were posted when the business had a dispute with a moving company.

See https://amp.theage.com.au/national/victoria/david-and-georgina-had-a-dispute-with-their-removalists-four-years-later-they-ve-taken-google-to-court-20220707-p5azub.html

Interestingly, they are suing Google.

Similar story to the Titan Sheds dispute that ended up in the Federal Court in Brisbane a few years back. There are about 3 court decisions. One involved trying to get evidence from Google, but because Google was offshore, this was difficult. See Note

OSC enforcement against crypto asset trading platforms

2022-06-30T12:01:00.007+10:00

The Ontario Securities Commission (OSC) announced this month the outcome of two successful enforcement actions against non-compliant crypto asset trading platforms.

ACCC to Review Facebook, Google and other large digital platforms

2022-02-28T11:36:00.002+10:00

The ACCC is seeking views from consumers, businesses and other parties on options for legislative reform to address concerns about the dominance of digital platforms.

A discussion paper, released today, outlines options for addressing harms to competition, consumers, and business users in a range of areas dominated by large digital platforms, including social media, search, app marketplaces, general online retail marketplaces and ad tech.

Facebook Sued for $150 billion by Rohingya refugees

2021-12-08T11:22:00.000+10:00

Rohingya refugees are suing Facebook over its own admitted failure to stop the spread of hate speech that contributed to violence in Myanmar.

A case has been filed in the USA. Because of s230 of the Communications Decency Act, the plaintiffs are asserting that Myanmar law should apply, not U.S. law.

Commentators have stated it is a difficult case for the refugees.

Chinese cyberattacks

2021-12-07T11:23:00.001+10:00

As experts say the number of cyber attacks being directed at Australia have reached a disturbing level, it can now be revealed that Chinese hackers came within minutes of shutting down two Queensland power stations . Had the attack been successful it could have been lights out for some 3 million homes.

Australian Social Media Law proposed

2021-12-01T07:35:00.009+10:00

The Australian Government has just released a proposed law to deal with defamation and social media comments.

See Social Media (Anti-Trolling) Bill.

https://www.ag.gov.au/legal-system/social-media-anti-trolling-bill

The AG's office provides the following information:

"The challenges of responding to anonymous online trolling became clear after the High Court's decision in Fairfax Media Publications v Voller [2021] HCA 27, handed down in September 2021. The Voller decision shows that Australians who maintain a social media page may be exposed to defamation liability for defamatory comments posted on the page by others – even if they are not aware of those defamatory comments.

To urgently address this situation the Australian Government has developed the Social Media (Anti-Trolling) Bill 2021. To address the implications of the Voller decision, the Bill will protect Australians from defamation liability that could arise if they allow users to comment on their social media page."

See my comments in The Australian blog: "Law professor supports anti-trolling proposals"

Crypto Regulation

2021-11-13T14:39:00.003+10:00

In an interesting article about Crypto Exchange regulation in the WSJ.

"The world’s fastest-growing major financial exchange has no head office or formal address, lacks licenses in countries where it operates and has a chief executive who until recently wouldn’t answer questions about his location."

The biggest exchange is Binance, which has no fixed address it seems. Creates interesting internet jurisdiction issues.

UK Cookies Case

2021-11-11T07:51:00.001+10:00

An interesting case today from the UK: Lloyd v Google

See note here: https://www.mishcon.com/news/the-developing-law-on-data-protection-group-claims

"This is of course a landmark judgment for data protection claims, but also more generally for consumer actions brought on an "opt-out" basis. The claimant, Mr Lloyd, represented a group of more than 4 million iPhone users, and alleged, on their behalf, that Google's historic deployment of cookies on the Safari browser had been not just unlawful, but that it meant that Google should pay compensation to everyone who had received cookies on that basis."

The court found for Google.

How the FBI obtains access to telephone information

2021-11-01T18:57:00.001+10:00

This is a good article. It provides insights on what exactly each carrier collects, a more recent run-down of how long each United States telecom retains certain types of data for, and images of the tool the FBI makes available to law enforcement agencies across the country to analyze cell phone tower data.

Here's the FBI's Internal Guide for Getting Data from AT&T, T-Mobile, Verizon

https://www.vice.com/en/article/m7vqkv/how-fbi-gets-phone-data-att-tmobile-verizon

Is cybersecurity insurance worth the risk?

2021-10-29T08:01:00.004+10:00

A good source of information about cybersecurity risks is the Information Security Forum (ISF).

For example, ISF recently published an interesting report regarding cybersecurity insurance. Is cybersecurity insurance worth the risk? See Report.

Reverse Domain Name Hijacking Lawsuit Dismissed in USA

2021-10-28T07:52:00.001+10:00

An interesting legal decision regarding the domain name pocketbook.com was handed down by a United States district judge this month. The case arose out of this NAF UDRP decision from 2019 that decided for the domain name owner: https://www.adrforum.com/DomainDecisions/1857174.htm

The court reviewed the Anticybersquatting Consumer Protection Act (ACPA) prohibits reverse
domain name hijacking, which occurs when “overreaching trademark owners” interfere with a
domain name registrant’s lawful use of a domain name.

The court decided that the requirement that the domain name “has been suspended, disabled, or transferred” does not include temporary suspension during the pendency of a UDRP case.

See decision here https://domainnamewire.com/wp-content/pocketbook.pdf and case note here.

Privacy Act Review in Australia

2021-10-25T20:02:00.004+10:00

The Australian Attorney-General's Office has released the Privacy Act Review Discussion Paper and seeks comments before 10 January 2022. The discussion paper considers these matters:

Scope, application & effectiveness of the Privacy Act
Direct rights of action by individuals
Statutory tort for invasion of privacy
Notifiable data breach scheme effectiveness
Enforcement power effectiveness
Aspects of a certification scheme

https://consultations.ag.gov.au/rights-and-protections/privacy-act-review-discussion-paper/

Concurrently, the AG's Office is holding this consultation at the same time as a consultation on the exposure draft of the Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021 (Online Privacy Bill).

The Online Privacy Bill addresses the pressing privacy challenges posed by social media and certain other online platforms.

The Privacy Act Review seeks to build on the outcomes of the Online Privacy Bill to ensure that Australia's privacy law framework empowers consumers, protects their data and supports the Australian economy.

Non Specialist Lawyers Doing Domain Name Disputes - A big risk!

2021-10-24T09:07:00.002+10:00

In my opinion, there is a big risk using a non-specialist lawyer to run a domain name dispute under the UDRP or auDRP. A recent example is the Brisbane law firm Dowd & Co running a domain name dispute under the UDRP for a complainant. Not only were they unsuccessful, there was a finding of Reverse Domain Name Hijacking (RDNH) against the Complainant, and resulting bad publicity.

The Panel stated:

"It is evident from the Complaint in this case that the Complainant has not fully appreciated the requirement to prove both registration and use in bad faith.... This Complaint was therefore doomed to fail at the outset as the Complainant could not prove registration in bad faith. The Complainant and/or its legal counsel should have appreciated this. A passing familiarity with Policy precedent on this issue (for example, as described in section 3.8 of the WIPO Overview 3.0) is something that the Panel is entitled to expect from parties represented by legal counsel, and it is lacking here. Such familiarity would have caused the Complainant to be aware of its difficulties in pursuing the Complaint. A modicum of additional research would also have indicated to the Complainant that the Respondent itself had created and run a business by the name of “Streamline Servers”, well before 2009, and it therefore had a bona fide basis for registration of the disputed domain name."

Not something good to have on the public record against you.

See GSL Networks Pty Ltd. v. Domains By Proxy, LLC / Alex Alvanos, Bobservers, WIPO Case No. D2021-2255

See Domain Wire

Cyber Insurance

2021-10-19T06:03:00.001+10:00

An excellent paper on Cyber Insurance in Australia: "Underwritten or Oversold". Well worth reading.

From the CSCRC (the Cyber Security Cooperative Research Centre).

Affiliate Program Advertisers Must Take Care Not to be Misleading

2021-10-18T09:49:00.001+10:00

Many businesses run affiliate programs. That is, a publisher or blogger will receive a commission for referring people to the website of the business.

For example, The Circle is a good novel that considers the future of social media, and I will receive a small commission if you buy The Circle from Amazon via this link: https://amzn.to/3pawSJK Or better still, buy my book! https://amzn.to/3vl85Dy

There are even affiliate programs for bitcoin purchases https://app.bitcoinlatinum.com/invite?ref=UD03527

Amazon recently emailed the following to their affiliate program members (which they call an Associates Program), to ensure that the affiliate is not acting in a misleading way (which is not uncommon):

This is a recurring reminder that any time you share an associate link, it’s important to disclose that to your audience. They will trust you more if you are transparent about where you are directing them and why. To meet the Associate Program’s requirements, you must (1) include a legally compliant disclosure with your links and (2) identify yourself on your Site as an Amazon Associate with the language required by the Operating Agreement.

To comply with Federal Trade Commission (FTC) regulations, your link-level disclosure must be:

1. Clear. A clear disclosure could be as simple as “(paid link)”, “#ad” or “#CommissionsEarned”.

2. Conspicuous. It should be placed near any associate link or product review in a location that customers will notice easily. They shouldn’t have to hunt for it.

In addition, the Operating Agreement requires that the following statement clearly and conspicuously appears on your Site: “As an Amazon Associate I earn from qualifying purchases.” For social media user-generated content, this statement must be associated with your account.

To read more about the FTC Endorsement Guides, visit: https://www.ftc.gov/tips-advice/business-center/guidance/ftcs-endorsement-guides-what-people-are-asking#affiliate.

Visit this page on AC to bookmark this information about disclosures.

LinkedIn to Pull Out of China

2021-10-17T18:13:00.013+10:00

LinkedIn said it would end service in China after the platform censored posts to keep operating but still came under government scrutiny.

"The operating environment in China has also become more difficult. Since President Xi Jinping took the reins of the Communist Party in 2012, he has repeatedly cracked down on what can be said online. Presiding over the rising power of the Cyberspace Administration of China, the country’s internet regulator, Mr. Xi turned China’s internet from a place where some sensitive topics were censored to one where critics face arrests for a constantly shifting set of infractions, like jokes at Mr. Xi’s expense.

See NYTimes and South China Morning Post