According to a recent ABA Journal article, the global digital infrastructure is under siege and law firms are to some extent on the front lines given the vast amounts of sensitive data they process and maintain. Bradford A. Bleier, unit chief to the Cyber National Security Section in the FBI’s Cyber Division, is quoted in the article: “Law firms have tremendous concentrations of really critical private information” and breaking into a firm’s computer system “is a really optimal way to obtain economic and personal security information.” Philip Reitinger, the director of the National Cybersecurity Center in the Department of Homeland Security, believes this threat is increasing for two different reasons. First, he said, “the skill level of attackers is growing across the board.” And, secondly, the nation’s networks of computer systems are becoming more connected and complex all the time, “and complexity is the enemy of security.” Marc Zwillinger, a founding partner of Zwillinger Genetski, recognized another obvious problem for law firms: “Lawyers haven’t been as diligent with security as some of the institutions that gave them information.”
After sufficiently spreading the FUD (fear, uncertainty, and doubt) throughout, what does the ABA author suggest as a solution. Well, not much of note. It is suggested that firms change their culture to be more in tune to security – which will likely need to be done from the top down given most managing partners, according to the author, have little time with sophisticated passwords and things that might otherwise slow them down. It is also suggested that data be segregated and that encryption be deployed.
The most relevant bit of information from the article actually was added in the sidebar and builds on Marc Zwillinger’s suggestion that a client’s security is usually more evolved than that of its law firm. The author’s sidebar comment points out that clients may soon be auditing their law firm’s security. Given that lawyers have been helping clients with technology due diligence for years now and have also been advising on the use of audits, it is not much of a stretch to expect one law firm to recommend auditing another firm. Those law firms in front of this issue will not only keep existing clients – they will also be in great shape to potentially win new ones. Afterall, what law firm would suggest such an audit if it did not already deploy a sophisticated security infrastructure of its own?