David Fagan

David Fagan

David Fagan counsels clients on assessing data security practices, developing and implementing information security programs, and complying with federal and state regulatory requirements, as well as on transactional matters involving the transfer of personal data. Mr. Fagan also has been counsel to companies in dozens of data security breach matters, including breaches involving millions of affected consumers.

Subscribe to all posts by David Fagan

White House Releases Vulnerability Equities Policy and Processes

The White House released on November 15, 2017 the Vulnerabilities Equities Policy and Process for the United States Government (“VEP”) — the process by which the Government determines whether to disseminate or restrict information about new, nonpublic vulnerabilities that it discovers.  This release was motivated by criticism following the allegations that significant cyber-attacks have exploited … Continue Reading

A Closer Look at CISA’s Cybersecurity Information-Sharing Provisions

As we reported on October 27, the U.S. Senate passed the Cybersecurity Information Sharing Act (“CISA,” S. 754).  If enacted into law, CISA would, among other things, establish a voluntary framework for the sharing of cybersecurity threat information between and among the federal government and private entities.  CISA must now be reconciled with two similar … Continue Reading

Analysis of President Obama’s Information Sharing Legislation

On Tuesday, President Obama announced his proposal for legislation that would encourage sharing of cyber threat information between the public and private sector by shielding private entities from liability for sharing information on cyber threats. The White House has since released the text of the proposed bill, which includes limitations on liability for private entities … Continue Reading

New State Privacy Laws Go Into Effect on Jan. 1, 2015

State legislators have recently passed a number of bills that impose new data security and privacy requirements on companies nationwide. The laws include new data breach notification requirements, marketing restrictions, and data destruction rules. Below is an overview of the new laws and amendments that will go into effect on January 1, 2015.… Continue Reading

Cybersecurity Regulators (Renew) Focus on Outside Vendors of Financial Institutions

By David Fagan and Sumon Dantiki Recently several media outlets reported that the New York State Department of Financial Services (“NYDFS”) sent a letter to many of the nation’s banks, regarding the “level of insight financial institutions have into the sufficiency of cybersecurity controls of their third-party service providers.”  The letter requested financial institutions to … Continue Reading

New Version of USA Freedom Act Introduced

By David Fagan, Richard Hertling, and Kate Goodloe Senate Judiciary Chairman Patrick J. Leahy introduced a new version of the Uniting and Strengthening America by Fulfilling Rights and Ensuring Effective Discipline Over Monitoring Act of 2014 (the “USA FREEDOM Act” or “Act”) in the Senate on Tuesday, more than two months House of Representatives passed … Continue Reading

House of Representatives Passes Three Cybersecurity Bills

By David Fagan, Richard Hertling, and Sumon Dantiki On July 28, 2014, the U.S. House of Representatives (“House”) passed three cybersecurity bills, the National Cybersecurity and Critical Infrastructure Protection Act of 2014 (H.R. 3696) (“NCCIP Act”), the Critical Infrastructure Research and Development Advancement Act (H.R. 2952) (“CIRDA Act”), and the Homeland Security Cybersecurity Boots-on-the-Ground Act … Continue Reading

Extending Cybersecurity Breach Notice Requirements to Intelligence Community Contractors

By David Fagan, Susan Cassidy, and Catlin Meade As an indicator of the continuing focus of government authorities on cybersecurity breaches and potential notification requirements, certain contractors for the federal government may soon face new rapid reporting requirements for successful network penetrations.  Specifically, President Obama signed the 2014 Intelligence Authorization Act (“2014 IAA”) into law … Continue Reading

Justice Department Allows More Transparency on Government Demands for Customer Information in National Security Investigations

By Jim Garland, David Fagan, and Alex Berengaut On January 27, 2014, the Attorney General and Director of National Intelligence announced that the U.S. government will allow Internet companies and telecommunications providers to disclose more information about government demands for customer data in national security investigations.  The government’s new transparency policy addresses legal demands served … Continue Reading

Supreme Court Hears Oral Argument on Standing Issue in Challenge to FISA Amendments Act of 2008

By Alex Berengaut On Monday, October 29, the Supreme Court heard oral argument in Clapper v. Amnesty International (No. 11-1025), a challenge brought by the American Civil Liberties Union (ACLU) against the FISA Amendments Act (FAA) of 2008.  The FAA amended the Foreign Intelligence Surveillance Act (FISA) of 1978 by authorizing new procedures for electronic … Continue Reading

Responding to a Data Breach: A Short Article on Best Practices

The costs associated with a data security breach can be substantial.   In addition to addressing the security issue that gave rise to the breach, companies often must assess notice obligations under federal and state law, manage public relations challenges, and work to rebuild consumer trust.   The costs–in terms of time and resources–needed to accomplish these … Continue Reading

Senate Holds Hearing on Newly Introduced ‘Cybersecurity Act of 2012’

By David Fagan and Kristen Eichensehr Yesterday, the Senate Committee on Homeland Security and Governmental Affairs held a hearing on the “Cybersecurity Act of 2012.” Senator Joseph Lieberman (I-CT) introduced the bill, S. 2105, on Tuesday with co-sponsors Senators Susan Collins (R-ME), Dianne Feinstein (D-CA), and John D. Rockefeller, IV (D-WV). S. 2105 builds on … Continue Reading

Virginia District Court Issues Significant Ruling Upholding Government Access to Non-Content User Data

by David Fagan and Alex Berengaut On November 10, 2011, Judge Liam O’Grady of the United States District Court for the Eastern District of Virginia issued a 60-page memorandum opinion in a dispute over the validity of a special court order issued to Twitter for non-content records for certain users connected to the government’s Wikileaks … Continue Reading

SEC’s Division of Corporation Finance Issues Guidance on Disclosing Cybersecurity Risks

By David Fagan & Steve Satterfield Yesterday, the SEC’s Division of Corporation Finance issued a guidance document regarding public companies’ disclosure obligations relating to cybersecurity risks and breaches.  The guidance responds to a request by Sen. Jay Rockefeller that the SEC clarify its position on this increasingly important issue.  The Division noted that as companies … Continue Reading

USA PATRIOT Act and the Use of Cloud Services

By David Fagan and Alex Berengaut Enterprises must consider a range of benefits and costs as they evaluate migrating their IT functions and data to cloud-based computing services, including the impact of the cloud services on the security and privacy of their data.  In this regard, one of the principal privacy-based concerns raised in connection … Continue Reading

White House Releases Legislative Proposal on Cybersecurity

By David Fagan and Josephine Liu The Obama Administration today sent Congress its long-awaited legislative proposal for improving U.S. cybersecurity.  The proposal is in the form of individual legislative amendments tackling various issues, packaged together as a comprehensive legislative framework.  As we previously discussed, cybersecurity is a subject of interest in both chambers of Congress.  … Continue Reading

Rep. Rush Reintroduces Data Breach Legislation

By David Fagan & Libbie Canter Last week, Congressman Bobby Rush (D-Ill.) reintroduced the Data Accountability and Trust Act (H.R. 1707).  During the 111th Congress, the House of Representatives approved the same measure by voice vote, but the legislation, introduced in the Senate by Senators Jay Rockefeller (D-WV) and Mark Pryor (D-Ark.), did not make … Continue Reading

Following the Sony Breach

The fallout from the last month’s data breaches of Sony’s PlayStation Network and its Online Entertainment service continued this week.  On Tuesday, Sen. Richard Blumenthal (D-CT) sent a follow-up letter to Sony saying he is “deeply concerned about the egregious inadequacy of Sony’s efforts thus far to notify its customers of these breaches,” and New … Continue Reading

Observations from Cloud Discussions

I’ve recently had the opportunity to participate in or moderate several panels on cloud computing, addressing issues such as governance, security, privacy, and legal liability.   One issue that frequently comes up is whether cloud computing is really new or different.  That depends on how you look at it.  As a legal matter, the model itself … Continue Reading

Goodlatte to Focus on Cybersecurity Legislation

Multiple press outlets are reporting on remarks from Rep. Robert Goodlatte (R-Va.) regarding his intent to take up cybersecurity legislation during the 112th Congress.  In remarks at the 2011 State of the Net Conference, sponsored by the Congressional Internet Caucus, Goodlatte reportedly said that the Judiciary Committee should explore the use of “limited liability protections” as an incentive … Continue Reading
LexBlog