{"id":3463,"date":"2016-12-02T21:19:45","date_gmt":"2016-12-02T21:19:45","guid":{"rendered":"http:\/\/jolt.richmond.edu\/?p=3463"},"modified":"2019-03-08T19:52:12","modified_gmt":"2019-03-09T00:52:12","slug":"the-skeleton-of-a-data-breach-the-ethical-and-legal-concerns","status":"publish","type":"post","link":"https:\/\/blog.richmond.edu\/jolt\/2016\/12\/02\/the-skeleton-of-a-data-breach-the-ethical-and-legal-concerns\/","title":{"rendered":"The Skeleton of a Data Breach: The Ethical and Legal Concerns"},"content":{"rendered":"

\"pdf_icon\"<\/a>\u00a0BDM Publication Version PDF<\/a><\/p>\n

Cite as:\u00a0Hilary G. Buttrick et al.,The Skeleton of A Data Breach: The Ethical and Legal Concerns<\/em>,\u00a023 Rich. J.L. & Tech. 2 (2016),\u00a0http:\/\/jolt.richmond.edu\/wp-content\/uploads\/volume23_article2_Buttrick.pdf.<\/p>\n

Hilary G. Buttrick,*\u00a0Jason Davidson,**\u00a0Richard J. McGowan***<\/p>\n

\u00a0<\/strong><\/p>\n

Introduction<\/strong>\u00a0<\/strong><\/p>\n

[1] \u00a0\u00a0\u00a0\u00a0\u00a0 After over thirty data breaches spanning the third and fourth quarter of 2012, Forbes magazine labeled the summer of 2012 as \u201cThe Summer of the Data Breach.\u201d[1]<\/a> Four years later, businesses across multiple industries have suffered brand-image damage and paid millions of dollars in remedial expenses; we are living in the era of the mega breach.[2]<\/a> In 2014, companies such as Target, Home Depot, JP Morgan Chase, Anthem, Sony, UPS, Jimmy John\u2019s, Kmart, Neiman Marcus, Community Health Systems, and the White House suffered data breaches.[3]<\/a> The Home Depot breach alone resulted in the loss of \u201c56 million credit card accounts,\u201d \u201c53 million email addresses,\u201d and an estimated 63 million dollars in damage.[4]<\/a> In addition to the economic fallout associated with data breaches, the 2015 Ashley Madison data breach highlighted the personal toll faced by consumers when their \u201cprivate\u201d information becomes \u201cpublic.\u201d[5]<\/a> That data breach exposed the identities of millions of would-be philanderers, shaming not only the subscribers to Ashley Madison\u2019s service, but also innocent bystanders such as their family members.[6]<\/a> The frequency of data breaches has shown no signs of abating in 2016\u2014in the first quarter, multiple hospitals fell victim to \u201cransomware,\u201d a data breach that allows hackers to literally hold patient data hostage.[7]<\/a> Several hospitals had to pay hackers to regain access to their patients\u2019 data.[8]<\/a><\/p>\n

[2]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u201cDecentralized technology\u201d creates a different set of problems than the simple misuse of a single individual\u2019s \u201ctechnological profile\u201d and information.[9]<\/a> Today, unauthorized access to electronic information, a result of what Burnham in 1983 referred to as \u201ctransactional information,\u201d[10]<\/a> includes \u201chackers breaking into systems or networks, third parties accessing personal information on lost laptops or other mobile devices, or organizations failing to dispose of personal information securely.\u201d[11]<\/a> Data breaches exemplify the first type of unauthorized access and despite their frequent occurrence, they are little examined from an ethical standpoint. Though Google Scholar lists over 82,000 entries under \u201cethics of a data breach,\u201d very few combine both terms in the title.[12]<\/a> One article that does so notes a \u201cdearth of prior organizational-level privacy research, which has largely overlooked ethical issues or the personal harms often caused by privacy violations.\u201d[13]<\/a> Even within the field of technology, \u201cthere has not been a huge literature on ethics within the mainstream of information systems journals.\u201d[14]<\/a> Part of the problem is the novelty of data breach cases. They are so new and different that they appear to be technologically, morally, and legally unlike other problems. We suggest that analogies and analyses exist which can help resolve some of these moral and legal puzzles.<\/p>\n

[3]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 First, this paper discusses the anatomy of a data breach, providing technical background on the way breaches occur. Next, we identify the ethical dimensions of data breaches. While privacy is a key topic in any ethical analysis of a data breach, other issues are more pressing, such as the responsibility of organizations to prevent and to repair consequences of data breaches. Then we analyze the current status of the law with regard to data breaches. We note immediately that the laws of various states are exactly that, various and eclectic. No consistent and stable legal understanding appears to have availed itself. The article concludes with guidance regarding data breach prevention, which can help businesses meet their ethical and legal obligations.<\/p>\n

I. Data Breach Basics<\/strong><\/p>\n

[4]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 According to popular folklore, the first computer \u201cbug\u201d was officially documented in 1945.[15]<\/a> This was years before the first personal computer was released, and instead of malware or social engineering deception, the \u201cbug\u201d was literally a moth that was stuck between two components of IBM\u2019s Harvard Mark II.[16]<\/a> After a cataclysmic data breach in the modern computing age, however, postmortem reports eventually surface that provide the details of each individual breach.[17]<\/a> These reports explain the hacker\u2019s methodology, the company\u2019s missed warning signs, and the collateral damage from the breach.[18]<\/a> Each individual breach has its own signature as every data system is as unique as a fingerprint; however, these breaches generally occur in one of several ways.<\/p>\n

[5]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The most common and well-documented method of cyber-attack uses malware.[19]<\/a> Malware, which includes viruses, worms, and trojan horses, is the \u201cgeneric name for evil software.\u201d [20]<\/a> A 2016 data breach report by Verizon found that malware continues to be the major contributor to data breaches involving stolen credentials and point of sale attacks. [21]<\/a> Malware attacks, specifically worms, were publically credited for both the Target[22]<\/a> and Home Depot[23]<\/a> data breaches. Ironically, the first worm was created in 1975 by Xerox as a network analysis tool.[24]<\/a> Modern day worms are standalone programs that can replicate and spread throughout a network when activated.[25]<\/a> Some of the more notable worms include Melissa, ILOVEYOU, Slammer, and the Morris worm.[26]<\/a> Malware is not the only factor that can lead to network compromise. Security breaches often are attributable to social engineering.[27]<\/a><\/p>\n

[6]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Social engineering employs deception tactics to persuade the user to simply give the cybercriminal direct access to the system under attack, similar to the modus operandi of a traditional con-artist.[28]<\/a> Social engineering attacks direct messages and correspondence to users who have access to the systems that are being attacked.[29]<\/a> Through different methods of deception, the user is prompted to give away the information needed to access the system.[30]<\/a> The most common methods of social engineering are spear phishing, smishing, and vishing.[31]<\/a> Spear phishing is direct correspondence, usually via email, that is personally crafted to gain the trust of the end user.[32]<\/a> Once trust is obtained, the user is prompted for login credentials and the system is compromised. Smishing and vishing are similar to spear phishing; however, they use text messages (smishing) and voice communication (vishing) as mediums.[33]<\/a> It is also worth noting that old-fashioned tactics such as breaking and entering, removing files from the printer, or simply guessing passwords are still commonly used tricks of the trade.[34]<\/a><\/p>\n

[7]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 To circumvent the millions of dollars companies invest in information technology security, hackers often use a combination of the tactics discussed above. As detailed in the Dell SecureWorks report on the Target infiltration, a combination of social engineering and malware was used to cause the collapse.[35]<\/a> Hackers first targeted Fazio Mechanical Services, a vendor for Target.[36]<\/a> They were able to gain login credentials through spear phishing, which in turn granted them direct access to the systems that opened a pathway to Target\u2019s network.[37]<\/a> Upon accessing Target\u2019s data network, the hackers injected a worm into the system.[38]<\/a> This worm compromised Target\u2019s point of sale systems using a customized version of malware called Black POS.[39]<\/a> This malware then compromised Target\u2019s server, which allowed the data to be distributed and copied to servers located throughout the world; accordingly, the hack was very difficult to trace.[40]<\/a><\/p>\n

[8]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 For businesses, the question of data breach is not \u201cif\u201d but \u201cwhen.\u201d It is indisputable that the hackers in the examples discussed above bear the moral responsibility for their acts.[41]<\/a> But the moral responsibility of the business that sustains the data breach presents a closer question. Businesses require consumers to provide their private information when completing even the most routine transactions; this places the business in a unique position of trust. The scope of a business\u2019s moral responsibility for breach of that trust is discussed below.<\/p>\n

II. Moral Responsibility and Data Breach<\/strong>\u00a0<\/strong><\/p>\n

[9]\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Of course, the right to privacy is at the fore. However, information technology \u201cexplicitly embodies particular important values\u2026privacy, autonomy, universal usability, trust, and cooperation.\u201d[42]<\/a> The existing literature does not explore the scope of a business\u2019 moral responsibility for data breach. Accordingly, reference to other areas, such as moral responsibility for marketing, is instructive. The values associated with information technology suggest moral analysis based on the ethics of marketing and on notions of corporate responsibility, inasmuch as knowledge plays a role in making autonomous choices and trust is associated with responsibility.[43]<\/a><\/p>\n

[10]\u00a0\u00a0\u00a0\u00a0 Three main positions have been staked out over the years with regard to marketing: the contractual view, the due care theory, and the social costs view, sometimes referred to as the \u201cdeep pockets\u201d view.[44]<\/a> Captured in the phrase, caveat emptor,<\/em> the contractual view of the buyer-seller relationship holds that the seller, typically a business, only has the duties to the buyer that the contract states.[45]<\/a> Thus, under the contract view, Ford could indeed sell a product which, when struck from behind at 21 miles per hour, could produce a flaming inferno.[46]<\/a><\/p>\n

[11]\u00a0\u00a0\u00a0\u00a0 The problem is that consumers lack the knowledge that the producer has and therefore cannot act knowledgably in purchasing a product. The due care position recognizes the imbalance and the vulnerable position of the consumer by placing additional duties on the business.[47]<\/a> As Culnan and Williams put the matter, \u201c[w]e further argue that because consumers are vulnerable in their dealings with businesses due to information and control deficits, organizations have a moral duty\u2014often overlooked, we observe\u2014that extends beyond legal compliance requiring them to take reasonable precautions with consumer data and to avoid harm in using this data.\u201d[48]<\/a> The \u201cdeep pockets\u201d view\u00ad\u2013analogous to the legal notion of strict liability\u2013would have the seller assume all costs\u2013even when exercising \u201cdue care\u201d to protect the consumer from risk and injury\u2013of a product.[49]<\/a> In other words, when a problem occurs, no investigation need be undertaken: the seller takes the responsibility, or caveat vendor<\/em>.[50]<\/a> Given the poor record of businesses with regard to handling data breaches,[51]<\/a> the third option appears most reasonable.<\/p>\n

[12]\u00a0\u00a0\u00a0\u00a0 Corporations have been reluctant to take steps to exhibit moral responsibility in the area of data breach.[52]<\/a> Normally, when wrongdoing occurs in an organizational setting, the elements of magnitude and certitude of harm as well as connection and contribution to the harm are utilized.[53]<\/a> Corporations appear to underestimate magnitude and certitude of harm and appear to ignore the contribution they make to data breaches by being primarily reactive rather than proactive.[54]<\/a> While an analysis of a business\u2019s moral responsibility for a data breach suggests the appropriateness of a rule akin to strict liability, the law is far from imposing such an obligation.[55]<\/a><\/p>\n

III. Legal Liability and Data Breach<\/strong><\/p>\n

[13]\u00a0\u00a0\u00a0\u00a0 Not surprisingly, the development of data breach law has lagged behind the speed of technological innovation.[56]<\/a> There are two significant legal questions surrounding data breaches. First, what legal obligations does a business owe its customers regarding data security and notifications of a breach? Second, what legal remedies do consumers have if their private information is compromised as the result of a data breach? As discussed below, there is currently no comprehensive federal regulatory scheme addressing data breach.[57]<\/a> Instead, businesses must attempt to comply with a patchwork of state laws addressing data breach notifications.[58]<\/a> Additionally, consumers are left with few effective civil remedies when their private information is breached.[59]<\/a><\/p>\n

A. Data Breach Notification Laws<\/strong><\/p>\n

[14]\u00a0\u00a0\u00a0\u00a0 At present, there is no comprehensive federal statute addressing a business\u2019s obligation to safeguard personal information.[60]<\/a> While there are a few federal statutes aimed at protecting personal information in narrow contexts (such as the protection of medical and health-related information under the Health Insurance Portability and Accountability Act of 1996),[61]<\/a> the legal rules governing data breach are handled largely at the state level.[62]<\/a> Currently, \u201c[f]orty-seven states, [and] the District of Columbia\u201d have laws addressing business obligations with regard to data breaches.[63]<\/a> Three states\u2014Alabama, New Mexico, and South Dakota\u2014have no statutes on the books addressing consumer notification of data breaches.[64]<\/a> Most states impose obligations on businesses to maintain \u201creasonable security\u201d measures \u201cto protect personal information.\u201d[65]<\/a> While definitions vary from state to state, \u201cpersonal information\u201d commonly includes an individual\u2019s social security number,[66]<\/a> or<\/p>\n

[A]n individual’s first and last names, or first initial and last name, and one (1) or more of the following data elements that are not encrypted or redacted: (A) A driver’s license number. (B) A state identification card number. (C) A credit card number. (D) A financial account number or debit card number in combination with a security code, password, or access code that would permit access to the person’s account.[67]<\/a><\/p>\n

[15]\u00a0\u00a0\u00a0\u00a0 A \u201cbreach\u201d occurs when there is an \u201cunauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information. . . .\u201d[68]<\/a><\/p>\n

[16]\u00a0\u00a0\u00a0\u00a0 In the event of a data breach, existing statutes require businesses to provide some type of notification to the consumer.[69]<\/a> The type and timing of that notice, however, varies from state to state.[70]<\/a> Some states require consumer notification whenever unauthorized access of personal information occurs.[71]<\/a> Other states require businesses to notify consumers only if there appears to be a reasonable risk that some harm will result from the breach.[72]<\/a> Many states require businesses to notify the attorney general of data breaches.[73]<\/a> Some statutes require notification within a specified time frame, while others simply require that notification be done expediently.[74]<\/a> Businesses that serve consumers in multiple states must comply with the notification requirements of each of the states where affected consumers reside.[75]<\/a> Thus, when a large data breach occurs, businesses face a considerable challenge in ensuring compliance with the various notification laws throughout the country.[76]<\/a><\/p>\n

[17]\u00a0\u00a0\u00a0\u00a0 This patchwork of state regulation leads commentators and policy advocates to suggest that a comprehensive federal data breach statute should be enacted.[77]<\/a> A federal data breach statute would preempt state regulation, thus simplifying the breaching business\u2019s compliance requirements and costs.[78]<\/a> Instead of struggling to comply with the various notification laws of multiple states, a business would look to only one source\u2014federal law\u2014to discern its obligations in the event of a data breach.[79]<\/a> While federal bills have been proposed,[80]<\/a> Congress has failed to pass any comprehensive proposal.[81]<\/a><\/p>\n

[18]\u00a0\u00a0\u00a0\u00a0 Moreover, critics claim that draft bills are weak and do not offer enough protection for consumers.[82]<\/a> In particular, critics note that the proposals do not do enough to incentivize data breach prevention because they focus on consumer notification after a breach has already occurred.[83]<\/a> To incentivize data breach prevention, businesses must view added security measures as solid investments that minimize risks of loss.[84]<\/a> The primary business risks associated with data breaches are loss of customer goodwill and, of course, lawsuits from affected consumers.[85]<\/a> As discussed below, data breach lawsuits are difficult to pursue. Accordingly, the threat of consumer litigation has not played an extensive role in influencing businesses to adopt more stringent security measures.[86]<\/a><\/p>\n

B. Consumer Remedies for Data Breach<\/strong><\/p>\n

[19]\u00a0\u00a0\u00a0\u00a0 Some commentators have argued that in order to meaningfully encourage businesses to adopt better data protection measures, businesses must view customer litigation as a serious threat.[87]<\/a> The threat of litigation in this context has been largely hollow because consumers have few legal remedies when their personal information is breached.[88]<\/a> While data breach statutes require businesses to notify consumers in the event of a breach, only a handful of those statutes create a private cause of action that allows the consumer to bring a lawsuit against the business.[89]<\/a> Thus, in the majority of states with data breach statutes, the consumer is statutorily entitled to notice of the breach but little else.[90]<\/a> Given the lack of meaningful statutory remedies for data breaches, consumers have looked to the common law for a cognizable theory of recovery.[91]<\/a> Consumers have sought damages for data breaches under theories of negligence, breach of contract, breach of fiduciary duty, and infliction of emotional distress.[92]<\/a> These common law theories are not well-suited to data breach cases and often end in dismissal for several reasons.[93]<\/a><\/p>\n

[20]\u00a0\u00a0\u00a0\u00a0 First, the harm that results from data breaches is most commonly economic harm\u2014there is no personal injury or physical property damage sustained by the consumer as a result of the data breach.[94]<\/a> Many jurisdictions follow a rule called the \u201ceconomic loss doctrine,\u201d which prevents consumers from recovering purely economic damages under a tort theory (such as negligence or infliction of emotional distress).[95]<\/a> Thus, in jurisdictions that follow the economic loss doctrine, data breach claims sounding in tort rarely reach the jury because they are dismissed as the result of pretrial dispositive motions filed by the defendant.[96]<\/a><\/p>\n

[21]\u00a0\u00a0\u00a0\u00a0 Second, many data breach cases are dismissed because the consumer lacks standing to bring such a claim.[97]<\/a> Standing is a constitutional prerequisite to litigation that requires the plaintiff to have suffered an injury in fact.[98]<\/a> In other words, the harm sustained by the plaintiff must be real, not hypothetical or speculative.[99]<\/a> In data breach cases, the injury can be hard to define. Plaintiff consumers often argue that the data breach itself and the risk of future identity theft are sufficient harms; defendant businesses contend that no injury has occurred unless the plaintiff can show a link between the data breach and an actual instance of identity theft.[100]<\/a> Not surprisingly, the courts are divided on what type of injury suffices to confer standing in a data breach case.[101]<\/a><\/p>\n

[22]\u00a0\u00a0\u00a0\u00a0 Even if the plaintiff consumer in a data breach case survives the standing hurdle, he or she must still prove all of the elements of his or her case in order to win. In most instances, the consumer will have to prove that his or her injury was caused by the defendant\u2019s data breach.[102]<\/a> Proving causation in data breach cases can be difficult because the plaintiff\u2019s personal information may have been compromised in other data breaches, making it nearly impossible to establish that the suffered identity theft was solely the result of the defendant\u2019s breach.[103]<\/a><\/p>\n

[23]\u00a0\u00a0\u00a0\u00a0 The procedural and substantive difficulties associated with data breach litigation mean that very few of these cases are likely to survive dispositive motions and reach a jury, which in turn makes them less attractive to class action attorneys.[104]<\/a> The procedural hurdles, the cost of litigation, and the prospect of a small recovery are enough to deter most individual consumers from bringing a data breach lawsuit.[105]<\/a> Without effective legal remedies, most consumers must simply put up with the headaches associated with data breaches.[106]<\/a> While external litigation pressures and the current data breach regulatory state may not incentivize businesses to take additional steps to safeguard consumer privacy, ethics would certainly suggest that businesses should voluntarily adopt higher standards for data protection.[107]<\/a><\/p>\n

 <\/p>\n

IV. Business Strategies to Minimize the Risk of Data Breach<\/strong><\/p>\n

[24]\u00a0\u00a0\u00a0\u00a0 Several tactics can help reduce the threat of cybercrime. The first tactic is infrastructure.[108]<\/a> A modern company must continually perform routine maintenance including, but not limited to, security patches, operating system upgrades, and hardware upgrades. Often cyber criminals exploit older software to maliciously gain access to data networks.[109]<\/a> The initial discovery of these exploits before the software manufacturer has developed a security patch is called a “zero-day attack.\u201d[110]<\/a> Once a hardware or software exploit is identified, software and hardware vendors act to create patches to repair the problem as quickly as possible.[111]<\/a> It is up to the corporation to obtain and apply these patches.<\/p>\n

[25]\u00a0\u00a0\u00a0\u00a0 <\/strong>The second prevention method is active monitoring.[112]<\/a> Similar to the way that the FBI manages the national threat level, a company\u2019s IT department must manage the cybercrime threat level.[113]<\/a> Myriad firewall and IT monitoring software is available to monitor network traffic.[114]<\/a> Many anti-virus software programs automatically scan and remove commonly found malware.[115]<\/a> In addition, IT security companies provide external monitoring services to augment a company\u2019s internal monitoring procedures.[116]<\/a> These offsite IT services offer network traffic monitoring and even provide built-in client insurance\/reimbursement if a data breach occurs due to negligence within their services.<\/p>\n

[26]\u00a0\u00a0\u00a0\u00a0 The third prevention method is education.[117]<\/a> While most people envision a hacker in a dark basement surrounded by computers, social engineering is a remarkably effective method of data intrusion.[118]<\/a> For example, a study of data breaches occurring in 2015 found that \u201c30% of phishing messages were opened by the target across all campaigns.\u201d[119]<\/a> The risk of data breach can be mitigated if employees know they should never share passwords; they should frequently change passwords, and they should lock their office doors.[120]<\/a> Additional security measures such as key fobs, biometric readers, and similar devices that must remain with employees, should also be kept private. While no one strategy can guarantee that a business will not sustain a data breach, the preceding measures will lessen the risk.<\/p>\n

V. Conclusion<\/strong><\/p>\n

[27]\u00a0\u00a0\u00a0\u00a0 Though data breaches are a relatively new phenomena, guidance about the technology, morality, and legality of data breaches is available. If we are correct, corporations must do a better job of determining where data breaches are likely to occur, whether from human error or informational system flaw. Corporations must take steps to minimize risk before data breaches occur. Protocols must be put in place that assume responsibility for the consumers\u2019 negative consequences, such as notifying them immediately and providing help in diminishing the harm from the data breach. The legal liability will be mitigated; trust and cooperation will more likely flourish.<\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

<\/a>*J.D., Assistant Professor of Business Law, Butler University.<\/p>\n

**M.B.A., Instructor of Management Information Systems, Butler University.<\/p>\n

***Ph.D., Instructor of Business Ethics, Butler University.<\/p>\n

[1] See<\/em> Dave Lewis, Notes from RSA: Accountability in Security<\/em>, Forbes, (Apr. 29, 2015, 6:30 PM), http:\/\/www.forbes.com\/sites\/davelewis\/2015\/04\/29\/notes-from-rsa-accountability-in-security\/#47e46e292163, archived at<\/em> https:\/\/perma.cc\/HV4B-D7T8.<\/p>\n

[2]<\/a> See<\/em> Bill Hardekopf, The Big Data Breaches of 2014<\/em>, Forbes, (Jan. 13, 2015, 7:06 PM), http:\/\/www.forbes.com\/sites\/moneybuilder\/2015\/01\/13\/the-big-data-breaches-of-2014\/#4ad6aa5f3a48, archived at<\/em> https:\/\/perma.cc\/WYT4-8JX8.<\/p>\n

[3]<\/a> See id.<\/em>; see <\/em>Ellen Nakashima, Hackers Breach Some White House Computers<\/em>, Wash. Post (Oct. 28, 2014), https:\/\/www.washingtonpost.com\/world\/national-security\/hackers-breach-some-white-house-computers\/2014\/10\/28\/2ddf2fa0-5ef7-11e4-91f7-5d89b5e8c251_story.html, archived at<\/em> https:\/\/perma.cc\/HD4S-MUX2.<\/p>\n

[4]<\/a> The Home Depot, Inc., Annual Report (Form 10-K) (Mar. 25, 2015), at 18\u201319.<\/p>\n

[5]<\/a> See<\/em> Eric Basu, Cybersecurity Lessons Learned from the Ashley Madison Hack<\/em>, Forbes, (Oct. 26, 2015, 11:55 AM), http:\/\/www.forbes.com\/sites\/ericbasu\/2015\/10\/26\/cybersecurity-lessons-learned-from-the-ashley-madison-hack\/#14c58a7eed99, archived at<\/em> https:\/\/perma.cc\/U4L3-R6VE.<\/p>\n

[6]<\/a> See id. <\/em><\/p>\n

[7]<\/a> See<\/em> Seung Lee, Ransomware Wreaking Havoc in American and Canadian Hospitals<\/em>, Newsweek, (Mar. 23, 2016, 10:23 AM), http:\/\/www.newsweek.com\/ransomware-wreaking-havoc-american-and-canadian-hospitals-439714, archived at<\/em> https:\/\/perma.cc\/MJ2N-UW4T.<\/p>\n

[8]<\/a> See id.<\/em><\/p>\n

[9]<\/a> See<\/em> Mary J. Culnan & Cynthia Clark Williams, How Ethics Can Enhance Organizational Privacy: Lessons From the ChoicePoint and TJX Data Breaches<\/em>, 33 MIS Q. 673, 673 (2009).<\/p>\n

[10]<\/a> David Burnham, The Rise of the Computer State 50 (1983).<\/p>\n

[11]<\/a> Culnan & Williams, supra<\/em> note 9, at 675.<\/p>\n

[12]<\/a> See<\/em> Search Results for \u201cEthics of a Data Breach,\u201d Google Scholar, https:\/\/scholar.google.com\/scholar?hl=en&q=ethics+of+a+data+breach&btnG=&as_sdt=1%2C47&as_sdtp=, archived at<\/em> https:\/\/perma.cc\/7HZG-UK9D (last visited Sept. 20, 2016).<\/p>\n

[13]<\/a> Culnan & Williams, supra<\/em> note 9, at 673.<\/p>\n

[14]<\/a> John Mingers & Geoff Walsham, Toward Ethical Information Systems: The Contribution of Discourse Ethics<\/em>, 34 MIS Q. 833, 837 (2010).<\/p>\n

[15]<\/a> See <\/em>Computerworld Staff, The Moth in the Machine: Debugging the Origins of the Bug<\/em>, Computerworld (Sept. 3, 2011, 7:00 AM), http:\/\/www.computerworld.com\/article\/2515435\/app-development\/moth-in-the-machine–debugging-the-origins-of–bug-.html, archived at <\/em>https:\/\/perma.cc\/KC3P-8QRF; see also<\/em> Fred R. Shapiro, Etymology of the Computer Bug: History and Folklore<\/em>, 62 American Speech 376, 376\u201377 (1987).<\/p>\n

[16]<\/a> See <\/em>Shapiro, supra <\/em>note 15, at 376\u201377 (noting that a moth was found in the Mark II in 1945, but contending that the word \u201cbug\u201d was used to describe defects in machines long before 1945; thus, the term did not originate with the insect found in the Mark II).<\/p>\n

[17]<\/a> See <\/em>Pragati Verma, You\u2019ve Been Breached — What Now? A Post-Mortem Checklist<\/em>, Forbes: AllClear ID (Aug. 17, 2015, 11:27 AM), http:\/\/www.forbes.com\/sites\/allclearid\/2015\/08\/17\/youve-been-breached-what-now-a-post-mortem-checklist\/#13a42ec34384, archived at<\/em> https:\/\/perma.cc\/Z365-VFCT.<\/p>\n

[18]<\/a> See id. <\/em><\/p>\n

[19]<\/a> See<\/em> Raymond R. Panko & Julia L. Panko, Business Data Networks and Security 91 (Pearson, 10th ed. 2015).<\/p>\n

[20]<\/a> Id.<\/em><\/p>\n

[21]<\/a> See<\/em> Verizon, Inc., 2016 Data Breach Investigations Report, at 20 (2016), http:\/\/www.verizonenterprise.com\/verizon-insights-lab\/dbir\/2016, archived at<\/em> https:\/\/perma.cc\/E8S4-RHVU (follow \u201cDownload the 2016 DBIR\u201d) [hereinafter Verizon Report].<\/p>\n

[22]<\/a> See<\/em> Keith Jarvis & Jason Milletary, Inside a Targeted Point-of-Sale Data Breach<\/em>, Dell SecureWorks, at 1 (Jan. 24, 2014), http:\/\/krebsonsecurity.com\/wp-content\/uploads\/2014\/01\/Inside-a-Targeted-Point-of-Sale-Data-Breach.pdf, archived at<\/em> https:\/\/perma.cc\/5V6Y-CAED.<\/p>\n

[23]<\/a> See<\/em> Hardekopf, supra<\/em> note 2.<\/p>\n

[24]<\/a> See <\/em>Michael A. Hiltzik, Computer Viruses Can Be Healthy for Innovation<\/em>, L.A. Times (Apr. 5, 1999), at 1, http:\/\/articles.latimes.com\/1999\/apr\/05\/business\/fi-24293, archived at<\/em> https:\/\/perma.cc\/A5ZD-P4R4.<\/p>\n

[25]<\/a> See<\/em> Panko & Panko, supra<\/em> note 19, at 93.<\/p>\n

[26]<\/a> See, e.g.<\/em>, Ned Potter, Top 10 Computer Viruses and Worms<\/em>, ABC News (Sept. 3, 2009), http:\/\/abcnews.go.com\/Technology\/top-computer-viruses-worms-internet-history\/story?id=8480794, archived at<\/em> https:\/\/perma.cc\/C6DW-YT2P (listing the top 10 most well-known computer viruses and worms).<\/p>\n

[27]<\/a> See<\/em> Verizon Report, supra<\/em> note 21, at 17 (noting that most phishing cases \u201cfeature phishing as a means to install persistent malware,\u201d leading to security breach).<\/p>\n

[28]<\/a> See<\/em> Panko & Panko, supra<\/em> note 19, at 96\u201397.<\/p>\n

[29]<\/a> See id.<\/em> at 96.<\/p>\n

[30]<\/a> See id.<\/em> at 97.<\/p>\n

[31]<\/a> See id.<\/em> at 96\u201397; see <\/em>FBI, Smishing and Vishing and Other Cyber Scams to Watch Out for This Holiday<\/em>, Federal Bureau of Investigation (Nov. 24, 2010), https:\/\/archives.fbi.gov\/archives\/news\/stories\/2010\/november\/cyber_112410\/cyber_112410 [hereinafter Smishing and Vishing<\/em>].<\/p>\n

[32]<\/a> See<\/em> Panko & Panko, supra<\/em> note 19, at 97.<\/p>\n

[33]<\/a> See<\/em> Smishing and Vishing, supra <\/em>note 31.<\/p>\n

[34]<\/a> See<\/em>, e.g.<\/em>, Eric Geier, Your Printer Could Be a Security Sore Spot<\/em>, PC World (Apr. 25, 2012, 6:01 PM), http:\/\/www.pcworld.com\/article\/254518\/your_printer_could_be_a_security_sore_spot.html, archived at <\/em>https:\/\/perma.cc\/7PZY-87MX (discussing five security threats network printers may impose); see also <\/em>Matt Smith, The 5 Most Common Tactics Used to Hack Passwords<\/em>, Make Use Of (Dec. 20, 2011), http:\/\/www.makeuseof.com\/tag\/5-common-tactics-hack-passwords\/, archived at<\/em> https:\/\/perma.cc\/YJ4K-NDLR.<\/p>\n

[35]<\/a> See<\/em> Jarvis & Milletary, supra<\/em> note 22, at 1,10.<\/p>\n

[36]<\/a> See<\/em> Staff of S. Comm. on Com., Sci., and Transp., 113th Cong., A \u201cKill Chain\u201d Analysis of the 2013 Target Data Breach 4 (2014), http:\/\/www.public.navy.mil\/spawar\/Press\/Documents\/Publications\/03.26.15_USSenate.pdf, archived at<\/em> https:\/\/perma.cc\/SLX8-24UD.<\/p>\n

[37]<\/a> See id.<\/em> at 8.<\/p>\n

[38]<\/a> See id.<\/em> at 9.<\/p>\n

[39]<\/a> See id.<\/em> at 2, 9.<\/p>\n

[40]<\/a> See id.<\/em> at 4.<\/p>\n

[41]<\/a> See generally<\/em> Richard J. McGowan & Hilary G. Buttrick, Moral Responsibility and Legal Liability, or Ethics Drives the Law<\/em>, 11 J. Learning in Higher Educ. 9, 10 (2015) (discussing the three basic elements of moral responsibility).<\/p>\n

[42]<\/a> Mingers & Walshman, supra<\/em> note 14 at 839.<\/p>\n

[43]<\/a> See generally<\/em> John Rawls, A Theory of Justice 347-50 (1971) (discussing the moral psychology and the acquisition of the sentiment of justice).<\/p>\n

[44]<\/a> See<\/em> Manuel Velasquez, Business Ethics: Concepts and Cases 308 (7th ed. 2012).<\/p>\n

[45]<\/a> See<\/em> id.<\/em> at 314; see generally<\/em> Thomas Garrett & Richard Klonoski, Business Ethics 88 (2nd ed. 1986) (discussing the fairness of a sales contract and the importance of protecting the dignity of the buyers).<\/p>\n

[46]<\/a> See generally<\/em> Clark Butler, Human Rights Ethics: A Rational Approach 80 (2008) (discussing the moral psychology and the acquisition of the sentiment of justice).<\/p>\n

[47]<\/a> See <\/em>Edgar H. Schein, The Problem of Moral Education for the Business Manager<\/em>, 8 Indust. Rev. 3, 4 (1966).<\/p>\n

[48]<\/a> Culnan & Williams, supra<\/em> note 9, at 674.<\/p>\n

[49]<\/a> See<\/em> Reed Dickerson, The Basis of Strict Products Liability<\/em>, 16 Food, Drug, Cosmetic L.J. 585, 591 (1961).<\/p>\n

[50]<\/a> See<\/em> David A. Hall, Strict Liability and Computer Software: Caveat Vendor<\/em>, 4 Computer\/L. J. 373, 373 (1983).<\/p>\n

[51]<\/a> See generally<\/em> Culnan & Williams, supra<\/em> note 9, at 681-82 (discussing the ways in which consumers are vulnerable when businesses lack appropriate data security measures); see also<\/em> Simon Petravick & Stephan G. Kerr, Protect Your Portable Data\u2014Always and Everywhere<\/em>, 6 J. of Acct. 30, 31 (2009) (discussing the ways in which businesspeople often fail to appropriately safeguard confidential client information).<\/p>\n

[52]<\/a> See <\/em>Culnan & Williams, supra<\/em> note 9, at 681-82.<\/p>\n

[53]<\/a> See<\/em> McGowan & Buttrick, supra <\/em>note 41, at 11.<\/p>\n

[54]<\/a> See<\/em> Culnan & Williams, supra<\/em> note 9, at 674.<\/p>\n

[55]<\/a> See<\/em> Norman C. Simon, Brendan M. Schulman & Samantha V. Ettari, Beware the Breach: Data Breaches, Notification Duties, and Legal Liability<\/em>, Lexology.com (Aug. 29, 2012), http:\/\/www.lexology.com\/library\/detail.aspx?g=221e63eb-ccea-4f5f-80e7-b72905037a6f, archived at<\/em> https:\/\/perma.cc\/9FBG-KKQY.<\/p>\n

[56]<\/a> See <\/em>Adi Snir, Dealing with the Law Lag<\/em>, LegalVision (May 6, 2016),\u00a0https:\/\/legalvision.com.au\/dealing-with-the-law-lag\/, archived at<\/em> https:\/\/perma.cc\/7SW7-4KFE.<\/p>\n

[57]<\/a> See<\/em> Peter J. Arant, Understanding Data Breach Liability: The Basics Every Attorney Should Know<\/em>, 40 Mont. L. 8, 8\u20139 (2015) (\u201cAt the federal level, there is no comprehensive data privacy or security law. Instead the U.S. follows a \u2018sectoral\u2019 approach, meaning there are federal laws that apply to specific sectors.\u201d).<\/p>\n

[58]<\/a> See id.<\/em>; see also Comparison of U.S. State and Federal Security Breach Notification <\/em>Laws, Steptoe & Johnson LLP (Jan. 21, 2016), http:\/\/<\/em>www.steptoe.com\/assets\/htmldocuments\/SteptoeDataBreachNotificationChart.pdf, archived at<\/em> https:\/\/perma.cc\/4R39-6XJQ.<\/p>\n

[59]<\/a> See<\/em> Rachel M. Peters, So You\u2019ve Been Notified, Now What? The Problem with Current Data-Breach Notification Laws<\/em>, 56 Ariz. L. Rev. 1171, 1175 (2014) (\u201c[O]nce an individual has been notified of a breach, she has limited legal recourse against the company or organization that exposed her personal information.\u201d).<\/p>\n

[60]<\/a> See<\/em> Arant, supra<\/em> note 57, at 8\u20139.<\/p>\n

[61]<\/a> See <\/em>Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936; see <\/em>Arant, supra<\/em> note 57, at 9 (noting that the Federal Trade Commission may bring lawsuits against companies with \u201clax security and privacy practices\u201d because they are considered \u201cunfair or deceptive practices\u201d); see also <\/em>Charlotte A. Tschider, Experimenting with Privacy: Driving Efficiency Through a State-Informed Federal Data Breach Notification and Data Protection Law<\/em>, 18 Tul. J. Tech. & Intell. Prop. 45, 47, 53\u201354 (2015) (\u201cBecause no federal law in the United States provides a broad, comprehensive set of data breach notification or data protection requirements for all businesses and consumers, other federal administrative bodies have provided catch-all protection in some circumstances.\u201d).<\/p>\n

[62]<\/a> See<\/em> Jeff Kosseff, Cyberwars: Navigating Responsibilities for the Public and Private Sector: Positive Cybersecurity Law: Creating a Consistent and Incentive-Based System<\/em>, 19 Chap. L. Rev. 401, 402 (2016) (We have \u201ca patchwork of related laws, including breach notification and privacy statutes, that focus on penalizing companies for inadequate data security. But our legal system lacks a coordinated network of laws that are designed to promote cybersecurity and prevent data breaches from occurring in the first place.\u201d); see also<\/em> Peters, supra<\/em> note 59, at 1181 (discussing various state law data-breach notification statutes).<\/p>\n

[63]<\/a> Security Breach Notification Laws<\/em>, Nat\u2019l Conf. of St. Legislatures (Jan. 4, 2016), http:\/\/www.ncsl.org\/research\/telecommunications-and-information-technology\/security-breach-notification-laws.aspx, archived at<\/em> https:\/\/perma.cc\/8JUS-CXX5 [hereinafter NCSL Security Breach Research]<\/p>\n

[64]<\/a> See id.<\/em><\/p>\n

[65]<\/a> Timothy J. Toohey, Beyond Technophobia: Lawyers\u2019 Ethical and Legal Obligations to Monitor Evolving Technology and Security Risks<\/em>, 21 J.L. & Tech. 1, 14 (2015) (explaining general state law requirements for data breach security in context of attorneys\u2019 obligations to secure data).<\/p>\n

[66]<\/a> See <\/em>Ind. Code \u00a7 24-4.9-2-10(1) (2014).<\/p>\n

[67]<\/a> Ind. Code \u00a7 24-4.9-2-10(2)(A)-(D) (2014).<\/p>\n

[68]<\/a> Ind. Code \u00a7 24-4.9-2-2(a) (2014).<\/p>\n

[69]<\/a> See <\/em>NCSL Security Breach Research, supra <\/em>note 63.<\/p>\n

[70]<\/a> See<\/em> Data Breach Charts, <\/em>Baker Hostetler 1, 17-18, http:\/\/www.bakerlaw.com\/files\/Uploads\/Documents\/Data%20Breach%20documents\/Data_Breach_Charts.pdf, archived at<\/em> https:\/\/perma.cc\/MM5K-ZRT3 (last visited Oct. 4, 2016) (providing state-by-state-survey of data breach notification requirements).<\/p>\n

[71]<\/a> See id. <\/em>at 9.<\/p>\n

[72]<\/a> See id.<\/em> at 9-12.<\/p>\n

[73]<\/a> See id. <\/em>at 13-16.<\/p>\n

[74]<\/a> See id.<\/em> at 15-16, 18-19.<\/p>\n

[75]<\/a> See <\/em>Sasha Romanosky et al., Empirical Analysis of Data Breach Litigation<\/em>, 11 J. Empirical Legal Stud. 74, 80 (2014) (\u201c[I]t is the residence of the individual that drives disclosure, not the location of the breach. That is, disclosure to an individual is required only if the state in which the individual is a citizen has adopted a disclosure law.\u201d).<\/p>\n

[76]<\/a> See<\/em> Arant, supra<\/em> note 56, at 10 (\u201cGiven the heterogeneous nature of state data breach notification laws, simultaneous compliance with multiple laws can be a logistical nightmare\u2014and an expensive one at that.\u201d).<\/p>\n

[77]<\/a> See<\/em> Jill Joerling, Note, Data Breach Notification Laws: An Argument for a Comprehensive Federal Law to Protect Consumer Data<\/em>, 32 Wash. U. J.L. & Pol\u2019y 467, 486 (2010) (\u201cCongress should take action immediately to enact a federal data breach notification law.\u201d); see also<\/em> Jay P. Kesan, et al<\/em>., A Comprehensive Empirical Study of Data Privacy, Trust, and Consumer Autonomy<\/em>, 91 Ind. L.J. 267, 346-48 (2016) (suggesting \u201ca complete overhaul of data privacy law[s] and the creation of [centralized] profile repository\u201d for consumers\u2019 data that would operate in a fashion similar to credit bureaus); Tschider, supra<\/em> note 61, at 72 (\u201ca federal statute should regulate all businesses involving consumer personal information to effectively preserve customer choice and control with respect to their information, to drive contract efficiency, and to facilitate international trade.\u201d).<\/p>\n

[78]<\/a> See<\/em> Joerling, supra<\/em> note 77, at 486.<\/p>\n

[79]<\/a> See id.<\/em> (\u201cReplacing the current patchwork of . . . state laws with a single comprehensive federal law would give businesses a clear road map to follow after a breach.\u201d).<\/p>\n

[80]<\/a> See<\/em>, e.g.<\/em>, Data Security and Breach Notification Act of 2015, H.R. 1770, 114th Cong. (2d Sess. 2016) (demonstrating a proposed federal data breach law that did not pass in Congress).<\/p>\n

[81]<\/a> See<\/em> Brett V. Newman, Hacking the Current System: Congress\u2019 Attempt to Pass Data Security and Breach Notification Legislation<\/em>, 2015 U. Ill. J.L. Tech. & Pol\u2019y 437, 445 (2015) (\u201cThe patchwork state legislation and numerous bill introduced in Congress show how difficult it is to agree on breach notification and data security measures. There is likely an agreement that the United States needs a data breach law, but that does not mean that one will be passed. The problem may also come from a surplus of Congressional committees claiming jurisdiction and trying to tackle the issue\u2014resulting in too many different bills.\u201d).<\/p>\n

[82]<\/a> See<\/em> Peters, supra<\/em> note 59, at 1196. (Although Peters analyzes an earlier draft bill, the Data Security & Breach Notification Act of 2013, her criticism holds true for the Data Security Breach Notification Act of 2015.)<\/p>\n

[83]<\/a> See id.<\/em>; see also<\/em> Tschider, supra<\/em> note 61, at 74-75 (emphasizing the need for a federal law that focuses on data protection in addition to data breach notification: \u201cHaving clear data protection standards will dramatically reduce uncertainty for consumers and business, as standard data protection requirements will be articulated and required for implementation . . .\u201d); see also<\/em> Andrea Peterson, Why this National Data Breach Notification Bill has Privacy Advocates Worried<\/em>, Wash. Post (Apr. 15, 2015), https:\/\/www.washingtonpost.com\/news\/the-switch\/wp\/2015\/04\/15\/why-this-national-data-breach-notification-bill-has-privacy-advocates-worried, archived at<\/em> https:\/\/perma.cc\/C9U3-S3W3 (noting that consumers could have fewer protections under Data Security Breach Notification Act of 2015 than they have under existing state laws).<\/p>\n

[84]<\/a> See<\/em> Kosseff, supra<\/em> note 62, at 403 (arguing that laws should create incentives through tax credits and litigation safe harbors to encourage businesses to invest in cybersecurity infrastructure; rather than focus solely on penalties for data breaches).<\/p>\n

[85]<\/a> See <\/em>Ponemon Inst., 2016 Cost of Data Breach Study: United States, IBM, 1, 3, 13 (2016).<\/p>\n

[86]<\/a> See<\/em> Peters, supra<\/em> note 59, at 1193.<\/p>\n

[87]<\/a> See id. <\/em>at 1197 (noting that a national data breach law that gives consumers a private right of action or requires mandatory credit monitoring \u201cwill be an incentive for companies to minimize data breaches.\u201d).<\/p>\n

[88]<\/a> See, e.g.<\/em>, Nicole Hong, For Consumers, Injury Is Hard to Prove in Data-Breach Case<\/em>, Wall St. J. (June 26, 2016, 8:06 PM), http:\/\/www.wsj.com\/articles\/for-consumers-injury-is-hard-to-prove-in-data-breach-cases-1466985988, archived at<\/em> https:\/\/perma.cc\/F3VF-8LKD.<\/p>\n

[89]<\/a> See<\/em> Baker Hostetler, supra<\/em> note 70, at 16\u201318.<\/p>\n

[90]<\/a> See<\/em> Kesan et al<\/em>., supra<\/em> note 77, at 277 (noting that \u201cmany other states merely require companies to notify customers of data breaches and the relevant statutes do not create any additional duties or entitlements.\u201d).<\/p>\n

[91]<\/a> See also<\/em> Thomas Martecchini, A Day in Court for Data Breach Plaintiffs: Preserving Standing Based on Increased Risk of Identity Theft After Clapper v. Amnesty International USA<\/em>, 114 Mich. L. Rev. 1471, 1474 (noting that courts are divided on \u201cwhether increased risk of identity theft is an injury-in-fact sufficient to create standing\u2026\u201d).<\/p>\n

[92]<\/a> See<\/em> Peters, supra<\/em> note 59, at 1185 (discussing various common law theories available to consumers for data breach).<\/p>\n

[93]<\/a> See id.<\/em> at 1185-87 (\u201c[A] principle reason that civil causes of action in data-breach cases are rarely successful is the difficulty consumer data-breach victims have in meeting the standing and injury requirements.\u201d).<\/p>\n

[94]<\/a> But see<\/em> Kesan et al<\/em>., supra<\/em> note 77, at 344 (discussing the various types of harm that result from loss of control over personal data, \u201cincluding dignitary harms; a chilling effect from law enforcement having too much control over individual expression; and circumstances that interfere with an individual\u2019s ability to exercise freedoms or develop a sense of self-determination.\u201d).<\/p>\n

[95]<\/a> See,<\/em> e.g.<\/em>, Gunkel v. Renovations, Inc., 822 N.E.2d 150, 154 (Ind. 2005) (holding that economic losses are not recoverable in a tort action premised on the failure of a product or service to perform as expected unless the failure results in personal injury or physical harm to property other than the product; proper remedy sounds in contract).<\/p>\n

[96]<\/a> See <\/em>Peters, supra<\/em> note 59, at 1186 (discussing data breach cases dismissed on economic loss grounds).<\/p>\n

[97]<\/a> See<\/em> id.<\/em> at 1187 (discussing split of authority with regard to whether consumers have standing to bring suit in data breach cases).<\/p>\n

[98]<\/a> See,<\/em> e.g.<\/em>, Remijas v. Nieman Marcus Group, LLC, 794 F.3d 688, 691\u201392 (7th Cir. 2015) (holding that standing requires a litigant to show a concrete injury that is causally linked to the defendants conduct and can be redressed by the court).<\/p>\n

[99]<\/a> See id.<\/em><\/p>\n

[100]<\/a> See<\/em> Peters, supra<\/em> note 59, at 1189\u201392 (collecting cases addressing standing and injury-in-fact in context of data breach litigation).<\/p>\n

[101]<\/a> See id.<\/em>; see also<\/em> Martecchini, supra<\/em> note 91, at 1474 (noting that courts are divided on \u201cwhether increased risk of identity theft is an injury-in-fact sufficient to create standing\u2026\u201d).<\/p>\n

[102]<\/a> See<\/em> Michael D. Simpson, All Your Data Are Belong to Us Consumer Data Breach Rights and Remedies in an Electronic Exchange Economy<\/em>, 87 U. Colo. L. Rev. 669, 685\u201386 (2016) (discussing difficulties of applying common law tort theories to data breach cases).<\/p>\n

[103]<\/a> See<\/em> Peters, supra<\/em> note 59, at 1188 (\u201c[I]f a person is the victim of two or more data breaches in which similar personal information is stolen and that information is not used until years later to harm her, it may be difficult for the victim to demonstrate which breach was the source of the information used.\u201d); see also<\/em> Newman, supra<\/em> note 81, at 440 (\u201cproving that a customer lost money due to a specific breach can be difficult.\u201d).<\/p>\n

[104]<\/a> See<\/em> Peters, supra<\/em> note 59, at 1192\u201393.<\/p>\n

[105]<\/a> See generally <\/em>Jeff John Roberts, This Court Ruling Just Made It Easier to Sue Companies That Get Hacked<\/em>, Fortune (July 29, 2015, 7:00 PM), http:\/\/fortune.com\/2015\/07\/29\/data-breach-7th-circuit\/, archived at<\/em> https:\/\/perma.cc\/C4ZT-SQD7 (discussing the hurdles victims of data breaches face when trying to sue).<\/p>\n

[106]<\/a> See<\/em> Simpson, supra<\/em> note 102, at 698 (observing that \u201cthe average consumer is essentially at the mercy of a breached entity\u2019s largesse to gain any recompense for stolen data.\u201d).<\/p>\n

[107]<\/a> See<\/em> supra <\/em>Part II; see also<\/em> Martecchini, supra<\/em> note 91, at 1473 (noting that while many businesses are implementing data protection plans, \u201cmany other businesses still remain in denial about the threat of data breaches, either failing to implement any data-security changes or making only nominal modifications.\u201d).<\/p>\n

[108]<\/a> See <\/em>Pierluigi Paganini, Preventing and Recovering From Cybercrime<\/em>, Tripwire (Nov. 4, 2014), http:\/\/www.tripwire.com\/state-of-security\/incident-detection\/preventing-and-recovering-from-cybercrime\/, archived at<\/em> https:\/\/perma.cc\/PYB7-VKN5.<\/p>\n

[109]<\/a> See<\/em> Panko & Panko, supra<\/em> note 19, at 92.<\/p>\n

[110]<\/a> See id.<\/em><\/p>\n

[111]<\/a> See<\/em> id.<\/em><\/p>\n

[112]<\/a> See <\/em>Paganini, supra<\/em> note 108.<\/p>\n

[113]<\/a> See DC Metro Cyber Security Summit<\/em>, The CyberWire (June 3, 2015), https:\/\/www.thecyberwire.com\/events\/dc-metro-cyber-security-summit-2015.html, archived at<\/em> https:\/\/perma.cc\/Z4XN-M6NK.<\/p>\n

[114]<\/a> See, e.g.<\/em>, Panko & Panko, supra<\/em> note 19, at 116\u201323 (discussing various forms of firewalls, their strengths, and their weaknesses).<\/p>\n

[115]<\/a> See id.<\/em> at 124.<\/p>\n

[116]<\/a> See, e.g.<\/em>, Third Party Monitoring – Vendor Monitoring<\/em>, ObserveIT, http:\/\/www.observeit.com\/solutions\/third-party-monitoring, archived at<\/em> https:\/\/perma.cc\/P3SX-SW4W (last visited Sept. 23, 2016) (illustrating the monitoring services that a third party security company provides).<\/p>\n

[117]<\/a> See<\/em> Paganini, supra <\/em>note 108.<\/p>\n

[118]<\/a> See<\/em> Verizon Report, supra<\/em> note 21, at 17.<\/p>\n

[119]<\/a> Id.<\/em> at 18.<\/p>\n

[120]<\/a> See generally<\/em> Jerry Fitzgerald, Alan Dennis & Alexandra Durcikova, Business Data Communications and Networking 362 (11th ed. 2012) (noting that security policies should explain to employees how to control the risk of intrusion).<\/p>\n","protected":false},"excerpt":{"rendered":"

\u00a0BDM Publication Version PDF Cite as:\u00a0Hilary G. Buttrick et al.,The Skeleton of A Data Breach: The Ethical and Legal Concerns,\u00a023 Rich. J.L. & Tech. 2 (2016),\u00a0http:\/\/jolt.richmond.edu\/wp-content\/uploads\/volume23_article2_Buttrick.pdf. Hilary G. Buttrick,*\u00a0Jason Davidson,**\u00a0Richard J. McGowan*** \u00a0 Introduction\u00a0 [1] \u00a0\u00a0\u00a0\u00a0\u00a0 After over thirty data breaches spanning the third and fourth quarter of 2012, Forbes magazine labeled the summer of […]<\/p>\n","protected":false},"author":4287,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[1228],"tags":[],"class_list":["post-3463","post","type-post","status-publish","format-standard","hentry","category-articles"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/paMHOZ-TR","jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/posts\/3463","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/users\/4287"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/comments?post=3463"}],"version-history":[{"count":0,"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/posts\/3463\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/media?parent=3463"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/categories?post=3463"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/tags?post=3463"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}