Scott leverages his extensive experience as a former federal cybercrime prosecutor, in senior leadership at the US Department of Justice, and as a former AmLaw 25 law firm partner to advise clients across industries on the full range of security issues created by global data collection and usage. This includes responding to cyber incidents and managing complex risk assessments. Scott often defends clients in investigations by federal, state, and local regulators and criminal authorities.
Scott has managed hundreds of cybersecurity incidents, including sophisticated nation-state intrusions, ransomware attacks, business email compromises, cyber-enabled theft of intellectual property, and credential harvesting schemes. Scott’s deep experience in incident response and regulatory enforcement informs his broader counseling practice.
During his decade-long tenure with DOJ, Scott served in leadership roles, including as an Associate Deputy Attorney General, where he advised the Deputy Attorney General and Attorney General on cyber and national security matters. Scott was the DOJ lead on White House and interagency policy groups addressing cyber incident response, cyber legislation, public/private partnerships, election integrity and nation-state cyber threats. Scott also served as Counsel for Cyber Investigations in DOJ’s National Security Division, where he advised federal prosecutors, law enforcement agencies, and the intelligence community on cyber matters affecting national security and foreign relations. Scott previously was an Assistant U.S. Attorney in Atlanta, where he served as the office’s Computer Hacking / Intellectual Property Coordinator, tried numerous jury trials, and briefed and argued multiple cases before the US Circuit Court of Appeals.
While at DOJ, Scott investigated and prosecuted a wide array of criminal and national security cases, including involving international cyber threats, economic espionage, the illegal export of military and strategic commodities, fraud, public corruption, and money laundering.
Scott previously served as an Assistant District Attorney at the Manhattan District Attorney’s Office.
Scott currently teaches Cybersecurity Crisis Challenges at the George Washington University Law School. Scott also has taught Cybersecurity Governance and Cybersecurity Risk Management at the Kogod School of Business at American University.
Provide top-down, enterprise-wide cybersecurity risk assessments and gap analyses; conduct in-depth reviews and optimize existing information security, supply chain, and vendor management programs; develop and conduct customized tabletop exercises; serve as hub advisors to organizations’ technical, legal, and operational stakeholders; translate and implement regulatory requirements; and formulate and advance government advocacy strategies for data security-related issues.
Lead incident response teams; oversee forensic investigations, containment, and remediation efforts; engage with government authorities; develop strategic communications and law enforcement outreach strategies; and manage and effectuate statutory, contractual, and reputational notices.
Provide strategic counsel to mitigate the risk of government investigations and regulatory enforcement actions; defend clients in cyber and national security related investigations by government authorities; conduct internal investigations; respond to lawful access requests from government authorities.
Advise clients on the secure development and adoption of AI technologies and strategies to effectively manage risks.
Advise organizations on the full range of privacy and security issues created by global data collection, usage, and sharing.
Advise individual executives and boards on managing risk, improving preparedness, and responding effectively to incidents.
Develop and implement compliance frameworks and strategies designed to mitigate risks, including providing practical advice regarding regulatory and enforcement issues, such as money laundering, know-your-customer requirements, and economic and other financial sanctions regimes.
Securely search and monitor sources, including deep and dark web channels, to Identify potential threats to and risks for organizations, including targeting by malign actors, exposure of sensitive or otherwise confidential information, data breaches affecting clients and third-party business partners, and insider threats.
Trace and seek recovery of crypto-enabled payments and fraudulent transfers of funds, as well as identify and recover misappropriated data.
Creating a Cyber Volunteer Force: Strategy and Options
JDSupra (Mar. 2023)
Ransomware: To Pay or Not to Pay? It Just Got More Complicated
The National Law Review (July 2022)
DOJ’s New CFAA Policy: Relief for White Hat Hackers and Web Scrapers?
The National Law Review (May 2022)
The National Law Review (Apr. 2022)
Cybersecurity Whistleblowers Are Different. Here’s How to Deal With Them
Corporate Compliance Insights (Mar. 2022)
Client Advisory: Cyber Alert – Russia / Ukraine Conflict
McGriff (Mar. 2022)
A Look Inside the TSA’s New Cybersecurity Regime for Pipelines and Railroads
Federal News Network (Jan. 2022)
Log4J: Enforcement Risk for Public Companies
The National Law Review (Dec. 2021)
Log4J: Questions and Considerations for Companies and Their Vendors
The National Law Review (Dec. 2021)
Federal Data Breach Reporting Requirements Continue to Evolve
The National Law Review (Dec. 2021)
The Infrastructure Investment and Jobs Act Invests Heavily in Cybersecurity
The National Law Review (Nov. 2021)
DOJ Announces New Civil Cyber-Fraud Initiative
The National Law Review (Oct. 2021)
NIST Issues Cybersecurity Framework for Ransomware Risk Management
JDSupra (Sep. 2021)
SEC Returns Spotlight to Cybersecurity Disclosure Enforcement
Harvard Law School Forum on Corporate Governance (Aug. 2021)