Cybersecurity: Legal implications and risk management
What's inside
In an increasingly interconnected world, cyber risk is firmly at the top of the boardroom agenda, and having an effective data breach response programme is no longer optional.
Cybersecurity crisis management
The internet knows no borders, neither do we. Our global team of cybersecurity response experts work across borders, combining data protection, privacy, regulatory, white collar and litigation expertise in order to deliver seamless crisis management and legal advice, whenever and wherever needed.
The digitalization and free flow of information has transformed global business. However, with increased opportunities have come new and increased risks, together with complex legislative regimes that can vary significantly by jurisdiction, and are constantly evolving. Even the most conscientious company can become the victim of a cybersecurity incident, such as the stealing of client or company information, or a ransomware attack. We work with a wide range of multinational companies to manage their cybersecurity risks, developing rapid response plans, providing time-critical crisis management advice, and working with clients to manage any resulting legal issues that may arise.
Key issues
Why?
Reputation
Fines
Breach of contract
M&A due diligence
Insurance
Proprietary information
Litigation
Criminal offences
Negligence
Be prepared
Risk Assessment
Key Information
Assets
Key Systems
Threat Analysis
Security Measures
Toolkit
Scripts
Internal and
External
Communications
Employee contacts
Response Plan
Live Training
Business Continuity Plan
Key considerations
Customer/individual rights
Requests for data
Data Protection Authority Complaints
Group litigation orders
Resolution mechanisms
B2B relationships
Contractual obligations
Contractual liability
Tort
Reputationmanagement
Media strategy
Customer interaction
Employee engagement
Commercial
Proprietary
Information/Trade Secrets
System Disruption
Regulatory issues
Data Protection Authority
Financial Regulators
Market authorities
Other regulators
Privacy & data protection
Jurisdictions involved
Reporting obligations
individuals
authorities
Evidence
Law Enforcement Involvement
Legal Privilege
Preservation of Evidence
Response
Crisis Team
Legal (internal and external)
IT/IT Forensics
PR
Regulatory
DPO
Executive committee
HR
Vendor manager
Key Actions
Work with forensic investigators to:
Identify and contain breach
Gather/preserve evidence
Maximise legal privilege coverage
Contact crisis team
Bring in external partners
Identify key risks and priorities based on nature of breach
Assess notification requirements
Communications
Regulatory notifications
Articles
2024
NYDFS Releases Artificial Intelligence Cybersecurity Guidance For Covered Entities
On October 16, 2024, the New York State Department of Financial Services (the "DFS"), under its Cybersecurity Regulation—23 NYCRR Part 500—issued a memorandum providing guidance on the risks posed by artificial intelligence ("Guidance Memo").
SEC Will Prioritize AI, Cybersecurity, and Crypto in its 2025 Examination Priorities
On October 21, 2024, the US Securities and Exchange Commission ("SEC") Division of Examinations ("Examination Division") announced its 2025 Examination Priorities ("Report").Investment advisers and broker-dealers should ensure that policies, procedures and surveillance efforts related to these priorities address concerns outlined in the Report.
SEC Enforcement Heats up on Key Public Company Topics: Cyber Disclosure, Director Independence and Regulation FD
The U.S. Securities and Exchange Commission's ("SEC") Division of Enforcement has recently brought a spate of enforcement actions relating to key topics for public companies. These include enforcement actions related to cybersecurity incident disclosure, director independence and Regulation Fair Disclosure ("Reg FD") violations, which are described below, and actions based on Section 13 and 16 beneficial ownership filings, as discussed in our prior alert.
Judge Rejects SEC’s Aggressive Approach to Cybersecurity Enforcement
On July 18, 2024, a New York federal judge dismissed most of the US Securities and Exchange Commission's ("SEC") claims against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO"), Timothy G. Brown, in connection with the Company's cybersecurity practice.
SEC’s Corp Fin Director Issues Statement on Cybersecurity Incident Disclosures
On May 21, 2024, the SEC's Director of the Division of Corporation Finance issued a statement on cybersecurity incident disclosures in light of the SEC's new cybersecurity disclosure rules. Our summary of this statement and key take-aways from White & Case's survey of cybersecurity disclosures is below.
The SEC’s Charges Against SolarWinds and its Chief Information Security Officer Provide Important Cybersecurity Lessons for Public Companies
On October 30, 2023, the US Securities and Exchange Commission ("SEC") announced that it filed charges against SolarWinds Corp. ("SolarWinds" or the "Company") and its Chief Information Security Officer ("CISO") in connection with the SEC Division of Enforcement's ("Enforcement Division") investigation of a cyberattack.
On July 26, 2023, the Securities and Exchange Commission ("SEC"), in a 3-2 vote, adopted rules that will require public companies to make prescribed cybersecurity disclosures.
Shaping the future of digital and cybersecurity governance
In this brief three-minute video, London-based partner Lawson Caisley, Chair of White & Case's Global Cyber Risk Committee, shares his insights on governing cyber risk at the corporate level and some of the challenges of cyber risk management in the boardroom. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
In this short three-minute video, Washington, DC–based partner F. Paul Pittman discusses the implications of the proposed new SEC rules on cybersecurity governance and what corporate boards can do now. Filmed at the Digital Directors Network (DDN) Domino 2023 conference on digital and cybersecurity governance.
The potential for cybersecurity threats and attacks looms large and the technology companies developing new products and services play a constant game of cat-and-mouse with hackers and cybercriminals for control of cyberspace. Here are six points to consider when analyzing cybersecurity risks and protections.
Directors face personal liability over cybersecurity failures
In an article for The Times, White & Case partner Lawson Caisley discusses why it could become increasingly common for UK directors to "face personal liability and regulatory censure as a result of their company suffering or mishandling a cyberbreach".
Director liability for cyber breaches: transatlantic warning signs?
Two legal cases in the US in the past month suggest that regulators and prosecutors are becoming more determined to take personal action against directors and senior executives who fail to deal adequately with cyber security breaches.
On March 9, 2022, the Securities and Exchange Commission ("SEC") proposed rules that would require public companies to make prescribed cybersecurity disclosures.
In The Legal 500's newly released In-House Lawyer Magazine a group of White & Case lawyers has contributed a legal briefing on trends in German commercial litigation.
AAA plc & ors v Persons Unknown: Cyber Activism or Blackmail?
In recent years, demands for payments in cryptocurrencies have become the ransom of choice for cyber extortionists and other online frauds. As a result, the English Court's powers are increasingly being called upon.
Ninth Circuit Decision Highlights Importance of Updating Risk Factors to Address Material Developments, including those relating to Cybersecurity Risks.
Cybersecurity Enforcement: New York Department of Financial Services issues first penalty under Cybersecurity Regulation
Consistent with its increasing activity in the cybersecurity enforcement space, in March 2021, the NYDFS issued its first penalty under the Cybersecurity Regulation. This client alert explores the settlement and offers takeaways on the areas of focus by the NYDFS in enforcement actions under the Cybersecurity Regulation.
Compensating non-material damages based on Article 82 GDPR
Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage?
Cybersecurity Risk: Top 5 strategies to build resilience
The fourth webinar in our 2020 Autumn Webinar Series covered crucial steps you should be taking to protect against cybersecurity threats and what you should do when disaster strikes.
Before the Dust Settles: The California Privacy Rights Act Ballot Initiative Modifies and Expands California Privacy Law
Hot on the heels of the California Attorney General's rulemaking process for the California Consumer Privacy Act ("CCPA"), California voters have passed a ballot initiative to expand and create new privacy rights for consumers.
UK law enforcement can now obtain an order against a person in or operating in the US for the production of or access to electronic data under a new ‘landmark’ US-UK data sharing agreement.
The COVID-19 crisis has exposed many companies to more cyber threats. Tim Hickman and John Timmons discuss what businesses need to do should a major incident occur.
Trending: Legal protection for cryptoasset stakeholders
Recent decisions in Singapore and New Zealand confirm that the courts are prepared to act to provide greater certainty and support to stakeholders in cryptoassets.
Recovering the ransom: High Court confirms Bitcoin status as property
The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.
Navigating Privacy and Cyber Incident Notification and Disclosure Requirements
Organisations are facing increasing uncertainty in assessing global notification and disclosure obligations and making a determination of whether to notify or disclose a privacy violation or security incident in today's complex regulatory environment. This article offers six steps companies should consider when navigating this complex process.
Proposal on the Application of the NIS Regulations post-Brexit
This article examines the impact of the UK Network and Information Systems Regulations 2018 (SI 2018/506) (NIS Regulations) on organisations post Brexit and their obligations under applicable cybersecurity law.
The High Court has determined that Bitcoin (and other similar cryptocurrencies) can be considered property under English law, and could be the subject of a proprietary injunction. The Court granted the injunction to assist an insurance company to recover Bitcoin that it had transferred in order to satisfy a malware ransom demand.
Background
In AA v Persons Unknown,1 the High Court has considered whether Bitcoin could be considered as property for the purposes of granting a proprietary injunction over Bitcoin. The Bitcoin in question was paid as part of a ransom following a cyberattack on a Canadian insurance company (the "Company"). The attack prevented the Company from accessing its IT systems that had been encrypted with malware. In order to regain access to the company's IT systems, the hacker(s) demanded that the Company transfer 109.25 Bitcoins (equivalent to USD 950,000) to a specified account in exchange for the decryption software.
The Company was insured against certain cyber-related incidents by an English insurance company (the "Insurer"). After the ransom had been paid, the Insurer hired consultants who tracked the Bitcoin payments to a specific address linked to the cryptoasset exchange Bitfinex. While some had been dissipated, 96 Bitcoins remained in the account. The Insurer therefore sought a proprietary injunction to recover the Bitcoins.
The decision is significant not only for its conclusion that Bitcoin could be considered property under English law, but also due to the fact that in reaching its conclusion, the Court gave considerable weight to the recent UK Jurisdictional Task Force ("UKJT") Legal Statement on Cryptoassets and Smart Contracts, published in November 2019 (see update here).
Decision
In order to grant the proprietary injunction, the fundamental question for the Court to consider was whether cryptoassets constituted a form of property capable of being the subject of such an injunction. While this issue has already been considered in two recent cases (with the Court treating cryptocurrencies as property in granting a worldwide freezing order2 and an asset preservation order3), the Court had not previously considered the issue in depth.
As a starting point, Bryan J noted that, "prima facie there is a difficulty in treating Bitcoin and other cryptocurrencies as a form of property" as English case law traditionally identifies property in two distinct categories. These include:
a 'thing in possession' (i.e. capable of being possessed in a tangible sense); or
a 'thing in action' (i.e. a right capable of being enforced by an action).
Bryan J determined that cryptocurrencies cannot be 'things in possession' as due to their virtual nature, they are intangible and cannot be possessed, nor can they be defined as 'things in action' as they do not embody any right capable of being enforced by action.4 In seeking to resolve this difficulty, Bryan J referred to the UKJT’s detailed analysis of the Court’s treatment of novel kinds of intangible assets (including patents and EU carbon emissions allowance) and concluded that while a cryptoasset might not be a ‘thing in action’ on a narrow definition, that did not mean it could not be treated as property.
Bryan J concluded that the UKJT's analysis was "compelling" and should be adopted by the Court.5 Further, as the Bitcoin met the four criteria set out in National Provincial Bank v Ainsworth6 (being definable, identifiable by third parties, capable in its nature of assumption by third parties, and having some degree of permanence), it was capable of being considered property. Bryan J therefore also applied the same reasoning as the landmark ruling in B2C2 v Quoine by the Singapore International Commercial Court (see update here), which was one of the first decisions to apply contractual principles and trust law to a cryptocurrency trading case.
Accordingly, as the Court considered that all other requirements for a proprietary injunction were met (i.e. serious issue to be tried, balance of convenience in favour of granting relief, and damages not being an adequate remedy), Bryan J granted the injunction sought. The Court also ordered the controllers of the Bitfinex exchange to provide information regarding the identity and addresses of the hackers to ensure that the proprietary injunction could be properly policed. The Court further recognised the difficulties inherent in seeking to recover Bitcoin given its ease of transfer and, accordingly, the urgency of the application. It therefore authorised alternative service, including by email.
Comment
This decision is significant as it provides detailed judicial reasoning for defining cryptoassets as property in a developing area of law. While the characteristics of cryptoassets can vary, this decision indicates that the English Courts are likely to find that established, tradeable cryptocurrencies can be treated as property. The decision therefore provides greater certainty to stakeholders in cryptoassets.
This judgment is also noteworthy for the Court's decision to allow the case to be heard in private. In reaching this decision, the Court noted the importance of the principle of open justice as stated in Cape Intermediate Holdings Ltd v Dring [2019] UKSC 38 (see update here), but held that "publicity would defeat the object of the hearing", as it would "potentially tip off the persons unknown to enable them to dissipate the Bitcoins".7 Bryan J also determined that the Company's and the Insurer's identity could be anonymised to prevent the possibilities of copycat cyberattacks.
1 AA v Persons Unknown who demanded Bitcoin on 10th and 11th October 2019 and others [2019] EWHC 3556 (Comm)
2 Vorotyntseva v Money-4 Limited [2018] EWHC 2596 (CH)
3 Robertson v Persons Unknown (unreported)
4 [2019] EWHC 3556, para 55
5 [2019] EWHC 3556, paras. 57 and 59
6 [1965] 1 AC 1175
7 [2019] EWHC 3556, para 30