Privileged Cybersecurity Investigations – A Checklist for Contracting with Consultants

Your company may suffer a cybersecurity incident that warrants bringing in third-party forensics or other consultants to investigate and report on the cause or consequences of the cyber event or compromise. To seek to protect the third parties’ reports with the work product privilege (and, thus, to avoid having to disclose the reports in litigation) – and to try to side-step the unexpected failure to establish such protection that Capital One recently experienced (In re: Capital One Consumer Data Security Breach Litigation) – do (and don’t do) the following with respect to your contracts with these third parties:

Do have outside counsel be the entity contracting directly with the third party. Have outside counsel pay the third party’s fees, directly. Then, have outside counsel bill you for reimbursement of the fees paid.

Do contract under a specific statement of work or services description that is exclusive to the particular cyber incident.

Do state and expressly limit the purpose of the third party’s services and reports to anticipating litigation arising from the cyber incident. The purpose should not explicitly or implicitly include, for example, financial controls or reporting.

Do require that the third party’s report be in a form and of substance specific to the purpose of anticipating litigation. The report should not mirror what would be provided for reports for other purposes.

Do require the third party to issue formal and informal reports and updates only to the contracting outside counsel. Outside counsel, then, as necessary or appropriate, can distribute further the reports or updates, for example, to select internal stakeholders.

Don’t allow those who receive reports and updates from outside counsel to further distribute the reports or updates, whether internally or externally. Require recipients to explicitly agree to limited use and handling terms, before receiving reports or updates.

Don’t allocate the costs and fees for the third party’s services to any internal billing or cost center other than Legal’s. The costs and fees should be assigned to Legal’s budget. Categorize the costs and fees as “legal” costs and fees, not, for example, cybersecurity or business costs or fees.

And, in the contract with the third-party forensics firm or consultant, do include requirements that the third party conform to all of the applicable above do’s and don’t’s.

Importantly, these are only a few do’s and don’t’s that may help guide many companies to attempt to structure and implement contracts with third-party consultants so as to establish the work product privilege applicable to the third party’s reports. Each company, each cybersecurity incident, and applicable law can vary and be unique, so it is perhaps even more critical for the company to immediately involve inside (or outside) counsel to navigate these thorny issues.

Background – In re: Capital One Consumer Data Security Breach Litigation

The above do’s and don’t’s follow from the recent decision of the U.S. District Court for the Eastern District of Virginia in the above-referenced litigation. Capital One sought to avoid having to disclose the report issued by the cybersecurity forensics firm that it retained in wake of the March 2019 data security breach suffered by the financial company.

In affirming a magistrate judge’s order to compel Capital One to disclose the forensics report, the Virginia federal district court made several observations. Well before the breach (and not specific to the March breach), Capital One had retained the forensics firm under a general SOW, on a retainer basis, to provide a set number of service hours for any one of a broad range of incident response services that might be needed. After the security breach, although the bank’s outside counsel signed a letter agreement with the forensics firm for services with respect to the breach. The terms of the letter agreement provided for the same scope and kind of services, on the same terms and conditions, as the general SOW (except that the forensics firm would work at the direction of the outside counsel and provide the forensics report to the outside counsel).

For performing under the letter agreement, the consultant was first paid from the retainer already provided under the general SOW. Then, Capital One directly paid the balance of the consultant’s fees due under the letter agreement – with funds from Capital One’s internal general cybersecurity budget. Capital One (at least at first) internally identified the fees paid to the consultant as a “business critical” expense – not as a “legal” expense.

During the forensics firm’s investigation, it communicated directly with the bank’s external financial auditors, so that the auditor’s could assess whether the breach impacted the bank’s accounting controls. Many internal and external parties received a copy of the forensics report, but Capital One provided no explanation as to why these recipients received a copy of the report, as to whether the report was provided for business purposes, regulatory reasons, or specifically in anticipation of litigation, or as to any restrictions placed on the recipients’ use, reproduction, or further distribution of the report.

Both the magistrate judge and, on appeal, the district court judge who opined on the matter saw these above facts, among others, as support for finding that the forensic firm’s investigation report was not protected from disclosure by the work product privilege.




Texas Lawyer’s Best Of 2020 Honors Houston’s PMR Law as Best Personal Injury Firm

Founding partner Tej Paranjpe also named to 2020 Texas Trailblazer list

HOUSTON – Houston-based Paranjpe Mahadass Ruemke Law (PMR Law) has earned back-to-back honors from Texas Lawyer magazine, earning a place in the publication’s Best Of 2020 listing as Houston’s best personal injury law firm, while firm co-founder Tej Paranjpe is featured as a Texas Trailblazer.

In the last year, the firm has secured significant settlements and resolutions for a range of clients, including the parents and children of a 28-year-old man involved in a car accident, who died after paramedics improperly intubated him in the stomach instead of the lungs.

In addition, PMR Law is representing nearly 1,000 plaintiffs in a lawsuit against six defendants – including CenterPoint Energy Houston Electric, LLC and Enterprise Products Holdings, LLC – for failing to properly construct a pipeline behind homes in Channelview, Texas, resulting in flooding, structural damage and a decrease in home values. The firm’s case started with fewer than 100 homeowners. The firm is working on a similar case in San Jacinto, Texas.

While the Best Of 2020 honor recognizes the entire PMR trial team, Mr. Paranjpe is singled out among Texas Lawyer’s 2020 Texas Trailblazers, an elite list of practitioners whose contributions to the practice, policy and technological advancement of their profession have made a significant impact.

Paranjpe has handled more than 100 jury trials to verdict in a 10-year legal career. He is lead counsel on the Houston-area pipeline litigation and has been instrumental in building a respected trial team at PMR Law that represents approximately 400 current and active cases.

PMR Law and its attorneys have earned numerous additional legal honors, including Texas Lawyer’s Litigation Department of the Year for products liability and mass torts, Best Lawyers in America “Ones to Watch,” Texas Super Lawyers and Texas Super Lawyers/Rising Stars.

PMR Law is driven by compassion and focused on results. The firm has helped hundreds of clients receive the compensation they deserve in personal injury litigation and business disputes. PMR Law’s priority is to provide personalized attention, professionalism, and tireless representation. Visit: https://pandmllp.com/.




The New Role of General Counsel in Today’s Big Data Privacy Age

Complimentary access to 2020 in-house privacy benchmarking report

Overcoming the economic crisis spurred by the COVID-19 pandemic, along with growing regulatory burdens in 2020 are requiring general counsel to take the reigns and ensure compliance with major data privacy laws.

With responses from representatives of more than 200 small, mid-size, and large businesses, the 2020 In-House Privacy Benchmarking Report is filled with valuable information. You’ll learn:

  • How privacy regulations have affected legal departments so far this year
  • Why legal must ensure privacy compliance
  • Why the need for cross-departmental communication is greater than ever

Download the report.




Three Defendants Charged in Multi-Million Dollar Medicare Fraud Scheme

“Three individuals were charged today in connection with a multi-million dollar Medicare fraud scheme, bringing the total number of defendants to six,” reports the Department of Justice in The United States Attorney’s Office District of Massachusetts.

The three “were each charged by Information with one count of receiving kickbacks in connection with a federal health care program.” Two “were also charged by Information with violating the HIPAA statute.”

The papers claim defendants “sold Medicare patients’ personal and medical data … worked with foreign call centers to contact Medicare patients to ask if they were interested in durable medical equipment (DME) such as arm, back, knee and shoulder braces ‘at little to no cost.’ The call centers collected demographic and insurance information from Medicare patients.” The defendants “received more than $1.6 million… for the patient data.”

Read the article.




DOJ Reached $46M Settlement with 5Dimes for Illegal Sports Betting

“5Dimes and the U.S. Department of Justice reached a $46.8 million settlement of an investigation into illegal US sports betting operations, as well as money laundering and wire fraud,” reports Matthew Waters in Legal Sports Report.

“The company announced an intent to enter the US sports betting market following the deal, although state regulators likely will balk at the long list of criminal activity detailed in the settlement.”

“5D Holdings and owner Laura Varela will forfeit the illegally obtained gambling proceeds as part of a settlement with the US Attorney’s Office Eastern District of Pennsylvania into the criminal investigation of 5Dimes’ offshore operations in Costa Rica.”

Read the article.




Craig Morford Elected General Counsel and Corporate VP Exxon Mobil Corporation

Exxon Mobil Corporation’s “board of directors has elected Craig Morford as vice president and general counsel for the company. Morford is currently deputy general counsel,” reports ExxonMobil in their Newsroom.

“Morford joined ExxonMobil in 2019 as deputy general counsel after previous roles with the United States Department of Justice and in private industry. For more than 20 years, Morford advanced through the Department of Justice with assignments as U.S. Attorney in Michigan and Tennessee, and first assistant U.S. attorney in Ohio. In 2007, he was appointed as Acting Deputy Attorney General by President George W. Bush. From 2008 until joining ExxonMobil, Morford served as the Chief Legal and Compliance Officer for Cardinal Health, a multinational health care services company.”

Read the article.




Facebook Brings Suit against Developers of a Browser Extension That Harvested User Data

Facebook brought suit against two marketing analytics firms alleging the defendants developed and distributed malicious Chrome browser extensions that were essentially designed to scrape users’ data from various social media platforms … “(including Facebook and Instagram), all in contravention of Facebook and Instagram’s terms of service and commercial terms,” reports Jeffrey Neuburger in Proskauer.

“According to the Complaint, the defendants coaxed users to install their UpVoice and Ads Feed extensions by, among other things, offering gift cards in exchange for downloading and suggesting that users would become ‘panelists’ impacting marketing strategies of large companies.”

Read the article.




2nd Circuit Clarifies Important Copyright Law

“Copyright law is found in more than in the copyright code. Courts interpret the code, along with rulings by other courts, and apply it to the circumstances. But courts can disagree with each other, making it difficult to predict the outcome of a copyright infringement case. Fortunately, the 2nd Circuit Court of Appeals recently issued an order clarifying some frequent copyright infringement issues,” writes Carolyn Wright in Photo Attorney.

“Joseph Sohm had entered into agreements with several agencies, including Continuum Productions Corp. (now Corbis Corp.), to issue licenses to third parties on his behalf. In 2004, Corbis entered into a preferred vendor agreement (“PVA”) with Scholastic Inc. that established fees for certain print-run ranges of Sohm’s photos.”

“The issues presented there are important to photographers.”

Read the article.




Practice Pointer: When Should You Send Default and Demand Letters?

“… there are times when a lender will want to start enforcing one or more rights or remedies. In all or almost all jurisdictions in the United States, a lender is required to provide a written notice of default to the borrower and guarantors, and to make a written demand for payment, before exercising any rights or remedies. In many jurisdictions, however, a borrower or a guarantor can waive these requirements in the loan documents, and many loan documents contain such waivers,” writes Cara M. Houck and Steven A. Roach in Miller Canfield’s Resources.

“This begs the question of whether to send a default and demand letter.”

Read the article.




Internet Terms and Conditions: Browsewrap Hyperlink

“The Second Circuit recently addressed this issue in declining to enforce browsewrap terms and conditions containing an arbitration agreement. The decisions in this area show that a hyperlink must be reasonably conspicuous to put a consumer on the requisite inquiry notice to render terms and conditions enforceable,” warns James F. Bogan III in Kilpatrick Townsend’s Insights.

“In Arnaud v. Doctor’s Associates Inc., Luis Arnaud entered his phone number on a promotional page of Subway’s website and clicked a box labeled ‘I’M IN’ to receive a free Subway sandwich the next time he purchased a 32-ounce drink. The promotional page included a hyperlink to terms and conditions that included an arbitration agreement.”

“After Subway allegedly sent Mr. Arnaud an unsolicited text message, he filed a putative class action against Subway alleging violations of the Telephone Consumer Protection Act. Subway moved to compel arbitration, but the district court denied the motion. Subway appealed, but the Second Circuit affirmed.”

Read the article.




Renewables on Tribal Land: Addressing Environmental and Economic Equity on the Path to a Clean Energy Economy

“Demand for renewable energy projects has never been greater,” write Bart J. Freedman, Teresa A. Hill, and Benjamin A. Mayer in K&L Gates’ Global Power Law & Policy.

“The newest, latest trend is the push for renewable energy projects with positive social impacts and benefits to marginalized communities. Indeed, some of the most significant consumers and supporters of renewable and carbon-free power are now making environmental and economic justice a central focus and condition of their use of and investments in clean energy projects. Utility leaders have identified racial justice as a top concern in the transition to a clean energy economy. Key stakeholders and influential civil rights organizations, including the NAACP, have created toolkits and are advocating for just energy policies and practices. The Rocky Mountain Institute announced this summer that it will be launching a residential solar program to expand the use of solar in communities of color. At the same time, clean energy transition legislation throughout the country is accelerating the need for carbon-free resources, including wind, solar, and storage projects, to replace traditional fossil fuel resources, such as coal, oil, and natural gas, to power the grid.”

Read the article.




Gentry Locke Welcomes Partner Jean Mumm

ROANOKE, Va. (Oct. 5, 2020) – The Virginia law firm, Gentry Locke is pleased to announce the arrival of Jean D. Mumm as a partner in the firm’s commercial real estate practice.

With more than 30 years of experience, Mumm brings a deep understanding of commercial real estate, business, and finance transactions.

Most recently, Mumm served as corporate counsel for a leading global real estate investment and management firm, where she managed complex corporate real estate transactions across the U.S. In this role, she prepared documents related to closings, financings, acquisitions, and dispositions.

She has spent much of her legal career in private practice, assisting clients with financings, acquisitions, and dispositions, loan workouts, and forbearance, mergers and acquisitions, defeasance, land use, and development, as well as contract and leasing matters.

Mumm earned her J.D. from the University of Richmond T.C. Williams School of Law where she served on the University of Richmond Law Review and the University of Richmond Moot Court Board. She earned her B.A., cum laude, in mathematics and economics from Bucknell University.




South Florida Lawyer Charged with Fraud Related to 1 Global Capital Investment Scheme

“A Florida attorney and former outside counsel for 1 Global Capital LLC (1 Global), has been charged today with conspiring to commit wire fraud and securities fraud in connection with an investment fraud scheme that, as alleged, impacted more than 3,600 investors in 42 different states, and involved him personally and fraudulently raising more than $100 million from investors,” released the Department of Justice in The United States Attorney’s Office for the Southern District of Florida.

“Andrew Dale Ledbetter, 78, of Fort Lauderdale, Florida, is charged in an information with conspiracy to commit wire fraud and securities fraud. The case is assigned to U.S. District Judge Darrin P. Gayles of the Southern District of Florida.”

“According to the allegations in the information, 1 Global was a commercial lending business based in Hallandale Beach, Florida, that made the equivalent of “pay day” loans with high interest rates to small businesses, termed merchant cash advance loans (MCAs). To fund these loans, 1 Global obtained funds from investors nationwide, offering short-term investment contracts that promised to “place” the investors’ money onto MCAs.”

Read the article.




Bacardi Limited Welcomes Beverage Industry Veteran Todd Grice as General Counsel

“Bacardi Limited, the world’s largest privately held spirits company, today announces the appointment of Todd Grice as Senior Vice President and General Counsel. Grice brings 25 years of legal practice to Bacardi, including the last 18 with The Coca-Cola Company, with extensive business and legal expertise in corporate governance, competition law, securities law, intellectual property, mergers and acquisitions, and commercial transactions. This appointment follows the long-planned retirement of Eduardo Sanchez who served as the company’s SVP and General Counsel for 17 years. Grice will report to Chief Executive Officer Mahesh Madhavan and joins the company’s Global Leadership Team. At Bacardi, Grice will be responsible for legal and government affairs including legal strategy, governance and compliance, strategic transactions, and dispute resolution and regulatory matters,” as posted on Barcardi Limited’s Media.

Read the article.




Sargeant Marine Pleads Guilty to FCPA Charges and Agrees to Pay $16.6M

“The Justice Department announced a guilty plea to FCPA charges by Sargeant Marine, Inc., a privately-owned company, based in Boca Raton, Florida. Sargeant Marine, an asphalt company, plead guilty to one count of conspiracy to violate the anti-bribery provisions of the FCPA and agreed to pay a fine of $16.6 million for bribery schemes in Brazil, Venezuela and Ecuador,” writes Michael Volkov in Volkov’s Blog.

“Between 2010 and 2018, Sargeant Marine paid millions of dollars in bribes to foreign officials in Brazil, Venezuela and Ecuador to secure contracts to purchase or sell asphalt to state-owned and state-controlled oil companies.”

Read the article.




State Gets $1.9 Million as Share of Data Breach Settlement

“Kentucky will receive more than $1.9 million as its share of a settlement with a company over a data security breach that compromised the personal information of 78.8 million Americans,” reports Steve Rogers in WTVQ’s Local News.

“Anthem, Inc. agreed to pay $39.5 million to 43 states and the District of Columbia. Kentucky will receive $1,929,942.02. In addition to the payment, Anthem has also agreed to a series of data security and adequate governance provisions designed to strengthen its practices going forward, according to Attorney General Daniel Cameron, who announced the settlement.”

Read the article.




Fears Nachawati Co-Founders Recognized as Texas Trailblazers

Bryan Fears, Majed Nachawati honored among ‘agents of change’

DALLAS – Bryan Fears and Majed Nachawati, co-founders of Fears Nachawati Law Firm, are among the attorneys heralded as “agents of change” by Texas Lawyer magazine in its 2020 listing of “Texas Trailblazers.”

The pair were selected for their leadership in transforming the North Texas law firm they co-founded in 2006 into one of the top products liability plaintiffs’ firms in the nation. The firm remains focused on high stakes litigation that includes representation of state and public entities on a contingency basis, pharmaceutical and medical device litigation, business-interruption insurance disputes, as well as catastrophic injury and death litigation.

That focus has afforded the firm the ability to pursue causes they believe in. For example, under Mr. Fears’ guidance, the firm has been among the first in the nation to develop a focus on groundwater “forever chemical” contamination by companies such as 3M and DuPont, fighting for safe drinking water for the future generations.

That dedication to justice extends well past the walls of the firm. Mr. Nachawati is a member of The Dallas Bar Association’s Legal Ethics and Lawyer Referral Service Committees and is a member of the Board of Directors of Public Justice. He previously served as the District Chairman for the Grievance Committee for the State Bar of Texas, District 6.

The full list of 2020 Texas Trailblazers can be found in Texas Lawyer magazine’s October/November issue.




Firm Honored in Texas Lawyer Magazine’s Best of 2020 Survey

DALLAS – The trial firm of Lyons & Simmons, LLP, has been selected the top personal injury law firm in Dallas by readers of Texas Lawyer, as presented in the magazine’s “Best of 2020” survey.

Each year since 2013, the editors of Texas Lawyer survey members of the legal community to identify the top industry support companies in Dallas, Houston, and Austin. This year the survey also included three new categories, recognizing the top personal injury, real estate, and family law firms in each city.

“It is a serious responsibility when you represent the victims of catastrophic personal injury and wrongful death. These individuals often face life’s biggest adversity, their lives have been torn apart, and the legal deck is stacked against them,” said firm co-founder Michael Lyons.

Lyons & Simmons’ ownership over clients’ legal outcomes has earned the firm a national reputation for getting remarkable results in big, high-exposure personal injury and wrongful death cases.

Among their notable recent work, the attorneys of Lyons & Simmons successfully represented the family of one of five victims of the worst oilfield accident in Oklahoma history and the deadliest in the U.S. since the 2010 Macondo Deepwater Horizon blowout. The firm’s work helped prompt a review of best practices for land-based drilling operations by the U.S. Chemical Safety Board and brought further attention to dangerous industry practices involving well control management and monitoring.

“We do not, cannot, step back until we do everything we can for our clients and their families,” said firm co-founder Chris Simmons. “When you earn a recognition such as this, you realize it is not just the clients who know and respect your dedication, but your peers as well.”

Results of the “Best of 2020” survey were published in the October/November issue of Texas Lawyer, the longest standing news publication focused on the state’s legal profession, and can be found online at www.texaslawyer.com.




Dallas Attorney Clayton Bailey Recognized as Litigation Star

Co-founder of Bailey Brauer earns Benchmark honor for seventh consecutive year

DALLAS – Trial and appellate attorney Clayton Bailey, co-founder of Dallas-based litigation boutique Bailey Brauer PLLC, has earned “Litigation Star” recognition from Benchmark Litigation for his work in commercial litigation.

Bailey’s selection to the annual guide to the nation’s top lawyers is based upon his competition and antitrust litigation practice and international arbitration work, recognition he has earned consistently since 2015. The 2021 edition of the Benchmark Litigation guide was compiled after months of peer review, client-based research, and a thorough review of attorney casework.

Bailey’s practice focuses on complex tort and commercial litigation matters, saving trial and appellate clients more than $750 million in potential exposure since 2013. His experience includes handling contract disputes, business torts, RICO, employment law, trade secrets, deceptive trade practices, fraud, breach of fiduciary duty, antitrust, unfair business practices, Packers and Stockyards Act, and wrongful death. He also has successfully defended against putative class actions and mass action lawsuits in state and federal district courts throughout the country.

In addition to the Benchmark recognition, his work has earned professional accolades from The Best Lawyers in America, Texas Super Lawyers, BTI Consulting Group, Texas Lawyer magazine, and the National Law Journal. He holds membership in invitation-only professional organizations including The National Trial Lawyers’ Top 100 civil plaintiff lawyers in Texas, the Federal Bar Association, and Litigation Counsel of America.




Jeffrey Simon Honored Among Texas Legal Trailblazers for Work in Ongoing Opioid Litigation

Dallas-based trial lawyer was first in Texas to file lawsuit against opioid drug manufacturers and distributors

DALLAS – In recognition of his leadership role in the state’s ongoing opioid multidistrict litigation (MDL), Simon Greenstone Panatier, P.C., founding partner Jeffrey Simon has been named a 2020 Texas Trailblazer by Texas Lawyer magazine.

Simon serves as chairman of the Texas Opioid MDL Plaintiffs Steering Committee, which seeks to hold drug manufacturers and supply chain corporations responsible for their roles in creating and prolonging the opioid epidemic in Texas.

Prior to the coronavirus outbreak, Simon was selected to be one of the lead attorneys to represent Dallas County in the state’s first opioid trial. That trial has been scheduled for September 2021.

He is a frequent speaker on opioid topics and has served as co-chair of the Opioid Litigation Conference. The seminar, held each of the last three years, brings together leading medical, legal, and law enforcement experts to discuss how to best address and reduce the social and economic devastation of opioid addiction.

The revered toxic tort and pharmaceutical injury litigation attorney is a past president of the Texas Trial Lawyers Association and the Dallas Trial Lawyers Association. He is on the Board of Governors of the American Association for Justice, is a longtime Fellow of the American Board of Trial Advocates, and is a member of the Trial Lawyers for Public Justice.