Cybersecurity: Legal implications and risk management
What's inside
In an increasingly interconnected world, cyber risk is firmly at the top of the boardroom agenda, and having an effective data breach response programme is no longer optional.
Cybersecurity crisis management
The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.
The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise.
Key issues
Why?
Reputation
Fines
Breach of contract
M&A due diligence
Insurance
Proprietary information
Litigation
Criminal offences
Negligence
Be prepared
Risk Assessment
Key Information
Assets
Key Systems
Threat Analysis
Security Measures
Toolkit
Scripts
Internal and
External
Communications
Employee contacts
Response Plan
Live Training
Business Continuity Plan
Key considerations
Customer/individual rights
Requests for data
Data Protection Authority Complaints
Group litigation orders
Resolution mechanisms
B2B relationships
Contractual obligations
Contractual liability
Tort
Reputationmanagement
Media strategy
Customer interaction
Employee engagement
Commercial
Proprietary
Information/Trade Secrets
System Disruption
Regulatory issues
Data Protection Authority
Financial Regulators
Market authorities
Other regulators
Privacy & data protection
Jurisdictions involved
Reporting obligations
individuals
authorities
Evidence
Law Enforcement Involvement
Legal Privilege
Preservation of Evidence
Response
Crisis Team
Legal (internal and external)
IT/IT Forensics
PR
Regulatory
DPO
Executive committee
HR
Vendor manager
Key Actions
Work with forensic investigators to:
Identify and contain breach
Gather/preserve evidence
Maximise legal privilege coverage
Contact crisis team
Bring in external partners
Identify key risks and priorities based on nature of breach
Assess notification requirements
Communications
Regulatory notifications
Articles
2024
Judge Rejects SEC’s Aggressive Approach to Cybersecurity Enforcement
On July 18, 2024, a New York federal judge dismissed most of the US Securities and Exchange Commission's ("SEC") claims against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO"), Timothy G. Brown, in connection with the Company's cybersecurity practice.
SEC’s Corp Fin Director Issues Statement on Cybersecurity Incident Disclosures
On May 21, 2024, the SEC's Director of the Division of Corporation Finance issued a statement on cybersecurity incident disclosures in light of the SEC's new cybersecurity disclosure rules. Our summary of this statement and key take-aways from White & Case's survey of cybersecurity disclosures is below.
The SEC’s Charges Against SolarWinds and its Chief Information Security Officer Provide Important Cybersecurity Lessons for Public Companies
On October 30, 2023, the US Securities and Exchange Commission ("SEC") announced that it filed charges against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO") in connection with the SEC Division of Enforcement's ("Enforcement Division") investigation of a cyberattack.
On July 26, 2023, the Securities and Exchange Commission ("SEC"), in a 3-2 vote, adopted rules that will require public companies to make prescribed cybersecurity disclosures.
Shaping the future of digital and cybersecurity governance
In this brief three-minute video, London-based partner Lawson Caisley, Chair of White & Case's Global Cyber Risk Committee, shares his insights on governing cyber risk at the corporate level and some of the challenges of cyber risk management in the boardroom. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
In this short three-minute video, Washington, DC–based partner F. Paul Pittman discusses the implications of the proposed new SEC rules on cybersecurity governance and what corporate boards can do now. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
The potential for cybersecurity threats and attacks looms large and the technology companies developing new products and services play a constant game of cat-and-mouse with hackers and cybercriminals for control of cyberspace. Here are six points to consider when analyzing cybersecurity risks and protections.
Directors face personal liability over cybersecurity failures
In an article for The Times, White & Case partner Lawson Caisley discusses why it could become increasingly common for UK directors to "face personal liability and regulatory censure as a result of their company suffering or mishandling a cyberbreach".
Director liability for cyber breaches: transatlantic warning signs?
Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.
On March 9, 2022, the Securities and Exchange Commission ("SEC") proposed rules that would require public companies to make prescribed cybersecurity disclosures.
In The Legal 500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.
AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?
In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.
Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.
Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation
Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.
Compensating non-material damages based on Article 82 GDPR
Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage?
Cybersecurity Risk: Top 5 strategies to build resilience
The fourth webinar in our 2020 Autumn Webinar Series covered crucial steps you should be taking to protect against cybersecurity threats and what you should do when disaster strikes.
Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law
Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.
UK law enforcement can now obtain an order against a person in or operating in the US for the production of or access to electronic data under a new ‘landmark’ US-UK data sharing agreement.
The COVID-19 crisis has exposed many companies to more cyber threats. Tim Hickman and John Timmons discuss what businesses need to do should a major incident occur.
Trending: Legal protection for cryptoasset stakeholders
Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.
Recovering the ransom: High Court confirms Bitcoin status as property
The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.
Navigating Privacy and Cyber Incident Notification and Disclosure Requirements
Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.
Proposal on the Application of the NIS Regulations post-Brexit
This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.
Corporate Boards Must Ask Key Cybersecurity Questions
Article
|
6 min read
Cybersecurity has been a mainstay of quarterly board agendas for years. Massive cyberattacks on several federal agencies, reported earlier this month, will trigger granular questions about companies' reliance on network management software made by SolarWinds Corp. — the suspected Trojan horse for the attacks.1
This news follows a seemingly endless parade of reports of hacks of consumer, patient and employee data — as well as of advice about shoring up cybersecurity defenses in-house and across supply chains, responding to ransomware demands, handling disclosures of such hacks with customers and employees, and complying with various regulatory changes concerning data management around the globe.
Directors must seek and consider all of that advice in exercising their fiduciary duties. But, inspired by the current documentary "The Perfect Weapon," corporate directors also should ask more fundamental, conceptual cybersecurity questions in boardrooms this coming quarter.
"The Perfect Weapon" started as a December 2016 article in the New York Times about the notorious hack of Democratic National Committee server,2 and became a 2018 book with the same title written by the Times' national security correspondent David Sanger.3 The documentary, based on Sanger's book, focuses on various cyberattacks, including one in 2014 targeting Las Vegas Sands Corp., an integrated resort company.
In the documentary, two former employees of Las Vegas Sands, dramatically silhouetted and with voices distorted, describe their perspective on perhaps one of the first nation-state cyberattack on a U.S. business. Once the attack had been discovered, neither actually knew what had happened or how.
Sands met the attack with a decisive, unconventional response. Sands was able to rebuild its infrastructure without losing all of its critical employee or customer data because of a bold decision to actually pull the plug. That's right: Sands disconnected its information technology infrastructure not only from the web but from the power grid, interrupting the attempted exfiltration and parallel data destruction.
Player data — oxygen to gaming regulators and casino customers — was not at risk because it also resided in a separate analog system, impervious to digital Trojan horses. That analog system allowed Sands to consider a response that cut off the intruders from the digital system and allowed a complete and clean rebuild. That experience may not be an option for most firms but it provides a conceptual basis for inquiry.
We appreciate the supreme convenience of the digital economy and the interdependence of businesses' information technology systems, both in complex networks with external business partners as well as sprawling integration among internal business functions. The digital economy compels many businesses to continue operating significant parts of their work online.
And many companies have continued to work productively during the pandemic because of the sophistication and breadth of their online resources. But our dependence on digital databases and interconnectivity demands consideration of all strategic defense options.4
We thus recommend that this quarter's cybersecurity agenda return to a fundamental question: Should U.S. corporations disaggregate data — preserving some data online, segmenting other data in more restricted, less restricted, less integrated sources — not only to comply with more aggressive privacy regimes, but to reduce the risk of a cyberattack?
Consider the following, common areas of corporate conduct in which aggregated information creates privacy and cyberhack risk.
Human Resources
In most large companies, the human resources department aggregates data through automated hiring, onboarding, training and benefits programs. But does your company's HR function really need online access to all personally identifiable information? After onboarding, an individual employee's disclosures are usually relevant only concerning potential misrepresentations about credentials or employment history.
Compliance certifications — e.g., participation in online training, onboarding and policy updates — and disciplinary records also could be separate from omnibus employee files. Boards and senior management can discuss salary parity and insurance utilization with sufficient data about job functions, productivity and compensation but without PII. Tailored segregation of employee PII, moreover, could also assist multinational companies in complying with increasingly complex privacy regimes around the world.
Customer Data
Upon collecting and safeguarding customers' most sensitive PII — credit card numbers, passports, etc. — who within the company actually needs to access that data? In many companies, marketing personnel conceive of how to sell customers more or how they might sell information about those customers to other business to pitch their products and services.
Customer data is an important resource to inform these strategies. But what is the necessary minimum of customer data that must be online and who really needs access to it? Should some or all of customers' most sensitive data be part of a separate, closed-loop, password-protected system that could, for instance, ensure legal review of any marketing effort to monetize that data in potential violation of privacy regimes abroad and, increasingly, in the U.S.?
Research and Development
Any business that invents and develops valuable know-how — virtually every large business — has policies to protect various forms of intellectual property; allocates rights of ownership; and typically uses technological keys to protect the intellectual property itself and those rights.
Research and development is, moreover, a collaborative process that requires some measure of connectivity. But that connectivity should be narrow. Any system storing that information linked to the web poses inordinate risk of data exfiltration. How does your firm balance the need for connectivity and collaboration with minimizing that risk? What R&D department work stations must be online — and can any be offline?
The C-Suite
Some cyberattacks seek competitive intelligence, which can put the C-suite in hackers' crosshairs. Yet there are other, more practical reasons to consider whether C-suite personnel should be integrated seamlessly into a corporations' online networks.
As editors David Shipley and Will Schwalbe warned in their email etiquette book "Send," email is spreadable, searchable and savable. Email is also informal, often imprecise, and sometimes exchanged impulsively. Connecting C-suite personnel to a companywide system can increase the likelihood of miscommunication reaching a much larger audience than intended, both internally and externally.
No matter the level of communications training given about the care and time all of us should invest in drafting communications and in deciding whether to click "send," it is worth asking whether the C-suite should be connected to a corporate wide system at all. In closed-loop communications among core executive functions, the C-suite can develop policy and then access a second system for broader communications. The strategic property developed at the top stays at the top until ready for dissemination.
Unplugging is the most blunt option to avert a hack. It is an option that many companies, in this overwhelmingly digital age, could apply only selectively and with increased costs and complexity.
But as the costs of online operations mount — defending class action claims for data hacks and leaks, complying with intricate privacy regulations, investing in software patches and expert advice — it may be worth asking questions about segmenting and shrinking a firm's networks and creating or preserving strategic data redundancies. Such cyberattack defenses and investments may be as critical as conventional approaches that firms must continue to apply to thwart the next, inevitable, cyberattack.
This article was first published on Law360 on January 6, 2021.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.