The United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) has issued an advisory warning against making ransomware payments related to cyberattacks. The OFAC warning, issued on October 1, 2020, notes that demands for ransomware payments has increased during the COVID-19 pandemic, and makes clear that such payments are a threat to national security.
The OFAC warning is not limited to victims of the attack, but is directed at any company who facilitates ransomware payments to cyber actors on behalf of the victims. …
In August of 2014 Microsoft began work on Project Natick, a research initiative focused on building and deploying underwater datacenters. Now, a datacenter that’s been 117 feet under the ocean’s surface for two years is providing a first look at what the future of offshore datacenter networks might look like.
According to Project Natick’s website: “Natick is a codename and carries no special meaning. It is a town in Massachusetts.” Microsoft’s initial underwater test ran from August to November of 2016 with a vessel that was submerged off the U.S. Pacific coast. …
On August 22, 2019, the National Institute of Standards and Technology (NIST) will hold its Second Post-Quantum Cryptography Standardization Conference. The core purpose of this Conference series is to standardize one or more quantum-resistant public-key cryptographic algorithms. This is significant, and requires the attention of any legal professional who is engaged in documenting compliance procedures associated with highly sensitive data, as well as those who draft and negotiate transactions involving cryptographic functions.
Technology Standards as Performance Standards
When drafting compliance and transaction documents relating to technology, one must reference specific standards of performance. Relating specifically to cryptographic functions, one should not simply require that data be “encrypted,” because that term is not precise. For example, applying file-level encryption to a document using only a four character passcode and no brute force attack protection mechanism might technically qualify as use of encryption; however, the underlying data will remain readily accessible and insecure. By contrast, requiring data to be encrypted in accordance with a specific technical standard cuts through the nuanced variations among encryption mechanisms, and creates a well-defined and measurable compliance and contract performance standard. …
Digital storage systems raise a number of legal issues that are challenging, yet manageable if they are fully understood. One such issue is managing the durability of electronic data when the original paper document is no longer available to remaster the digital image if it were to become lost or inaccessible.
Paper is a physical object, and physical objects can provide a feeling of comfort that is hard to replace with an intangible stream of ones and zeros. When we think of paper’s longevity, we think of things like William the Conqueror’s Domesday Book, completed in 1086AD and still held intact at the United Kingdom’s National Archives. …
The terms “cloud computing” and “cloud storage” are generally used to describe any system of managing or storing data that is not dependent upon a single device or computer. “Cloud computing” usually means that the data can be accessed over the Internet, and frequently means that the data is stored on a server that is owned and controlled by a third party, such as Dropbox or Microsoft.
It’s important to address privacy and security issues that might impact the information being stored “in the cloud.” Here are five things one should consider when making this evaluation:
1. End User License…
About