- individuals
- authorities
Evidence
- Law Enforcement Involvement
- Legal Privilege
- Preservation of Evidence
Response
Crisis Team
- Legal (internal and external)
- IT/IT Forensics
- PR
- Regulatory
- DPO
- Executive committee
- HR
- Vendor manager
Key Actions
- Work with forensic investigators to:
- Identify and contain breach
- Gather/preserve evidence
- Maximise legal privilege coverage
Articles
2024
Judge Rejects SEC’s Aggressive Approach to Cybersecurity Enforcement
On July 18, 2024, a New York federal judge dismissed most of the US Securities and Exchange Commission's ("SEC") claims against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO"), Timothy G. Brown, in connection with the Company's cybersecurity practice.
NIS 2 Directive: Navigating the challenges of implementation, impact, and scope
The NIS 2 directive establishes a regulatory framework aimed at improving the level of cybersecurity across the EU.
SEC’s Corp Fin Director Issues Statement on Cybersecurity Incident Disclosures
On May 21, 2024, the SEC's Director of the Division of Corporation Finance issued a statement on cybersecurity incident disclosures in light of the SEC's new cybersecurity disclosure rules. Our summary of this statement and key take-aways from White & Case's survey of cybersecurity disclosures is below.
2023
The SEC’s Charges Against SolarWinds and its Chief Information Security Officer Provide Important Cybersecurity Lessons for Public Companies
On October 30, 2023, the US Securities and Exchange Commission ("SEC") announced that it filed charges against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO") in connection with the SEC Division of Enforcement's ("Enforcement Division") investigation of a cyberattack.
SEC Adopts Mandatory Cybersecurity Disclosure Rules
On July 26, 2023, the Securities and Exchange Commission ("SEC"), in a 3-2 vote, adopted rules that will require public companies to make prescribed cybersecurity disclosures.
Shaping the future of digital and cybersecurity governance
In this brief three-minute video, London-based partner Lawson Caisley, Chair of White & Case's Global Cyber Risk Committee, shares his insights on governing cyber risk at the corporate level and some of the challenges of cyber risk management in the boardroom. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
Prioritizing cybersecurity at the corporate level
In this short three-minute video, Washington, DC–based partner F. Paul Pittman discusses the implications of the proposed new SEC rules on cybersecurity governance and what corporate boards can do now. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
Cybersecurity Developments and Legal Issues
The potential for cybersecurity threats and attacks looms large and the technology companies developing new products and services play a constant game of cat-and-mouse with hackers and cybercriminals for control of cyberspace. Here are six points to consider when analyzing cybersecurity risks and protections.
Directors face personal liability over cybersecurity failures
In an article for The Times, White & Case partner Lawson Caisley discusses why it could become increasingly common for UK directors to "face personal liability and regulatory censure as a result of their company suffering or mishandling a cyberbreach".
2022
Director liability for cyber breaches: transatlantic warning signs?
Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.
SEC Proposes Mandatory Cybersecurity Disclosure Rules
On March 9, 2022, the Securities and Exchange Commission ("SEC") proposed rules that would require public companies to make prescribed cybersecurity disclosures.
2021
Legal 500's In-House Lawyer Magazine Autumn - Commercial Litigation Focus (Germany)
In The Legal 500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.
AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?
In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.
Time to Revisit Risk Factors in Periodic Reports
Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.
Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation
Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.
Compensating non-material damages based on Article 82 GDPR
Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage?
Corporate Boards Must Ask Key Cybersecurity Questions
Cybersecurity has been a mainstay of quarterly board agendas for years.
2020
Cybersecurity Risk: Top 5 strategies to build resilience
The fourth webinar in our 2020 Autumn Webinar Series covered crucial steps you should be taking to protect against cybersecurity threats and what you should do when disaster strikes.
Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law
Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.
US Cybersecurity Standards to Get Tougher and More Specific
In the past few years, cybersecurity has taken on increasing importance in the eyes of lawmakers and regulators.
Data Sharing Without Borders
UK law enforcement can now obtain an order against a person in or operating in the US for the production of or access to electronic data under a new ‘landmark’ US-UK data sharing agreement.
Responding to a cyber-incident
The COVID-19 crisis has exposed many companies to more cyber threats. Tim Hickman and John Timmons discuss what businesses need to do should a major incident occur.
Trending: Legal protection for cryptoasset stakeholders
Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.
Recovering the ransom: High Court confirms Bitcoin status as property
The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.
2019
Navigating Privacy and Cyber Incident Notification and Disclosure Requirements
Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.
Proposal on the Application of the NIS Regulations post-Brexit
This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.
View all publications
Contacts
Cybersecurity Contacts
Americas
EMEA
Asia-Pacific
Mainland China
Bingna Guo
Cybersecurity Developments and Legal Issues
22 March 2023 | 9 min readFor most large companies, a frictionless flow of information and the ability to transfer customer data, employee files, financial records and other information around the world quickly and cost-effectively is a critical element in doing business. However, this can give rise to many cybersecurity risks and legal issues. The potential for cybersecurity threats and attacks looms large and the technology companies developing new products and services play a constant game of cat-and-mouse with hackers and cybercriminals for control of cyberspace. Here are six points to consider when analyzing cybersecurity risks and protections.
Developments in cybersecurity deep fake technology and behavioral biometrics
There are already multiple attack mechanisms for hackers and cybercriminals, including the use of malware, ransomware, denial of service and phishing campaigns. As technology continues to develop and improve, so too do the methods and techniques of hackers for executing cyberattacks. One area where cybercriminals are pushing hard is in the use of deep fake technology. AI and machine- learning systems offer huge technological advantages for companies, but also potential new entry points for determined cybercriminals looking to infiltrate new systems. For example, the use of biometric technology for system sign-ins has become a target for cyberattacks by hackers using deep fake technology techniques to attempt to clone and spoof voice, image and fingerprint authentications.
Companies are fighting back, by implementing multiple, password-free authentications (such as push notifications on mobile devices) and even behavioral biometrics platforms to control and limit unauthorized access to systems. Behavioral biometrics, in particular, use continuous authentication programs to analyze a user's patterns and behavior over the course of their session (i.e., not just during the log-in process) in order to detect suspicious activity that differs from their usual individual patterns. This could include mouse activity, keystroke movement, touchscreen swiping behavior and device movement.
Notwithstanding such technological developments, companies should bear two things in mind when considering their risk profile. First, the vast majority of external attacks are relatively unsophisticated and still rely on individual human fallibility, for example, an employee clicking on a malicious link in a phishing email. Second, although internal attacks (e.g., by a disgruntled employee) are far less frequent than external attacks, they also tend to be far more damaging.
Developments in the cybersecurity legal landscape
The cybersecurity legal landscape facing international companies comprises a combination of outdated, new, overlapping and country-specific laws. In light of the ever-changing cybersecurity threat landscape, and the sophistication of the tools deployed by cybercriminals, there is recognition in the major global economies of the need to strengthen and develop cybersecurity laws.
For example, the EU recently adopted the Directive (EU) 2022/2555 ("NIS 2"), which aims to uplift the overall level of cybersecurity across a wide range of organizations operating in the EU (including those in the energy, transport, water, banking, financial market infrastructures, healthcare, digital infrastructure and digital service sectors). NIS 2 introduces a range of cybersecurity-related obligations, including obligations focused on organizational governance, operational risk-management and cyber-incident reporting. Each Member State within the EU must implement laws in their own jurisdictions to give effect to NIS 2 by October 17, 2024.
Similarly, following a public consultation in early 2022, the UK Government outlined its proposal to update the UK cybersecurity legal framework. It is expected that this updated legal framework will cover a broader range of organizations, amend the approach to regulatory oversight, and broaden the scope of cyber -incidents that must be reported to regulators and affected individuals. The UK Government is also currently consulting on an update to the aging legislation that criminalizes the activities of cybercriminals.
Companies with a footprint across jurisdictions should be familiar with the cybersecurity laws applicable to their operations. In particular, companies should understand their obligations when designing cybersecurity breach response strategies and cybersecurity risk management frameworks, and the impact that country-specific laws may have on these frameworks (e.g., the legality of "ethical hacker" services), and the regulatory reporting obligations that are triggered once a cybersecurity breach has occurred.
Legal and other consequences of cybersecurity breaches
The consequences of cybersecurity breaches can be serious for the companies that suffer them, ranging from heavy fines and regulatory sanctions, government audits, lengthy regulatory investigations and even criminal liability. The business disruption and loss of data, IP and confidential information can also be extremely damaging, as well as very expensive in terms of financial losses, market position and the costs of remedial actions. Perhaps even more importantly, companies that suffer cyber security breaches find themselves open to negative media attention and the immeasurable damage of lost consumer trust and confidence.
Companies are also exposed to the threat of litigation from customers, employees and business partners, particularly where those groups allege they have suffered actual financial losses. In the US, there have been class action lawsuits brought by shareholders against companies when announced cybersecurity breaches resulted in a drop in the company's stock price, allegedly due to inadequate security measures being in place.
Obligations to disclose
Where a serious cybersecurity breach has taken place, companies need to consider their duties to the company to contain and remediate the breach and any obligations triggered under relevant laws and regulations. They also need to consider their contractual obligations and commitments. A major cybersecurity breach is likely to be an event requiring disclosure to consumers and regulators under applicable laws, to investors and major shareholders under an investment or shareholders'/stockholders' agreement, and to banks and lenders under material debt or other funding and security agreements.
Potential new investors and acquirers of companies will expect to receive details of any material cybersecurity breaches and cybersecurity risks as part of their due diligence process so they can factor the potential costs of these issues into their financial modelling and valuation, the structure of their offer and overall deal pricing. The adequacy of a company's cybersecurity policies and practices are typically caught by the representations and warranties to be given in the investment or purchase agreement and are subject to disclosure requirements. Acquirers and investors will often seek additional contractual protection through indemnities, price deductions or holdbacks for losses flowing from historical cybersecurity breaches (be it through potential regulatory fines, customer lawsuits or otherwise) and these protections can have a material impact on the deal economics. Acquirers will also need assurances of the adequacy of a company's cybersecurity program, for the purposes of their post-closing transition and integration planning, particularly where systems are to be merged or integrated, shared systems access is to be given and/or data is intended to be shared or processed.
In the case of publicly -listed companies, boards of directors and other officers will need to carefully consider whether cybersecurity risks and issues need to be disclosed to their relevant markets and/or regulators, for example, in the company's periodic public filings. In the US, both a recent court decision and SEC Guidance emphasize, the importance of updating risk factors in periodic reports to address material developments, including those relating to cybersecurity risks. In the case of serious non-compliance, the sanctions can be severe.
Personal liability for directors and officers?
While legal claims and regulatory actions are usually directed at the company suffering the cybersecurity breach, directors and officers should not be complacent to the risks of personal claims for negligence or breach of fiduciary duty. In the US, direct legal action has been taken against company directors, including by the Department of Justice and the Federal Trade Commission, in response to the management of a cybersecurity breach, reporting of that breach and alleged failures to protect the personal information of customers.
It is entirely conceivable that the UK and other European authorities will decide to follow the lead of their US counterparts and pursue directors for personal liability and regulatory censure as a result of management failings, that result in a cyberattack or (equally significantly) subsequently mishandling or failing to report a cybersecurity breach. Such an approach would not be dissimilar to the increasingly aggressive stance already being taken by authorities and regulators in several jurisdictions on ESG-related issues.
Notably, the NIS 2 directive recently introduced in the EU requires that the laws implemented in each EU Member State mandate management bodies of relevant organizations to review cybersecurity risk-management measures that are being implemented to comply with NIS 2, and oversee the implementation of these measures. Crucially, management bodies can be held liable for failures with respect to the implementation of cybersecurity risk-management measures.
Mitigating cybersecurity risk
There is much that companies can do to mitigate cybersecurity risks and help to protect the position of their directors and officers at the same time. UK regulators have long made it clear that cybersecurity is a board level issue that requires serious and meaningful senior engagement. On a commercial level, clear cybersecurity expert advice and professional products and services are needed to ensure that appropriate and reasonable cybersecurity measures are in place, that software and systems are kept fully up-to-date and are audited, robust, fit-for-purpose, that access to them is properly controlled, endpoints are protected and data is adequately backed-up.
From a legal perspective, companies should have policies and recognized standards in place on, among other things, incident response, data security and data retention, together with robust training programs and employee monitoring. Best practice for remote employee authentication and authorization should also be followed to restrict unwarranted access to the business' software, files and intranet (which may involve engaging third- party authentication services). This should be combined with appropriate governance structures and processes. Contracts with employees, suppliers and third parties need to include appropriate provisions on matters such as security standards, data access, governance and control and liability. Suitable cybersecurity insurance should be carefully considered, with sufficient coverage for incident response and remediation, breach notification, business-level disruption and losses and associated legal issues such as regulatory fines and additional advisory costs. Any exclusions to the insurance policy need to be carefully checked.
In the modern environment, having both robust cybersecurity measures in place and a plan to deal with cybersecurity breaches when they arise, are essential for all companies. Those companies and boards that choose to ignore this do so at their own peril.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities. This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice. © 2023 White & Case LLP
