THE RSA BREACH-- BANKERS BEWARE, NOT JUST COMPUTER GEEKS

On March 17 the RSA, the security division of information storage company EMC, announced that its servers had been breached.  RSA makes the RSASecurID, a sophisticated one time password device which serves as a multifactor authenication device used by 90% of the nations' banks according to a Bank Technology News Article.

Not being a computer type I hesitated to follow my Blog on FFIEC draft authenication guidelines with another internet banking Blog but this is serious business and could have profound effects  on security in every high risk internet banking transaction.  It really means that internet banking security and authenication issues have moved out of the world of IT and into the headquarters' suites of CEOs, COOs and CFOs.  This further complicates whatever the FFIEC comes up with in its final guidelines. 

 Bank Technology News noted that worlds leading security vendor was not able "to lock out the beasts" criticized RSA "lack of candor" in it release of "scant" details.  P.C. World describes the operation of the RSA SecurID in almost lay terms.  The user logs in by username, inserts a four digit PIN and, from the RSA SecurID gets a six digit one time password to enter the system.  Mysteriously the one time password is generated by algorithim  and a "seed record".  The one time password lasts from 30 to 60 seconds.  A remote RSA server verifies the information and lets the user into the system.  P.C. World is concerned, given the lack of information, that the "seed record" at RSA was breached.  If so, PC World claims it would be a fairly easy step for the bad guys to get into a bank transaction. This RSA device is used by 40 million people and 30,000 organizations worldwide according to RSA.  See, http://pcworld.com/  for March 18.  In an SEC filing RSA suggested some precautionary steps which did not seem to calm the IT world.  One competitor has advised that RSA customers unhook their RSA systems. 

Even without the RSA breach some criminals have mastered a fraud technique to inject their presence into the middle of the bank-customer RSA SecurID operation and plunder an account.  In the colorful jargon of IT this is the "man in the middle" ploy.

I usually try to tell the reader some solutions or ways to at least minimize harm.  I am sorry.  If I had a scant idea of the answers I would not be practicing law.

Marshall G. Martin

Comeau, Maldegen, Templeman & Indall, LLP

(505) 982 4611

(505) 228 8506

DOCUMENT RETENTION POLICIES AND BEWARE FACEBOOK

Although the  focus of this Blog is document retention and similar policies,  Facebook users should be aware that their comments on Facebook are not immune from hacking or "forgery". I have used Facebook minimally to keep track of classmates from high school and college. My computer savvy son just informed me that my Facebook had been hacked. When I opened my Facebook page, I found  postings in which I represented that I personally used a new, super weight loss compound that had taken pounds and inches from my overweight frame. This false weight loss claim was contained in six postings that I had not authored. I am now an "ex" user of Facebook.  If my experience is widespread, it adds to the Facebook danger.

This  story points up the essential need for all banks and responsible business to have strong written policies on the use of social media and other E-discovery targets. Even if your system blocks use or access to Facebook, Twitter, etc. you should still have a policy that extends to discussion of company business or personnel on employees' personal computers. This is no different from having a confidentiality policy that extends to conduct outside the workplace.

It is now standard litigation practice to request discovery of all electronic records, including e-mails and social media.  Therefore all banks and  substantial  target companies should have policies on e-mail retention and the use of e-mails and social media.  E-mails still remain the main target of E-discovery.  Invariably, some damaging "nugget" of evidence is found in most e-mail production under E-discovery practice.

In this day of  expensive and burdensome "E-discovery" the following policies are essential:

1 A comprehensive e-mail retention policy is required with deletion times, e-mail archival times and a period after which no e-mail or electronic communication will be saved or retained in an archive (unless a "hold" is placed on it by HR or legal counsel).  The electronic retention policy should cover all forms of electronic communication, including voice mail.  The key to an electronic retention policy is that with modern technology no e-mail is really deleted from the hard drive. Even e-mails that are not archived can be restored, but only at great expense and burden. Most judges will not order such an undertaking absent bad faith or unusual circumstances. Archived e-mails can be accessed by computer professional on request. The question is how long should you archive? That depends on the circumstance but generally the periods should be from one to three years.  Wall Street lawyers like 30 days, which is risky in New Mexico.
2.  There should be policies, usually contained in the employment manual, concerning the lack of an employee's expectation of privacy on company computers, appropriate use and, if not blocked, social media policies. Most lawyer or HR prepared employment manual forms contain some of these features.  Social media policies are currently not widespread but most publicly traded companies have them.
3.  A social media policy covering Facebook and other forms of the social media are becoming more and more critical.  Aside from cases in which employees post damaging information (worst example:: an Albuquerque police officer involved in a publicized shooting posted that he was part of the trash removal squad), their random posting about what is happening at work can be damaging in litigation or to company reputation.  Anyone who has seen e-mail discovery in litigation and been shocked by the lack of thought which appears, should take a minute to view Facebook and Twitter postings which vary from the damaging to embarrassing.  If your computer system does not block social media, you should have a strong policy on its use--covering everything from confidentiality to inappropriate personnel comments (some recent cases involve termination when an employee describes her jerk boss). As mentioned, this policy should extend to the employee's personal computer.

Banks should also consider training in e-mail communication, especially in this time of frequent foreclosure counterclaims over alleged "bad" loan renewals.  This is a topic for a future blog. 

Marshall G. Martin

Comeau, Maldegen, Templeman & Indall, LLP

(505) 982 4611

(505) 228 8506

newmexicobankinglawyer.blogspot.com

COMMUNITY BANKERS BEWARE: THE FFIEC AUTHENICATION GUIDANCE IS COMING:

Until  early February 2011 I thought FFIEC was a obscure governmental agency which set out guidelines for the examiners of the various financial regulatory agencies of the federal government. Its proper name is Federal Financial Institutions Examination Council.  It is a creation of FIRREA. It  is a interagency body composed of the    Federal Reserve, FDIC, NCUA, OCC and OTS (for a time). Its guidance is designed to provide uniform principles, standards and report forms for examiners of the  financial regulatory bodies.   In 2005 FFIEC published  guidance for  authentication in electronic transactions including ACH and wire transfer.  In 2010 FFIEC was updating the guidance. FFIEC's members were set to release the draft on December 31, 2010.  However, one agency asked for delay.  The word apparently did not get to NCAU and it posted the draft guidance on December 31.  .Bank Info Security  blog, edited by Tracy Kitten reported that immediately over the New Year's holiday 1,100 copies were downloaded.   (The draft guidance is titled, "Interagency Supplement to Authentication in an Internet Banking Environment"). The details of the FFIEC draft guidance were then analyzed in detail by leading members of bank security community from mid-February to March,  2011 in Bank Info Security (http://www.bankinfosecurity.com/).

Although the Bank Info Security expert reporters'analysis of the FFIEC  draft guidance contains many suggestions and generally approves the draft guidance, the experts have ignored the reality of coping with a wide array of commercial customers and varying levels of sophistication in ACH, wire transfer and internet banking departments.

The principal draft guidance  recommendations as reported by Bank Info Security are: (1)  better risk assessments to address emerging threats now used frequently by foreign and domestic gangs, such as man in the middle, man in the browser  and key loggers [a Google search will quickly summarize how each works, but essentially the criminal injects himself in the middle between the server and the computer user and intercepts data without the knowledge of the server or user; and in key logging the bad guy captures key strokes remotely]; (2) use multi-factor identification [again, a Google search explains the operation well, but multi-factor authentication is the use of more than a password to authenticate identity with a preference for three factor authentication]; (3) layered security [again see Google, but the concept involves vertical layers of review or checking of IDs; (4) improved user authentication measures; and (5) customer and employee training of fraud awareness.

In the writer's personal experience, the technologically of the Russians,  Eastern Europeans, Nigerians, and some domestic gangs will attack and conquer the latest token or gimmick to defeat authentication security measures.    The Russians, etc. have no other jobs and as quick as a new device is implemented, absent multifactor or layered security, the Bad Guys may be in business. 

David Shroyer, an expert reporting in Bank Info Security notes in a February 24, 2011 edition of the blog, that the draft guidance mentions the vulnerabilities of small to medium sized commercial accounts.  Most surprising is the concept that banks must "educate" commercial customers to the lack of protection of Regulation E in most commercial transactions.   The draft guidance also puts much more responsibility on the bank to monitor high risk transactions such as wire transfer or ACH, including regular reviews of volume and value for customers and the customer's online users.  The guidance also suggests banks encourage commercial customers to perform risk assessments and control evaluations.

This is not just an bank IT issue.  Recently, as reported by Bank Info Security, two customers with large wire transfer losses have used the 2005 FFIEC guidance to argue that two banks did not follow acceptable standards. If the FFIEC 2010 draft guidance is adopted (which it may not be in the December form) banks are in the cross hairs of broad but vague standards that do not fit reality for many banks.

New Mexico banks don't have search out the big security companies or out of state auditors to analyze the issues posed by the draft guidance, once it is adopted.  New Mexico has   competent experts in the '"authentication" and the compliance process which is involved. in the draft guidance   Aside from the "usual suspects" like the big national firms,. New Mexico has   local  resources.  One is CAaNES,LLC  which offers a network security and other services. (http://www.caanes.com/)   CAaNES, LLC is a creature of NM Tech University's Reseach Corporation and is actively involved in research.  REDW, LLC, an Albuquerque accounting firm, regularly does security and authentication evaluations and audits for banks, and has an IT Governance, Risk Management and Compliance Practice http://www.redw.com/

My friends in bank IT will now point out to you that I am a techno idiot.  But it does not take a technocrat to judge that all banks are not created equal, all customers are not equal (in the sense of internet banking).  A great number of commercial customer losses to internet fraud are caused by poor internal controls at the customer level.  Most customers resist bringing in outside experts to strengthen their controls.  Most bank internet systems require a named "administrator" who is solely responsible for passwords and other security devices.  Often, for convenience sake, passwords are doled out without restrictions or user accounts are set up without thought.  The customer's CFO or person in charge must be available (or a back up named) to insure that at the first sign of a suspicious transaction internet banking can contact him or her to stop the transactions.  Most major wire fraud transactions are not done in one wire transfer but are spread over several transfers.  In short customer accountability is  required.

My  suggestions follow but they are not a substitute for an expert review of issues raised by the draft guidance.

1.  If you don't have them, use very strong internet banking, wire transfer and ACH agreements for commercial customers.  NACHA has a model form for ACH transactions, although it needs modifications. Insert a clear statement concerning Regulation E's inapplicability to commercial transactions. Consumer forms of agreement usually can be simpler.

2.  If possible, communicate any concerns to the customer if controls are lax or the customer's administrator does not control passwords, other security devices or is not careful about setting up user accounts. 

3.  Institute a clear and reliable communications system with the  customer's CFO, administrator or other appropriate authority figure to immediately alert that person to suspicious circumstances or transactions.  I would not leave out the CEO if no one else can be found.

4. Contact a knowledgeable  insurance consultant or broker about obtaining "cyber" insurance coverage or similar coverage.  Make sure that the coverage extends to  the type of ACH or wire transfer account takeover or invasion which is now occurring frequently.

5.  In one lawsuit reported by Bank Info Security, a CEO complained that knowing the size of his company's accounts the bank should have given the company information about multi-factor identification and other types of protection.  Picking and choosing which commercial customers get the most effective security has grave legal risks.  On what risk or "reasonable care" basis do you differentiate between an $800,000 account and a $200,000 account?  Telling a New Mexico jury that you take better care of the "big" $800,000 customer when the $200,000 customer has lost $175,000 is a recipe for losing.  Start with high risk, but treat everyone as vulnerable and get protections in as soon as possible. 

And, last but not least, meet with IT and see what problems exist in following the final FFIEC guidelines when they arrive in final form.  Consult an expert if needed.

Marshall G. Martin
Comeau, Maldegen, Templeman & Indall, LLP
(505) 982 4611
(505) 228 8506

newmexicobankinglawyer.blogspot.com

HELP'!! MY COURT IS CLOGGED

 As a young lawyer sitting on a Bar Committee, I once naively complained--with a New Mexico Supreme Court Justice in attendance-- that the New Mexico courts' dockets were clogged.  The judge rebuked me strongly, saying that I sounded like I was talking about toilets--not the courts.  If the old judge  saw the present budget mess in the New Mexico courts he might agree.  The courts clogged condition significantly affect banks trying to clean up their asset quality by foreclosure and collection actions.

On Sunday February 13 the Albuquerque Journal had a byline, "Courts Struggle to Stay Afloat".  A Tucumcari District Judge was reported as having given up his office copier to save $120 a month.  In Albuquerque layoffs of security personnel added to more than 16 unfilled court staff vacancies. This concerned some judges since a year before an outraged spouse was shot after threatening his wife and court staff.  The Journal article reported that the current Chief Justice, complained of likely cuts in  the court system budget, noted that the recession had added to the work of the courts--more foreclosures, more collection actions, more conflicts and criminal cases. The Journal reported one legislative committee meeting at which judges' complained of case loads increasing by 7 % and budgets cut by 10 %.   An executive of the court system was reported as stating the cuts planned by the legislature and Governor would result a week's furlough for all employees in the court system. 

Courts take people. Every time you file a foreclosure complaint  you go to court and manually process the complaint in the clerk's office, standing as the clerk checks the papers, stamps them, etc..  Since there are fewer clerks, the process takes longer.  Often the chief clerk shuts down the line with you or others waiting to file.   The judge's staff who schedule and keep track of the judge's cases is overworked or furloughed.  After the complaint is filed most papers are mailed, and they have to be sorted, filed and brought to the judge's attention and scheduled for hearing.  Fewer cases are settled since savvy lawyers  know that the system is almost broke and cases will not move as they did a few years ago.  There is no incentive to settle. 

Five years ago an uncontested mortgage foreclosure might take 4 months to complete, assuming no intervening mechanics liens, and timely filing and publication, etc. as required by law.   Now, with the heavier case loads, thinner staff and less scheduling help, an uncontested mortgage foreclosure might take 6 months.  And now comes the real clog.  Times are hard.  An increasing number of defendant debtors think, "if I can just buy more time, I can make it out of this--I will see my old college roommate who went to law school".  Roomie says, "thin case, but I think you should counterclaim.  It will buy you time."  "How much time", you ask.  Roomie, " at least a year."  When a counterclaim is filed it adds the whole mix of litigation to the case with discovery, disputes about discovery,  motions, etc. All of which add delay to the foreclosure. 

Why is New Mexico so bad?  Aren't Colorado and Arizona suffering the same problems?   Arizona and Colorado have had Deeds of Trust for many years.  Absent exceptional circumstances the foreclosure of a Deed of Trust can not be stopped by litigation.  From notice of default to the banks taking the property normally takes only two months.  New Mexico now has a Deed of Trust statute, but only  newer loans have used the Deed of Trust.  Due to some drafting problems no bank started using Deeds of Trust in New Mexico until after 2007.  Most foreclosures involve the old mortgage procedures.  In addition, New Mexico has a very weak version of a statute that prohibits claims concerning loans above $25,000 without a written commitment.  New Mexico's version of the statute rarely produces  a favorable result.

Two added factors aggravate the delay or push the bank into a less than favorable settlement::  (1)  New Mexico judge's reluctance to grant summary judgment and (2) the in terror em effect in some New Mexico counties of a trial by jury.  Summary judgements were invented by the federal courts to permit a party to file a motion for summary judgement to end the case before trial if "there were no material issues of fact" concerning the merits of the case.  In New Mexico most state judges will not grant summary judgement if there is any hint of a dispute.  Many time even a loud and confusing argument  will persuade the judge to deny the motion.  Added to this inability to stop weak cases at the outset, is the liberal view of some juries in certain parts of New Mexico.  Banks are never favorites of juries, but a jury in one of the high unemployment, high poverty counties makes a bank officer check the bank's lender liability insurance limits

Is there a solution, absent a change in the economics of New Mexico?  Yes, to an extent,  although little can be done to fix the old mortgage loan foreclosure problems.  A bank should do at least four things immediately :  (1) if possible do all loans and renewals on a Deed of Trust; (2)  insert a "waiver of jury trial" in your loan forms or use the most current LaserPro, or similar vendor form, which have the waiver of jury trial language in it; (3)  always use a "workout agreement" or similar "without prejudice" document when negotiating a renewal of a loan (in the writer's experience most sizable foreclosures have been renewed, sometimes with contentious negotiations); and (4) always use a tight, well drafted commitment letter for any renewal. 

After  this you may agree with Ambrose Beirce:  "Lawsuit:  a machine you go into as a pig and come out as a sausage."  The Devil's Dictionary

Marshall Martin
Comeau, Maldegenn, Templeman & Indall, LLP
(505) 982-4611
mmartin@cmtisantafe.com

newmexicobankinglawyer.blogspot.com