Yesterday, the FTC published a blog post outlining what companies should expect if they find themselves as the subject of an FTC data security investigation. In addition to highlighting the different phases of the FTC’s investigative process, the FTC’s discussed the types of information that it seeks as well as the questions it wants answered. The FTC highlights that it would consider a company’s cooperation with “criminal and other law enforcement agencies in their efforts to apprehend the people responsible for the intrusion” as part of the “steps the company took to help affected consumers[,]” and such cooperation with law enforcement would lead the FTC to “likely . . . view that company more favorably than a company that hasn’t cooperated.” Notably, the FTC does not provide any guidance on what actions qualify as “cooperation with law enforcement” or whether withholding privileged information — such as internal or third-party forensic reports — would be viewed less favorably than a company that discloses such information.
Speaking yesterday at Georgetown Law’s Cybersecurity Institute, Assistant Attorney General Leslie Caldwell referenced the blog post in highlighting the collaboration between the FTC and the Justice Department in forming this policy. In particular, Caldwell referred to the work completed by the Justice Department’s Cybersecurity Unit, a new arm of the Criminal Division created in December 2014. The Cybersecurity Unit is tasked with influencing cybersecurity legislation and ensuring effective utilization of law enforcement resources in prosecuting cybercrime, as well as educating the private sector on lawful cybersecurity practices and the role of law enforcement.
In addition to highlighting the importance of cooperating with law enforcement, the FTC outlines its approach to data security investigations. The post states that the FTC compares “what a company says about its data security practices” to “what it actually does” to determine if the company’s data security practices are “reasonable in light of the sensitivity and volume of consumer information the company holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.” For data breach investigations, the post states that the FTC will often request information on the breach itself, the protections in place at the time of the breach, and the company’s response. As an agency “focused on the security of consumer information entrusted to the company,” the FTC is particularly interested in likely consumer harm resulting from a breach, as well as consumer complaints regarding security issues.