Our Website Uses Cookies
We and the third parties that provide content, functionality, or business services on our website may use cookies to collect information about your browsing activities in order to provide you with more relevant content and promotional materials, on and off the website, and help us understand your interests and improve the website.
For more information, please contact us or consult our Privacy Notice.
Your binder contains too many pages, the maximum is 40.
We are unable to add this page to your binder, please try again later.
This page has been added to your binder.
"Cybersecurity 2.0: The Role of Counsel
in Addressing Destructive Cyberattacks"
The Cybersecurity Law Report
Our Cybersecurity practice has unsurpassed experience addressing the most significant cybersecurity matters confronted by commercial enterprises. We have assisted clients in responding to scores of cybersecurity incidents, ranging from security breaches perpetrated by inside actors, to sophisticated external attacks involving millions of customer and employee records, to several of the largest cyber-related financial crimes on record. These incidents have spanned a broad range of industries, including financial services, pharmaceuticals, media and Internet content companies, retail, technology, communications, defense, energy, software, travel-related services, and data-based services companies. Many of these incidents have been global in nature.
Our cybersecurity lawyers and advisors are based on both coasts of the United States, and in Europe and Asia. We regularly work with multinational companies on the full lifecycle of cybersecurity events, including development of internal compliance policies and incident response planning; incident response, investigation, and remediation; and defense of claims and pursuit of recoveries. We have unparalleled depth across a range of practice areas that intersect with cyber-related risks, including insurance, litigation, corporate governance, and regulatory compliance, to name a few.
Enterprises face threats from multiple vectors, including, among others, state-sponsored actors, criminal organizations, hactivists, competitors, and insiders—with potential for incidents that may include denial-of-service attacks, theft of funds or IP, breaches of payment card data and other sensitive customer information, and other significant compromises. Unlike many other firms, Covington does not approach cybersecurity as simply a subset of our broader privacy practice. Rather, we take a truly multi-dimensional, cross-disciplinary approach, taking into account not only privacy law, but also the potential impact of any particular threat vector on U.S. national security and the integrity of critical enterprises internationally.
Our team includes former senior officials from the Department of Homeland Security and Department of Justice, and we regularly engage with those agencies, as well as the Federal Trade Commission, Federal Bureau of Investigation, Department of Defense, and other federal and international agencies as well as State Attorneys General and EU, Asian, and Latin American data protection authorities, on defending against and responding to cyber threats.
Our areas of focus include:
- Preparedness and counseling
- Incident response and investigations
- Regulatory advice and compliance
- Risk management and insurance coverage
- Litigation—class action defense
- European and international data protection
Responding to Sophisticated Advanced Persistent Theat ("APT") Attacks
We have directed the investigations and response into APT attacks from state-sponsored actors and sophisticated criminal groups targeting intellectual property and other proprietary information. These attacks, and the responses, have spanned multiple industries and global companies, with investigations covering four continents.
Responding to Large Cyber-based Financial Crimes
We have handled multiple large cyber-based financial crimes, including, among others, assisting in the response to one of the largest criminal organization ATM cash drawdowns in U.S. history.
Addressing Regulatory Enforcement Actions
We have addressed regulatory investigations and enforcement actions from regulators in the United States, Europe, and Asia following data breaches. These have included investigations or formal enforcement proceedings brought by the Federal Trade Commission, State Attorneys General, and the Securities and Exchange Commission in the United States, and by data protection authorities and sector-specific regulators across Europe and Asia.
Responding to Government Surveillance Inquiries
We have a leading practice advising Internet companies and cloud service providers on responding to legal demands seeking access to customer data or network surveillance, served by governments around the world.
Investigating Insider Thefts
We have directed investigations into cyber-based insider thefts of highly sensitive proprietary information and consumer information.
Pre-Incident Advice and Assessments
We regularly advise clients on compliance with information security requirements and best practices, including, among others, governance best practices, vendor contract terms and due diligence, the implementation of information security controls to satisfy regulatory requirements, and the conduct of vulnerability assessments.
Pursuing Recovery for the Largest Documented Data Security Breaches
We have successfully handled the recovery under insurance coverage policies for several of the largest documented data security breaches.
Data Breach Response and Compliance
We have counseled clients on all aspects of data breach response globally, including incidents involving more than 100,000 impacted employees, payment card incidents involving millions of consumers, and breaches of other personal information impacting more than 50 million consumers.
HIPAA Breach Notification Requirements
Advised employer health plans on HIPAA breach notification requirements relating to breaches of protected health information held by the plans.
Whitepaper on Cybersecurity Advantages of Blockchain Technologies
Advising Microsoft and the Chamber of Digital Commerce in the development of a whitepaper exploring the cybersecurity advantages of blockchain technologies.
AI Algorithms and Services Cybersecurity
Advising a software company and other high-tech companies on the integrity and security of AI algorithms and services.
June 13, 2018, Inside Privacy
On June 11, 2018, the Financial Services Information Sharing and Analysis Center (“FS-ISAC”) announced the launch of the CERES Forum, an information sharing initiative for central banks, regulators, and supervisors designed to strengthen responses to cyber and physical threats. The new forum will become operational on July 1, 2018. Although FS-ISAC primarily ...
April 23, 2018, Inside Privacy
Pursuant to Executive Order 13636, the National Institute of Standards and Technology (“NIST”) established the Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0, a technology-neutral, voluntary, risk-based cybersecurity framework that includes standards and processes intended to align policy, business, and technological approaches to ...
April 17, 2018, Inside Privacy
Today, 34 global technology and security companies announced that they have signed a Cybersecurity Tech Accord, which publicly commits them “to protect and empower civilians online and to improve the security, stability and resilience of cyberspace.” The signatories include Cisco, Dell, Facebook, HP, Intuit, and Microsoft. The text of the Accord references ...
April 3, 2018, Inside Privacy
[This article was originally published in Law360] Last week, South Dakota became the 49th U.S. state to enact a data breach notification law with the passage of S.B. 62, which sets forth requirements for notifying state residents, the state attorney general, and major consumer reporting agencies in the event of a breach. The law, which...… Continue Reading
March 6, 2018, Inside Privacy
Two hundred billion IoT devices could be in use by 2020, according to one estimate cited in the World Economic Forum’s recent report, Mitigating Risk in the Innovation Economy. This rapid integration of the digital world and the physical world presents unprecedented opportunities for businesses in a wide array of industries. But it also creates...… Continue ...
March 1, 2018, Covington Alert
On February 21, 2018, the U.S. Securities and Exchange Commission (the “Commission”) approved a statement and interpretive guidance that provides the Commission’s views on a public company’s disclosure obligations concerning cybersecurity risks and incidents (the “2018 Commission Guidance”).
February-March 2018, Pratt’s Privacy & Cybersecurity Law Report
February 27, 2018, Inside Privacy
Earlier today, our colleagues David Engvall, Keir Gumbs, Reid Hooper, and Matthew Wood in the Securities and Capital Markets practice group posted the below article on the SEC’s new statement and interpretive guidance on public company cybersecurity disclosures and insider trading on the Cov Financial Services blog. The original article can be read here. On...… ...
February 22, 2018, The Recorder
Keir Gumbs is quoted by The Recorder in an article regarding the SEC's recently issued guidance on cybersecurity. Gumbs says that he is disappointed the guidance does not give more clarity about how to determine when a cyber breach is material—or provide any kind of safe harbor for companies that make good-faith determinations about the scope of a breach that ...
February 15, 2018, Bloomberg Law
Anne Termine is quoted in a Bloomberg Law article regarding the settlement reached with AMP Global Clearing LLC following charges from the CFTC stating that AMP's failure to diligently supervise a cybersecurity vendor resulted in a data breach. According to Termine, cybersecurity is “an area of increasing concern and scrutiny for the CFTC as it goes directly to ...
Feds to Ramp Up Online Purchasing Presence
January 22, 2018, E-Commerce Times
Susan Cassidy is quoted in an E-Commerce Times article regarding efforts to create an online marketplace for government purchasers. "One model that was discussed would require a portal provider to contract with GSA to provide an online interface. Under this approach, suppliers would then sign up to use the portal, potentially via a contract with the portal ...
January 17, 2018, Inside Privacy
Following the Equifax data breach in 2017, there has been heightened awareness surrounding how credit reporting agencies handle consumers’ personal information. At the same time, recent high-profile attacks, such as the “WannaCry” ransomware attacks, have focused media and regulatory attention on vulnerabilities associated with unpatched systems. In response to ...
January 12, 2018, Inside Privacy
On January 9, the House of Representatives passed the Cyber Vulnerability Disclosure Reporting Act by voice vote. The Act directs the Secretary of the U.S. Department of Homeland Security (“DHS”) to prepare a report describing the policies and procedures that DHS developed to coordinate the cyber vulnerability disclosures. Under the Homeland Security Act of ...
January 10, 2018, Inside Privacy
Last week, U.S. Customs and Border Protection (“CBP”) released a revised Directive governing searches of electronic devices at the border. These are the first official revisions CBP has made to its guidelines and procedures for devices since its 2009 Directive. The new Directive is intended to reflect the evolution of technology over the intervening ...
January 8, 2018, Inside Privacy
As we summarized last fall, the EU Commission published a new Cybersecurity Communication in September that, among other things, sets out proposals for an EU cybersecurity certification framework as part of an EU “Cybersecurity Act” (see our post here and a more detailed summary here). Just before the holidays, on December 20, 2017, the UK Government published ...
Russian hacker claims there's proof of his DNC breach
January 2, 2018, Politico
Susan Cassidy is quoted in Politico Pro's "Morning Cybersecurity" newsletter regarding the December 31st deadline for defense contractors to meet minimum cybersecurity requirements for the systems they operate for the Pentagon. According to Cassidy, the cybersecurity rule presents “a problem for DoD because there’s a lot of subjectivity in what is ‘adequate ...
Aerospace Up Against Deadline on Cybersecurity
November 24, 2017, Los Angeles Business Journal
Susan Cassidy is quoted in a Los Angeles Business Journal article regarding the difficulties that some defense contractors in Southern California were facing trying to meet the Department of Defense deadline of December 31, 2017 for implementing the cybersecurity controls in NIST Special Publication 800-171. Cassidy notes that the definition of the information ...
US corporates braced for cyber-chaos
October 3, 2017, Commercial Dispute Resolution
David Fagan is quoted in a Commercial Dispute Resolution article regarding how companies are bracing for cyber attacks. According to Fagan, cybersecurity is “a one-way ratchet: all constituents, whether customers, regulators, business partners, claimant counsel and finders of fact, are increasingly aware of and focused on the risk [which] arises from operating ...
October 2017
Covington's Data Privacy and Cybersecurity practice is excited to take part in National Cybersecurity Awareness Month. Throughout October, our lawyers will highlight top-of-mind concerns, provide helpful tips, and discuss the cybersecurity landscape more generally through a series of posts on our Inside Privacy blog. Below you can find our most recent content, ...
The EU Gets Serious About Cyber: The EU Cybersecurity Act and Other Elements of the "Cyber Package"
September 18, 2017, Covington Alert
Last week, in his annual State of the European Union Address, the President of the European Commission Jean-Claude Juncker called out cybersecurity as a key priority for the European Union in the year ahead. In terms of ranking those priorities, President Juncker placed tackling cyber threats just one place below the EU leading the fight against climate change, ...
China Seeks Comments on Updated Draft of Cross-Border Data Transfer Security Assessment Standard
August 31, 2017, Covington Alert
On August 31, 2017, China’s National Information Security Standardization Technical Committee (“NISSTC”), a standard-setting committee jointly supervised by the Standardization Administration of China (“SAC”) and the Cyberspace Administration of China (“CAC”), released an updated draft of the Information Security Technology - Guidelines for Data Cross-Border ...
Rising Star: Covington & Burling's Elizabeth Canter
August 2, 2017, Law360
Libbie Canter was named a "Rising Star" by Law360, recognizing her as a top lawyer under 40 in Privacy & Cybersecurity law. In its profile of Canter, Law360 highlights her advisory role on significant transactions, including Microsoft’s $8.5 billion acquisition of video call service Skype.
July 28, 2017, Medtech Insight
Marialuisa Gallozzi, John Buchanan, and Jeff Kiburtz are quoted in a Medtech Insight article regarding the growing interest in the healthcare sector in buying cyber insurance. According to Gallozzi, "We are in the midst of an evolution of the insurance market right now in this area." She says cyber insurance policies have been a growing trend but unlike other ...
Pentagon demands contractors up cybersecurity
July 2, 2017, San Antonio Express-News
Susan Cassidy is quoted in a San Antonio Express-News article regarding new cybersecurity requirements for contractors. According to Cassidy, "Essentially, the DOD wants its contractors to protect its information, because the DOD is a huge target, and its contractors are also a target." Commenting on the fact that over the years, contractors have been working ...
European General Data Protection Regulation: What You Need to Know
May 23, 2017, Cloud, Big Data and AI Conference, Seattle, Washington
Artificial Intelligence
May 23, 2017, Cloud, Big Data and AI Conference, Seattle, Washington
May 17, 2017, The Cybersecurity Law Report
May 3, 2017, The Cybersecurity Law Report
May 3, 2017, Covington Alert
On May 2, 2017, the Cyberspace Administration of China (“CAC”) released the final version of the Measures on the Security Review of Network Products and Services (Trial) (“the Measures”), with an effective date of June 1, 2017 (official Chinese version available here). The issuance of the Measures marks a critical first step toward implementing China’s ...
Data Privacy and National Security
April 21, 2017, Luxembourg Forum (Triannual Meeting Between the United States Supreme Court and the European Court of Justice), Washington, DC
April 12, 2017, Covington Alert
On April 11, 2017, the Cyberspace Administration of China (“CAC”) released a draft of the Measures on Security Assessment of Cross-border Data Transfer of Personal Information and Important Data (“the Draft Measures”) for public comment (official Chinese version available here; Covington’s translation of the Draft Measures is appended at the end of this alert).
GDPR Planning and Preparation Conference for Employers
March 30, 2017, Business Forums International Ltd.
Shrunken Chickens, Neck Flanges, Pill Mills & Bacteria: New Twists on Perennially Difficult Issues in Products-Related Coverage
March 4, 2017, ABA Insurance Coverage Litigation Committee CLE Seminar
March 2017, Pratt's Government Contracting Law Report
Forensic Firms: Understanding and Leveraging Their Expertise From the Start (Part One of Three)
February 22, 2017, The Cybersecurity Law Report
Steve Surdu was interviewed by The Cybersecurity Law Report for a three-part series on the role of forensic firms during a cyber breach. Part one discusses how to understand and leverage the expertise of forensic firms from the start. According to Surdu, forensic consultants have specialized skills and knowledge “that are very difficult for most organizations to ...
February 7, 2017, Covington Alert
On February 4, 2017, the Cyberspace Administration of China (“CAC”) released the draft Measures on the Security Review of Network Products and Services (“the draft Measures”) for public comment (official Chinese version available here; Covington’s translation of the draft Measures is here). The comment period ends on March 4, 2017.
Banks Face Cybercrime Wave As Tougher Regulations Loom
January 24, 2017, Law360
Mark Young and Ian Hargreaves are quoted in a Law360 article regarding the high level of cyberattacks on the financial services industry and the resulting regulatory pressures. According to Young, “The GDPR [General Data Protection Regulation] is a massive text with groundbreaking change in the data privacy area, in terms of compliance requirements and the new ...
January 17, 2017, Federal Contracts Report
Susan Cassidy is quoted in a Federal Contracts Report article regarding the fate of cybersecurity improvements made by the DoD under President Trump. According to Cassidy, “I would expect those to continue forward because I don't see a political will to say, ‘No you shouldn't protect this.’” The nomination of former Sen. Dan Coats (R-Ind.) to serve as director ...
U.S. Expands Sanctions, Takes Other Steps in Response to Russia’s Election-Related Cyber Operations
January 4, 2017, Covington Alert
President Obama announced several actions on December 29 to respond to Russian cyber operations that the U.S. intelligence community previously had concluded were intended to influence the U.S. presidential election. Specifically, the President revised and expanded an earlier executive order that blocks the property and interests in property of persons that ...
October 20, 2016, Covington Alert
On October 19, 2016, the Board of Governors of the Federal Reserve System (Federal Reserve), Office of the Comptroller of the Currency (OCC), and Federal Deposit Insurance Corporation (FDIC) (collectively the “Agencies”) released a joint Advance Notice of Proposed Rulemaking (ANPR) requesting public comment on enhanced cybersecurity standards that would apply to ...
Covington hires cyber expert
July 27, 2016, Global Investigations Review
Stephen Surdu and James Garland are quoted in a GIR article regarding Surdu’s arrival to Covington as a Senior Cybersecurity Advisor. “In the fog of war, companies do not think clearly,” Surdu says. “They want to do the right thing, but they do not quite know what that is. As someone who has handled many cybersecurity investigations, I can help calm the ship.” ...
July 25, 2016, Covington Alert
Search warrants served on U.S. Internet companies and cloud service providers cannot obtain customer data stored overseas, the U.S. Court of Appeals for the Second Circuit ruled on July 14. The federal appellate decision focuses on warrants issued under the federal Electronic Communications Privacy Act (“ECPA”) and formally applies only in the Second Circuit, ...
Covington Launches Cyber Response Team With Mandiant Pro
July 21, 2016, Law360
David Fagan and Stephen Surdu are quoted in a Law360 article regarding the launch of Covington’s new Cybersecurity Incident Response Team in conjunction with the arrival of Surdu and Jenny Martin. According to Fagan, “We’re a big firm with clients that span the globe. They can’t control when they have incidents, and you can get calls on a Friday afternoon from ...
Covington Forms Cybersecurity Incident Response Team
July 18, 2016
WASHINGTON—Covington has formed an enhanced team of lawyers and advisors to provide cybersecurity incident response services to clients, highlighted by Stephen Surdu, who formerly led the professional services group of Mandiant, joining the team as a Senior Cybersecurity Advisor. Through the formation of the Cybersecurity Incident Response Team with members on ...
July 18, 2016, The American Lawyer
James Garland and Steve Surdu are quoted in an American Lawyer article regarding the launch of Covington’s Cybersecurity Incident Response Team, highlighted by Surdu’s recent arrival as a Senior Cybersecurity Advisor. According to Garland, "The lawyers that do the interviews and oversee the forensic investigation, we're experienced but we're not engineers." He ...
July 7, 2016, Covington Alert
The Brazilian financial industry has long been a target of cyber criminals, and with the continued growth of sophisticated online banking services in Brazil, such systems are a prime target for organized crime. In addition, among the emerging BRICS countries (Brazil, Russia, India, China, and South Africa), Brazil is on a par with China and Russia in terms of ...
Insider Threats to Cybersecurity—Prevent, Prepare, and React Webinar
June 21, 2016, Webinar
April 8, 2016, Covington Alert
On April 6, the National Telecommunications and Information Administration (NTIA), part of the U.S. Department of Commerce, issued a Request for Comment (RFC) seeking public feedback on the benefits, challenges, and potential roles for the government in fostering the advancement of the Internet of Things (IoT). NTIA issued the RFC as part of the Commerce ...
March 2016, Cyber Security Law & Practice
5 Ways To Keep Cybersecurity Risk From Derailing A Deal
February 19, 2016, Law360
Mark Young and Libbie Canter are quoted in this Law360 article offering tips on how deal makers can mitigate cybersecurity risks. According to Young, any discovered incidents can give buyers pause on how — and if — they want to move forward. “We’ve dealt with at least a couple examples where deals were at least delayed if not reconsidered because of ...
Cybersecurity: CFTC Proposes New Cybersecurity Testing Rules for Derivatives Market Infrastructure
January 12, 2016, Covington Alert
December 2015, Privacy & Data Protection
Covington Tackles Vendor Cybersecurity Risks in New Book for Corporate Directors and Officers
October 13, 2015
WASHINGTON, DC, October 13, 2015 - Covington addresses the critical issue of how to manage risks associated with third-party outsourcing in Navigating the Digital Age: The Definitive Cybersecurity Guide for Directors and Officers. Published in collaboration with Palo Alto Networks and the New York Stock Exchange, the book provides boards, executives and ...
October 6, 2015, Covington Alert
October 2015, Navigating the Digital Age: The Definitive Cybersecurity Guide for Directors and Officers
September 2015, Bloomberg BNA World Data Protection Report
August 27, 2015, Inside Cybersecurity
Susan Cassidy was quoted in this article.
August 13, 2015, Inside Cybersecurity
Susan Cassidy was quoted in this article.
August 12, 2015, The Cybersecurity Law Report
August 11, 2015
WASHINGTON, DC, August 11, 2015 —The Los Angeles Business Journal has named Covington partner and former federal prosecutor Daniel Shallman to its list of the city’s “Most Influential Lawyers” in the white collar and cyber practice areas. In selecting Mr. Shallman, the publication noted that he has handled “a string of impressive matters” since joining the firm ...
August 2015, Bloomberg BNA World Data Protection Report
Insider Threats to Cybersecurity—Prevent, Prepare, React
July 17, 2015, Webinar
June 12, 2015, InsidePrivacyBlog
May 12, 2015, Inside Counsel
May 2015, Privacy Laws & Business UK Report
March 9, 2015, The National Law Journal
February 28, 2015, InsidePrivacy Blog
February 19, 2015, Inside Counsel
February 2015, Bloomberg BNA World Data Protection Report
November/December 2014, E-Commerce Law Reports
October 10, 2014, InsideMedicalDevices Blog
May 14, 2014, InsidePrivacy Blog
April 8, 2014, InsidePrivacy Blog
November 27, 2013, Covington E-Alert
October 24, 2013, Covington E-Alert
April 2013, World Data Protection Report
May 2010, Privacy Law & Business
October 2009, The Privacy Advisor
November 24, 2008, Covington E-Alert