AXEL.org

Blog

Should Privacy be a Human Right?

With the advancements in the mass surveillance technology used by governments and corporations, maintaining individual privacy has never been more important. AXEL believes privacy is a fundamental human right that these powerful institutions need to acknowledge. Without a vigorous defense of this position, influential organizations will inevitably erode privacy protections and lead society down a dark, Orwellian path.

Privacy law – not a new thing

Citizens demanding basic privacy is not a new phenomenon. Formal privacy law goes all the way back to 1361 AD in England[1]. Nevermind modern accouterments like cellphones, back then niceties such as plumbing and an easily traversable road system weren’t fathomable. It was the time of King Edward the III, with England and France engaged in what was to be known as ‘The 100 Years War.’ In other words, a LONG time ago.

The Justices of the Peace Act outlawed peeping toms and eavesdroppers under the penalty of imprisonment. It was a way to stop the town weirdo from spying on neighbors from behind a cow or haycart.

Today these concerns seem quaint, as every computer, cellphone, smartwatch, digital assistant, or any other piece of internet-connected technology is the equivalent of an eavesdropping creep. On the plus side, medicine advanced past the practice of bloodletting as a cure-all. So, we’ve got that going for us.

A decree from the United Nations

Fast-forward over half a millennium to 1948. The newly-formed international coalition, the United Nations, released the United Nations Declaration of Human Rights[2]. This short document outlined various human rights for all people. Article 12 states, “No one shall be subjected to arbitrary interference with his privacy, family, home, or correspondence, nor to attack upon his honor and reputation. Everyone has the right to  the protection of the law against such interference or attack.”

While these UN guidelines are clear and concise, they lacked any true enforcement capabilities. Fantastic ideals in theory; often ignored in practice.

United States privacy law history

Unfortunately, The United States Constitution doesn’t explicitly guarantee privacy as a right. However, not all is lost. Throughout the years, there have been legal arguments that other liberties imply privacy rights. Examples include:

  • Stanford Law Review April 2010. A piece in the prestigious legal journal by Orin Kerr outlined an argument that sought to apply the Fourth Amendment to internet privacy[3]. The focus is on police-related intrusions, specifically dealing with warrant requirements for digital surveillance.
  • Griswold v. Connecticut. This 1965 case set the precedent that the Constitution grants privacy rights against government intrusion implicitly from other liberties established in the Bill of Rights[4]. While the case pertained to marital relations, the ruling set a precedent for the more general concept of implicit rights.

The current state of privacy

Two-thirds of countries have privacy regulations on the books[5]. So, everything’s all good, right? Time for privacy advocates to pack it up and celebrate their victory! No, things are not all rainbows and sunshine in this space. In fact, the situation is pretty bad.

Government privacy intrusions

The U.S. government spying on its citizens is nothing new. The practice dates back at least 70 years. Over this time, many groups (political activists, civil rights leaders, union participants, the far-Left, the far-Right, you name it) became surveillance targets of federal agencies like the FBI, CIA, and NSA. However, the devastating 9/11 attacks combined with advancing digital technology created a perfect storm for privacy intrusion at a scale never before seen.

The details of which were outlined by whistleblower Edward Snowden in 2013[6]. Here are a few significant revelations of the leaks:

  • The NSA collected millions of peoples’ cellphone metadata (i.e., when calls are made/to whom) and location information[7]. A federal appeals court finally ruled this tactic illegal in 2020[8].
  • The NSA can easily break internet standard encryption methods to view private emails, financial transactions, and other personal data[9].
  • The NSA implemented a program code-named PRISM where the Big Tech companies would mine user data and turn it over to the agency upon request[10].

These only scratch the surface of the Snowden leaks. The story received enormous press coverage over the years, putting pressure on the federal agencies for more transparency. It is naive to think organizations like the NSA stopped using these tactics, though. After all, the courts didn’t ban illegal phone metadata collection until seven years after initial disclosure, after multiple other scandals[11].

Corporate intrusions

Of course, the government doesn’t have a monopoly on invading peoples’ privacy. Corporations are big players in the game, too (although, as seen in the PRISM program, the two entities can work together.)

Big Tech has a notorious reputation in this regard. Companies such as Facebook, Google, and Amazon collect so much personal data that their algorithms probably know people better than they know themselves.

The most known scandal involved Cambridge Analytica, a Big Data firm that bought user data from Facebook and used it to serve targeted political ads, allegedly resulting in a shift toward Donald Trump’s election[12].

Regardless of that hypothesis’s validity, data mining and selling are an everyday occurrence in Big Tech’s world. All one has to do is read the privacy policies or terms of service agreements the companies provide to get a glimpse at the breadth of knowledge they have about individuals. Easier said than done since those policies are thousands of words of legalese, but decipher them, and it becomes quite creepy.

Tougher legislation

Data privacy and protection are now mainstream topics. As such, some governments are enacting stronger legislation. The Gold Standard of these laws is the General Data Protection Regulation (GDPR) in the European Union. It is the most comprehensive data privacy law to date.

California took the main framework of the GDPR and passed a similar law called the California Privacy Rights Act (CPRA), which will take a few years to implement fully. While these are the best laws currently in effect, they still have loopholes that will undoubtedly lead to exploitation. Do they go far enough to protect everyone’s personal information? Only time will tell.

Be proactive

The GDPR and CPRA are much needed, but people should take matters into their own hands as well. Stop relying on “free” software from the megacorporations and search for privacy-based alternatives.

AXEL Go is the perfect solution for anyone looking for a private, secure file-sharing and storage platform. It has blockchain implementation, runs on the un-censorable InterPlanetary File System, and utilizes military-spec AES 256-bit encryption to ensure your files aren’t compromised. Sign up for a free Basic account and receive 2GB of online storage and enough network fuel for hundreds of typical shares. AXEL truly believes privacy is an inalienable human right. That’s why AXEL Go has industry-leading privacy features that will only get better. Download it today.

 

 

 

[1] English Parliament, “Justices of the Peace Act 1361”, legislation.gov.uk, https://www.legislation.gov.uk/aep/Edw3/34/1

[2] The United Nations, “The Universal Declaration of Human Rights”, un.org, 1948, https://www.un.org/en/universal-declaration-human-rights/#:~:text=Article%2012.,against%20such%20interference%20or%20attacks

[3] Kerr, Orin S. “Applying the Fourth Amendment to the Internet: A General Approach.” Stanford Law Review 62, no. 4 (2010): 1005-049. Accessed February 24, 2021. http://www.jstor.org/stable/40649623

[4] “Griswold v. Connecticut.” Oyez. Accessed February 24, 2021. https://www.oyez.org/cases/1964/496

[5] “Data Protection and Privacy Legislation Worldwide”, UNCTAD, Feb. 4, 2020, https://unctad.org/page/data-protection-and-privacy-legislation-worldwide

[6] Glen Greenwald, “Edward Snowden: the whistleblower behind the NSA surveillance revelations”, The Guardian, June 9, 2013, https://www.theguardian.com/world/2013/jun/09/edward-snowden-nsa-whistleblower-surveillance

[7] Barton Gellman, Ashkan Soltani, “NSA tracking cellphone locations worldwide, Snowden documents show”, The Washington Post, Dec. 4, 2013, https://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_story.html

[8] Josh Gerstein, “Court rules NSA phone snooping illegal -after 7-year delay”, Politico, Sept. 2, 2020, https://www.politico.com/news/2020/09/02/court-rules-nsa-phone-snooping-illegal-407727

[9] Joseph Menn, “New Snowden documents say NSA can break common Internet encryption”, Reuters, Sept. 5, 2016, https://www.reuters.com/article/net-us-usa-security-snowden-encryption/new-snowden-documents-say-nsa-can-break-common-internet-encryption-idUSBRE98413720130905

[10] Barton Gellman, Laura Poitras, “U.S., British intelligence mining data from nin U.S. Internet companies in broad secret program”, The Washington Post, June 7, 2013, https://www.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-internet-companies-in-broad-secret-program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story.html

[11] Zack Whittaker, “NSA improperly collected Americans’ phone records for a second time, documents reveal”, Tech Crunch, June 26, 2019, https://techcrunch.com/2019/06/26/nsa-improper-phone-records-collection/

[12] Dan Patterson, “Facebook data privacy scandal: A cheat sheet”, Tech Republic, July 30, 2020, https://www.techrepublic.com/article/facebook-data-privacy-scandal-a-cheat-sheet/

Why the Data Localization Movement is Misguided

Data localization, or data residency, is the concept of storing certain data collected on a nation’s citizens within the country of origin at all times. It gained steam after whistleblower Edward Snowden revealed the scope of government mass surveillance in 2013[1]. Governments worldwide enacted data localization legislation to protect state secrets and their citizens’ personal information from the watchful eyes of perceived competitors.

Governments expected and hoped these regulations would bring a host of benefits, including domestic IT job growth, more-hardened national cybersecurity, and increased data privacy. The truth is a bit murky, however, as the desired advantages haven’t materialized.

Countries and regions with data localization laws

First, let’s look into some examples of countries with data residency laws on the books. It is not a comprehensive list but illustrates how many nations are concerned about their data security.

The European Union

The EU’s sweeping data privacy law, the GDPR, sets many expectations for handling sensitive information, such as:

  • Profile data
  • Employment data
  • Financial data
  • Medical and health information
  • Payment data

The GDPR specifies that the above data types stay secured within the EU.  If any transfers are required out of the European Union, the countries receiving the information must have similar privacy regulations.

China

Unsurprisingly, China wants to keep a tight grip on its data. Basically, domestic network operators must store all data within China. They can transfer info across borders, but anything deemed “important” by the government must undergo a security clearance beforehand. What the CCP considers important is fairly broad. It includes:

  • Anything related to national security
  • Information that could identify Chinese citizens

As the country embraces Big Data collection on its citizens[2], you can expect the CCP to strengthen these laws.

Russia

The Russian Federation requires any personal identifying information about its citizens to be stored locally. This could mean:

  • Profile data
  • Financial information
  • Medical and health records

Interestingly, as long as companies initially stored the data in a Russian database, they can send it out of the country for further processing.

Their regulations don’t only apply to domestic organizations. Anyone doing business in the country is subject to the law, so multinational corporations there must have Russia-specific data centers.

These three regions alone account for over a quarter of the world’s population, and there are many more countries with data localization laws.  So, it’s pretty widespread. But what’s the United States’ opinion on the matter?

The United States viewpoint

The United States’ general belief is that data residency laws unduly stifle commerce and don’t offer the expected benefits. Analysts estimate half of the services trade depends on cross-border data flows[3]. With the United States being a service-dominant economy, it makes sense the government would oppose such regulation.

And oppose it, they have! In fact, it has been a point of contention in nearly all of its recent trade deal negotiations, though the EU and Korea have pushed back on outright bans. The USMCA, the North American trade agreement replacing NAFTA, formally prohibits the practice as a condition of doing business[4]. There are similar provisions in the U.S.-Japan Digital Trade Agreement[5] and the U.S.-Kenya Trade Agreement of 2020[6].

So, what are the downsides of data localization that countries like the United States want to avoid?

Technical issues

There is a multitude of technical headaches accompanying data localization. For instance, what if tech personnel in other countries access it regularly for debugging or maintenance purposes? Or, a company uses foreign backup databases for redundancy?

It’s challenging to build separate data centers in all applicable territories, even for large companies with sizable revenues. That makes it downright impossible for even the pluckiest startup to consider. But that should open up markets for smaller, domestic companies, right?

Lack of domestic stimulus

Unfortunately, significant job growth does not occur due to data localization. There are short-term construction jobs available if the data center requires a new building. After that, however, jobs are scarce. This is because the modern data center is mostly automated. The CBRE’s Data Center Solutions Group estimates that the average data center results in between 5-30 permanent, full-time positions[7]. Given the investment required for implementing data residency, it hardly seems worth it based on employment opportunities.

Privacy and security

Well, it has to be more secure and offer more data protection, though! That’s the biggest piece of the benefit pie. Not so fast.

In reality, the exact opposite appears to be true. Regarding privacy, you’d hope that housing data in the country of origin would benefit the citizens. But think back to some of the countries passing data localization laws. Is a full data set of personal information housed in a single jurisdiction good for the people in China? Or Russia? Very debatable. These nations are already surveillance states. Any data housed within their borders is at the control of their totalitarian governments.

Cybersecurity is another issue where expectations don’t match up with the real-world. Consider that these implementations aren’t in a vacuum and that they’ll inevitably cost a significant amount of money. That’s money the company will need to divert from other areas of the business. Cybersecurity could be one of those areas.

Additionally, data residency results in server centralization. This provides a larger attack surface for malicious agents and could ultimately mean more data breaches, not less.

So, paradoxically, data localization could make it easier for state-sponsored threat actors to carry out successful attacks. Combined with the economic inefficiencies, privacy concerns, and technical problems, it becomes plain to see that decentralization is a better path forward. Companies can employ other, less-expensive methods such as end-to-end encryption to protect sensitive information.

The AXEL Network

The AXEL Network is a decentralized, distributed system of servers backed by blockchain technology and the InterPlanetary File System. It gives users a secure, private way to share and store files on the internet. With server nodes located throughout the world, the AXEL Network offers both resiliency and performance. AXEL Go a the next-generation file-sharing platform using the AXEL Network. It combines all of the advantages listed above with optional AES 256-bit encryption to provide exceptional privacy and security. Download it today for Windows, Mac, Android, or iOS and receive a free 14-day trial of our unrestricted Premium service. Enjoy the power of a decentralized, distributed network.

 

[1] Jonah Force Hill, “The Growth of Data Localization Post-Snowden: Analysis and Recommendations for U.S. Policymakers and Business Leaders”, ResearchGate, Jan. 2014, https://www.researchgate.net/publication/272306764_The_Growth_of_Data_Localization_Post-Snowden_Analysis_and_Recommendations_for_US_Policymakers_and_Business_Leaders#:~:text=Abstract,geographies%2C%20jurisdictions%2C%20and%20companies.

[2] Grady McGregor, “The world’s largest surveillance system is growing- and so is the backlash”, Fortune, Nov. 3, 2020, https://fortune.com/2020/11/03/china-surveillance-system-backlash-worlds-largest/

[3] United States International Trade Commission, “Global Digital Trade 1: Market Opportunities and Key Foreign Trade Restrictions”, usitc.gov, Aug. 2017, https://www.usitc.gov/publications/332/pub4716_0.pdf

[4] Agam Shah, Jared Council, “USMCA Formalizes Free Flow of Data, Other Tech Issues”, The Wall Street Journal, Jan. 29, 2020, https://www.wsj.com/articles/cios-businesses-to-benefit-from-new-trade-deal-11580340128

[5] “FACT SHEET ON U.S.-Japan Digital Trade Agreement”, Office of the United States Trade Representative, Oct. 2019, https://ustr.gov/about-us/policy-offices/press-office/fact-sheets/2019/october/fact-sheet-us-japan-digital-trade-agreement

[6] ITI, “ITI: U.S.-Kenya Trade Agreement Can Set New Global Benchmark for Digital Trade”, itic.org, Apr. 28, 2020, https://www.itic.org/news-events/news-releases/iti-u-s-kenya-trade-agreement-can-set-new-global-benchmark-for-digital-trade

[7] John Lenio, “The Mystery Impact of Data Centers on Local Economies Revealed”, areadevelopment.com, 2015, https://www.areadevelopment.com/data-centers/Data-Centers-Q1-2015/impact-of-data-center-development-locally-2262766.shtml

Here’s Why Free Software Can Be a Poison Pill

There was a time when consumer expectations did not demand software be free. Sure, there has always been freeware, but it wasn’t the norm. If someone in the 1980s wanted a word processor, they expected to pay for it!

Today, these expectations have flipped. Why would someone pay for software or web services? Social media platforms are free. Big Tech companies like Google offer free alternatives to traditionally-paid programs such as word processors, spreadsheets, and visual presentation software. What’s the harm? The services are high-quality and users aren’t out a dime. It’s a win-win, right? Well, much like your relationship status during college, it’s complicated.

A costly endeavor

The truth is, software development is expensive. It’s always been expensive. And, even with the proliferation of outsourcing, it remains so today. It is a highly specialized skill requiring considerable knowledge and continued education. The median pay for a developer in the United States was over $107,000 in 2019[1]. Prices for outsourced developers vary by country but expect to pay around $30,000 a year for quality work[2]. Many development teams employ a mixture of domestic and foreign help.

Unlike the 80s, where a small team could complete programs in a basement, now larger units are necessary to deal with the complexities of modern computing. Big Tech’s full-featured products certainly require these sizeable teams of high-cost developers. Their offerings also typically need massive investments in physical infrastructure to keep the services running for millions of potential users. Knowing all this, how do they provide the end products for free? Out of the goodness of the shareholders’ hearts?

The tradeoff

Unsurprisingly, no. Big Tech companies are some of the largest businesses in the world, with billions in yearly revenue. The “free” apps and services they provide do require a form of payment. Your personal data. As the saying goes,” If you aren’t paying for the product, you are the product.”

Today, tech megacorporations collect an absurd amount of data on their users (and in Facebook’s case, even non-users[3].)  The data they find most useful usually falls into the following categories:

  • Email receipts. Who people email consistently can be a wealth of information for data miners.
  • Web activity. Big Tech wants to know which sites everyone visits, how long they stay there, and a host of other browsing metrics. They track across websites, analyze likes and dislikes, and even assess mouse cursor movement.
  • Geolocation. When tracking internet activity isn’t invasive enough, many companies evaluate where people go in the real world. Most don’t understand that their phones’ GPS sensors aren’t strictly used for directions to their Aunt’s new house.
  • Credit card transactions. Purchase records outline a person’s spending habits. Since the entire point of collecting all of this data is to squeeze money out of the user in other ways, this info is extremely valuable.

Imagine the models companies can create of their users, given all of that information. They use these models to personalize advertisements across their platforms. Advertisements more likely to result in sales mean more revenue, so they have an incentive to collect as much data as possible. But that’s not the only way they monetize personal information. Many sell it to third-parties too. Are you creeped out yet?

Alternative data providers

Organizations called ‘alternative data providers’ buy up all of this information, repackage it, and sell it off to whoever wants it (usually financial institutions looking to gain broad insights about the direction of a given market.)

As of 2020, there are over 450 alternative data providers[4], and what happens to your information after they get their hands on it is about as opaque as it gets. This is especially the case in the United States, as there are no federal privacy laws that set clear expectations regarding personal data sales and stewardship. However, there is hope with the passing of California’s new privacy law that Congress will finally tackle the subject.

Privacy policies

One way consumers can stay informed about an organization’s data collection guidelines is to read through its privacy policy and terms of service agreement. There, they can find general information about their practices. Unfortunately, organizations seldom list the specifics (i.e., which companies do they share with or sell the data to, etc.) These documents also tend to be excessively long and filled with confusing legalese. It makes it difficult to extract even basic information and leads to a frustrating user experience.

It’s no wonder that according to a Pew Research survey, only 22% of Americans read privacy policies “always” or “often” before agreeing to them[5]. Most just hit accept without a second thought. We recommend always looking into a company’s privacy policy and terms of service before using their products. If you don’t want to slog through the jargon, try out ToS;dr, a website that breaks down these documents into readable summaries. They also give Big Tech companies “privacy grades” based on what they find. A few examples include: (note: “E” is the lowest grade)

  • Facebook – E. Big surprise here. The company that stores data, whether the person has an account or not, did not score well.
  • Amazon – E. Although online retail is their bread and butter, Amazon also dabbles in providing free apps and services such as the Kindle App. They track people across websites and sell consumer data to third parties, among other egregious tactics.
  • Google – E. Google collects biometric data, shares info with third parties, retains data after erasure requests, and much more.

Search for your favorite social media platform or Big Tech service and see how it stacks up. Spoiler alert: probably not very well.

Another consideration

Open source projects have a poor reputation for cybersecurity since the developers are unpaid and less motivated to provide reliable support. Conversely, free Big Tech products typically get a pass on those risks. After all, their software is well-funded and receives developer support throughout its entire lifespan. This minimizes a few crucial points, though.

First, large tech corporations benefit immensely from a built-in following and the integrated marketing apparatuses at their disposal. This attracts a significantly higher baseline of users for any given service than a startup’s equivalent solution.  These massive user bases attract cybercriminals.

This leads to the second point; while these companies support their products and offer cybersecurity patches regularly, there will always be vulnerabilities. The services almost always run on centralized server farms, making for an enormous attack surface. And the products with the most users will always be the primary targets for phishing scams. So, it’s kind of a paradox. More marketing, support, and users lead to more attacks.

File sharing app examples

There are countless examples of vulnerabilities found in Big Tech apps and services, but here are a few examples in the file-sharing sector:

Google Drive: In the Fall of 2020, threat actors exploited a flaw in Google Drive to send push notifications and emails to users[6]. The messages contained malicious links containing dangerous malware. The situation affected hundreds of thousands of users.

Microsoft OneDrive: Although not officially breached, in April 2020, Microsoft announced a critical vulnerability in their OneDrive cloud app[7]. They quickly released a security fix, but it is unknown if hackers knew about the vulnerability beforehand or if they breached unpatched systems after Microsoft disclosed it.

Dropbox. In 2012, a hacker stole login credentials to over 68 million Dropbox users and sold them on the Dark Web. As if this weren’t bad enough, it took Dropbox three years to disclose the breach! So, during that time, nearly 70 million users were in danger.

ShareIt. This platform may be lesser-known in the United States, but it has 1.8 billion users worldwide and is very popular throughout Asia and Russia. A recent security audit found crucial exploits that could result in hackers stealing sensitive data[8]. Its website doesn’t even default to HTTPS, meaning security doesn’t seem to be a priority for the development team.

In conclusion, free platforms from multibillion-dollar corporations can be dangerous from both data collection and cybersecurity standpoints. Consumers should do their research and consider paying a small fee for privacy and security-focused competitors.

AXEL Go

AXEL is dedicated to giving data custody back to the user. We never sell personal information to third parties or mine accounts. Our file-sharing application, AXEL Go, utilizes blockchain technology, the InterPlanetary File System, and AES 256-bit encryption to provide the most secure cloud-sharing experience in the industry.

Sign up for AXEL Go and receive a free 14-day trial of our Premium service. Premium accounts receive five times more online storage than the Basic account, along with more security options and no restrictions on file sizes. After the trial, users pay $9.99/month to continue the Premium service or downgrade to the Basic account. So, stop worrying and share your documents securely with AXEL Go.

 

 

 

[1] “Occupational Outlook Handbook: Software Developers”, U.S. Bureau of Labor Statistics, 2019, https://www.bls.gov/ooh/computer-and-information-technology/software-developers.htm

[2] Julia Kravchenko, “How Much Does It Cost to Hire Developers: Software Developer Salary Guide 2018”, Hackernoon.com, March 12, 2018, https://hackernoon.com/how-much-does-it-cost-to-hire-developer-software-developer-salary-guide-2018-590fb9e1af2d

[3] Kurt Wagner, “This is how Facebook collects data on you even if you don’t have an account”, Vox, April 20, 2018, https://www.vox.com/2018/4/20/17254312/facebook-shadow-profiles-data-collection-non-users-mark-zuckerberg

[4] Rani Molla, “Why your free software is never free”, Vox, Jan. 29, 2020, https://www.vox.com/recode/2020/1/29/21111848/free-software-privacy-alternative-data

[5] Brooke Auxier, Lee Rainie, Monica Anderson, Andrew Perrin, Madhu Kumar, Erica Turner, “Americans and Privacy: Concerned, Confused And Feeling Lack Of Control Over Their Personal Information”, Pew Research Center, Nov. 15, 2019, https://www.pewresearch.org/internet/2019/11/15/americans-attitudes-and-experiences-with-privacy-policies-and-laws/

[6] Lindsey O’Donnell, “Scammers Abuse Google Drive to Send Malicious Links”, threatpost, Nov. 2, 2020, https://threatpost.com/scammers-google-drive-malicious-links/160832/

[7] Davey Winder, “Windows OneDrive Security Vulnerability Confirmed: All You Need To Know”, Apr. 15, 2020, https://www.forbes.com/sites/daveywinder/2020/04/15/windows-onedrive-security-vulnerability-confirmed-all-you-need-to-know/?sh=517e144b6fa3

[8] Ron Amadeo, “’ShareIt’ Android app with over a billion downloads is a security nightmare”, ars Technica, Feb. 16, 2021, https://arstechnica.com/gadgets/2021/02/shareit-android-app-with-over-a-billion-downloads-is-a-security-nightmare/

Have We Entered the Age of Cyber Terrorism?

What pops in your mind when you hear the term ‘hacker’? Years of corny representations in pop culture probably conjure up the image of a sweaty, obese man giggling to himself in his parent’s basement. Recently, the proliferation of state-sponsored hacker groups may have shifted this view somewhat. Still, even the worst breaches, such as the SolarWinds incident disclosed in December 2020, only move the needle of our collective attention span for few days at most. The danger is too abstract to take seriously.

But, what about attacks against critical infrastructure? Does a hacker’s attempt to poison a small Florida town’s water supply transform your conception from goofy punchline to legitimate terrorist? It should.

Oldsmar Florida water supply hack

On February 8, 2021, an unknown hacker or hacker group attacked Oldsmar’s water treatment plant[1].  The culprit took control of the treatment plant’s computer system and briefly increased the amount of lye in the water supply from 100ppm (parts per million) to 11,100. Lye is a corrosive chemical used to balance water’s pH, but it can be very harmful or even deadly in the incorrect ratio. Needless to say, a 100-fold rise in the amount of lye would have meant dire consequences for Oldsmar.

Luckily, a plant worker spotted the intrusion immediately and decreased the lye to normal levels quickly so no tainted water made it into the system. Had the plant operator not been on their game, or if the plant was completely automated, it could have been a disaster. Many smaller water treatment plants throughout the United States do not have constant human supervision, and they’re even less likely to have robust cybersecurity defenses.

Currently, the identity of the malicious agent(s) responsible for the attack is unknown. Both the FBI and Secret Service are investigating the matter[2]. Oldsmar is a town of approximately 15,000 people on the Gulf Coast of Florida, so you wouldn’t think it’s exactly a prime target for nation-state actors. Furthermore, the attack was not very sophisticated[3], pointing toward a more inexperienced perpetrator.

Preliminary analysis shows that the hacker accessed the water plant’s computer system via the remote desktop program, Teamviewer[4]. The system ran Windows 7, an older, outdated operating system that Microsoft has not supported with security patches for over a year. This, combined with poor password policies, led to the dangerous breach.

Not the first incident of cyber terrorism

The Oldsmar hack is very frightening but not the first occurrence of cyber terrorism. Here are a few notable past examples.

Israel water supply attack

Water supply attacks didn’t begin with Oldsmar. In May 2020, Israel implicated Iran in an attack on water treatment plants throughout the country. There is a striking similarity to the Oldsmar situation in that the hack’s goal was to change the proportion of chemicals mixed into the water[5]. So had Israel not noticed and foiled the assault, thousands of people could have been harmed.

The Israel-Iran conflict is way beyond this article’s scope, but know that this cyber incident is just one event in a long game of cat-and-mouse between the two archnemeses. With tactics such as these escalating the conflict, hopefully sanity prevails before a catastrophe happens.

Australia targeted by China

In another geopolitical squabble, in June 2020, Australia reported attacks against a variety of its critical infrastructure[6]. While officially unconfirmed, government officials attributed the attacks to China. Power plants, water networks, transportation grids, and communications grids all fell in the crosshairs.

The prevailing explanation for China’s motivation is that Australia put pressure on the communist nation to let an independent research team investigate the origins of the COVID-19 pandemic. This led to increased tensions, with China placing restrictions on trade with Australia and encouraging its citizens not to visit as tourists[7]. Analysts believe the hacks fell into this category of retaliation.

Ukrainian power grid hijacked

When discussing cyberattacks against infrastructure, you can’t leave out the Ukrainian power grid’s hack in December of 2015. Malicious agents infiltrated deep into the control systems of nearly 60 power Ukrainian substations[8]. It cut the power to 230,000 people in the area for between 1-6 hours. It was the first time a hack of a country’s electrical grid resulted in significant power outages. Cybersecurity experts pinpoint Russia as the offenders, and the very next year, they struck again by blacking out a small portion of Kyiv[9].

A look to the future

These situations largely avoided the worst potential consequences of cyber terrorism, can that be counted on forever? The truth is that all countries have vulnerable Industrial Control Systems (ICS) tied to critical infrastructure. The number of vulnerabilities disclosed in 2020 increased by 25% compared to the previous year, and this trend is only expected to continue[10].

There needs to be a national discussion about the prevention of cyber terrorism, as well as the contingency plans required just in case the worst happens. There can’t be a situation where a city’s electrical grid is so compromised that citizens are without power for a significant amount of time. Or where a threat actor successfully poison’s a town’s water supply. If society is not proactive about these scenarios, calamity is inevitable.

Securing data is our job

AXEL’s dedication to providing secure solutions for file sharing and storage is unparalleled. Our innovative, easy-to-use file-sharing platform, AXEL Go, protects your sensitive document from hackers and nosey corporations. Our engineers integrated blockchain technology, the InterPlanetary File System, and AES 256-bit encryption to ensure industry-leading privacy and safety. Download AXEL Go today for Windows, Mac, iOS,  and Android to see how secure file sharing can be.

 

[1] Jack Evans, “Someone tried to poison the water supply of this Florida city in a hack, sheriff says”, The Miami Herald, Feb. 8, 2021, https://www.miamiherald.com/news/state/florida/article249110820.html

[2] Mahsa Saeidi, “FBI and Secret Service investigating Florida water hack”. News Nation, Feb. 9, 2021, https://www.newsnationnow.com/us-news/southeast/fbi-and-secret-service-investigating-florida-water-hack/

[3] Ionut Ilascu, “Hackers tried poisoning town after breaching its water facility”, Bleeping Computer, Feb. 8, 2021, https://www.bleepingcomputer.com/news/security/hackers-tried-poisoning-town-after-breaching-its-water-facility/

[4] ABC News, “Outdated computer system exploited in Florida water treatment plant hack”, ABC Columbia, Feb. 11, 2021, https://www.abccolumbia.com/2021/02/11/outdated-computer-system-exploited-in-florida-water-treatment-plant-hack/

[5] “Israel thwarted attack on water systems: cyber chief”, DW.com, May 28, 2020, https://www.dw.com/en/israel-thwarted-attack-on-water-systems-cyber-chief/a-53596796

[6] Associated Press, “Australia says an unnamed state is increasing cyberattacks on its infrastructure, businesses”, LA Times, June 19, 2020, https://www.latimes.com/world-nation/story/2020-06-19/australian-leader-says-unnamed-state-increasing-cyberattacks

[7] “China punishes Australia for promoting an inquiry into covid-19”, The Economist, May 23, 2020, https://www.economist.com/asia/2020/05/21/china-punishes-australia-for-promoting-an-inquiry-into-covid-19

[8] Jose A. Bernat, “Inside the Cunning, Unprecedented Hack of Ukraine’s Power Grid”, Wired, Mar. 3, 2016, https://www.wired.com/2016/03/inside-cunning-unprecedented-hack-ukraines-power-grid/

[9] Andy Greenberg, “’Crash Override’: The Malware That Took Down a Power Grid”, Wired, June 12, 2017, https://www.wired.com/story/crash-override-malware/

[10] Eduard Kovacs, “Number of ICS Vulnerabilities Continued to Increase in 2020: Report”, Security Week, Feb. 4, 2021, https://www.securityweek.com/number-ics-vulnerabilities-continued-increase-2020-report

Law Enforcement is Already Breaking into Encrypted Devices

Are we living in the drowsy beginnings of an Orwellian nightmare? The signs don’t look great. In Orwell’s most famous book, 1984, the protagonist Winston exclaims, “Freedom is the freedom to say two plus two make four,” as an appeal to the uncontroversial description of objective reality. You may think our society hasn’t sunk that low yet, but with 2+2=5 receiving some mainstream acceptance[1], sirens should be sounding in your head.

Beyond that can of worms lies less abstract evidence that our world is slipping into dystopia, such as the increasingly-shady tactics law enforcement agencies use to pry evidence from peoples’ phones.

A bit of backstory

The 2014 Supreme Court case Riley v. California scored a rare unanimous decision[2]. In it, the Justices upheld that law enforcement is not allowed to search a suspect’s phone upon arrest without a warrant. Privacy advocacy groups saw this as a significant win in the fight against unconstitutional search procedures.

Since then, the central issue centers around the topic of encryption. Police don’t like encryption, as it makes their job more difficult, even when they have a warrant. The frustration is understandable. Going through the trouble of attaining a warrant against an alleged criminal and still being unable to access their device to get crucial evidence would be upsetting. This is precisely what happened in the high-profile cases of the 2015 San Bernardino[3] shooting and the 2019 Pensacola Naval Air Station[4] shooting.

It boils down to the Department of Justice wanting tech companies like Apple and Google to implement “backdoors” into their operating systems, allowing law enforcement to bypass the encryption when necessary. Of course, the problem is that once you put a backdoor in a piece of software, there is no way to ensure only the “good guys” can use it. As we’ve seen with cyberattacks such as the recent SolarWinds breach, malicious hackers seem to be one step ahead of cybersecurity as-is. Now, imagine if developers had to code in an explicit path that allowed system breaches. It doesn’t seem like a good idea, right?

This image has an empty alt attribute; its file name is Guns_used_in_San-Bernardino_shooting-2.jpg
The guns used by the San Bernardino shooter. San Bernardino County Sheriff’s Department, Public domain, via Wikimedia Commons

In the end, the bluster of the United States Department of Justice wasn’t necessary. In both of the shooting cases mentioned above, the feds cracked the encryption without Apple’s help[5][6]. Although, in the San Bernardino case, authorities shelled out over a million dollars to freelance hackers to do so. Those payment requirements are unsustainable, even for the U.S. government. So, their typical workflow is a bit different.

How they do it

This image has an empty alt attribute; its file name is 800px-CLB_logo_Tag_2color_pos_rgb.png
Cellebrite Logo Alon Klomek, GM, InternationalChris Armstrong (Toronto), CC BY-SA 4.0, via Wikimedia Commons

Law enforcement agencies use Mobile Device Forensic Tools (MDFTs) to break into locked, encrypted phones. Third-party vendors such as Grayshift and Cellebrite provide these tools[7][8]. Cellebrite is an Israeli company that requires the agency to send in the device they wish to crack. In contrast, the United States-based Grayshift gives the software and hardware packages directly to law enforcement. Both cost tens of thousands of dollars or more. MDFTs bypass locking and encryption mechanisms through system exploits. This is why Cellebrite has law enforcement send the mobile devices directly to them. It prevents the actual mobile companies (Apple and Google) from purchasing the tools to see which exploits they use and patching them.

 

MDFT packages are designed to be easy-to-use. Clients with little technical knowledge on staff can still use them and acquire all the desired information. They automatically scan the device’s directories for files and then sort them into categories such as “Images, SMS, Audio, etc.”

MDFT abuse

An October 2020 study by Upturn uncovered many startling facts about law enforcement’s use of MDFTs[9]  in the United States. Here’s a brief synopsis of their findings:

  • Over 2000 agencies throughout all 50 states, including the 50 largest police departments, purchased MDFTs between 2015-2020.
  • Many departments have no set guidelines regarding the use of MDFTs, resulting in little accountability.
  • Police skirt warrant regulations by coercing people involved in minor crimes to consent to a phone search. Then, they use the MDFT to analyze the entirety of the person’s device and collect evidence relating to other, more serious crimes.

The usage of these criminal analysis tools is widespread. Even smaller departments can usually pay the exorbitant fees through indirect avenues such as federal grant programs. Worryingly, those consenting to an electronic search typically assume it will be limited to the particular crime that sparked the investigation. Unfortunately, this isn’t the case.

Other shady tactics

Coercion isn’t the only loophole for law enforcement. In the age of Big Data, many agencies simply purchase information like detailed location data from third-party sellers[10]. It’s a particularly sneaky way to get around the pesky Fourth Amendment.

You never really know which apps will sell your data to law enforcement. Multiple recent stories prove that many seemingly innocuous applications collect a surprising amount of your personal info and are willing to sell to law enforcement or the military[11]. Download a digital level app to make sure your bookshelf isn’t crooked? You might be in a police database. It’s a strange reality most people don’t give a second thought to, but it truly is pushing society toward totalitarianism.

How to protect yourself

It isn’t easy. Firstly, if you’re in a situation where law enforcement wants to search your phone without a warrant, do not consent. Even if you have nothing to hide, we should hold the police to high standards of ethical behavior.

Furthermore, recognize Big Tech doesn’t have your back (although Apple’s new privacy labels for their App Store[12] are reasonable first steps.) We recommend only installing apps from reputable companies committed to keeping your data safe. It’s also a good idea to move away from free Big Tech services as much as you can. Free services sound great, but these companies are some of the most profitable in the world and are making money somehow. Usually, this means selling your data.

AXEL Go

You can move away from cloud storage and file-sharing apps such as Google Drive, OneDrive, or DropBox by using AXEL Go. AXEL is dedicated to providing users with full data custody and never selling personal information. AXEL Go delivers one of the most secure and private ways to share and store data on the internet. It utilizes technologies such as blockchain, IPFS servers, and AES 256-bit encryption for industry-leading security. Try it out today and sign up for a free, full-featured Basic account with 2GB of storage and complimentary fuel for hundreds of typical shares.

 

[1] Caroline Delbert, “Why Some People Think 2+2=5…and why they’re right, Popular Mechanics, Aug. 7, 2020, https://www.popularmechanics.com/science/math/a33547137/why-some-people-think-2-plus-2-equals-5/

[2] Marc Rotenberg, Alan Butler, “Symposium: In Riley v. California, a unanimous Supreme Court sets out Fourth Amendment for digital age”, SCOTUSblog, June 26, 2014, https://www.scotusblog.com/2014/06/symposium-in-riley-v-california-a-unanimous-supreme-court-sets-out-fourth-amendment-for-digital-age/

[3] Arjun Karpal, “Apple vs. FBI: All you need to know”, CNBC, March 29, 2016, https://www.cnbc.com/2016/03/29/apple-vs-fbi-all-you-need-to-know.html

[4] Joseph Marks, “The Cybersecurity 202: Bar ramps up encryption war with Appl over Pensacola shooter’s phone”, May 19, 2020, https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2020/05/19/the-cybersecurity-202-barr-ramps-up-encryption-war-with-apple-over-pensacola-shooter-s-phone/5ec32a4188e0fa6727ffe363/

[5] Thomas Brewster, “FBI Hacks iPhones in Pensacola Terrorist Shooting Case, But The War With Apple Goes On”, Forbes, May 18, 2020, https://www.forbes.com/sites/thomasbrewster/2020/05/18/feds-hack-iphones-in-pensacola-case-apple-not-needed-after-all/?sh=1db6e89675e9

[6] Matt Drange, “FBI Hacks Into San Bernardino Shooter’s iPhone Without Apple’s Help, Drops Case”, Forbes, May 28, 2016, https://www.forbes.com/sites/mattdrange/2016/03/28/fbi-gets-into-san-bernardino-iphone-without-apples-help-court-vacates-order/?sh=492873d93b18

[7] Thomas Brewster, “Mysterious $15,000 ‘GrayKey’ Promises To Unlock iPhone X For The Feds”, Forbes, March 5, 2018, https://www.forbes.com/sites/thomasbrewster/2018/03/05/apple-iphone-x-graykey-hack/?sh=1419c67b2950

[8] Thomas Brewster, “This Powerful iPhone Hacking Tool Can Now Break Into Samsung Androids”, Forbes, Feb. 1, 2021, https://www.forbes.com/sites/thomasbrewster/2021/02/01/the-powerful-graykey-iphone-hacking-tool-can-now-break-into-samsung-androids/?ss=cybersecurity&sh=1cbafece4d61

[9] Logan Koepke, Emma Weil, Urmila Janardan, Tinuola Dada, Harian Yu, “Mass Extraction: The Widespread Power of U.S. Law Enforcement to Search Mobile Phones”, Upturn, Oct. 2020, https://www.upturn.org/reports/2020/mass-extraction/

[10] Gilad Edelman, “Can the Government Buy Its Way Around the Fourth Amendment?”, Wired, Feb. 11, 2020, https://www.wired.com/story/can-government-buy-way-around-fourth-amendment/

[11] “Mobile App Monetisation – Covert trackers in your pocket”, Privacy International, Jan. 28, 2021, https://privacyinternational.org/case-study/4404/mobile-app-monetisation-covert-trackers-your-pocket

[12] Sarah Perez, “Apple launches its new app privacy labels across all its App Stores”, Tech Crunch, Dec. 14, 2020, https://techcrunch.com/2020/12/14/apple-launches-its-new-app-privacy-labels-across-all-its-app-stores/

How Remote Work Affects the Legal Profession

The lockdowns and restrictions caused by the coronavirus pandemic transformed the way people work. This is especially true for legal professionals, as attorneys used to long hours in the office and courtroom were mandated to work from home. It was a considerable departure from business-as-usual and resulted in significant ramifications for the industry.

A unique sector

The legal industry is a notorious laggard when it comes to embracing technological advancements. And, for good reason too! Who would want to go digital after sparing no expense on all those leatherbound legal tomes that look so classy adorning the office bookshelf? Kidding aside, it’s true; in 2018, over 80% of Legal Departments claimed they were unprepared for digital transformation[1]. While late 2018 may seem like eons ago after spending the past year cooped up, it was well after most industries embraced the advantages of increased digitalization.

Then, the pandemic hit, and law firms scrambled to condense a decade’s worth of technological evolution into a few months. With nearly all organizations experiencing problems due to COVID-19, it is not surprising that the legal profession was especially susceptible. It’s easy to argue that this accelerated implementation is a good thing in the long run, but let’s look at some of the short-term growing pains.

Increased cyber attacks

Law firms are already high-priority targets for hackers due to their business’s inherently confidential and sensitive nature. The fact that firms had to switch to remote working basically overnight exacerbates this problem. Whereas traditional cybersecurity deals with setting up and maintaining perimeter defenses, what happens when there is no longer a definable perimeter?

Attorneys in the same practice are now spread out throughout their regions. Some may only use approved devices to do work, while others skirt guidelines and conduct business on their personal phones, tablets, laptops, or PCs. Some firms may not even have concrete policies in the first place! These significant discrepancies increase the attack surface for malicious agents. It’s unlikely that the IT department or third-party cybersecurity firm can monitor every single device each lawyer will be using. This unfortunate dynamic resulted in more instances of:

  • Phishing. Scammers posing as legitimate colleagues or clients send emails or other forms of communication to trick victims into clicking malware-infested links and attachments. Phishing attempts rose across the board last year, with some analysts claiming an increase of 85% over pre-COVID levels[2].
  • Ransomware. Once threat actors compromise a computer system, they often attempt to install ransomware. This type of malware encrypts as much data as it can find on the system, then the hacker group responsible for the attack demands a ransom to restore it. Incidents of ransomware rose significantly in 2020[3], with high-profile attacks such as the one against celebrity law firm Grubman Shire Meiselas and Sacks. In that case, hackers demanded a $42 million (!) ransom, which, when left unpaid, resulted in privileged client data leaked to the Dark Web[4].

Slower data breach detection

Due to many of the same variables mentioned above (lack of consistent monitoring, use of unapproved hardware, users spread across a wider geographic area), remote work increases the time it takes to detect data breaches. In an IBM survey, 76% of respondents agreed with that conclusion[5]. In the field of Law, where cybersecurity budgets are already stretched thin, this is a major issue.  Slower detection times can mean more time for hackers to map out networks, leading to more inaccessible files, higher ransoms, and larger overall breaches that can irreparably damage a practice’s reputation.

Shifting job expectations

Attorneys (especially Junior or mid-level ones) typically have pretty rigid schedules and expectations. The pandemic has thrown this into flux. Lawyers with children are the most affected. If the parents are working from home, chances are the kids are distance learning too. This means that professionals who usually have a large window of the day’s time blocked off specifically for their career now have to share that time with parental duties.

Firms must meet these new requirements by allowing for schedule flexibility or even reduced workloads. Otherwise, an already-stressful occupation becomes unmanageable, leading to poor performance.

Disrupted development tracks

Younger attorneys gain experience and learn on-the-job. Working from home can stunt their professional growth and take away otherwise organically-appearing opportunities. This is because they lose the ability to attend events such as hearings, depositions, witness meetings, and more with their experienced colleagues.

It also prevents interactions with senior attorneys in the office or courthouse halls. This can adversely affect the chances of a helpful mentorship and important professional relationships. While digital correspondence and interaction are possible, many parts of an in-person exchange cannot be replicated on a Zoom call or email.

Ways to deal with these issues

In a time with reduced revenues, investing in large-scale cybersecurity projects is probably not a viable option. So, while hiring more IT professionals or a dedicated SOC-as-a-Service (Security Operations Center) company to shore up your networks is a great idea, it may not be possible.  We recommend implementing other low-cost suggestions to protect your organization.

  • Ongoing cybersecurity training. Most of the time, organizations can avoid data breaches by training employees on the basics of cybersecurity best practices. Consult with your IT team and construct an ongoing curriculum that informs your team how to spot phishing emails and what policies your firm has in place regarding data sharing, personal device usage, and more.
  • Require strong passwords and 2-Factor Authentication (2FA). Prevent brute force attacks by requiring team members to set up strong, phrase-based passwords. Then, mandate 2FA for all logins to firm networks through unrecognized hardware. Unless you’re dealing with extremely sophisticated hackers, these two no-cost solutions offer excellent protection.
  • Vet new software and cloud solutions. If your practice didn’t allow working from home previously, chances are you’ll need to invest in some cloud or enterprise solutions. Make sure you use trusted vendors with documented cybersecurity safeguards. Remember, your system is only as strong as the weakest link. A lesson that law firm Goodwin Procter recently learned when hackers breached their third-party file transfer vendor[6].
  • Utilize data encryption. Encrypting your data is essential these days. Strong encryption means even if malicious agents could breach your system and access information, it wouldn’t be useful or even viewable unless they had the decryption key.
  • Implement Access Controls. Everyone in your organization doesn’t need access to all the potential files on the network. While it might take some work to segment and decide individual permissions, doing so promotes resiliency. It means that if someone is able to hack a low-level employee, they don’t automatically gain access to highly confidential information.
  • Have a mitigation plan. As of 2019, 25% of firms have experienced a data breach, and 36% report malware infections. Knowing this, a mitigation plan is crucial. All of the top-level decision-makers need to get together and agree on a roadmap for damage reduction. It could be the difference between an unfortunate blip or the complete loss of client trust.
  • Remain flexible. As we’ve seen, cybersecurity is only a part of the work-from-home equation. Firms also need to ensure their lawyers are in a good mental state and in a position to provide high-performance to their clients. This may mean making some changes regarding work schedules and workloads. Allowing this flexibility can actually be a good thing for clients as well, as perhaps some of their schedules will line up better this way.
  • Facilitate interactions. Don’t neglect the everyday interactions that make practicing law special, especially for your junior attorneys. Perhaps you could set up office hours with the senior team or have an open Zoom room for your organization where everyone has to check in daily to preserve basic socialization.

These trying times present new challenges every day. Your organization can weather the storm and come out better for it on the other side. Take the situation seriously and evolve intelligently, and you’ll be fine.

Protect your documents

Having a trusted data transfer solution is critical to protecting your firm’s and clients’ confidential information. As the situation with Goodwin Procter confirms, your organization needs a vendor committed to preventing hacks.

AXEL Go is a cloud file-sharing and storage solution that puts security and privacy first. It runs on a decentralized and distributed network that is resilient to breaches. All data transferred via AXEL Go is split into smaller pieces called ‘shards’ and spread across many secure servers. Your files can also be protected using AES 256-bit encryption, ensuring industry-leading data security for your most sensitive documents. If your firm needs a data transfer and storage solution, contact us today to discuss your needs and schedule a demo.

 

 

[1] Rob van der Meulen, “Gartner Says 81 Percent of Legal Departments Are Unprepared for Digitalization”, Gartner, Dec. 12, 2018, https://www.gartner.com/en/newsroom/press-releases/2018-12-12-gartner-says-81-percent-of-legal-departments-are-unprepared-for-digitalization

[2] Phil Muncaster, “Experts Detect 30,000% Increase in #COVID19 Threats”, Infosecurity Magazine, Apr. 27, 2020, https://www.infosecurity-magazine.com/news/experts-detect-30000-increase/

[3] “Mid-Year Threat Landscape Report 2020”, BitDefender, 2020, https://www.bitdefender.com/files/News/CaseStudies/study/366/Bitdefender-Mid-Year-Threat-Landscape-Report-2020.pdf

[4] Akshaya Asokan, “Ransomware Gang Demands $42 Million From Celebrity Law Firm”, Bank Info Security, May 16, 2020, https://www.bankinfosecurity.com/ransomware-gang-demands-42-million-from-celebrity-law-firm-a-14292

[5] “Cost of a Data Breach 2020”, IBM Security, 2020, https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/

[6] Meghan Tribe, “Goodwin Procter Says It Was Hit by Data Breach of Vendor”, Bloomberg Law, Feb. 2, 2021, https://news.bloomberglaw.com/us-law-week/goodwin-procter-says-it-was-hit-by-data-breach-of-vendor