Our thinking

Cybersecurity: Legal implications and risk management

What's inside

In an increasingly interconnected world, cyber risk is firmly at the top of the boardroom agenda, and having an effective data breach response programme is no longer optional.

Cybersecurity crisis management

The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.

The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise. 

Key issues

Why?

  • Reputation
  • Fines
  • Breach of contract
  • M&A due diligence
  • Insurance
  • Proprietary information
  • Litigation
  • Criminal offences
  • Negligence

Be prepared

Risk Assessment

  • Key Information
  • Assets
  • Key Systems
  • Threat Analysis
  • Security Measures

Toolkit

  • Scripts
  • Internal and 
    External
  • Communications
  • Employee contacts
  • Response Plan
  • Live Training
  • Business Continuity Plan

Key considerations

Customer/individual rights

  • Requests for data
  • Data Protection Authority Complaints
  • Group litigation orders
  • Resolution mechanisms

B2B relationships

  • Contractual obligations
  • Contractual liability
  • Tort

Reputation management

  • Media strategy
  • Customer interaction
  • Employee engagement

Commercial

  • Proprietary
  • Information/Trade Secrets
  • System Disruption

Regulatory issues

  • Data Protection Authority
  • Financial Regulators
  • Market authorities
  • Other regulators

Privacy & data protection

  • Jurisdictions involved
  • Reporting obligations
    • individuals
    • authorities

Evidence

  • Law Enforcement Involvement
  • Legal Privilege
  • Preservation of Evidence

Response

Crisis Team

  • Legal (internal and external)
  • IT/IT Forensics
  • PR
  • Regulatory
  • DPO
  • Executive committee
  • HR
  • Vendor manager

Key Actions

  • Work with forensic investigators to:
    • Identify and contain breach
    • Gather/preserve evidence
    • Maximise legal privilege coverage
  • Contact crisis team
  • Bring in external partners
  • Identify key risks and priorities based on nature of breach
  • Assess notification requirements
  • Communications
  • Regulatory notifications

 

Articles

2023

Shaping the future of digital and cybersecurity governance

In this brief three-minute video, London-based partner Lawson Caisley, Chair of White & Case's Global Cyber Risk Committee, shares his insights on governing cyber risk at the corporate level and some of the challenges of cyber risk management in the boardroom. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.

cybersecurity_square_800x800_4

Prioritizing cybersecurity at the corporate level

In this short three-minute video, Washington, DC–based partner F. Paul Pittman discusses the implications of the proposed new SEC rules on cybersecurity governance and what corporate boards can do now. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.

digital mesh

Cybersecurity Developments and Legal Issues

The potential for cybersecurity threats and attacks looms large and the technology companies developing new products and services play a constant game of cat-and-mouse with hackers and cybercriminals for control of cyberspace. Here are six points to consider when analyzing cybersecurity risks and protections.

client alert image

Directors face personal liability over cybersecurity failures

In an article for The Times, White & Case partner Lawson Caisley discusses why it could become increasingly common for UK directors to "face personal liability and regulatory censure as a result of their company suffering or mishandling a cyberbreach".

wafer circuit detail

2022

Director liability for cyber breaches: transatlantic warning signs?

Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.  

arrow

2021

Legal 500's In-House Lawyer Magazine Autumn - Commercial Litigation Focus (Germany)

In The Legal 500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.

magazine pile

AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?

In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.

orange background

Time to Revisit Risk Factors in Periodic Reports

Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.

Alert 800x800

Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation

Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.

Compensating non-material damages based on Article 82 GDPR

Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage? 

Corporate Boards Must Ask Key Cybersecurity Questions

Cybersecurity has been a mainstay of quarterly board agendas for years.

2020

Cybersecurity Risk: Top 5 strategies to build resilience

The fourth webinar in our 2020 Autumn Webinar Series covered crucial steps you should be taking to protect against cybersecurity threats and what you should do when disaster strikes.

Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law

Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.

stack of paper

US Cybersecurity Standards to Get Tougher and More Specific

In the past few years, cybersecurity has taken on increasing importance in the eyes of lawmakers and regulators.

Data Sharing Without Borders

UK law enforcement can now obtain an order against a person in or operating in the US for the production of or access to electronic data under a new ‘landmark’ US-UK data sharing agreement.

Alert 800x800

Responding to a cyber-incident

The COVID-19 crisis has exposed many companies to more cyber threats. Tim Hickman and John Timmons discuss what businesses need to do should a major incident occur.

Trending: Legal protection for cryptoasset stakeholders

Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.

Recovering the ransom: High Court confirms Bitcoin status as property

The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.

2019

Navigating Privacy and Cyber Incident Notification and Disclosure Requirements

Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.

Proposal on the Application of the NIS Regulations post-Brexit

This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.

Contacts

Time to Revisit Risk Factors in Periodic Reports

Alert
|
8 min read

Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.

As companies prepare their periodic reports with the SEC, a recent case and US Securities and Exchange Commission ("SEC") pronouncements have reiterated the importance of revisiting risk factors to assess any material developments since the disclosure of complete risk factor sections in Form 10-Ks, including those related to cybersecurity risks.

The SEC's Form 10-Q only requires "any material changes from risk factors as previously disclosed in the registrant's Form 10-K" and often companies will disclose that there are no such material changes in their 10-Q and refer readers back to their risk factors in the 10-K. A recent Ninth Circuit case, however, provides an important reminder of the importance of assessing whether any material changes should be disclosed.

I. Recent Ninth Circuit Decision Reminds Public Companies to Update Their Risk Factors 

In an opinion published on June 16, 2021, the Ninth Circuit found that plaintiff shareholders adequately alleged that a major tech company (the "Company") intentionally made statements on its Forms 10-Q that omitted material facts necessary to make the statements not misleading regarding cybersecurity risks.1 Notably, the panel found that by simply affirming that there were no material changes to its prior 10-K risk factor disclosures and incorporating its prior 10-K disclosures, a reasonable investor reading the Company's Forms 10-Q could have been misled by the Company's representation that there had been "no material changes" in its risk factor disclosures whereas, at the time of the 10-Qs filings, the Company was allegedly aware of a cybersecurity vulnerability.2

Plaintiffs alleged that, in March 2018, senior executives of the Company learned that, since 2015, the company was exposed to cyber security vulnerabilities.3 In April and June 2018, the Company purportedly filed quarterly Form 10-Q reports that incorporated the risk disclosures it already made in its 2017 10-K report that did not reflect the vulnerabilities it discovered in March 2018, and affirmed that there had been no material changes to its risk factors since 2017.4

The Company's publicly traded share price fell after the news broke of these vulnerabilities.Three days later, plaintiffs sued the Company and several of their senior executives for securities fraud under Section 10(b) of the Securities Exchange Act of 1934.6 The district court granted the Company's motion to dismiss for failure to state a claim finding that plaintiffs had failed to allege a material misrepresentation or omission and also failed to sufficiently allege scienter.

The Ninth Circuit reversed in part holding that plaintiffs plausibly alleged that the Company's omission was material given (i) the lack of any new risk disclosures in the Company's 10-Qs following the detection of the vulnerabilities, (ii) that the 10-Qs were made after internal deliberation at a senior level to exclude information relating to the vulnerabilities, and (iii) the statements were made at the same time as growing scrutiny of tech companies' disclosure of user information following the Cambridge Analytica scandal.7

The Ninth Circuit also relied on SEC guidance issued in 2018 on public company cybersecurity disclosures (the "SEC Guidance") to support its conclusion that the omission was material.8 The SEC Guidance directs public companies to take all required actions to inform investors about material cybersecurity risks and incidents in a timely fashion, implement appropriate disclosure controls and procedures, and take steps to prevent insiders from trading until their investors have information about the incident or risk. In particular, the SEC Guidance advises that companies should weigh a series of factors, such as harm to their reputation, financial performance, customer trust, and possibility of litigation and regulatory investigations, when determining the materiality of cybersecurity risks and the duty to disclose them.9

The Ninth Circuit then found that "these risks of harm had ripened into actual harm" when the vulnerabilities were detected.10 Further, the Ninth Circuit ruled that the complaint plausibly alleged that this omission was misleading because the Company warned in its 10-Qs of risks that "could" or "may" occur whereas the company knew these risks had already materialized.11 The Ninth Circuit concluded that the materiality of the costs and consequences associated with the discovered vulnerabilities and their public disclosures, and the Company's decision not to disclose that information in its 10-Qs, significantly altered the total mix of information available for decision-making by a reasonable investor.12

The court also found that the complaint's allegations raised a strong inference that senior executives were informed about the vulnerabilities, aware of the consequences of disclosing them, and intentionally chose not to disclose them in the company's 10-Qs.13

II. SEC is Focused on Cybersecurity Risks

The new leadership of the SEC has made it clear it intends to continue to scrutinize cybersecurity risks and incidents disclosures, and this recent decision issued by the Ninth Circuit supports the SEC's approach. In May, SEC Chair Gary Gensler stated that the SEC is "ready to bring cases involving issues such as crypto, cyber, and fintech."14 Then in June, the SEC announced that it is considering enhancing its disclosure rules concerning cybersecurity risk governance15 and it announced settled charges against an insurance company for disclosure controls and procedures violations related to a cybersecurity vulnerability that exposed sensitive customer data.16 Further, the SEC announced it opened an investigation regarding a cyberattack that compromised software made by SolarWinds and issued hundreds of investigative letters to SolarWinds' customers to determine if they too failed to disclose their exposure to the incident.17

Standing alone, these actions show the SEC is focused on cybersecurity disclosures, but the Ninth Circuit's recent opinion emphasizes that these disclosures should be timely and updated, if necessary, in quarterly filings. The SEC's focus on disclosures relating to cybersecurity vulnerabilities, rather than confining cybersecurity disclosures to the more clearly defined "cyberattack," however, could create uncertainty for public companies in determining what needs to be disclosed with regard to cybersecurity. Identifying and resolving network security vulnerabilities are a standard component of any reasonable cybersecurity program. Such testing is routinely performed, sometimes on a weekly or monthly basis, and may reveal hundreds of critical vulnerabilities that the business needs to address. As such, the SEC's approach could lead to the excessive disclosure of cybersecurity vulnerabilities in public filings. Ultimately, public companies should take care to ensure that any disclosures of cybersecurity vulnerabilities are consistent with the SEC Guidance discouraging detailed disclosures that might invite cyberattacks.18

Key Takeaways

The Ninth Circuit decision is an important reminder of the importance of revisiting risk factors each quarter, and not just cyber-related risk factors, in a context of continuous global uncertainty. Generally, as Item 1A of Form 10-Q requires public companies to update their risk factor disclosure in their Form 10-K when a material change occurs, public companies should carefully consider whether prior disclosed risks have mutated, new risks have emerged, and hypothetical risks have materialized. More specifically, the Ninth Circuit decision highlights that presenting risks as hypothetical when in fact these risks have already occurred could be considered misleading. Likewise, public companies must be mindful when referring to prior risk disclosure and assuring that there have been no material changes. If any of these risks have materialized, such statement could be material and misleading and Form 10-Q must be updated accordingly.

1 Alphabet Secs. Litig., R.I., v. Alphabet, Inc., NNo. 20-15638, 2021 US App. LEXIS 17926 (9th Cir. Feb. 4, 2021); Rhode Island v. Alphabet, Inc., No. 20-15638, 2021 US App. LEXIS 21981 (9th Cir. July 23, 2021) (denying petition for rehearing en banc).
2 Alphabet Secs. Litig., R.I., 2021 US App. LEXIS 17926, at *27-28.
3 Id. at *4.
4 Id. at *12-13.
5 Id. at *16.
6 Id. at *17 (alleging violations of Section 20(a) as well, which allows for control persons to be held jointly and severally liable for securities fraud violations of those the control person controls).
7 Id. at*27-28, *34-35, *38.
8 Id. at *22, *29 (quoting Commission Statement and Guidance on Public Company Cybersecurity Disclosures, Securities Act Release No. 33-10459, Exchange Act Release No. 34-82746, 83 Fed. Reg. 8166-01, 8167, 8169 (Feb. 26, 2018)(hereinafter "Cybersecurity Disclosures").  
9 Cybersecurity Disclosures, 83 Fed. Reg. at 8169.
10 Alphabet Secs. Litig., R.I., 2021 US App. LEXIS 17926, at *29.
11 Id. at *29-30. 
12 Id. at *34. 
13 Id. at *36-38.
14 SEC Chairman Gary Gensler, Remarks at 2021 FINRA Annual Conference, Speech, US SECURITIES AND EXCHANGE COMMISSION (May 20, 2021), https://www.sec.gov/news/speech/gensler-finra-conference.
15 See SEC Announces Annual Regulatory Agenda, Press Release, US SECURITIES AND EXCHANGE COMMISSION (June 11, 2021), https://www.sec.gov/news/press-release/2021-99; Cybersecurity Risk Governance, 3235-AM89, Securities and Exchange Commission (Spring 2021).
16 SEC Charges Issuer With Cybersecurity Disclosure Controls Failures, Press Release, US SECURITIES AND EXCHANGE COMMISSION (June 15, 2021), https://www.sec.gov/news/press-release/2021-102; In re First American Financial Corporation, Order Instituting Cease-and-Desist Proceedings, Release No. 92176 (June 14, 2021).
17 In the Matter of Certain Cybersecurity-Related Events (HO-14225) FAQs, Press Release, US SECURITIES AND EXCHANGE COMMISSION (modified June 25, 2021),  https://www.sec.gov/enforce/certain-cybersecurity-related-events-faqs. The investigative letters encourage companies to report voluntarily to the SEC how they were impacted by the SolarWinds breach and what remedial steps they implemented in response. The SEC Enforcement staff may not recommend enforcement actions against companies that answer the SEC's letter.
18 Cybersecurity Disclosures, 83 Fed. Reg. at 8169 ("We do not expect companies to publicly disclose specific, technical information about their cybersecurity systems, the related networks and devices, or potential system vulnerabilities in such detail as would make such systems, networks, and devices more susceptible to a cybersecurity incident.").

 

White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.

This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.

© 2022 White & Case LLP

Top