Most companies have no strategic plan in place to deal with attacks, insider threats, or data privacy breaches, including law firms. Companies must have a framework for protection that goes beyond mere technological filters. Lawyers now have an additional duty technologically to protect against such attacks and breaches internally, and to also advise clients on strategic plans and compliance that effectively address cyber attacks and data protection in effort to mitigate potential liability and damage stemming from such attacks. Law firms have to be as well-informed as any other organization and must have a model in place to address attacks. Law firms are persistently targeted by insidious hackers. Financial institutions are now auditing law firms to see if they have such protections in place to secure their clients’ data.
Passwords and Supervisory Control and Data Acquisition (“SCADA”, used to collect real time data) systems with default passwords are easily available through forums such as Russian hacker chatter. Yet the most commonly used employee password remains “password.” Mobile devices remain big targets, and many employees charge these devices at work thereby opening the door to another avenue of attack. Many computer networks are easily defeated by malware. Malware is available for sale on the internet and is easily available for purchase to carry out cyber attacks. Firewalls and similar technological protection software are too often easy to hack, and therefore due diligence requires companies to go beyond technological protections. Many companies who have experienced attacks or have had data breaches remain completely unaware and unprepared. In fact, it is more probable that the only reason a company may not have yet been attacked would be a lack of intent or interest by hackers or insiders with access, and would not be because the data is not available or the networks are not accessible.
Unpatched programs pose a serious, major threat, but this is not merely a technical issue as it is really a business risk issue. Companies need to ask where their critical information is located. Most company Information Technology personnel and service companies cannot respond to this question easily. A company’s critical information is usually scattered across the company, and identifying and finding the location of that information is an ongoing process requiring continuous high-level conversations.
Data retention is a key issue for corporations. The usual cost to remediate a data breach is roughly $200 per file. Customer lists containing 10,000 or more persons can therefore be very expensive. Adherence to data retention policies by destruction of information and records when this information is no longer needed is good policy. Regular risk assessments in different business lines is also good policy given that business lines have different types of valuable data and therefore have different targets; different targets equates to different methods of targeting by internal and external threats. Good data hygiene requires that data security policies and procedures are up to date and regularly checked by a third party. This should be an ongoing process. All corporate stakeholders must be involved to have a full business view of the risks, as opposed to merely a technical view of the risks. Effective data security and compliance therefore mandates that corporations work across business lines and together with high-level management and the C-suite, and finance, legal, and IT departments. It is also prudent for corporations to involve the Board, set up a high-level Risk Committee, and develop an external audit system with major assessments to identify threats and the most valuable corporate information. Corporations need more than just one or two solutions, but require a series of interventions at every possible level to effectuate due diligence and compliance.
Soon due diligence will not be optional, but in the foreseeable future will involve liability for attacks and tighter regulation beyond mere voluntary frameworks. Privacy laws are complex and directly related to cyber security. Protection of PII, such as credit card information, health care information, and corporate secrets are at risk by phishing emails. Insidious tweets or false social media postings can cause immediate harm to a corporation’s bottom line and net worth. A filibuster of cyber legislation does not mean that corporations can ignore and escape due diligence responsibility or liability concerning data protection. Data protection concerns public safety on every level and the complexity of legal issues are only mounting.
More legislation and regulations are surely looming in the near future. Potential initial investigative steps following a data breach can be difficult and daunting tasks for a corporation, such as responding to a Foreign Intelligence Surveillance Act (“FISA”) subpoena, determining whether any protected personal and private information has in fact been shared, and determining whether a corporation has therefore triggered mandated notification requirements. Over time litigation will end up shaping corporate guidance governing data breaches beyond the current voluntary suggestions. It is therefore imperative that corporations begin now to learn how to monetize various potential data breaches of differing information and how to conclude what constitutes a material breach requiring notification. Corporations often have no way of predicting how or when information might be exploited following a breach. These exercises are vital for corporations doing international business, particularly in Europe given the European Union’s intent to tighten requirements governing data protection within two years and that will affect aid.
Data protection is a never-ending process. Corporations can no longer be static or concerned solely with defense should a breach occur; corporations must be proactive. Hackers have been successfully hacking for many years. Corporations who are unaware of who is operating the network place their money at risk and stand to lose huge amounts of money daily should a breach happen. All corporations and states in the United States have theft of data despite data privacy laws. How corporations share data about these breaches, and how they overcome information sharing hurdles, such as how to address breaches involving national security and secret information that cannot be conveyed to other members of board or company, is imperative to mitigation. Cyber space is now a global network that has become a global problem. No country or corporation, no matter how big or small, is exempt from these risks, the loss of data, or the resulting damage.
Data Privacy, Cyber Security, and GCC Countries
President Obama’s recent Executive Order No. 13636, issued February 12, 2013, places data privacy and cyber security as lead initiatives for critical infrastructure sectors, such as financial services, health services, and energy. Data privacy and cyber security are hot topics globally. In the U.S., data privacy and cyber security regulations are challenging and vast. The EU has stringent privacy laws as well. Today, nearly every industry sector is touched by data privacy regulations, threats, and demands, and is therefore also liable for breaches or other non-compliance when things go awry.
Many companies fail to routinely audit their compliance situation or Information Technology operations. Many do not have a breach or notification plan in place. Further, high-level executives and boards often fail to review cyber security, privacy, and risk management as part of corporate good governance operations or policies. Because financial services and energy are two prime critical infrastructure sectors that attackers target, Gulf Cooperation Council (GCC) countries and those companies operating in the region are particularly vulnerable. A Gulf Business Machine (GBM) survey of regional IT professionals revealed that 35 percent of all cyber crime and breaches were from the result of an organization’s own internal employees. Social media was noted as a primary source for attack. Other attacks come from external hackers. In 2012, hackers linked to the government of Iran attacked data and disabled 30,000 computers, thereby causing millions in damages at Aramco
In the U.S., civil and criminal liability is on the rise as class actions have mounted for breaches involving Personally Identifiable Information (PII). State and federal investigations and prosecutions are on the rise for noncompliance in nearly every industry, including financial services, health services, manufacturing, and energy. Energy companies and financial institutions are particularly vulnerable for cyber attacks, and the targets may vary from customer information to company secrets. Energy companies are routinely targeted by insiders, foreign governments, organized crime, or competitors seeking corporate secrets and intelligence, control over critical industrial control systems, or other data or intellectual property. The most widely known attack against U.S. oil and gas companies was by China through use of its Night Dragon. Night Dragon was launched to steal confidential information from major U.S. energy companies, of whom at least one company said it was not aware of any successful attacks.
Because the energy and financial sectors are prime targets for data and cyber attacks, a strong compliance program and breach plan is crucial to prevention, mitigation of losses, and protection of a company’s reputation. Billions of dollar a year are routinely lost by companies simply in stolen intellectual property. Mitigating exposure to liability as a result of data security breaches can save millions per year in lost assets or reputation, intellectual property, customer information, fines, or other damages. The risks are even direr for energy companies where an attack could result in an oil spill or other environmental damage, prolonged power outages, and loss of life.
Threats and attacks from outside hackers are usually what comes to mind when one thinks of data and cyber protection, however, what most are not aware of is that the bulk of threats actually come from inside a company by either disgruntled employees, poorly trained employees, poor compliance controls, poor oversight of employees with access to sensitive information, and employees who are interested in selling competitive corporate intelligence for whatever reason. The actual amount of breaches and other cyber crime by insiders is actually much higher than the GBM survey, and most incidents are unreported, confidential, or undiscovered.
Information technology personnel cannot front the risks alone and are not equipped to conduct assessments and analysis as are regulatory attorneys. Even the best IT personnel and management need legal guidance and assistance with investigating breaches and attacks. Legal representation at every level of compliance activities and investigation is the best insurance to successful mitigation and management of risks. It is imperative that outside counsel be involved in routine audits and assessments of compliance review and development, training, and in development of a solid breach plan. Cyber and privacy insurance rarely covers liability or damages for breaches in all scenarios. Compliance will always remain cheaper than the losses a company may suffer in stolen property or loss of reputation.
Teresa N. Taylor is Of Counsel at Akrivis Law Group, PLLC in Washington and is an Adjunct Faculty member at Georgetown University Law Center. Her professional biography is available here.
Middle East and North Africa Legal Review 