SPEAKER INTRODUCTION Josh M Kantrow is a Partner

SPEAKER INTRODUCTION Josh M. Kantrow is a Partner at Lewis Brisbois who advises clients on how to protect their intellectual property, trade secrets and proprietary information from security breaches. Josh litigates a wide variety of high-exposure, complex cyber, technology, computer-related and professional liability matters throughout the United States. Josh is an AV® Preeminent™ peer review rated lawyer by Martindale. Hubbell, reflecting the highest peer recognition for both ethical standards and legal ability, is a Chicago Top Rated Lawyer, and a current Illinois “Leading Lawyer” for Commercial Litigation, Insurance Law and Professional Liability. Josh is active is pro-Israel causes and the Chicago Jewish Community and has visited Israel many times. Josh co-founded and co-chaired the American Israel Public Affairs Committee’s (AIPAC) Young Leadership Council in Chicago. Over the past 12 years, the Young Leadership Council has produced thousands of pro-Israel activists in the Chicago area.

So You Want to Do Business in the United States: Protecting Your Intellectual Property, Bottom Line and Reputation from Cyber Intrusions and Security Breaches Josh Kantrow Lewis Brisbois Bisgaard & Smith LLP 312. 463. 3445 Josh. Kantrow@lewisbrisbois. com

OVERVIEW • Background re digital risk explosion. • What are the enterprise risks caused by internet connectivity? • What are the legal risks in the United States caused by internet connectivity? • What you can do to protect your bottom line and reputation (or the bottom line and reputation of companies in which you invest that do business in the U. S. )?

BACKGROUND: DIGITAL RISK EXPLOSION • 99. 9% of new information is stored digitally. • Facebook collects an average of 15 TB of data every day or 5000+ TB per year. – That’s equivalent to the amount of paper stored in the beds of 15 pickup trucks per day. • Privacy breaches are occurring more often - more than once a day. – The average rate of publicly reported privacy breaches has grown from about 5 per month in 2005 to a peak of about 60 per month in 2008. – By 2009 the 5 year average was about 40 per month.

BACKGROUND: OFTEN OVERLOOKED SOURCES OF DATA • • • Photocopiers Shredding machines Flash drives Smart phones Tablets Cloud storage (Google Drive, Drop. Box, e. Discovery Systems, etc) • Court Reporters - Audio/Video Tapes, Transcripts

BACKGROUND: HOW DO BREACHES HAPPEN • Traditional “Hacking” – only one type of breach – Number of Attacks Increasing & Sophistication of Attacks Increasing • China (in some cases, state sponsored; recently China Hackers hit big U. S. Media like the Wall Street Journal and New York Times) • Eastern Europe • Africa – The security firm Mandiant estimated that 80 major U. S. law firms were hacked in 2011. – Action Items: • Improve Network Security Policies/Procedures • Encryption of Sensitive Information • Penetration Testing • Breach Response Plan and Testing

ENTERPRISE RISKS: OVERVIEW • • Theft of IP/Proprietary information/business secrets Stolen customer information Negligence Social media/e-publishing Bad technology and software Business interruption Vendor negligence or fault

ENTERPRISE RISKS: THEFT OF IP • Data breaches where there is theft of IP, proprietary data, confidential business secrets, etc. • China and other countries actively stealing and attempting to steal such information. • IP can be stolen not just from hacking into the target company’s computer systems but via the vendors (i. e. professional service providers like law firms, accounting firms, etc. ) that do work for them. • In fact, it’s often easier to do it this way.

ENTERPRISE RISKS: STOLEN CUSTOMER INFORMATION • Data breaches, where customers personal information (health, financial, employment records, social security numbers, credit card information, etc. ) is stolen.

ENTERPRISE RISKS: DATA BREACHES VIA NEGLIGENCE • Data breaches via negligence (i. e. leaving a laptop or a smart phone in a coffee shop or on a bus). • In fact, negligence is responsible for about 70% of all breaches, while network hacking or a malicious breach only responsible for 30%.

ENTERPRISE RISKS: SOCIAL MEDIA • Many employers and their employees engage in social media of some sort – a corporate blog, Twitter, Facebook, Linked. In, etc. • Employer use of social media can lead to privacy defamation, trade libel, trademark infringement, and copyright infringement claims. • Recent study shows that only 40% of corporate directors and general counsel at public companies believe their company has a good handle on the risks associated with social media. • Only 39% of companies even have a social media policy. • If properly tied to an overall internet and email policy, a comprehensive social media policy can be used to help reduce defamation, trade libel, trademark infringement, and copyright infringement claims.

ENTERPRISE RISKS: BUSINESS INTERRUPTION • Technology/Systems/software that don't work as planned • Computer malfunction or attack • Can lead to massive business interruption claims

ENTERPRISE RISKS: VENDOR/BUSINESS PARTNER ISSUES • 30 -40% of all breaches are caused by vendors (litigation support, offsite storage, disaster recovery, mail room, shredding service, cleaning service). • Must have contracts that shift liability to vendor (defense and indemnity).

ENTERPRISE RISKS: LACK OF ACTION BY COMPANIES RE CYBER EXPOSURE • Recent studies show that data security was the number one concern of directors and general counsel at public companies. • 33% of GCs believe their board is not effective at managing cyber risk. • Yet only 42% of companies had a crisis management plan in place.

LEGAL RISKS • Explanation of federalism system of government in the U. S. : State v. Federal powers • State government efforts: new laws and regulations • Federal (U. S. government) efforts: new laws and regulations • Common law: class actions • Trends

LEGAL RISKS: EXAMPLE • Stolen IP and lack of digital risk management safeguards can lead to large shareholder derivative claims against directors and officers and other claims for large companies. • Cyber claims can put small companies out of business. • Wall Street Journal ran a series last year about the number of small companies who filed for bankruptcy or suffered significant financial losses due to the costs of responding to data breaches.

LEGAL RISKS: STATE LAW • State Laws and Trends – 46 States with Breach Notification Laws – Attorney General/Other Agency Notification

LEGAL RISKS: FEDERAL LAWS PROTECTING PERSONAL INFORMATION • F. A. C. T. A. “Red Flag” Rule: Rules that require financial institutions and creditors to develop and implement written identity theft prevention programs. • H. I. P. A. A. Security Rule: Require appropriate administrative, physical and technical safeguard to insure confidentiality, integrity and security of electronic protected health information. • H. I. T. E. C. H. Law: Extends the scope of HIPAA requirements to the business associates of covered entities. This also expands the regulations to include mandatory breach notifications, heightened enforcement, increased penalties and patient rights. • Gramm-Leach-Biley Act: Requires financial institutions to have in place standards which protect the security of their banking customers’ nonpublic information. • I. T. E. R. A. : The Identity Theft Enforcement and Restitution Act amends the federal criminal code to authorize criminal restitution orders in identity theft cases.

LEGAL RISKS: FTC ENFORCEMENT IS ON THE RISE • Since 2005, the FTC has settled dozens of cases against companies for issues ranging from failure to safeguard private information to failure to comply with their own privacy policies. • Not even small “do good” firms escape the FTC’s reach.

LEGAL RISKS: COMMON LAW CAUSES OF ACTION - OVERVIEW • Malpractice • Negligence • Breach of fiduciary duty • Fraud

LEGAL RISKS: DECEPTIVE TRADE PRACTICES AND CONSUMER PROTECTION LAWS Violation of Deceptive Trade Practices or Consumer Protection Laws: • Communications/Web Site Privacy Policy or other materials viewed or received by plaintiff caused plaintiff to believe that his/her information would be kept private. • Plaintiff was misled, provided the information, and was deceived because the information was not kept private. • Frequently sought because a prevailing plaintiff recovers treble damages and attorneys’ fees.

LEGAL RISKS: FRAUD • Material misrepresentation by defendant (that information would be kept private) induced plaintiff to provide private information, reasonably believing that it would be kept private. • Plaintiff was damaged because the information was not kept private.

LEGAL RISKS: EU PLANS NEW CYBERSECURITY RULES • The Wall Street Journal recently reported that the EU is considering enacting laws and regulations that would require search engines, energy providers, banks, transit hubs, stock exchanges and other companies must report disruptions and breaches to government authorities. • The WSJ further reported that “In the U. S. , a White House backed bill, which would have established a voluntary regime of cybersecurity standards developed by private industry, was blocked by Republican lawmakers in August. ”

LEGAL RISKS: CYBER LITIGATION TRENDS – Privacy/Security Breaches • Avoiding Spoliation • Jurisdiction • Motions to Dismiss • Class Certification and Settlement – Technology Errors & Omissions • Vendor Contracts – Cyber Media Liability • Social Media • Email Publishing

LEGAL RISKS: COST OF A DATA BREACH: TANGIBLE COSTS Legal Fees $100, 000 Customer Notification $10, 000 Public Relations $20, 000 Credit Monitoring $50, 000 Customer Demands • Reimbursement $300, 000 Forensic Investigation $25, 000 Total $505, 000 Insurable Costs $505, 000 (Less any applicable Deductible)

INTANGIBLE COSTS • Loss of Customer Goodwill/Trust • Loss of Future Revenues Due to Reputation Damage • Employee Downtime

PROTECTING YOUR BOTTOM LINE AND REPUTATION: STEPS FOR COMBATING BREACHES • Technical Steps: – Strong and complex passwords & encryption – Monitoring software – Bottom-up security approach – allowing employees access to the required set of resources to perform their job function – Regular Implementation of security patches and updates – Threat assessments a. Proactively look for potential risks b. Review logs proactively c. Intrusion / penetration testing d. Independent testing of security protocols

PROTECTING YOUR BOTTOM LINE AND REPUTATION: RISK MANAGEMENT STEPS • Risk Management Steps: § Evaluate Breach Exposure as an Enterprise Risk § What Policies/Procedures Protect Network and Sensitive Information? § Form Breach Response Team • Stakeholders • Internal Communication • External Communication • Compliance • Brand/Reputation Protection § Periodically Test Breach Response and Revise as Warranted

PROTECTING YOUR BOTTOM LINE AND REPUTATION: RISK MANAGEMENT STEPS Pre-Breach Response Planning • Identify Stakeholders • Establish Analysis and Communication Protocols • Evaluate Vendor Needs Remediation and Recovery Procedures • Human Resource Involvement • Testing (DRP) Incident Analysis • Breach Containment • Damage Determination • Legal Analysis • Communication Incident Disclosure • Analyze Requirements (State and Fed Considerations) • Consider All Notification Methods • Third Party Vendors for Notification and PR(? ) • Roll Out Notifications Over Time Loss Mitigation • Insurance Remedies • Credit Monitoring • Public Relations • Customer Retention Plans • Implementation of IT Upgrades Communication & Remediation • Public Relations • Ongoing Marketing Efforts • IT as part of the Ongoing Solution • HR Involvement TBD

PROTECTING YOUR BOTTOM LINE AND REPUTATION: RISK MANAGEMENT STEPS • Before the Data Security Incident – – – • During the Incident (Conducting an Investigation) – – – • Plan and prepare Recognize that regulators expect compliance Incident response plan Workforce security awareness training Annual privacy/security risk assessment Identify resources needed to respond to an incident Implement incident response plan Document everything Manage internal and external communications (Know who to notify) Mitigate harm to affected persons Work cooperatively with regulators After the Investigation Concludes – – GAP analysis Fix identified problems Update the incident response plan based on lessons learned Incorporate lessons learned into training

PROTECTING YOUR BOTTOM LINE: EVOLUTION OF CYBER INSURANCE Past Present Future Internet and e-commerce Identity Theft and Privacy Regulations Social Media, Cloud Computing, Expanded BI, Additional Regulation February 21, 2013 31

PROTECTING YOUR BOTTOM LINE AND REPUTATION: CYBER LIABILITY MARKETPLACE • Evolution of Cyber Insurance • Some companies offer business interruption cover: positive development • Who is in the Hot Seat? • Risk Management and Underwriting Considerations

PROTECTING YOUR BOTTOM LINE: OUR EXISTING INSURANCE PROVIDES ENOUGH COVERAGE−ARE YOU SURE? • Ok for existing limits to be eroded by a data breach? − If you aren’t purchasing more than you need, a data breach claim could leave you bare if you have the type of claim for which the coverage was purchased.

PROTECTING YOUR BOTTOM LINE: OUR EXISTING INSURANCE PROVIDES ENOUGH COVERAGE−ARE YOU SURE? • What isn’t covered by traditional policies? − Non-client claims, including claims stemming from bots, spyware and other malware on your system without your authorization. −Responding to regulatory inquiries. −Complying with state breach notification laws, including providing notice to regulators and potentially impacted individuals. −Credit monitoring. −Public relations costs incurred in connection with a breach response. −Correcting risk control deficiencies that may have contributed to a breach. −Managing relationships with privacy regulatory/law enforcement authorities. −Your vicarious liability for your vendor’s breach. −Theft of laptops, Blackberries, i. Phones, USB drives etc.

PROTECTING YOUR BOTTOM LINE: OUR EXISTING INSURANCE PROVIDES ENOUGH COVERAGE−ARE YOU SURE? COST OF A DATA BREACH • Reputational damage−lost client trust/loyalty Symantec study results: − 85% would only want to do business with companies that haven’t had a breach. − 82% would warn others not to do business with a company that had a breach.

PROTECTING YOUR BOTTOM LINE AND REPUTATION: RISK MANAGEMENT AND UNDERWRITING CONSIDERATIONS • Target of Choice or Opportunity? • Facebook and Linked. In • Smart phones: Health care providers/PHI; Business/Proprietary Info • Basic Issues – Employee awareness and training – Password security − Administrator too! – Avoid using/keeping PII and PHI absent need – Limit use of PII to only those who need it – Paper records – Adopt defenses to known attack methods – Coverage gaps in traditional policies • Media: Does coverage follow you where you publish?

QUESTIONS? Josh M. Kantrow Lewis Brisbois Bisgaard & Smith LLP 312. 463. 3445 Josh. Kantrow@lewisbrisbois. com