The Cloud Act : A risk for your company ?

•

0 likes•335 views

What the Cloud Act means for your business and your data You heard about the Cloud Act but you don’t know what it means? You do know what it means but you don’t know how it might affect you? This talk explains the impact of US legislation on your data hosted at OVHcloud or elsewhere. What is the risk? How does Cloud Act fit with GDPR? How does OVHcloud help you to control who has access to your data? Does it matter where your data is located? These and other questions will be addressed by our Chief Legal Officer, in plain and simple terms.

Technology

#OVHcloudSummit
THE CLOUD ACT:
A RISK FOR YOUR
COMPANY?
Adam Smith
Chief Legal Officer
ROOM 5
FROM 3 PM
TO 3.45 PM

#OVHcloudSummit
INTRO: WHAT IS IT
ABOUT?
From zero to hero about the “Cloud Act”
Understand the context
Understand the risk
Make better decisions about your move to the cloud

#OVHcloudSummit
THE FEARS….
• Expansion of US power
• Jeopardises territorial
sovereignty (data
sovereignty)
• Incompatible with
fundamental rights to
privacy
• Extraterritorialiality

#OVHcloudSummit
DEFINITIONS
Law enforcement agency
Provider (RCS or ECS)

#OVHcloudSummit
• Location of data
• Bilateral agreements

#OVHcloudSummit
A provider must preserve, backup,
or disclose content …and
subscriber information within its
possession, custody, or control,
regardless of whether such …
information is located within or
outside of the United States”

#OVHcloudSummit
THE STORED
COMMUNICATIONS
ACT
1986

#OVHcloudSummit
“possession custody or control”

#OVHcloudSummit
Under the SCA and the Due
Process clause of the U.S.
Constitution, a warrant or
subpoena may only be directed to
an entity that is subject to
“personal jurisdiction” in the United
States.

#OVHcloudSummit
A SUBSIDIARY OF A
US COMPANY

#OVHcloudSummit
A COMPANY WITH NO
CONNECTION TO USA

#OVHcloudSummit
A FRENCH COMPANY
WITH A US
SUBSIDIARY

#OVHcloudSummit
FIVE SAFEGUARDS
• Must be an RCS or ECS
• Subject to US jurisdiction
• Evidence is in P, C or C
• Due process, probable
cause
• “Comity”

#OVHcloudSummit
Mutual Legal Assistance Treaty

#OVHcloudSummit
« Sur les 12 derniers mois, nous avons
reçu 25 requêtes en provenance des
forces de l'ordre américaines, la plupart
visait des clients US, aucune ne
concernait des organisations publiques,
cotées et aucune ne visait des
entreprises françaises », Stéphane
Hadinger, AWS
https://www.lemondeinformatique.fr/actualites/lire-aws-et-idc-unis-pour-
desamorcer-la-portee-du-cloud-act-76405.html

#OVHcloudSummit
PROVIDER CAN
OBJECT
IF(i) the customer is not a US person and is
not resident in US; and
(ii) disclosure would require the provider
to violate “qualifying” foreign law; and
(3) the “interests of justice” dictate that the
order should be quashed.

James Arlen and Tiffany Rad As a participant in the information economy, you no longer exclusively own material originating from your organic brain; you leave a digital trail with your portable device's transmitted communications and when your image is captured by surveillance cameras. Likewise, if you Tweet or blog, you have outsourced a large portion of your memory and some of your active cognition to inorganic systems. U.S. and International laws relating to protection of intellectual property and criminal search and seizure procedures puts into question protections of these ephemeral communications and memoranda stored on your personal computing devices, in cloud computing networks, on off-shore "subpoena proof" server platforms, or on social networking sites. Although once considered to be futuristic technologies, as we move our ideas and memories onto external devices or are subjected to public surveillance with technology (Future Attribute Screening Technology) that assesses pre-crime thoughts by remotely measuring biometric data such as heart rate, body temperature, pheromone responses, and respiration, where do our personal privacy rights to our thoughts end and, instead, become public expressions with lesser legal protections? Similarly, at what state does data in-transit or stored in implantable medical devices continuously connected to the Internet become searchable? In a society in which there is little differentiation remaining between self/computer, thoughts/stored memoranda, and international boundaries, a technology lawyer/computer science professor and a security professional will recommend propositions to protect your data and yourself.

Contracting for Better Cybersecurity

Shawn Tuma

Better Security Through Big Data Analytics

Symantec

Think Big Data Analytics can't help you with your security? Do these stats make you nervous? Attackers Moving Faster, defenses are not; 5 out of 6 large companies attacked; a 40% increase over 2013 More than 317 million new pieces of malware created last year; 1 million new threats created daily 60% of all targeted attacks struck small- and medium-sized organizations Retail Remains Hot Spot for Identities: 1 billion stolen in the last 2 years; 59% of all identities exposed in 2014 came from the retail sector Top 5 zero-days left companies without a patch for 295 days Digital extortion on the rise: 113% increase in ransomeware; 45 times more people had their devices held hostage by vicious crypto-ransomeware Malware gets smarter -- 28% of all malware was “virtual machine aware “ 2014 had an all-time high of 24 discovered zero-day vulnerabilities

Security Basics for Law Firms

Clio - Cloud-Based Legal Technology

Lawyers are required to enact 'reasonable' safeguards when storing client files. They must also deal with an ever-increasing number of new privacy regulations imposed on them and their clients. When handling sensitive client data, lawyers need to balance issues of confidentiality and privacy against building productive workflows. Failure to keep client information secure can lead to a potential waiver of privilege, malpractice claims, and even fines from various government agencies. Law firms need rigorous security, no matter their firm’s size or practice area. A law firm’s security plan must include three components: user training and access controls, secure technology, and a recovery plan. Join Clio’s lawyer in residence, Joshua Lenon, as he shows you how to enact a security plan for your law firm with guest Chris Wiesinger of CloudMask, an encryption service provider for cloud-based technologies. In this free, CLE-accredited presentation1, attendees will learn: The difference between confidentiality and privacy for law firms The regulations that apply to all law firms, as well as those for specific practice areas The security planning tips you can use to assess and protect your law firm The tools to improve your law firm’s security profile

AICPA The State of the Union of Forensic Accounting From Both Sides of the 49...

Rudner Law

SecureWorld Expo Dallas - Cybersecurity Law: What Business and IT Leaders Nee...

Shawn Tuma

This presentation was delivered by Shawn E. Tuma, Cybersecurity and Data Privacy Attorney, to SecureWorld Expo Dallas on September 27, 2016. This presentation was significantly updated from past presentations and included a discussion of the groundbreaking New York Department of Financial Services (NYDFS) Cybersecurity Requirements for Financial Services Companies. The main points of this presentation are: (1) Cybersecurity events create a crisis situation and should be treated as such; (2) Cybersecurity incidents are as much legal events as they are IT or Business / Public Relations events; (3) Companies must have a cybersecurity breach response plan in place and tested, in advance; (4) While consumer class action data breach litigation is a significant threat to companies and their leadership, it is not as great of a threat as regulatory enforcement by agencies such as the FTC and SEC, or the shareholder derivative claims for officer and director liability; and (5) The odds are that all company will be breached, but preparation and diligence can help minimize the likelihood that such a breach from being a catastrophic event. This presentation addresses the role of attorneys as the first responders in leading their clients through cybersecurity and data loss crisis events. The discussion begins by looking at the risk business have of being the victim of a cybersecurity or data loss incident and examining the nature of such incidents and the crisis environment they create. Then, because of this crisis environment, the need for leadership in helping keep the parties calm, rational, and making deliberate, calculated decisions. The discussion then explains why cybersecurity events are legal events and legal counsel is the natural leader that should fulfill this role and how they can do so. It will then discuss the process legal counsel will take, including assembling the key players in such an event, both internally and externally. It discusses the obligations for responding to such an event, the steps that must be taken, those that must be considered, and certain factors that go into the decision-making process. It briefly addresses the costs of such an incident and the liability issues that can arise from such an incident and failing to properly respond to the incident. This section includes a discussion of the cybersecurity lawsuit landscape, cybersecurity regulatory landscape, and the issue of cybersecurity-related officer and director liability stemming from shareholder derivative lawsuits based on cybersecurity incidents. It concludes with a discussion of the steps that companies can take to prepare for and be in a better position to respond to and mitigate the negative repercussions of such an incident.

CipherCloud Webinar - Cloud Encryption & Tokenization 101

CipherCloud

Cyber Security Extortion: Defending Against Digital Shakedowns

CrowdStrike

Real world lessons from CrowdStrike Services experts investigating complex cyber extortion attacks The criminal act of theft is as old as civilization itself, but in the cyber realm new ways to steal your organization's data or profit by holding it hostage, continue to evolve. With each advancement in security technology, adversaries work tirelessly on new techniques to bypass your defenses. This webcast, "Cyber Extortion: Digital Shakedowns and How to Stop Them" examines the evolution of cyber extortion techniques, including the latest "datanapping" exploits. Whether it's an attack on a major movie studio, a massive healthcare system, or a global entertainment platform, recent extortion attempts demonstrate how critical it is to understand today's threat landscape so you can ensure that your organization mounts the best defense possible. Download this presentation to learn what security experts from the cyber defense frontlines are discussing. Learn about: •The range of extortion techniques being used today, including commonalities and differences in approaches •Commodity type ransomware/datanapping vs. hands-on attacks — how are they alike and what are their differences? •Potential outcomes of paying vs. not paying when attempting to recover data after an attack •Real world examples of successful attacks and those that were thwarted or mitigated •Strategies for keeping your organization from being targeted and what to do if you become the victim of a cyber shakedown

Think You’re Covered? Think Again: Cybersecurity, Data Privacy, and Cyber Ins...

Withum

Cybersecurity Legal and Compliance Issues Business & IT Leaders Must Know -- ...

Shawn Tuma

This presentation was delivered by Shawn E. Tuma, Cybersecurity and Data Privacy Attorney, to the Joint Meeting of ISACA and IIA North Texas on January 12, 2017. This presentation was significantly updated from past presentations and included a discussion of the groundbreaking New York Department of Financial Services (NYDFS) Cybersecurity Requirements for Financial Services Companies. The main points of this presentation are: (1) Cybersecurity events create a crisis situation and should be treated as such; (2) Cybersecurity incidents are as much legal events as they are IT or Business / Public Relations events; (3) Companies must have a cybersecurity breach response plan in place and tested, in advance; (4) While consumer class action data breach litigation is a significant threat to companies and their leadership, it is not as great of a threat as regulatory enforcement by agencies such as the FTC and SEC, or the shareholder derivative claims for officer and director liability; and (5) The odds are that all company will be breached, but preparation and diligence can help minimize the likelihood that such a breach from being a catastrophic event. This presentation addresses the role of attorneys as the first responders in leading their clients through cybersecurity and data loss crisis events. The discussion begins by looking at the risk business have of being the victim of a cybersecurity or data loss incident and examining the nature of such incidents and the crisis environment they create. Then, because of this crisis environment, the need for leadership in helping keep the parties calm, rational, and making deliberate, calculated decisions. The discussion then explains why cybersecurity events are legal events and legal counsel is the natural leader that should fulfill this role and how they can do so. It will then discuss the process legal counsel will take, including assembling the key players in such an event, both internally and externally. It discusses the obligations for responding to such an event, the steps that must be taken, those that must be considered, and certain factors that go into the decision-making process. It briefly addresses the costs of such an incident and the liability issues that can arise from such an incident and failing to properly respond to the incident. This section includes a discussion of the cybersecurity lawsuit landscape, cybersecurity regulatory landscape, and the issue of cybersecurity-related officer and director liability stemming from shareholder derivative lawsuits based on cybersecurity incidents. It concludes with a discussion of the steps that companies can take to prepare for and be in a better position to respond to and mitigate the negative repercussions of such an incident.

WeSecure Data Security Congres: How to build a data governance framework

WeSecure

Privacy Concerns and Cloud Computing

AIIM International

Although cloud computing presents a compelling business case for companies looking to reduce spending, streamline processes, and increase accessibility, the very idea of trans-border data flows raises the hackles of privacy advocates all over the globe. In Canada, government and members of the public have expressed serious concern over the potential misuse of personal information gone offshore. Join Else for an overview of those concerns and what they might mean for your organization.

Cyber Liability Insurance Counseling and Breach Response

Shawn Tuma

This presentation focused on how teaching attorneys how to counsel their clients on cyber insurance and guide them through the data breach incident response process. Cybersecurity and data privacy attorney Shawn Tuma presented this continuing legal education session on March 10, 2017. It was delivered live at the TexasBarCLE presents the 8th Annual Course Essentials of Business Law:Four Modules for a Robust Practice Cosponsored by the Business Law Section of the State Bar of Texas.

NIST Cybersecurity Requirements for Government Contractors

Unanet

What is Controlled Unclassified Information (CUI)? What is NIST SP 800-171? How is my project management and accounting system impacted? Navigating your way through these complex topics can be difficult for any government contractor, but protecting CUI in a non-federal environment is critical. Compliance is required by December 31, 2017. Join us for this webinar to learn more about: • What it means to be compliant with NIST SP 800-171 • Documenting your compliance status • Preparing for audits and/or requests for compliance attestation/reports • Key CUI requirements • Suggested NIST processes • How having the right system and team in place can help you remain compliant Learn more at: https://www.unanet.com/news/demand-webinars

Sec_360_Capability_StatementRandy B.

Dark Web What it is & How Does it Work

Onsite Helper

kmd_hst_201312Samuel Boyle

Cloud security - Publication

Bianca Mueller, LL.M.

The term cloud is often used but widely misunderstood. The cloud comes in different shapes and sizes. The three most common cloud service models are Infrastructure as a Service (e.g. data storage), Platform as a Service (e.g. web servers, operating system) and Software as a Service (e.g. applications, software, web email). These three service structures can be deployed in four different ways: public cloud, private cloud, community cloud, or hybrid cloud.

OVHcloud Startup Program : Découvrir l'écosystème au service des startups

The Cloud Act : A risk for your company ?

Recommended

Recommended

More Related Content

Similar to The Cloud Act : A risk for your company ?

Similar to The Cloud Act : A risk for your company ? (20)

More from OVHcloud

More from OVHcloud (20)

Recently uploaded

Recently uploaded (20)

The Cloud Act : A risk for your company ?