Privacy and Data Security Section Updates and Library How-To

By Taylor Ey

Hello, section members!

Happy spring! We are beginning to add resources to our online library, including recordings of two recent discussions from last week: (1) the joint YLD/PDS specialist discussion from March 16, “Becoming a Privacy Law Specialist: Exploring NC’s Newest Legal Specialization,” and (2) the Fireside Chat from March 17, “Managing Third-Party Privacy and Security Risks.”

We invite you to review the materials if you weren’t able to join or to revisit the materials at your leisure.

Here is a reminder of how to navigate the library.

How Do I Access the Library?

  1. Click on “Communities.”
  2. Scroll and find your community.
  3. Click on the “Library” tab.

How Do I Find Content in the Library?

  1. On the left side under folders, you will see varying folders.
  2. When you click on a folder, the contents of the folder will pop up on the right side under “Folder Contents.”
  3. To open a document, double click on any document.
  4. Click “Download” under the attachment name.

SolarWinds – What Do We Know and What Can We Learn From It?

By Eva Lorenz and Taylor Ey

SolarWinds made a name for itself as the developer of tools for network monitoring that help small and large companies efficiently run their environment. While not a security-focused company from a product standpoint, the understanding was that the code behind SolarWinds’ tools was protected as intellectual property and that updates were safe to run until it turned out that both of these assumptions were wrong.

How Was the Compromise Detected?

In late 2020, FireEye, a company focused on cybersecurity and internationally involved in helping companies post cyber incident, detected some unusual activity on the FireEye network. FireEye detected it was hacked after the attackers tried to register a device to FireEye’s multi-factor authentication system using stolen credentials. The system then notified the employee, whose credentials were stolen, and alerted the FireEye security team of this new device. This notice triggered an internal investigation to learn who was trying to register this device. FireEye performed in-depth code analysis and determined that the intrusion originated with a SolarWinds product called Orion. Some analysts believe that attacking FireEye was a mistake by the attackers since it sped up detection of the SolarWinds hack.
Read more

Reconciling Emerging Technologies with North Carolina’s Duty of Competence

By Sarah Beth Tyrey

A Multilayered Duty of Competence

The North Carolina State Bar’s Rules of Professional Conduct mandates attorneys in this state to uphold a duty of competence in their practice. Under Rule 1.1, competence in representation “requires the legal knowledge, skill, thoroughness, and preparation reasonably necessary.” Competent and zealous representation for an attorney’s clients is of highest priority. Monitoring changes in case law and the broader legal landscape is imperative to maintain this knowledge and skill.

Read more

Worried about Hackers? Take Proactive Measures by Hiring Someone to Test Your Network

By Eva Lorenz 

You may be an in-house attorney at an organization subject to specific compliance requirements or you may work at a law firm and handle sensitive client information, including information subject to laws such as the N.C. Identity Theft Protection Act. In either case, you need to show your business partners that data managed by your organization is protected. You, as an attorney in the room, can help your organization or law firm reduce the risk of a high-profile breach or ransomware attack. Read on to learn about technical approaches to address these concerns.

Read more

Ketan Soni Presents “The New Community Platform”

By Ketan Soni

What You Need to Know About the New Community Platform

This year, the NCBA has switched to a new online community platform. This new community platform for Sections, Divisions and Councils offers many more features than the previous system. Below is a summary of the basics and what you need to know to utilize this platform and its features.

Read more

Fall and Winter Fireside Chats: Vote for Topics Today

By Shannon Ralich
Privacy & Data Security International Working Group Committee Chair

The NCBA Privacy & Data Security International Working Group will host Fireside Chats this fall and winter.

Vote for the topics you would like to hear about (you can select more than one topic).

The last day to vote is Wednesday, September 30 at 5 p.m.

We look forward to hearing from you! Click here to take the 1-minute survey.

Thank you.

A Lot Has Changed in Privacy and Data Security This Year. Do You Feel Up to Date?

By Karin McGinnis

While the world was quarantining, the privacy and data security world was busy. Now the California Consumer Privacy Act is in full swing with final regulations, the U.S./EU Privacy Shield is no longer valid, and the attorney-client privilege in data breaches has been challenged. With most purchases and interactions happening online, online businesses and virtual meeting spaces are in the crosshairs. Even your old trusty vendor agreement is at risk. All of these changes have significant implications for your clients and your practice, and it is easy to feel behind the curve. Your NCBA Privacy and Data Security Committee has your back! We’ve created a full day seminar (6 MCLE credits*) to get you up to speed. You’ll get ethics and technology credit as well. And with safety in mind, the seminar will be 100% virtual. If you are one of the first 30 people to sign up, you’ll receive a $65 discount. You can sign up here.

Hope to “see” you there!

*6.00 MCLE Hours Includes 1.00 Ethics/Professional Responsibility and 1.00 Technology Training Qualifies for NC State Bar Privacy & Information Security Law Specialization

A Message from the Chair of the NCBA Privacy and Data Security Section

By Erin Illman

Greetings Privacy and Data Security Section members, and welcome to the 2020-2021 bar year! It is my honor and privilege to serve as Chair this year, and I am looking forward to working with an amazing and highly invested group of council members, committee co-chairs, and NCBA staff. I’m also very excited about this year’s top-notch programming, activities, blog content, and other valuable benefits our Section provides our members.

While this year may look a little different in light of the unique challenges that we are all navigating during the COVID-19 pandemic, the Section leadership is committed to providing the same excellent CLE programming, social and professional benefits, and practical tips and discussions with colleagues in this evolving area of law.

Below is an update on the Section’s activities this year and some opportunities for members to get involved in the Section’s work.

Read more

School’s Out for Summer! (School’s Out Forever?): Distance Learning Policies and The New Normal

By Rachel LaBruyere

Over the past few weeks, parents all over the country let out a collective sigh of relief when the school year ended. They could relinquish their new duties as at-home [insert subject here] teacher. Meanwhile, college and graduate students sat for final exams remotely, shifted to pass/fail grading rubrics, and mourned lost graduations and rites of passage.

Educational institutions from elementary schools to law schools are now considering whether to go fully or partially online in the fall of 2020 and beyond. While privacy has long been a conversation in the education sector, data privacy and cybersecurity issues should be front and center for not only decision-makers but also educators, faculty, and administrators as they make these decisions. Data privacy and cybersecurity issues will not be new to those in the education sector, but what may be novel are all the different parties who may now have access to personal information. These include technology vendors who are not familiar with the student data regulatory landscape, as well as new sources of data as more online tools are leveraged in the distance learning environment. The shifting privacy and cybersecurity landscape makes this a daunting task even for the most tech-savvy institutions. So, where should one start? As discussed in detail below, educators and administrators should ground themselves in applicable requirements under federal and state privacy laws, conduct due diligence on all education technology vendors, and implement or update distance learning policies.

Read more

Why VPNs and Encryption Services Are Our Digital Masks and Gloves

By Jaren Butts and Nickeyea Wilkinson 

Thanks to social distancing mandates, teleconference platforms have experienced a huge surge in site traffic as new users around the world participate in telehealth, telework, and many other teleservices that have now been transitioned online.[1] As virtual capabilities become more important to our daily lives than ever before, now is also the time to focus on the importance of our daily digital hygiene by gearing up with VPN and encryption services in the same way as we do with our masks and gloves.

Read more