Defining Reasonable Security, Dave Stampley, Security BSides - New Orleans - May 30, 2015

1.
Bio: David A. Stampley, CIPP, is a partner at KamberLaw in New York. He has specialized in
data privacy and security compliance for over 15 years. Currently, he litigates information-
technology-related class actions. His prior roles include regulatory enforcement (New York
Attorney General’s Office), privacy officer (a Fortune1000 B2B technology provider), and
consultant and general counsel (Neohapsis). He started his legal career as an Assistant District
Attorney in the Manhattan D.A.’s Office.
Preview of conclusion: In every role I’ve had in the practice of privacy/security law, I’ve
advocated for what should be considered reasonable or unreasonable by my client, or should
have been considered reasonable or unreasonable by the other party in a court case.
• I started the same place discussed today—the laws, regulations, and cases—and the rule of
reasonableness.
• And then I looked at what rules there were in security literature—standards organizations,
textbooks, vendor documentation.
• But, inevitably, I started calling people—I/S professionals, and asked them what they
considered good/bad, acceptable/unacceptable; why; and how they draw the line. I asked
them what they observed in practice and wwhat they saw their peers in other organizations
doing. I asked how they would back up their positions if challenged.
That’s what I did, before advising upper management when I was in-house, or taking a
position in court—I asked the kind of people in this this room, because the answer is already
there. If a court then made a decision, that doesn’t mean a particular practice suddenly became
reasonable or unreasonable. It means it already was.

2.
2014 topic was “Who defines ‘reasonable security’? – Lessons from courts and regulators.
Some key takeaways:
• Wyndham case: FTC exercise of unfairness jurisdiction. Wyndham said it wasn’t on notice
of unreasonableness.
• Target case: CEOs affected? Maybe, but not through the courts. Security vendors on the
hook? Not likely to be a major trend yet.
• Why is “reasonable security” not more defined in enforcement actions/cases?
• Regulatory constraints and prosecutorial discretion: awareness, resources &
priorities, provability, litigation risk
• Class action constraints: consumer awareness, standing, certifiability, resources,
provability, litigation risk & cost (long duration of litigation on contingency)
• Result: Many security failures go unaddressed.
2014 session emphasized definition of “reasonable security” after the question was put to the
test in enforcement and court actions. But if regulators and courts haven’t yet answered the
question, how do I/S professionals determine what’s reasonable? Would it really help if the
government came up with an answer?

3.
Assumptions about target audience for this presentation:
• I/S professionals are trying to do their jobs. However, I/S is often viewed as a cost center.
Communicating needs & getting budget $ for security can be a struggle. But regardless of
who makes the go/nogo decision on security measures, if there’s a security failure, I/S is
likely to be a target for blame.
• Many I/S professionals believe clearer rules about what is “reasonable” would support their
mission.
So who defines “reasonable security”? In this 2015 session, the answer is the same as last year
—if I/S professionals want a workable definition, it’s incumbent on the I/S community to
come up with it, since it has the expertise.
• Last year I advocated for security experts and thought leaders to coalesce & be heard.
• This year, we’ll work toward the answer from a different angle--the front line. That’s where
the definition of reasonable security happens.
3

4.
Our starting point is the same as last year—the dictionary definition of “reasonable.”
• What is considered reasonable may vary with circumstances.
If that’s the case, you can’t expect regulators or courts to define it for every circumstance.
Instead, regulations tend to be general and follow this definition. See, e.g., GLBA
Safeguards Rules
• You might be thinking, “That’s no help.” But the expectation is that an organization,
informed by I/S professionals, can figure it out.
If “reasonable” care is “ordinary” care, what is “ordinary”? It’s a level of care that any
“competent [I/S professional] engaged in the same line of business would exercise under
similar circumstances.”
• What does that tell you? Under the law, the idea isn’t that someone is playing hide the ball,
not telling you the rule, and later playing gotcha. The expectation is that you already know
what you need to know to figure it out.
[Refer back to FTC & class action case lists. Would you need a specific rule to tell you...?]

5.
[Recap FTC jurisdiction]
• Prohibits unfair or deceptive acts or practices (may include omission).
[Recap Wyndham, LabMD discussion from last year—”we didn’t know the standards”; current
status]
• Some argue that the FTC’s current authority isn’t enough to bring actions against
companies for data breaches, espec. under unfairness jurisdiction.

6.
Would you need a more specific legal rule to tell you whether the alleged practices are sub-
standard and unreasonable?
[Discuss Verizon:
• FTC closing letters
• Value of prompt mitigation and cooperative response to regulatory inquiry.
• Recap from 2014: Recognition of enforcement body’s need to prioritize spending taxpayer
dollars.]
[Recap 2014 discussion. FTC and state AGs don’t--and can’t—bring enforcement actions for
every security failure.
• Jurisdiction (Wyndham challenge to FTC unfairness jurisdiction).
• Enforcement priorities discussed previously.
• Non-transparency—not every failure can be seen, so consumers and other businesses bear
the costs.]

7.
Would you need a more specific legal rule to tell you the whether alleged practices are sub-
standard and unreasonable?
[Recap 2014 discussion of barriers to relief in class action:
Non-transparency: consumers may not know to bring cases because may not know who
harmed them, or even that they were harmed.
Litigation risks, winnows down likelihood of relief: Cases handled on contingency, long
duration, multiple motions to dismiss, availability of competent experts, costly expert
discovery, technical sophistication of courts
Jurisdictions requiring plaintiff reliance on specific misrepresentations.
Certifiability of class.
Standing.]
Target: Last year, discussion in I/S community of whether security vendors like Trustwave
would be held liable for breaches. Not major trend so far.
Garvey v. Hulu: Appeal issue of VPPA knowledge element. Did Hulu know what was sent
to Facebook through Hulu’s implementation of Like button.
Target, Yahoo, Spokeo: Biggest issue = standing
•
•
•
•
•
•
•
•
7

8. One rule is—don’t rely on predictions.
Another is don’t hold your breath waiting for enforcers and courts to make the rules.
Will there be a next wave, focused on data breaches? Maybe. But just remember that lawyers
and reporters may be prone to making attention-getting predictions. There’s already a history
of private litigation in response to data breaches.

9. Returning to definition of “reasonable”--a key takeaway is, you don’t have to wait for
someone else to make rules because “everybody knows that.”
[2014 analogy: It doesn’t take a written rule to tell you to get the kids’ soccer team inside
when you see a thunderstorm.]
[Refer back to Black’s definition of reasonable & case overviews.]

10.
Many states have “baby UDAP” statutes. NY GBL § 349 provides useful angle in determining
what is reasonable—the reasonable consumer.
• Organization can’t count on defense of “good heart, empty head.” Did company promise
reasonable security and fail to deliver?
[Recap Wyndham discussion from last year—”we didn’t know the standards”; current
status]
“Website Security Flaw Costs ZD,” Brian McWilliams, Wired, Aug. 28, 2002
(regarding N.Y. Attorney General settlement with Ziff Davis Media for online
exposure of subscriber information database):
In a statement, New York-based Ziff Davis said Wednesday that it had not
broken any laws, and the company termed the incident “a one-time online
security violation ... caused by a coding error.”
Stampley said he was "surprised and disappointed" at Ziff Davis'
characterization of the facts of the case. "Acts such as failing to use SSL
encryption and disabling Web server logging indicate an ongoing failure to
follow standard security practices.”
• Requires thinking ahead and considering consequences. Not just a question of does system
do what we want, but whether someone else can use it in unwanted way.

11.
FTC’s safeguards rule under the GLBA useful in understanding that:
• reasonable security isn’t one-size-fits-all—what is reasonable depends on the organization
• the organization is expected to be able to figure it out.
Many I/S professionals have been challenged within their organizations to “show me where
the law says we have to do that.” The reasonableness standards under federal and state laws
and regulations are where.
Takeaways:
• I/S professionals don’t have to become lawyers to determine position on reasonable
security.
• I/S professionals do need to inform other actors in the organization, so reasonably
foreseeable risks can be evaluated in context.

12.
Good to be aware, but understand that lobbying positions aren’t rules or predictions I/S can
count on or a reason for inaction. Plus, there may be strategic and tactical reasons for those
positions that aren’t apparent.
• If there is a compliance “minefield,” why? Specific examples? How much of it consists of
pre-existing laws? How different are the laws?
Do consumers face any minefield of their own? Are they hurt/helped by a compliance
minefield? Who bears costs of security compliance & failure?
• Would “one, consistent federal standard” that trumps everything else give I/S desirable
rules? (Refer back to laws/cases). From a consumer advocate’s perspective, these would be
potential effects of “one standard”:
• weak standard that trumps better laws and further diminishes opportunities for
healthy enforcement (refer back to constraints on regulatory enforcement and class
actions)
• continues to shift the burden of losses to consumers
• puts organizations that want to do the right thing at a competitive disadvantage
• disincentivizes development of a more trustworthy and robust marketplace—what
looks like benefit to shareholder value is long-run loss of opportunity to maximize
• and still won’t give I/S rules that are specific to the circumstances of the
organization.
There may be very good bases for some policy arguments—but they are still just arguments.
For I/S, don’t drink the Kool-Aid. Your organization needs you to have a clear head and be
able to communicative objectively to those in organization who rely on I/S’s advice.

13.
Plus, I/S can’t count on the outcome of policy and legal arguments.
• [Example of Hulu defense that VPPA didn’t apply to streaming video]
• From 14 years ago—”Internet Privacy; Enforcement Actions,” David Medine and Christine
Varney, National Law Journal, Aug. 6, 2001:
“The FTC has treated Web site privacy policies as ‘representations,’ subjecting
them to scrutiny under the act, thus transforming a decades-old consumer
protection law into a comprehensive, modern privacy statute.”
Perhaps the authors weren’t saying that the law was stale and shouldn’t apply to website
privacy policies—but “transforming a decades old law” is a debatable characterization. The
law was there and applied to commerce. Commerce moved online. The law was applied
where commerce was taking place.
Deploying a new technology application doesn’t put the application beyond the reach of laws.
Remember examples from NY § 349 and FTC Safeguards Rule language: reasonably
foreseeable.
3

14.
Bottom line: Don’t wait for someone else to tell you what the rule is.
• Even if more rules are needed, even if you agree that federal standards should be
established that trump other laws: there are rules already, they need to be followed,
and I/S has a duty to take a leading role in defining what compliance with those
rules looks like.
• If policymakers devise new data security rules without meaningful I/S input, they
won’t be good rules.
Regardless of how rules evolve, or whether upper management is held accountable for
failures, failures puts I/S professionals at risk, so you’d better speak up. [Discussion: Average
CIO lifespan; I/S taking blame for breaches.]

15.
• But, when you speak up, or if you are in a consultative role to other I/S professionals, be
mindful: If the question is “Is it reasonable,” responding with “That won’t work” isn’t a
useful answer. Some I/S professionals dismiss technologies/approaches by saying “That
won’t work,” when what they really mean is, “It leaves some problems unsolved” or “It can
be exploited.” Does it solve some of the problem—how much? Is it a starting place? Is
there a better option?
Other pitfalls:
• Saying that the sky is falling, and saying it often. The sky is usually not falling. Some I/S
professionals treat security issues as crises when they are not, or fail to distinguish among
levels of seriousness. Sometimes internal clients do this—not necessarily motivated by
security.
• Failure to document compliance efforts. [Refer back to Safeguards Rule.] Thinking about
what’s reasonable, planning for it, documenting decisions shows attention to the issues. It’s
not only an important part of maintaining institutional memory and continuity, it can
validate the reasonableness of efforts, even if failure occurs. [Refer back to GLBA
Safeguards Rule—documented program.]

16.
• Don’t pre-judge compliance failure. Based on my experience, some employees (out of
vigilance or even internal jockeying) raise security issues with e-mails to too many
recipients saying “We’re non-compliant.” Sometimes it’s I/S, or other employees referring
to I/S issues.
• “We’re non-compliant” is not documenting compliance effort. It’s probably a legal
conclusion that should be left to lawyers to make.
• It may be the wrong conclusion. There may be mitigating factors. But what the e-
mail does is create a record that can be used as evidence against the organization,
even if the conclusion is incorrect. (That may be one of several reasons that your
lawyers may ask I/S to direct compliance concerns to them.)
Part of incident response should include how to communicate about potential issues that
require attention
[Refer back to Safeguards Rule.] Remember that, while I/S should be defining reasonable
security from the I/S perspective, defining what that looks like for the organization involves
others in the organization.

17.
Think back to cases discussed—was unreasonableness obvious? If what’s reasonable seems
hard ot pinpoint, start by defining what is out of bounds.
Rely on your expertise to define a starting point for what’s reasonable, as input to
organizational determination. Back yourself up—if you believe certain practices are
reasonable/unreasonable, there’s a reason why. What is industry practice? Get input from
colleagues in other organizations who are “prudent and competent person[s] engaged in the
same line of business or endeavor” facing “similar circumstances.” Refer to I/S
organization publications.
I often hear I/S professionals say “there’s no proof” of what’s reasonable. Your word is a
form of proof. You don’t get a guarantee of absolute proof, but your credibility is evidence,
and if you back up your position, it’s even stronger evidence.
Then you’re ready to talk to your lawyer with information your lawyer needs, instead of
just asking what the rule is.
Just as with some I/S professionals, some lawyers have a highly risk-averse “that won’t
work” approach, but at least you’ll be in a position to give your lawyers information they
need.
7
•
•
•

18.
[Discussion: What do you do if you believe there’s a compliance failure and no one listens?
Steps to protect yourself... ethical/moral issues.]
• The actions of I/S professionals matter in people’s lives. Right now, ask yourself: At one
point might it be necessary to sound an alarm and maybe put your job at risk —or to walk
away? What would make it hard to look yourself in the mirror in the morning? What are the
reasonably foreseeable risks? These are hard questions that sound dramatic, but those
kinds of challenges can come up, and when they do, they are dramatic. Ask yourself now,
because these questions may be harder to answer when you’re in the middle of a situation
in which the answers might matter.
• By asking yourself those questions—about where the line is between reasonable and
unreasonable—you may gain clarity that will help in communicating the more everyday
answers about what reasonable security looks like.
“Success is never final and failure never fatal. It’s courage that counts.” — Attributed to
George F. Tilton

19.
[Discussion--being heard: Comment period for regulations and standards.]
• Process is critical. It’s not just what you do, but how you do it, as a team, redundantly.

20. !
Preview of conclusion: In every role I’ve had in the practice of privacy/security law, I’ve
advocated for what should be considered reasonable or unreasonable by my client, or should
have been considered reasonable or unreasonable by the other party in a court case. !
• I started the same place discussed today—the laws, regulations, and cases—and the rule of
reasonableness.!
• And then I looked at what rules there were in security literature—standards organizations,
textbooks, vendor documentation.!
• But, inevitably, I started calling people—I/S professionals, and asked them what they
considered good/bad, acceptable/unacceptable; why; and how they draw the line. I asked
them what they observed in practice and wwhat they saw their peers in other organizations
doing. I asked how they would back up their positions if challenged.!
That’s what I did, before advising upper management when I was in-house, or taking a
position in court—I asked the kind of people in this this room, because the answer is already
there. If a court then made a decision, that doesn’t mean a particular practice suddenly became
reasonable or unreasonable. It means it already was.!
What reasonable security looks like down the road is for you to decide—maybe not alone—
but the security expertise is yoursThe rest of us are relying—reasonably so--on I/S
professionals, individually, and the I/S community, collectively, to tell us. !
20