Guide to Cybersecurity Due Diligence in M&A Transactions

Thomas J. Smedinghoff focuses his practice on legal issues involving digital identity management, privacy, cybersecurity, and electronic business activities. He is internationally recognized for his leadership in addressing emerging digital legal issues, and has been retained to structure and implement first-of-their-kind e-commerce initiatives, and identity management and information security legal infrastructures for the federal government and for national and international businesses.  He assisted in development of the identity management legal infrastructure for PKI browser-based online entity identity (EV SSL), which is designed to resolve rights, responsibilities, and liabilities of participants in the system to allow website users to verify the identity of the company they are dealing with in order to promote secure online commerce. Tom also has been actively involved in developing e-business, e-signature, identity management, and data security legal policy both in the U.S. and globally. As an advisor of the U.S. Delegation to the United Nations Commission on International Trade Law (UNCITRAL), he helped to negotiate the 2022 UNCITRAL Model Law on the Cross-Border Recognition of Identity Management and Trust Services, and the first international treaty that addresses general cross-border e-commerce known as the 2005 United Nations Convention on the Use of Electronic Communications in International Contracts. He currently is working on new UNCITRAL projects to develop legal rules for the use of artificial intelligence in international contracting, and for cross-border data transfers. He previously served as the American Bar Association’s advisor to the Uniform Law Commission committee that drafted the Uniform Electronic Transactions Act in 1999. He also wrote the Illinois Electronic Commerce Security Act enacted in 1998 when he chaired the Illinois Attorney General’s Commission on Electronic Commerce and Crime. He currently chairs the Identity Management Legal Task Force of the ABA Business Law Section, and serves on the ABA Cybersecurity Legal Task Force (which he co-chaired from 2019-2020). A longstanding leader in the ABA Science & Technology Law Section, Tom served as the Section Chair from 1999 to 2000 and the Electronic Commerce Division Chair from 1995 to 2003. In addition to publishing numerous articles on electronic transactions, identity management, privacy, and data security law, Tom is the co-editor of the book Guide to Cybersecurity Due Diligence in M&A Transactions (ABA 2017), author of the book Information Security Law: The Emerging Standard for Corporate Compliance (IT Governance Publishing 2008), and the editor and primary author of the book Online Law (Addison-Wesley, 1996). Based in Chicago, Tom continues to consult on selected legal issues following his 2021 retirement from Locke Lord LLP. Roland Trope is a partner in the New York City offices of Trope and Schramm LLP and an Adjunct Professor in the Departments of Law and of Electrical Engineering and Computer Science at the U.S. Military Academy at West Point, where he has been teaching since 1992. He is Public Liaison on the ABA Cybersecurity Legal Task Force, Vice-Chair of the Intellectual Property Committee for the ABA Public Contracts Law Section and Co-Host for the podcast series, Mind the Gap: Dialogs on Artificial Intelligence, accessible at https://www.americanbar.org/groups/business_law/resources/podcasts/to_the_extent_that/mind-the-gap/. Mr. Trope has a national security practice in which he advises on government procurement, protection and licensing of intellectual property under government contracts, cross-border tech transfers, export controls, economic sanctions regulations, anti-corruption laws, reviews by the Committee on Foreign Investment in the United States (CFIUS), determinations of foreign ownership, control, and influence (FOCI), cyberspace law, cybersecurity, and artificial intelligence. Mr. Trope has over 40 years of experience in cross-border legal transactions representing governments and multi- national corporate clients. He represents high tech companies in the U.S., Canada, Europe and Asia, and U.S. grid owners and operators. He has represented governments in international arbitrations of commercial contracts for design and development of advanced, computer-based systems. His international work includes significant experience in advising Japanese automotive manufacturer and gas/chemical companies, and ministries of defense and aerospace and defense contract clients in Australia, New Zealand, Singapore, Thailand, Japan, the Mideast, Norway, The Netherlands, Brazil and Canada. He has written more than 30 articles and co-authored two books: Checkpoints in Cyberspace: Best Practices for Averting Liability in Cross-Border Transactions and Sailing in Dangerous Waters: A Director’s Guide to Data Governance. He co-edited and was a co-author for the Guide to Cybersecurity Due Diligence in M&A Transactions. He co-authored a chapter in the ABA Cybersecurity Handbook (1st and 2nd editions) and wrote a chapter for the Handbook’s 3rd edition (to be published in January/February 2022). Mr. Trope earned a B.A. from the University of Southern California. As Marshall Scholar and as a Danforth Fellow, he studied English Language and Literature at Oxford University, earning a B.A. and M.A. He earned a J.D. at Yale Law School. He clerked on the Minnesota Supreme Court, and began practicing law in New York City in 1982. Education J.D., Yale Law School, 1980 B.A., M.A., Oxford University, 1972, 1976 B.A., University of Southern California, 1969 Honors Danforth Fellow, Oxford University, 1974 – 1978 Marshall Scholar, Oxford University, 1969 – 1972 U.S. Army Commander’s Award for Public Service, 1994, 2000 Professional Affiliations Adjunct Professor, Department of Electrical Engineering and Computer Science, U.S. Military Academy (since 2018) Adjunct Professor, Department of Law, U.S. Military Academy at West Point (1992 - 2018) Chair, Subcommittee on Artificial Intelligence, New York City Bar Association’s Council on Intellectual Property (since 2021) Co-Chair, Subcommittee on Artificial Intelligence, American Bar Association (“ABA”), Cybersecurity Legal Task Force (since 2021) Member, New York City Bar Association’s Council on Intellectual Property (since 2019) Public Sector Liaison, ABA Cybersecurity Legal Task Force (since 2017) Co-Chair and Co-Host, ABA, Section of Business Law, Podcast Series, Mind the Gap – Dialogs on Artificial Intelligence (published online since May 2022) Steering Committee, ABA Task Force on Cybersecurity (2012 – 2015) Chair, Commission on Defense Procurement, International Society for Military Law and the Law of War (since Board of Directors, International Society for Military Law and the Law of War, (since 2011) Co-Chair, Intellectual Property Committee, ABA Public Contracts Section, (2017 - 2020) Copyright and Literary Property Committee, Association of the Bar of the City of New York, (since 2005) Co-Chair, Cybersecurity Subcommittee, Cyberspace Law Committee, ABA Business Section (2011 - 2020) Fellow of The American Bar Foundation (since 2016) Institute of Electrical and Electronic Engineers (IEEE) (since 1996) Associate Editor, IEEE Security & Privacy (2004 – 2009) Books and Chapters in Books 2022       Duty to Advise Clients Concerning Use of Cyber and Other Digital Technologies, chapter in THE ABA CYBERSECURITY HANDBOOK - A RESOURCE FOR ATTORNEYS, LAW FIRMS & BUSINESS PROFESSIONALS, 3rd Edition, March 2022 2019       AI-Controlled Vehicles: How Will We Frame Thy Fearful Symmetry?, chapter in The Law of Artificial Intelligence and Machine Learning, published by ABA Business Law Section, August 2019 (First Author) 2017       GUIDE TO CYBERSECURITY DUE DILIGENCE IN M&A TRANSACTIONS, book published by ABA, August 2017 (Co- Editor and Contributing Author) Duty to Advise Clients Concerning Use of Cyber and Other Digital Technologies, chapter in THE ABA CYBERSECURITY HANDBOOK - A RESOURCE FOR ATTORNEYS, LAW FIRMS & BUSINESS PROFESSIONALS, 2nd Edition, published by ABA, November 2017 2013       Duty to Advise Clients Concerning Use of Cyber and Other Digital Technologies, chapter in THE ABA CYBERSECURITY HANDBOOK - A RESOURCE FOR ATTORNEYS, LAW FIRMS & BUSINESS PROFESSIONALS, published by ABA, August 2013 2013       Maddening to Militaries and Museums: Why Large-Scale RFID Systems May Lose Track of Objects, chapter in RFIDS, NEAR-FIELD COMMUNICATIONS, AND MOBILE PAYMENTS: A GUIDE FOR LAWYERS, published by ABA, August 2013 2006       SAILING IN DANGEROUS WATERS: A DIRECTOR’S GUIDE TO DATA GOVERNANCE, book published by American Bar Association, 2006 (Co-author) 2005       Checkpoints in Cyberspace: Best Practices for Averting Liability in Cross-Border Transactions, treatise published by American Bar Association, 2005 (First author) Recent Articles 2022       When Security Paradigms Fail, THE BUSINESS LAWYER, to be published in Winter 2022 - 2023 The “New Abnormal” – The Emergence of Persistently Insecure Digital Systems, THE BUSINESS LAWYER, published in Winter 2021 - 2022 2021       What a Piece of Work is AI – Security and AI Developments, THE BUSINESS LAWYER, Winter 2020 - 2021 2020 Whether to Secure, Or Not Secure, Data Integrity – That Is The Question: Cybersecurity Developments May 2018 – May 2019, THE BUSINESS LAWYER, Winter 2019 - 2020 (First Author) 2019       When Incident Response Goes Awry: Cybersecurity Developments May 2017 – May 2018, THE BUSINESS LAWYER, Winter 2018 - 2019 (First Author) 2018       Why Smart Car Safety Depends on Cybersecurity, THE SCITECH LAWYER, Summer 2018 (First Author) Reckoning with the Hacker Age: Cybersecurity Developments, THE BUSINESS LAWYER, Winter 2017 - 2018 (First Author) 2017       The Importance of Cybersecurity Due Diligence in M&A Transactions, BUSINESS LAW TODAY, September 2017 (First Author) Hacking Away at Trust: Significant Developments in Cybersecurity 2015 – 2016, THE BUSINESS LAWYER, Winter 2016 - 2017 (First Author) 2016       Mettle Fatigue: VW's Single-Point-of-Failure Ethics, IEEE SECURITY & PRIVACY, January/February 2016 (First Author) Work in Progress 2023       Co-Author (1st Author) Guide to CFIUS Reviews of Foreign Direct Investments in Companies Designing and Developing Artificial Intelligence and Other Emerging Technologies, ABA Section of Business Law, to be published in 1st Quarter 2023. Recent Presentations and Briefings 2022       Defence Procurements from the U.S.: Detecting and Averting Problematic Outcomes, New Zealand Ministry of Defence, November 2022, Wellington, New Zealand US Trade Control and Foreign Direct Investment Reviews – Working With Our Allies, SAFEGUARDING AUSTRALIA SUMMIT 2022, November 2022, Canberra, Australia US Trade Control and Foreign Direct Investment Reviews – Working With Our Allies, Australia Export Control Council, November 2022, Canberra, Australia Intersection of Government Procurements of AI and Other Emerging Technologies, Intellectual Property Rights, and Security, XXIIND Congress of the International Society on Military Law and the Law of War, Florence, Italy, May 2022 Conservation of Orderly Orbital Operations: Key to Protecting Terrestrial Critical Infrastructure, XXIIND CONGRESS OF THE INTERNATIONAL SOCIETY ON MILITARY LAW AND THE LAW OF WAR, Florence, Italy, May 2022 Thinking Inside the Black Box: AI Due Diligence in M&A Transactions, ABA SECTION OF BUSINESS LAW SPRING MEETING, Atlanta, GA, presentation, April 2022 2021       When OTAs Become Terra Incognita: IP Rights in AI-Augmented Systems under OTAs, ABA Section of PUBLIC CONTRACTS, COMMITTEE ON INTELLECTUAL PROPERTY, Webinar, May 2021 “No bucks, no Buck Rogers”: Negotiating IP Rights Under USG Contracts for AI and Other Emerging Technologies, ASSOCIATION OF THE BAR OF THE CITY OF NEW YORK, Webinar, March 2021 2020       National Security S.H.I.E.L.D., ABA ARTIFICIAL INTELLIGENCE AND ROBOTICS INSTITUTE, Webinar, October 2020 Emergence of Artificial Intelligence as Collaborator, as Creator: An Exploration of the Intersection of AI, IP, and Security, NEW YORK CITY BAR ASSOCIATION, Webinar, June 2020 Cracking the CFIUS Code – Illuminating the New Regulations Implementing the Foreign Investment Risk Review Modernization Act (FIRRMA), ABA BUSINESS LAW SECTION, Webinar, June 2020 Rising Tides of Protectionism? Foreign Direct Investment Regulations Across the Globe, Speaker, ABA SECTION OF INTERNATIONAL LAW, New York City, Webinar, June 2020 Cracking the CFIUS Code – Challenges to IP Rights in CFIUS Reviews of Foreign Direct Investment Transactions, NEW YORK CITY BAR ASSOCIATION, Webinar, May 2020 Embedded Security Risks and Artificial Intelligence, 2020 CYBERSPACE LAW INSTITUTE AND WINTER WORKING MEETING, Phoenix, Arizona, January 2020 2019       Cracking the CFIUS Code – Startup’s Guide to Averting Bad Outcomes in National Security Reviews of Foreign Direct Investment, International Startup and Emerging Growth Forum: Pushing the Boundaries, ABA SECTION OF INTERNATIONAL LAW, San Francisco, California, scheduled for September 2019 Uncle Sam Wants Your Innovations, Not Your Intellectual Property – Strategies for Protecting a Startup’s IP Under Federal Funding Agreements, INTERNATIONAL STARTUP AND EMERGING GROWTH FORUM: PUSHING THE BOUNDARIES, ABA SECTION OF INTERNATIONAL LAW, San Francisco, California, scheduled for September 2019 Is the U.S. Open for Business or Not – CFIUS’ Increasingly Important Role in Cross-Border M&A Deals in Light of New Laws, ABA SECTION OF INTERNATIONAL LAW ANNUAL MEETING, Washington, D.C., April 2019 Artificial Intelligence and the Law, ABA SECTION OF BUSINESS LAW SECTION SPRING MEETING, Vancouver, British Columbia, Canada, March 2019 Guiding Clients Through CFIUS Reviews In the Wake of the Foreign Investment Risk Review Modernization Act of 2018, ABA BUSINESS LAW SECTION SPRING MEETING, Vancouver, British Columbia, Canada, March 2019 Compliance with U.S. Economic Sanctions Regulations, SANCTIONS COMPLIANCE WORKSHOP, Gujarat National Law University, Gandhinagar, Gujarat, India, February 2019 Resilient Cybersecurity for Positioning, Navigation, and Timing Systems, WINTER WORKING MEETING, ABA BUSINESS LAW SECTION, CYBERSPACE LAW COMMITTEE, January 2019 2018       Voices in the Room: Ethical Challenges to Advising Clients on Responding to Cyber Extortion Demands, ABA BUSINESS LAW SECTION ANNUAL MEETING, Austin, Texas, September 2018 Regulating Foreign Direct Investment in the U.S. – Reviews by the Committee on Foreign Investment in the U.S., ABA CONFERENCE ON TRANS-PACIFIC TRANSACTIONS, Singapore, May 2018 Cybersecurity and IP in IoT Devices Installed in Smart Cars, ABA CONFERENCE ON TRANS-PACIFIC TRANSACTIONS, Singapore, May 2018 Averting and Responding to Ethical Crises in Multi-National Enterprises, ABA CONFERENCE ON TRANS-PACIFIC TRANSACTIONS, Singapore, May 2018 Where was the Board? Where were the lawyers? Averting and Responding to Institutional Ethical Crises, ABA SECTION OF INTERNATIONAL LAW SPRING MEETING, New York City, April 2018 Averting Corporate Ethical Crises, ABA Business Law Section, Cyberspace Law Committee, WINTER WORKING MEETING, Atlanta, GA, January 2018 2017       Where was the Board? Where were the lawyers? Averting and Responding to Institutional Ethical Crises, The Ed Sell Lecture, 2017 BUSINESS LAW INSTITUTE, Pennsylvania Bar Institute, Philadelphia, PA, November 2017 Connected Cars, Cybersecurity, and CFIUS, Speaker, ABA BUSINESS LAW SECTION, ANNUAL MEETING, Chicago, September 2017 Avoiding the Next Yahoo!/Verizon: Cybersecurity Due Diligence in M&A Transactions, Speaker, ABA BUSINESS LAW SECTION, ANNUAL MEETING, Chicago, September 2017 From Enron to Volkswagen and Companions: Where were the Boards? The Critical Importance of Governance, Culture, Compliance, and Ethics, Speaker, ABA BUSINESS LAW SECTION, ANNUAL MEETING, Chicago, September 2017 When Companies Go Wrong: Implications for Legal, Speaker, EAST COAST GENERAL COUNSEL FORUM, New York City, September 2017 Connected Cars, Cybersecurity, and CFIUS, Speaker, ABA SCITECH SECTION MEETUP, May 2017 Cybersecurity Due Diligence in M&A Transactions, Speaker, CONFERENCE ON EMERGING LEGAL CHALLENGES IN THE UNITED STATES AND INDIA, Washington, DC, May 2017 Intellectual Property Rights under U.S. Government Contracts, Speaker, CONFERENCE ON EMERGING LEGAL CHALLENGES IN THE UNITED STATES AND INDIA, Washington, DC, May 2017 The New Realities of Dealing with Iran: What Has and Has Not Changed Since Implementation Day and how to Comply without Over-Compliance, ABA SECTION ON INTERNATIONAL LAW SPRING MEETING, Washington, DC, April 2017 When Boards are Confronted by Ethical Crises, PRESENTATION TO WEST COAST CHAIRS ROUNDTABLE, (independent directors of Fortune 500 companies), Menlo Park, California, March 2017 From Enron to Volkswagen: The Critical Importance of Governance, Culture, Compliance, and Ethics, 20TH ANNUAL CORPORATE COUNSEL INSTITUTE: AN INSIDER’S GUIDE TO WASHINGTON, Georgetown University Law Center, Washington, DC, March 2017 When Boards are Confronted by Ethical Crises, PRESENTATION TO EAST COAST CHAIRS ROUNDTABLE (independent directors of Fortune 500 companies), New York, New York, March 2017 Cybersecurity Risks in Connected Vehicle Technologies, ABA Cyberspace Law Committee Winter Working Meeting, San Diego, January 2017 2016     From Enron to Volkswagen: The Critical Importance of Governance, Culture, Compliance, and Ethics, at MEETING OF ASSOCIATION OF CORPORATE DIRECTORS, MINNEAPOLIS, AND AT RETAIL INDUSTRY LEADERS ASSOCIATION LAW CONFERENCE, Atlanta, October 2015 Cybersecurity Due Diligence in M&A Transactions, ABA BUSINESS LAW SECTION MEETING, Montreal, Canada, April 2016 From Enron to Volkswagen: The Critical Importance of Governance, Culture, Compliance, and Ethics, ABA BUSINESS LAW SECTION SPRING MEETING, Montreal, Canada, April 2016 Reviews by the Committee on Foreign Investment in the United States, ABA-SILF Conference, INDIA-UNITED STATES CROSS BORDER INVESTMENT 2.0: COUNSELING IN REFORM ENVIRONMENTS, New Delhi, India, February 2016 Intellectual Property Rights Under U.S. Government Contracts, ABA-SILF Conference, INDIA-UNITED STATES CROSS BORDER INVESTMENT 2.0: COUNSELING IN REFORM ENVIRONMENTS, New Delhi, India, February 2016 Bar Admissions New York (1982) Minnesota (1984) U.S. District Courts for the Southern and Eastern Districts of New York and U.S. Court of Federal Claims