A Look Inside the City of Atlanta's Legal Department During the Biggest Ransomware Attack on a Local Government
Roy Hadley, a former high-ranking in-house lawyer at several companies and the current outside counsel to the city of Atlanta called in to help the city respond to last year's massive breach, spoke with Corporate Counsel about how his time in-house informed his work on this matter and the role of the city's legal department during the crisis.
March 25, 2019 at 03:13 PM
5 minute read
The ransomware attack on the city of Atlanta, which marked its one-year anniversary last week, remains the most extensive breach on a local government to date.
A number of services in the major metropolitan center and home to the nation's busiest airport were hamstrung, keeping some city systems, including city payment and court information portals, offline for nearly a week after the attack was discovered.
Last November, a federal grand jury in Newark, New Jersey, returned a six-count indictment charging two Iranian nationals with creation of the SamSam ransomware that targeted not only the Atlanta government but other municipalities, hospitals and companies around the United States.
Roy Hadley, former vice president for legal and chief privacy officer at international travel services company World Travel Partners and former general counsel and corporate secretary at wireless communications company AirGate PCS, was brought in to help with the immediate response and aftermath. Hadley, now special counsel at Adams and Reese, a technology and cybersecurity expert and outside counsel to the city of Atlanta, spoke with Corporate Counsel about how his time in-house informed his work on this matter and the role of the city's legal department during the crisis.
The conversation has been edited for length and clarity.
Corporate Counsel: How did your experience as a GC and chief privacy officer prepare you for this event?
Roy Hadley: It helps if you have sat in that seat. If you understand what dynamics they're having to deal with, that's very helpful.
What are those dynamics?
Understanding that there's no such thing as a blank check, that the money has to be allocated from somewhere, that you have to run through the traps and understand protocols and approval levels. Understanding those issues and being able to bring them into the equation without somebody having to teach it to you on the fly is helpful because you can then say, “OK, let's do X, Y and Z.” And you already understand that inherent in X, Y and Z, you're going to have to get this approval or that approval.All of those things that I learned in corporate America were eminently helpful in terms of what advice I could give to the city. When you're in the trenches, and the bullets are flying around your head, being able to not have to ask the questions of, “Now, do we have to get approval for this? For that?” is invaluable.
How are these dynamics different when you're dealing with the government vs. corporate America?
Anytime you talk about a data breach or an attack, it's complex. But in this case, it's even more complex because now what you're talking about is water delivery, public safety, fire, police, 911. You're talking about trash pickup, building permits, court systems, a lot of different things that have to happen every day in order for the city to run. You can't say, “OK, they knocked us offline, and we can't sell our widgets.”
People's lives and public safety truly do depend upon the city being able to function. Corporate America has its challenges, and the stock price may get hit because of something, but in the government world, you potentially are talking about life and death.
And the thing that I am most proud of, and I think the city probably is most proud of, was that those essential services never stopped being delivered.
What was the role of the city of Atlanta's in-house legal department during this event?
In the legal department, there is no such thing as a cyber-response lawyer. In theory, there is no need for one because you can bring outside assistance in if needed, similar to what the city did.
But when you start talking about response, you're talking about contracts, procurements, courts and all of those issues. For example, as we were procuring vendors to come in and assist, the lawyers that deal with the contracts had to review those contracts very quickly. The lawyers that deal with procurement and the procurement process had to shepherd those contracts through the procurement process to get them signed and authorized because you have protocols that you must follow, even in an emergency. The lawyers that deal with the courts on a daily basis were helping us figure out what we needed to do to make sure that the courts were functioning appropriately.
The city had lawyers out there, working with the departments to make sure that any issues or potential issues were being addressed. It really was all hands on deck with respect to the law department because the law department is an interface with all of the various departments of the city.
Is there anything the city's legal department could have done to prevent what happened?
In an instance like this, people tend to focus on what went wrong, but I like to focus on what went right, and in this instance the city had an incident response plan that was immediately put into place.
And the lawyers had already vetted that response plan, so immediately people knew what to do, who to call, what groups needed to get together. But not only did the lawyers help put that together on the front end, they were instrumental in making sure that it was followed and that everyone was doing what they were supposed to do during the crisis.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View All11 Red State AGs Demand Damages in Antitrust Lawsuit Shaming ESG Climate Investors
3 minute readRegulatory Upheaval Is Coming. How Businesses Prepare and Respond Will Separate Winners and Losers
Trending Stories
Who Got The Work
J. Brugh Lower of Gibbons has entered an appearance for industrial equipment supplier Devco Corporation in a pending trademark infringement lawsuit. The suit, accusing the defendant of selling knock-off Graco products, was filed Dec. 18 in New Jersey District Court by Rivkin Radler on behalf of Graco Inc. and Graco Minnesota. The case, assigned to U.S. District Judge Zahid N. Quraishi, is 3:24-cv-11294, Graco Inc. et al v. Devco Corporation.
Who Got The Work
Rebecca Maller-Stein and Kent A. Yalowitz of Arnold & Porter Kaye Scholer have entered their appearances for Hanaco Venture Capital and its executives, Lior Prosor and David Frankel, in a pending securities lawsuit. The action, filed on Dec. 24 in New York Southern District Court by Zell, Aron & Co. on behalf of Goldeneye Advisors, accuses the defendants of negligently and fraudulently managing the plaintiff's $1 million investment. The case, assigned to U.S. District Judge Vernon S. Broderick, is 1:24-cv-09918, Goldeneye Advisors, LLC v. Hanaco Venture Capital, Ltd. et al.
Who Got The Work
Attorneys from A&O Shearman has stepped in as defense counsel for Toronto-Dominion Bank and other defendants in a pending securities class action. The suit, filed Dec. 11 in New York Southern District Court by Bleichmar Fonti & Auld, accuses the defendants of concealing the bank's 'pervasive' deficiencies in regards to its compliance with the Bank Secrecy Act and the quality of its anti-money laundering controls. The case, assigned to U.S. District Judge Arun Subramanian, is 1:24-cv-09445, Gonzalez v. The Toronto-Dominion Bank et al.
Who Got The Work
Crown Castle International, a Pennsylvania company providing shared communications infrastructure, has turned to Luke D. Wolf of Gordon Rees Scully Mansukhani to fend off a pending breach-of-contract lawsuit. The court action, filed Nov. 25 in Michigan Eastern District Court by Hooper Hathaway PC on behalf of The Town Residences LLC, accuses Crown Castle of failing to transfer approximately $30,000 in utility payments from T-Mobile in breach of a roof-top lease and assignment agreement. The case, assigned to U.S. District Judge Susan K. Declercq, is 2:24-cv-13131, The Town Residences LLC v. T-Mobile US, Inc. et al.
Who Got The Work
Wilfred P. Coronato and Daniel M. Schwartz of McCarter & English have stepped in as defense counsel to Electrolux Home Products Inc. in a pending product liability lawsuit. The court action, filed Nov. 26 in New York Eastern District Court by Poulos Lopiccolo PC and Nagel Rice LLP on behalf of David Stern, alleges that the defendant's refrigerators’ drawers and shelving repeatedly break and fall apart within months after purchase. The case, assigned to U.S. District Judge Joan M. Azrack, is 2:24-cv-08204, Stern v. Electrolux Home Products, Inc.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250