Overview

Sean is a partner in the Portland office and chair of the national Constangy Cyber Team. His background includes over 25 years of experience with data privacy and information security matters. He is a former cyber attorney for the U.S. Department of Justice where he served as the lead cyber attorney for the U.S. Attorney's Office in Oregon, and worked with the Computer Crime & Intellectual Property Section in Washington, D.C. During that time, he worked closely with the FBI, the Secret Service, and other federal agencies in prosecuting complex white collar and high-tech cybercrime. Sean was also honored twice with the Director’s Award, one of the highest awards bestowed upon Assistant U.S. Attorneys. He has been recognized for his leadership in the data privacy and cybersecurity space, having been named by the Cybersecurity Docket as one of the best and brightest data breach response lawyers in the business. His credentials include being a Global Information Security Professional (GISP), a Certified Information Systems Security Professional (CISSP), and a Certified Information Privacy Professional for United States law (CIPP/US). In managing the national Constangy Cyber Team, Sean continues to manage responses to complex data breaches and works with information security personnel and corporate executives in managing and mitigating cyber risk.

Honors & Recognitions

  • Incident Response 50 for 2023 and 2024, selected by Cybersecurity Docket as one of the 50 best data breach response lawyers in the business
  • 2021 Distinguished Alumni Award, Linfield University Alumni Association
  • Incident Response 40 for 2021 and 2022, selected by Cybersecurity Docket as one of the 40 best and brightest data breach response lawyers in the United States
  • Incident Response 30 for 2020, 2019, 2018, selected by Cybersecurity Docket as one of the 30 best and brightest data breach response lawyers in the United States
  • Outstanding Support, Dedication, and Contribution to Federal Law Enforcement in the District of Oregon, Federal Law Enforcement Officers Association, Portland, Ore., 2014
  • Outstanding Prosecutive Skills and Assistance to the FBI, FBI Director James B. Comey, 2014
  • Outstanding Assistance and Support on Behalf of the Investigative and Protective Responsibilities of the Secret Service, United States Secret Service Director Julia A. Pierson, 2014
  • Exemplary Efforts on Defense Criminal Investigative Service Investigations, Defense Criminal Investigative Service Office of Inspector General, 2014
  • Outstanding Efforts In Support of the U.S. Postal Inspection Service’s Mission of Protecting the U.S. Mails from Criminal Activity, United States Postal Inspection Service, 2014
  • Appreciation for Protecting the Integrity of the Social Security Number, Social Security Administration Office of Inspector General,2014
  • Outstanding Dedication and Exemplary Service to the United States Attorney’s Office, District of Oregon, 2014
  • Outstanding Prosecutive Skills and Assistance to the FBI, FBI Director Robert S. Mueller, III, 2010
  • Assistant Attorney General’s Award for Intra-Departmental Cooperation, Assistant Attorney General Matthew Friedrich, 2008
  • Superior Contributions to the Law Enforcement Responsibilities of the United States Secret Service, United States Secret Service, 2007
  • Dedication and Commitment to the Prosecution of Complex Financial Crimes, Internal Revenue Service Criminal Investigation Division, Portland Field Office, 2005
  • Director’s Award, Executive Office for United States Attorneys (EOUSA), 2004
  • Outstanding Assistance to the FBI, FBI Director Robert S. Mueller, III, 2002
  • Outstanding Prosecutive Skills and Assistance to the FBI, FBI Director Louis J. Freeh, 2001
  • Achievements and Contributions to the Department of Justice, Attorney General Janet Reno, 2000
  • Director’s Award, EOUSA,1997
  • Outstanding Contributions in the Field of Drug Law Enforcement, DEA, 1997

Professional & Civic Associations

Certifications

  • Certified Information Systems Security Professional (CISSP) through the International Information System Security Certification Consortium (ISC2)
  • Global Information Security Professional (GISP) through the Global Information Assurance Certification
  • Certified Information Privacy Professional (CIPP) for United States law (US) through the International Association of Privacy Professionals (IAPP)

Prior Experience

  • Assistant United States Attorney, United States Department of Justice, District of Oregon, Portland, Ore., 1991-2014
  • Assistant District Attorney, Lane County District Attorney’s Office, Eugene, Ore., 1987-1991

Press Room

Representative Matters

Representative Matters

General information security consulting

Provides guidance to clients across all industry sectors on commercially sound measures to strengthen their corporate information security posture. This often involves assessing  the sufficiency of security controls to mitigate risk against current malicious threats. It also involves reviewing and revising incident response plans, business continuity and emergency operations plans, information security policies and procedures, and third-party contract and vendor management programs. His years of experience as a cyber attorney and a data breach first responder provide unique insights and inform his proactive work.

Incident response planning

Provides assistance drafting or revising incident response plans. This includes identifying and involving important stakeholders, ensuring placement with appropriate cyber liability insurance products, facilitating engagements with other incident response service providers such as digital forensics firms, and introductions to law enforcement personnel. It also involves assessing consumer, regulatory and contractual incident notification obligations, and preparing templates to meet them.

Tabletop exercises

Incorporates almost 25 years of data privacy and information security experience in facilitating enterprise-wide, cross-functional exercises to test organizational incident response plans. The exercises include key stakeholders to help them understand their roles and responsibilities in responding to a data security event and as an extension of their organizational information security team. The exercises are also focused upon enhancing existing incident response plans.

Incident response services

Oversees a national team of legal and administrative professionals who assist businesses respond to data security incidents. This team has managed responses to thousands of data breaches. They staff Constangy's 24/7 data breach hotline and serve as project managers to facilitate a rapid response to any type of data security incident. Each project manager has substantial expertise managing responses to data breaches, and provides an initial impact assessment in order to facilitate appropriate responsive resources to contain, analyze, investigate, and remediate the matter. This often involves digital forensics, crisis management and communications, and consumer notification and remediation services (, e.g., credit monitoring, and/or identity protection services). They also assess consumer, regulatory and contractual incident noice obligations and help businesses comply with them. They also interface with law enforcement, the media and regulatory officials as necessary. While managing Constangy’s national incident response team, he also personally manages responses to complex data breaches with the support of the team.

Data breach-related defensive litigation

Assists clients who are subject to class action complaints or third-party demands arising from data security incidents. As a former litigator for the U.S. Department of Justice, he works with Constangy’s extensive litigation resources across 12 states with over 30 attorneys to ensure clients are well represented in defensive litigation matters.

Employee/Board/Executive training

Assists clients in identifying and prioritizing employee training requirements for network security awareness, creating tailored training for employees, and briefing boards of directors and executives about information security threats, regulatory developments, and enterprise risk mitigation measures. He is often asked to provide business impact analyses addressing appropriate allocation of resources for information security

Information system vulnerability testing and penetration testing

Assists clients with sourcing appropriate vendors, defining reasonable scopes, facilitating the execution of contracts, supervising confidential vulnerability assessments and penetration testing, and reviewing and editing draft reports to ensure accuracy and a format suitable for disclosure to third-parties, if necessary.  The facilitation of these services is typically subject to the Attorney-Client Privilege and the Work-Product Doctrine to provide the highest level of confidentiality.

Digital forensics services

Assists clients with sourcing appropriate vendors, defining reasonable scopes, facilitating the execution of contracts, overseeing digital forensics investigations, and reviewing and editing preliminary reports to ensure accuracy. The facilitation of these services is typically subject to the Attorney-Client Privilege and the Work-Product Doctrine to provide the highest level of confidentiality.

Information security policies and procedures

Assists clients in identifying and defining necessary information security policies and procedures. This includes reviewing existing policies and procedures, providing suggested revisions to them, and creating policies and procedures as necessary.

Law enforcement and regulatory investigations

Assists clients in responding to government investigative requests arising out of data privacy and security events. This may involve representation during interviews, and often requires assembling relevant documentation, including policies and procedures, and/or summarizing complex technological and digital forensics information in summary reports appropriate for disclosure to law enforcement and regulatory officials.

News & Analysis

Speaking Engagements & Industry Publications

  • Panelist, “Navigate the Uncertainty of War Exclusions to Provide Certainty to Insureds,” Cyber Risk and Insurance Innovation USA Conference, 5.16.23
  • Panelist, “Managing Insurance Issues Before and After a Cyber-Attack,” Incident Response Forum Masterclass 2023, Cybersecurity Docket, 4.20.23
  • Speaker, “The Evolving Threat Landscape – Mitigating Risk to Business Models,” Linfield University Business Symposium, Portland, OR, 4.12.23
  • Panelist, “Claims & Losses Update,” NetDiligence Cyber Risk Summit, Fort Lauderdale, FL, 2.20.23
  • Speaker, “Cybersecurity Basics for Administrative Professionals”, Lorman Webinar, 1.26.23
  • Panelist, “Banks, Regulators and Cybersecurity,” 2022 Oregon Bank Leadership Symposium, Eugene, OR, 12.05.22
  • Panelist, “Cybersecurity!,” Risk Management Association (RMA), Portland Metro Chapter, Portland, OR, 11.16.22
  • Panelist, “Cyber and Data Security: Claims, Coverage and Marketplace Trends,” Webinar sponsored by Brown & Brown, 10.19.22
  • Panelist, “Cybersecurity War Stories,” Oregon Society of CertifIed Public Accountants, Business & Industry Conference, Beaverton, OR, 10.18.22
  • Moderator, “2022 Claims & Losses,” NetDiligence Cyber Risk Summit, Santa Monica, CA, 10.11.22
  • Panelist, “Data Breach Trends,” Podcast sponsored by Experian, 09.27.22
  • Speaker, “Cyber Threats to Healthcare: Mitigating the Risk,” EXPLORE Healthcare Summit, Norman, Oklahoma, 08.25.22
  • Panelist, “Top Data Breach Response Mistakes and How to Avoid Them,” Webinar sponsored by A.J. Gallagher, 08.18.22
  • Panelist, “Why Talent Issues are a Bigger Threat than Ransomware,” NetDiligence Cyber Risk Summit, Philadelphia, 06.3.22
  • Speaker, “Cyber Threats & Risk Mitigation Strategies for the Construction Industry,” Construction Financial Management Association, Tacoma, Washington, 03.10.22
  • Speaker, “Cybersecurity for Bankers: Mitigating Risk from Emerging Threats,” Oregon Bankers Association Technology Roundtable,1.20.22
  • Moderator, “Ransomware and Cyber Insurance,” Incident Response Forum Ransomware 2022, 1.13.22
  • Speaker, “Cybersecurity for Educators: Emerging Threats & Risk Mitigation Measures,” 2021 Oregon School Law Conference,12.02.21
  • Panelist, “Emerging Legal Issues Related to Technology: Trends in Cyber security – Views from Law and Tech,” Webinar sponsored by Oregon State Bar Technology Law Section, 10.08.21
  • Speaker, “The Dark Web and Emerging Threats,” Webinar sponsored by Linfield University, 10.06.21
  • Panelist, “Threat Actor Attribution,” NetDiligence Cyber Risk Summit, Santa Monica, California, 10.06.21
  • Panelist, “The Front Lines of Cyber Insurance Claims,” Webinar sponsored by SANS Institute, 07.30.21
  • Speaker, “Pandemic Cyberattack Mayhem: New Issues and Updated Approaches to Cyberattacks in the Wake of the Pandemic,” 2021 Directors Workshop, Western Bankers Association, 06.22.21
  • Moderator, “Learning from the Losses: Today’s Cyber Claims Landscape,” Advisen Cyber Risk Insights Conference London, @Home Virtual Series, 05.12.21
  • Speaker, “Emerging Cyber Threats: How did a Russian hacker get into my office?,” Webinar sponsored by the Washington State Transit Insurance Pool, 04.21.21
  • Panelist, “Data Security Incidents and Cyber Insurance,” Incident Response Forum Masterclass, 04.08.21
  • Panelist, “Cybersecurity for Executives,” iVision CIO Forum, 2.24.21, 2.25.21, and 3.03.21
  • Speaker, “Government Technology Management: Responding to Major Cyber Threats,” Oregon Association of Government Information Technology Management 2021 Winter Virtual Conference, 2.25.21
  • Speaker, “Emerging Cyber Threats: Risk Mitigation Strategies,” CIS20th Annual Conference, 2.24.21
  • Panelist, “Cybersecurity Update: Risks, Exposure and Prevention,” Annual Meeting of the New York State Bar Association on Law Practice Management, 01.21.21
  • Speaker, “Navigating Breach Reporting Laws in Canada, the United States & Europe/UK,” Osgoode Data Breaches & Cybersecurity Incidents Virtual Conference, 11.20.20
  • Panelist, “The Shifting Sands of the Cyber Legal Landscape,” In2RiskProgram, Webinar sponsored by CLM, 10.07.20
  • Panelist, “Ransomware: Proactive Planning and Preparation for a Ransomware Event,” NetDiligence Cyber Risk Summit, Fall 2020, 10.07.20
  • Co-instructor, “Cyber Event Table Top Exercise,” Webinar sponsored by CLM Cyber Claims College, 09.09.20
  • Panelist, “Testing Your Bank's Response During & After COVID 19 -CBW's Incident Response Team Offers insights on Crisis Response, Cyberattacks and Insurance;” Webinar sponsored by Community Bankers of Washington, 05.27.20
  • Moderator, “Responding to Ransomware Attacks,” Incident Response Forum (virtual conference), 04.14.20
  • Panelist, “Gain Crucial Insights into Incident Response & Cyber Insurance," Webinar sponsored by CrowdStrike, 04.16.20
  • Panelist, “Cyber Risk and the Remote Workforce,” Webinar sponsored by A.J. Gallagher, 04.01.20
  • Panelist, “Experts Roundtable: Dinner, Drinks & Incident Response,” CrowdStrike, New York, New York, 03.11.20
  • Panelist, “Cybersecurity Threats Today,” Mortgage Bankers Association Mid-Winter Housing Conference, Bachelor Gulch, Avon, Colorado, 03.10.20
  • Panelist, “Lessons from the Digital Battlefield,” Combined Claims Conference, Garden Grove, California, 03.04.20
  • Panelist, “Son of a Breach! Incident Response Insights, Planning & Practices,” Western Bankers Association 2020 Annual Conference & Directors Forum, Scottsdale, Arizona, 03.02.20
  • Speaker, “The CCPA & Privacy Legislation: How Can We Mitigate Claims?,” Webinar for GAIG claims counsel and underwriters,02.19.20
  • Speaker, “Emerging Cyber Threats: Claims Mitigation,” 2020 SDAO Annual Conference, Seaside, Oregon, 02.07.20
  • Panelist, “Ransomware and Business Email Compromises,” Incident Response Forum West, Beverly Hills, California, 01.30.20
  • Moderator, “Information Governance & Cybersecurity,” ACC Foundation Cybersecurity Summit, Washington D.C. 01.28.20
  • Speaker, “The GDPR, CCPA & Privacy Legislation: How Can My Clients Comply?” Oregon State Bar Association Health Law Section, Portland, Oregon, 12.12.19
  • Speaker, “Cyber Risk Concerns of the C-Suite and Understanding the Vendor Breach Ecosystem,” Webinar sponsored by the American Bankers Association, 12.10.19
  • Speaker, “Cybersecurity: Malicious Trends & Preparation for Zero Day Attacks,” Webinar sponsored by Intel, 12.10.19
  • Panelist, “Professional Liability & Cyber Liability Update,” AIG Financial Lines Seminar & 2020 Outlook, Los Angeles, California,11.07.19
  • Panelist, “Professional Liability & Cyber Liability Update,” AIG Financial Lines Seminar & 2020 Outlook, San Francisco, California, 11.06.19
  • Speaker, “Cybersecurity for Administrative Professionals,” Webinar sponsored by Lorman Education Services, 11.01.19
  • Panelist, “Lightning Round – Everything a CISSP Needs to Know About the Cyber Legal Landscape,” 2019 ISC2 Security Congress, Orlando, Florida, 10.30.19
  • Moderator, “Rise of the Mega-Fines: Accounting for Regulatory Action in Cyber Insurance,” Advisen Cyber Risk Insights Conference, New York, 10.24.19
  • Panelist, “HSB CyberSLAM,” Webinar sponsored by HSB, Hartford, Connecticut, 10.16.19
  • Moderator, “The PCI DSS: Security Goals or Revenue Stream?,” NetDiligence, Santa Monica, California, 10.15.19
  • Panelist, “Cyber Risk Claims,” Propel Insurance Annual Sales Meeting, Portland, Oregon, 10.15.19
  • Panelist, “Emerging Trends in Cyber Insurance Claims,” Cyber Immersion Summit, The Hartford, Hartford, Connecticut, 10.11.19
  • Speaker, “Emerging Cybersecurity Threats: Measures to Keep Risk Between the Rails,” 2019 American Short Line and Regional Railroad Association General Counsel Symposium, Columbus, Ohio, 10.10.19
  • Panelist, “Holy @#%&, What Do We Do Now? A Guide to Handling a Ransomware Attack,” AWAC Panel Counsel Summit, Hartford, Connecticut, 9.25.19
  • Speaker, “Cyber Breaches and the Messes They Create,” Community Bankers of Washington Annual Conference, Stevenson, WA, 9.19.19
  • Speaker, “A Day in the Life of a Breach Coach,” Hanover CyberSummit, Worchester, MA, 9.11.2019
  • Panelist, “Emerging Online Trends,” Hanover Cyber Summit, Worchester, MA, 9.11.19
  • Speaker, “Mitigating the Risk and Expense of Cyber Claims,” GAIG Claims Training, Cincinnati, OH, 9.9.19
  • Panelist, “Critical Guidance for Mitigating Business CyberRisk,” Oregon Association of School Business Officers, Bend, OR, 7.24.19
  • Presenter, “Cyber Trends”, Advisen Quarterly Events Webinar, 7.24.19
  • Presenter, “Well, It’s Too Late Now: Being Properly Prepared for a Data Breach,” 2019 CLM Cyber, Management & Liability Conference, 7.11.19
  • Presenter, “Incident Response: Lessons on Claims from the Digital Battlefield,” The Hartford Webinar, 06.07.19
  • Panelist, “The Next Big Thing: Keep Track of Emerging Threats,”Advisen Cyber Risk Insights Conference, Chicago, IL, 05.16.19
  • Panelist, “Cybersecurity for Attorneys: Protecting Your Clients & Your License,” National Creditors Bar Association 2019 Spring Conference, Minneapolis, MN, 05.15.19
  • Presenter, “Cyber Breaches and the Messes They Create,” American Association of Insurance Management Consultants Annual Conference, Charleston, South Carolina, 5.03.19
  • Presenter, “Lessons from the Digital Battlefield,” American IT Symposium, New Orleans, LA, 4.24.19
  • Presenter, “Lessons from Thousands of Incidents,” Special Districts Association of Oregon PACE Day, Salem, Oregon, 4.18.19
  • Moderator, “Cyber Insurance: How to Work with Insurance Companies, Battleground Issues and How to get Paid,” Incident Response Forum, Washington, D.C., 4.10.19
  • Presenter, “Cybersecurity Trends Webinar (CISOs),” Fairfax Family of Companies, 03.28.19
  • Panelist, “Privacy Regulation Goes Global: Compliance and Insurance Coverage Issues,” Advisen Cyber Risk Insights Conference, London, England, 03.19.19
  • Moderator, “Creating a Breach Response PLAN – Strategies for Prevention, Logistics, Action and Notification,” CLM Annual Conference, Orlando, Florida, 03.14.19
  • Speaker, “Enterprise Risk Assessment – A Case Study,” CyberCONNECT, Portland, Oregon, 03.06.19
  • Panelist, “Privacy Compliancy – GDPR and Beyond," CyberCONNECT, Portland, Oregon, 03.06.19
  • Moderator, “Outage of Cloud Services Providers – Systemic Risk for Cyber Underwriters,” Advisen Cyber Risk Insights Conference, San Francisco, California, 02.21.19
  • Moderator, “Counseling a Corporation Before the Inevitable Data Security Incident,” Incident Response Forum West, Beverly Hills, California, 02.06.19
  • Panelist, “Cyber Insurance: From Risk Transfer to Cyber Threat Response – Is It Covered?,” University of San Diego Cyber Law, Risk and Policy Symposium, San Diego, California, 11.15.18
  • Speaker, “Enterprise Risk Assessment - A Case Study,” EDGE 2018 Cyber Summit, Vancouver, Washington, 11.13.18
  • Panelist, “Privacy Compliance - GDPR and Beyond,” EDGE 2018 Cyber Summit, Vancouver, Washington, 11.13.18
  • Speaker, “Cybersecurity and the Petroleum Distribution Industry,” SIGMA 2018 Annual Conference, San Francisco, California, 11.06.18
  • Panelist, “Mapping the Cyber Threat Landscape,” Advisen CyberRisks Insights Conference, New York, New York, 10.25.18
  • Speaker, “Cybersecurity in the Hospitality Industry,” Academy of Hospitality Industry Attorneys Fall Meeting, Portland, Oregon, 10.18.18
  • Speaker, “New Laws Make Cyber Insurance For Small and Medium Sized Businesses More Critical Than Ever,” Webinar sponsored by Hartford Steam Boiler, 10.16.18
  • Panelist, “Preparing for the Worst – The Importance of Cyber Liability Insurance and a Cyber Security Plan,” 96th Annual Conference for the National Council on Teacher Retirement, Washington, D.C., 10.09.18
  • Speaker, “Emerging Trends in Cybersecurity,” Travelers Annual Business Torts Meeting, St. Paul, Minnesota, 10.01.18
  • Participant, “Cybersecurity Industry Roundtable: Challenges in Data Breach Cases,” U.S. Department of Justice, Washington D.C.,09.27.18
  • Participant, “Executive Roundtable on Cybersecurity,” sponsored by Envista Forensics, New York, New York, 09.26.18
  • Keynote speaker, “Cybersecurity: Keeping the Bad Guys Out,” Willamette Education Service District All Staff Kick Off in Salem, Oregon, 08.27.18
  • Speaker, “General Data Protection Regulation,” Webinar sponsored by EPIC Insurance Brokers and Consultants, 05.15.18

Publications

  • "Cybersecurity: Managing the Risk in Higher Education," The Beacon, Northwest Commission on Colleges and Universities, 09.06.19 
  • “Reducing the Risk of Cyber Extortion For Health Care Cos.,” Law360, 02.24.16
  • “Cyber Threats: Is the Sky Falling or Is the Threat Real?,” Power Magazine, 08.01.15

Blogs, Videos & Podcasts

  • “Do or do not. There is no try.” 
    Yoda, Grand Master of the Jedi Order

Education

University of Oregon School of Law

  • J.D., 1987
  • Moot Court Board
  • National Mock Trial Team
  • President, Student Bar Association
  • Centurion Award

Florida State University

  • M.S., Higher Education Administration, 1981

Linfield University

  • B.A., English and Psychology, 1980
  • President, Associated Students of Linfield College
  • Football and baseball teams

Bar & Court Admissions

  • Oregon, 1987
  • Washington, 2015
  • District of Columbia, 2015
  • U.S. Supreme Court, 1997
  • U.S. Court of Appeals 9th Circuit, 1991
  • U.S. District Court District of Oregon, 1991
Back to Page