Cybersecurity: Legal implications and risk management
In an increasingly interconnected world, cyber risk is firmly at the top of the boardroom agenda, and having an effective data breach response programme is no longer optional.
Cybersecurity crisis management
The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.
The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise.
Breach of contract
M&A due diligence
Business Continuity Plan
Requests for data
Data Protection Authority Complaints
Group litigation orders
Data Protection Authority
Privacy & data protection
Law Enforcement Involvement
Preservation of Evidence
Legal (internal and external)
Work with forensic investigators to:
Identify and contain breach
Maximise legal privilege coverage
Contact crisis team
Bring in external partners
Identify key risks and priorities based on nature of breach
Assess notification requirements
Directors face personal liability over cybersecurity failures
In an article for The Times, White & Case partner Lawson Caisley discusses why it could become increasingly common for UK directors to "face personal liability and regulatory censure as a result of their company suffering or mishandling a cyberbreach".
Director liability for cyber breaches: transatlantic warning signs?
Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.
AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?
In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.
Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation
Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.
Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law
Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.
Recovering the ransom: High Court confirms Bitcoin status as property
The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.
Navigating Privacy and Cyber Incident Notification and Disclosure Requirements
Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.
Proposal on the Application of the NIS Regulations post-Brexit
This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.
Cybersecurity has been a mainstay of quarterly board agendas for years. Massive cyberattacks on several federal agencies, reported earlier this month, will trigger granular questions about companies' reliance on network management software made by SolarWinds Corp. — the suspected Trojan horse for the attacks.1
This news follows a seemingly endless parade of reports of hacks of consumer, patient and employee data — as well as of advice about shoring up cybersecurity defenses in-house and across supply chains, responding to ransomware demands, handling disclosures of such hacks with customers and employees, and complying with various regulatory changes concerning data management around the globe.
Directors must seek and consider all of that advice in exercising their fiduciary duties. But, inspired by the current documentary "The Perfect Weapon," corporate directors also should ask more fundamental, conceptual cybersecurity questions in boardrooms this coming quarter.
"The Perfect Weapon" started as a December 2016 article in the New York Times about the notorious hack of Democratic National Committee server,2 and became a 2018 book with the same title written by the Times' national security correspondent David Sanger.3 The documentary, based on Sanger's book, focuses on various cyberattacks, including one in 2014 targeting Las Vegas Sands Corp., an integrated resort company.
In the documentary, two former employees of Las Vegas Sands, dramatically silhouetted and with voices distorted, describe their perspective on perhaps one of the first nation-state cyberattack on a U.S. business. Once the attack had been discovered, neither actually knew what had happened or how.
Sands met the attack with a decisive, unconventional response. Sands was able to rebuild its infrastructure without losing all of its critical employee or customer data because of a bold decision to actually pull the plug. That's right: Sands disconnected its information technology infrastructure not only from the web but from the power grid, interrupting the attempted exfiltration and parallel data destruction.
Player data — oxygen to gaming regulators and casino customers — was not at risk because it also resided in a separate analog system, impervious to digital Trojan horses. That analog system allowed Sands to consider a response that cut off the intruders from the digital system and allowed a complete and clean rebuild. That experience may not be an option for most firms but it provides a conceptual basis for inquiry.
We appreciate the supreme convenience of the digital economy and the interdependence of businesses' information technology systems, both in complex networks with external business partners as well as sprawling integration among internal business functions. The digital economy compels many businesses to continue operating significant parts of their work online.
And many companies have continued to work productively during the pandemic because of the sophistication and breadth of their online resources. But our dependence on digital databases and interconnectivity demands consideration of all strategic defense options.4
We thus recommend that this quarter's cybersecurity agenda return to a fundamental question: Should U.S. corporations disaggregate data — preserving some data online, segmenting other data in more restricted, less restricted, less integrated sources — not only to comply with more aggressive privacy regimes, but to reduce the risk of a cyberattack?
Consider the following, common areas of corporate conduct in which aggregated information creates privacy and cyberhack risk.
In most large companies, the human resources department aggregates data through automated hiring, onboarding, training and benefits programs. But does your company's HR function really need online access to all personally identifiable information? After onboarding, an individual employee's disclosures are usually relevant only concerning potential misrepresentations about credentials or employment history.
Compliance certifications — e.g., participation in online training, onboarding and policy updates — and disciplinary records also could be separate from omnibus employee files. Boards and senior management can discuss salary parity and insurance utilization with sufficient data about job functions, productivity and compensation but without PII. Tailored segregation of employee PII, moreover, could also assist multinational companies in complying with increasingly complex privacy regimes around the world.
Upon collecting and safeguarding customers' most sensitive PII — credit card numbers, passports, etc. — who within the company actually needs to access that data? In many companies, marketing personnel conceive of how to sell customers more or how they might sell information about those customers to other business to pitch their products and services.
Customer data is an important resource to inform these strategies. But what is the necessary minimum of customer data that must be online and who really needs access to it? Should some or all of customers' most sensitive data be part of a separate, closed-loop, password-protected system that could, for instance, ensure legal review of any marketing effort to monetize that data in potential violation of privacy regimes abroad and, increasingly, in the U.S.?
Research and Development
Any business that invents and develops valuable know-how — virtually every large business — has policies to protect various forms of intellectual property; allocates rights of ownership; and typically uses technological keys to protect the intellectual property itself and those rights.
Research and development is, moreover, a collaborative process that requires some measure of connectivity. But that connectivity should be narrow. Any system storing that information linked to the web poses inordinate risk of data exfiltration. How does your firm balance the need for connectivity and collaboration with minimizing that risk? What R&D department work stations must be online — and can any be offline?
Some cyberattacks seek competitive intelligence, which can put the C-suite in hackers' crosshairs. Yet there are other, more practical reasons to consider whether C-suite personnel should be integrated seamlessly into a corporations' online networks.
As editors David Shipley and Will Schwalbe warned in their email etiquette book "Send," email is spreadable, searchable and savable. Email is also informal, often imprecise, and sometimes exchanged impulsively. Connecting C-suite personnel to a companywide system can increase the likelihood of miscommunication reaching a much larger audience than intended, both internally and externally.
No matter the level of communications training given about the care and time all of us should invest in drafting communications and in deciding whether to click "send," it is worth asking whether the C-suite should be connected to a corporate wide system at all. In closed-loop communications among core executive functions, the C-suite can develop policy and then access a second system for broader communications. The strategic property developed at the top stays at the top until ready for dissemination.
Unplugging is the most blunt option to avert a hack. It is an option that many companies, in this overwhelmingly digital age, could apply only selectively and with increased costs and complexity.
But as the costs of online operations mount — defending class action claims for data hacks and leaks, complying with intricate privacy regulations, investing in software patches and expert advice — it may be worth asking questions about segmenting and shrinking a firm's networks and creating or preserving strategic data redundancies. Such cyberattack defenses and investments may be as critical as conventional approaches that firms must continue to apply to thwart the next, inevitable, cyberattack.
This article was first published on Law360 on January 6, 2021.