Cybersecurity

This website uses cookies. For more information please contact us or consult our privacy policy.

Your binder contains too many pages, the maximum is 40.

We are unable to add this page to your binder, please try again later.

This page has been added to your binder.

PDF Binder
- Create PDF
- Add to Binder
Word Document Binder

Our Cybersecurity practice has unsurpassed experience addressing the most significant cybersecurity matters confronted by commercial enterprises. We have assisted clients in responding to scores of cybersecurity incidents, ranging from security breaches perpetrated by inside actors, to sophisticated external attacks involving millions of customer and employee records, to several of the largest cyber-related financial crimes on record. These incidents have spanned a broad range of industries, including financial services, pharmaceuticals, media and Internet content companies, retail, technology, communications, defense, energy, software, travel-related services, and data-based services companies. Many of these incidents have been global in nature.

Our cybersecurity lawyers and advisors are based on both coasts of the United States, and in Europe and Asia. We regularly work with multinational companies on the full lifecycle of cybersecurity events, including development of internal compliance policies and incident response planning; incident response, investigation, and remediation; and defense of claims and pursuit of recoveries. We have unparalleled depth across a range of practice areas that intersect with cyber-related risks, including insurance, litigation, corporate governance, and regulatory compliance, to name a few.

Enterprises face threats from multiple vectors, including, among others, state-sponsored actors, criminal organizations, hactivists, competitors, and insiders—with potential for incidents that may include denial-of-service attacks, theft of funds or IP, breaches of payment card data and other sensitive customer information, and other significant compromises. Unlike many other firms, Covington does not approach cybersecurity as simply a subset of our broader privacy practice. Rather, we take a truly multi-dimensional, cross-disciplinary approach, taking into account not only privacy law, but also the potential impact of any particular threat vector on U.S. national security and the integrity of critical enterprises internationally.

Our team includes former senior officials from the Department of Homeland Security and Department of Justice, and we regularly engage with those agencies, as well as the Federal Trade Commission, Federal Bureau of Investigation, Department of Defense, and other federal and international agencies as well as State Attorneys General and EU, Asian, and Latin American data protection authorities, on defending against and responding to cyber threats.

Our areas of focus include:

Preparedness and counseling
Incident response and investigations
Regulatory advice and compliance
Risk management and insurance coverage
Litigation—class action defense
European and international data protection

View More View Less

Responding to Sophisticated Advanced Persistent Theat ("APT") Attacks

We have directed the investigations and response into APT attacks from state-sponsored actors and sophisticated criminal groups targeting intellectual property and other proprietary information. These attacks, and the responses, have spanned multiple industries and global companies, with investigations covering four continents.

Addressing Regulatory Enforcement Actions

We have addressed regulatory investigations and enforcement actions from regulators in the United States, Europe, and Asia following data breaches. These have included investigations or formal enforcement proceedings brought by the Federal Trade Commission, State Attorneys General, and the Securities and Exchange Commission in the United States, and by data protection authorities and sector-specific regulators across Europe and Asia.

Pre-Incident Advice and Assessments

We regularly advise clients on compliance with information security requirements and best practices, including, among others, governance best practices, vendor contract terms and due diligence, the implementation of information security controls to satisfy regulatory requirements, and the conduct of vulnerability assessments.

View More View Less

EU Announces Major New Cybersecurity Plans

Last week, in his annual State of the European Union Address, the President of the European Commission Jean-Claude Juncker called out cybersecurity as a key priority for the European Union in the year ahead. In terms of ranking priorities, President Juncker placed tackling cyber threats just one place below the EU leading the fight against...… Continue Reading

The EU Gets Serious About Cyber: The EU Cybersecurity Act and Other Elements of the "Cyber Package"

Last week, in his annual State of the European Union Address, the President of the European Commission Jean-Claude Juncker called out cybersecurity as a key priority for the European Union in the year ahead. In terms of ranking those priorities, President Juncker placed tackling cyber threats just one place below the EU leading the fight against climate change, ...

China Seeks Comments on Updated Draft of Cross-Border Data Transfer Security Assessment Standard

On August 31, 2017, China’s National Information Security Standardization Technical Committee (“NISSTC”), a standard-setting committee jointly supervised by the Standardization Administration of China (“SAC”) and the Cyberspace Administration of China (“CAC”), released an updated draft of the Information Security Technology - Guidelines for Data Cross-Border ...

Central Bank of Kenya Issues Guidance Note on Cybersecurity

On August 18, 2017, the Central Bank of Kenya (“CBK”) used its authority under Section 33(4) of the Banking Act to publish a Guidance Note on identifying and mitigating cyber risk. The Guidance Note directs institutions licensed under the Banking Act (Cap. 488) (“Institutions”) to develop and implement a comprehensive set of program requirements to...… Continue ...

NIST Releases Fifth Revision of Special Publication 800-53

By Susan Cassidy, Jenny Martin, and Catlin Meade The National Institute of Standards and Technology (“NIST”) released on August 15, 2017 its proposed update to Special Publication (“SP”) 800-53. NIST SP 800-53, which was last revised in 2014, provides information security standards and guidelines, including baseline control requirements, for implementation on ...

A Summary of the Recently Introduced “Internet of Things (IoT) Cybersecurity Improvement Act of 2017”

On August 1, 2017, a bipartisan group of Senators introduced legislation (fact sheet) that would establish minimum cybersecurity standards for Internet of Things (“IoT”) devices sold to the U.S. Government. As Internet-connected devices become increasingly ubiquitous and susceptible to evolving and complex cyber threats, the proposed bill attempts to safeguard ...

Department of Justice Releases Guidance for Vulnerability Disclosure Programs

Last week, the U.S. Department of Justice (“DOJ”) released a voluntary framework for organizations to use in the development of a formal program to receive reports of network, software, and system vulnerabilities, and to disclose vulnerabilities identified in other organizations’ environments. This framework provides private entities a series of steps to ...

Rising Star: Covington & Burling's Elizabeth Canter

Libbie Canter was named a "Rising Star" by Law360, recognizing her as a top lawyer under 40 in Privacy & Cybersecurity law. In its profile of Canter, Law360 highlights her advisory role on significant transactions, including Microsoft’s $8.5 billion acquisition of video call service Skype.

Cyber Insurance Offerings Growing In Response To New Threats

Marialuisa Gallozzi, John Buchanan, and Jeff Kiburtz are quoted in a Medtech Insight article regarding the growing interest in the healthcare sector in buying cyber insurance. According to Gallozzi, "We are in the midst of an evolution of the insurance market right now in this area." She says cyber insurance policies have been a growing trend but unlike other ...

New York DFS Publishes FAQs on New Cybersecurity Regulations

As our readers know, New York’s Department of Financial Services (“NY DFS”) released a draft of its new Cybersecurity Regulations on September 13, 2016, and the final version of the regulations went into effect on March 1, 2017 (23 NYCRR 500). Among other things, the regulations require regulated entities to conduct cyber risk assessments and...… Continue ...

Pentagon demands contractors up cybersecurity

Susan Cassidy is quoted in a San Antonio Express-News article regarding new cybersecurity requirements for contractors. According to Cassidy, "Essentially, the DOD wants its contractors to protect its information, because the DOD is a huge target, and its contractors are also a target." Commenting on the fact that over the years, contractors have been working ...

SEC steps up enforcement against escalating cybercrime

Jennifer Martin is quoted in a Global Investigations Review article discussing the SEC's response to the rising rates of cybercrime. “The cyber criminals go where the money is,” says Martin. “They’re constantly figuring out new ways to monetize information.” She adds that whether it’s extorting hospitals through ransomware or going after valuable healthcare ...

Cloud Security Alliance Releases Guidance for Securing Connected Vehicles

The increasing connectivity of vehicles has raised questions about how to maintain the security of connected vehicles. In response, the Cloud Security Alliance released on May 25, 2017 a 35-page research and guidance report on Observations and Recommendations on Connected Vehicle Security. The Cloud Security Alliance is a not-for-profit organization dedicated ...

Senators push for enhanced powers to battle botnets

Jennifer Martin is quoted by The Hill in an article regarding the increased focus by law enforcement on botnets and the threats they pose to national security. "One of the reasons botnets are growing in prevalence is the growth of the Internet of Things,” says Martin. “As more and more things are connected, you can expect more and more things to be compromised ...

White House Issues New Cybersecurity EO

On May 11, 2017, President Trump signed an Executive Order titled “Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure” (the “Order”). The long-anticipated directive was issued months after the White House originally planned to release a cybersecurity order in February. Since then, revised drafts of the order were circulated, ...

Working Effectively with Forensic Firms

Among the many issues that can give rise to the initial uncertainty of responding to a significant cybersecurity incident is a failure by incident response team members to understand the perspectives and priorities of other stakeholders. But this complicating factor can readily be mitigated through cross-functional education and relationship building before an ...

China Releases Final Regulation on Cybersecurity Review of Network Products and Services

On May 2, 2017, the Cyberspace Administration of China (“CAC”) released the final version of the Measures on the Security Review of Network Products and Services (Trial) (“the Measures”), with an effective date of June 1, 2017 (official Chinese version available here). The issuance of the Measures marks a critical first step toward implementing China’s Cybersecurity Law (“the Law”), which was promulgated on November 7, 2016 and will take effect on June 1, 2017 (the same date as the Measures).

China Releases Final Regulation on Cybersecurity Review of Network Products and Services

Today, the Cyberspace Administration of China (“CAC”) released the final version of the Measures on the Security Review of Network Products and Services (Trial) (“the Measures”), with an effective date of June 1, 2017 (official Chinese version available here). The issuance of the Measures marks a critical first step toward implementing China’s Cybersecurity Law ...

China Seeks Public Comments on Draft Regulation of Cross-Border Data Transfer

On April 11, 2017, the Cyberspace Administration of China (“CAC”) released a draft of the Measures on Security Assessment of Cross-border Data Transfer of Personal Information and Important Data (“the Draft Measures”) for public comment (official Chinese version available here; Covington’s translation of the Draft Measures is appended at the end of this alert).

Forensic Firms: Understanding and Leveraging Their Expertise From the Start (Part One of Three)

Steve Surdu was interviewed by The Cybersecurity Law Report for a three-part series on the role of forensic firms during a cyber breach. Part one discusses how to understand and leverage the expertise of forensic firms from the start. According to Surdu, forensic consultants have specialized skills and knowledge “that are very difficult for most organizations to ...

China Seeks Public Comments on Draft Regulation on Cybersecurity Review of Network Products and Services

On February 4, 2017, the Cyberspace Administration of China (“CAC”) released the draft Measures on the Security Review of Network Products and Services (“the draft Measures”) for public comment (official Chinese version available here; Covington’s translation of the draft Measures is here). The comment period ends on March 4, 2017.

Banks Face Cybercrime Wave As Tougher Regulations Loom

Mark Young, Jennifer Martin, and Ian Hargreaves are quoted in a Law360 article regarding the high level of cyberattacks on the financial services industry and the resulting regulatory pressures. According to Young, “The GDPR [General Data Protection Regulation] is a massive text with groundbreaking change in the data privacy area, in terms of compliance ...

Fate of DOD Cybersecurity Improvements Unclear, Lawyers Say

Susan Cassidy is quoted in a Federal Contracts Report article regarding the fate of cybersecurity improvements made by the DoD under President Trump. According to Cassidy, “I would expect those to continue forward because I don't see a political will to say, ‘No you shouldn't protect this.’” The nomination of former Sen. Dan Coats (R-Ind.) to serve as director ...

New York Overhauls Cybersecurity Proposals After Backlash

Jennifer Martin is quoted in a PaymentsCompliance article regarding revisions to “first-in-nation” cybersecurity rules made by New York financial regulators following industry backlash. According to Martin, third-party service due diligence requirements had been clarified to “narrow and more clearly describe the regulation’s applicability to vendors.”

U.S. Expands Sanctions, Takes Other Steps in Response to Russia’s Election-Related Cyber Operations

President Obama announced several actions on December 29 to respond to Russian cyber operations that the U.S. intelligence community previously had concluded were intended to influence the U.S. presidential election. Specifically, the President revised and expanded an earlier executive order that blocks the property and interests in property of persons that engage in significant malicious cyber-enabled activities, and designated 5 Russian entities and 6 Russian individuals for sanctions pursuant to the revised and expanded order. The President also released a report by the U.S. Department of Homeland Security (“DHS”) and Federal Bureau of Investigation (“FBI”) containing declassified information attributing cyber attacks to Russia, expelled 35 Russian diplomats, and barred Russian access to two compounds in the United States. Additionally, today, the U.S. Commerce Department added the five designated Russian entities involved in Russia’s election-related cyber operations to the Entity List, which prohibits the export, reexport, or transfer of any item subject to the U.S. Export Administration Regulations (“EAR”) to the listed entities, absent Commerce Department licensing. Although these actions are politically significant, they do not expand the U.S. sectoral sanctions against Russia and should have a limited near-term economic effect.

Jennifer Martin Named a "Cybersecurity & Data Privacy Trailblazer"

NEW YORK—The National Law Journal has named Covington’s Jennifer Martin as one of its “Cybersecurity & Data Privacy Trailblazers.” The list profiles 50 lawyers “who have helped make a difference in the fight against criminal cyberactivity and towards adding much needed layers of data security in an increasingly digital world of commerce.” Ms. Martin has worked ...

Federal Banking Agencies Request Comment on Enhanced Cybersecurity Standards

On October 19, 2016, the Board of Governors of the Federal Reserve System (Federal Reserve), Office of the Comptroller of the Currency (OCC), and Federal Deposit Insurance Corporation (FDIC) (collectively the “Agencies”) released a joint Advance Notice of Proposed Rulemaking (ANPR) requesting public comment on enhanced cybersecurity standards that would apply to certain large, interconnected financial entities (“covered entities”) as well as the third parties that provide services (“covered services”) to such entities.

21st Century Cybersecurity: People are the first step

Jennifer Martin participated in the American Bar Association’s Annual Meeting and is quoted in an ABA Journal article regarding effective cybersecurity in today’s current threat environment. Martin discussed the importance of concentrating on developing an incident response program. “More and more companies have plans, but the devil is really in the details. She ...

Covington hires cyber expert

Stephen Surdu and James Garland are quoted in a GIR article regarding Surdu’s arrival to Covington as a Senior Cybersecurity Advisor. “In the fog of war, companies do not think clearly,” Surdu says. “They want to do the right thing, but they do not quite know what that is. As someone who has handled many cybersecurity investigations, I can help calm the ship.” ...

Second Circuit Limits Use of U.S. Warrants Seeking Data Stored Overseas

Search warrants served on U.S. Internet companies and cloud service providers cannot obtain customer data stored overseas, the U.S. Court of Appeals for the Second Circuit ruled on July 14. The federal appellate decision focuses on warrants issued under the federal Electronic Communications Privacy Act (“ECPA”) and formally applies only in the Second Circuit, but will be important precedent nationwide as courts, law enforcement, and industry grapple with the extraterritorial reach of U.S. legal process. The decision affects not only providers of cloud-based services that are subject to compulsory process under ECPA, but also individuals and companies that store data with U.S. technology companies. The decision, which the government may seek to appeal, could also spur congressional action addressing the extraterritorial reach of U.S. legal process and law enforcement’s access to data in cross-border investigations.

Covington Launches Cyber Response Team With Mandiant Pro

David Fagan and Stephen Surdu are quoted in a Law360 article regarding the launch of Covington’s new Cybersecurity Incident Response Team in conjunction with the arrival of Surdu and Jenny Martin. According to Fagan, “We’re a big firm with clients that span the globe. They can’t control when they have incidents, and you can get calls on a Friday afternoon from ...

Covington Forms Cybersecurity Incident Response Team

WASHINGTON—Covington has formed an enhanced team of lawyers and advisors to provide cybersecurity incident response services to clients, highlighted by Stephen Surdu, who formerly led the professional services group of Mandiant, joining the team as a Senior Cybersecurity Advisor. Through the formation of the Cybersecurity Incident Response Team with members on ...

Covington Bulks Up Cybersecurity Practice With Ex-Mandiant Consultant

James Garland and Steve Surdu are quoted in an American Lawyer article regarding the launch of Covington’s Cybersecurity Incident Response Team, highlighted by Surdu’s recent arrival as a Senior Cybersecurity Advisor. According to Garland, "The lawyers that do the interviews and oversee the forensic investigation, we're experienced but we're not engineers." He ...

Cyber Crime in Brazil: Preparing for the Rio Olympics

The Brazilian financial industry has long been a target of cyber criminals, and with the continued growth of sophisticated online banking services in Brazil, such systems are a prime target for organized crime. In addition, among the emerging BRICS countries (Brazil, Russia, India, China, and South Africa), Brazil is on a par with China and Russia in terms of internet usage by the population; of particular note is the widespread use of social media and mobile devices. Given this ubiquitous connectedness, users and companies are regularly targeted by online attackers, primarily for financial gain, but also increasingly to commit cyber espionage and hacktivist disruptions.

Jennifer Martin Joins Covington's Cybersecurity Practice

NEW YORK — Jennifer Martin has joined Covington’s Data Privacy and Cybersecurity practice. She most recently served as the Director of Cyber Incident Response & Investigations at Symantec. “Jennifer has worked at the intersection of law and cybersecurity from almost every vantage point over the past 15 years,” said David Fagan, who leads Covington’s cyber and ...

Commerce Department Seeks Comments on Internet of Things Policy Issues

On April 6, the National Telecommunications and Information Administration (NTIA), part of the U.S. Department of Commerce, issued a Request for Comment (RFC) seeking public feedback on the benefits, challenges, and potential roles for the government in fostering the advancement of the Internet of Things (IoT).

NTIA issued the RFC as part of the Commerce Department’s Digital Economy Agenda, which, among other things, is meant to identify and address leading public policy and operational challenges in the Internet ecosystem. Noting that thus far no U.S. government agency has taken a holistic, ecosystem-wide view that identifies opportunities and addresses the risks of IoT across the digital economy, NTIA explained that it is seeking broad input from all interested stakeholders and will use that input to draft a “green paper” on key IoT issues. Comments are due on or before 5 p.m. Eastern Time May 23, 2016.

5 Ways To Keep Cybersecurity Risk From Derailing A Deal

Mark Young and Libbie Canter are quoted in this Law360 article offering tips on how deal makers can mitigate cybersecurity risks. According to Young, any discovered incidents can give buyers pause on how — and if — they want to move forward. “We’ve dealt with at least a couple examples where deals were at least delayed if not reconsidered because of ...

Covington Tackles Vendor Cybersecurity Risks in New Book for Corporate Directors and Officers

WASHINGTON, DC, October 13, 2015 - Covington addresses the critical issue of how to manage risks associated with third-party outsourcing in Navigating the Digital Age: The Definitive Cybersecurity Guide for Directors and Officers. Published in collaboration with Palo Alto Networks and the New York Stock Exchange, the book provides boards, executives and ...

Daniel Shallman Named to LA Business Journal’s Most Influential List

WASHINGTON, DC, August 11, 2015 —The Los Angeles Business Journal has named Covington partner and former federal prosecutor Daniel Shallman to its list of the city’s “Most Influential Lawyers” in the white collar and cyber practice areas. In selecting Mr. Shallman, the publication noted that he has handled “a string of impressive matters” since joining the firm ...

View More View Less

"Cybersecurity 2.0: The Role of Counsel in Addressing Destructive Cyberattacks" The Cybersecurity Law Report

"Ten Cybersecurity Incident Investigation Best Practices" Cyber Security Law & Practice

Covington Forms Cybersecurity Incident Response Team

Cybersecurity

Representative Matters

Responding to Sophisticated Advanced Persistent Theat ("APT") Attacks

Responding to Large Cyber-based Financial Crimes

Addressing Regulatory Enforcement Actions

Responding to Government Surveillance Inquiries

Investigating Insider Thefts

HIPAA Breach Notification Requirements

Pre-Incident Advice and Assessments

Data Breach Response and Compliance

Pursuing Recovery for the Largest Documented Data Security Breaches

News and Insights (Showing 5 of 91) (Showing 91 of 91)

Back to Data Privacy and Cybersecurity

Key Contacts

"Cybersecurity 2.0: The Role of Counsel
in Addressing Destructive Cyberattacks"
The Cybersecurity Law Report

"Ten Cybersecurity Incident
Investigation Best Practices"
Cyber Security Law & Practice

Covington Forms Cybersecurity
Incident Response Team