Megan L. Brown

Manages cybersecurity events, including ransomware attacks and negotiations. Advises public and private companies on incident reporting, data security, and cybersecurity governance and disclosures, including compliance with new mandates across critical infrastructure. Advises federal contractors on cybersecurity obligations, supply chain, and software security. Advises manufacturers and technology companies on vulnerability disclosure policies and the handling of identified vulnerabilities, including with the Cybersecurity and Infrastructure Security Agency (CISA) at the Department of Homeland Security. Advises boards and senior management about data governance and emerging technologies, from AI to IoT, including geopolitical risk to business operations, via tabletop exercises and counseling. Represents private equity and investors in regulatory review of multi-billion dollar transactions in the telecom and technology sectors. Counsels clients on CFIUS and Team Telecom obligations, national security agreements, and letters of agreement.

Successfully resolved a multi-year, multi-jurisdiction FCC investigation into a national wireless carrier over multiple public data security incidents. Manages numerous FCC investigations into equipment regulation, supply chain, accessibility, and other regulatory issues. Represents organizations and individuals in Congressional inquiries and investigations.

Represents companies and associations in proceedings before the FTC, FCC, CISA, SEC, Commerce, and DoD addressing incident reporting, data governance, privacy, internet routing security, federal procurement obligations, and more. Leading a challenge in the United States Court of Appeals for the Seventh Circuit to cybersecurity directives issued by the Transportation Security Agency, in Grand Trunk Railroad Corp. and Illinois Central Railroad Co. v. TSA (Nos. 24-2109, 24-2156, 7th Cir.) Supports judicial review of agency decisions and litigation over cybersecurity and privacy regulatory actions and claims. This includes briefing for the United States Chamber of Commerce and other clients in cases like NetChoice v. Bonta, No. 23-2969 (9th Cir.), involving California’s Age-Appropriate Design Code, X-Corp. v. Bonta, No. 24-271 (9th Cir.), involving the constitutionality of a California social-media regulation law, and Popa v. PSP Group LLC, No. 24-14 (9th Cir.), a privacy class action over the use of session replay technology. It also includes briefing in challenges to FCC actions under Jarkesy and Loper-Bright.

These days, cyber regulators are in a hurry. Commentators have observed, the “federal government is quietly directing a seismic shift in the economy” with new mandates.[1] Ann Neuberger, Deputy National Security Advisor for cyber, recently said in an interview[2] that despite dozens of new cyber regulations and Executive Orders, “I want it to go faster.” Developing effective cyber regulations requires careful consideration, but with the pace and scope of new proposals it can be hard for regulators or their targets to do that. Haste and ambitious goals can lead to truncated analysis and cut corners that affect everything from who may be covered by a rule, to dismissing unintended consequences, to overly optimistic cost-benefit analyses. It also can lead to heavy reliance on third-party frameworks and other agencies’ definitions, which may not be a good fit for the regulatory purpose at hand.

Welcome to "START HERE" the educational resource for public policymakers seeking to delve into the intricate world of cyber policy. In this evergreen series, we bring you the foundational knowledge you need to navigate the complex realm of cybersecurity with confidence. Join us as we sit down with top experts in the field, uncovering the essential principles and insights that shape cyber policy today.

My colleague Matt Gardner and I recorded this podcast to give our listeners and sense of what the DHS Cybersecurity was about. Implications for tech, critical infrastructure and more. I was a speaker at the summit, and we heard a lot of interesting things from industry and government.

She discusses cyber, the role of DOJ and the pending nomination of Brian Benczkowski to be AAG of the Criminal Division.

Some First Amendment cases are hard. Lee v. Tam is not one of them. Simon Tam, the “front man” for an Asian-American rock band known as The Slants, was denied trademark registration for the mark THE SLANTS. Why? Not because the proposed mark was inaccurate or misleading or violated someone’s intellectual property interests. The government denied Tam the beneficial trademark status routinely afforded others solely on the basis that the government considers THE SLANTS, as used by Tam, to be “disparaging” to some subset of Asian-Americans. It is rare that a First Amendment case presents such an obvious example of both content and viewpoint discrimination being embraced by the government.