2023 begins with federal agencies flexing their cybersecurity enforcement muscles

In January, the SEC filed an enforcement action in Washington D.C federal court to enforce its investigative powers following a cyber breach at the international law firm of Covington & Burling LLP.

According to the SEC, “In or around November 2020, threat actors associated with the Microsoft Hafnium cyberattack maliciously and unlawfully obtained access to Covington's computer network and certain individual devices, including access to non-public files of nearly 300 Covington clients that are regulated by the SEC.” The SEC served the law firm with a subpoena for its client lists, seeking the names of any clients whose data was “viewed, copied, modified or exfiltrated by the threat actors.”

In response, the law firm refused to turn over its client records, citing the sacrosanct attorney-client privilege. Notably, the law firm itself is not a publicly traded company and thus not under direct regulation by the SEC.

The SEC argues that the court should compel the law firm to produce the records to assist the SEC, “in identifying any suspicious trading by the threat actors or others in those clients' securities, and whether such trading was illegal based on material non-public information that the threat actors viewed or exfiltrated as part of the cyberattack.” In addition, the SEC seeks to determine, “whether the impacted clients made all required disclosures to the investing public about any material cybersecurity events in connection with the cyberattack.”

Legal commentators are uncertain of the ultimate disposition, and while the SEC maintains that the information it seeks is simple identity and not protected attorney-client communications, other law firms have joined in support of Covington in its litigation in opposing the SEC’s enforcement action. We will monitor this litigation as it develops.

The FCC has also recently submitted proposed cybersecurity regulations that it hopes will modernize its ability to regulate and enforce cybersecurity requirements within the telecommunications industry. This includes, “expansion of the definition of a breach, changes to customer notification, and changes to reporting to the Commission and law enforcement.” Whereas the current definition of a breach includes only intentional acts, the proposed regulations will include, “inadvertent access, use, or disclosures of customer information.”

The FCC is also considering comments on whether actual harm should be required to trigger notifications and whether there should be “good faith” carveouts for notification due to accidental disclosures by employees. But while such carveouts and harm triggers would be helpful, other proposed language will impose additional responsibilities on telecommunication companies. These include separate notification directly to the Commission (in addition to the FBI and Secret Service), as well as imposing a “without unreasonable delay” notification standard for customers, removing the current mandatory waiting period.

We will continue to watch and update once these rules are fully adopted.

While we most commonly associate the TSA with the airline industry, the agency’s reach is much broader, extending to railroads and pipelines as well. As set forth in the Biden Administration’s recently issued National Cybersecurity Strategy, infrastructure security is a key pillar in overall national security. As a result, the TSA anticipates issuing specific regulations intended to secure railroads and pipelines.

The Colonial Pipeline attack in 2021 demonstrated the unique disruptive impact that an attack on pipelines can have on the national economy. As a result, the TSA is focused on requiring a layered depth approach to security that fends off not just Information Technology (IT)threats but Operational Technology (OT) threats as well, such as to supervisory control and data acquisition (SCADA) systems.

According to Homeland Security Today, “Cyber actors have demonstrated their willingness to engage in cyber intrusions and conduct cyberattacks against critical infrastructure by exploiting the vulnerability of OT IT systems.

Pipeline and rail systems, and associated facilities, are vulnerable to cyberattacks due to legacy equipment that lacks updated security controls and the dispersed nature of pipeline and rail networks spanning urban and outlying areas. Keeping these systems insulated from attacks is therefore critical, and part of a layered cybersecurity strategy.