Our thinking

Cybersecurity: Legal implications and risk management

What's inside

In an increasingly interconnected world, cyber risk is firmly at the top of the boardroom agenda, and having an effective data breach response programme is no longer optional.

Cybersecurity crisis management

The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.

The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise. 

Key issues

Why?

  • Reputation
  • Fines
  • Breach of contract
  • M&A due diligence
  • Insurance
  • Proprietary information
  • Litigation
  • Criminal offences
  • Negligence

Be prepared

Risk Assessment

  • Key Information
  • Assets
  • Key Systems
  • Threat Analysis
  • Security Measures

Toolkit

  • Scripts
  • Internal and 
    External
  • Communications
  • Employee contacts
  • Response Plan
  • Live Training
  • Business Continuity Plan

Key considerations

Customer/individual rights

  • Requests for data
  • Data Protection Authority Complaints
  • Group litigation orders
  • Resolution mechanisms

B2B relationships

  • Contractual obligations
  • Contractual liability
  • Tort

Reputation management

  • Media strategy
  • Customer interaction
  • Employee engagement

Commercial

  • Proprietary
  • Information/Trade Secrets
  • System Disruption

Regulatory issues

  • Data Protection Authority
  • Financial Regulators
  • Market authorities
  • Other regulators

Privacy & data protection

  • Jurisdictions involved
  • Reporting obligations
    • individuals
    • authorities

Evidence

  • Law Enforcement Involvement
  • Legal Privilege
  • Preservation of Evidence

Response

Crisis Team

  • Legal (internal and external)
  • IT/IT Forensics
  • PR
  • Regulatory
  • DPO
  • Executive committee
  • HR
  • Vendor manager

Key Actions

  • Work with forensic investigators to:
    • Identify and contain breach
    • Gather/preserve evidence
    • Maximise legal privilege coverage
  • Contact crisis team
  • Bring in external partners
  • Identify key risks and priorities based on nature of breach
  • Assess notification requirements
  • Communications
  • Regulatory notifications

 

Articles

Legal 500's In-House Lawyer Magazine Autumn - Commercial Litigation Focus (Germany)

In The Legal500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.

magazine pile

AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?

In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.

orange background

Time to Revisit Risk Factors in Periodic Reports

Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.

Alert 800x800

Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation

Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.

Compensating non-material damages based on Article 82 GDPR

Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage? 

Corporate Boards Must Ask Key Cybersecurity Questions

Cybersecurity has been a mainstay of quarterly board agendas for years.

Cybersecurity Risk: Top 5 strategies to build resilience

The fourth webinar in our 2020 Autumn Webinar Series covered crucial steps you should be taking to protect against cybersecurity threats and what you should do when disaster strikes.

Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law

Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.

stack of paper

US Cybersecurity Standards to Get Tougher and More Specific

In the past few years, cybersecurity has taken on increasing importance in the eyes of lawmakers and regulators.

Data Sharing Without Borders

UK law enforcement can now obtain an order against a person in or operating in the US for the production of or access to electronic data under a new ‘landmark’ US-UK data sharing agreement.

Alert 800x800

Responding to a cyber-incident

The COVID-19 crisis has exposed many companies to more cyber threats. Tim Hickman and John Timmons discuss what businesses need to do should a major incident occur.

Trending: Legal protection for cryptoasset stakeholders

Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.

InTheMedia_800x800.jpg

Recovering the ransom: High Court confirms Bitcoin status as property

The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.

Navigating Privacy and Cyber Incident Notification and Disclosure Requirements

Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.

Proposal on the Application of the NIS Regulations post-Brexit

This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.

Contacts

Corporate Boards Must Ask Key Cybersecurity Questions

Article
|
7 min read

World in Transition

Our views on changing dynamics in energy, ESG, finance, globalization and US policy.

Cybersecurity has been a mainstay of quarterly board agendas for years. Massive cyberattacks on several federal agencies, reported earlier this month, will trigger granular questions about companies' reliance on network management software made by SolarWinds Corp. — the suspected Trojan horse for the attacks.1

This news follows a seemingly endless parade of reports of hacks of consumer, patient and employee data — as well as of advice about shoring up cybersecurity defenses in-house and across supply chains, responding to ransomware demands, handling disclosures of such hacks with customers and employees, and complying with various regulatory changes concerning data management around the globe.

Directors must seek and consider all of that advice in exercising their fiduciary duties. But, inspired by the current documentary "The Perfect Weapon," corporate directors also should ask more fundamental, conceptual cybersecurity questions in boardrooms this coming quarter.

"The Perfect Weapon" started as a December 2016 article in the New York Times about the notorious hack of Democratic National Committee server,2 and became a 2018 book with the same title written by the Times' national security correspondent David Sanger.3 The documentary, based on Sanger's book, focuses on various cyberattacks, including one in 2014 targeting Las Vegas Sands Corp., an integrated resort company.

In the documentary, two former employees of Las Vegas Sands, dramatically silhouetted and with voices distorted, describe their perspective on perhaps one of the first nation-state cyberattack on a U.S. business. Once the attack had been discovered, neither actually knew what had happened or how.

Sands met the attack with a decisive, unconventional response. Sands was able to rebuild its infrastructure without losing all of its critical employee or customer data because of a bold decision to actually pull the plug. That's right: Sands disconnected its information technology infrastructure not only from the web but from the power grid, interrupting the attempted exfiltration and parallel data destruction.

Player data — oxygen to gaming regulators and casino customers — was not at risk because it also resided in a separate analog system, impervious to digital Trojan horses. That analog system allowed Sands to consider a response that cut off the intruders from the digital system and allowed a complete and clean rebuild. That experience may not be an option for most firms but it provides a conceptual basis for inquiry.

We appreciate the supreme convenience of the digital economy and the interdependence of businesses' information technology systems, both in complex networks with external business partners as well as sprawling integration among internal business functions. The digital economy compels many businesses to continue operating significant parts of their work online.

And many companies have continued to work productively during the pandemic because of the sophistication and breadth of their online resources. But our dependence on digital databases and interconnectivity demands consideration of all strategic defense options.4

We thus recommend that this quarter's cybersecurity agenda return to a fundamental question: Should U.S. corporations disaggregate data — preserving some data online, segmenting other data in more restricted, less restricted, less integrated sources — not only to comply with more aggressive privacy regimes, but to reduce the risk of a cyberattack?

Consider the following, common areas of corporate conduct in which aggregated information creates privacy and cyberhack risk.

 

Human Resources

In most large companies, the human resources department aggregates data through automated hiring, onboarding, training and benefits programs. But does your company's HR function really need online access to all personally identifiable information? After onboarding, an individual employee's disclosures are usually relevant only concerning potential misrepresentations about credentials or employment history.

Compliance certifications — e.g., participation in online training, onboarding and policy updates — and disciplinary records also could be separate from omnibus employee files. Boards and senior management can discuss salary parity and insurance utilization with sufficient data about job functions, productivity and compensation but without PII. Tailored segregation of employee PII, moreover, could also assist multinational companies in complying with increasingly complex privacy regimes around the world.

 

Customer Data

Upon collecting and safeguarding customers' most sensitive PII — credit card numbers, passports, etc. — who within the company actually needs to access that data? In many companies, marketing personnel conceive of how to sell customers more or how they might sell information about those customers to other business to pitch their products and services.

Customer data is an important resource to inform these strategies. But what is the necessary minimum of customer data that must be online and who really needs access to it? Should some or all of customers' most sensitive data be part of a separate, closed-loop, password-protected system that could, for instance, ensure legal review of any marketing effort to monetize that data in potential violation of privacy regimes abroad and, increasingly, in the U.S.?

 

Research and Development

Any business that invents and develops valuable know-how — virtually every large business — has policies to protect various forms of intellectual property; allocates rights of ownership; and typically uses technological keys to protect the intellectual property itself and those rights. 

Research and development is, moreover, a collaborative process that requires some measure of connectivity. But that connectivity should be narrow. Any system storing that information linked to the web poses inordinate risk of data exfiltration. How does your firm balance the need for connectivity and collaboration with minimizing that risk? What R&D department work stations must be online — and can any be offline?

 

The C-Suite

Some cyberattacks seek competitive intelligence, which can put the C-suite in hackers' crosshairs. Yet there are other, more practical reasons to consider whether C-suite personnel should be integrated seamlessly into a corporations' online networks.

As editors David Shipley and Will Schwalbe warned in their email etiquette book "Send," email is spreadable, searchable and savable. Email is also informal, often imprecise, and sometimes exchanged impulsively. Connecting C-suite personnel to a companywide system can increase the likelihood of miscommunication reaching a much larger audience than intended, both internally and externally.

No matter the level of communications training given about the care and time all of us should invest in drafting communications and in deciding whether to click "send," it is worth asking whether the C-suite should be connected to a corporate wide system at all. In closed-loop communications among core executive functions, the C-suite can develop policy and then access a second system for broader communications. The strategic property developed at the top stays at the top until ready for dissemination.

Unplugging is the most blunt option to avert a hack. It is an option that many companies, in this overwhelmingly digital age, could apply only selectively and with increased costs and complexity. 

But as the costs of online operations mount — defending class action claims for data hacks and leaks, complying with intricate privacy regulations, investing in software patches and expert advice — it may be worth asking questions about segmenting and shrinking a firm's networks and creating or preserving strategic data redundancies. Such cyberattack defenses and investments may be as critical as conventional approaches that firms must continue to apply to thwart the next, inevitable, cyberattack.

This article was first published on Law360 on January 6, 2021.

 

1 See, e.g., David E. Sanger, "Russian Hackers Broke Into Federal Agencies, U.S. Officials Suspect," N.Y. Times(Dec.13, 2020; updated Dec. 18, 2020), https://www.nytimes.com/2020/12/13/us/politics/russian-hackers-us-government-treasury-commerce.html.
2 Eric Lipton, David E. Sanger, & Scott Shane, "The Perfect Weapon: How Russian Cyberpower Invaded the U.S.,"N.Y. Times (Dec. 13, 2016), https://www.nytimes.com/2016/12/13/us/politics/russia-hack-election-dnc.html.
3 David E. Sanger, The Perfect Weapon: War, Sabotage and Fear in the Cyber Age (2018).
4 See, e.g. https://www.whitecase.com/publications/insight/cybersecurity-legal-implications-and-risk-management

This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2021 White & Case LLP

 

Top