SAFETY Act Sequence, Half 1: The SAFETY Act Is Highly effective Safety Towards Rising Liabilities

The SAFETY Act is a extremely efficient threat administration device created to incentivize the event of anti-terrorism applied sciences—broadly outlined—the SAFETY Act created a program to supply protections to suppliers of services meant to forestall or mitigate bodily and cyber-attacks.  Amongst different advantages, corporations receiving SAFETY Act protection for his or her applied sciences have their probably legal responsibility related to an act of terrorism capped on the quantity of insurance coverage protection required by the U.S. Division of Homeland Safety (“DHS”).  Corporations searching for to cut back their publicity to legal responsibility related to cyber or bodily assaults ought to think about making use of for designation or certification underneath the SAFETY Act.  DHS has additionally accepted all kinds of different applied sciences and safety applications for cover underneath the SAFETY Act. 

Almost each enterprise is susceptible to potential cyber or bodily assaults.  The liabilities arising in reference to cyber incidents may be large and are an rising focus for companies, giant and small.  Equifax paid $700M to resolve authorities investigations and client claims arising out of an information breach, and T-Cellular paid $500M to settle an information breach class motion.  Potential legal responsibility is just not restricted to the group; administrators and officers additionally face the specter of particular person legal responsibility.  For instance, final 12 months, the Delaware Chancery Courtroom dominated that officers owe an obligation of oversight (since clarifying that this obligation will likely be analyzed underneath the identical commonplace as fir administrators), opening the door for civil breach of oversight claims to be introduced towards each administrators and officers. 

What Is the SAFETY Act?

Congress handed the Supporting Anti-Terrorism by Fostering Efficient Applied sciences (“SAFETY”) Act^[1] in 2002 following the September 11 terrorist assaults.  The Act created a program administered by the DHS to advertise the event of “certified anti-terrorism applied sciences” meant to safeguard towards “acts of terrorism.”  The SAFETY Act defines acts of terror broadly.  Included are any acts which might be illegal and trigger hurt in the USA utilizing strategies supposed to trigger mass losses. 

Act of terrorism means any act [that]. . .

(1) Is illegal.

(2) Causes hurt, together with monetary hurt, to an individual, property, or entity, in the USA, or within the case of a home United States air provider or a United States-flag vessel . . . in or exterior the USA.

(3) Makes use of or makes an attempt to make use of instrumentalities, weapons or different strategies designed or supposed to trigger mass destruction, harm or different loss to residents or establishments of the USA.

49 C.F.R. 50.201.  In passing this laws, and in its persevering with help of this program, Congress seeks to encourage corporations to put money into a variety of anti-terrorism applied sciences. 

Importantly, merchandise, providers, and methods may be protected.  The DHS notes that “certified anti-terrorism applied sciences” is outlined very broadly to incorporate “any qualifying product, gear, service (together with help providers), system, or expertise (together with data expertise)” that deserves safety.  For instance, many sorts of providers— design, consulting, engineering, and software program improvement and/or integration—qualify as “expertise,” as do menace evaluation and vulnerability research.  In actual fact, DHS has decided that an enterprise-wide cyber governance framework can qualify as a licensed “expertise” for functions of the SAFETY Act.  The DHS additionally lists detection methods, blast mitigation supplies, screening providers, sensors and detectors, choice help software program, safety plans, and disaster administration methods as eligible for cover.^[2]

The Act makes three ranges of safety accessible for qualifying applied sciences; so as of safety, they’re:  (1) Growth, Testing, and Analysis Designation, (2) Designation, and (3) Certification.^[3]  Every has differing requirements, phrases, and accompanying protections.  Some latest recipients of SAFETY Act safety embrace:

• Nationwide Soccer League:  Certification for tips for stadium safety administration to discourage and defend towards terrorist assaults at sports activities stadiums;
• Leidos:  Designation for a non-intrusive inspection system to scan motorized autos;
• Hardwire, LLC:  Designation for a bodily protect put in over susceptible cable bridge elements;
• ASIS Worldwide, Inc.:  Designation for a certification and re-certification program for safety professionals primarily based on examinations;
• American Petroleum Institute:  Certification for its commonplace offering necessities and steerage for managing cyber threat for the oil and pure fuel pipeline trade.^[4]

What Are the Advantages of Designation and/or Certification?

Designation or certification as a professional anti-terrorism expertise (“QATT”) entitles the creators or customers of certified applied sciences to highly effective legal responsibility protections within the occasion of a declared act of terrorism.  These advantages could embrace, relying on the extent of designation or certification, unique federal jurisdiction and selection of regulation the place the assault occurred, caps on legal responsibility, prohibition of punitive damages, and authorities contractor immunity. 

The SAFETY Act additionally affords significant reputational advantages.  The expertise will likely be positioned on the DHS’s Accepted Applied sciences record, and the creator is entitled to make use of a DHS seal of approval in public supplies.  The federal authorities additionally generally requires SAFETY Act certification for its contractors. Corporations can switch certification together with the expertise within the occasion of a sale or merger.

Lastly, SAFETY Act safety can show extremely useful in different contexts the place the security and safety of an organization’s merchandise, providers, or operations is scrutinized— whether or not by regulators, buyers, clients, or jurors.  A SAFETY Act certification or designation may very well be a pivotal issue within the analysis of an organization’s conduct and potential legal responsibility within the wake of a cyber or bodily incident inflicting substantial hurt—even when the occasion is just not declared an act of terrorism that will set off the Act’s statutory protections.  Insurers may think about SAFETY Act safety in underwriting legal responsibility insurance policies, significantly cyber and D&O legal responsibility.  This can be a large alternative for policyholders to display that they need to obtain the good thing about decrease premiums and better protection given the proactive steps they’ve taken to cut back legal responsibility by making certain state-of-the-art expertise and acquiring recognition of these efforts by way of SAFETY Act certification or designation.

How Is Expertise Licensed?

Corporations searching for SAFETY Act safety should file a petition with the DHS.  Extra on this course of will likely be addressed in Half 2 of this sequence. 

^[1] See 6 U.S.C. § 441 et seq.

^[2] See SAFETY Act 101 Briefing at 3, Dep, Dep’t of Homeland Safety, accessible at https://www.safetyact.gov/externalRes/refDoc/refGroup/8/SAFETYpercent20Actpercent20101percent20Briefing.pdf.

^[3] Id. at 6.

^[4] See SAFETY Act, Accepted Applied sciences, Dep’t of Homeland Safety, https://www.safetyact.gov/lit/at/aa.