Our thinking

Cybersecurity: Legal implications and risk management

What's inside

In an increasingly interconnected world, cyber risk is firmly at the top of the boardroom agenda, and having an effective data breach response programme is no longer optional.

Cybersecurity crisis management

The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.

The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise. 

Key issues

Why?

  • Reputation
  • Fines
  • Breach of contract
  • M&A due diligence
  • Insurance
  • Proprietary information
  • Litigation
  • Criminal offences
  • Negligence

Be prepared

Risk Assessment

  • Key Information
  • Assets
  • Key Systems
  • Threat Analysis
  • Security Measures

Toolkit

  • Scripts
  • Internal and 
    External
  • Communications
  • Employee contacts
  • Response Plan
  • Live Training
  • Business Continuity Plan

Key considerations

Customer/individual rights

  • Requests for data
  • Data Protection Authority Complaints
  • Group litigation orders
  • Resolution mechanisms

B2B relationships

  • Contractual obligations
  • Contractual liability
  • Tort

Reputation management

  • Media strategy
  • Customer interaction
  • Employee engagement

Commercial

  • Proprietary
  • Information/Trade Secrets
  • System Disruption

Regulatory issues

  • Data Protection Authority
  • Financial Regulators
  • Market authorities
  • Other regulators

Privacy & data protection

  • Jurisdictions involved
  • Reporting obligations
    • individuals
    • authorities

Evidence

  • Law Enforcement Involvement
  • Legal Privilege
  • Preservation of Evidence

Response

Crisis Team

  • Legal (internal and external)
  • IT/IT Forensics
  • PR
  • Regulatory
  • DPO
  • Executive committee
  • HR
  • Vendor manager

Key Actions

  • Work with forensic investigators to:
    • Identify and contain breach
    • Gather/preserve evidence
    • Maximise legal privilege coverage
  • Contact crisis team
  • Bring in external partners
  • Identify key risks and priorities based on nature of breach
  • Assess notification requirements
  • Communications
  • Regulatory notifications

 

Articles

Director liability for cyber breaches: transatlantic warning signs?

Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.  

arrow

Legal 500's In-House Lawyer Magazine Autumn - Commercial Litigation Focus (Germany)

In The Legal500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.

magazine pile

AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?

In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.

orange background

Time to Revisit Risk Factors in Periodic Reports

Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.

Alert 800x800

Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation

Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.

Compensating non-material damages based on Article 82 GDPR

Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage? 

Corporate Boards Must Ask Key Cybersecurity Questions

Cybersecurity has been a mainstay of quarterly board agendas for years.

Cybersecurity Risk: Top 5 strategies to build resilience

The fourth webinar in our 2020 Autumn Webinar Series covered crucial steps you should be taking to protect against cybersecurity threats and what you should do when disaster strikes.

Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law

Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.

stack of paper

US Cybersecurity Standards to Get Tougher and More Specific

In the past few years, cybersecurity has taken on increasing importance in the eyes of lawmakers and regulators.

Data Sharing Without Borders

UK law enforcement can now obtain an order against a person in or operating in the US for the production of or access to electronic data under a new ‘landmark’ US-UK data sharing agreement.

Alert 800x800

Responding to a cyber-incident

The COVID-19 crisis has exposed many companies to more cyber threats. Tim Hickman and John Timmons discuss what businesses need to do should a major incident occur.

Trending: Legal protection for cryptoasset stakeholders

Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.

InTheMedia_800x800.jpg

Recovering the ransom: High Court confirms Bitcoin status as property

The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.

Navigating Privacy and Cyber Incident Notification and Disclosure Requirements

Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.

Proposal on the Application of the NIS Regulations post-Brexit

This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.

Contacts

AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?

Alert
|
5 min read

In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. The COVID-19 pandemic and resulting public health lockdowns precipitated an explosion in such activity with record cases of cyber fraud being recorded.1 This is notwithstanding that Bitcoin and most other mainstream cryptocurrencies use a distributed ledger to record transactions which should, in principle, make it easy to "follow the money" once a payment has been made. In practice, the absence of KYC checks and the lack of regulatory oversight means that the identity of cryptocurrency wallet owners, and therefore the holders of the funds can often be difficult to determine. Cybercriminals also deploy sophisticated techniques, such as placing Bitcoins in a "tumbler",which makes it difficult to trace tainted funds back to their original source. As a result, the English Court's powers are increasingly being called upon in actions against unknown parties demanding payment in cryptocurrencies.

Following AA v Persons Unknown3 – in which the High Court determined that Bitcoin and other cryptocurrencies can be considered property under English law, and could therefore be the subject of a proprietary injunction – there has been a number of cases in which the Court has deployed its existing powers to tackle novel issues.4

AAA plc & ors v Persons Unknown [2021] EWHC 2529 (QB) represents the latest of these types of cases, although in this instance, the Court's powers were used pre-emptively, that is, to avoid a ransom having to be paid in the first instance.

Notably, the judgment demonstrates the Court's willingness to issue: (1) injunctions against persons unknown, and (2) anonymity orders protecting the identity of Claimants in circumstances where disclosure of their identity would defeat the purpose of the application.

 

Background

The Claimants/Applicants were a group of associated companies nominally referred to in the judgment as AAA plc, BBB Limited, CCC Limited, DDD plc and EEE Limited (the "Group"). The Defendants were "Persons Unknown" only identified as "Ben" and "Bryan".

In July 2021, AAA plc (the "AAA") became aware of a website published by purported "investors" in AAA accusing the Group of fraud. The website stated that the Group was made up of various shell companies designed to appear the same as AAA for the purpose of defrauding investors. It was alleged that their function was to secure initial investment and then report misleading results to shareholders in order to secure further investment. The website went on to criticise AAA's CEO, its investor team, and accountants before stating that they had "a few methods in the pipeline" to help them get their money back.

The purported "investors" had paid for the website to be prominently advertised on a search engine, and the allegations were repeated across various social media accounts. Consequently, existing and potential investors were likely to encounter these allegations of fraud if searching for AAA and the wider Group online.

In response, AAA hired a cyber investigator who was able to contact the person(s) behind the website. Their identities ultimately remained unknown, only signing off emails as "Ben" and "Bryan". The "investors" demanded payment in Bitcoin in exchange for the removal and deletion of the website and social media accounts, and desisting from the same conduct in respect of the Group.

 

Decision

As a first step, the Court was willing to grant the anonymity order, and thus depart from the principle of open justice because:

  • AAA was the victim of blackmail – to refuse anonymity would be to deny the Group a potential judicial remedy;
  • disclosure of the Group's identities put the Defendant's defamatory allegations of fraudulent conduct in the public domain, defeating the purpose of the application; and
  • anonymity allowed the Court to explain more of the circumstances of the case in a public judgment.

The Court was also satisfied that there were "good reasons" for not notifying the Defendants. There was a real risk that the Defendants would take steps to defeat the purpose of the injunction by carrying out their threat of publishing allegations of fraud online.

Injunction Application

The Claimants' underlying claim against the Defendant was for unlawful means conspiracy.

Applying the principles from American Cynanamid,5 the Court found not only that the Claimant had established that there was the lower "serious issue to be tried", but, in line with Section 12(3) of the Human Rights Act (given the interference with freedom of speech), the Applicant had surpassed the higher threshold: that it was likely to establish at trial that the publication should not be allowed. This was because:

  • The alleged fraudster, "Ben", claimed to represent at least two other shareholders and there was evidence that another alleged conspirator, "George", was acting in concert with Ben. There was also a clear intention to injure the Claimants; and
  • There was "clear evidence" the Claimants were the victims of blackmail – an indictable offence under the Theft Act 1968.6

Second, the Court held that the Claimants would not be adequately compensated by an award of damages, while the Defendants were unlikely to suffer any real loss from the grant of an interim injunction. As such, the balance of convenience was tilted in favour of the Claimants and granting the injunction.

 

Comment

This judgment highlights how readily the English Court is prepared to issue injunctions against persons unknown "hidden behind aliases and the cloak of secure emails."

As cybercriminals deploy increasingly sophisticated techniques to hide their identity and source of funds while perpetrating frauds online, the growing jurisprudence in this sphere is a welcome addition and can only be bad news for Defendants.

 

1 NCA on Cyber Crime – National Crime Agency.
2 A cryptocurrency mixing program which mixes tainted cryptocurrency funds with others to obscure the funds' original source.
3 AA v Persons Unknown who demanded Bitcoin on 10th and 11th October 2019 and others [2019] EWHC 3556 (Comm).
4 Fetch.ai Ltd and another v Persons Unknown Category A and others [2021] EWHC 2254 (Comm).
5 American Cyanamid Co v Ethicon Ltd [1975] AC 396.
6 Pepperall J at [25.3].

 

Valerie Seah (Trainee Solicitor, White & Case, London) co-authored this publication

 


 

This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2021 White & Case LLP

 

Top