Washington Lawyer - November 2018 - 30

LAWYERS' CHOICE SUITES
910 17th Street NW, Suite 800
Washington, DC 20006
&
ARMY NAVY SUITES
1627 I Street, NW, Suite 510
Washington, DC 20006
A SHARED OFFICE
ENVIRONMENT
FOR LAWYERS
OVERLOOKING FARRAGUT
SQUARE
ELEGANT PRIVATE
WINDOWED OFFICE
NEW AFFORDABLE SOLO
PRACTICE SUITE
Full Time Receptionists
Conference Rooms
Secretarial Support
Internet Legal Research
Westlaw Provider

Senior Lawyer Discount

"One of the things we learned from Mueller's Russia
indictment is that many of the techniques that were
used by the Russians are standard bad acts," says
John Hardin Young, a lawyer at Sandler Reiff, P.C.
and former counsel to the Democratic National
Committee (DNC). "For example, the spear phishing
of John Podesta's email. They got Mr. Podesta to
send the information about his password to an
evil party in Russia. The indictments are not only
a warning about elections, but they are a good
warning about the obligations we have to our
clients."

BREACHES HAPPEN
The theft and release of documents can and
does happen to lawyers and law firms with
surprising effects. The 2016 "Panama Papers" leak
of documents from a Panama law firm led to a
year-long project by the International Consortium
of Investigative Journalists that uncovered the
secret offshore financial holdings of more than
300 high-profile clients.
In 2017, DLA Piper LLP was hit by the "Petya" ransomware attack that left the firm and employees
without phones and email for three days. In 2016, to
fuel an illegal insider trading strategy on Wall Street,
hackers gathered information from 48 law firms
nationwide. An American Bar Association survey
found that one in five law firms reported experiencing hacking attempts or data breaches.1
"We saw in the indictments [that] once the Russians
were able to get into the DNC system, they were
able to insert malware that allowed the Russians to
see screenshots and follow along on key strokes.
Once again, lawyers and their clients need to ensure
that they have the computer protections necessary
to prevent the introduction of malware," Young
says. "We need, as lawyers, to embrace the new
technology and the need to protect client information. There is a whole series of steps that can be
taken."
Young points out that ABA Formal Opinion 477,
adopted by the ABA Standing Committee on Ethics
and Professional Responsibility, imposes on lawyers
a duty of competence in handling electronic communications and a requirement to take precautions
to protect client information.

Alvin M. Guttman, Esq.
(202) 293-3595
www.lawofficespacedc.com

D.C. Bar member and cyber consultant Jody Westby,
CEO of Global Cyber Risk LLC, is co-chair of the ABA's
Privacy and Computer Crime Committee and has
authored several resources on cybersecurity. Given
the hard lessons of recent years, what has the legal
profession learned and done about cyber threats?
"People are aware and generally more careful,"
Westby says. "The big boys have realized that the
entire firm's business depends on their having their
act together because their clients are demanding it.

The bigger firms are certainly having to take major
steps like hiring staff and doing annual reviews. But
beyond that, I don't think it's been anything that's
measurable."

PROACTIVE RESPONSES
Cyber threats are a hard reality not just for law firms
but for the business world in general. The introduction of the European Union's new General Data
Protection Regulation means clients and firms with
customers in the European market will now have to
comply with strict data privacy rules.2 The United
States may move toward a similar standard in the
future.
The challenge is that data breaches are all but
inevitable given the state of technology today,
according to John Reed Stark, a lawyer and cybersecurity consultant based in Bethesda, Maryland, who
wrote a white paper 3 on cybersecurity for law firms
in 2016. Today, cybersecurity, he jokes, "is actually an
oxymoron."
"The threat is always growing. It is always changing,
and data points reside on multiple platforms, especially for law firms: cloud services, iPhones, iPads,
laptops, desktops, servers," Stark says. "It is just
getting easier and easier to commit forms of cyber
hacking, cyber espionage, and other forms of unauthorized intrusion into the systems of companies
and law firms."
Wiley Rein LLP, attacked by Chinese hackers in 2012,
announced in May that it had been awarded ISO
27001 certification, a standard for best practices in
information security.
"The firm uses a robust and comprehensive stack of
cybersecurity solutions to protect our people, data,
networks, endpoints, mobile devices, and cloud
applications from cyberattacks," says James
Goehrig, Wiley's chief information officer.
DLA Piper, Hogan Lovells, and Steptoe & Johnson
are among other top U.S. firms that have obtained
the ISO 27001 certification.

William Roberts is a regular contributor to
Washington Lawyer.

NOTES
1 ABA TECHREPORT 2017, available at americanbar.org.
2 General Data Protection Regulation report, available
at eugdpr.org.
3 Stark, John Reed, "Law Firms and Cybersecurity:
A Comprehensive Guide for Law Firm Executive
Committees," available at johnreedstark.com.

http://www.lawofficespacedc.com http://www.americanbar.org http://www.eugdpr.org http://www.johnreedstark.com

Washington Lawyer - November 2018

Table of Contents for the Digital Edition of Washington Lawyer - November 2018