Relevant. Affordable. Actionable.
In December 2021, Dave Ries, a frequent co-presenter with the authors, wrote an excellent summary of the cybersecurity portion of the ABA’s 2021 Legal Technology Survey Report. Perhaps the most striking statistic is that 25% of the survey’s respondents reported that their law firm had been breached at some time. Clearly, law firms are an attractive target for cybercriminals - with a plethora of data about so many people and businesses, law firms are a one-stop shop for harvesting a wealth of information.
Several of the ABA Model Rules are particularly related to safeguarding client data, including competence (Model Rule 1.1), communication (Model Rule 1.4), confidentiality of information (Model Rule 1.6), and supervision (Model Rules 5.1, 5.2, and 5.3).
What do these duties require? When using technology, they require that we employ competent and reasonable measures to safeguard the confidentiality of client information, that we communicate with clients about our use of technology and get informed consent from clients where appropriate, and that we supervise subordinate attorneys, law firm personnel, and service providers to ensure compliance with these duties.
There are currently three opinions from the ABA (and others from state bars) that you should be familiar with, including ABA Formal Opinion 477R, “Securing Communication of Protected Client Information” (May 2017), ABA Formal Opinion 483, “Lawyers’ Obligations After an Electronic Data Breach or Cyberattack” (October 2018), and ABA Formal Opinion 498, “Virtual Practice” (February 2021).
Don’t forget common law duties or contractual and regulatory obligations involving protecting client data and personally identifiable information (PII).
It won’t surprise anyone that 80% of solo practitioners have primary responsibility for the security of their firms. The larger the firm, the more likely it is to have expert consultants, IT staff, or a chief information officer.
A chief security officer has primary responsibility in some large firms, 13% of firms with 100-499 attorneys and 16% with 500+ attorneys. That number surprised us a little — we would have expected the percentages to be higher given what’s at risk and the available resources of larger firms.
53% of respondents say their firms have a policy to manage the retention of data held by the firm, 60% have a policy on email use, 56% for internet use, 57% for computer acceptable use, 56% for remote access, 48% for social media, 32% for personal technology use/BYOD (Bring Your Own Device), and 44% for employee privacy. As you might expect, the numbers have increased over the years, and they are particularly higher in larger firms. The smaller firms tend to lag behind.
We are concerned that 17% of respondents report that they have no policies in place and 8% don’t know about security policies. Clearly, many firms need to up their game.
Just 36% of respondents say their firm has an incident response plan (IRP). Firm size makes a big difference here, with 12% of solo firms and 21% of firms with 2-9 attorneys having IRPs. The number jumps to 80% at firms with 100+ attorneys.
As the authors regularly give CLEs on cybersecurity, these numbers are consistent with what we’ve seen, and they are deplorable. We have borne witness to the chaos and panic that ensues after a cyber incident or a full-blown data breach — it isn’t pretty. We hear many lawyers say that developing an IRP is expensive and time-consuming. If you believe that, you may well discover just how expensive and time-consuming a data breach can be!
Though this statistic is not from the ABA Report, it is generally agreed that there is a human element involved in 82% of data breaches. It is relatively inexpensive to provide law firm employees with security awareness training. They need to know what a phishing email is, how social engineering is used to extract information from law firm employees, the dangers of re-using or sharing passwords — and the list goes on and on.
Is it expensive? If you go to the big cybersecurity firms, yes. If you have your training done by the smaller firms, you’ll find the costs modest.
How often should you train? People just plain forget some of what they learned. Also, both threats and defenses in cybersecurity change regularly. Train at least annually. Twice a year is better.
Some clients are requiring third-party security assessments, though there is resistance from law firms. Only 27% of law firms reported that they had a full security assessment, and they were mostly large firms.
30% of respondents reported that they had received a client security requirements document or guidelines, again mostly large firms.
It continues to worry us that these percentages are so low. Only once have we done a security assessment for a law firm without finding any critical vulnerabilities.
Though we say it all the time, we’ll repeat ourselves here. There is no silver bullet in the cybersecurity world. If a vendor tells you they can make you 100% secure, run the other way. We need to get many of the percentages cited above to be higher. Time to roll up your sleeves and get to work.
Lastly, because there is no silver bullet, don’t forget to make sure that you have adequate cyber insurance — that is a risk management tool since danger always lurks, your technology efforts notwithstanding!
Sharon D. Nelson, Esq., is the President of Sensei Enterprises, Inc., a digital forensics, cybersecurity and information technology firm in Fairfax, Virginia. Ms. Nelson is the author of the noted electronic evidence blog, Ride the Lightning and is a co-host of the Legal Talk Network podcast series called “The Digital Edge: Lawyers and Technology” as well as “Digital Detectives.” She is a frequent author (eighteen books published by the ABA and hundreds of articles) and speaker on legal technology, cybersecurity and electronic evidence topics. She was the President of the Virginia State Bar June 2013 – June 2014 and a past President of the Fairfax Law Foundation and the Fairfax Bar Association. She may be reached at snelson@senseient.com
2 min read
Martha Amrine, Senior Claims Attorney : Jun 18, 2020 12:00:00 AM
The COVID-19 pandemic forced most law firms to conduct business in ways they had not done before. Many firms were forced to transition to work from...
4 min read
Mark Bassingthwaighte, Risk Manager : May 21, 2019 12:00:00 AM
Few law firms seem to fully appreciate the level of risk that attorneys and staff truly represent. Of course, the ultimate goal is to avoid having...
1 min read
Rob Tameler, Claims Manager : Nov 20, 2017 12:00:00 AM
The short answer is yes. The common thought most law firms have is, “I’m too small a fish to worry about being hacked . . . there are bigger fish to...
