Download to read offline
Uploaded byDan Michaluk
The internet as a corporate security resource
The document discusses the legal framework and tactics involved in using the internet as a corporate security resource, focusing on privacy laws such as PIPEDA and investigation tactics like background checks and intelligence gathering. It emphasizes the importance of balancing privacy rights with corporate investigation needs, outlining various tactics and their associated risk scores. Additionally, it highlights the need for ethical considerations and legal compliance in information collection processes.
More Related Content
Similar to The internet as a corporate security resource
The internet as a corporate security resource
- 1. The internet asa corporate security resource – tactics, tools and techniques Dan Michaluk March 19, 2015 This organization has been approved as an Accredited Provider of Professionalism Content by The Law Society of Upper Canada. This program contains 0.25 Professionalism Hours. This program is eligible for up to 0.75 Substantive Hours.
- 2. Outline • Legal framework •Tactics
- 3. Legal framework • Statutory,common law and criminal • Very contextual analysis about what is and is not permitted, without a bright line • Law reduces to one question – is the investigation tactic reasonable in light of all the circumstances? • Judges must recognize that investigation requires some "exploration," but we can't expect a blessing for aimless probing into private matters ("fishing")
- 4. Legal framework • PIPEDAsection 7(1)(b) permits collections • it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
- 5. Legal framework • PIPEDAsection 7(1)(d) permits collections of some kinds of publicly available information • personal information that appears in a publication, including a magazine, book or newspaper, in printed or electronic form, that is available to the public, where the individual has provided the information
- 6. Legal framework • PIPEDA7(1)(d) • The "appears in a publication" requirement will limit, but there is a question of how much – doesn’t expressly say "formal publication" • Addressed in one case that doesn't say much • Argument – implied consent to collection for some purposes (e.g., to conduct a threat assessment) • Consider – applicability of Charter expression right
- 7. Legal framework • Labourarbitrators often recognize privacy interest and balance management rights against a privacy interest • Courts now can hear a privacy tort claim • Unauthorized intrusion • Upon a reasonable expectation of privacy • Highly offensive to the reasonable person
- 8. Legal framework • CriminalCode • Section 342.1 – Hacking • Section 402.2 – Identity theft • Section 403 – Identity fraud
- 9. Legal framework • LawSociety – General rules
- 10. Legal framework • LawSociety – Rule 5.1-2 • When acting as an advocate, a lawyer shall not
- 11. Legal framework • LawSociety – Rule 7.2-6
- 12. Legal framework • LawSociety – Rules 5.1-5 and 5.3-1
- 13. Tactics • Nine tacticsin the following slides • Three purposes • Investigations • Background checks • Intelligence • Assigned a risk score (1 = low risk, 10 = high risk)
- 14. Tactics (Investigations) • Receivingunsolicited evidence from a friend
- 15. Tactics (Investigations) • Receivingunsolicited evidence from a friend • Risk score = 1 • An employer may often have a duty to receive and "process" this evidence • Numerous cases in which this evidence has been used without dispute – e.g. Sheridan College (Rowe)
- 16. Tactics (Investigations) • Wait,confront and ask for production
- 17. Tactics (Investigations) • Wait,confront and ask for production • Risk score = 1 • Mixed law on "right to silence," but non-cooperators open themselves to an adverse inference • Privacy likely to be a weak defence for social media publications (see M Picher cell record cases) • Think about scope of request, manner of production and risk of modification
- 18. Tactics (Investigations) • Searchingopen internet for evidence
- 19. Tactics (Investigations) • Searchingopen internet for evidence • Risk score = 3 • Permitted but may be challenged • Cleanest defence = reasonable for investigation • Document purposes • What is the relevant evidence? • Or, is the search to test veracity/credibility of statements/defences? to identify witnesses?
- 20. Tactics (Investigations) • Requesting"protected" evidence from a friend
- 21. Tactics (Investigations) • Requesting"protected" evidence from a friend • Risk score = 7 • The employee may become your agent in allowing unauthorized and unexpected access • By all means question to gather evidence • Then say, "Thank you. If you have anything else you wish to bring to our attention please let us know."
- 22. Tactics (Investigations) • Gainingunauthorized access to a SM account
- 23. Tactics (Investigations) • Gainingunauthorized access to a SM account • Any means (finding login credentials, under false pretenses) • Risk score = 10 • It happens • Calgary Police Service • Moore's Industrial Service Ltd
- 24. Tactics (Background Checks) •Background check of open internet w consent
- 25. Tactics (Background Checks) •Background check of open internet w consent • Risk score (1 to 10) = 1 • Until amended, PIPEDA arguably does not apply • Risks are manageable: (a) defer, (b) demonstrable need, (c) objective criteria, (d) not decision-maker, (e) written report and (f) validate negative information
- 26. Tactics (Background Checks) •Background check of open internet w/o consent
- 27. Tactics (Background Checks) •Background check of open internet w/o consent • Risk score (1 to 10) = 3 • Risks arguably increase when PIPEDA is amended to apply to candidates for employment • Manage risks per the suggestions above
- 28. Tactics (Background Checks) •Background check of protected spaces w consent
- 29. Tactics (Background Checks) •Background check of protected spaces w consent • Risk score = 7 • Conduct a supervised search, don't take login credentials • Permissible, but significant non-legal risks • Awkward, employee relations and public affairs risk
- 30. Tactics (Intelligence) • Usinginternet data for preventative purposes
- 31. Tactics (Intelligence) • Usinginternet data for preventative purposes • Risk score = 5 • Primary risk is derived from PIPEDA consent rule • Risk mitigation • Target activity (e.g. event monitoring), not people (e.g. adversarial group reports) • Favour surveillance (looking for exceptions) over intelligence gathering (building a dossier)
- 32. The internet asa corporate security resource – tactics, tools and techniques Dan Michaluk March 19, 2015 This organization has been approved as an Accredited Provider of Professionalism Content by The Law Society of Upper Canada. This program contains 0.25 Professionalism Hours. This program is eligible for up to 0.75 Substantive Hours.
Editor's Notes
- #2 Relevant topic Given to corporate security team last summer Found it helpful
- #3 1.0 hours Condensed presentation Rules that govern the use of Invite question and answer as we go
- #4 Statute – PIPEDA (nuclear), not FIPPA (exclusion) Common law -arbitral principles -civil tort Big qualifier – very grey area – today we're dealing with degrees of risk Be pragmatic -what's the risk? -are we likely to obtain information of value? -does that justify taking the risk? Fishing is a useful metaphor -e.g. three grounds – look at emails to find a fourth ground -there's risk that will vary with sensitivity of information
- #5 PIPEDA -applies to activities of a federally-regulated employer -regulates collection, use and disclosure of personal information -requires consent unless there's an exception -main exception you rely on is 7(1)(b) -two requirements -first requirement will often fit with social media evidence (disappears) -second requirement -not reasonable and probable grounds -not even reasonable suspicion -but opens up a broad review jurisdiction -burden of justification
- #6 Do we even need to worry about justification when it's online? Is it a publication? Did the individual provide it? -Autobiographical article in online magazine – YES -Malingering employee windsurfing photo on page 1 of paper – ARGUABLY NOT (!) -Mommy blog – ARGUABLY YES -Twitter stream - DEBATEABLE -Facebook - DEBATEABLE
- #7 This slide is for your defence lawyer Practically – 7(1)(d) will only cut down your risk a little Practically – don't assume it is not a privacy issue because it is posted online Pending interpretation and unless it clearly applies keep 7(1)(d) in your back pocket Focus on 7(1)(b) and justification in deciding what to do
- #8 Common law claim Is there a reasonable expectation of privacy in online information? If no, there's no privacy issue from a common law perspective R v Spencer, 2014 SCC 43 – protectable interest in surfing the internet anonymously Not the same as surfing the net "in the open" Typical judge may not "get" the privacy issue, an arbitrator might Example – Murphy v Perger, [2007] OJ No 5511 – 366 friends = no REP But… Ontario courts have arguably backed away from that position. Again, just because it is online doesn't mean you are out of the woods.
- #9 See handout Hacking -possession of a password (searching your system for login credentials) -obtaining access to a shielded SM account without authorization Identity theft (deals with acquiring information to impersonate) -doesn't rest on proof of false pretenses -dumpster diving, spyware, exercise of legitimate system rights -possession of password for purpose of gaining unauthorized access Identity fraud -fraudulent personating of another non-ficticious person -using someone's identity to gain access -e.g. creating a fake social media account of a real "trusted" person
- #10 -very aggressive tactics by security will engage these duties -we can't counsel in assistance of illegality ……….. -Do you violate 3.2-7 if advise an investigator on whether it is lawful to create a fictitious but appealing SM profile? -No -Though I think you may be prohibited by creating the profile yourself
- #12 ABA guidance -you (or your agent) can "friend" an unrepresented party but must fully disclose your proper identity and provide accurate answers to questions -under our Rules, you likely need to disclose your interest (see next slide, see 7.2-9) ABA guidance -don't friend a represented person -warns against inadvertent communications with represented parties (e.g. LinkedIN notifications)
- #13 -so you can friend a witness -but must disclose your interest
- #14 Apply the law and talk about tactics Investigations -gone wrong -looking for evidence Background checks -typically hiring Intelligence -preventative focus
- #16 -strange fit with PIPEDA -but your defence, if challenged, is 7(1)(b)
- #18 -quite obviously fine from a privacy perspective -risks a. compromise the availability b. say no -
- #20 -this one depends if privacy legislation applies -if it does you need to fit within the publicly available information exception OR -(better) the investigation exception ……….. -THE BEST POLICY FOR RISK MITIGATION PURPOSES IS TO RELY ON 7(1)(B) EVEN IF PUBLICLY AVAILABLE
- #22 -probably legal but could be the subject of good analysis -inducing breach of confidence? -inducing some other breach? -lawyers directing the collection -borderline -is this counselling "dishonesty" -you can talk to a witness without restriction – is this not the same?
- #24 -illegal, can be criminal
- #26 -PIPEDA may not apply -if it does you have consent ……. -the risks are related to human rights legislation
- #28 privacy risks are pretty low if no legislation applies if legislation applies you must carefully consider the scope of the publicly available information defence
- #30 -just awkward and aggressive from an HR perspective -legal risks are quite manageable
- #32 -risk here is that you can't collect under 7(1)(b) and, as discussed, the publicly available information exception is limited -but, if you don't target people and target activity you can argue you have not "collected" PI even if you gather information that would be about individuals in another argument -there is law that supports this argument
- #33 Privacy lawyer Employment lawyer Internet user … Not a PI Not a technologist