McDermott Will & Schulte, a global law firm

Mark E. Schreiber focuses his practice on cybersecurity, data breach response, Payment Card Industry (PCI), global privacy coordination, and AI governance. He advises entities facing cross-border data protection, the General Data Protection Regulation (GDPR), privacy frameworks, strategic decisions, cyber assessments and investigations. Mark has led numerous multinational and cross-border matters and internal investigations, including those involving data breaches, data transfer and credit card/PCI matters. He has advised senior management, boards, and special board committees on a variety of investigations, including data breach prevention and response.

Mark has spoken around the world on topics related to data breaches and related defense litigation strategy, overlapping international data protection compliance, and other privacy topics. He has also given cyber, privacy, and AI presentations to delegations from some 80 countries during numerous State Department sponsored international visits. He helped found and was chair for over a decade of the Privacy and Data Protection Group of the World Law Group, an international affiliation of large law firms in some 65 countries, and received the “2012 World Law Group Practice/Industry Group Leader of the Year Award” in recognition of his privacy and data protection work, including managing two global data protection publications. In addition, Mark helped found and was co-chair of the Boston Bar Association’s Privacy Law Committee. He is also a Certified Information Privacy Professional (CIPP/US) and has given a variety of presentations for the International Association of Privacy Professionals (IAPP).

Mark has also practiced, written and lectured widely on topics related to employment law, including presentations to the Flaschner Judicial Institute for judges. Prior to entering private practice, he was the chief trial lawyer for the Massachusetts Commission Against Discrimination (MCAD).

Robert Duffy helps clients manage their cybersecurity, privacy, and information technology legal risks by delivering practical advice, navigating crisis response and aggressively pursuing justice for victims of cybercrime and business torts. Robert conducts internal investigations into security incidents, vulnerability reports, potential compliance issues, insider threats and other high-stakes matters. Robert helps clients meet regulatory and legal obligations by assessing cybersecurity maturity and developing cost-effective and risk-prioritized remediation plans and maturity roadmaps. Robert also defends clients against regulatory investigations and other post-incident disputes.

Robert helps industry leaders and other mature organizations meet emerging legal and regulatory obligations by leveraging enterprise risk management tools and techniques, deploying best-of-breed technology solutions and developing novel tactics, techniques, and procedures. He also helps start-up, mid-market and acquisition-focused companies quickly close compliance gaps. Robert helps clients across industries bring compliant and secure products to market.

Robert is a trusted adviser to the cybersecurity industry. His current and former clients include the counter-cybercrime division of a major technology company, a leading consumer security software company, a multinational managed security services provider and a leading enterprise cybersecurity services provider.

Robert is a lifelong technology enthusiast who wrote his first “hello world” computer program more than 30 years ago. He learned Linux and FreeBSD as an undergraduate and has been a Unix hobbyist since. Between undergraduate and law school, he was a full-stack developer for a leading government contractor. Today, clients turn to Robert for guidance with issues across the technology spectrum, including secure software development, privacy-by-design, process automation, outsourcing and external dependency management, information assurance and resiliency, operations technology, critical infrastructure, AI governance, IT audit and compliance operations.

In his pro bono practice, Robert fights for the confidentiality of abuse victim services by defending VAWA-funded organizations from subpoenas. He also advises start-up and growing non-profit organizations on a broad array of issues.

During law school, Robert was the president of the Student Bar Association and chair of the ad hoc committee to redraft the Honor Code.

Brian Long focuses his practice on transactional and regulatory matters, with an emphasis on cybersecurity. He counsels clients on cyber breach response; cybersecurity maturity and risk assessments under frameworks such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001; compliance with NIST SP 800-171 and the Cybersecurity Maturity Model Certification (CMMC) program; artificial intelligence (AI) governance; and audit support and management.

Brian also drafts, reviews, and updates cybersecurity agreements and general technology contracts and supports clients in sophisticated information technology and business process outsourcing transactions. He regularly helps clients navigate complex private equity transactions, drawing on his experience with technology, security, AI, and intellectual property matters.

While in law school, Brian served as lead articles editor of the SMU Law Review.

Prior to attending law school, Brian spent more than 20 years working as a consultant, focusing on cybersecurity, information security, and IT risk management for US and global companies, primarily in regulated industries. He brings extensive knowledge of hacking mechanisms and security controls, IT operations, and information security standards for the financial services, healthcare, and energy industries, among others. He also contributed cybersecurity, privacy, and export controls updates to Outsourcing: Law and Business.