Planning to be in the Chicago area on June 4? Register to attend this interactive panel discussion regarding best practices for social media policies. The panelists multi-disciplinary perspective will include privacy, intellectual property and employment law issues related to the use of social media in the workplace.
On March 24, 2014, the U.S. Copyright Office issued a Final Rule that establishes new fees for certain of its services. The new fee schedule is effective as of May 1, 2014 and available here. The fees were last updated in 2009.
The Office increased fees for certain registration and recordation and associated services, as well as search and review services for FOIA requests. The Office reduced renewal application and addendum fees in an effort to “encourage the filing of more renewal claims” and thereby help improve the public record about copyright ownership.
According to the Copyright Office’s announcement, the fee increases result from its “responsibility, like other Federal agencies, to establish sound financial policies and develop a budget derived largely from fees” and enable it to “recover a significant part of the costs to the Office for services that benefit both copyright owners and the public.”
(And, while on the subject of copyright, if your website accepts and hosts user-generated content, we encourage you to check that you have registered a “DMCA agent” under the Digital Millennium Copyright Act (DMCA). The DMCA is a federal law that provides “safe harbor” protection for claims of copyright infringement for website operators that follow certain procedures, including designating a DMCA agent.)
For more information, please contact Jennifer Mikulina, global head of McDermott’s trademark prosecution practice, or Julia Jacobson, author of this blog entry and ODI editor.
“Heartbleed” has been all over the news, and companies have been scrambling to respond. What sounds like a nasty medical condition is actually a recently discovered flaw in popular encryption software called OpenSSL. It has been widely reported in the news outlets that approximately 60 percent of all web servers use OpenSSL. According to the Federal Trade Commission, the flaw can permit a hacker to unlock the encryption and “monitor all communication to and from a server—including usernames, passwords, and credit card information—or create a fake version of a trusted site that would fool browsers and users, alike.”
So how can companies stop the bleeding?
Figure out if any websites, systems (like e-mail) or applications (like virtual private network [VPN] endpoints, load balancers or database management software) use OpenSSL. More information about how internal information technology (IT) teams can find and fix the flaw can be found on heartbleed.com.
A comprehensive review of systems is important because, according to security firm Coalfire, OpenSSL is a program that is not just used on externally facing websites. It also is frequently used on internal applications, management consoles, “appliances” and legacy systems, which will remain vulnerable until patched. This is especially critical for systems that contain sensitive information, such as protected health information, financial information, Social Security numbers and other highly confidential items. A firm like Coalfire can scan corporate systems to discover the vulnerability at a relatively modest cost.
Update to the latest version of OpenSSL to fix the flaw. After updating, companies need to generate a new encryption key (most IT teams know how to do this) and obtain a new SSL Certificate from a trusted authority, which will signal to browsers that the website is secure. Generating the new key is critical—otherwise a company’s server and data could still be at risk.
Confirm that vendors, business partners and contractors that provide technical services or support to company systems have addressed any OpenSSL flaws in their systems.
But what about the blood that’s already spilled?
After taking these steps to stop the bleeding by fixing OpenSSL flaws, a critical next step is for companies to conduct an assessment of data and actions previously thought to be encrypted.
Companies should consider evaluating with counsel how and when to communicate with customers and employees about changing log-in credentials and taking any other appropriate steps in light of the particular situation addressed by the company.
In addition, given the publicity and attention to this issue, customer service lines might see an increase in calls inquiring whether a company’s website is secure and whether log-in credentials should be changed. Convening the right internal resources to prepare clear, concise talking points will help those customer service teams convey accurate, consistent information in a way that minimizes harm to consumers and brand.
Even if companies are confident that their own sites have been fixed, they should consider whether employees may have used corporate log-in credentials on mobile devices or over connections, such as remote access VPN [...]
Privacy and data protection continue to be an exploding area of focus for regulators in the United States and beyond. This report gives in-house counsel and others responsible for privacy and data protection an overview of some of the major developments in this area in 2013 around the globe, as well as a prediction of what is to come in 2014.