In Pennsylvania, Employers (and Others) may be Liable for Failing to Protect Personal Information that They Collect

On November 21, 2018 Pennsylvania’s highest court ruled that employers in Pennsylvania have an affirmative legal duty to protect workers’ sensitive data from possible hacking.  This ruling has profound implications for employers, which may now be subject to liability for failing to take reasonable precautions to protect their employees from cyber attacks. In a proposed class action, employees of the University of Pittsburgh Medical Center sought damages after a data breach exposed the personal information – including names, dates of birth, addresses, Social Security numbers,… Continue Reading

3D Printing: A Cybersecurity Concern

Additive manufacturing, more commonly known as 3D printing, is a process of making three-dimensional solid objects from a digital model. Additive manufacturing is already used in a number of critical fields, such as medicine, aerospace, civil engineering, and industrial manufacturing. 3D printers are often internet-connected, and increasingly open-sourced. As a result, they face a host of security issues which range from digital to physical. Most of these issues fall broadly into either confidentiality and privacy concerns or device and product integrity concerns. Confidentiality and privacy… Continue Reading

DHS’s National Risk Management Center to Protect Against Cybersecurity Threats to Critical Infrastructure.

On July 31, the U.S. Department of Homeland Security (DHS) announced the creation of the National Risk Management Center (NRMC), which will focus on evaluating cyber threats and defending critical United States infrastructure. The NRMC will have responsibility for coordination at a national level to protect banks, utilities, telecoms, and similar infrastructures from cybersecurity threats including attacks from nation states like Russia. Specifically, DHS states that the NRMC will:
  • identify, assess, and prioritize efforts to reduce risks to national critical functions, which enable national and
Continue Reading

Supreme Court Recognizes Expectation of Privacy Regarding Cellphone Location Data

On Friday, June 22, 2018, in a 5-4 split, the Supreme Court in Carpenter v. United Statesheld that the government usually needs a warrant to access an individual’s historical cellphone location data held by third-party carriers. The court rejected the government’s argument that an individual does not have a legitimate expectation of privacy under the Fourth Amendment concerning the location data that third-party carriers collect and keep.  This data, essentially logs of the location of cellphone towers used to route calls to and… Continue Reading