The Transparency Imperative: Challenges Of Public Sector Cyber Incident Response

Public sector cyber incident response has unique challenges that counsel and client must appreciate. To demonstrate this point, we presented the following scenario at the Law Society of Ontario's recent Ontario Digital Evidence and eDiscovery Institute.

You are on day five of an incident as counsel to an Ontario public school board. The Board has been holding off inquires by staff and students with a communication that refers to a "network disruption." The Board does not know the details of what occurred, although the Chair of the Board of Trustees has been briefed informally briefed. The threat actor, the Karakurt group, just presented a 500,000+ line file tree with employee data going back 15 years and a hodgepodge of student data, including psycho-educational reports and individual education plans. They've given the Board five days to pay up or the data will be released on the Karakurt leak site.