Bank Lawyer's Blog

It's All About Leverage

The problems that many smaller (and even some bigger) banks have in obtaining meaningful protection in contracts with third-party technology service providers is one near to my heart. The Tech Law Guy, Tom Hall, put up a post yesterday that gives businesses of all types, including banks, useful tips to deal with the process of negotiating a contract with a technology vendor.

Tom's basic premise is that the purchaser's options may be limited by the "leverage" that it has or does not have entering into the negotiations, and that leverage is usually a matter of whether or not the business has the option to walk away from a vendor and find another vendor for the same or a similar service. Increased leverage could also result from the fact that a business does not need to engage in the activity with which the vendor is going to assist the business. If the business terms or legal terms of the contract imposed by the vendor are too unfavorable to the purchaser, the business can say "No Thanks."

As Tom notes, times have changed in the technology services business.

I can recall when, many years ago, “negotiating” with IBM for data services meant haggling over volume discounts and service hours. There were competitors in the market, but none of them rivaled IBM’s reputation for service and cutting edge technology. With little competition, IBM had no incentive to change its standard terms and conditions

Today there is vigorous competition in most sections of the IT market. Few companies dominate their fields, giving Customers room to negotiate.

That ought to be the case, but I find that many banks fall in love with the product or service, hash out the basic business terms with the vendor, then get their lawyer involved to review the contractual terms. At that point, there often exists an emotional commitment by the client's business people to "the deal" that results in the bank agreeing to knuckle under when the vendor digs in its heels. Often,  the bank rationalizes the granting of concessions in some fundamental contractual benefits or protections that it wouldn't have to give if it, too, "dug in its heels." In essence, the bank begins to negotiate with itself, a process that seldom ends well for the bank. Tom recognizes this danger and suggests a solution.

Once Customer has said “You’ve got the deal,” Vendor has no incentive to make concessions. Better to award the contract only after the competing vendors have made their best offer on price and terms and standards and service levels and warranties, etc. Also, consider requiring vendors to comment on your standard contract terms as part of RFP. Vendors who request unreasonable changes, or an unreasonable number of changes, may be weeded out early in the process. Time spent on needless negotiation will only delay project completion and a difficult negotiation may portend a difficult relationship.

Doing an RFP makes sense for most major technology transactions, but some banks either lack the attention span or the in-house expertise to manage this process and won't spring for the cost of a third-party consultant to manage the RFP process for them. At the very least, the bank should have at least one alternative vendor in mind, and senior management ought to sit down with  the bank's legal counsel, before the business negotiations start, decide upon the "have-to-have" risk allocation and other critical contract provisions, and make those contractual requirements available to both vendors at the outset. The reactions of the vendors to those requests can make (or, at least, SHOULD make) a difference in the overall evaluation of the ultimate "winner." I've been involved in a number of transactions where the resistance of the vendor to the bank's customary risk allocation provisions (or other standard terms and conditions) was the deciding factor, even trumping price. In one transaction, the CEO of the bank observed that it appeared to him that at one specific vendor, the "legal tail seems to wag the business dog and they've forgotten who's the customer and who's the service provider. I don't want to deal with an organization like that." Of course, that observation is also a lesson to all bank lawyers as to how savvy clients view the role of lawyers for the bank who unreasonably scrap over every phrase in a contract. They might find their telephone silent when the next deal rolls around.

Again, as Tom says, it's all about "leverage."

Legend has it Archimedes said “Give me a lever and I will move the world.” The business lawyer might well say “Give me more leverage and I’ll get you a better deal.”

A little bit of forethought and preparation in setting up the process to purchase technology services so that contractual terms are thrown into the mix early, not late, can often add more leverage and, in the end, result in a better deal for the bank.

Watch What You Tweet

Corporate "Tweeters" are a new breed of marketer. Sometimes, being cutting edge is double-edged. A recent Wall Street Journal article demonstrates how being tech-savvy doesn't mean that you're necessarily compliance-savvy.

An eBay Inc. effort to broaden communication through the popular Twitter Web-messaging service highlights the hurdles facing corporate users of online social media.

The online auctioneer launched a corporate blog in April 2008. Two months later, blogger Richard Brewer-Hay began "tweeting" -- posting updates on Twitter -- about Silicon Valley technology conferences, eBay's quarterly earnings calls and other topics.

The growing Twitter audience also attracted the attention of eBay's lawyers, who last month required Mr. Brewer-Hay to include regulatory disclaimers with certain posts. Some followers think the tougher oversight is squelching Mr. Brewer-Hay's spontaneous, informal style.

[...]

Blogs and tweets can run afoul of Securities and Exchange Commission regulations on corporate communications. But sanitizing such posts risks hurting credibility with online audiences.

[...]

Corporate lawyers say companies should devise a social-media policy before adopting blogs or Twitter. "All of the traditional ways that a company can get in trouble for making public statements" apply to the Web, says Lisa Wood, of Foley Hoag LLP.

She urges companies to include the standard disclaimers they use in other communications, as Mr. Brewer-Hay now does. Ms. Wood says companies shouldn't disclose financial information on Twitter that isn't available elsewhere, and should make clear that opinions expressed by others in company-sponsored forums -- like comments on blogs -- don't represent management's views.

It's obvious that we're all feeling our way along with this new social media marketing "stuff." It's a balancing act, with marketing folks worried that the damn lawyers are going to put a stopper in the magic bottle and lawyers breaking out in flop sweat over the immediacy of the communication and the relative lack of control over the conversations that are generated. That said, I think a lot of the risk is either overblown or, where it's real, can be effectively managed. From the number of financial institutions, large and small, I see on Twitter these days, banks better come to grips with the management of those risks. If not, they'll either be shut out or shot down.

Social Media Marketing Legal Risk: The Bark Is Worse Than The Bite

I spent a good portion of last Thursday in Las Vegas among bank marketing professionals and, as hard as it might be for some readers to believe, I found the experience refreshing. Perhaps because of what they do, but more likely because of the type of people who are drawn to the marketing field, many marketing professionals are pleasant and interesting conversationalists. At least, they're nice to your face, which in a world filled with snarky cranks like the author of this blog, is the best you can hope for.

The specific topic of the day's presentations was the use of social media to market a bank's products and services. All of the other presenters were impressive. I was able to speak at length with Jim Craig of 1st Advantage Federal Credit Union in Yorktown, Virginia and Shari Storm of Verity Credit Union in Seattle, and they were both engaging human beings, as well as knowledgeable and impressive speakers. Ms. Storm's also a published author, and I wondered, after hearing her speak and realizing what an active career she has, when she had time to have three children. Effective time management, I suppose.

I, on the other hand, was the wet blanket who told the attendees how many ways I, and my fellow demons from Legal Hell, could "what-if" their imaginative use of social media into a limbo of paralysis and eventual abject failure. Sure, it's a nasty, brutal job, but somebody's got to do it.

Actually, I find the legal risks of the use of social media to be overblown. It's true that, unlike the one-way communication of traditional marketing, where the bank "talks" to the customer or potential customer, in social media, the customer (or potential customer) "talks back" to the bank and, depending on how "social" the media might be, talks to other customers and potential customers. As I said to the audience, you're inviting strangers into your home, and you don't know whether you're getting a witty Oscar Wilde type or a Charles Manson who'll stick the cat in the microwave, pee in the punch bowl, and puke on the Persian rug. The apparent lack of control makes lawyers jerk and twitch like they've got a bad case of Tourette syndrome.

Nevertheless, the legal risks can be mitigated and managed, and it shouldn't be that difficult to do so if the bank makes an upfront commitment to do what's required. Mitigation involves having the right attitude, the right people, and the right infrastructure (policies and procedures, training and monitoring) in place to govern the bank's social media marketing activities. Those speakers and audience members with whom I spoke whose institutions have been in front of the curve in using social media marketing for a "long time" (in social media time, a "long time" is five years) haven't experienced any serious legal setbacks. Of course, the stories they told me indicated that when they confronted situations where things could have turned very ugly, they were able to deftly manage the situation and, in some cases, not merely lessen the potential risk but turn it to their advantage. In other words, they understand how to treat other human beings in a decent and transparent manner, as shocking as that may seem in an age when it's all about the "spin."

I think that much, perhaps most, of the concern about the legal risks of social media marketing by banks arises from the understandable fear of the unknown. The media is relatively new, banks are traditionally conservative, and lawyers are risk mitigators, not risk takers. Thus far, banks are experimenting with the media, and "the jury is still out." In other words, many banks don't yet "get it." Nevertheless, social media is the way through which much of the world is relating to one another, especially among Gen Y, and banks are going to have to learn to embrace the media if they want to effectively reach those who use it. Shari Storm displayed a picture of her three daughters, ages 5, 3 and 1, and told the assembled bankers that the challenge was how to make them and their older brothers and sisters their future customers. It's a huge group of human beings (larger than the Boomers) who are coming of age using social media as second nature.

Legal risks or no legal risks, banks will have to come to terms with it. Perhaps you don't have to be a hare to be in this race, but you sure won't be able to win it as a tortoise.

A Short Break

I'm on a combined business/vacation trip for the rest of the week. I'm speaking in Las Vegas on Thursday morning to a group of bank marketing professionals about the legal risks of banks using social media to market their wares. I'm sure that I'll recognize the employees of banks who've taken TARP money. They'll be the ones with paper bags over their heads. I'm headed out early and staying late in order to take advantage of some much needed downtime. As a result, no blogging until next week, because I promised both my wife and my professional liability carrier: no more blogging while drinking.

PTSD Damages For A Non-Event

Two and one-half years ago, then-VA Administrator Jim Nicholson asked Congress for emergency funding of not less $160.5 million "for credit counseling and other measures to protect veterans and military troops whose sensitive personal information was stolen." Yesterday, the VA announced that it had agreed to pay $20 million to settle class-action litigation filed by five veterans groups as a result of that data theft.

Unfortunately for the taxpayers, there's a rub. As VA spokesman Phil Buhdan stated yesterday: "We want to assure veterans there is no evidence that the information involved in this incident was used to harm a single veteran."

It's even better than that. A lap top and external hard drive containing the data were stolen, and later recovered. According to FBI experts at the that time, the data had not been accessed by the thieves, much less used. In the intervening 30 months, not a single incident of identity theft or other unlawful use of the personal information was reported. So why pay $20 million?

The money, which will come from the U.S. Treasury, will be used to pay veterans who can show they suffered actual harm, such as physical symptoms of emotional distress or expenses incurred for credit monitoring.

[...]

According to the proposed settlement, veterans who show harm from the data theft will be able to receive payments ranging from $75 to $1,500. If any of the $20 million is left over after making payments, the remainder would be donated to veterans' charities agreed to by the parties, such as the Fisher House Foundation Inc. and The Intrepid Fallen Heroes Fund.

[...]

"This is a very positive result," said Douglas J. Rosinski, an attorney representing the veterans groups. "A lot of hard work went into finding a resolution that all the parties could be proud to say they were a part of bringing about."

$75 to $1500 a pop for "emotional distress." How many warriors will step forward and claim that prize? Not many, I bet.  As for credit monitoring, the VA offered to provide free credit monitoring for any veteran who asked for it, but it wasn't necessary, was it? We knew it was a waste of money in the summer of 2006, and the absence of any misuse of personal information in the intervening months has only supported that view. The VA fired the parties responsible for the lapse of security, and the OMB changed its rules to require encryption of laptop hard drives, and all that was done without prompting by a class action lawsuit. Therefore, no actual harm exists to be compensated, and no dysfunctional behavior was corrected by the litigation.

The folks that this class-action litigation serves are the plaintiffs' lawyers. They'll make a lot more per-person than $75 to $1500. They'll make millions. For that small cadre, this outcome is, indeed, "a very positive result."

Data Breaches: On The Rise and Striking the Heartland

While most honest citizens are recovering from the hangover induced by the Obama Inaugural Extravaganza, the few rotten apples in the barrel have been busy little bees. Last week, the WSJ reported that last year, businesses reported 656 data security breaches, up 47% from the previous year. Much of that increase may be due to the expansion of state laws that require notification of such breaches, according to the Identity Theft Resource Center. More distressing was the news that over 35% of the breaches were due to human error, and worse, that insider abuses that resulted in data breaches were double those of 2007. "The Bozo Factor" that affects employees can be mitigated by training, and by implementing policies and procedures that are rigorously enforced, but as we've noted before, a banker's worst nightmare is the rogue employee. If an employee's bent when he starts working for you, it's doubtful that any training will straighten him or her out.

Yesterday, the news did not get better. Heartland Payment Systems Inc., a major credit-card processor, disclosed a data breach "that analysts said may be among the biggest ever reported."

Heartland Payment Systems Inc. said Tuesday that cyber criminals compromised its computer network, gaining access to customer information associated with the 100 million card transactions it handles each month.

The company said it couldn't estimate how many customer records may have been improperly accessed, but said the data compromised include the information on a card's magnetic strip -- card number, expiration date and some internal bank codes -- that could be used to duplicate a card.

100 million rockets past the previous record of 45 million, set by TJX (which we last discussed here). Heartland's president said that his company was targeted by malicious software that "light-years more sophisticated" than what is usually downloaded from the Internet by your average stooge. This points up another problem we've often discussed: the crooks are smart cookies. Bet you a dollar to a donut that they came from Eastern Europe. That area of the world appears to be breeding gifted amoral cyber thieves at a rate that would make your average Mafia don green with envy.

An analyst at Forester Research estimates that the average data breach costs $300 to $600 in fraudulent purchases, fees and legal costs, for a total of hundreds of millions, perhaps in excess of a billion, of dollars to be spread around between Heartland, the card issuing banks, and others (including merchants who are duped by the fraudulent use of the stolen data).

It's tough becoming the poster child of data breaches. Coming in the midst of an economic maelstrom makes it all the tougher to deal with. On the other hand, most of the average citizenry will have little sympathy for Heartland. The man on the street may sell his e-mail password for a discount card to Starbucks, but he expects businesses, especially those that handle sensitive personal and financial information, to be impenetrable fortresses when it comes to data security. That may not be fair, but it's just the way it is.

Speaking of the TJX fiasco, the Maine Bureau of Finacial Insitutions released a report that showed the financial costs to banks in that state from the TJX and other data security breaches. The TJX breach cost banks from $60 to $32,146 in card reissuance expenses. H/t CSBS

Mad For Loan Mods

Although often berated as a prime example of the "Liberal Main Stream Media" that conservative radio talk show hosts love to loathe, the latest issue of Time magazine sang the praises of a company that's often been labeled as one of the biggest of the bad boys when it comes to loan servicers who live solely to foreclose on widows, orphans, the halt and the lame: Ocwen.

Time's inamorata is praised for its aggressive loan modification program, one, surprisingly, not sprung form the fruitful loins of Mother Bair. In fact, compared to Ocwen's loan modification, the FDIC's so-called "systematic" approach is found distressingly flawed.

The big problem is that no one has figured out a systematic way to stop the rot. Federal agencies and private lenders have rolled out one loan-modification program after another--scattershot and largely timid attempts to make existing mortgages more affordable and keep neighborhoods intact.

Then there is Ocwen, which has already revised 16% of its 340,000 mortgages, in many cases cutting monthly payments 20% to 40%. Based in West Palm Beach, Fla., the company handles some of the worst loans Wall Street kicked up during the housing boom and isn't about to win any popularity contests among consumers--in the past, it's been the target of complaints about unresponsiveness and excessive fees. Nevertheless, good ideas can come from unlikely places, and as more borrowers--including a growing number with prime loans--fall behind on payments, there are lessons to be learned from the firm that has done more than almost anyone else to keep struggling homeowners in their houses.

The secret to Ocwen's success is all in the computer modeling. When home prices began dropping below the amount of the loan balance in some areas of the country, Ocwen called in its programmers.

So the company reprogrammed its computer models, which determine how to extract the most value from each loan, to allow much more substantial changes--lowering a mortgage's interest rate, docking its principal balance, converting an adjustable rate to a fixed one, stretching out the life of a loan. With many mortgages "upside down" (when the loan is larger than the home's current value) and the economy sagging, changes often have to be drastic to make the math work, but Ocwen has largely found a way, devising an affordable payment plan 90% of the time.

More importantly,however, Ocwen apparently doses itself with loan servicer Viagra.

What really sets Ocwen apart, though, is its vigor. From doing just a couple of hundred modifications a month in the first half of 2007, Ocwen was up to 4,000 a month by the beginning of 2008, with 77% involving a reduction of the interest rate and 20% including a permanent write-down of the principal balance. Is it working? Six months after receiving an Ocwen modification, 21% of homeowners have again fallen behind on their payments by 60 days or more. That compares with a 37% redefault rate nationally, according to data from federal regulators--a figure that also includes much more stable prime loans.

How is Ocwen avoiding the dreaded "loan investor lawsuit" risk? Because, unlike the Blair plan, which involves a simplified "one-size-fits-all" modification scheme, Ocwen actually has the sophistication to prove, by virtue of its computer modeling, that the loan modification (or no foreclosure) option selected for the particular borrower is likely to yield the most financial return to the investor, given the specific set of facts applicable to the specific borrower and the specific collateral.

Ocwen has also answered a key question for other would-be modifiers: whether it's possible to pass major losses to investors without getting sued. Paul Koches, Ocwen's general counsel, holds that the company is not only permitted to take such steps but obligated to--if that's what it takes to squeeze the most money out of a loan for the long term. That's the case executives make when angry investors call--and they do call, especially when a principal reduction chokes off cash flow in a particular month.

Make no mistake: Ocwen has a nearly messianic focus on the goal of maximizing returns for investors. "In most cases, that means keeping people in their homes and getting them to pay their mortgages," says Ocwen CEO Bill Erbey. In foreclosure, investors typically recoup only 60¢ on the dollar.

In a way, Ocwen was uniquely situated to jump ahead on modifications. Erbey, who used to run General Electric's mortgage-insurance operation, started buying nonperforming loans with his partners in the early 1990s. Ever since, Ocwen has been refining its computer models--we're talking sophisticated stuff, like vectors and artificial intelligence--to better whip delinquent loans into shape. When the housing slump hit and defaults started to rise, Ocwen wasn't some afterthought unit of a mortgage originator caught with its pants down; it was in its element, in a position to immediately scale up.

That's why, unlike a lot of loan-modification programs, such as those rolled out by Citigroup and IndyMac Bank, Ocwen's doesn't use broad guidelines--for instance, assuming that homeowners should be able to contribute 38% of their income to paying their mortgage. When Ocwen rewrites a loan, it starts from scratch, with an agent at one of its four call centers--two in Florida, two in India--following an adaptive script to reconstruct a borrower's financial data. (The script changes, based on not only what a borrower says but also how he says it; since hiring a director of consumer psychology last summer, Ocwen has been handling embarrassed callers differently than, say, angry ones.)

Ocwen also doesn't disrespect speculators. If it will yield more to the loan investor to modify a loan made to a home investor, then Ocwen will modify the loan. That may not be in line with the popular cant of the day by the chowder heads in Washington, but, then, Ocwen's all about dollars and cents, not hot air.

In bucking the general disdain for bailing out investment properties, Ocwen realizes that cash is cash, whether it comes from an owner-occupied mortgage payment or one fed by rent, and that a foreclosure displaces a family and blights a neighborhood whether the occupants are owners or tenants.

Which just goes to show that moneymaking and good economic policy aren't necessarily incongruous. As much as capitalism--especially in the mortgage industry--has gotten a bad rap of late, it might just prove useful yet.

Praise for capitalism? Break out my skates: Hell just froze over.

If, in fact, the loan-by-loan computer-driven analysis approach taken by Ocwen can provide evidence that it works better than the broad "systematic" approach championed by the FDIC's Sheila Bair and those who follow her lead, then will loan investors have an argument that taking the Bair approach is, in and of itself, a breach of the servicer's obligations under the relevant serving agreements? One article in a popular weekly news magazine isn't going to settle that question, but it's food for thought, especially if you're a class action litigator fishing for claims.

Employees: The Chink In The Armor Of Information Security

Last May, we profiled the risk of rogue sociopathic employees who help outsiders steal sensitive data from banks, mortgage lenders, and other businesses. In that story, former employees disclosed passwords that were not changed after the employees left the business. According to a recent study by Cisco, a bank's current  employees pose even more of a security risk.

Employees could be to blame for one of the most prominent security concerns facing businesses today: loss of corporate information.

So say findings from a new Cisco global security study. The report offers insight into the risks employees take that could cause data leakage.

The reason is clear: With the move toward distributed business models and remote workforces, lines are blurring between work and home lives. That’s leading to more collaborative devices and applications, including mobile phones, laptops, Web 2.0 applications, video and other social media.

[...]

Security is ultimately rooted in users’ behavior, so businesses of all sizes and employees in all professions need to understand how behavior affects the risk and reality of data loss — and what that ultimately means for both the individual and enterprise, according to John Stewart, chief security officer at Cisco.

"Understanding this can help strengthen relationships between IT and employees, tailor localized awareness and education programs, and better manage risk," Stewart said.

The takeaway: There are opportunities for businesses to tailor risk-management plans that prevent data loss incidents locally while remaining global in scope. While some solutions are technology-based and others are policy-based, the common denominator in these programs is employee education.

"Companies need a strong set of policies and consequences for breaking them," said Michelle Drolet, CEO of IT security services firm Towerwall in Framingham. "The employees need to be clear about the rules for handling information and using technology."

An information security officer for a banking client recently told me that employees remain his biggest concern  with respect to data leaks and information security system breaches. No matter the policies and procedures, the training sessions, the education, and the penalties imposed for violating information security policies, no business has yet found the magic bullet to deal with the "dumb-ass factor" (his term, not mine). I suppose capital punishment might bring the point home, but that seems a bit harsh.

Cisco's study confirm's my client's officer's jaundiced view.

Still, even with awareness programs, employee handbooks and information security training, and appreciation, workers remain a common point of failure in the information security equation.

Employees tend to lose laptops or portable storage, store logins and passwords, share sensitive corporate information or corporate devices, and alter security settings on computers, according to the Cisco study.

[...]

"A lot of our clients are looking into ways to prevent the use of flash drives by locking the ports so they can’t use them and putting some level of protection on laptops to encrypt the data in the hard drive," said Glenn Siriano, a principal of KPMG’s Information Technology Advisory Services. "But you still see people posting sticky notes with their passwords on the desktop."

The sticky notes problem is definitely a prime example of "the dumb-ass factor" at work. Such employees need to put out to pasture. Unless, of course, he oe she is a senior officer, in which case you give him or her a bonus and a promotion.

As compliance officers of banks have long known, unless senior bank management makes the failure to comply with a policy a termination offense, and enforces the penalties consistently, all the well intentioned policies, procedures, education and training in the world aren't going to be enough to stem the tide. In addition, as the article also suggests, banks and other businesses need to invest in the necessary technology-based solutions and/or consulting engagements to minimize the risks. During a time when everyone's uncertain how bad the economy is going to become (just that it's bound to be bad), convincing banks and other businesses to make such investments is going to be a tough sell, absent regulatory sanctions or other painful experiences (hits to reputations, lawsuits, etc.) that make the risks impossible to ignore. As we've previously observed, many businesses have decided that, as things now stand, the risk doesn't justify the expense.

Red Flags In Place?

Occasionally, I like to point those readers who are in-house counsel or private practitioners and who represent financial institutions to a useful publication that's available on-line from another law firm. Ordinarily, I'd make a snarky, self-deprecating comment at this point; however, my e-mail lately indicates that there are some readers who not only don't "get" the snark, but take it on face value and begin to froth at the mouth with politically correct apoplexy. So, just for today, I'll play it straight. Tasteless, low-brow sarcasm will resume tomorrow.

Today's resource is the Proskauer Rose LLP Privacy Law Blog, which has good material on, of all things, privacy law. Of particular interest to many businesses is a recent post on the suspension of enforcement by the FTC of the of the "Identity Theft Red Flag and Address Discrepancies Rules" until May 1, 2009. Unfortunately, the suspension applies only to those business subject to FTC enforcement of the rules, not to financial institutions governed by the Red Flag rules that are enforced by the federal bank regulatory agencies. As to the latter, you banks better be in compliance by the end of this week!

The reasons for the FTC action are interesting.

The rules apply to financial institutions and creditors.  But, according to the FTC, many companies “indicated that they were not aware that they were engaged in activities that would cause them to fall under the FACT Act’s definition of creditor or financial institution.”Moreover, the FTC said that companies not traditionally subject to the jurisdiction of the FTC did not follow the FTC’s rulemaking, and consequently did not become aware of their obligations under the Red Flag Rules until very recently.  The FTC also expressed concern that covered entities, to meet the fast approaching November 1 deadline, were not taking the appropriate care necessary to do a proper risk assessment and craft a meaningful red flags program.

As the FTC stated, “[g]iven the confusion and uncertainty within major industries under the FTC’s jurisdiction about the applicability of the rule, and the fact that there is no longer sufficient time for members of those industries to develop their programs and meet the November 1 compliance date, the Commission believes that immediate enforcement of the rule on November 1 would be neither equitable for the covered entities nor beneficial for the public.”  Therefore, the FTC will delay enforcement of the new rules for six months.  Considering this generous extension, covered entities should be on notice that they will need to have a written identity theft prevention program in place by the May 1, 2009 deadline.

So, this time around, being a clueless ignoramus turned out to be a good thing, unless you were a financial institution regulated by one of the federal bank regulatory agencies.

Many banks were well on their way to compliance with the Red Flag rules as part of their information security and customer identification programs, long prior to November 1. Red Flag and address discrepancies compliance has been more a matter of documenting the program and having it approved by the board of directors.

Incidentally, the OTS released last Friday revised examination procedures, which were developed jointly with the other agencies, for examinations after November 1, 2008. The revised procedures incorporate procedures to test compliance with the Red Flag rules. The OCC released its revised examination procedures on October 15, 2008, which also addressed affiliate marketing and opt-out notices.

Feel My French Fist of Fury, Hacker-Pig!

From Monty Python and the Holy Grail:

King Arthur: Go and tell your master that we have been charged by God with a sacred quest. If he will give us food and shelter for the night, he can join us in our quest for the Holy Grail.
French Soldier: Well, I'll ask him, but I don't think he will be very keen. Uh, he's already got one, you see.
King Arthur: What?
Sir Galahad: He said they've already got one!
King Arthur: Are you sure he's got one?
French Soldier: Oh yes, it's very nice!

If what passes for the present-day French king has "got one" (other than Carla Bruni, that is), he's likely not got it any longer.

The French government was forced to admit that no one was safe from internet fraud yesterday after it emerged that thieves had managed to hack into President Nicolas Sarkozy's personal bank account and siphon off cash.

The unknown hackers removed several small sums of money from the account after obtaining Sarkozy's online access codes. An inquiry was launched after the president noticed the transactions and complained to the police, said a government spokesman.

The French aren't going to take this heinous act lying down, notwithstanding that "supine" is the national position when faced with a determined adversary, at least if World Wars Un and Deux are any indication.

"The swindlers will be punished," Luc Chatel, secretary of state for consumer affairs, told French radio. He said more work needed to be done to tighten internet banking security in France, which, according to the national crime agency, has seen a 9% rise in offences this year.

"[This] proves the system of internet checking [of bank accounts] is not infallible," Chatel said. "These cases are sufficiently rare that we haven't had to really organise ourselves, but [they are] sufficiently serious for us to reflect on how to improve the system."

That's a nice twist on bad news, that Monsieur Chatel spun, isn't it? The French, unlike the Yanks, don't have to worry about this sort of thing very much, since they're pretty much a cheese-eatin', wine-sippin', snail-suckin', congregation of domesticated poodles, while the barbarian Americans are used to this sort of lawlessness. Just one more spatter of mud on the pristine French culture thrown off by the grinding, oversized, tires of the Americanization Globalization Monster Truck. As if the pollution of MacDonalds' Happy Meals weren't enough of an affront, now the Gauls have to deal with this "cybercrime" merde.

They will punish the porcs who perpetrated this, however. Luc promised it, and when Luc promises something, you better believe this: it WILL be delivered. In a little gift box, tastefully wrapped, and accompanied by a baquette, a side of Brie, and a slightly chilled bottle of Francois Pinon Vouvray 2005, but delivered nonetheless.

We'll send over John Edwards to help you feel your pain, Luc. Please, though: no police escort for the former Senator. He's easily distracted by sirens, being possessed of the Pavlovian reflex to the sound of a passing ambulance common to all former P.I. lawyers.

***********************************************************************************************************************

On another matter, an insider who wants to remain anonymous, e-mailed to advise me that the appraisers who are featured in my post of October 19, 2008, and who are suing Countrywide for (allegedly) blacklisting them, were deemed unacceptable by Countrywide because their appraised values came in too high, rather than too low. The story in Housing Wire on which that post was based didn't explain that aspect. Most complaints about lender pressure involve expectations of inflated, not deflated, appraised values. It goes to show that the appraisal biz is a lot like Goldilocks and the Three Bears. Some appraisals, like porridge, are too hot and others too cold. It takes a lot of attempts (and sometimes, apparently, a heavy hand) to find one that's just right.