CLOSE X
RSS Feed LinkedIn Instagram Twitter Facebook
Search:
FMG Law Blog Line

Archive for January, 2020

Ransomware Attacks Reached Unprecedented Numbers in 2019

Posted on: January 15th, 2020

By: Melissa Santalone

According to a study published by Emsisoft Malware Lab, an unparalleled number of ransomware attacks hit U.S. businesses and government agencies in 2019.  In total, 113 state and municipal governments and agencies, 764 healthcare providers, and 89 universities, colleges, and school districts were targeted at a potential cost of more than $7.5 billion.  In many instances, these attacks caused disruptions that placed lives at risk, like when 911 services were interrupted, emergency patients had to be sent to other hospitals, and police were unable to run background checks and check criminal histories and active warrants.

The report analyzed the “why” of the sharp increase of ransomware attacks in 2019 and concluded that organizations continue to have security weaknesses and attackers have developed better ways of exploiting those weaknesses, creating a “perfect storm.”  Emsisoft referenced a 2019 University of Maryland, Baltimore County report based on data from a national survey of cybersecurity in local governments that found a lack of preparedness within the local governments and a lack of funding for cybersecurity.  Many local governments do not even have mechanisms in place to detect or track cyberattacks and even basic best practices are going unused.  The report cited the city of Baltimore’s loss of data after a ransomware attack because data resided only on users’ individual systems for which there was no mechanism for back-up.

It is clear that state and local governments, healthcare providers, and schools need to be better at preventing, detecting and recovering from ransomware and other cyberattacks.  The Emsisoft report recommends multiple actions that should be taken to make public entities more secure, including improved oversight, more guidance, better funding, and mandatory reporting requirements for ransomware and other cybersecurity incidents.  While there are numerous federal and state laws requiring entities to take protective measures to secure the data with which they are trusted, many organizations are failing to comply.  Emsisoft suggests that authorities should implement auditing systems and corrective measures for those entities that fail to meet minimum standards.  Further, the report argues, clear minimum standards must be adopted so organizations can make appropriate decisions about how best to protect themselves and can allocate their resources in better ways.  Because ransomware and other cyberattacks are not always required to be reported, it is also proposed that entities be legally required to do so in an effort to better pool information on such attacks to detect, prevent, and recover from them.

The Data Security, Privacy & Technology attorneys at Freeman Mathis & Gary, LLP are ready, willing, and able to assist entities with compliance with data security and privacy laws and preparing for attacks before they occur.  If you have any questions about detecting, preventing, or responding to ransomware or other cyberattacks, contact Melissa Santalone at [email protected] or any other member of our Data Security, Privacy & Technology team.

Section 1983 First Amendment Retaliation by Litigation: SOL without PC

Posted on: January 14th, 2020

By: Brent Bean

“When angry count to ten before you speak.  If very angry, count to one hundred.”  – Thomas Jefferson

In a case of first impression in the Eleventh Circuit, the Court held that in a Section 1983 First Amendment retaliation claim premised on the filing of a civil lawsuit, probable cause will generally defeat the claim as a matter of law.  See DeMartini v. Town of Gulf Stream, Case No. 17-14177 (11th Cir., Nov. 21, 2019).

A Section 1983 First Amendment retaliation claim requires the plaintiff to show (1) she engaged in protected speech, (2) the government’s retaliatory conduct adversely affected that speech and (3) a causal link exists between the conduct and the adverse effect.  As the Supreme Court observed, retaliatory animus is “easy to allege and hard to disprove.”  Nieves v. Bartlett, 587 U.S. ___, ___, 139 S.Ct. 1715, 1725, (2019).

There are two accepted methods of showing causation.  The first, typically used in the employment setting, is whether the retaliatory motivation was the but-for cause of the adverse action.  If not, or if the government would have taken the same action regardless of retaliatory animus, the defendant is not liable.  The second, typically used when the government uses the legal system to arrest or prosecute a plaintiff, is to ask whether there was probable cause for the arrest or prosecution.  If so, this will destroy the casual link.

In DeMartini, the plaintiff sued the Town of Gulf Stream, Florida (population 2000), for filing a civil RICO action against DeMartini and her business, CAFI.  The Town filed the lawsuit because CAFI had made thousands of public records requests designed to overwhelm the small town’s staff and lead to the recovery of attorney’s fees for non-compliance.

In the face of these requests, the Town received a sworn statement from an insider at CAFI attesting the requests were bogus and designed to lead to monetary recovery. The Town then engaged outside counsel to advise on merits of a lawsuit to stop the abuse.  The Town filed the RICO case, which was dismissed because the Town could show no predicate act.

DeMartini then sued the Town under Section 1983 for First Amendment retaliation, claiming the RICO lawsuit was unlawful retaliation designed to silence her right to seek redress, a First Amendment right.  She claimed public statements made at Town meetings confirmed the retaliatory animus for the lawsuit and the RICO lawsuit had no merit, as it was dismissed and affirmed on appeal.

The Eleventh Circuit considered whether a plaintiff asserting a claim for Section 1983 First Amendment retaliation based on the filing of a civil lawsuit is required to plead and prove an absence of probable cause for the civil lawsuit and whether the Town in fact lacked such probable cause.

The Court held that while the RICO lawsuit was ultimately dismissed, it was not without probable cause because the Town had sworn facts from an insider and had hired a lawyer who advised them on the law. So, the Court concluded the Town had a reasonable belief in the validity of the RICO claim.  The Court then held for retaliatory claims based on a civil lawsuit DeMartini had to show an absence of probable cause in the filing of the RICO lawsuit, which DeMartini could not do.

Governments seeking to take affirmative steps through civil litigation will be one-hundred times better served to first confirm their claims are supported by probable cause prior to filing a civil lawsuit.

If you have any questions or would like more information, please contact Brent Bean at [email protected].

To Pursue or Not to Pursue

Posted on: January 10th, 2020

By: Sara Brochstein

The City of Atlanta Police Department has announced that its officers will no longer engage in vehicular pursuits while it takes time to review its pursuit policies. This decision comes in the face of recent deadly crashes where suspects in stolen vehicles struck and killed motorists while fleeing police pursuits.

Police pursuits have often been the subject of controversy as the risks and benefits are constantly being weighed.  On one hand, pursuits have the potential to put innocent pedestrians and motorists in harm’s way.  In situations where the crime or violation is minor, the risk is even more unjustified.  Conversely, to disengage in pursuits altogether signals to people that arrest can be avoided by evading the police in vehicles.  This certainly has the potential lead to an increase in crime as Atlanta Police Chief Erika Shields acknowledged when announcing the City’s change in position.

Notably, the City’s new policy is intended to only serve as an interim policy while the department “work[s] to identify specific personnel and certain specialized pursuit training to enable the department to conduct pursuits in limited instances.”  However, as long as the no-pursuit policy remains in effect, the City of Atlanta may prove to be an instructive case study as to whether pursuits are worth the risk.

If you have any questions or would like more information, please contact Sara Brochstein at [email protected].

Statute of Repose Does Not Bar Claims Resulting from Improper Maintenance

Posted on: January 9th, 2020

By: Tom McCraw

The Massachusetts Appeals Court recently held that the six-year statute of repose (G.L. c. 260, § 2B) did not bar a homeowner’s insurer’s subrogation claim against a gas company for damages caused by the company’s failure to maintain a gas meter that caused a fire on the homeowner’s property in February 2015.

The gas company, Bay State Gas d/b/a Columbia Gas, had installed the gas meter on the property in 1996, attaching the meter to a high-pressure gas pipe rising out of the ground but not installing supports to brace the pipe.  Bay State Gas retained ownership of the meter and maintained it over the years prior to the fire.  The incident occurred when the meter broke off from the pipe under the weight of significant snowfall, causing a fire that damaged the homeowner’s property.  The insurer, Penn-America, paid the homeowner’s claim and subrogated against Bay State.  Bay State obtained summary judgment in the trial court on grounds that the claim was barred by the six-year statute of repose, as the meter had been installed nearly 20 years before the incident.

The Appeals Court vacated the decision, noting that the six-year statutory period applies only to actions of tort “for damages arising out of any deficiency or neglect in the design, planning, construction, or general administration of an improvement to real property.”  The Appeals Court rejected Bay State Gas’ argument that the failure to include supports for the pipe was a defect in the original design in 1996. Instead, it agreed with Penn-America that the incident resulted from Bay State Gas’ breach of its continuing duty to maintain the meter – as Bay State had done throughout the years – and was beyond the scope of the statute.

In light of the Penn-America case, those in the construction industry should carefully evaluate whether any ongoing maintenance obligations for older improvements are sufficiently up to code as those obligations are seperate and distinct from issues with the original design, and not within the statute of repose.

If you have any questions or would like more information, please contact Tom McCraw at [email protected].

Penn-America v. Bay State Gas Co. d/b/a Columbia Gas, No. 19-P-86 (Mass. App. Ct. Dec. 20, 2019)

AB5: California’s Controversial Gig-Work Law Took Effect January 1, 2020

Posted on: January 7th, 2020

By:  Margot Parker

As of January 1, 2020, California’s AB5 may require employers to reclassify hundreds of thousands of independent contractors as employees with broad labor law protections.  The new law codifies the “ABC test” adopted by the California Supreme Court in Dynamex Operations West, Inc. v. Superior Court of Los Angeles in 2018.  Under the ABC test, a worker may only be classified as an independent contractor if it can be shown that:

A. The worker is free from the control and direction of the hiring entity, both under the contract for the performance of work and in fact;

B. The worker performs work that is outside of the usual course of the hiring entity’s business, and

C. The worker is engaged in independently established trade, occupation, or business that is of the same nature as the work performed for the hiring entity.

This strict three-pronged test now applies to the requirements of the California Labor Code and the California Unemployment Insurance Code.  Beginning July 1, 2020, it will also apply to the California Workers Compensation Code.

While the law provides exemptions for certain occupations and industries (including accountants, architects, dentists, insurance brokers, lawyers, and engineers), the Legislature declined to exempt app-based ride services and food delivery companies, whose workers complain they often earn less than minimum wage.  Uber, Lyft, DoorDash, Postmates and Instacart are mounting a ballot initiative to exempt their workers, while trucking associations, photographers, and freelance journalists have brought other initiatives opposing the law.

Given such controversy, the law’s author intends to introduce additional legislation to clarify AB5 this year.  In the meantime, employers should consult with legal counsel and review independent contractor classifications to ensure proper classification of workers pursuant to the ABC test.

If you have any questions or would like more information, please contact Margot Parker at [email protected].