Series
Blogs
Series
Blogs
Proceedings disrupted over allegations of hacking by an adversary
In arbitration proceedings, the current pandemic is proving to be a catalyst in a shift towards more online dispute resolution, with participants attending virtual hearings and moving to online case-management platforms. On the one hand, using such technology can help to save time and costs. On the other hand, arbitration proceedings (which often relate to high-value disputes that are business-sensitive, or involve public or state-controlled entities) are not immune to cyber risks. Many stakeholders – be it competitors, hackers, investigative journalists, state agencies or even the opponent party – might have an interest in the data relating to the arbitration being shared and may attempt to influence, control or even taint the outcome of such proceedings.
Latest cyber hack in international arbitration proceedings
It has been reported that a Sao Paulo court stayed the enforcement of a partial award in favour of the claimant and obtained in February 2021 in a multibillion-dollar ICC dispute over the sale of a pulp maker while it considers allegations that the arbitration has been tainted by cyber hacking (for example, see Global Arbitration Review, 12 April 2021: “Brazilian pulp award leads to cyber hack challenge”). The defendant had challenged the award and asserts that the claimant orchestrated a hacking of its servers and thus gained access to confidential information (around 70.000 emails) during the arbitration proceeding. The claimant rejects those accusations. Brazilian news outlets report that the Sao Paulo police detected illegal spyware on numerous email accounts of the defendant. Apparently, two hackers admitted having hacked the defendant’s IT system, but denied any connection to the claimant.
Regardless of the question of who commissioned the cyber-attack, it is clear that privileged information may well have been compromised, the impartiality of the arbitral tribunal is being questioned and arrests have been made by the police in connection with the cyber-attack allegations. In short: the proceedings face difficulties.
What can be done to be prepared?
This recent example of a cyber incident disrupting an on-going arbitration illustrates the importance of arbitral proceedings being prepared to prevent an incident from happening and to cope with such an incident if it does occur. Obviously, a cyber-attack cannot be fully prevented as there is no such thing like full technical security, with cyber attackers constantly adapting their methodology. However, there are risk mitigation measures that parties may wish to consider, with the involvement of the arbitral tribunal, in order to limit the chances of a breach, and to help ensure the smooth running of the proceedings. The exact measures deployed will depend on the nature of the arbitration, its risk profile, and proportionality considerations, but these can include, amongst others: