LOS ANGELES

www.dailyjournal.com

THURSDAY, JUNE 18, 2015 PERSPECTIVE St. Louis Picked Off Trying to Steal? By Mary Ellen Callahan covered by the statute, as would es- secrets’ owner. and Emily Bruemmer sentially any unauthorized access of a Aside from civil or criminal en- PIG Tales he St. Louis Cardinals may computer in the United States. forcement actions by the DOJ, the This regular column is devoted to catch some chin music after Although we do not yet know the Cardinals may also face the threat issues of critical importance to the Treports that federal law en- charges to be brought against the Car- of civil litigation by the Astros. The Privacy and Information Governance forcement is investigating whether dinals, the applicable charge under CFAA provides that a party may file (PIG) communities. Provided by the Cardinals employees hacked into the CFAA could be classified only as a a civil action if certain factors apply, former Chief Privacy Officer of the ’ internal network. misdemeanor, but could rise to the lev- including a loss of $5,000 or more to U.S. Department of Homeland Secu- On Tuesday, the New York Times el of a felony if certain enhancements one or more persons in a one-year pe- rity, PIG Tales discusses cutting edge issues while offering valuable insight reported that the FBI and Department apply. The penalty for a first offense riod. And there may be other statutes and practical advice to companies of Justice are investigating wheth- under Section 1030(a)(2) is a fine or available to the Astros. Earlier this on how to collect, use, store, protect er Cardinals front-office employees imprisonment for not more than one year, law firm Reyes & Barsoum LLP and share their sensitive data in an hacked into a computer database year. However, the penalty rises to a filed suit in state court un- efficient, effective, and compliant maintained by the Astros. The net- fine or imprisonment for up to five der the state’s Computer Crime Law manner. work, known as “Ground Control,” years if any of the following felony and applicable professional codes al- contained databases built by the team enhancements apply: “(i) the offense leging that employees of an opposing fend against advanced, persistent, and the hack exposed information was committed for purposes of com- firm hacked into a computer network state-sponsored threats that likely have about trades, scouting reports and pro- mercial advantage or private financial to steal documents related to a dispute more resources at their disposal than a prietary information about the Astros’ gain, (ii) the offense was committed in in workers’ compensation court. single company), the company will in- players. furtherance of any criminal or tortious The potential civil and criminal evitably be caught, the advantage will The investigation began after in- act in violation of the Constitution or penalties are significant, but do not be short-lived while the costs may be formation from the database was re- laws of the United States or of any begin to account for the reputational substantial. The FBI’s announcement leased online in June 2014 and led to a State; or (iii) the value of the informa- damage. Most sporting competitions of this investigation was a signal to computer in the former home of Car- tion obtained exceeds $5,000.” involve an attempt to anticipate an companies tempted by such trickery dinals employees. The investigators All three felony enhancements opponent’s next move, but hacking — don’t get picked off, stay on base. reportedly believe that the employees could come into play here. Despite into team databases and stealing in- used a list of old passwords to access speculation, the motives behind the formation is hardball of a different Mary Ellen Callahan chairs Jenner & Block LLP’s Privacy and Information the Astros’ computer network. Astros breach are still unclear. However, in- sort. Other teams may be similarly Governance Practice and provides general Jeff Luhnow previ- vestigators could well determine that tempted to access their competitors’ privacy and data security counseling to ously worked for the Cardinals, and the information was accessed to gain evidence-based statistics, but the po- a broad range of clients, including some the “Ground Control” network he built a commercial advantage. While this tential consequences of this unprece- of the most visited Internet websites. She was similar to the “Redbird” network may seem strange given the teams’ dented cyber-espionage should act as served as chief privacy officer of the U.S. created when Luhnow was with the respective records at the time of the a deterrent. If investigators determine Department of Homeland Security from Cardinals. Some reports indicate that incident, after “Moneyball” there is no that the attack was perpetrated by Car- 2009 until August 2012 and received the Luhnow’s previous tenure with the question that the introduction of big dinals employees, the team will add 2013 Privacy Vanguard Award. You can reach her at [email protected]. Cardinals may have been a motivation data and data mining in professional an unfortunate statistic to its admitted- for the breach. sports can result in substantial prof- ly impressive resume: the first Major Emily A. Bruemmer is an associate Aside from presenting a caution- its. Furthermore, prosecutors could League team whose employ- in Jenner & Block LLP’s Litigation ary tale about the dangers of reusing allege that the unlawful access un- ees carried out a cyberattack against Department and the Privacy and passwords, the news of the investiga- der the CFAA was committed in the another team. Information Governance practice. She tion is a sign that the bases are loaded furtherance of another criminal act. All of these legal actions are in focuses on appellate litigation, internal for criminal prosecutions under the Finally, the value of the information addition to any actions that Major investigations, and compliance with Computer Fraud and Abuse Act. The accessed — and then posted online — League Baseball could take under its complex regulatory regimes. You can reach her at [email protected]. CFAA, codified at 10 U.S.C. Section is unclear, but as previously noted, this own rules. Although this is an issue 1030, was originally passed in 1986 information is increasingly valuable to of first impression and MLB rules do and provides penalties for several baseball teams and could easily ex- not expressly address hacking, there offenses, including under Section ceed $5,000. are long-standing prohibitions against 1030(a)(2) for intentionally accessing Liability may also arise under oth- theft of other teams’ proprietary infor- a computer without authorization and er statutes, such as the theft of trade mation. thus obtaining “information from any secrets under 18 U.S.C. Section 1832, Companies looking for short-term protected computer.” Since protected which criminalizes the stealing or advantage and inside information computers are defined broadly to in- unauthorized appropriation of trade should pause and consider the con- clude any computer “used in or affect- secrets with intent to convert the trade sequences. Stealing signals may pro- ing interstate … commerce or com- secrets to the economic benefit of any- vide temporary informational benefit munication,” the unauthorized access one other than their owner, intending and assistance, but given the ability MARY ELLEN CALLAHAN EMILY BRUEMMER of the Astros’ network would likely be or knowing this will injure the trade to perform forensics (in part to de- Jenner & Block Jenner & Block Reprinted with permission from the Daily Journal. ©2015 Daily Journal Corporation. All rights reserved. Reprinted by ReprintPros 949-702-5390