Neil Kirton and Zoë Newman The GC on the Front Line: Corporate Counsel’s Role in Surviving a Company Crisis GLL Global GC Congress Neil Kirton and Zoë Newman September 2018

Agenda Introductions Crisis response Managing an effective investigation Managing outcomes Conclusions

1 Introductions

Introductions Neil Kirton Zoë Newman Managing Director, Business Intelligence and Investigations Managing Director, Business Intelligence and Investigations

Overview Managing a crisis Crises come in all shapes and sizes GCs are often at the centre of a response Companies face high incidences of Fraud, Cyber and Security threats % of respondents encountering an issue in the past year; 2017/18 Kroll Global Fraud & Risk Report

2 Crisis response

Crisis response A crisis unfolds – case study

Crisis response What happened next CEO contacts Head of IT to investigate and they determine that there is likely a security incident as the attached documents were genuine Contacts GC to initiate crisis response GC forms crisis committee; contacts insurers and external advisors Legal PR Incident response investigators Negotiators

Crisis response Immediate agenda for the GC Building crisis management team – internal and external members Business continuity Use of email / compromised systems Recovery of data / availability of backups Bug sweep Technical Surveillance Counter Measures Internal and external communications Insider lists / price sensitive information Internal stakeholders Partners and customers Individuals / Employees Resourcing the incident response – internal vs. external resources Follow-the-sun resourcing?

Crisis response Initial questions to consider Do you have an incident response plan? Which internal stakeholders are involved – who really needs to know? IT/CISO/CIO Data Protection Officer / GC C-suite / shareholders HR / Finance / Operations Which external advisors should be notified External Counsel PR Investigators Do you have insurance? At what point do you involve: law enforcement, regulators, other stakeholders (employees, customers, data subjects)? Budgeting - who pays? Who needs support / managing ? Who could cause problems? What is the role of the GC?

Managing an effective investigation 3 Managing an effective investigation

Managing an effective investigation Conducting the investigation – case study Internal investigation Rule out internal collusion - review of user activities, permissions and communications Identify digital vulnerabilities/compromise Implement cyber resilience strategy External investigation of potential suspect Client identified possible suspect. Subsequent investigation found no evidence to forensically link the suspect to the attack Taking offensive actions Investigation into attacker’s IT infrastructure and recovery of data Cluttering and takedown exercise and monitoring of attacker’s online activities Data review To better understand the extent of the issue and inform notification strategy External communications and regulatory action

Managing an effective investigation Conducting the investigation – issues for the GC Managing/supporting crisis management team Business continuity Insider wrongdoing? Necessary/appropriate actions with HR Remediation steps Engagement with authorities/law enforcement Internal and external communications When and who to notify Data review Speed, accuracy, costs Challenges (multiple pages docs, foreign languages, data types, unusual formats) Legal commercially sensitive information / legal challenges Personal information

Managing an effective investigation Conducting the investigation – questions to consider Who is responsible for the incident? Has the issue been resolved / contained? Can you recover losses? How far do you go?

4 Managing outcomes

GC GC Managing outcomes External communications and regulatory action – case study GC Employees Press Contracted parties Subscribers Suppliers Customers GC

Managing outcomes Managing the tail – issues for the GC Litigation Police action Witness statements Trial and prosecution Notification process Systems and remediation exercises Policies and procedures Training Billing discussions with insurers

Managing outcomes Managing the tail – questions to consider Lessons learned? Are we safe going forward? Do we need to allocate more budget? Are we happy with our external crisis team and/or insurance cover?