Thread by @FrankMcG

At a discussion today on cyber litigation and what you can do to reduce your cyber legal risks.

Almost every breach today comes with a lawsuit or lawsuits. And it’s only growing.

Everything you do, you are producing evidence for when you get breached that will be used against you by prosecutors.

We are needing a federal statute on breach notification. Every state has their own rules and when a breach happens, you have to know the laws of every state regarding notification and ensure you’re following them.

Don’t use the word breach. It’s a damning word and it WILL be used against you. Too many times someone drops the word breach and it ends up that it wasn’t even a breach. Dropping the word is almost an instant admission of guilt.

Good word: “issue”

It doesn’t matter if you’re being diligent. A plaintiff attorney will always accuse you of not being so. Even if you’re following a standard, the attorney will state that the standard is negligent.

When an “issue” happens, don’t write anything down unless you have to. Manage what you’re writing.

Every case almost always comes down to 15-20 emails that determine the case.

When you’re typing an email after an “issue,” decide if it’s something you want to appear in court.

Don’t stop at just internal counsel. Because general counsel typically wears many hats and gives business advice, the basis of attorney-client privilege can be challenged and has in court.

Attorneys will argue that general counsel was giving business advice and not legal advice.

When you retain and use outside counsel, no one can challenge attorney-client privilege because it was obvious that you engaged them for legal risk aid. It will almost never get challenged and even if it was, the precedence is solid.

Example of effective use of outside counsel to retain privilege and keep specific data private and protected under attorney-client privilege.

Someone in audience giving an example that they’re conducting a risk assessment for a client and all of their communication is through the client’s attorneys.

Conducting a risk assessment through attorneys so that data is always protected, even before something happens. Amazing.

If you’re a vendor and you discover something incredibly damning that you think a gross negligence, don’t just email or tell your client. You should retain outside counsel and break the news of your findings through counsel. Or you can be included in a future court case for it.

It’s a daunting task. Having to get an attorney just to talk to someone and having them think any time they have to talk to you, they have to go through a lawyer.

But you should make them realize the major service you’re doing for them. Retaining confidentiality.

Statement: “I have never seen someone win a case because they successfully hid evidence.”

When an “issue” or even potentially happens, get into a room with who’s who and talk about what is going on.

Don’t ever write emails saying you think it’s X. Never guess and never put guesses in writing. You will be held to that in court.

Verbally tell exec’s. Then get counsel.

From set things that you can read and is tangible down to the last bullet which is 🤷🏼‍♂️.