Driving Cybersecurity with Participants and Providers

Plan sponsors should evaluate providers’ cybersecurity practices, but there are also steps they and plan participants can take to safeguard retirement accounts.

Among a plan sponsor’s responsibilities, encouraging and enforcing cybersecurity are not the first tasks that come to mind.

Never miss a story — sign up for PLANSPONSOR newsletters to keep up on the latest retirement plan benefits news.

But, as modern technology takes over the common workplace, the concept of cybersecurity for retirement plans has started to see attention. In late 2018, the ERISA [Employee Retirement Income Security Act] Advisory Council requested guidance from the Department of Labor (DOL) on how employers should evaluate cybersecurity risks, and to mandate plan sponsors build a protection process and understand how these defenses work. In February, lawmakers sent a letter to the U.S. Government Accountability Office (GAO), asking it to examine cybersecurity in the U.S. retirement industry.

Plan sponsors, providers and participants are understanding how susceptible retirement plan and participant data are to hacks and online threats, but, what can they do to try to prevent attacks?

For starters, participants need to register their accounts online, says Charlie Nelson, CEO of Voya Retirement. Ensuring participants have registered can provide an additional degree of security in knowing that no one else is registering on a participant’s behalf.

“We sometimes hear people say, ‘My account is safe because I never registered for online access.’ That can be misguided. Fraudsters will sometimes try to get access to an unregistered account so they can set the original data points, such as a phone number or other piece of information,” Nelson says.

Not only should accounts be registered, personal devices including laptops, phones and tablets are important to cybersecurity as well, Nelson adds. He suggests that another step in securing private information is implementing two-factor authentication, where a one-time access code is sent to a participant via a phone call, text message or email, for example, to access his account.

“We recommend this feature as it provides another layer of security, in addition to a password,” Nelson says.  “Some may view this as an inconvenience, but when it comes to what is – for many people – their greatest financial asset, taking extra steps to protect their account is worth the time and effort.”

George Sepsakos, principal with Groom Law Group, says the industry has been seeing two-factor authorization features applied by plan sponsors recently. He adds that instituting required regular password changes could also aid in preventing hacks or online threats. “These are the type of actions that are low-hanging fruit,” he says.

Asking Providers About Cybersecurity

When selecting a recordkeeper or other plan provider, plan sponsors should ask about cybersecurity practices. They should be looking for a sense of partnership and communication on what is expected from a provider, and what it expects from them, says Allison Itami, principal at Groom Law Group.

“Cybersecurity is going to evolve, there is no static process,” she explains. “When you’re looking for a service provider, you want to be comfortable knowing that you’ll be in the loop and know that it is an evolving partnership.”

Instead of just asking about the number of incidents a service provider has had, plan sponsors should be asking how the provider will work with them in the event of a cyber incident in their plan, Itami says. The key is to not stress past data breaches, but stress the impact they will have for the provider in working with plan sponsors and the plan in the future.  

Sepsakos mentions asking whether a provider can present an audit of its cyber practices. Utilizing internal assistance, such as a plan sponsor’s own security team, to field questions and gain ideas to ask can be crucial in this process, and may help a plan sponsor better understand a provider’s cybersecurity measures, he adds.

“While we’re seeing more providers offer a cybersecurity guarantee, try to think about procedure and the technology the provider has, such as whether its site is data encrypted,” Sepsakos says.

At Voya, Nelson says, clients are protected by the S.A.F.E. program—if assets are taken out of an account, the company will restore its full value, given that participants have registered the account online and responded once notified about the potential unauthorized activity.

Nelson echoes Itami’s previous sentiments, mentioning the importance in engaging with plan providers to understand the tools educating their participants, and says that among other actions, plan sponsors can ask their providers to do predictive analytics on both the call center and websites.

He adds, “There’s a variety of information that a plan sponsor can and should get to understand the general level of security for the plan and the participants.”

Third-Party Litigation Funders and ERISA Suits

ERISA attorneys say it is not common to see third parties providing financial support to litigants in the retirement plan industry, despite the significant complexity and cost of ERISA litigation.

For a cut of the potential winnings, there are financial companies willing to put up capital to pay for some or all of the cost of private litigation, such as attorneys’ fees, discovery expenses, expert witness fees and court costs.

Given the substantial complexity and cost of litigation under the Employee Retirement Income Security Act (ERISA), it makes sense to ask whether “litigation finance” is common in the retirement plan industry.

Get more!  Sign up for PLANSPONSOR newsletters.

In the experience of David Levine and Kevin Walsh, principals at Groom Law Group, in fact this is not common in the ERISA domain. Both Walsh and Levine said they have not seen third parties funding any of the significant ERISA cases they have worked on or studied. Other attorneys active in the ERISA space concurred. 

One potential caveat to keep in mind here is that litigation funding firms commonly deploy non-disclosure agreements, so it is theoretically possible that litigation funding has occurred in ERISA lawsuits without being disclosed. According to Validity Finance, which engages in litigation funding across a variety of industries, the process starts with a potential client sharing basic information about their proposed claims. Generally, the litigation funder will execute a non-disclosure agreement at this early stage and only then conduct an initial screening of the claims and an evaluation of the basic economics of a potential funding agreement.

Assuming the claims seem reasonable, the litigation funding firm will then conduct its full due diligence to confirm the strength of the claims. It is common for the litigation funding firm to ask for documentation from the potential client and any existing counsel. From here, in Validity Finance’s case, a proposal is submitted to the firm’s investment committee for approval. Should the committee approve the proposal, litigation funding is then made available according to the terms of a privately negotiated contract.

According to Laina Miller Hammond and Wendie Childress, both serving in counsel roles at Validity Finance, in commercial litigation, “discovery has become a war of attrition in which the better-resourced party has an almost insuperable advantage.” They say litigation finance is growing in the U.S. and as a result, deep-pocketed parties facing lawsuits are using the discovery process as a delay tactic and to seek disclosure of confidential financing arrangements.

“Allowing such discovery is irrelevant to the merits of the case, and unduly burdens both courts and those litigants who avail themselves of financing,” they say. “Courts across the country are increasingly refusing to permit discovery of litigation financing documents, describing the use of financing as ‘a side issue at best.’”

Notably, the U.S. District Court for the Eastern District of New York recently weighed in on this issue in a case called Benitez v. Lopez. In short, the court held that litigation finance agreements are “not relevant to the litigation and should not be discoverable.” Hammond and Childress note that the defendants had argued they needed access to the funding agreement in order to understand “the motives behind it,” and claimed that the existence of the agreement went “directly to plaintiff’s credibility and [was] grounds for impeachment at trial.”

In denying the motion, the court stated “the financial backing of a litigation funder is as irrelevant to credibility as the plaintiff’s personal financial wealth, credit history, or indebtedness. That a person has received litigation funding does not assist the fact finder in determining whether or not the witness is telling the truth.”

Financing More Likely in the Future?

Despite the prospect of an undisclosed financing agreement, one potential obstruction to litigation funding becoming popular in the ERISA domain is that recovered losses are generally paid to the retirement plan, rather than to a private individual who could then pay the litigation funding firm according to the terms of a private, undisclosed contract. While ERISA permits the payment of substantial attorney’s fees to the counsel that represents participant-plaintiffs, it is far from clear that a participant could somehow compel an ERISA-covered retirement plan to pay some portion of its recovered losses to a third-party financier.

With this in mind, perhaps the most likely area in which litigation financing could be playing an undisclosed role in the ERISA domain would be a case where a firm like Validity Finance is providing financial resources to the attorneys representing classes of participant-plaintiffs, rather than providing such support directly to the lead plaintiffs. Indeed, according to Validity’s leadership, law firms have begun to realize the power of “portfolio financing” and are engaging third-parties to support their practices financially.  

“If your firm has an existing group of cases or wishes to build a portfolio, we can help,” the firm’s website advertises. “Like other funders, we can finance up to half of the fee and cost budgets of a basket of cases. This frees up capital for the firm’s other financial needs.”

In this way, Validity’s model helps litigators spread their risk, and its investments are “made in the firm not in the cases,” meaning law firm management can choose to use capital for broader strategic purposes—such as hiring lateral lawyers, expanding offices into new markets or covering fixed fee overruns.

According to Validity, generally, the term “litigation funder” describes a privately held or publicly traded entity that has its own pool of capital earmarked to invest in litigation. How a funder accesses that capital can vary widely. Some funders draw upon a dedicated investment fund, Validity’s leadership explains, while others rely on multiple investors to provide financial backing. Still others in the market “find and diligence cases first and then attempt to raise the necessary capital from their network of sources through a process called syndication.”

«