Can We Trust Cybersecurity in Arbitration?
Virtual hearings in international arbitration have received significant attention, both among scholars and practitioners, since the start of Covid-19 pandemic. Before the pandemic it was used in exceptional cases or less significant hearings, such as case management conferences. Suddenly it has gained worldwide attention among the general business community and arbitration professionals alike. Virtual hearings are the place to be given the heavy travel restrictions worldwide.
This article presents the regulatory frameworks applicable to holding a virtual hearing for international commercial arbitrations in pre- and post-pandemic world. It will also identify cyberthreats and data protection concerns raised by widespread use of virtual hearings. Finally, I will consider what could and should be done to enhance virtual arbitration proceedings while mitigating identified risks.
Regulatory Frameworks: A comparative view
In a pre-pandemic world, arbitration model laws, national laws and rules of arbitral institutions were typically silent on the issue of virtual hearing in arbitration. While not explicitly regulating the issue, they did not directly exclude the possibility of virtual hearings.
Article 20 Paragraph 2 of the UNCITRAL Model Law on International Commercial Arbitration (Model Law) is particularly interesting. It authorises the arbitral tribunal, unless differently agreed by the parties, to meet at any place it considers appropriate for consultations, inspecting goods, property or documents or for hearing witnesses, experts or the parties. Similar provisions are found in national arbitration laws based on the Model Law, such as the Croatian Law on Arbitration (Articles 18, 19 and 23) and Austria’s Arbitration Act (Sections 594, 595 and 598). On the other hand, the Swiss International Arbitration Act, which is not based on the Model Law, also recognises the parties’ and arbitral tribunal’s freedom to regulate procedure (Article 182).
Looking at various arbitral institutions’ arbitration rules, predominantly, prior to pandemic, they did not expressly regulate holding oral hearings virtually. Rather, existing provisions were broad enough to cover the possibility of virtual oral hearings, in particular if parties expressly agreed to this.
Interestingly, in China, the China International Economic and Trade Arbitration Commission (CIETAC) Arbitration Rules specify locations where to hold oral hearings, unless the parties agree on other options. Oral hearing held virtually would thus not qualify, since article 36 of the CIETAC Conduct of Hearing reads:
Unless otherwise agreed by the parties, the place of oral hearings shall be in Beijing for a case administered by the Arbitration Court or at the domicile of the sub-commission/arbitration center administering the case, or if the arbitral tribunal considers it necessary and with the approval of the President of the Arbitration Court, at another location.
Furthermore, Article 82 on Arbitration Fees and Costs states that:
Where the parties have agreed to hold an oral hearing at a place other than the domicile of CIETAC or its relevant sub-commission/arbitration center, they shall advance a deposit for the actual costs such as travel and accommodation expenses incurred thereby. In the event that the parties fail to do so within the time period specified by CIETAC, the oral hearing shall be held at the domicile of CIETAC or its relevant sub-commission/arbitration center.
Yet, on 28 April 2020, CIETAC published its ‘Guidelines on Proceeding with Arbitration Actively and Properly during the COVID-19 Pandemic’ (Trial), coming into effect on 1 May 2020 and remaining in force until the pandemic is over. Section 2.6. specifically provides that “virtual hearing is considered as a specific way of oral hearing which is in accordance with the Arbitration Rules” and advises that, during the pandemic, the arbitral tribunal should “first consider the possibility of holding virtual hearings”.
The present pandemic-struck world arbitration community appears to be united on the point that holding oral hearings in a virtual manner is in line with the due process requirements imposed by national laws and arbitration rules. However, it will be interesting to follow the development when parties reach the next stage of the arbitration process, namely, filing of legal remedies against awards or objecting to their enforcement. Will losing parties attempt to invoke a violation of due process defence against awards because they were issued in arbitrations with virtual oral hearings? How will such potential arguments be evaluated by judges?
Cyber Threats in Arbitration: What are the Concerns?
In an ever more technology-dependent world, cyber threats from phishing to hacker attacks coordinated to leak documents, are never far away. Such fierce attacks may be motivated by gaining a competitive edge in arbitrations.
For example, in July 2015, the Permanent Court of Arbitration (PCA) suffered a hacking attack during an ongoing maritime border dispute between China and the Philippines. Malware exposing the partes’ computers to a risk of data theft. Hence, making arbitration digital or merely holding a virtual hearing, necessarily entails risking an unsafe digital environment, especially when big multinationals, NGO’s, investors and governmental bodies are involved in alternative dispute resolution.
To such clients, confidentiality and the protection of their trade and state secrets, sensitive financial and personal information is of paramount importance. Thus, while resolving their disputes, arbitral institutions should act accordingly with the parties’ expectations, especially in justifying the high procedural costs they impose. We cannot understate the importance of arbitral institutions pushing for greater emphasis and devoting resources towards cybersecurity and data protection.
On the other hand, handling virtual proceedings is, mostly, left to parties and tribunals using unfamiliar technologies, working from home on unsecured networks. Namely, bearing in mind that virtual hearings present a legal grey area (as seen above) the regulation of the virtual hearings is reduced to “recommendations” within arbitral institution’s pamphlets or protocols. Such recommendations usually provide for the institution’s preferred virtual platforms, hardware, internet connection and speed, and code of conduct for the hearing.
For example, paragraph II of the VIAC Protocol, regarding virtual platforms’ privacy and security recommendations, states that participants should ensure that their platforms offer enough protection against unwanted third-party access. This includes using password protection, sufficient encryption, locking the remote room and so on. VIAC also recommends reviewing a platform’s general conditions for data protection, since some claim ownership rights of any data you transmit during a hearing.
Since the conduct of a virtual hearing is left to the participants’ choosing, security risks are very different and potentially higher than in regular circumstances. What platform shall parties’ use? Who is going to host the hearing? Who shall make video and audio recording, and should it be made using an external device or only with the hosting device? Not all participants are tech-savvy enough to answer these questions confidently, and that could impact quality, safety and confidentiality. If a hearing host, who typically records audio and video of the hearing, unknowingly has a piece of simple malware on their computer, a result could easily be “zoom-bombing”, a leak of sensitive information or compromised evidence. Hence, general guidelines like “choose a reputable platform” or “encrypt your hearing with a password” are probably insufficient to guarantee cyber safety. To help streamline these conundrums, arbitral institutions should offer comprehensive assistance to all participants in organising and hosting virtual hearings.
A step in the right direction has been made by the International Court of Arbitration of the International Chamber of Commerce (ICC), which offers a user-friendly submission form on its website. It enables arbitration participants to schedule and hold virtual oral hearings with the full assistance of the ICC Hearing Centre, using their technology and technical support. Since this service is offered not only for ICC-administered cases, but also for those administered by other institutions, and ad-hoc cases, other institutions will have to keep up the competition and raise the level of their virtual hearing services. Who the long-term winners of this new market will be is yet to be seen.
Image credit: Getty Images under Canva licence.
