CYBER CORNER

The Biden administration has announced a new national cybersecurity strategy that calls for greater regulatory scrutiny of the private sector’s handling of cyber threats. The plan also proposes a shift in liability for flaws in technology products which leaves their end users vulnerable to an attack.

The plan would hold software developers responsible for putting out products without adequate security built into their design, while cloud service providers would be held accountable for failing to safeguard personal data. White House officials indicated that they would collaborate with Congress around legislation that would offer a “safe harbor” provision for companies that take steps to “securely develop and maintain” the products they bring to market. Critics within the tech industry fear that the shift in liability will stifle innovation. Critics also argue that it is impossible to design products in a way that anticipates new vectors of attack in advance. 

Another proposal would require companies that operate “critical infrastructure” to report “substantial” incidents to the federal government within 72 hours of discovery. Currently, cooperation of this sort is voluntary on the part of businesses, and compliance is not universal. While Homeland Security Secretary Alejandro Mayorkas believes mandatory reporting of incidents could benefit the fight against cybercrime, privacy advocates have voiced concerns over the possible erosion of civil liberties. Separately, the tension between these competing interests has boiled over in an ongoing dispute between the SEC and a prominent law firm around the SEC’s demand that attorneys disclose a list of clients whose information may have been compromised in a cyberattack on the firm.   

The plan also calls for the exploration of a federal backstop for cyber insurance, something which is already being explored by the Department of the Treasury. Cyber insurers have raised premiums and sought to narrow the scope of coverage over the past few years in an effort to recoup losses resulting from ransomware and other incidents. Proponents of a backstop argue that it would help the industry withstand a systemic or catastrophic event, although it is not clear whether the federal government would seek to prescribe underwriting criteria and coverage terms if taxpayer dollars were at stake. 

One of the most popular social media platforms (the “Company”) found its confidential source code posted on an online collaboration platform for software developers. While the country’s concerns about the security of social media users’ data have been on the rise, this leak is also a major exposure of intellectual property for the Company. The Company reached out to the software platform, pointing to copyright infringement issues, and asked them to take down its code. The software platform complied; however, how long the leaked code was online remains unclear. 

In the months leading up to this event, the Company faced drastic leadership changes, followed by mass layoffs that affected 75% of employees. The stories of such layoffs received a lot of attention from the public. The Company suspects that one of its former employees was to blame for the leak and asked a Federal Court to order the software platform to reveal the identity of the person who shared the code, as well as any other individuals who downloaded it. 

This incident also serves as a reminder for employers about the sensitivity of employee departures. This incident demonstrates that employees could take advantage of the sensitive data of a business, especially when they are leaving a given company on less than great terms. Although such coordination is easier said than done, the IT, HR, and Legal departments need to work closely during times of such turmoil, to ensure the security of the offboarding process. That is especially true when the departing party is as sophisticated as one of the company’s technical engineers. The HR and Legal departments should be ready to remind all departing employees of any non-disclosure agreements. Companies should also consider notifying key clients of employee departures to alert the necessary parties that such employees no longer have the authority to act on the company’s behalf. Finally, even during a period of layoffs, it is important to part with employees as humanely as possible to avoid aggrieving the parties who once had knowledge of the company’s vulnerabilities.