Home Page | Data Matters Privacy Blog

Data Matters
Cybersecurity, Privacy, Data Protection, Artificial Intelligence, Internet Law, and Policy

The U.S. Federal Government Continues Its Focus on Ransomware Attacks: CISA, FBI, and NSA Publish Technical Advisory on the Conti Group

Cybersecurity, National Security, Policy

Carly R. Owens, Alan Charles Raul and Stephen W. McInerney

October 14, 2021

On September 22, 2021, the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and National Security Agency (NSA) published a cybersecurity advisory (the “Advisory”) outlining the Conti ransomware group’s tactics, techniques, and procedures (“TTPs”) to help companies protect against their attacks. This Advisory is especially notable because it is an example of the type of information sharing promised by the Biden administration, which includes technical details about the Conti group’s TTPs. It also heralds the launch of new website called: StopRansomware.gov. (more…)

Carly R. Owens

Alan Charles Raul

Washington, D.C., New York

araul@sidley.com

Stephen W. McInerney

Chicago

smcinerney@sidley.com

Oct 132021

Is the SEC Coming for Your Texts? SEC’s New Enforcement Director Telegraphs a Warning to Registrants About Improper Use of Personal Devices for Business-Related Communications

eDiscovery, Employee Privacy, SEC

Ranah Esmaili and Stephen L. Cohen

October 13, 2021

The U.S. Securities and Exchange Commission (SEC) Division of Enforcement is stepping up investigative efforts looking at registered firms’ use of personal devices for business communications, which can implicate their recordkeeping obligations and result in failure to retain and produce responsive business-related communications in SEC investigations. These risks are particularly acute in the current work-from-home posture at many firms, where employees may more easily blur the line between personal and business communications. Firms should review their policies, procedures, and communication monitoring to ensure that employees are not engaging in business-related communications outside of the firm’s official channels and in a manner that the firm is unable to capture and preserve if required.

(more…)

Ranah Esmaili

Washington, D.C.

resmaili@sidley.com

Stephen L. Cohen

Washington, D.C., Boston, ...

scohen@sidley.com

Oct 122021

Data Breaches are More Expensive than Last Year, New IBM Security Report Finds

Cybersecurity, Data Breaches, Insurance, Policy

Kaitie M. Wilson and Colleen Theresa Brown

October 12, 2021

Death, taxes and data breaches. Cybersecurity incidents have grown in frequency, scale and seriousness. As articulated in President Biden’s May 2021 Executive Order, Improving the Nation’s Cybersecurity, “[t]he United States faces persistent and increasingly sophisticated malicious cyber campaigns that threaten the public sector, the private sector, and ultimately the American people’s security and privacy.” These threats lead to direct costs on victims, and these costs have also grown exponentially in recent years, as readers of the famed annual Ponemon data breach report well know. This year’s report is out, and confirms the continuation of a troubling trend. (more…)

Kaitie M. Wilson

Colleen Theresa Brown

Washington, D.C.

cbrown@sidley.com

Oct 42021

Changes to FTC Rulemaking Procedures Herald More Aggressive Action on Consumer Privacy

Enforcement, FTC, Litigation, Regulation

Alan Charles Raul, Colleen Theresa Brown, Ash Nagdev, Gabriel Schonfeld, Mark Prior and Sophia Aguilar (*Aguilar was a 2021 Summer Associate in Sidley Austin’s New York office)

October 4, 2021

On July 22, 2021, the Federal Trade Commission finalized important changes to its procedures for rulemaking under Section 18 of the FTC Act. Section 18 authorizes the Commission to make regulations, termed “Trade Regulation Rules,” (or “Magnuson-Moss Rules” after their authorizing statute), which “define with specificity” conduct that violates the FTC Act’s ban on “unfair or deceptive” business practices. Section 18 rules are promulgated through a “hybrid rulemaking” process that includes, if an interested party requests it, an “informal hearing” with limited opportunities for oral presentation and cross-examination by representatives of stakeholder groups. (more…)