Does your employer require your fingerprint when you clock in for work? That fingerprint is considered private biometric information. BIPA is the Illinois law that protects its use. Experts Lee Neubecker and David Rownd share how this law affects employers that have Illinois based employees.
Biometric Information Privacy Act (BIPA) is a law that covers the employer’s use of biometric information of its employees. Biometrics are the physiological means to gather an individual’s uniqueness. The oldest most widely used is a fingerprint but other biometric identifiers may be also used such as; facial recognition, photos, retina scan, voice recognition, ear shape, and hand scans all are considered private biometric information. The Illinois BIPA law is designed to govern, secure, store and prohibit the sale of biometric information. Forensic Expert Lee Neubecker and David Rownd from Vedder Price discuss how BIPA may affect employers that have satellite offices in Illinois.
Part 1 of a 3 Part Series on Illinois’ Biometric Information Protection Act
The Video Transcript on BIPA: How It May Affect Employers in Illinois.
Lee Neubecker (LN): Hi I am here again with David Rownd from Vedder Price. Thanks for being on the show David
DavidRownd (DR): Thanks for having me
LN: David is an attorney that specializes in defending class action lawsuits also employment litigation, trade secret theft, and misappropriation. I asked him to come on the show today to talk a little bit about BIPA which is the Illinois Biometric Information Protection Act and specifically he deals with a lot of trading security-related financial services firms and since that law applies to Illinois and many trading firms in New York have satellite offices I wanted him to talk a little bit about the act and some of the concerns that employers should have if they have employees working in Illinois. So, David, can you tell us a little bit about BIPA what it is and what it entails?
DR: Basically it covers the employers use of biometric information of its employees and this can be a retinal scan it can be a fingerprint it can be a number of different things and it can be used for time cards access to the workplace and things like that and employers are using biometric information because its an easy way to keep track of employees. However, it is also a privacy issue and that’s where the BIPA comes in and BIPA is intended to regulate employers ability to utilize biometric information and put certain requirements on them for notifying employees they are using it and notifying employees why they are using it keeping written records of the biometric information and it specifically prohibits the sale of biometric information to third parties.
LN: It’s especially troublesome too because if you lose your biometric unique identifiers you can’t necessarily get those back unlike a social security number you could replace a social security number but if someone is able to copy your retina scan your fingerprints what not it could cause a lot of permanent damage.
DR: That’s true you only get one of those things
LN: So we will be talking later in the series next well be talking a little bit about what employers should do before they land in trouble with BIPA to help protect against finding themselves embroiled in litigation and then finally we’ll talk a little bit about some of the national happenings with Facebook and other entities who have been en snagged in the BIPA trap and we’ll conclude with there so thanks for being on the show today.
DR: Oh thanks for having me.
View related Employment Litigation articles on our website.
The recent Pensacola Naval Air Station shooting left the FBI with the assailant’s locked iPhone. Apple has refused efforts to assist with bypassing the security features. Should legislation require Apple provide a back door to law enforcement? Hear more about the cell phone privacy debate between two noted cyber and privacy experts.
On Friday, December 6, an aviation student from Saudi Arabia opened fire in a classroom at the Pensacola Naval Air Station (NAS) killing three people in the attack and injuring eight others. Another Saudi student recorded the shooting events as it unfolded. The shooter was identified as Mohammed Saeed Alshamrani, an aviation student from Saudi Arabia. The assailant’s name doesn’t really matter because the question in these national security threats remains the same.
How does law enforcement obtain personal information off smart devices in a timely fashion?
What role does cell phone privacy play when it comes to terror attacks such as the most recent Naval Air Station attack?
Leading computer forensic expert Lee Neubecker, CEO & President of Enigma Forensics discusses with the Data Diva, Debbie Reynolds of Debbie Reynolds Consulting about the many technical tools in their arsenal that’ll offer solutions in these cases.
Lee Neubecker and Debbie Reynolds discuss cell phone privacy as it relates to national terrorist acts
Cell Phone Privacy: Naval Air Station Attack – Final Video of 4-part series
The transcript for Cell Phone Privacy – Naval Air Station Attack follows:
Lee Neubecker: Hi, I’m back again with Debbie Reynolds, the data diva. Thanks for being on the show again.
Debbie Reynolds: Thank you, Lee.
LN: So, we’re finishing up our multi-part series relating to cell phone forensics, as it relates to the FBI’s desire to get Apple and other information from the cell phone makers so that they can unlock their phones.
DR: Right, so there was a recent shooting, unfortunately, in Pensacola, at the Naval Air Station and because there were people who were recording the attack, they’re interested in being able to get information from those cell phones and this is renewed calls, as was the case with the San Bernardino attack in California in 2015, to have Apple help law enforcement unlock particular cell phones of folks.
LN: Yeah, as Debbie was saying, with the Pensacola Naval Air Station, what had been reported in the associated press was that a Saudi national student who was getting training out of the navy facility, which, our government trains foreign nationals and other militaries and has been doing that for a long time but some of the Saudi students had been watching, earlier that evening, they had been watching videos of mass shootings before the shooting took place. And during the shooting that she said, one of the students had been recording the events as they unfolded and likely has data on cell phones and other information.
DR: Right, I think the issue is, you know, is law enforcement able to get this information without accessing the cell phone and the chances are, possibly yes. But there are many different ways to get it.
LN: Yeah but this week they asked Apple for help to get in and they said they haven’t been able to get in the phone but like what happened with San Bernardino, it’s not entirely clear if they had fully used their capabilities, like their mobile access unit, had that unit exhausted their capabilities, had they reached out to third party vendors and computer forensic consultants and firms, like myself or others.
DR: That does this every day, yes.
LN: Or even the Israeli firm, called Cellebrite, which makes the equipment used by many forensic people, like myself, that was ultimately successful in unlocking the San Bernardino terrorist’s phone.
DR: Well, the one thing I will say is, in 2015, the phones have gotten a bit more advanced, the encryption is better but if, for example, people are taping things on cell phones, typically, they’re sharing it with other people so you may be able to get the information from another person’s phone, if the phone is backed up, you may be able to get the data from a backup, you may be able to get phone records about who they were calling or who they were texting, even though you may not get the actual footage, there are a lot of different ways to triangulate this information.
LN: And if they plugged their cell phone into their computer, a lot of times, it will automatically create a backup file but, in this case, I think the, you know, the FBI has a legitimate interest in wanting to know who were they texting right beforehand, were other people involved so I support that but I think that there are different means of how to accomplish their goal.
DR: Absolutely, absolutely. So, I think, the way that the story was told in the media, it makes it seem as though the only way the information can be gotten to is to have Apple or other cell phone makers create a vulnerability that anyone can use on any phone and I don’t think that that’s exactly true.
LN: No.
DR: Because we’ve not seen that in the field and many of us work with cell phones every day.
LN: Well, there was, recently disclosed, a vulnerability in every iPhone up to, not including, the very latest model but every iPhone relating to the Bootrom, where the phone can be, you know, basically, bootlegged and taken over until it’s rebooted, then it resets so I’m sure that there’s already bypass means on 95% of the iPhones out there, since most people aren’t running the latest model but again, the concern here is that it almost seems like there’s an effort to try to change the policy, you know, Director Comey, from the FBI, Former Director Comey had repeatedly stated that we need to be able to defeat encryption but by its nature, it’s like saying everyone should have weak locks on all their doors and companies shouldn’t lock their stuff up so that’s going to lead to problems in, you know, as I said, in the prior segment, a multi-key solution that has unlocked but specific to an individual user’s cell phone, with approval by the court, I think that is a much better solution than having a master key that can open up any phone.
DR: I think so and, I mean, we’ve seen in other cases, even though it’s not about terrorism, obviously, with the Jussie Smollett issue in Chicago, they were able to get a ton of information so they went to Uber, they had surveillance cameras, they had phones, I mean, the–
LN: They get GPS records on phones.
DR: Oh, all kinds of stuff.
LN: You can get cell phone tower records and then you have all these third-party apps like, you know, the secure Signal and WhatsApp, well, is it very secure if you get one of the two phones?
DR: Right.
LN: Not exactly because you can see all the messages.
DR: Oh, absolutely and I think Paul Manafort, unfortunately, found this out the hard way when he was using WhatsApp to chat with people about illegal dealings and the forensic folks were able to get the exact chat and all the texts because he had backed it up to his iPhone or his iCloud, I believe, so.
LN: It’s interesting now, you discover, these days, when things get involved with what was intent on a business deal gone wrong or was there fraud or misrepresentation, you know, getting, finding out what the text messages are and who was texting with which party and what did they say, that can be very important and litigation, still, it seems that text messages are just starting to come upon the attorney’s radar, for asking for that information.
DR: Well, it’s coming up on their radar ’cause people use many different means so someone may start with an email and then go to maybe Snapchat or go to texts, so.
LN: Or Slack.
DR: Or Slack so there are many different, yeah, right.
LN: You’ve got these other platforms that are just, that should be part of the discovery, that are getting ignored, unless you have an attorney or advisors, like us.
DR: Yes.
LN: Helping to make sure that you get that information.
DR: Exactly, exactly, it’s not easy because it’s not as linear as you think it would be but if you know that you have this information, that it’s out there, it’s possible to find ways to get it. Obviously, the cell phone would probably be the easiest way to at least be able to help you point to where things are but there are different ways to be able to get the information, not necessarily, so you do need the cell phone for the actual texts, the text message but.
LN: But sometimes people have that hooked up to their computer too.
DR: Yes, that’s true, right, that’s true.
LN: So their computer might have, you know, people who have an Apple laptop and running that, you might be able to get the messages off the laptop, which is yet another means of getting the data and then, you know, there are entities that do log the messages in between so you have the servers that they cascade through so there’s a lot of places that the information can be found and, you know, before a mass policy change is made to just by giving an open key, you know, people need to think this through because, you know, we had keys, master keys that open in the past, those keys have gotten leaked and it’s created a lot of problems.
DR: No, absolutely, I think that’s the villain in almost any little movie you could think of, someone who has a master bit of information that can rule the world so this is definitely something that needs to be thought through and we already know that there are, you know, other things that can be done that don’t require, currently, a master key.
LN: Yeah, well, one of the ways that all of you can show your appreciation if you like our videos, is click like, share the videos out and sign up for our blogs and check ’em out, thanks a bunch for being on the show again.
Is it necessary to have Apple provide a back door so that law enforcement can access a person’s cell phone? Computer Forensic Experts Lee Neubecker and Debbie Reynolds say there are technical solutions to use instead.
A law-abiding citizen or a criminal’s cell phone can be the largest piece of evidence in a criminal investigation. Once confiscated, cell phones are powerful tracking devices that can be used to infringe on an individual’s cell phone privacy. In this video, Data Diva, Debbie Reynolds of Debbie Reynolds Consulting’s and renowned Computer Forensics Expert Lee Neubecker, CEO & President of Enigma Forensics share their cell phone cracking technical solutions. Is the government’s desire to have a backdoor into all smartphones really necessary? No matter what security measures are placed on smart phone devices, there are many technical solutions available from the computer forensics experts to utilize when attempting to unlock a mobile smart cell phone. Check out this video to learn what technical solutions available that don’t require going back to the manufacturer and asking them to create a backdoor.
Experts discuss unique technical solutions available to retrieve cell phone information
Cell Phone Privacy: Part 3 of 4
Lee Neubecker: Hi, thanks for watching the show again, we’re now talking again about cell phone forensics as it relates to privacy issues and our government’s request to get information on specific cell phone users. I have Debbie Reynolds the data diva back on the show. Joining me again, and to help me elucidate some of the unique issues that relate to the current situation.
Debbie Reynolds: Right, so there are privacy issues obviously with being able to track, or be able to crack someone’s cell phone. In a law enforcement situation, time’s of the essence. They want to be able to get the information on the cell phone the best way that they can. The issue is, and especially with the Louden news reports, they aren’t exactly accurate about how this happened. So in order to do this cracking of certain cell phones, there are things that forensic folks, like Lee can do to actually do this that don’t require you going back to the manufacturer, asking them to create a backdoor. My opinion, and I think this is something that was echoed by Apple in their objection to this. Is that, you know, the iPhone or the cell phone is their invention. And the way that they do privacy for phones is kind of their unique, you know, secret sauce or special sauce so. Being able to, Having to try to do that is sort of the antithesis of what they’re doing, of their invention. And I’m not seeing any court cases where ever. Where someone had to literally create, invent something to sort of negate their own invention.
LN: And even then government, like, our US government has resources to have a lab where they can use equipment to actually replicate all the chips and storage devices. And then make a virtual machine where they can brute-force crack the device without worrying about the three false passwords that slow it down. Because if you virtualize, if you duplicate the embedded memory off the D-Ram, the various chips and storage, you can then set up a mass server farm of virtual machines to just pound away, trying combinations. And with quantum computing, it wouldn’t take much time, but that isn’t even necessary today. There are easier tools to get into the phones, but the real issue becomes if, it would much be like if the government said we want everyone to have one particular key-type for their home.
DR: Right.
LN: So that we have a key that we can take and we can get into any door without having to break down the door.
DR: Yeah.
LN: And the problem with that is, what happens when someone gets fired from the FBI and they copy that key? You know, then we got to lock change every house in America? And every business.
DR: Yeah, who’s to say, I mean not every person who has a phone is a criminal. So if you think let’s say you know 1% of everyone who has cell phones is doing a criminal activity, so should 99% of everyone else have these vulnerabilities that, you know, hackers love to have. They would love to be able to crack into your phone and do different things.
LN: That could actually you know lead to HIPAA violations, you know there are physicians and people that have some medical data as they connect to their work machines. and if there’s this weak backdoor key, that creates a problem. Now, I want to talk a little bit about how I think they could do it and it hasn’t been done yet.
DR: Okay.
LN: But if Apple were to issue, I mean if you have a multi-key solution where anyone key alone doesn’t work. But the FBI could make a request to the justice department, to the judiciary, a judge of some sort. The judge could issue a key unique to the cell phone IMEI identifier, and then that information could be a key that then goes to Apple or to Microsoft or whatever provider, who then generates a key that can unlock the phone. So you can have a multi-key solution, but it’s specific to the phone and that would preclude a situation where any one person’s key gets leaked and all phones are compromised. And, you know, if for instance the FBI’s key that they use to generate request keys, if that got compromised they would rotate that and going forward new keys would be used and they’d invalidate all the others. But you’d have a technical means to still get into the phone without necessarily meaning that every phone is totally open to one key.
DR: I think so, but I think, that’s actually a smart solution. But I also think companies like Apple, and I’m, we’re just picking on Apple ’cause the phone was an Apple phone that we’re talking about. But, you know, companies are in business to make money, and not to be law enforcement. So there’s probably not a lot of money in law enforcement stuff for them, so they may not be compelled, or feel like this is something they really want to invest a lot of time or energy in. Especially because there are smart people that do this for a living and can actually do this work.
LN: I support the idea that if there’s a terrorist out there, that we should have a system that does allow to get into that phone, but there’s got to be a check and balance, it can’t just be one person acting alone or else it inherently makes everything insecure.
DR: I agree, I agree. Yeah, it’s a tough issue, I feel like people get really, sort of, wound up about it. especially ’cause they’re thinking about sort of, patriotism and freedom and stuff like that. But you know there’s a way to solve this problem without creating problems for the whole world basically.
LN: Thanks for watching this segment, in our next segment we’ll talk about the more recent story regarding the Pensacola Naval Air Station terrorist attack, as they’re calling it. And the FBI’s renewed request of Apple to get into the cell phone.
