Ceiba Law

09/19/2026

Canada has its own technology, regulatory and cybersecurity signals. Knowing which ones matter requires more than collecting information.

Ceiba Law has joined CCN Intelligence as a Founding Member, with Vanessa Henri serving on its National Intelligence Council.

Created by the Canadian Cybersecurity Network, the Council brings together leaders from cybersecurity, insurance, law, government, academia and industry to assess emerging signals and determine what Canadian organizations need to understand.

Ceiba Law contributes a technology law perspective shaped by our regulatory monitoring and incident response work.

The objective is clear: identify what is changing early enough for Canadian leaders to make better decisions.

Featuring:
Canadian Cybersecurity Network
Vanessa Henri
Ceiba Offline
SHAWN FORD, LL.M. | CRISIS & CYBER LAWYER
The Vox - By Ceiba Law

We are decisions professionals. If this resonates, follow our sister company Ceiba Offline for a different take on decision making 🧠

09/14/2026

⚖️ Limas v. Wayfair LLC, No. CV 25-11185-DMG (Ex), 2026 WL 2351592 (C.D. Cal. Aug. 13, 2026)

What's changing?
A California federal court has allowed wiretapping and trap and trace claims under the California Invasion of Privacy Act to proceed against Wayfair over third party tracking tools installed on its website. The court rejected the retailer's encryption, rule of lenity, and First Amendment defenses, while dismissing a separate pen register claim under the same statutory section without leave to amend.

What's the alert status?
Ruling issued at the motion stage. Wiretapping and trap and trace claims proceed to further litigation. The pen register theory is dismissed and closed.

Who is in scope directly?
Businesses running consumer facing websites with third party tracking tools, including analytics scripts, session recording tools, and ad pixels that collect product views, purchases, search terms, or browsing activity and share that data with vendors or ad partners.

What would be the direct impact?
The court held that outgoing website communications, not just incoming signals, can qualify as a trap and trace device. That interpretation keeps a legal theory open that plaintiffs have increasingly used against companies running standard tracking tools, and it raises the stakes for how those tools are configured and disclosed.

09/03/2026

Ceiba Law’s Managing Partner, Vanessa Henri, has joined the Advisory Board for CareLogic, Canada’s first behaviour based Quality Engineering Benchmark, launched by SQALogic.

QE benchmarking sits outside the usual scope of a law firm, but it aligns directly with Ceiba’s practice: helping organizations make defensible risk decisions where cybersecurity, data protection, and Canadian privacy law meet.

Rather than relying on self reported checklists, CareLogic scores real diagnostic answer patterns across People, Processes, and Products, and updates live rather than through yearly reports. Results are grouped by province and sector, giving Canadian organizations a peer comparison point that global benchmarks don’t offer. It was named winner of the 2026 CQTA QE Innovation Award.

Quality gaps and risk are linked upstream. Weak processes, undocumented ownership, and gaps in testing are often the same gaps that later surface as security incidents or data handling failures.

The team behind CareLogic built the platform with Canadian sovereignty and privacy in mind from the outset. Vanessa’s seat on the board brings her cybersecurity and data protection expertise to a project focused on managing risk before it reaches the surface.

Link in the comments to learn more about CareLogic.

08/08/2026

07/22/2026

Le 29 juin, la Cour suprême américaine a rendu une décision qui touche directement la structure derrière le Data Privacy Framework, l'accord qui encadre le transfert de données personnelles vers les États-Unis.

Dans Trump v. Slaughter, la Cour a autorisé la révocation d'une commissaire de la Federal Trade Commission, renversant un précédent de 1935 qui protégeait l'indépendance des organismes de réglementation. La FTC est l'autorité responsable de l'application du Data Privacy Framework. Ce jugement s'ajoute à une série de développements touchant les mécanismes de surveillance américains, notamment la perte de quorum démocrate au Privacy and Civil Liberties Oversight Board plus tôt en 2025.
Le Data Privacy Framework demeure en vigueur. Mais les recours devant les tribunaux européens s'accumulent, et cette décision change la nature des arguments disponibles.

Pendant ce temps, Bruxelles avance sur un autre front. Le Cloud and AI Development Act, publié le 3 juin dans le cadre du Tech Sovereignty Package, introduit quatre niveaux d'exigence pour les marchés publics européens. Pour la première fois, la souveraineté numérique devient un critère mesurable plutôt qu'un argument commercial.

Sidy Juste a décortiqué ces deux dossiers avec Daphnée Lucenet pour IA Éthique Insider, du point de vue de la gouvernance des risques numériques pour les organisations qui dépendent de fournisseurs ou d'infrastructures américaines.

Comment votre organisation évalue-t-elle sa dépendance réelle à des fournisseurs soumis à ce cadre, au-delà de la case cochée dans le contrat?

07/17/2026

Between late December 2025 and mid-February 2026, a single operator used Anthropic's Claude Code and OpenAI's GPT-4.1 to breach nine Mexican government organizations and exfiltrate hundreds of millions of citizen records. According to an April 2026 technical report from Israeli security vendor, Gambit Security, the operator logged 1,088 prompts that produced 5,317 AI-executed commands across 34 sessions on live victim infrastructure, with roughly 75% of remote command ex*****on generated and run by Claude Code. A custom 17,550-line Python tool piped harvested server data through OpenAI's API to produce 2,597 structured intelligence reports across 305 internal servers.

Claude declined a number of the operator's requests along the way. He got past those refusals by describing the work as authorized bug bounty research. The model's guardrails did what they were built to do. The human judgement that should have caught that framing was not there.

Gigi Agassini and Shawn Ford unpack the Mexico case, and what it means for oversight, judgement, and liability, in the latest piece for ISRM Canadian Charter.

When your team is inside a live incident, how quickly would you catch an attacker's framing before it moves the response in the wrong direction?

07/17/2026

A single operator breached nine Mexican government organizations between December 2025 and February 2026, using Anthropic’s Claude Code and OpenAI’s GPT-4.1.

1,088 prompts. 5,317 AI-executed commands. Hundreds of millions of citizen records exfiltrated.

Claude declined a number of the operator’s requests along the way. He got past those refusals by describing the work as authorized bug bounty research.

The model’s guardrails did what they were built to do. The human judgement that should have caught the framing was not there.

Gigi Agassini and Shawn Ford break down the case, and what it means for oversight, judgement, and liability, in the latest piece for ISRM. Link in first comment.

06/05/2026

If you’re navigating AI, cybersecurity, or complex technology contracts — you need the right people in your corner.

We are proud to welcome Sidy Juste to Ceiba Law. Dual-barred in Montréal and Paris. Seasoned across IT contracts, AI governance, privacy law, cloud infrastructure, and digital sovereignty. Formerly at board level as General Counsel at a leading French cloud company.

The firm just got stronger.

06/04/2026

Bill C-8 is moving through Senate committee and it is closer to becoming law than most organizations realize.

When it passes, telecom providers and designated operators of critical cyber systems will be required to maintain formal cybersecurity programs, manage third-party and supply chain risks, and report incidents to the government.

That last point is where it gets interesting for everyone outside the telecom sector. If you supply technology, software, or services to a designated operator, their compliance obligations flow directly into your vendor relationship. Your security posture, your documentation, your incident response capability — all of it becomes part of their defensible record.

The question to ask now is not whether Bill C-8 applies to you directly. It is whether it applies to your clients.

05/15/2026

Digital sovereignty is often discussed.
Rarely operationalized.

Most organizations are asked to take a position on sovereignty without a clear way to assess it.

What do you actually control?
Where does your data flow?
Which decisions can you enforce?

In practice, sovereignty is not a statement.
It is a function of how your systems are designed, contracted, and operated.

It starts with:
– understanding your architecture and dependencies
– identifying where control exists and where it doesn’t
– aligning legal, technical, and operational realities

From there, it becomes something measurable.

At Ceiba Law, we approach digital sovereignty as a question of control, not abstraction. Reach out to learn how we approach sovereignty assessments.