Cybersecurity: Legal implications and risk management
In an increasingly interconnected world, cyber risk is firmly at the top of the boardroom agenda, and having an effective data breach response programme is no longer optional.
Cybersecurity crisis management
The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.
The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise.
Breach of contract
M&A due diligence
Business Continuity Plan
Requests for data
Data Protection Authority Complaints
Group litigation orders
Data Protection Authority
Privacy & data protection
Law Enforcement Involvement
Preservation of Evidence
Legal (internal and external)
Work with forensic investigators to:
Identify and contain breach
Maximise legal privilege coverage
Contact crisis team
Bring in external partners
Identify key risks and priorities based on nature of breach
Assess notification requirements
Shaping the future of digital and cybersecurity governance
In this brief three-minute video, London-based partner Lawson Caisley, Chair of White & Case's Global Cyber Risk Committee, shares his insights on governing cyber risk at the corporate level and some of the challenges of cyber risk management in the boardroom. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
In this short three-minute video, Washington, DC–based partner F. Paul Pittman discusses the implications of the proposed new SEC rules on cybersecurity governance and what corporate boards can do now. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
The potential for cybersecurity threats and attacks looms large and the technology companies developing new products and services play a constant game of cat-and-mouse with hackers and cybercriminals for control of cyberspace. Here are six points to consider when analyzing cybersecurity risks and protections.
Directors face personal liability over cybersecurity failures
In an article for The Times, White & Case partner Lawson Caisley discusses why it could become increasingly common for UK directors to "face personal liability and regulatory censure as a result of their company suffering or mishandling a cyberbreach".
Director liability for cyber breaches: transatlantic warning signs?
Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.
AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?
In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.
Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation
Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.
Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law
Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.
Recovering the ransom: High Court confirms Bitcoin status as property
The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.
Navigating Privacy and Cyber Incident Notification and Disclosure Requirements
Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.
Proposal on the Application of the NIS Regulations post-Brexit
This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.
Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.
Since the rise in use of digital currencies and smart contracts, jurisdictions around the world have been called on to consider how cryptoassets and related transactions should be treated as a matter of law, and consequentially, what legal protection stakeholders can expect. In the past year, there have been noteable developments in this area and signs of a trending consensus towards recognition of cryptoassets as property. This classification is important as it provides stakeholders with legal remedies that would otherwise not be available.
B2C2 v Quoine
One of the first key rulings was by the Singapore International Commercial Court in B2C2 v Quoine1. The case concerned a series of cryptocurrency trades on a currency exchange platform (Quoine) which were inadvertently carried out at 250 times the market rate (in favour of B2C2), due to a fault in Quoine's trading algorithm. The trades were subsequently unilaterally reversed by Quoine, who alleged, amongst other things, that it was right to reverse the trades because they had been entered into by mistake and were therefore void. B2C2 consequently brought proceedings against Quoine, claiming that Quoine's decision to reverse the trades was both a breach of the contractual terms between the parties and a breach of trust.
In order to determine the dispute, the court had to address a number of novel points, including whether cryptocurrencies could be considered as property, and how to ascertain a party's knowledge where the relevant operations are carried out by an algorithm with no human intervention (to determine whether the trades could be considered void for mistake). The judge, Thorley LJ determined that: (i) there was no 'mistake' and Quoine was therefore in breach of contract for unilaterally reversing the trades; (ii) cryptocurrencies could be considered as property, capable of being held in trust by Quoine; and (iii) Quoine was in breach of that trust (for full details, see our update here).
That decision has now been affirmed in part by the Singapore Court of Appeal. Specifically, the Court of Appeal agreed that Quoine was in breach of contract for unilaterally reversing the trades, and provided authoritative guidance on how courts should determine contractual terms and the knowledge and expectations of the parties in transactions involving algorithmic processes, rather than traditional human decision-making. In reaching its decision, the Court demonstrated that traditional legal principles are of continuing relevance, and can be "meaningfully adapted" to deal with novel situations.2
However, the Court of Appeal allowed Quoine's appeal regarding the breach of trust, as it was not persuaded that there had been sufficient certainty of intention to create a trust. In particular, the Court did not consider that the mere fact that Quoine held the account holders' assets in separate digital wallets from the platform's own trading assets, could in and of itself lead to the conclusion that there was a trust.3 Given this, the Court of Appeal refrained from coming to a final position on whether cryptoassets could, in principle, be treated as property. It noted, however, that a number of recent Commonwealth decisions, as well as the UK Jurisdiction Taskforce's ("UKJT") Legal Statement on Cryptoassets and Smart Contracts (see update here), had all concluded that cryptoassets could, in principle, be treated as property, with Menon CJ commenting that "There may be much to commend the view that cryptocurrencies should be capable of assimilation into the general concepts of property. There are, however, difficult questions as to the type of property that is involved".4
Growing consensus that cryptoassets should be treated as property
Notwithstanding the Singapore Court of Appeal's reluctance to come to a conclusive decision on the precise proprietary definition that can be ascribed to cryptoassets, there appears to be a continuing trend towards recognising cryptoassets as property, with the New Zealand High Court being the latest to issue a ruling in support of this approach.
Ruscoe v Cryptopia Limited (in liquidation)5 concerned a cryptocurrency trading exchange platform, Cryptopia, that had been hacked in January 2019. As a result, Cryptopia lost approximately NZD 30 million in cryptocurrency, with the company consequently being placed into liquidation. During the liquidation proceedings, the High Court in New Zealand had to determine whether cryptocurrencies could be considered as property, capable of being held on trust. The implications of this question were important: if the cryptoassets were considered to be held on trust, it would mean that the account holders on Crytopia's platform would have priority over creditors in the liquidation proceedings.
In line with the UKJT's conclusion in its report, the Court determined that while it was difficult to formulate a precise definition, cryptoassets could be treated as property for the purposes of the New Zealand Companies' Act (and "probably more generally").6 In reaching this conclusion, Gendall J found that the four elements of the classic test for 'property', set out by Lord Wilberforce in National Provincial Bank Ltd v Ainsworth7, were satisfied.8 Gendall J also noted support for treating cryptoassets as property from across common law countries, including Canada9 and England10 (although it is notable that, in many cases, neither party appeared to advance the argument that cryptoassets might not be property). The Court also firmly rejected any argument that cryptoassets could be considered as mere 'information' (which is generally not accepted as property), before finally noting that there were strong public policy arguments in favour of recognising cryptoassets as property.
In deciding whether the cryptocurrencies could be held on trust, the court distinguished the case from the Singapore's Court of Appeal ruling in B2C2 v Quoine. As stated above, the Singapore Court of Appeal had concluded that the mere fact that Quoine's currency platform held the accountholder's assets in separate accounts, could not in and of itself lead to the conclusion that Quoine intended to hold the cryptoassets on trust for its account holders. However, in Cryptopia there were a number of additional factors which pointed to Cryptopia being a trustee of the traded cryptoassets, namely (i) Cryptopia's terms and conditions of the platform included express trust provisions; and (ii) the company's internal financial accounts demonstrated that the platform did not assert any ownership in the traded cryptocurrency.11 Accordingly, the court found that whether cryptoassets can be held on trust will depend on the facts of each case.12
As the market for cryptoassets continues to grow, along with the cyber security risks that can be associated with them, it is helpful that judges in some common law jurisdictions have sought to apply traditional legal principles to novel circumstances, in order to provide protection to the stakeholders of these assets. The recent decisions also demonstrate that the UKJT's legal statement has been influential on these issues.
1 B2C2 Ltd v Quoine Pte Ltd  SGHC(I) 03.
2 Quoine Pte Ltd v B2C2 Ltd  SGCA(I) 02, paragraph 72.
3 Quoine Pte Ltd v B2C2 Ltd  SGCA(I) 02, paragraphs 144-145.
4 Quoine Pte Ltd v B2C2 Ltd  SGCA(I) 02, paragraph 144.
5 Ruscoe v Cryptopia Limited (in liquidation)  NZHC 728.
6 Ruscoe v Cryptopia Limited (in liquidation)  NZHC 728, paragraphs 120 to 121, 133.
7 National Provincial Bank Ltd v Ainsworth  AC 1175 (HL) at 1247–1248.
8 Ruscoe v Cryptopia Limited (in liquidation)  NZHC 728, paragraphs 120 to 121.
9 Shair.Com Global Digital Services Ltd v Arnold, 2018 BCSC 1512.
10 Citing Vorotyntseva v Money-4 Ltd  EWHC 2596 (Ch) and AA v Persons Unknown  EWHC 3556,  4 WLR 35 at – (see update here).
11 Ruscoe v Cryptopia Limited (in liquidation) CIV-2019-409-000544  NZHC 728, paragraphs 165 to 166.
12 Ruscoe v Cryptopia Limited (in liquidation) CIV-2019-409-000544  NZHC 728, paragraphs 164.