The risks to corporations from corruption under the US Foreign Corrupt Practices Act (FCPA) and the (in some ways fiercer) UK Bribery Act, are well-known and understood. The current case against British-American Tobacco, which will likely be penalized heavily under both laws, is a cautionary tale.
At Asymmetrica we are tracking three emerging liability trends of which our corporate clients should be aware:
Liability for damages from the compromise of personnel data by a hack or leak
RICO prosecutions for lack of supply and distribution chain control
Corruption convictions in the importation of cheap migrant labor that ends up in debt bondage
The biggest growing liability trend (for which insurance companies are now offering riders) stems from the protection of data from cyber attacks. Most companies are infiltrated for nearly a year before they become aware of the hack. Companies can be the victims of:
“Black hat” hackers working at the behest of a government such as Russia or China
Activist hackers such as Anonymous or other “hacktivists” opposed to the corporation’s activities
Organized crime or even terrorist groups extorting money, either by:
Withholding access to service (see Hollywood Presbyterian Hospital case, above)
Selling data on the Dark Web or using it themselves to launder money and acquire goods needed for their ongoing criminal enterprises
Leaks or extortion by disgruntled or terminated employees who still have access to databases and the Internet after dismissal.
Corporations hold data on R&D, M&A or JV contracts, suppliers, clients, contractors and consultants. As we saw with the Sony hack, personnel, whether in-house or third-party, can sue a company for failure to have sufficient countermeasures to protect their data, particularly if it can be proven that the corporation was aware of weaknesses in its IT systems — including failure to cut off access to terminated employees.The second emerging liability trend we are seeing is from distribution and supply chain KYC (know-your-customer). As above, the prosecution of pharmaceutical company executives for selling key inputs for narcotics has been expanding for several years. The OECD’s Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas and its attendant “blood mobile phones” campaign, has prompted Apple to undertake better know-your-supplier measures and De Beers to undertake better both know-your-supplier and know-your-customer (KYC) measures. DeBeers now boasts that not only does it not buy “conflict” or “blood” diamonds, but it won’t sell ints “conflict-free” diamonds to wholesalers or retailers who trades in conflict diamonds, turning the regulatory trend into a branding opportunity. Asymmetrica is well on record pushing for similar measures across other consumer goods industries, including tobacco: if you are selling key inputs to illicit producers who use organized crime to smuggle the products, you should be liable under RICO.
The third emerging trend in corporate liability comes from the human trafficking and slavery that is so prevalent in labor migration. Corruption is a major factor in the debt bondage behind forced labor and human trafficking – and there are multitudinous opportunities for corruption in the supply chain for cheap imported labor. Civil servants can (and are) bribed in order to approve, expedite or outright falsify a plethora of documents, all of which entail the payment of fees. The heavy bureaucracy that creates the ample opportunities for graft on the government side and the large contracts that create the incentive for corruption on the business side of the equation together generate drivers for the exploitation of migrant workers at every point in their journey – and just about all of the upfront costs of their employment are in fact borne by the workers, not their employers, which not only contravenes contractual obligations, but is patently illegal. As I discuss in my upcoming book on crime-terror pipelines, anti-slavery NGOs are pushing to use US FCPA and the UK Bribery Act to prosecute companies who import cheap labor that ends up enslaved.
