David Cass

David Cass occupies a vantage point few cybersecurity and financial-technology experts can claim: he has sat on every side of the table. He recently served as a lead regulator at the Federal Reserve Bank of New York, where he was a member of the Large Institution Supervising Coordinating Committee (LISCC) overseeing the systemically important institutions whose security and risk practices he had spent two decades building from the inside. As Head of the FinTech Practice at Law & Forensics and a member of the firm's Cyber Security and Forensics Practice, he brings that supervisory perspective to bear as a testifying expert and consultant — most recently as a cybersecurity expert witness on a significant cyber-attack against a regional credit union that compromised member data and disrupted services.

That regulatory standing rests on an unusually deep operating record. Before the Federal Reserve, David was Chief Information Security Officer and Global Partner for Cloud Security at IBM, with global responsibility for cloud security practices, processes, and policies across IBM's Security Services unit, serving as a regulatory subject-matter expert and executive steering committee member for IBM's international banking customers. He was part of the team that introduced the first financial-services blockchain initiative on public cloud, supported by ten major international banks. Earlier, as SVP and Chief Information Security Officer at Elsevier, he ran security, privacy, data protection, and the HIPAA function for a regulated FTSE 100 enterprise — accumulating more than four and a half years operating such a business in the cloud — and earlier still rebuilt the information-security risk and governance function at Freddie Mac and directed risk management for JPMorgan Chase's global technology infrastructure.

Across these roles David has handled the full range of high-stakes matters that define the firm's forensics-first practice: ransomware and breach incident response, forensic tracing of cryptocurrency and digital assets, AML and KYC program design, securities and ICO compliance under SEC and international frameworks, and cybersecurity governance counsel to corporate boards. He pairs that operational fluency with the formal credentials regulators and courts expect — among them the CISSP, CISM, CRISC, CGEIT, CIPP/E and CIPP/US, PMP, and Certified Blockchain Professional designations — and the engineering and management training behind them, including a Master of Science in Engineering from the University of Pennsylvania's Wharton School and Penn Engineering and an Executive MBA from MIT's Sloan School of Management.

David's authority extends well beyond his client engagements. He has spoken as a subject-matter expert at the Federal Judges Association's 9th Quadrennial Conference in Washington, D.C., and teaches as an adjunct professor at Harvard University — covering risk management, regulatory issues, and computer forensics — and at Rutgers Law School. He serves on the editorial boards of the Journal of Law and Cyber Warfare and the Journal of Legal Technology Risk Management, sits on the New York State Bar Association's Cybersecurity subcommittee as a subject-matter expert, and has published on cybersecurity, forensics, cryptocurrency, blockchain, cloud, and AI/ML, including co-authoring "The Dirty Truth About Crypto: Money Laundering Made Easier" with Daniel Garrie and Gail Andler. A frequent voice at conferences from RSA and DefCon to Money 20/20, the Institute of International Finance, and the Singapore Academy of Law's TechLaw Fest, he combines the credibility of a former regulator, the fluency of a hands-on operator, and the clarity of a teacher — the qualities that make a named expert persuasive in a courtroom.