Washington Lawyer - May 2019 - 16

charging cables that can be purchased at a local convenience store. They can
be infected with malware that secretly opens the door to secure data when
plugged into a device or network.

You adopt a cyberprotocol,
and somebody figures out a way
around it. We try to be one step
ahead of the criminals, but
the criminals are always right
behind us.

The same is true of unknown wireless networks outside of secure firms. Public
Wi-Fi networks such as those at a hotel or airport can be suspect and infiltrated
by rogue operators looking to capture information from smartphones and
computers. And public computers or workstations at hotels and cybercafes
should be avoided in most cases.
The use of virtual private network (VPN) software to establish a secure connection to block eavesdropping is essential whenever attorneys hop on the
internet, away from secure office connections. VPN services encrypt data while
accessing the internet and create a safe tunnel for sharing data. Another key
recommendation is secure web browsing - using only secure or "https" URLs
- as an additional layer of security against predatory websites looking to soak
up valuable user data.
Finally, encryption software is considered an exceptionally effective tool to
protect user documents and data, but a number of countries ban the use of
imported encryption software or require prior approval for its use.
Among the many objections to encryption software, the two main
concerns are that it provides too much security in a country that likes to
monitor transmissions, and it allows foreign spy agencies to snoop by using
"backdoor" technology. Countries such as Iraq and Russia have total bans
on outside encryption software, while China requires individuals to acquire
a license to import such software.

NOT ALL COUNTRIES ARE EQUAL

Courtesy of Dykema

The cybersecurity challenges facing international attorneys are numerous and
pervasive. With the rising risks of digital attacks, even the most tech-friendly
lawyer might consider going back to legal pads, but of course that's not
possible. Technology is essential in serving legal clients today.
Applying healthy cybersecurity practices in most countries will be sufficient to
protect against wayward and even targeted intrusions, but that is not true in a
handful of countries that have a history of aggressive cyberassaults, most
notably China, Russia, Iran, and North Korea.

SEAN C. GRIFFIN
Member, Dykema

"There are many opportunities for human error. What's interesting is that in the
last couple of years, the sophistication of targeting the human factor has significantly grown," says Luppi.
The best cyber risk management is bespoke and enterprise-wide, not just for
offices but also for lawyers. No firm can afford to take a cookie-cutter approach
to cybersecurity because each firm is different, each office poses its own particular risks, and each team of staff members has its own special challenges.

TIME TO PLAY OFFENSE
The rules of the road when working abroad are numerous and diverse, but
when it comes to cybersecurity, the best practice is to remain observant and
suspicious of any unfamiliar device, software, or connection. Experts say playing
defense is the best offense in the digital environment.
No doubt keeping tabs on the location of desktops, laptops, smartphones,
and tablets is a primary security goal, whether attorneys operate in the United
States or abroad. That includes making sure computers and tablets are fully
turned off rather than hibernating or sleeping, which can make them vulnerable to hacking.
Most international law firms have highly secure networks, but it is critical to
avoid accessories that cannot be trusted, such as flash drives, SD cards, and
16

WASHINGTON LAWYER

MAY 2019

Attorneys should have no expectation of privacy in these countries. It is likely
that telephone calls, data communications, and offices and hotels are monitored as a customary practice. It is also likely that attempts may be made to
inject malware into devices to gain remote access and later infect a law firm's
protected network.
Lawyers provisionally operating in these countries are encouraged to use temporary laptops and smartphones that can be wiped, re-imaged, or disposed of
after travel. Or at the very least, they are encouraged to sanitize all important
data and documents from their laptops that could be compromised or be considered provocative. Instead, attorneys can use cloud services to retrieve important papers as needed.
Regardless of country, however, some believe that electronic devices and communications are always at risk, and the wise attorney will function with that
understanding. Cybersecurity practices are cumbersome, but they are the first
and only defense against a massive, faceless battle to own and control information today.
"You have to work with the world as it is and personalize your risk
and mitigation strategies for ways to be effective in the world," says Sidley
Austin's Brown. "If you don't, it will cost you and your clients a great deal."
Sarah Kellogg is a regular contributor to Washington Lawyer.

https://www.dcbar.org/

Washington Lawyer - May 2019

Table of Contents for the Digital Edition of Washington Lawyer - May 2019