At Ward and Smith’s annual Construction Conference, four attorneys from the firm shared essential updates and useful guidance related to the dynamic legal and regulatory landscape in the construction industry.
Recognizing the importance of staying informed, the presentation featured strategic response plans for dealing with Immigrations and Customs Enforcement (ICE), the North Carolina Statute on the Lawful Use of Lawful Products, choice of law and venue selection, and how to respond to email compromises and fraudulent payment requests.
Immigration
Will Oden, a labor and employment attorney and a North Carolina State Bar Board Certified Specialist in Employment Law, initiated the discussion with an overview of ICE enforcement responsibilities. “ICE is tasked with enforcing I-9 compliance, verifying employment eligibility requirements, and investigating unauthorized workers,” said Oden.
ICE can enforce its responsibilities through conducting I-9 audits and jobsite inspections, as well as by making arrests for illegal immigration.
“They have a variety of tools in their tool belt, including notices of inspection, search warrants, and subpoenas,” explained Oden. “Each one has different mechanisms and scope, and there are appropriate ways to respond to each of them.”
When ICE decides to audit an employer’s I-9 forms, a Notice of Inspection form will be issued. Delivery methods for I-9 audit paperwork from ICE include certified mail, hand delivery, or overnight delivery. “You’re supposed to get three days advance notice of an I-9 audit, so if you don’t receive that advance notice at the outset, you should insist upon it, even if ICE requests that you waive the notice requirement” noted Oden.
Upon being notified by ICE of a jobsite inspection via a Notice of Inspection, Oden recommends immediately contacting HR or operational leadership. “You should already have someone designated as the point person to address this issue before receiving anything from ICE,” commented Oden. The designated person should be provided with a copy of the Notice of Inspection as quickly as possible, and that person should serve as the main point of contact for all ICE communications, explained Oden.
It is not a requirement to maintain I-9 records for independent contractors, only for employees. “However, the misclassification of workers as independent contractors is going to be an ongoing focus for the Department of Labor,” advised Oden.
Warrants and subpoenas can be triggered if ICE gets an anonymous tip that unauthorized employment is an issue, or if they have any suspicion that the employer is hiring ineligible workers. “This can feel very intrusive because multiple agents could be involved, and they’ll likely be seizing documents, computers, and/or devices,” noted Oden. If you receive such a warrant or subpoena “review the warrant and any other documents provided thoroughly so you understand the scope of the initial investigation,” advised Oden.
There are two types of warrants you could receive from ICE. “Administrative warrants are issued by an immigration judge or DHA officer.” Administrative warrants limit ICE access to public spaces (i.e. where the public would be expected to have access) such as reception areas, lobbies and parking lots.
Judicial warrants are issued by a federal or state court and signed by a judge or magistrate. That type of warrant authorizes access to specific areas that are named in the warrant, and the terms must be complied with, or the employer will face serious consequences.
An immigration subpoena is a written federal document that is signed by an immigration judge or officer. Judicial subpoenas originate from a court order. The intent of these subpoenas is to compel the production of certain documents, and there are also substantial consequences for non-compliance with legitimate subpoenas.
There is a dearth of information and confusion on social media about ICE warrants and subpoenas. “For this and many other reasons, I would highly recommend reaching out to counsel if you receive a warrant and/or a subpoena, because I think your attorney can add a lot of value here,” added Oden.
How to Respond
After receiving a warrant, the first step is to determine whether or not it is active and the timeframe it covers. “You’ll want to make a copy of the document and immediately get it to the person on your staff that has been designated to respond to such issues”, said Oden.
Being professional and cooperative is critical. Oden advises that even if the first point of contact ICE speaks with is not the company’s designee for such matters, that person should say the following:
“I understand you are here for immigration enforcement purposes. Company policy requires that I contact our HR and Operations team, who are designated to assist you.”
If the agents will not wait or the designated representative is unavailable, Oden advises reviewing the warrant to verify the signature to understand whether it came from a Judge or an Immigration Officer, verifying the expiration date, the scope of the authorization, and the items authorized for seizure.
“Have at least one representative accompany ICE during its investigation, but do not impede their process,” commented Oden. “Observe what they’re doing, take detailed notes of what they are doing, object if they are doing anything that’s outside the bounds of their warrant, note the objection, and how they responded to the objection.”
Document the agents’ IDs, supervising agent name, and the US Attorney, if applicable. To ensure everyone’s safety, shut down operations in the search areas and offer a safety orientation if your business has jobsite access. Along with having a company representative accompany the agents during the inspection, take video, request copies of seized documents, and ask for an inventory of what was seized. “If there is a document or a computer that is necessary for an ongoing functioning of your business, you can ask for an accommodation,” mentioned Oden. “Whether or not they will grant it just depends, but you can ask for it, and if they refuse, you should note your objection and why it was denied in detail.”
In regard to attorney-client privileged information, inform the agents of the privileged status of that information, and request for no inspection or seizure of that information prior to attorney consultation. Do not obstruct if the agent insists proceeding without waiting for you to consult counsel, but document any objections you make and the ICE response to the objection.
Managers should be advised to consult with company counsel prior to providing a statement. Non-managers should not be advised to refuse to speak to agents, and employees should not be hidden. It is permissible to tell non-managers that they are not obligated to submit to questioning, that they can choose whether to speak to agents, and that the company will not retaliate against them regardless of their choice.
Being professional, understanding the type of warrant and/or subpoena you are dealing with, documenting key information, protecting privileged information, and contacting legal counsel are a few of the best practices for employers in order to effectively manage an ICE audit, warrant, or subpoena and any accompanying inspection.
Lawful Use of Lawful Products
Devon Williams, a labor and employment attorney, sparked a discussion of a North Carolina statute that was enacted in 1992, Lawful Use of Lawful Products. “This was originally designed to protect employees who smoked cigarettes and drank alcohol off company premises and outside of working hours,” noted Williams.
All private employers with three or more employees are subject to compliance. The law prohibits employers from firing, failing to hire, discharging, disciplining, or discriminating against employees or applicants because of their lawful use of lawful products outside of working hours and off company premises.
“The final piece is that the extracurricular activities cannot adversely affect job performance responsibilities or coworker safety, so this is a good catch-all to keep in mind,” advised Williams.
The idea is that the lawful consumption of lawful products can have a negative impact on an employee’s job performance, even when it’s off-site and outside of working hours. “We’ve all heard of that situation where someone shows up to work smelling of alcohol, and maybe they didn’t have a drink immediately prior to reporting to work, but they are obviously still feeling the effects, and they’re not as focused and engaged,” commented Williams. The law does not prohibit employers from taking action in that situation.
Contrary to other statutes, North Carolina’s Lawful Use of Lawful Products statute does provide employees with remedies for a violation of the statute.
An employee can bring a lawsuit within a year of the discriminatory act, and, if successful in proving a violation of the statute, they could receive lost wages. Additionally, an applicant who was not hired could receive an offer of employment, and an employee that was terminated could be reinstated. Individuals that bring a lawsuit could also win court costs and attorney’s fees.
“This has really come back into the spotlight in North Carolina because of hemp and CBD,” mentioned Williams. The 2018 Farm Bill that removed hemp that has less than 0.3% delta-9 THC by dry weight from the federal Controlled Substances Act has also resulted in a significant increase in interest.
North Carolina also removed hemp from the state-controlled substances list in alignment with the Farm Bill. Hemp products can lawfully contain THC, as well as the intoxicating delta-9 THC agent.
“What does this mean? Employees using hemp are going to have protections under this particular statute,” added Williams.
Another change that Williams predicts could drastically alter the hemp industry is the Federal Appropriations Act, which caps the total amount of THC per container at 0.4 milligrams.
Drug Tests
The small amount of THC that is present in hemp products means that drug tests cannot decipher the difference between marijuana and lawful hemp products. Additionally, most drug tests screen for the presence of THC, not precise levels of THC unlike a toxicology report that can dictate blood alcohol level, for example.
“The mere presence of THC on a drug test is no longer a guarantee that it is from marijuana, and so employers that have that instinctive reaction of seeing it on a drug test and not hiring the applicant or firing the employee because of it run the risk of violating this North Carolina statute,” noted Williams.
Employers can also potentially run afoul of the Americans with Disabilities Act, if the individual has been instructed to use CBD by their medical provider. Many employees are shocked to learn that they failed a drug test due to the lawful use of hemp products.
“This is kind of like the Wild West because there’s no regulation on the front end to ensure that the products are labeled correctly, and people may go into these stores thinking they are going to get something mild when that isn’t the case. It’d be like a bottle of alcohol saying it’s four percent when it is actually 12 percent,” explained Williams.
The law does allow a bona fide occupational requirement for safety sensitive roles; however, caution should be exercised if an employer is seeking to apply a complete ban on THC. Some employers are continuing to test for the presence of THC and evaluating whether its presence merits action on a case-by-case basis.
“You still have to have a policy, and it can’t be inconsistent or unpredictable. You have to walk each person through what happened with the test, and you have to make decisions holistically, not just on whether there is THC present. If you don’t apply it consistently, you run the risk of a discrimination claim,” said Williams.
The legal landscape has shifted rapidly, so employers should review their drug testing policies, especially if they haven’t done so since 2015. “It’s really important that you are protected when this happens, not if this happens, but when this happens,” concluded Williams.
Choice of Law and Venue Provisions
Bill Durr, a litigation attorney, spoke about the choice of law and venue provisions in contracts, specifically in regard to construction contracts. “North Carolina has two provisions in the General Statute that are designed to protect North Carolina companies and businesses,” commented Durr.
There is a public policy that prohibits venue and jurisdiction choice of law provisions for North Carolina contracts that select an out of state jurisdiction. “Most people overlook this because they are focused on the scope of work,” added Durr, “but I have talked with countless clients who can’t believe that it got them into a dispute.”
Issues often occur when a subcontractor receives a contract from a General Contractor with principal offices in another state. Although a project could be in North Carolina, the contract may include a provision stating that disputes will be litigated where the principal offices are located.
“Why would you want that? And if you push back on the GC about it and they say ‘No, we’re just going to keep that,’ you may want to reconsider whether you want to work for them, because it could be a solid indicator of how you’ll be treated during the project,” mentioned Durr.
Reference the statute and say it’s against public policy if they push back, advised Durr. A common practice is for a GC from out of state to prepare a contract and then send it to the subcontractor in North Carolina and ask them to sign.
If the GC had not signed the contract in that case, the provision would not offer any protection because the last act to create that contract was performed out of state. “A practical tip for a subcontractor is to just have the GC sign the contract first, not the other way around,” noted Durr.
Federal law preempts state statutes, so choice of law and venue provisions do not apply to federal projects.
How to Avoid Misdirecting Payments
Mayukh Sircar, a cybersecurity, data privacy and technology attorney, shared insights on how businesses can protect the security of email addresses, avoid wire fraud, and respond in the event of a misdirected payment. “This is a story as old as time,” joked Sircar, “and it usually starts with a company receiving an email from someone they worked with before, the email looks legitimate, and it includes something like, ‘Our billing information has been updated, please update it on your end and remit payment.’”
After the company makes the change and wires the funds, it becomes apparent that the money never got where it was supposed to go. The vendor still wants payment, but the money is gone.
A few of the common red flags that indicate a vendor’s email systems have been compromised include:
- A changed bank account
- Sense of urgency
- Slight email-domain variations
- Poor grammar
- Refusal to speak by phone
- Instructions that bypass normal payment controls
Attacks are becoming more sophisticated due to a variety of factors, including AI. Sophisticated attacks may contain no obvious red flags because the fraudster has access to a real email thread or uses AI to proofread or draft the email to avoid the red flags of spelling errors, poor grammar or awkward phrasing.
“Instead of the attack coming from an outside vendor, we’ve seen cases where a person impersonates the CFO and contacts accounting with some statement like, ‘Hey, change this vendor’s information and then send the money,’” added Sircar. Employees are more likely to trust an email if it originates from within the company.
Wire transfers are fast, final, and difficult to reverse. “The same reason wire transfers are a very helpful business tool is also the same reason they’re being used in this kind of fraud,” Sircar explained.
Once the criminal receives the money, the fraudulent account is typically closed immediately, and the funds can be almost impossible to trace. The speed of the response time is therefore critical.
The first step is to contact the originating bank immediately, request a recall and a SWIFT freeze. “Some banks have a hold period for payments over a certain amount,” notes Sircar, “so they may be able to reverse the transaction during that hold period.”
The next step is to notify the FBI, through IC3.gov, and the local authorities; the Financial Fraud Kill Chain depends on speed. “Law enforcement agencies can use their own resources to try to freeze a transaction. They can also aid in the investigation, try to find the threat actor, and aid in recovery. Also, having a police report will help with an insurance claim,” Sircar said.
Preserving information is the next phase. Businesses should log all of the emails, wire instructions, and the confirmation of payment. “This will help when you try to negotiate a settlement,” mentioned Sircar.
Cybersecurity response is the next step. “You’re going to want to have your cybersecurity and/or IT team come in and review the system, see if there was an intrusion, whether someone’s email got hacked or an employee clicked on something they shouldn’t have,” added Sircar. A threat actor may not have just sent a fraudulent email from a compromised email. The threat actor may have accessed sensitive, confidential or personal information present in other emails in the account or moved out of the account and accessed other parts of the company’s servers and networks.
Locking down systems and ensuring that nothing else was impacted are important action items for a business facing a cybersecurity incident. Determining whether it was the vendor’s systems or the company’s systems is another critical step.
Covering the Loss
“The money is gone, now what? Many companies look at their banks, but if the transfer was authorized by an authorized employee, the bank might not cover it. Reviewing whether the bank used commercially reasonable security protections may provide an avenue for recovery from the bank,” explained Sircar. Recovering funds from the banking system may be possible if the bank made an error or was negligent in how the payment was processed.
A dispute with the vendor or counterparty could occur. “Language in the contracts between the parties may be at play here, we would look at whether the contract said remit payment or receive payment. We would also look at the procedure for financial changes and verification obligations in determining the party that may be responsible for payment,” noted Sircar.
To determine who is responsible for the missing funds, the courts exercise a fault-based rule stating that, when one of two equally innocent parties must suffer by reason of the fraud of another, the loss should fall upon him whose negligent act or omission has enabled the wrongdoer to commit the fraud.
“Increasingly, however, courts are at looking at which party was in the best position to prevent the fraud. If you didn’t do cybersecurity training, for example, they may decide you are more at fault than the other party,” added Sircar. Similarly, most companies are aware that it is best practices to independently verify any payment instructions prior to making payments. If a company does not have such polices in place or employees failed to follow such policies, that company may be more at fault and ultimately responsible for the payment.
“Civil litigation and emergency relief may be possible if you identify who the account holder is,” Sircar said. “You may be able to get an injunction, a temporary restraining order, or file a civil claim to reclaim that money as fraudulently obtained.”
Insurance recovery may be possible for those who have cyber liability insurance. “Having cyber liability insurance is, generally, a good thing because it’s not a question of if you will be the victim of a cyber-attack, it’s when,” mentioned Sircar.
Criminal restitution may also be a possibility, however, the difficulty of identifying the perpetrator means it is uncommon.
An ounce of prevention is worth a pound of cure. Sircar recommends using payment controls, independent verification, and internal controls requiring the approval of two or three people, especially when it is a large payment request with urgency.
“Many contracts now have contractual protections requiring a phone call after sending wiring instructions,” concluded Sircar. “Liability is often fact-specific, so make sure you are training your employees and responding to these incidents as quickly as possible.”
Sircar’s presentation included the following disclaimer: This presentation reflects the personal views of the speaker in his individual capacity. It does not necessarily represent the views of his organizations or employer. The information contained herein is intended for informational purposes only and should not be construed as legal advice or a substitute for obtaining legal advice from an attorney. The information in this presentation is based on our current interpretation of recent developments and their implications for businesses. This is a very fluid area and thus further changes and variations in interpretation remain very likely.
