The Ethical Investigator

What does the Supreme Court’s decision this week about the Privileges and Immunities Clause mean to investigators?

That they need to continue having a good national network to help one another.

The Court this week upheld unanimously a Virginia law that grants the right to see documents under the state’s Freedom of Information Act (FOIA), but only to citizens of Virginia.

Investigators care about this kind of law, and many like it that restrict the kinds of information we can get. A fire inspection report in Tennessee, or some official record in Virginia? Local residents only.

We have been able to get around such laws for years, by hiring a citizen of the state in question to make the request. Since there is an unquestioned right to access certain public records, our Virginia or Tennessee agents need not reveal the purpose of their information requests, nor do they need to say they are acting as agents for companies out of state.

There is another reason to use cut-outs to gather information, however: in smaller jurisdictions, clerks talk and could tip the subject or the local papers that a search is underway, and in some cases the subject of the FOIA request may be notified that a public record about him has been requested.

For that reason, it may be prudent if you are sitting in New York to get a Texas agent to ask for a federal document in Washington, for instance.

One more tip when using agents to make requests for you. Don’t tell them why you need the documents, and request one or two unrelated documents to throw them off the track of why you are hiring them at all. Then if your agent gets unduly talkative when doing his job, there will be fewer beans to spill.

Why is it that we would never decide to put $100,000 in the bank and tell people our deposits are “in the cloud,” but we readily do so with data that could be worth many times more than that?

This week’s drama in Cyprus, in which a lot of people have seen their money vaporized before their eyes, is a healthy reminder that money and data are the same thing: bits of information stored on a computer that is, for legal purposes, very much below the clouds and in a particular legal jurisdiction.

Consider the argument by the U.S. Attorney for the Eastern District of Virginia, here, who argues that because certain computer servers for the SEC and other organizations are located in his patch, he has jurisdiction to go after defendants in out-of-state securities frauds and alleged international copyright pirates.

Whether or not he prevails in his argument, the location of the server on which someone’s data resides is going to determine whether or not there is a legal fight over jurisdiction. That’s going to increase legal costs and headaches, never mind what happens if the U.S. Attorney is successful.

This kind of thing gets covered every year in good depth by Stanford’s annual conference on best practices in e-commerce, where I was warned a few years ago that if employee data from the U.S. gets moved to a server in a country with stricter privacy laws (say, France or Germany), then getting that data back could be a problem if it violates those stricter laws.

That hit home at the time, because just a few months before when I was shopping around for a payroll service for our firm, I asked a higher-cost provider why his competition was so cheap. “Their server is in India, and ours is in New York,” was the answer.

It's cloud illusions I recall

I really don't know clouds at all

--Joni Mitchell

When does green not mean go? As toddlers we drive with our parents and learn that green means go, yellow means caution and red means stop. But then later on, in driving and in life, we learn that green means “go, as long as…”

In New York, green means go but you still need to “yield the right of way to other traffic lawfully within the intersection or an adjacent crosswalk at the time such signal is exhibited,” according to the statute. If you have a green arrow, you may “cautiously” enter the intersection.

What does any of this have to do with investigation? Plenty. When a client asks us to gather information, we assume until told otherwise that we have a red light as to picking up a phone and calling people. As we tell clients every week, there is always a chance that the person you are investigating will find out about it once you start calling around and asking questions about that person. The decision to take a chance that an investigation will surface belongs to the client.

Now suppose the client says, “Go ahead, green light to call people.” Does that mean the light stays green for the rest of the investigation or even the rest of that day? Not necessarily.

If we call Mr. Garcia to ask about Mr. Stein, we are on yellow and not green, whatever the client may think. That’s because if it turns out Mr. Garcia is represented by an attorney in this matter, the light turns red and we have to terminate the call so as not to violate the no-contact rule of professional ethics. The light is also yellow until you make sure to tell the person you are interviewing that you don’t want to find out any information that’s privileged or confidential. We wrote about this in Trial Ethics: A Template Can Save Your Life.

In what other situations would the light turn from green to red?

1. The client changes his mind for any reason and tells us to stop calling.
2. We find out that despite our best efforts and warnings that it could happen, our investigation has made its way back to Mr. Stein. We may then need to call the client to get permission to continue calling.
3. The client instructs us to use the phone to obtain information we are not allowed to get, including bank accounts, phone records and medical records. The client is normally king, but nobody can prevail on us to violate a statute.

Well, another day, another email hacking story. This one involves the Bush clan, with reports that a hacker who goes by the name Guccifer accessed private emails and photographs, telephone numbers and addresses sent between members of the Bush family, including both former presidents. Among the data released are catty emails about Bill Clinton, photographs of the ailing senior Bush in the hospital, and a security code to one of the Bush homes. The Secret Service is investigating the matter.

We know that despite stories such as these, many of our clients and colleagues are unwilling to take more sophisticated measures to ensure secure email communications, some of which are detailed in our article on the General Petraeus scandal, "Lessons Learned." For example, they are still unwilling to encrypt their messages (see our entry "Why You Should Encrypt Your Data Now" for a primer on encryption). And they fear that a service like 10 Minute Mail, which sets a self-destruct timer for messages and email addresses 10 minutes after a message is opened, is too extreme and potentially impractical.  Some even refuse to get off of Gmail, even though Google admits that it scans email content for marketing purposes. A point Microsoft is happy to exploit in a new campaign to get people to switch over to Outlook.

Short of deleting your Gmail account, what is the bare minimum you can do to make your Gmail communications more secure? A few simple adjustments would provide some peace of mind:

• Google offers the option of two-step verification to sign in, which is a lot more secure than just using a password.  First you enter your password, which hopefully is hard to hack, and then you receive a code either via text, voice call or Google mobile app that needs to be entered as well. Google offers the option to have this two-step process every time you log in, which we think is best, or at least whenever you use a different computer. That way if someone is trying to access your email from another computer, you’ll receive a request for a code that will notify you that someone is attempting to infiltrate your account.  You can activate this feature via Accounts and then Security.

• Google provides a list of your Last Account Activity to track where and when your account was most recently accessed. The list details what IP addresses most recently tried to log into your account. Click here and here for lessons on how to determine your IP address. And remember that your smartphone may also access your account, so you need to determine what its IP address is too. You can access the link to this data below your list of messages.

We have written here and here about the dangers of not having more sophisticated or complex passwords for technical devices and online accounts. We are also strong proponents of fighting hackers with encryption. None of this should come as a surprise to knowledgeable online users. Yet, as the press enjoys pointing out,  sometimes even self-professed tech geeks rely on easy-to-crack passwords, use the same passwords for multiple accounts or never bother to update the default passwords their devices and accounts came with in the first place. Whenever one of these articles is published or news stories air, you can virtually hear the echo of hands smacking on foreheads as people realize they’re guilty of the lazy practices hackers exploit. It stings to realize you’re the low-hanging fruit identity thieves love to target.

What gets less coverage, however, is how often small business owners are the weakest link in an identity theft chain. Certainly big businesses have been called out for serious data breaches, including misrepresenting whether or not their data was encrypted. But, as it turns out, personally taking pains to protect against hackers and identity thieves can all be for naught if thieves are accessing your digital data via the smaller businesses you frequent. This could include your favorite local restaurant, or the neighborhood Mom and Pop bookstore or boutique you proudly support. Take credit card terminals, for example: Small businesses are especially vulnerable to the plethora of ways hackers collect cardholder data via credit card terminals used to process credit card sales.

Here are some ways small businesses can protect their client’s data from credit card terminal breaches:

• Some credit card terminals are set with a default password and a default programming code that vendors are supposed to change to ensure their clients’ credit card information is secure. Needless to say, many don’t make the effort, or use an easy-to-guess password, leaving themselves vulnerable to hacks. Insert hand-smacking-forehead sound here.

• Some businesses scrimp on card terminals from reliable vendors with more sophisticated security measures. Of course, this isn’t to say that trusted vendors don’t make bad equipment, but in security, as in almost everything else, you get what you pay for. And better to pay for equipment from a vendor with a solid reputation and a good track record, and decrease the likelihood of getting hit with legal costs for data breaches.

• Brazen hackers will go into a store pretending to be a service person sent to update or replace card terminals and actually be granted access to the terminals. Devices are then doctored to leak cardholder data.  This is akin to getting a phishing email that appears to be from your bank with a link to change the password on your online checking account. The take away is that no bank or processor is going to send out a service person without notifying the business first. If a technician claims otherwise, show him the door.

• Sometimes hacks leave clues that there is a security breach. For instance, credit card data may be hacked by linking a credit card terminal to an external network or an external device. Card holder data is then funneled via this link. Any indication of this sort of external activity is a massive red flag that cardholder data is being leaked. Vigilant business owners will diligently monitor their connections. That way, they can track the traffic their devices generate, including whether any data is being transmitted to terminals or devices outside their network. If a leak is suspected, all traffic should be immediately stopped and the local FBI office should be notified.