August 15, 2024 | GableGotwals is pleased to announce that 74 lawyers have been recognized in the 2025 Edition of The Best Lawyers in America, three of which were newly included, and two newly named on the “Ones to Watch” list. In addition, seven GableGotwals attorneys were named 2025 “Lawyer of the Year.”

Best Lawyers has published their list for more than three decades. Its first international list was published in 2006, and since then has grown to provide lists in more than 75 countries. Lawyers on The Best Lawyers in America list are divided by geographic region and practice areas and are reviewed by their peers on the basis of professional expertise.

GableGotwals would like to congratulate the following attorneys named to 2025 The Best Lawyers in America list:

The Best Lawyers in America
Houston
	John D. Sullivan Commercial Litigation
Oklahoma City
	Ellen A. Adams Energy Law
	Jeffrey A. Curran Insurance Law Personal Injury Litigation – Defendants	Product Liability Litigation – Defendants
	E. Talitha Ebrite Banking and Finance Law Commercial Litigation	Energy Law Oil and Gas Law
	Jake M. Krattiger Commercial Litigation Oil and Gas Law
	Lance E. Leffel Commercial Litigation Construction Law	Insurance Law Litigation – Insurance
	Robert G. McCampbell Administrative / Regulatory Law Bet-the-Company Litigation Commercial Litigation	Criminal Defense: White-Collar Government Contracts Government Relations Practice Health Care Law Litigation – Regulatory Enforcement (SEC, Telecom, Energy)
	Nick V. Merkley Commercial Litigation Energy Law	Litigation – Mergers and Acquisitions
	J. Blake Patton Commercial Litigation
	Leo J. Portman Corporate Law Energy Law	Litigation – Trusts and Estates
	Brooks Richardson Commercial Litigation
	Rob F. Robertson Commercial Litigation Corporate Governance Law Energy Law Oil and Gas Law	Litigation – Banking and Finance Litigation – Bankruptcy Litigation – Environmental Litigation – Real Estate
	G. Blaine Schwabe III Bankruptcy and Creditor Debtor Rights / Insolvency and Reorganization Law Bet-the-Company Litigation Commercial Litigation
	Leasa M. Stewart Insurance Law Litigation – ERISA
	Amy M. Stipe Commercial Litigation Oil and Gas Law
	Jay P. Walters Litigation – Mergers and Acquisitions Litigation – Securities Native American Law
Tulsa
	Steven J. Adams Commercial Litigation Mass Tort Litigation / Class Actions – Defendants
	Jennifer R. Annis Litigation – Health Care Litigation – Insurance	Medical Malpractice Law – Defendants
	John R. Barker Banking and Finance Law (Lawyer of the Year) Corporate Law Securities / Capital Markets Law
	Brandon C. Bickle Bankruptcy and Creditor Debtor Rights / Insolvency and Reorganization Law Commercial Litigation
	David L. Bryant Arbitration Bet-the-Company Litigation	Commercial Litigation Mediation
	Frank J. Catalano Copyright Law Patent Law	Trademark Law
	Jason B. Coutant Banking and Finance Law Corporate Law
	John D. Dale Bankruptcy and Creditor Debtor Rights / Insolvency and Reorganization Law
	Renee DeMoss Commercial Litigation Insurance Law	Litigation – ERISA
	Alicia J. Edwards Patent Law
	LeAnn Drummond Ellis Litigation – Trusts and Estates
	Grant Fitz Litigation – Insurance
	Craig A. Fitzgerald Commercial Litigation Insurance Law	Litigation – Antitrust Litigation – Intellectual Property
	Amelia A. Fogleman Appellate Practice Commercial Litigation	Litigation – Antitrust
	John A. Gaberino, Jr. Energy Law
	Robert J. Getchell Bankruptcy and Creditor Debtor Rights / Insolvency and Reorganization Law Litigation – Real Estate
	Jeffrey D. Hassell Banking and Finance Law Bankruptcy and Creditor Debtor Rights / Insolvency and Reorganization Law Corporate Law (Lawyer of the Year)
	Jeffrey T. Haughey Securities / Capital Markets Law Securities Regulation
	Steven G. Heinen Banking and Finance Law Corporate Law
	Philip D. Hixon Appellate Practice (Lawyer of the Year) Commercial Litigation
	Andrew J. Hofland Commercial Litigation
	Thomas J. Hutchison Banking and Finance Law Corporate Law	Real Estate Law
	Susan I. Jordan Health Care Law Litigation – Health Care
	Stephen W. Lake Banking and Finance Law Commercial Litigation Corporate Law	Energy Law (Lawyer of the Year) Mergers and Acquisitions Law Oil and Gas Law Securities / Capital Markets Law (Lawyer of the Year) Securities Regulation
	Lloyd W. Landreth Litigation – Environmental Natural Resources Law
	James F. Lea III Copyright Law Patent Law	Trademark Law (Lawyer of the Year)
	David Limekiller Banking and Finance Law Commercial Litigation
	Graydon D. Luthey, Jr. Commercial Litigation Corporate Compliance Law	Corporate Governance Law Corporate Law Gaming Law Native American Law
	David B. McKinney Employee Benefits (ERISA) Law Health Care Law	Litigation – ERISA (Lawyer of the Year) Trusts and Estates
	Todd A. Nelson Copyright Law Litigation – Patent
	Richard B. Noulles Bet-the-Company Litigation Commercial Litigation	Natural Resources Law Oil and Gas Law
	Terry D. Ragsdale Commercial Litigation Energy Law
	Paul E. Rossler Patent Law Technology Law	Trademark Law
	John Henry Rule Banking and Finance Law Commercial Litigation	Litigation – Banking and Finance Litigation – First Amendment
	Stephen A. Schuller Energy Law Land Use and Zoning Law	Litigation – Real Estate Real Estate Law
	Deborah C. Shallcross Appellate Practice Arbitration	Family Law
	Trent Shores Commercial Litigation Native American Law
	Lisa T. Silvestri Energy Law Insurance Law
	Timothy J. Sullivan, Jr. Commercial Litigation Energy Law
	Sidney K. Swinson Bankruptcy and Creditor Debtor Rights / Insolvency and Reorganization Law Bet-the-Company Litigation Litigation – Bankruptcy
	Chris S. Thrutchley Employment Law – Management Labor Law – Management	Litigation – Labor and Employment
	Mia Vahlberg Commercial Litigation Corporate Law	Energy Law Insurance Law Oil and Gas Law
	Tom C. Vincent II FinTech Practice Privacy and Data Security Law
	David G. Woodral Patent Law (Lawyer of the Year) Trademark Law
	Scott R. Zingerman Copyright Law Patent Law	Trade Secrets Law
Best Lawyers: Ones to Watch in America
Oklahoma City
	Gerard D’Emilio Appellate Practice Commercial Litigation
	Scott Kiplinger Litigation – Construction Oil and Gas Law
	Ashlyn Smith Oil and Gas Law
	Tim Sowecke Energy Law Environmental Law	Natural Resources Law
Tulsa
	Emily Collins Litigation – Trusts and Estates Trusts and Estates
	Madeline Cook Litigation – Intellectual Property
	Adam Doverspike Administrative / Regulatory Law Appellate Practice	Commercial Litigation Litigation – Construction Municipal Law
	Justin A. Lollman Appellate Practice Commercial Litigation	Criminal Defense: White-Collar Labor and Employment Law – Management
	Barrett L. Powers Commercial Litigation Insurance Law

January 1, 2024 | By: Brooks A. Richardson and Tom C. Vincent II

On January 1, 2024, beneficial ownership information reporting requirements will take effect for legal entities created or registered to do business in the United States. The CTA reporting requirements will affect “tens of millions” of legal entities, according to official estimates from the U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN). Businesses of all sizes will need to consider their reporting obligations.

Who must file beneficial ownership information reports (“BOI Reports”)?

• “Reporting Companies” are defined to mean virtually any legal entity created or registered to do business in the United States, including corporations, LLCs, various types of partnerships, and certain trusts. The statutory and regulatory definitions are intentionally broad.

What are the exemptions from these requirements?

• Under the CTA and FinCEN’s implementing rules, 23 exemptions exist from the definition of “Reporting Company.” An entity that qualifies for any one of these exemptions need not file a BOI Report.
• Examples of exempt entities include:
  • Banks, bank holding companies, broker-dealers, exchanges, clearinghouses, and CFTC-registered entities
  • Issuers of securities registered under Exchange Act Section 12 or required to file information under Section 15(d)
  • Investment companies and registered investment advisers
  • Certain registered venture capital fund advisers
  • Insurance companies
  • Accounting firms
  • Certain pooled investment vehicles
  • Tax-exempt entities
  • “Large operating companies” with:
    • a physical office in the U.S.;
    • more than 20 full-time employees; and
    • annual gross revenues exceeding $5MM
  • Subsidiaries “controlled or wholly owned” by certain types of exempt entities
  • “Inactive” entities

How is a BOI Report filed?

Through an electronic filing system available through FinCEN’s website. FinCEN cannot accept BOI reports before January 1, 2024.  Starting on that day, the URL to file a report is:  https://www.fincen.gov/boi

What information must a BOI Report include?

• Full legal name of entity and any “doing business as” (DBA) name;
• Street address for the entity’s principal place of business (domestic entities) or the primary U.S. location (foreign entities);
• State/territory of incorporation/formation or, for foreign entities, the U.S. jurisdiction where it first registered to do business;
• Internal Revenue Service (IRS) taxpayer identification number;
• For each “Beneficial Owner” and “Company Applicant”:

• Full legal name
• Date of birth
• Street address (must be a residential address for Beneficial Owners)
• A “unique identifying number” (valid passport/state ID/driver’s license)

Who is a Beneficial Owner?

An individual who, directly or indirectly:

• Owns or controls at least 25% of the ownership interests of such Reporting Company, regardless of the form such interests take (e.g., equity shares, a capital or profit interest, convertible instruments, options, etc.); or
• Exercises substantial control over the entity, including:
• “Senior officers” (e.g., President, CEO, COO, CFO, General Counsel or individuals performing similar functions);
• Individuals with the authority to appoint or remove senior officers or a majority of the directors (or similar body);
• “Decision makers” (individuals who, for any reason, have the ability to direct, determine, or exercise substantial influence over important decisions of the entity); and
• Any individual who has any other form of material control over the Reporting Company (e.g., general partners/managers or a VC investor capable of influencing important decisions)

Who is a Company Applicant*?

An individual who:

• “Directly files” the entity’s creation or registration document (must be identified by all Reporting Company that is required to report its Company Applicants); and
• (if more than one individual is involved) Is “primarily responsible for directing or controlling” such filing.

• Although the reporting requirements take effect on January 1, 2024, the deadline for filing an initial report varies, depending on when the entity was formed:
• After filing an initial BOI report, a company must submit updated reports within 30 daysof any change in beneficial ownership.

*Note: Required only for reporting companies formed after January 1, 2024

When are BOI Reports Due?

• Initial Reports

When Reporting Company formed:	When initial report is due:
Before January 1, 2024	By January 1, 2025
During 2024	Within 90 days of formation
After January 1, 2025	Within 30 days of formation

• Updates

• • After filing an initial BOI report, a company must submit updated reports within 30 daysof any change in beneficial ownership.

What are the penalties for failing to file?

• Civil and criminal penalties attach to both reporting and use/disclosure violations. The civil penalty for willful noncompliance of beneficial ownership reporting requirements is a fine of $500 per day, and criminal penalties include a fine up to $10,000, imprisonment, or both.
• The CTA prohibits:

• • Willful provision of false or fraudulent beneficial ownership information or identifying documents or failure to report or update required information; and
  • Knowing unauthorized use or disclosure of beneficial ownership information obtained from FinCEN.

• While Reporting Companies are generally responsible for compliance under the CTA, individuals may be held liable for noncompliance.
• Under a safe harbor provision, an entity can avoid liability (absent evidence of intentional evasion of compliance) by correcting inaccurate information within 90 days of submission.

What should companies be doing now?

• Managers of legal entities organized or registered to do business in the United States should consider:

• • Evaluating every entity within the organizational structure to determine which may be a “Reporting Company” and whether an exemption may apply;
  • Identifying each “Beneficial Owner” for entities that are “Reporting Companies” and, for those organized after January 1, 2024, the “Company Applicant(s);”
  • Collecting required information for the BOI Report(s) and preparing to file in accordance with the applicable deadline;
  • Maintaining a tracking system for Beneficial Owners so that timely update filings can be made going forward.
• Legal professionals should consider not only reporting obligations that apply to their clients but also their own potential obligations as “Company Applicants.”

As indicated above, the CTA and its implementing regulations have created a number of new risks and responsibilities – we understand the difficulty in sorting through these new requirements, let alone complying with them. If you have any questions about them, or how GableGotwals may be able to help you, please let us know.

Brooks A. Richardson 405-568-3310 brichardson@gablelaw.com	Tom C. Vincent II

This information is provided for educational and informational purposes only and does not contain legal advice or create an attorney-client relationship. The information provided should not be taken as an indication of future legal results; any information provided should not be acted upon without consulting legal counsel.

GableGotwals is pleased to announce that 74 lawyers have been recognized in the 2024 Edition of The Best Lawyers in America, four of which were newly included, and seven newly named on the “Ones to Watch” list. In addition, eight GableGotwals attorneys were named 2024 “Lawyer of the Year.”

Best Lawyers has published their list for more than three decades. Its first international list was published in 2006, and since then has grown to provide lists in more than 75 countries. Lawyers on The Best Lawyers in America list are divided by geographic region and practice areas and are reviewed by their peers on the basis of professional expertise.

GableGotwals would like to congratulate the following attorneys named to 2024 The Best Lawyers in America list:

	Ellen A. Adams Oklahoma City	Energy Law
	Steven J. Adams Tulsa	Commercial Litigation Mass Tort Litigation/Class Action-Defendants
	John R. Barker Tulsa	Banking and Finance Law Corporate Law Securities/Capital Markets Law
	Brandon C. Bickle Tulsa	Bankruptcy and Creditor Debtor Rights / Insolvency and Reorganization Law Commercial Litigation
	David L. Bryant Tulsa	Arbitration Bet-the-Company Litigation Commercial Litigation Mediation
	Meagan E.W. Burrows Tulsa	“Ones to Watch” Healthcare Law Business Organizations (Including LLCs and Partnerships) Banking and Finance Law
	Frank J. Catalano Tulsa	Copyright Law Patent Law Trademark Law
	Emily R. Collins Oklahoma City	Litigation – Trusts and Estates
	Casey Cooper Tulsa	Commercial Litigation
	Jason B. Coutant Tulsa	Banking and Finance Law Corporate Law
	Jeffrey A. Curran Oklahoma City	Insurance Law Personal Injury Litigation – Defendants Product Liability Litigation – Defendants
	John D. Dale Tulsa	Bankruptcy and Creditor Debtor Rights / Insolvency and Reorganization Law
	Gerard M. D’Emilio Oklahoma City	“Ones to Watch” Appellate Practice Commercial Litigation
	Renee DeMoss Tulsa	Insurance Law Commercial Litigation Litigation – ERISA(Lawyer of the Year)
	Adam C. Doverspike Tulsa	“Ones to Watch” Administrative / Regulatory Law Appellate Practice Commercial Litigation Municipal Law Litigation – Construction
	E. Talitha Ebrite Oklahoma City	Oil and Gas Law Energy Law Banking and Finance Law Commercial Litigation
	Alicia J. Edwards Tulsa	Patent Law
	LeAnn Drummond Ellis Tulsa	Litigation – Trusts and Estates
	Philip Feist Tulsa	Trusts and Estates
	Grant A. Fitz Tulsa	Litigation – Insurance
	Craig A. Fitzgerald Tulsa	Commercial Litigation Insurance Law Litigation – Antitrust Litigation – Intellectual Property
	Amelia A. Fogleman Tulsa	Appellate Practice (Lawyer of the Year) Commercial Litigation Litigation – Antitrust
	John A. Gaberino, Jr. Tulsa	Energy Law
	Robert J. Getchell Tulsa	Bankruptcy and Debtor Rights/Insolvency and Reorganization Law Litigation – Real Estate
	Jeffrey D. Hassell Tulsa	Banking and Finance Law (Lawyer of the Year) Bankruptcy and Creditor Debtor Rights / Insolvency and Reorganization Law Corporate Law
	Jeffrey T. Haughey Tulsa	Securities/Capital Markets Law Securities Regulation
	Steven G. Heinen Tulsa	Banking and Finance Law Corporate Law
	Philip D. Hixon Tulsa	Appellate Practice Commercial Litigation
	Andrew J. Hofland Tulsa	Commercial Litigation
	Thomas J. Hutchison Tulsa	Banking and Finance Law Corporate Law Real Estate Law
	Susan Jordan Tulsa	Healthcare Law Litigation – Healthcare
	Scott Kiplinger Oklahoma City	“Ones to Watch” Litigation – Construction Oil and Gas Law
	Jake Krattiger Oklahoma City	Commercial Litigation Oil and Gas Law
	Stephen W. Lake Tulsa	Banking and Finance Law Commercial Litigation Corporate Law Energy Law Mergers and Acquisitions Law Oil and Gas Law Securities/Capital Markets Law Securities Regulation
	Lloyd W. Landreth Tulsa	Litigation – Environmental (Lawyer of the Year) Natural Resources Law
	James F. Lea, III Tulsa	Copyright Law Patent Law (Lawyer of the Year) Trademark Law
	Lance Leffel Oklahoma City	Commercial Litigation Insurance Law Construction Law Litigation – Insurance
	David P. Limekiller Tulsa	Banking and Finance Law Commercial Litigation
	Justin A. Lollman Tulsa	“Ones to Watch” Appellate Practice Commercial Litigation Criminal Defense: White-Collar Labor and Employment Law – Management
	Graydon Dean Luthey, Jr. Tulsa	Commercial Litigation Corporate Compliance Law Corporate Governance Law Corporate Law Gaming Law Native American Law
	Robert G. McCampbell Oklahoma City	Administrative / Regulatory Law  (Lawyer of the Year) Bet-the-Company Litigation Commercial Litigation Criminal Defense: White-Collar Government Contracts Government Relations Practice (Lawyer of the Year) Healthcare Law Litigation – Regulatory Enforcement (SEC, Telecom, Energy)
	David B. McKinney Tulsa	Employee Benefits (ERISA) Law Healthcare Law Litigation – ERISA Trusts and Estates
	Nick Merkley Oklahoma City	Energy Law Commercial Litigation
	Motahareh H. Nickel Oklahoma City	“Ones to Watch” Banking and Finance Law Mergers and Acquisitions Law
	Todd A. Nelson Tulsa	Copyright Law Litigation – Patent
	Richard B. Noulles Tulsa	Natural Resources Law (Lawyer of the Year) Commercial Litigation Bet-the-Company Litigation Oil and Gas Law
	Leo J. Portman Oklahoma City	Corporate Law Energy Law Litigation – Trusts and Estates
	Barrett Powers Tulsa	“Ones to Watch” Commercial Litigation
	Terry D. Ragsdale Tulsa	Commercial Litigation Energy Law
	Rob F. Robertson Oklahoma City	Commercial Litigation Corporate Governance Law Energy Law Litigation – Banking and Finance Litigation – Bankruptcy Litigation – Environmental Litigation – Real Estate Oil and Gas Law
	Paul E. Rossler Tulsa	Patent Law Technology Law Trademark Law
	John Henry Rule Tulsa	Banking and Finance Law Commercial Litigation Litigation – Banking and Finance Litigation – First Amendment
	John D. Russell Tulsa	Bet-the-Company Litigation Commercial Litigation
	Stephen A. Schuller Tulsa	Energy Law Land Use and Zoning Law Litigation – Real Estate Real Estate Law
	G. Blaine Schwabe, III Oklahoma City	Bankruptcy and Creditor Debtor Rights / Insolvency and Reorganization Law Bet-the-Company Litigation Commercial Litigation
	Deborah C. Shallcross Tulsa	Appellate Practice Arbitration Family Law
	Trent Shores Tulsa	Commercial Litigation
	Lisa T. Silvestri Tulsa	Energy Law Insurance Law
	Ashlyn M. Smith Oklahoma City	“Ones to Watch” Oil and Gas Law
	Leasa M. Stewart Oklahoma City	Insurance Law Litigation – ERISA
	Amy M. Stipe Oklahoma City	Commercial Litigation Oil and Gas Law
	Timothy J. Sullivan, Jr. Tulsa	Energy Law Commercial Litigation
	John D. Sullivan Houston	Commercial Litigation
	Sidney K. Swinson Tulsa	Bankruptcy and Creditor Debtor Rights / Insolvency and Reorganization Law (Lawyer of the Year) Bet-the-Company Litigation Litigation – Bankruptcy
	Chris S. Thrutchley Tulsa	Employment Law – Management Labor Law – Management
	Mia Vahlberg Tulsa	Commercial Litigation Corporate Law Energy Law Insurance Law Oil and Gas Law
	Tom C. Vincent II Tulsa	FinTech Practice Information Technology Law Privacy and Data Security Law
	Jay P. Walters Oklahoma City	Litigation – Mergers and Acquisitions Litigation – Securities Native American Law
	Brad W. Welsh Tulsa	Appellate Practice Commercial Litigation
	Paula M. Williams Oklahoma City	Employment Law – Management Litigation – Labor and Employment
	David G. Woodral Tulsa	Patent Law Trademark Law
	Scott R. Zingerman Tulsa	Copyright Law Patent Law Trade Secrets Law

Best Lawyers lists are compiled based on an exhaustive peer review evaluation, therefore, honorees are not required or allowed to pay a fee to be included.  However, to be listed on the Best Lawyers web site, there is a required advertising fee.

March 31, 2022 | By Susan Lindberg, Trent Shores, and Tom Vincent

President Biden’s recent signature of a new cyber incident reporting law made headlines. The Cyber Incident Reporting for Critical Infrastructure Act of 2022, which was attached to a $1.5 trillion government funding bill, requires critical infrastructure owners to file a report with the Cybersecurity and Infrastructure Security Agency (CISA) of the U.S. Department of Homeland Security if they have been hacked or made a ransom payment in response to a ransomware attack. Reports must be made within 72 hours of a breach, and within 24 hours of a ransom payment.

The statute, signed March 15, 2022, requires CISA to issue rules implementing the new law. CISA has two years to publish its proposed rules in the Federal Register. The law does not provide specific guidance on whether, how, or in what circumstances to report cyber incidents in the interim. The U.S. government has consistently urged, but not required, critical infrastructure owners to report significant incidents. For example, the Cybersecurity Information Sharing Act of 2015.

Who will be affected? The law applies to “covered entities” within the 16 critical infrastructure sectors identified in Presidential Policy Directive 21, which was issued in 2013. These sectors are:  chemical, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, energy, financial services, food and agriculture, government facilities, healthcare and public health, information technology, nuclear reactors, materials, and waste, transportation systems, and water and wastewater systems. The new law requires CISA’s rule to include a clear description of the types of entities that constitute “covered entities.”

What types of incidents must be reported? Covered entities must report “covered cyber incidents.” At a minimum, these are:

• a cyber incident that leads to substantial loss of confidentiality, integrity or availability of such information system or network, or a serious impact on the safety and resiliency of operational systems and processes;
• a disruption of business or industrial operations, including due to a denial of service attack, ransomware attack or exploitation of a zero day vulnerability; or
• unauthorized access or disruption of business or industrial operations due to loss of service facilitated through, or caused by, a compromise of a cloud service provider, managed service provider, or other third-party data hosting provider or by a supply chain compromise.

The new statute directs CISA to clearly describe the types of incidents that are “covered cyber incidents.”

Ransom payments in connection with a covered cyber incident must also be reported.

How will reported information be used?  Information will be anonymized, aggregated, and shared among various government agencies in order to improve cybersecurity, identify and track attackers, and assist companies in addressing ongoing threats and vulnerabilities.

Will companies be penalized if they do not report?  The new law does not give CISA the authority to issue fines or other penalties. It specifically grants CISA the power to issue subpoenas to allow it to obtain information to companies that do not submit a required report.

Does information provided to the government remain private? Companies reporting cyber incidents or ransom payments to CISA will receive protections similar to those contained in the Cybersecurity Information Sharing Act of 2015: companies receive liability protections, privileges are maintained, proprietary information is protected, information is not released under the Freedom of Information Act, and certain liability protections.

How to plan ahead for required reporting?  Although the details of CISA’s reporting requirements are not yet known, because other laws and regulations in effect (as well as client or vendor contracts) may require an organization to report a significant cyber incident within a short period of time to the government or to others, organizations should (if they haven’t already) have both a reporting plan in place and a structure to appropriately collect information for such reporting.

Sources of these reporting requirements may include:

• Securities and Exchange Commission reporting requirements — in addition to its 2018 guidance on reporting of cyber incidents, the SEC has proposed a new regulation on cybersecurity requirements and disclosure
• State data privacy laws
• Industry-specific regulations, such as the TSA Security Directives for critical pipeline infrastructure
• Insurance policies

An organization will have many decisions to make within a short time frame if it experiences a significant cybersecurity breach. It is important to know and consider ahead of time what circumstances would require reporting, and include those requirements and outline a decision process in an incident response plan. Seek advice of counsel for guidance on the specific requirements applicable to your organization.

Regardless of whether a disclosure is required by law, an organization may wish to make voluntary disclosures, either to government agencies or to an information sharing and analysis center specific to the industry, or to law enforcement or the organization’s insurance carrier. Legal counsel can provide guidance on ensuring that the organization is protected when providing such information.

Trent Shores Former United States Attorney and National Security Cyber Specialist 918-595-4805 tshores@gablelaw.com	Tom Vincent Certified Regulatory Compliance Manager and Certified Information Privacy Professional

This article is provided for educational and informational purposes only and does not contain legal advice or create an attorney-client relationship. The information provided should not be taken as an indication of future legal results; any information provided should not be acted upon without consulting legal counsel.

October 27, 2021 | By: Emma Kincade, Trent Shores, and Tom C. Vincent II

A number of tribal governments and their business enterprises are in the sights of cybercriminals. Cyberattacks threaten the security and critical infrastructure of tribal nations, many of which are integral to healthcare, education, justice, and other governmental services and operations. A number of tribes within Oklahoma’s borders and beyond were targeted by ransomware attacks in 2021, leaving both their information technology systems and their citizens in peril. Government facilities, hospitals, justice systems, and gaming enterprises were forced to shut their doors and respond to what some tribal leaders have rightly identified as acts of terrorism against their sovereign nations.

The Federal Bureau of Investigation estimates that hackers launch nearly 4,000 ransomware attacks per day. More and more hackers have recently shown a focused interest in tribal enterprises, including gaming operations, because of their deep cash reserves. Cyberattacks in Indian Country are becoming more frequent and more destructive, prompting the National Indian Gaming Commission to announce that it will go “on the offense” and create a cybersecurity task force. Moreover, the need for action to protect tribal citizen’s personal data and health information is pertinent and clear, especially as tribal governments transition to facilitate more online services during the COVID-19 pandemic.

Ransomware breaches are costly. Perpetrators have been known to demand thousands—or even millions—in cash for the return of data. The catastrophic nature of these attacks leave many leaders wondering if the tribe should pay a hacker’s ransom. Some tribes have reported that after their data was returned for a high price, some files remained subject to encryption, leaving the files corrupt and sometimes unusable. Others have declined to pay ransom, resulting in days of shutdown at revenue-driving facilities because of prolonged damage to the tribes’ IT systems. So, how do tribes defend their data? It depends. There is no one size fits all solution for Indian Country. Each tribe is unique in its history, people, culture, customs, language, and government. Tribes maintain different data for numerous purposes, and through various systems and access points. Because there is no uniform approach, guarding against sophisticated cyberattacks requires a firm understanding of a tribe’s government structure, economic environment, and approach to self-governance.

The Transportation Security Administration, Securities and Exchange Commission, Department of Labor Office of Safety and Health Administration, and Department of Homeland Security have made cybersecurity regulation and enforcement a priority in 2021. Each shares a common message across the board: it is imperative that any individual, government, or business prepare its arsenal for responding to cyberattacks. Every good defense starts with a plan. Developing a comprehensive response plan that encompasses both the tribe’s government and business operations will enable swift action by those best-suited to respond to attacks as soon as they come. Unlike the often top-secret plans used by America’s armed forces to respond to enemy combatants, the best cybersecurity plan is one that is communicated to and understood by every person at every level of service. This includes a tribe’s third-party vendors, because as more data is shared, more access points arise. Preventative measures, including employee training and system audits are necessary to prepare team members and vendors at every level of operation to avoid attacks and respond to crises as they occur. Even with a defense strategy in place, data is vulnerable to theft and corruption unless government and business IT systems are fortified. Guarding against sophisticated hackers will require more than a few anti-virus updates; and everyone from tribal leaders to employees must understand their responsibilities to protect the tribe and the data it maintains.

Sadly, cybersecurity threats are no longer hypothetical and criminals are targeting every access point imaginable. Every link in the armor provides a stronger and more coordinated response to cybercriminals and others seeking to disrupt the self-governance of our tribal nations. It’s evident that hackers are on the offense. It’s time to secure the defense.

Trent Shores 918-595-4805 tshores@gablelaw.com	Tom C. Vincent II

This article is provided for educational and informational purposes only and does not contain legal advice or create an attorney-client relationship. The information provided should not be taken as an indication of future legal results; any information provided should not be acted upon without consulting legal counsel.