I. Introduction

Following two major cybersecurity events, President Biden issued a sweeping Executive Order on May 12, 2021,[1] reinforcing his commitment that fighting cyberattacks is “a top priority and essential to national and economic security.” The executive action is the latest of the Administration’s efforts on “prevention, detection, assessment, and remediation of cyber incidents,” coming on the heels of the Colonial Pipeline ransomware attack, and just a few months after the SolarWinds breach.

In brief, reports in December 2020 revealed that hackers accessed the systems of SolarWinds, an IT management software company, and implemented malicious code that enabled the hackers to install malware that was used to spy on SolarWinds and its customers, including several U.S. government agencies and many Fortune 500 companies. And in early May 2021, Colonial Pipeline, an oil pipeline system, was targeted by a criminal cybergroup encrypting its system and demanding a ransom. Although aimed at business technology, the attack caused Colonial Pipeline to shut down operations on a major pipeline serving the Northeast, leading to gas shortages and panic buying.

These two high-profile incidents illustrate the reality that cyberattacks are a growing threat facing both the public and private sectors. The scope and incidence of these attacks has grown steadily year over year, with experts from Cybersecurity Ventures estimating that cybercrime will cost $6 trillion globally in 2021 and continue to grow by 15% annually over the next five years.[2] Cyberattacks can have wide-ranging implications, including theft of sensitive personal data, breach of state and trade secrets, and network and power disruptions, so investment in cybersecurity infrastructure is critical.

In light of these threats, the Order is the latest step in the Biden Administration’s commitment to “disrupt and deter our adversaries from undertaking significant cyberattacks.” President Biden’s appointments have signaled his seriousness in this regard — he has appointed a number of experienced cybersecurity professionals to significant roles, including for the newly-created role of National Cyber Director and a Deputy National Security Advisor for Cyber and Emerging Technology (a role that elevated the subject within the Administration). While the Administration has indicated intentions to push for more comprehensive cybersecurity legislation, in the interim, the Order will have a significant impact on the way that federal government agencies and government contractors approach cybersecurity. The Administration intends the Order to also “encourage private sector companies to follow the Federal Government’s lead,” a strategy that had prior success with the widespread adoption of the National Institute of Standards and Technology’s 2014 voluntary cybersecurity framework.

II. Key Provisions of the Executive Order

The Order aims to improve the nation’s cybersecurity and protect federal government networks against sophisticated, malicious cyber activity from both nation-state actors and cyber criminals. As many high-profile cyber incidents have shared risk factors and other commonalities, such as similar cybersecurity vulnerabilities and a lack of robust defenses, the Order focuses on measures likely to have an immediate and wide-ranging impact on critical infrastructure systems, such as strengthening federal network protections, promoting information-sharing between the U.S. government and private sector, and enhancing the ability to respond to incidents. While many federal agencies and contractors already maintain and abide by existing agency-specific cybersecurity measures, the Order establishes additional mechanisms and standards to ensure that all information systems used or operated by federal agencies or contractors “meet or exceed” the cybersecurity standards and requirements set forth in the Order.

The Order aims to spur substantial participation and investment from a diverse array of relevant stakeholders in both the public and private sectors. Although the Order’s requirements apply only to federal agencies and contractors, the Order acknowledges the private sector’s integral role in providing and maintaining domestic critical infrastructure. To this end, the Order expressly encourages the private sector — including entities that are not government contractors — to adopt comparable and ambitious measures to minimize future cyber incidents.

The Order contains eight key components and provisions for modernizing the federal government’s defenses and responses to cyberattacks, which are summarized below.

The Order calls for the review and update of Federal Acquisition Regulation (“FAR”) and Defense Federal Acquisition Regulation Supplement (“DFARS”) requirements to ensure that federal contractors collect, preserve, and share information related to cyber threats and incidents. The anticipated revisions to the FAR and DFARS provisions would also require service providers to collaborate with federal agencies in investigating and responding to incidents or potential incidents. The Order establishes a federal government policy that information and communications technology service providers must promptly report the discovery of cyber incidents to the appropriate federal agencies, and contemplates revisions to the FAR identifying the types of cyber incidents that will trigger such reporting, the types of information to be reported, the time periods within which to report cyber incidents based on a graduated scale of severity, and the types of contractors and service providers to be covered by the proposed language. The Order also contemplates the standardization of agency-specific cybersecurity requirements through the anticipated FAR updates. Furthermore, the Biden Administration has conveyed its expectation that these revised contract terms will spur adoption of the practices by the private sector more broadly.

Sec. 3. Modernizing Federal Government Cybersecurity.

Recognizing that the cyber threat environment is “dynamic and increasingly sophisticated,” the Order identifies necessary steps for modernizing its approach to cybersecurity and ensuring effective defenses, including: (1) adopting security best practices; (2) advancing toward Zero Trust Architecture; (3) accelerating movement to secure cloud services, including Software as a Service (“SaaS”), Infrastructure as a Service (“IaaS”), and Platform as a Service (“PaaS”); (4) centralizing and streamlining access to cybersecurity data to drive analytics for identifying and managing cybersecurity risks; and (5) investing in both technology and personnel to match these modernization goals.

Tools such as multi-factor authentication and encryption for data at rest and in transit, as well as endpoint detection response, logging, and operating in a zero-trust environment, will be rolled out across federal government networks on a tight timeline. The Order also requires the development of cloud-security technical reference architecture documentation that illustrates recommended approaches to cloud migration and data protection, as well as the development and issuance of a cloud-service governance framework. Notably, the Order also requires modernization of the existing FedRAMP program, a government-wide program that delivers a standard approach to the security assessment, authorization, and continuous monitoring of cloud products and services.

Sec. 4. Enhancing Software Supply Chain Security.

The Order also seeks to improve the security of commercial software used by the federal government in three ways. First, the Order calls for the creation of baseline guidelines and standards for the security of software used by the federal government based on industry best practices established by the National Institute of Standards and Technology (“NIST”) with input from “the Federal Government, private sector, academia, and other appropriate actors.” Second, the Order seeks to jumpstart the market for secure software by leveraging federal buying power. The Order requires the FAR Council to consider recommendations for contract language requiring software suppliers to comply with, and attest to complying with, the new software standards. Agencies will then be directed to remove and remediate software products that do not meet the amended FAR requirements. Third, the Order directs NIST to develop a cybersecurity “pilot program” labeling initiative to give consumers visibility into the security of the software.

Sec. 5. Establishing a Cyber Safety Review Board.

The Order establishes a Cyber Safety Review Board composed of both federal officials and representatives from private-sector entities to review and assess threat activity, vulnerabilities, mitigation activities, and agency responses related to “significant” cyber incidents. The Board, which is modeled after the National Transportation Safety Board’s investigations of civil transportation incidents, would convene following significant cyber incidents and provide recommendations for improving cybersecurity and incident response practices.

Sec. 6. Standardizing the Federal Government’s Playbook for Responding to Cybersecurity Vulnerabilities and Incidents.

As current cybersecurity vulnerability and incident response procedures vary across agencies, the Order calls for standardized response processes to “ensure a more coordinated and centralized cataloging of incidents and tracking of agencies’ progress toward successful responses.” The Order mandates that federal agencies work together in the development of a “standard set of operational procedures (playbook)” that incorporates NIST standards, as well as articulates all phases of an incident response while also building in flexibility. The Administration intends for this playbook to “also provide the private sector with a template for its response efforts.”

Sec. 7. Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Networks.

Endpoint detection and response is an emerging technology intended to address the need for continuous monitoring and response to advanced threats. The Order calls for an Endpoint Detection and Response (EDR) initiative to “support proactive detection of cybersecurity incidents within Federal Government infrastructure, active cyber hunting, containment and remediation, and incident response.” Federal adoption of EDR has lagged behind the private sector, which has already begun incorporating it as central component of cybersecurity programs within industry.

Sec. 8. Improving the Federal Government’s Investigative and Remediation Capabilities.

The Order requires “agencies to establish requirements for logging, log retention, and log management, which shall ensure centralized access and visibility for the highest level security operations center of each agency,” and requires that the FAR Council consider the recommendations for these policies in promulgating the revisions to the FAR described in Section 2 of the Order. Therefore, companies should anticipate changes to contractual requirements to establish logging policies.

Sec. 9. National Security Systems.

The Order calls for “National Security Systems requirements that are equivalent to or exceed the cybersecurity requirements set forth in this order that are otherwise not applicable to National Security Systems,” which will be reflected in a National Security Memorandum (“NSM”). Generally speaking, a “national security system” is an information system used or operated by an agency or contractor that involves intelligence activities, cryptologic activities, command and control of military forces, equipment integral to a weapon or weapons system, or that is critical to the fulfilment of military or intelligence missions.

III. Analysis and Takeaways

Among the many takeaways from the Order, the most noteworthy is the expected and intended impact beyond federal agencies and contractors, given the express goal of influencing the broader private sector’s cybersecurity best practices. The Order’s ultimate impact will largely be shaped by the regulations issued in the coming months to comply with these new requirements.

The Order contemplates an aggressive timeline for these reforms, with deadlines ranging between 45 and 120 days for agencies to begin implementing many of the Order’s key requirements.
Many of these requirements have already been established as common or best practices in the private sector, but widespread adoption by federal agencies may encourage additional private sector businesses to conform to these standards.
With the forthcoming guidelines, private companies — regardless of whether they intend to pursue federal contracts — may see a new “best practice” to which its own standards will be compared and evaluated. As a result, the requirements promulgated in response to the Order could impact what amounts to “reasonableness” and the duty of care for civil liability.
The Order’s recognition of the need for collaboration and cooperation between the federal government and the private sector creates an opportunity for input from private sector stakeholders. Industry should monitor forthcoming rulemakings to implement the Order and consider opportunities to comment.

The legal issues and obligations related to Executive Order 14028, entitled “Improving the Nation’s Cybersecurity,” are likely to shift as federal agencies implement its provisions. We will continue to monitor and advise on developments to stay on the forefront of this rapidly-changing area. We are available to guide companies through these and related issues. Please do not hesitate to contact us with any questions.

____________________

[1] See Exec. Order No. 14,028, 86 Fed. Reg. 26,633 (May 12, 2021).

[2] Steve Morgan, Cybercrime To Cost The World $10.5 Trillion Annually By 2025, Cybercrime Magazine (Nov. 13, 2020), https://cybersecurityventures.com/cybercrime-damage-costs-10-trillion-by-2025/.

This alert was prepared by Alexander H. Southwell, Eric D. Vandevelde, Ryan T. Bergsieker, Lindsay M. Paulin, Jennifer Katz and Terry Y. Wong.

Gibson Dunn lawyers are available to assist in addressing any questions you may have about these developments. Please contact the Gibson Dunn lawyer with whom you usually work in the firm’s Privacy, Cybersecurity and Data Innovation or Government Contracts practice groups, or the following authors:

Alexander H. Southwell – New York (+1 212-351-3981, asouthwell@gibsondunn.com)
Eric D. Vandevelde – Los Angeles (+1 213-229-7186, evandevelde@gibsondunn.com)
Ryan T. Bergsieker – Denver (+1 303-298-5774, rbergsieker@gibsondunn.com)
Lindsay M. Paulin – Washington, D.C. (+1 202-887-3701, lpaulin@gibsondunn.com)
Jennifer Katz – New York (+1 212-351-4066, jkatz@gibsondunn.com)

Privacy, Cybersecurity and Data Innovation Group:

United States
Alexander H. Southwell – Co-Chair, PCDI Practice, New York (+1 212-351-3981, asouthwell@gibsondunn.com)
S. Ashlie Beringer – Co-Chair, PCDI Practice, Palo Alto (+1 650-849-5327, aberinger@gibsondunn.com)
Debra Wong Yang – Los Angeles (+1 213-229-7472, dwongyang@gibsondunn.com)
Matthew Benjamin – New York (+1 212-351-4079, mbenjamin@gibsondunn.com)
Ryan T. Bergsieker – Denver (+1 303-298-5774, rbergsieker@gibsondunn.com)
David P. Burns – Washington, D.C. (+1 202-887-3786, dburns@gibsondunn.com)
Nicola T. Hanna – Los Angeles (+1 213-229-7269, nhanna@gibsondunn.com)
Howard S. Hogan – Washington, D.C. (+1 202-887-3640, hhogan@gibsondunn.com)
Robert K. Hur – Washington, D.C. (+1 202-887-3674, rhur@gibsondunn.com)
Joshua A. Jessen – Orange County/Palo Alto (+1 949-451-4114/+1 650-849-5375, jjessen@gibsondunn.com)
Kristin A. Linsley – San Francisco (+1 415-393-8395, klinsley@gibsondunn.com)
H. Mark Lyon – Palo Alto (+1 650-849-5307, mlyon@gibsondunn.com)
Karl G. Nelson – Dallas (+1 214-698-3203, knelson@gibsondunn.com)
Ashley Rogers – Dallas (+1 214-698-3316, arogers@gibsondunn.com)
Deborah L. Stein – Los Angeles (+1 213-229-7164, dstein@gibsondunn.com)
Eric D. Vandevelde – Los Angeles (+1 213-229-7186, evandevelde@gibsondunn.com)
Benjamin B. Wagner – Palo Alto (+1 650-849-5395, bwagner@gibsondunn.com)
Michael Li-Ming Wong – San Francisco/Palo Alto (+1 415-393-8333/+1 650-849-5393, mwong@gibsondunn.com)
Cassandra L. Gaedt-Sheckter – Palo Alto (+1 650-849-5203, cgaedt-sheckter@gibsondunn.com)

Europe
Ahmed Baladi – Co-Chair, PCDI Practice, Paris (+33 (0)1 56 43 13 00, abaladi@gibsondunn.com)
James A. Cox – London (+44 (0) 20 7071 4250, jacox@gibsondunn.com)
Patrick Doris – London (+44 (0) 20 7071 4276, pdoris@gibsondunn.com)
Kai Gesing – Munich (+49 89 189 33-180, kgesing@gibsondunn.com)
Bernard Grinspan – Paris (+33 (0)1 56 43 13 00, bgrinspan@gibsondunn.com)
Penny Madden – London (+44 (0) 20 7071 4226, pmadden@gibsondunn.com)
Michael Walther – Munich (+49 89 189 33-180, mwalther@gibsondunn.com)
Alejandro Guerrero – Brussels (+32 2 554 7218, aguerrero@gibsondunn.com)
Vera Lukic – Paris (+33 (0)1 56 43 13 00, vlukic@gibsondunn.com)
Sarah Wazen – London (+44 (0) 20 7071 4203, swazen@gibsondunn.com)

Asia
Kelly Austin – Hong Kong (+852 2214 3788, kaustin@gibsondunn.com)
Connell O’Neill – Hong Kong (+852 2214 3812, coneill@gibsondunn.com)
Jai S. Pathak – Singapore (+65 6507 3683, jpathak@gibsondunn.com)

Government Contracts Group:
Dhananjay S. Manthripragada – Los Angeles (+1 213-229-7366, dmanthripragada@gibsondunn.com)
John W.F. Chesley – Washington, D.C. (+1 202-887-3788, jchesley@gibsondunn.com)
Joseph D. West – Washington, D.C. (+1 202-955-8658, jwest@gibsondunn.com)
Lindsay M. Paulin – Washington, D.C. (+1 202-887-3701, lpaulin@gibsondunn.com)
Justin Paul Accomando – Washington, D.C. (+1 202-887-3796, jaccomando@gibsondunn.com)

Attorney Advertising: The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.

Decided May 17, 2021

CIC Services, LLC v. IRS, No. 19-930

Today, the Supreme Court unanimously held that the Anti-Injunction Act does not bar pre-enforcement judicial review of reporting mandates enforced by tax penalties, at least when a mandate is also enforced by criminal punishment.

Background:
CIC Services, LLC advises companies that create and use “captive insurers” to fill gaps in third-party insurance coverage. In 2016, the IRS issued Notice 2016-66, which imposes reporting and recordkeeping requirements for taxpayers and tax advisors involved in captive-insurance transactions—transactions the IRS believes can facilitate tax avoidance. If taxpayers or advisors violate these requirements, they face hundreds of thousands of dollars in civil tax penalties; for willful violations, they face criminal punishment, including imprisonment. CIC filed a pre-enforcement suit to challenge Notice 2016-66 under the Administrative Procedure Act, arguing that the IRS should have promulgated the Notice through notice-and-comment rulemaking, and that the Notice was arbitrary and capricious because it was issued without a proven need.

The Sixth Circuit held that CIC’s suit was barred by the Anti-Injunction Act, which prohibits suits “for the purpose of restraining the assessment or collection of any tax.” 26 U.S.C. § 7421(a). Because the Notice is enforced by a tax penalty, the Sixth Circuit ruled, CIC’s challenge to the Notice necessarily seeks to restrain the assessment or collection of that tax.

Issue:
Whether the Anti-Injunction Act bars pre-enforcement challenges to reporting mandates enforced by tax penalties.

Court’s Holding:
The Anti-Injunction Act does not bar pre-enforcement challenges to reporting requirements enforced by tax penalties that also impose independent legal obligations enforced by criminal punishment, such that the only alternative way of challenging the reporting mandate—violating it, paying the penalty, and then suing for a refund—requires committing a crime.

A suit “to enjoin a standalone reporting requirement, whose violation may result in both tax penalties and criminal punishment … is not a suit ‘for the purpose of restraining the [IRS’s] assessment or collection’ of a tax, and so does not trigger the Anti-Injunction Act.”

Justice Kagan, writing for the Court

What It Means:

Tax advisors may bring pre-enforcement challenges to standalone tax-reporting and other requirements that are backed by both tax penalties and criminal punishment, where the challenge is to the reporting mandate itself, rather than a challenge to the tax penalty imposed for violating that mandate. In these situations, tax advisors do not have to risk criminal liability by violating a mandate before they can challenge its legality.
The Court’s decision will make it easier to obtain judicial review of the IRS’s position that it can use informal guidance—as opposed to rules that go through the notice-and-comment process—to impose information reporting requirements on third parties. This could restrict the agency’s ability to gather information that is indirectly related to the computation of tax.
Now that CIC’s suit can proceed, if on remand the courts rule that Notice 2016-66 should have gone through notice-and-comment rulemaking or is arbitrary and capricious, this could pave the way for similar challenges to other IRS information reporting requirements.
Justice Kavanaugh wrote separately to observe that the Court’s focus on the objective purpose of a pre-enforcement suit aligns with the text of the Anti-Injunction Act and that the Court’s ruling narrows previous decisions suggesting that pre-enforcement suits are barred if they would have the effect of preventing the assessment or collection of a tax. Put another way, what matters is whether the plaintiff seeks relief from a legal obligation imposed by the challenged mandate that is separate and independent from the tax penalty.
Although the Court did not distinguish suits brought by taxpayers from those brought by tax advisors like CIC, Justice Sotomayor wrote separately to suggest that the outcome might have been different had the plaintiff been a taxpayer. This issue likely will be presented in future litigation if the Government attempts to cabin the ruling to tax advisors.

The Court’s opinion is available here.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding developments at the Supreme Court. Please feel free to contact the following practice leaders:

Appellate and Constitutional Law Practice

Allyson N. Ho
+1 214.698.3233
aho@gibsondunn.com

Mark A. Perry
+1 202.887.3667
mperry@gibsondunn.com

Lucas C. Townsend
+1 202.887.3731
ltownsend@gibsondunn.com

Bradley J. Hamburger
+1 213.229.7658
bhamburger@gibsondunn.com

Related Practice: Tax

Sandy Bhogal
+44 (0) 20 7071 4266
sbhogal@gibsondunn.com

Eric B. Sloan
+1 212.351.2340
esloan@gibsondunn.com

Dora Arash
+1 213.229.7134
darash@gibsondunn.com

Related Practice: Administrative Law and Regulatory Practice

Helgi C. Walker
+1 202.887.3599
hwalker@gibsondunn.com

Eugene Scalia
+1 202.955.8210
escalia@gibsondunn.com

Decided May 17, 2021

BP plc v. Mayor & City Council of Baltimore, No. 19-1189

Today, the Supreme Court held 7-1 that appellate courts have jurisdiction to review all grounds for removal in a remand order so long as removal is premised in part on the federal-officer removal statute or the civil-rights removal statute.

Background:
The Mayor & City Council of Baltimore sued energy companies in Maryland state court, seeking to hold them liable under state tort law for harms attributable to global climate change. Defendants removed the action, asserting (among other things) federal-question jurisdiction, federal-officer removal jurisdiction, and Outer Continental Shelf Lands Act jurisdiction. The district court granted the City’s motion to remand, rejecting each of Defendants’ grounds for removal. Defendants appealed.

Under 28 U.S.C. 1447(d), “[a]n order remanding a case to the State court from which it was removed is not reviewable on appeal or otherwise, except that an order remanding a case to the State court from which it was removed pursuant to section 1442 [federal-officer removal] or 1443 [civil rights] of this title shall be reviewable by appeal or otherwise.” The Fourth Circuit acknowledged that the Supreme Court had interpreted similar language in 28 U.S.C. 1292(b) to confer appellate jurisdiction over the entire order, rather than particular reasons for the order, and that the Seventh Circuit had relied on that authority in holding that 28 U.S.C. 1447(d) authorizes appellate courts to review any issue in a remand order so long as removal was premised in part on the federal-officer removal statute or the civil-rights removal statute. But the court concluded that those decisions were insufficient to abrogate preexisting Circuit authority interpreting 28 U.S.C. 1447(d) as conferring appellate jurisdiction over only the enumerated grounds for removal.

The Fourth Circuit affirmed the district court’s conclusion that removal was improper under the federal-officer removal statute, and otherwise dismissed for lack of appellate jurisdiction.

Issue:
Does 28 U.S.C. 1447(d) permit courts of appeals to review any issue encompassed in a district court’s order remanding a removed case to state court where the removing defendant premised removal in part on the federal-officer removal statute, 28 U.S.C. 1442, or the civil-rights removal statute, 28 U.S.C. 1443?

Court’s Holding:
Yes. The plain meaning of the term “order” refers to “a ‘written direction or command delivered by … a court or judge,’” and neither legislative history nor policy support limiting the scope of appellate review to particular issues contained in such an order.

“[W]hen a district court’s removal order rejects all of the defendants’ grounds for removal, §1447(d) authorizes a court of appeals to review each and every one of them.”

Justice Gorsuch, writing for the Court

What It Means:

A defendant that asserts multiple grounds for removal will be able to secure appellate review from a remand order with respect to all grounds, so long as at least one of those grounds is appealable (such as the federal-officer removal statute or the civil-rights removal statute).
The Court’s ruling may create opportunities for state-court defendants to test new theories supporting federal jurisdiction. The Court noted that the prospect of sanctions or the award of costs and expenses (including attorneys’ fees) for frivolously removing a case to federal court should deter gamesmanship.
The Court’s reasoning may have broader implications for statutory interpretation. First, the Court emphasized that the presumption that statutory exemptions should be read narrowly does not give courts license to give those exemptions anything but a fair reading. Second, it held that Congress did not ratify the more limited interpretation of 28 U.S.C. 1447(d) adopted by lower courts when it subsequently amended the statute without changing its use of the term “order,” because the statutory text was clear.

The Court’s opinion is available here.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding developments at the Supreme Court. Please feel free to contact the following practice leaders:

Appellate and Constitutional Law Practice

Allyson N. Ho
+1 214.698.3233
aho@gibsondunn.com

Mark A. Perry
+1 202.887.3667
mperry@gibsondunn.com

Theodore J. Boutrous, Jr.
+1 213.229.7804
tboutrous@gibsondunn.com

Lucas C. Townsend
+1 202.887.3731
ltownsend@gibsondunn.com

Bradley J. Hamburger
+1 213.229.7658
bhamburger@gibsondunn.com

Thomas G. Hungar
+1 202.887.3784
thungar@gibsondunn.com

The SPAC boom has resulted in more than 400 SPACs searching for targets. The SEC has opened investigations and issued a string of warnings about potential risks associated with companies going public through mergers with SPACs. Civil litigation has been growing. This webcast will provide the latest update on the state of the SPAC market, recent SEC guidance on SPACs, the issues that sponsors, boards, underwriters, advisers and auditors should be considering in connection with SPAC IPOs, de-SPAC transactions, disclosures, and strategies for mitigating the regulatory and litigation risk.

View Slides (PDF)

PANELISTS:

Evan M. D’Amico is a partner in Gibson Dunn’s Washington, D.C. office, where his practice focuses primarily on mergers and acquisitions. Mr. D’Amico advises companies, private equity firms, boards of directors and special committees in connection with a wide variety of complex corporate matters, including mergers and acquisitions, asset sales, leveraged buyouts, spin-offs and joint ventures. He also has experience advising issuers, borrowers, underwriters and lenders in connection with financing transactions and public and private offerings of debt and equity securities. Mr. D’Amico has particular expertise in advising special purpose acquisition companies (SPACs), operating companies and investors in connection with SPAC business combinations and financing transactions.

Brian Lutz is a partner in Gibson Dunn’s San Francisco where he is Co-Chair of the Firm’s National Securities Litigation Practice Group. Mr. Lutz has experience in a wide range of complex commercial litigation, with an emphasis on corporate control contests, securities litigation, and shareholder actions alleging breaches of fiduciary duties. He represents public companies, private equity firms, investment banks and clients across a variety of industries, including bio-pharma, tech, finance, retail, health care, energy, accounting and insurance.

Mark Schonfeld is a partner in Gibson Dunn’s New York office, and Co-Chair of Gibson Dunn’s Securities Enforcement Practice Group. Mr. Schonfeld’s practice focuses on the representation of financial institutions, public companies, hedge funds, accounting firms and private equity firms in investigations conducted by the Securities and Exchange Commission (SEC), Department of Justice (DOJ), States Attorneys General, Financial Industry Regulatory Authority (FINRA) and other regulatory organizations. Mr. Schonfeld also conducts internal investigations and counsels clients on compliance and corporate governance matters.

Lori Zyskowski is a partner in the New York office and Co-Chair of the firm’s Securities Regulation and Corporate Governance practice. She was previously Executive Counsel, Corporate, Securities & Finance at GE. She advises clients, including public companies and their boards of directors, on a wide variety of corporate governance and securities disclosure issues, and provides a unique perspective gained from over 12 years working in-house at S&P 500 corporations.

Gerry Spedale is a partner in Gibson Dunn’s Houston office where he has a broad corporate practice, advising on mergers and acquisitions, joint ventures, capital markets transactions and corporate governance. He has extensive experience advising public companies, private companies, investment banks and private equity groups actively engaging or investing in multiple industries, including the energy industry. His over 20 years of experience covers a broad range of the energy industry, including upstream, midstream, downstream, oilfield services, utilities and renewables.

MODERATOR:

Stephen Glover is a partner in the Washington, D.C. office and Co-Chair of the firm’s Mergers and Acquisitions Practice Group. Mr. Glover has an extensive practice representing public and private companies in complex mergers and acquisitions, including SPACs, spin-offs and related transactions, as well as other corporate matters. Mr. Glover’s clients include large public corporations, emerging growth companies and middle market companies in a wide range of industries. He also advises private equity firms, individual investors and others.

MCLE CREDIT INFORMATION:

This program has been approved for credit in accordance with the requirements of the New York State Continuing Legal Education Board for a maximum of 1.5 credit hours, of which 1.5 credit hours may be applied toward the areas of professional practice requirement.

This course is approved for transitional/non-transitional credit. Attorneys seeking New York credit must obtain an Affirmation Form prior to watching the archived version of this webcast. Please contact CLE@gibsondunn.com to request the MCLE form.

Gibson, Dunn & Crutcher LLP certifies that this activity has been approved for MCLE credit by the State Bar of California in the amount of 1.5 hours.

California attorneys may claim “self-study” credit for viewing the archived version of this webcast. No certificate of attendance is required for California “self-study” credit.

London partner Benjamin Fryer and associate Bridget English are the authors of the “United Kingdom” [PDF] chapter in Taxation of Crypto Assets published by Wolters Kluwer on November 13, 2020.

Reprinted from Taxation of Crypto Assets, (November 2020), (p683-710) with permission of Kluwer Law International.

The 17th amendment of the Foreign Trade and Payments Ordinance (“AWV amendment”) came into effect in the first week of May 2021. It marks the third fundamental revision of the German FDI regime since April 2020. FDI scrutiny in Germany therefore continues to witness a significant amount of attention.

Summary

Almost 20 new business sectors, for which a mandatory cross-sector filing may be required, are added to the existing regime. These include: satellite systems, artificial intelligence, robots, autonomous driving/unmanned aircrafts, quantum mechanics, and critical raw materials.
In these newly covered business sectors, a mandatory filing is triggered if 20% or more of the voting rights in the German target are to be acquired by a non-EU/EFTA investor. This is higher than the 10% threshold that applies to the business sectors covered by the regime before the most recent changes.
One of the main goals of the reform is to mirror in national law the protection of the specific sectors mentioned in Art. 4(1) Regulation (EU) 2019/452 (“EU Screening Regulation”) and to further clarify the delineation of these sectors.
Investments in the defence sector also face a broader range of mandatory sector-specific filing obligations.
In addition, an ex officio review can now also be triggered if certain control rights are acquired.

Background

On 30 April 2021, the AWV amendment was published in the Federal Gazette and came into effect the day after. The German Ministry of Economic Affairs and Energy (“BMWi”) had published a draft of the amendment in January 2021, which was open for public consultation. The AWV amendment follows two earlier revisions to the German FDI regime in 2020 which were triggered by the COVID-19 pandemic as well as the EU Screening Regulation. FDI regimes across the globe, in particular in EU Member States, such as Austria, France, Italy, and Spain have seen substantial expansion in recent months.

Overview

The AWV amendment is mainly driven by the aim of reflecting in national law the categories of critical technologies and activities mentioned in Art. 4(1) of the EU Screening Regulation. By its nature, the EU Screening Regulation has a directly binding effect so that a transposition into national law is not formally required. However, the EU Member States are not obliged to consider these categories as a ground for a mandatory filing and have some discretion with respect to their implementation. The German regulator has added almost twenty critical sectors to the list.

In more detail:

Cross-sector review increased significantly

The AWV amendment expands the cross-sector review significantly and introduces a new investment threshold. A mandatory filing in the newly covered business sectors is only triggered if a non-EU/EFTA investor acquires 20% or more of the voting rights in a German target. The 10% threshold remains the applicable threshold for the business sectors previously covered. The “new” business sectors include:

developers or manufacturers of filter materials that are suitable as a starting material for respirators or medical face masks;
operators of a high-quality earth remote sensing system (e. satellites);
developers or manufacturers of goods which solve specific application problems by means of artificial intelligence and are capable of independently optimizing their algorithm, and which can be used inter alia to carry out cyber-attacks or imitate individuals in order to distribute targeted disinformation;
developers or manufacturers of motor vehicles or unmanned aircrafts;
developers or manufacturers of specific industrial robots;
developers, manufacturers or refiners of micro- or nanoelectronics, including their components;
developers or manufacturers of specific security-relevant IT products or components of such products;
operators of an air carrier with an EU operating license or developers or manufacturers of goods mentioned in subcategories 7A, 7B, 7D, 7E, 9A, 9B, 9D, or 9E of Annex I of Regulation (EC) No 428/2009 (“Dual-Use Regulation”) or goods or technology intended for use in space or for use in space infrastructure systems;
developers, manufacturers, modifiers or users of goods of category 0 or of list headings 1B225, 1B226, 1B228, 1B231, 1B232, 1B233 or 1B235 of Annex I to Dual-Use Regulation;
developers or manufacturers of specific goods or components for such goods using quantum mechanics;
developers or manufacturers of goods with which components of metallic or ceramic materials are produced by means of additive manufacturing processes;
developers or manufacturers of goods specifically for the operation of wireless or wireline data networks;
manufacturers of (components of) smart meter gateways;
employers of persons who work in vital facilities at safety-sensitive locations;
processors or refiners of raw materials or ores that have been defined in the list of critical raw materials;
developers or manufacturers of goods within the scope of protection of a patent classified or a utility model classified; and
a German undertaking which is of fundamental importance for food safety and directly or indirectly manages an agricultural area of more than 10,000 hectares.

Scope of sector-specific review also broadened

In addition, Section 60 of the AWV amendment expands the sector-specific review and now includes a reference to the entire part 1, section A of the export list [Ausfuhrliste]. It also captures developers or manufacturers or modifiers of goods in the field of defence technology, and those who have actual control over such goods which are within the scope of protection of a patent classified or a utility model classified. Both cases also apply to undertakings which have developed, produced or modified or had actual control over the respective goods in the past and which still have knowledge or other access to the underlying technology.

The acquisition of certain control rights opens the scope for ex officio investigations

The scope of the FDI review now also extends to acquisitions of control rights. Section 56(3) of the AWV amendment provides that the regime also applies to acquisitions of effective control over a German target, even if the voting rights threshold of 25% is not exceeded. This is particularly the case if an acquisition of voting rights is accompanied by (i) the guarantee of additional seats or majorities in supervisory bodies or in the management; (ii) the granting of veto rights in strategic business or personnel decisions; or (iii) the granting of information rights. Such rights must go beyond the influence which would ordinarily result from a 25% stake.

Increasing shareholding may trigger another filing obligation

The AWV amendment also clarified that share increases may lead to new filing obligations. If, for example, a non-EU/EFTA investor initially acquired 10% in a German target which operates a critical infrastructure and intends to increase its stake to 25%, 40%, 50%, or 75% (25%, 40%, 50%, or 75% in case of the 20% threshold for “new” business sectors, respectively) a mandatory filing is triggered.

Conclusion

The decision of the German regulator to introduce specific business sectors instead of referring to the broad categories mentioned in the EU Screening Regulation promotes legal certainty. However, it also significantly increases the regulatory burden for inbound M&A. First, the business sectors now covered by the German FDI regime will often require a sophisticated qualitative filing assessment. Secondly, since the categories of control are rather vague, a voluntary filing (to obtain a certificate of non-objection) will more often be considered as the only prudent course.

In light of this, investors should analyse potential FDI filing requirements at an early stage to avoid any time constraints impeding the completion of the transaction.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding the issues discussed in this update. For further information, please feel free to contact the Gibson Dunn lawyer with whom you usually work, any member of the team in Frankfurt or Munich, or the following authors:

Georg Weidenbach (+49 69 247 411 550, gweidenbach@gibsondunn.com)
Michael Walther (+49 89 189 33 180, mwalther@gibsondunn.com)
Wilhelm Reinhardt (+49 69 247 411 520, wreinhardt@gibsondunn.com)
Linda Vögele (+49 69 247 411 536, lvoegele@gibsondunn.com)
Jan Vollkammer (+49 69 247 411 551, jvollkammer@gibsondunn.com)

Attorney Advertising: The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.

Washington, D.C. partner Joshua Lipshutz and Los Angeles associate Thomas Cochrane are the authors of “Ruling sets up worker classification test for high court review,” [PDF] published by the Daily Journal on May 5, 2021.

Dallas associate Michael Cannon is the author of “The Clean Energy Revolution: Renewable Energy Tax Incentives and Issues” [PDF] published by Tax Notes Federal on April 12, 2021.

New York partner Joel Cohen, London partner Sacha Harber-Kelly and London associate Steve Melrose are the authors of “Why Corporations Should Rethink How They Evaluate Deferred Prosecution Agreements,” [PDF] published by the New York Law Journal on May 6, 2021.

Washington, D.C. partner Mark Perry and Los Angeles partner Perlette Michèle Jura are the authors of the “United States” [PDF] chapter in Appeals 2021 published by Lexology in May 2021.

London partners Doug Watson and Patrick Doris and associate Daniel Barnett are the authors of the “United Kingdom” [PDF] chapter in Appeals 2021 published by Lexology in May 2021.

Join our panelists for a discussion of cap and trade programs in the United States and Europe, and a forecast of what to expect for a U.S. carbon market under the Biden administration. The panel will cover the potential for federal action by the new administration as well as the existing cap and trade systems of California, the Regional Greenhouse Gas Initiative, and the EU Emissions Trading System, including lessons learned and key takeaways from these existing systems.

View Slides (PDF)

PANELISTS:

Lena Sandberg is a partner in the Brussels office where she is a member of the firm’s Energy Group. Ms. Sandberg’s practice covers all aspects of competition law, including subsidies (State aid) and she has extensive regulatory experience in the energy and environmental sectors, including gas, renewables, electricity production and transmission, carbon emission reduction schemes and hydrogen. Prior to joining Gibson Dunn, Ms. Sandberg served as Senior Officer in the Competition and State Aid Directorate at the EFTA Surveillance Authority, where she covered complex questions in the energy and environmental area particularly in the field of the EU Emissions Trading Scheme, renewable energy, energy taxes, electricity supply, carbon capture, and a string of related issues.

Jeffrey L. Steiner is a partner in the Washington, D.C. office, where he co-leads the firm’s Derivatives practice and is co-leader of the firm’s Digital Currencies and Blockchain Technology team practice. Mr. Steiner advises financial institutions, energy companies, private funds, corporations and others on compliance and implementation issues relating to derivatives and commodities trading, including compliance with CFTC, SEC, the Dodd-Frank Act, and other rules and regulations. He also helps clients to navigate through cross-border issues resulting from global derivatives and commodities requirements. Before joining the firm, Mr. Steiner was special counsel in the Division of Market Oversight at the CFTC where he handled a range of issues relating to trading and execution of futures and swaps.

Abbey Hudson is a partner in the Los Angeles office where she is a member of the Environmental Litigation and Mass Tort Practice Group. Ms. Hudson devotes a significant portion of her time to helping clients navigate environmental and emerging regulations and related governmental investigations. She has handled all aspects of environmental and mass tort litigation and regulatory compliance. She also provides counseling and advice on environmental and regulatory compliance to clients on a wide range of issues, including supply chain transparency requirements, comments on pending regulatory developments, and enforcement.

Jennifer C. Mansh is a senior associate in the Washington, D.C. office and a member of the firm’s Energy, Regulation and Litigation Practice Group. Ms. Mansh advises clients on energy litigation, regulatory, and transactional matters before the FERC, CFTC, the Department of Energy, and state public utility commissions. Ms. Mansh has represented a wide variety of electric utilities, merchant transmission companies, power marketers, and natural gas and oil pipeline companies in rate, licensing, and enforcement proceedings, and she assists clients on a variety of transactional matters and compliance issues.

Mark Tomaier is an associate in the Orange County office where he currently practices general litigation in the firm’s Litigation Department. Mr. Tomaier earned his law degree cum laude in 2017 from Harvard Law School, where he was an Articles Editor on the Harvard Environmental Law Review. In 2012, he graduated with highest honors from the University of California Berkeley with a Bachelor of Arts Degree, double majoring in English and in Rhetoric. Prior to joining the firm, Mr. Tomaier served as a law clerk to The Honorable Marilyn L. Huff in the United States District Court for the Southern District of California and as a law clerk to The Honorable Michael D. Wilson in the Supreme Court of Hawaii.

MCLE CREDIT INFORMATION:

This program has been approved for credit in accordance with the requirements of the New York State Continuing Legal Education Board for a maximum of 1.0 credit hours, of which 1.0 credit hours may be applied toward the areas of professional practice requirement.

Gibson, Dunn & Crutcher LLP certifies that this activity has been approved for MCLE credit by the State Bar of California in the amount of 1.0 hours.

California attorneys may claim “self-study” credit for viewing the archived version of this webcast. No certificate of attendance is required for California “self-study” credit.

Los Angeles partner Theane Evangelis is the author of “Don’t turn classrooms into courtrooms and retraumatize victims,” [PDF] published by the Daily Journal on April 28, 2021.

Los Angeles partner Michael Dore is the author of “Legal issues to watch in navigating the secondary market for NFTs,” [PDF] published by the Daily Journal on April 27, 2021.

On April 27, 2021, a federal court in the Northern District of California dismissed federal and state law claims brought derivatively on behalf of The Gap, Inc., holding that the California proceedings were foreclosed by a forum selection bylaw designating the Delaware Court of Chancery as the exclusive forum for derivative suits (the “Forum Bylaw”). See Lee v. Fisher, Case No. 20-cv-06163-SK, ECF No. 59. This decision strikes a blow against what has become a new tactic of the plaintiff’s bar: asserting violations of the federal securities laws in the guise of shareholder derivative claims. This ruling furthers the purpose of exclusive forum bylaws to prevent duplicative litigation in multiple forums, and highlights the benefits these bylaws may achieve for companies.

The plaintiff in Fisher brought derivative claims purportedly on behalf of Gap against certain directors and officers based on their alleged failure to promote diversity at Gap and for allegedly making misleading statements about Gap’s commitment to diversity. The plaintiff asserted both state law claims (like breach of fiduciary duty) and a federal securities law claim for violation of Section 14(a) of the Securities Exchange Act.

Defendants moved to dismiss on forum non conveniens grounds pursuant to the Forum Bylaw. Plaintiff argued that the court could not enforce the Forum Bylaw as to the federal Section 14(a) claim because (1) that claim was subject to exclusive federal jurisdiction and could not be asserted in the Delaware Court of Chancery, and (2) enforcing the Forum Bylaw would violate the Exchange Act provision that prohibits waiving compliance with the Exchange Act (the “anti-waiver” provision).

The court rejected plaintiff’s arguments and enforced the Forum Bylaw, effectively precluding the plaintiff from asserting a Section 14(a) claim in any forum. First, the court noted the strong policy in favor of enforcing forum selection clauses, which the Ninth Circuit has held supersedes anti-waiver provisions like those in the Exchange Act. See Yei A. Sun v. Advanced China Healthcare, Inc., 901 F.3d 1081 (9th Cir. 2018). Second, relying on the Ninth Circuit’s holding in Sun that a forum selection clause should be enforced unless the forum “affords the plaintiffs no remedies whatsoever,” the court held that the Forum Bylaw was enforceable because the plaintiff could file a separate state law derivative action in Delaware, even if that action could not include federal securities law claims.

This ruling is notable because other federal courts confronted with a similar argument have decided to enforce these bylaws only as to state law claims, and to keep the federal claims in federal court. The result of those rulings, though, is that derivative actions involving the same alleged misconduct could proceed in two forums—actions in federal court involving federal law claims, and actions in state court involving state law claims. This result undermines the purpose of exclusive forum bylaws to prevent duplicative litigation in multiple forums.

The Fisher decision, as well as a similar ruling reached in Seafarers Pension Plan v. Bradway, 2020 WL 3246326 (N.D. Ill. June 8, 2020), should help establish that exclusive forum bylaws require all derivative actions to proceed in a single forum. When drafting and (later) enforcing exclusive forum bylaws, companies should have these recent decisions top of mind to make sure that these bylaws achieve their goal of efficiently litigating disputes in one forum only.

Gibson Dunn lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any member of the Securities Litigation or Securities Regulation and Corporate Governance practice groups, or the following authors:

Brian M. Lutz – San Francisco/New York (+1 415-393-8379/+1 212-351-3881, blutz@gibsondunn.com)
Jason J. Mendro – Washington, D.C. (+1 202-887-3726, jmendro@gibsondunn.com)
Ronald O. Mueller – Washington, D.C. (+1 202-955-8671, rmueller@gibsondunn.com)
Michael J. Kahn – San Francisco (+1 415-393-8316, mjkahn@gibsondunn.com)

Please also feel free to contact any of the following practice leaders and members:

Securities Litigation Group:
Monica K. Loseman – Co-Chair, Denver (+1 303-298-5784, mloseman@gibsondunn.com)
Brian M. Lutz – Co-Chair, San Francisco/New York (+1 415-393-8379/+1 212-351-3881, blutz@gibsondunn.com)
Robert F. Serio – Co-Chair, New York (+1 212-351-3917, rserio@gibsondunn.com)
Craig Varnen – Co-Chair, Los Angeles (+1 213-229-7922, cvarnen@gibsondunn.com)
Jefferson Bell – New York (+1 212-351-2395, jbell@gibsondunn.com)
Matthew L. Biben – New York (+1 212-351-6300, mbiben@gibsondunn.com)
Michael D. Celio – Palo Alto (+1 650-849-5326, mcelio@gibsondunn.com)
Paul J. Collins – Palo Alto (+1 650-849-5309, pcollins@gibsondunn.com)
Jennifer L. Conn – New York (+1 212-351-4086, jconn@gibsondunn.com)
Thad A. Davis – San Francisco (+1 415-393-8251, tadavis@gibsondunn.com)
Mark A. Kirsch – New York (+1 212-351-2662, mkirsch@gibsondunn.com)
Jason J. Mendro – Washington, D.C. (+1 202-887-3726, jmendro@gibsondunn.com)
Alex Mircheff – Los Angeles (+1 213-229-7307, amircheff@gibsondunn.com)
Robert C. Walters – Dallas (+1 214-698-3114, rwalters@gibsondunn.com)

Securities Regulation and Corporate Governance Group:
Elizabeth Ising – Co-Chair, Washington, D.C. (+1 202-955-8287, eising@gibsondunn.com)
James J. Moloney – Co-Chair, Orange County, CA (+ 949-451-4343, jmoloney@gibsondunn.com)
Lori Zyskowski – Co-Chair, New York (+1 212-351-2309, lzyskowski@gibsondunn.com)
Brian J. Lane – Washington, D.C. (+1 202-887-3646, blane@gibsondunn.com)
Ronald O. Mueller – Washington, D.C. (+1 202-955-8671, rmueller@gibsondunn.com)
Thomas J. Kim – Washington, D.C. (+1 202-887-3550, tkim@gibsondunn.com)
Michael A. Titera – Orange County, CA (+1 949-451-4365, mtitera@gibsondunn.com)

Attorney Advertising: The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.

On April 28, 2021, the U.S. Senate approved a resolution to repeal EPA’s 2020 policy amendments to regulations of upstream and midstream oil and gas operations. Under the 2020 policy amendments, the Trump Administration had declined to regulate oil and gas transmission and storage operations or set methane emission limits under Section 111 of the Clean Air Act’s (“CAA”) New Source Performance Standards (“NSPS”). If the U.S. House of Representatives approves the resolution and it is signed by the President, then the 2020 policy amendments would no longer be in effect, thus restoring key aspects of an earlier rule from the Obama Administration regulating methane from production and processing facilities at upstream oil and gas facilities as well as transmission and storage operations.

Key Takeaways:

The recent Senate resolution targets the last Administration’s rulemaking declining to regulate methane emissions from production and processing operations at oil and gas facilities. The soon-to-be repealed rule also declined to regulate associated transmission and storage operations.
Once the House of Representatives passes the same resolution and it is signed into law by President Biden, EPA will be able to quickly commence regulation of methane emissions for this sector as well as volatile organic compounds (“VOC”) and methane emissions for transmission and storage operations.
Impacted sources in the sector should begin evaluating compliance with the 2016 Obama Administration rules governing methane from production and processing operations as well as transmission and storage operations.
For production and processing operations, compliance with methane requirements should complement existing VOC compliance programs under NSPS Subpart OOOOa, although additional requirements could attach for operations in areas of ozone nonattainment.
The 2020 technical amendments to the NSPS Subpart OOOOa program governing production and processing operations remain unaffected.

Detailed Analysis: Beginning in 2012 and again in 2016, the Obama administration promulgated new regulations of the oil and gas industry under the CAA’s NSPS (“2016 NSPS”). Pursuant to the 2016 NSPS, the transmission and storage segment of the oil and gas industry was included in the NSPS regulated source category.[1] This applied the NSPS standards to storage tanks, compressors, equipment leaks, and pneumatic controllers, among other sources in the transmission and storage segment.[2] The 2016 NSPS also added methane emission limits for the same segment.[3]

In 2020, EPA repealed these changes, issuing final policy amendments that removed the transmission and storage segment sources from the NSPS source category.[4] Further, EPA rescinded the separate methane emission limits for the production and processing segments of the source category while retaining limits for VOCs, and EPA also interpreted the CAA to require a “significant contribution finding” for any particular air pollutant before setting performance standards for that pollutant unless EPA addressed the pollutant when first listing or regulating the source category.[5] This latter requirement was significant, among other reasons, because the EPA did not consider methane emissions at the time it initially listed the oil and gas source category in 1979, and would thus require “significant contribution finding” for methane.[6]

In a separate rulemaking also finalized in 2020, EPA made a number of separate technical amendments to the 2016 NSPS.[7] This final rule was not cited in the resolution that passed the Senate.

This week, Congress began the process of reversing course. The Senate passed a resolution, S.J. RES. 14,[8] which disapproved of the EPA’s 2020 policy amendments. The Senate voted by a 52-42 margin, with three Republicans voting in the majority, to repeal the 2020 policy amendments pursuant to its authority under the Congressional Review Act (“CRA”). Pursuant to the CRA, certain agency rules must be reported to Congress and the Government Accountability Office.[9] After receiving the report, Congress is authorized to disapprove of the promulgated rule within 60 session days.[10] Significantly, when certain criteria are met, a joint resolution of disapproval cannot be filibustered in the Senate.[11] Moreover, disapproval carries with it longer term effects: the CRA prohibits a rule in “substantially the same form” as the disapproved rule from being subsequently promulgated (unless so authorized by a subsequent law).

Although the Senate resolution is a significant step towards repeal of the 2020 policy amendments, the 2016 NSPS are not yet back in effect. In order to repeal the 2020 rule and reinstate the 2016 NSPS (subject to the technical changes finalized in 2020 that are unaffected by the CRA resolution), the House of Representatives will also need to pass the same resolution, which it is expected to vote on in the coming weeks.[12] Disapproval renders the 2020 rule “as though such rule had never taken effect.”[13] Questions remain as to whether this repeal will reignite past litigation challenging the 2012 and 2016 NSPS rulemakings.

Affected facilities in the transmission and storage segments of the source category that will soon be subject to the NSPS should prepare for compliance. Furthermore, all facilities in the source category subject to NSPS, including in the production and processing segments, should ensure that they have adequate controls to meet the 2016 NSPS requirements for methane emissions. The practical impact of this reversion is uncertain, particularly given EPA’s findings in 2020 that separate methane limitations for these segments of the industry are redundant because controls used to reduce VOC emissions also reduce methane. Moreover, given the uncertainty created by the CRA’s language that a disapproved rule is rendered not only ineffective moving forward but also “as though such rule had never taken effect,” EPA likely will need to issue guidance to regulated entities in order to explain its expectations for compliance and the timing thereof. EPA likely also will need to promulgate a ministerial rule restoring the applicable regulatory text from the 2016 NSPS in the Code of Federal Regulations.

Litigation over the 2012 and 2016 rulemakings, currently held in abeyance, likely will resume in the wake of this resolution. In addition, EPA will once again be responsible for issuing an existing source rule for this source category. Because EPA rescinded methane limits for the source category, EPA was no longer required to issue emission guidelines to address existing sources. This will change after the CRA resolution is approved.

_____________________

[1] EPA Issues Final Policy Amendments to the 2012 and 2016 New Source Performance Standards for the Oil and Natural Gas Industry: Fact Sheet, epa.gov (Aug. 13, 2020), https://www.epa.gov/sites/production/files/2020-08/documents/og_policy_amendments.fact_sheet._final_8.13.2020_.pdf.

[2] EPA’s Policy Amendments to the New Source Performance Standards for the Oil and Gas Industry, epa.gov (Aug. 2020), here.

[3] Supra note 1. For additional analysis of the previous standard, see S. Fletcher and D. Schnitzer, “Inside EPA’s Plan for Reducing Methane Emissions,” Law360 (Aug. 20, 2015), available at https://www.gibsondunn.com/wp-content/uploads/documents/publications/Fletcher-Schnitzer-Inside-EPAs-Plan-For-Reducing-Methane-Emissions-Law360-08-20-2015.pdf; “Client Alert: EPA Announces Program Addressing Methane Emissions from Oil and Gas Production,” (Jan. 15, 2015), available at https://www.gibsondunn.com/epa-announces-program-addressing-methane-emissions-from-oil-and-gas-production/

[4] Supra note 1.

[5] Id.

[6] See id.

[7] Id.

[8] A joint resolution providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Environmental Protection Agency relating to “Oil and Natural Gas Sector: Emission Standards for New, Reconstructed, and Modified Sources Review”, S.J.Res.14, 117th Cong. (2021).

[9] 5 U.S.C. §801(a)(1)(A).

[10] See 5 U.S.C. §802.

[11] See 5 U.S.C. §802(d).

[12] Jeff Brady, Senate Votes To Restore Regulations On Climate-Warming Methane Emissions, NPR (Apr. 28, 2021), https://www.npr.org/2021/04/28/991635101/senate-votes-to-restore-regulations-on-climate-warming-methane-emissions.

[13] 5 U.S.C. §801(f).

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any member of the firm’s Environmental Litigation and Mass Tort practice group, or the following authors:

Stacie B. Fletcher – Washington, D.C. (+1 202-887-3627, sfletcher@gibsondunn.com)
David Fotouhi – Washington, D.C. (+1 202-955-8502, dfotouhi@gibsondunn.com)
Mark Tomaier – Orange County, CA (+1 949-451-4034, mtomaier@gibsondunn.com)

Please also feel free to contact the following practice group leaders:

Environmental Litigation and Mass Tort Group:
Stacie B. Fletcher – Washington, D.C. (+1 202-887-3627, sfletcher@gibsondunn.com)
Daniel W. Nelson – Washington, D.C. (+1 202-887-3687, dnelson@gibsondunn.com)

Attorney Advertising: The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.

This edition of Gibson Dunn’s Federal Circuit Update summarizes a new petition for certiorari in a case originating in the Federal Circuit concerning the Kessler preclusion doctrine, it addresses the Federal Circuit’s announcement that Judge Moore will become Chief Judge on May 22, 2021, and it discusses recent Federal Circuit decisions concerning self-enabling references, Article III standing, patent eligibility, and more Western District of Texas venue issues.

Federal Circuit News

Supreme Court:

This month, the Supreme Court did not add any new cases originating at the Federal Circuit. As we summarized in our January and February updates, the Court has two such cases pending: United States v. Arthrex, Inc. (U.S. Nos. 19-1434, 19-1452, 19-1458) and Minerva Surgical Inc. v. Hologic Inc. (U.S. No. 20-440).

The Court heard argument on the doctrine of assignor estoppel on Wednesday, April 21, 2021, in Minerva v. Hologic.

Noteworthy Petitions for a Writ of Certiorari:

There is one new potentially impactful certiorari petition that is currently before the Supreme Court:

PersonalWeb Technologies, LLC v. Patreon, Inc. (U.S. No. 20-1394): 1. Whether the Federal Circuit correctly interpreted Kessler v. Eldred, 206 U.S. 285 (1907), to create a freestanding preclusion doctrine that may apply even when claim and issue preclusion do not. 2. Whether the Federal Circuit properly extended its Kessler doctrine to cases where the prior judgment was a voluntary dismissal.

Other updates include:

On April 1, the Court requested a response in Warsaw Orthopedic v. Sasso (U.S. No. 20-1284) concerning state versus federal court jurisdiction.

As of April 26, the cert-stage briefing is complete in Sandoz v. Immunex (U.S. No. 20-1110), which concerns obviousness-type double patenting. Association for Accessible Medicines has filed an amicus brief in support of Sandoz and the Court has distributed this case for its May 13 conference.

On April 19, Illumina filed its brief in opposition in Ariosa Diagnostics, Inc. v. Illumina, Inc. (U.S. No. 20-892) concerning patent eligibility under 35 U.S.C. § 101.

American Axle & Manufacturing, Inc. v. Neapco Holdings LLC (U.S. No. 20-891), also concerning patent eligibility under 35 U.S.C. § 101, is scheduled for the Court’s April 30 conference.

Other Federal Circuit News:

The Federal Circuit announced that, on May 22, 2021, the Honorable Kimberly A. Moore will become Chief Judge. She will succeed the Honorable Sharon Prost who has served as Chief Judge since May 31, 2014, and has served as Circuit Judge since September 24, 2001. Judge Moore has served as Circuit Judge on the Federal Circuit since September 8, 2006.

Upcoming Oral Argument Calendar

The list of upcoming arguments at the Federal Circuit are available on the court’s website.

Live streaming audio is available on the Federal Circuit’s new YouTube channel. Connection information is posted on the court’s website.

Key Case Summaries (April 2021)

Raytheon Technologies Corp. v. General Electric Co. (Fed. Cir. No. 20-1755): Raytheon appealed a final inter partes review decision from the PTAB determining that certain claims of the asserted patent unpatentable as obvious. Raytheon argued before the Board that the prior art reference, Knip, failed to enable a skilled artisan to make the claimed invention because Knip relied on “revolutionary” materials unavailable as of the priority date of the asserted patent. The Board found that Knip was “enabling,” because it provided enough information to allow a skilled artisan to calculate the power density of Knip’s advanced engine, which fell within the claimed density range. The Board thus concluded that Knip rendered the challenged claims obvious.

The Federal Circuit (Chen, J., joined by Lourie, J. and Hughes, J.) reversed. The court agreed with Raytheon that the Board legally erred it in its prior art enablement analysis. To render a claim obvious, the prior art must enable a skilled artisan to make and use the claimed invention. The Board, rather than determining whether Knip enabled a skilled artisan to make and use the claimed invention, focused only on whether a skilled artisan was provided with sufficient parameters in Knip to determine the claimed power density without undue experimentation. The Board defended its position by noting that the claims did not require the advanced materials disclosed in Knip. However, Raytheon had presented unrebutted testimony that Knip fails to enable a skilled artisan to physically make Knip’s engine given the unavailability of the revolutionary composite material contemplated by Knip. The court thus concluded that the Board’s finding that Knip is “enabling” was legal error, because without a physical working engine, a skilled artisan could not achieve the claimed power density.

Apple Inc. v. Qualcomm Inc. (Fed. Cir. No. 20-1561): Apple appealed two PTAB inter partes review final written decisions holding that Apple did not prove several claims of two patents were obvious. These two patents were also asserted against Apple in district court. However, before Apple filed its appeal to the Federal Circuit, Apple and Qualcomm settled all litigation between the companies. Based on that settlement, the district court action was dismissed with prejudiced at the parties’ request.

The Federal Circuit (Moore, J., joined by Reyna, J. and Hughes, J.) dismissed Apple’s appeal for lack of standing. As a preliminary matter, the court stated that Apple should have addressed arguments and evidence establishing its standing in its opening brief. The court declined to apply waiver, however, and addressed the merits of the standing issue. The court rejected Apple’s argument that its ongoing payment obligations provides standing because Apple did not provide evidence that the validity of any single patent, including the two patents at issue, would impact its ongoing payment obligations. The court also found Apple’s argument that Qualcomm could later sue for infringement after the settlement agreement expires was too speculative to confer standing. Finally, the court explained that any injury based on the inter partes review estoppel’s provision was also too speculative to provide standing, especially where Apple did not show that it will likely be practicing the patent claims.

In Re: Board of Trustees of the Leland Stanford Junior University (Fed. Cir. No. 20-1288): The PTAB affirmed an examiner’s final rejection of claims directed to “computerized statistical methods for determining haplotype phase,” on the basis that the claims were not patent-eligible under 35 U.S.C. § 101. Haplotype phasing “is a process for determining the parent from whom alleles—i.e., versions of a gene—are inherited.” The PTAB held that the claims were directed to two abstract mental processes: (1) “the step of ‘imputing an initial haplotype phase for each individual in the plurality of individuals based on a statistical model’”; and (2) “the step of automatically replacing an imputed haplotype phase with a randomly modified haplotype phase when the latter is more likely correct than the former.” The PTAB also held that the claims lacked an inventive concept, as they “recited generic steps of receiving and storing genotype data in a computer memory, extracting the predicted haplotype phase from the data structure, and storing it in a computer memory.”

The Federal Circuit (Reyna, J., joined by Prost, C.J. and Lourie, J.) affirmed. At step one, the court held that the claims were directed to the abstract idea of “the use of mathematical calculations and statistical modeling.” The court rejected the applicant’s argument that the claims provided a technological improvement by allowing for “more accurate haplotype predictions.” The court explained that “[t]he different use of a mathematical calculation, even one that yields different or better results, does not render patent eligible subject matter.” At step two, the court held that the claims lacked an inventive concept because the “the recited steps of receiving, extracting, and storing data amount to well-known, routine, and conventional steps taken when executing a mathematical algorithm on a regular computer.”

In Re TracFone Wireless (Fed. Cir. No. 21-136) (nonprecedential): As discussed in our March update, the Federal Circuit granted TracFone’s first mandamus petition, ordering Judge Albright to “issue [his] ruling on the motion to transfer within 30 days from the issuance of this order, and to provide a reasoned basis for its ruling that is capable of meaningful appellate review.” On April 20, the court granted mandamus for a second time, holding that Judge Albright “clearly abused” his discretion in denying transfer under § 1404(a) by relying on a “rigid and formulaic” application of the Fifth Circuit’s 100-mile rule.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding developments at the Federal Circuit. Please contact the Gibson Dunn lawyer with whom you usually work or the authors of this alert:

Blaine H. Evanson – Orange County (+1 949-451-3805, bevanson@gibsondunn.com)
Jessica A. Hudak – Orange County (+1 949-451-3837, jhudak@gibsondunn.com)

Please also feel free to contact any of the following practice group co-chairs or any member of the firm’s Appellate and Constitutional Law or Intellectual Property practice groups:

Appellate and Constitutional Law Group:
Allyson N. Ho – Dallas (+1 214-698-3233, aho@gibsondunn.com)
Mark A. Perry – Washington, D.C. (+1 202-887-3667, mperry@gibsondunn.com)

Intellectual Property Group:
Wayne Barsky – Los Angeles (+1 310-552-8500, wbarsky@gibsondunn.com)
Josh Krevitt – New York (+1 212-351-4000, jkrevitt@gibsondunn.com)
Mark Reiter – Dallas (+1 214-698-3100, mreiter@gibsondunn.com)

Attorney Advertising: The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.

Los Angeles partner Maurice Suh and of counsel Daniel Weiss are the authors of “NCAA under scrutiny in grant-in-aid cap antitrust litigation,” [PDF] published by the Daily Journal on April 26, 2021.

On April 26, 2021, in McMorris v. Carlos Lopez & Associates, LLC,[1] Judges Calabresi, Katzmann, and Sullivan of the Second Circuit entered the muddy waters at the intersection of data privacy and constitutional law in addressing when a plaintiff in a data breach case has suffered a sufficient injury to establish standing to bring a lawsuit in federal court under Article III of the United States Constitution based on an increased risk of future identity theft. This question presented a matter of first impression for the Second Circuit, which sought to harmonize the divergent approaches taken by its sister circuits on this pressing—and oft-recurring—issue by articulating a non-exhaustive three-factor test to aid courts’ future adjudication of these highly fact-specific disputes. Applying this test, the Second Circuit affirmed the district court’s dismissal for lack of standing because the plaintiffs had failed to plead a sufficient risk of future identity fraud.

I. Article III Standing and Data Privacy

Under Article III of the United States Constitution, “federal courts lack jurisdiction if no named plaintiff has standing.”[2] To establish standing, plaintiffs must demonstrate that they have (1) “suffered an injury in fact” (2) that “was caused by the defendant,” and which (3) “would likely be redressed by the requested judicial relief.”[3] In turn, an injury in fact requires “‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’”[4] While an alleged risk of future harm may suffice, a mere “possible future injury” or even an “objectively reasonable likelihood” of a future injury is not enough to meet the injury in fact requirement.[5] Instead, the future injury must be “certainly impending” or there must be “a substantial risk that the harm will occur.”[6]

Whether an injury in fact has been adequately pleaded is often a threshold issue raised at the motion to dismiss stage in litigation concerning data breaches. Despite the frequency with which this question arises, however, it is widely recognized that “courts have struggled” to answer it in a consistent manner[7] and the federal courts of appeals “are divided.”[8]

For instance, the D.C. Circuit has found it “at least plausible” that data breach victims “run a substantial risk of falling victim” to future identity theft, particularly where some plaintiffs “have already experienced some form of identity theft since the breaches.”[9] Similarly, the Ninth Circuit suggested that it was sufficient for standing purposes if hackers “accessed information that could be used to help commit identity fraud or identity theft” or had “the means” to access such information going forward in light of the data breach.[10]

On the other hand, the Third Circuit has long held that plaintiffs lack standing if “no misuse is alleged” and there is “no quantifiable risk of damage in the future.”[11] More recently, the Eighth Circuit similarly held that “a mere possibility” of future harm following hackers’ theft of financial information was not a constitutionally cognizable injury,[12] and earlier this year the Eleventh Circuit agreed that “a mere data breach does not, standing alone, satisfy the requirements of Article III standing.”[13]

II. Facts and Procedural History of McMorris

In June 2018, an employee at Carlos Lopez & Associates, LLP (“CLA”) accidentally sent a spreadsheet containing the Social Security numbers, home addresses, dates of birth, telephone numbers, hiring dates, and other personal information for approximately 130 current and former CLA employees to all of the company’s then-current employees.[14] Three individuals whose personally identifiable information was disclosed filed a class-action complaint against CLA, asserting various state-law claims and alleging two distinct injuries.[15] First, they claimed that the disclosure put them “‘at imminent risk of suffering identity theft’ and becoming the victims of ‘unknown but certainly impending future crimes.’”[16] Second, they alleged they were injured “in the form of the time and money spent monitoring or changing their financial information and accounts.”[17] Notably, however, they never alleged that their personal information was actually shared outside of CLA or misused by anyone.

Although the parties reached a proposed class settlement, Judge Furman of the United States District Court for the Southern District of New York declined to approve the settlement and instead dismissed the matter sua sponte for lack of subject-matter jurisdiction.[18] In doing so, he held, that the plaintiffs’ alleged increased risk of future identity theft was not sufficiently concrete to support standing.[19] With no allegations that CLA’s release of personal information was intentional, involved malicious third parties, or had caused any actual misuse of data, Judge Furman found the plaintiffs’ injury too speculative and attenuated to qualify as an injury in fact.[20] He also rejected their theory of injury based on the actual costs they had incurred as a result of the disclosure of their personal information, reasoning that plaintiffs “cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.”[21] Since the possibility of identity theft was speculative, any costs taken to avoid it did not qualify as injuries in fact.

III. The Second Circuit’s Legal Analysis

In an opinion written by Judge Sullivan, the Second Circuit affirmed the district court’s dismissal of the claims against CLA for lack of standing.

While it recognized that other circuits had wrestled with the question of “whether a plaintiff may establish standing based on a risk of future identity theft or fraud stemming from the unauthorized disclosure of that plaintiff’s data,”[22] the Second Circuit sought to bridge the apparent divide. Its reading of its sister circuits’ decisions was that none had “explicitly foreclosed” a future-harm theory.[23] Instead, Judge Sullivan reasoned that the Third, Eighth, and Eleventh Circuits had only “declined to find standing on the facts of a particular case.”[24] The Second Circuit therefore characterized itself as “join[ing] all of [its] sister circuits that have specifically addressed the issue in holding that plaintiffs may establish standing based on an increased risk of identity theft or fraud following the unauthorized disclosure of their data.”[25]

However, the Second Circuit did not hold that any such allegation was sufficient to plead an injury in fact. Instead, it endorsed three non-dispositive and non-exhaustive factors that, it said, other appellate courts have “consistently addressed in the context of data breaches and other data exposure incidents” as providing “helpful guidance” in assessing the presence or absence of constitutional standing: “(1) whether the plaintiffs’ data has been exposed as the result of a targeted attempt to obtain that data; (2) whether any portion of the dataset has already been misused, even if the plaintiffs themselves have not yet experienced identity theft or fraud; and (3) whether the type of data that has been exposed is sensitive such that there is a high risk of identity theft or fraud.”[26]

Applying these factors to CLA’s data disclosure, the Second Circuit held that the plaintiffs had failed to plead a sufficient risk of future identity theft or fraud to establish Article III standing. The first two factors weighed in favor of dismissal in McMorris because the case “merely involve[d] the inadvertent disclosure of [personal information] due to an errant email,”[27] not a targeted or malicious attempt to obtain data, and the plaintiffs never alleged that any of “the exposed dataset was compromised.”[28] Although the third factor weighed in favor of finding that the court had Article III jurisdiction because the disclosed data “included the sort of [personally identifiable information] that might put Plaintiffs at a substantial risk of identity theft or fraud, in the absence of any other facts suggesting that the [data] was intentionally taken by an unauthorized third party or otherwise misused,” the Second Circuit held that “this factor alone does not establish an injury in fact.”[29] As such, the first two factors proved fatal to plaintiffs’ claimed standing based on a risk of future harm. And, as a result, the plaintiffs’ claims based on their protective-measures theory also failed because absent “a substantial risk of future identity theft,” any efforts “protecting . . . against [a] speculative threat cannot create an injury.[30]

IV. Conclusion

Whether McMorris effectively synthesized the federal judiciary’s “disarray about the applicability of [the] ‘increased risk’ theory in data privacy cases”[31] or only (inadvertently) highlighted the stark differences among the courts of appeal remains an open question. But, regardless, it is now binding law in the Second Circuit, and its adoption of guiding non-dispositive factors should provide a roadmap for the resolution of similar litigation going forward. Such future developments may also be influenced by the Supreme Court’s highly anticipated upcoming decision in TransUnion LLC v. Ramirez,[32] in which oral argument was held on March 30, 2021, addressing the closely related question of whether Article III or Federal Rule of Civil Procedure 23 permit a damages class action where the majority of the putative class did not suffer an actual injury. As always, Gibson Dunn remains available to help its clients in navigating this evolving area of the law.

____________________

[1] — F.3d —-, 2021 WL 1603808 (2d Cir. Apr. 26, 2021).

[2] Frank v. Gaos, 139 S. Ct. 1041, 1046 (2019).

[3] Thole v. U.S. Bank N.A., 140 S. Ct. 1615, 1618 (2020).

[4] Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1548 (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)).

[5] Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409–10 (2013).

[6] Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014) (internal quotation marks omitted).

[7] Allison Grande, High Court FCRA Case Could Shake Up Class Action Standing, Law360.com (Mar. 26, 2011), available at https://www.law360.com/articles/1368905/high-court-fcra-case-could-shake-up-class-action-standing.

[8] Tsao v. Captiva MVP Rest. Partners, LLC, 986 F.3d 1332, 1340 (11th Cir. 2021); Beck. v.McDonald, 848 F.3d 262, 273 (4th Cir. 2017).

[9] In re U.S. Off. of Pers. Mgmt. Data Sec. Breach Litig., 928 F.3d 42, 59 (D.C. Cir. 2019).

[10] In re Zappos.com, Inc., 888 F.3d 1020, 1027–28 (9th Cir. 2018) (emphasis added).

[11] Reilly v. Ceridian Corp., 664 F.3d 38, 45 (3d Cir. 2011).

[12] In re SuperValu, Inc., 870 F.3d 763, 771 (8th Cir. 2017).

[13] Tsao, 986 F.3d at 1344.

[14] Steven v. Carlos Lopez & Assocs., LLC, 422 F. Supp. 3d 801, 802 (S.D.N.Y. 2019).

[15] McMorris, 2021 WL 1603808, at *1.

[16] Id. at *1 (quoting Amended Complaint ¶¶ 6, 34).

[17] Steven, 422 F. Supp. 3d at 807.

[18] Id. at 803.

[19] Id. at 804.

[20] Id. at 804–07.

[21] Id. at 807 (quoting Clapper, 568 U.S. at 416).

[22] McMorris, 2021 WL 1603808, at *3.

[23] Id. .

[24] Id. at *3 & n.2.

[25] Id.

[26] Id. at *5.

[27] Id.

[28] Id. at *6.

[29] Id.

[30] Id. at *6 n.7 (quoting SuperValu, 870 F.3d at 771).

[31] Katz v. Pershing, LLC, 672 F.3d 64, 80 (1st Cir. 2012).

[32] No. 20-297.

The following Gibson Dunn lawyers assisted in the preparation of this alert: Alexander H. Southwell, Akiva Shapiro, Jeremy S. Smith, Michael Nadler, and Eric Hornbeck.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any of the following members of the firm’s Privacy, Cybersecurity and Data Innovation practice group, or the following authors:

Alexander H. Southwell – New York (+1 212-351-3981, asouthwell@gibsondunn.com)
Akiva Shapiro – New York (+1 212-351-3830, ashapiro@gibsondunn.com)

United States
Alexander H. Southwell – Co-Chair, PCDI Practice, New York (+1 212-351-3981, asouthwell@gibsondunn.com)
S. Ashlie Beringer – Co-Chair, PCDI Practice, Palo Alto (+1 650-849-5327, aberinger@gibsondunn.com)
Debra Wong Yang – Los Angeles (+1 213-229-7472, dwongyang@gibsondunn.com)
Matthew Benjamin – New York (+1 212-351-4079, mbenjamin@gibsondunn.com)
Ryan T. Bergsieker – Denver (+1 303-298-5774, rbergsieker@gibsondunn.com)
Howard S. Hogan – Washington, D.C. (+1 202-887-3640, hhogan@gibsondunn.com)
Joshua A. Jessen – Orange County/Palo Alto (+1 949-451-4114/+1 650-849-5375, jjessen@gibsondunn.com)
Kristin A. Linsley – San Francisco (+1 415-393-8395, klinsley@gibsondunn.com)
H. Mark Lyon – Palo Alto (+1 650-849-5307, mlyon@gibsondunn.com)
Karl G. Nelson – Dallas (+1 214-698-3203, knelson@gibsondunn.com)
Ashley Rogers – Dallas (+1 214-698-3316, arogers@gibsondunn.com)
Deborah L. Stein – Los Angeles (+1 213-229-7164, dstein@gibsondunn.com)
Eric D. Vandevelde – Los Angeles (+1 213-229-7186, evandevelde@gibsondunn.com)
Benjamin B. Wagner – Palo Alto (+1 650-849-5395, bwagner@gibsondunn.com)
Michael Li-Ming Wong – San Francisco/Palo Alto (+1 415-393-8333/+1 650-849-5393, mwong@gibsondunn.com)
Cassandra L. Gaedt-Sheckter – Palo Alto (+1 650-849-5203, cgaedt-sheckter@gibsondunn.com)

Attorney Advertising: The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.

Washington, D.C. partner David Fotouhi and associates Andrew Wilhelm and Amalia Reiss are the authors of “Water Rule Reinstatement Shows Specific Objections Are Key,” [PDF] published by Law360 on April 28, 2021.

I. Introduction

II. Key Provisions of the Executive Order

Sec. 2. Removing Barriers to Sharing Threat Information.

Sec. 3. Modernizing Federal Government Cybersecurity.

Sec. 4. Enhancing Software Supply Chain Security.

Sec. 5. Establishing a Cyber Safety Review Board.

Sec. 6. Standardizing the Federal Government’s Playbook for Responding to Cybersecurity Vulnerabilities and Incidents.

Sec. 7. Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Networks.

Sec. 8. Improving the Federal Government’s Investigative and Remediation Capabilities.

Sec. 9. National Security Systems.

III. Analysis and Takeaways

Federal Circuit News

Upcoming Oral Argument Calendar

Key Case Summaries (April 2021)