A legal perspective on cybersecurity

We invited Axel because legal expertise on cybersecurity and cyber-incidents is in great demand from the tech-oriented Dutch Cloud Community. Research by Eurostat has shown that an increasing proportion of EU businesses are affected by cybercrime (22 per cent in 2022). Meanwhile, the European Parliament recently passed the Network Information Security Directive II (NIS2), introducing a raft of new cybersecurity provisions. Axel specialises in bridge-building between the technical world of cybersecurity and the parallel legal world.

Figure 1: Axel Arnbak presents at a meeting of the Dutch Cloud Community.

Case numbers are rising

More and more of the cases that land on Axel's desk involve data breaches and security incidents. Poor security on the Internet of Things has been a particularly significant catalyst for incidents in recent years. "Neither the general public nor businesses and other organisations realise that webcams, media players and production machines are like portals that crooks and snoopers can use to get into their homes and premises," says Axel. "Often, what intruders want is your bandwidth: they use your insecure IoT device and millions of other devices like it to force their way through other organisations' defences. Unfortunately, the law doesn't really oblige device manufacturers to make their products secure. Things have to improve!"

Attacks usually begin with phishing

Ransomware is a growing problem as well. In many cases, the way the ransomware gets through an organisation's security is by phishing. Any kind of attack you can think of usually begins with phishing. If you want to protect yourself, it's vital to limit the impact of successful phishing attacks, because it's impossible to prevent an attack ever succeeding. "Paradoxically," says Axel, "the key to defending against phishing isn't to increase awareness. You can get 99 per cent of your people to understand that they mustn't click on a dodgy LinkedIn invitation, but if just one of them does fall for the trick, all your good work is undone. It therefore makes more sense to compartmentalise your IT environment. Of course, you still need to do what you can to keep the bad guys out. But the priority should be on building internal moats, so that raiders can only plunder one little island within your organisation. In every truly crippling cyber-attack I've come across, the fundamental problem has been the absence of internal digital moats. Often, you've got to raise the subject with your IT vendors.

Extensive legal impact

A further complication is that many organisations don't fully appreciate the extent of the legal impact an incident can have. Insurance claims have to be made, third-party damage claims need to be averted, and everything needs to be cleared with the regulator. Every step of the resolution process has to be taken carefully and fully documented. For many members of the audience, including some who had often dealt with security incidents, Axel's presentation was therefore quite an eye-opener.

Axel: "I hope that our technical heroes recognise that cybersecurity has become a multidisciplinary matter. The legal dimension doesn't begin and end with your reporting obligations. You've also got to consider disputes with customers and suppliers, regulators, shareholders, insurers and law enforcement agencies. Lawyers can't do without technical experts, but unfortunately the reverse is also true. And I say that as a nerd. The world I grew up in, where the internet was a playground, no longer exists, I'm afraid."

About Axel Arnbak

Axel Arnbak is a partner at the law firm De Brauw Blackstone Westbroek, columnist at Financieele Dagblad and fellow of the University of Amsterdam's Institute for Information Law (IViR). In 2021, he was one of the '40 under 40′ privacy professionals named by the Global Data Review, and one of Legal500's Rising Stars. His website is https://axelarnbak.nl.

Axel's presentation slides are available to view online.