The Aftermath of a Law Firm Data Breach

Wait, I’m the VICTIM!

Yes, but your clients will not see it that way and neither does the ABA.

In addition to the ethical requirements of competency, confidentiality, and transparency, the ABA’s Formal Opinion 483, issued in November 2018, makes it clear that “Data breaches and cyberthreats targeting lawyers and law firms are a major professional responsibility and liability threat facing the legal profession.”

Why not just keep a data breach “our secret”?

Sadly, most law firms do. According to the American Bar Association’s TECHREPORT 2020, only 14% of law firms reported a data breach to law enforcement. Law firm clients fared even worse, being informed just 11% of the time.

States differ in their definitions of what constitutes a breach, as well as personally identifiable information that would necessitate notification. Nonetheless, under the ABA’s Model Rule 1.4, a law firm is required to disclose a breach to a client if the breach is likely to impact the result of that client’s case.

In other words, following your state’s disclosure statues doesn’t remove your ethical obligations.

We back up our data, so we don’t need to payout on ransomware

Yes, hackers have thought of that, so to insure against this scenario, cybercriminals download your data before they encrypt it. Then they can blackmail you with the threat of selling and/or publishing your information if you don’t pay the ransom.

Our cyber insurance will cover the damages

Not so fast. Insurance companies are increasingly litigating payouts. There are several reasons that a cyber claim, or portion of the claim, would be denied:

· Failure to implement necessary prevention practices

· Failure to document preventative measures

· The incident was the fault of a third-party vendor or contractor

· Administrative errors

· Exceeding the time period covered for interruption of service

I could face a malpractice claim?

Yes. Opinion 483, combined with the ABA’s mandate for technical competence per Model Rule 1.1, opens the door for malpractice, negligence, breach of fiduciary duty, or breach of contract claims from clients whose confidential information is compromised.

What are the costs of a breach?

Outside of the costs associated with a lawsuit, there are significant costs surrounding the cyber incident itself – both monetary and reputational.

Two years ago, the average ransomware demand was approximately $5,000. Now, the average is nearly $200,000, and that’s just the ransomware payment.

Other costs can vary widely depending on the depth of the breach and the number of clients involved. These include expenses such as:

· Forensic analysis to see what data was compromised and who was impacted

· Repair and/or replacement of hardware and software

· Data recovery

· Business interruption/loss of billable hours

· Public relations advice

· Compliance with state/state’s notification laws

· Increased insurance premiums

· Increased targeting by hackers once a payment is made

· Loss of intellectual property

· Reputational damage/client churn

· Regulatory fines/penalties

· Credit monitoring for clients whose financial information was stolen

What do we need to do?

Ultimately, you need to take cybersecurity seriously. Yes, an investment in security controls can be costly, but it outweighs the downside of a data breach, which can be severe…or even business-ending.

December 3, 2020/by Jason Hwang

Blog

How Do Hackers Breach Law Firms?

The Lincoln Memorial’s columns are 33 feet tall. What does this have to do with data breaches?
Read on!

In our last blog, Why Are Law Firms an Attractive Target for Hackers?, we laid out the reasons why law firms get hacked – they are a one-stop-shop for valuable information and they are perceived to be an easy target, especially smaller firms with a less secure cybersecurity infrastructure.

So how do cybercriminals break into a law firm’s network? According to the Verizon Business 2020 Data Breach Investigations Report, attacks are primarily external and seek personal information or credentials (user names, passwords, etc). Phishing and social engineering are the easiest ways to get up-to-date credentials or personal information.

More sophisticated hackers can breach networks by exploiting known vulnerabilities in your network. Or, they can gain network access by hacking into one of your third-party vendors.

For the lucky hacker, employee error is also a factor in data breaches, whether accidental or intentional. The Verizon report indicates the professional services industry, which includes law firms, suffers 22% of their breaches at the hands of employees. However, this is less than North American companies as a whole, at 31%.

PHISHING

Phishing is usually carried out using emails, but text messages and social media are other avenues hackers use.

Phishing scams are increasingly difficult to detect since they appear to be legitimate messages and the embedded URL links take you to official-looking websites. Three telltale indications of a phishing scheme are:

Messages that have an urgent or emergency nature; and/or
Messages that take advantage of fear; and/or
Messages that have awkward or grammatically incorrect language.

However, many phishing campaigns involve mundane or routine events. For example, the following is a sample of phishing attacks that have been successfully used to breach law firms.

Malicious link claiming to be a software update
Hackers posing as law firm executives and requesting W-2s for employees
Warning that your Office 365 account is being deactivated
Delinquent membership dues for Bar Associations
Notification of a disciplinary complaint
A last-minute change in money wiring instructions
A notice to appear in court
Invoice from “Quicken Billpay-center”
Alert to change password
Vendor request to change payment options
File sharing services (Sharepoint, Dropbox, ShareFile, WeTransfer, Google Docs, and Egnyte) with malware-infected documents

SOCIAL ENGINEERING

Social engineering can take many forms and it’s often employed in phishing campaigns. Emails, texts, phone calls, or even a fake job application seeking an interview with your firm are techniques used by bad actors to fool your employees and gather more and more information to piece together ways to infiltrate your network.

Law firm websites are great for intelligence gathering. From attorney bios and significant verdicts to past and upcoming panel presentations, insight papers and news coverage. Hackers can use that knowledge together with court records and information from social media accounts to craft highly-targeted and personalized messages that don’t raise suspicion. They may even impersonate a client, friend, or family member.

EXPLOITS

You’ve probably heard about the importance of patching, but didn’t give it much thought. Hackers regularly use known vulnerabilities in software as an entry point into your network. In fact, the breach we discussed in our last blog at celebrity law firm Grubman, Shire, Meiselas & Sacks likely was an exploit of their Pulse Secure VPN (Virtual Private Network) server, according to BankInfoSecurity.

The Cybersecurity and Infrastructure Security Agency (CISA) recently released an alert of the Top Ten Routinely Exploited Vulnerabilities and noted that unpatched VPNs, particularly Pulse Secure VPN and Citrix VPN, are top targets in work-from-home environment in 2020. So too are cloud collaboration services, such as Microsoft Office 365.

The Panama Papers hack is a stunning example of the devastating consequences of ignoring cybersecurity. The law firm, Moassack Fonesca, had many outdated and unpatched systems that made them a sitting duck. Ultimately, the hackers were able to take advantage of known vulnerabilities with working exploits in outdated and unpatched versions of Drupal and Revolution Slider, a WordPress plugin.

VENDORS

Any third-party vendors your firm uses represent another attack vector for your network. We mentioned the data breach of 193 U.K. law firms in our last blog that was the result of a software security flaw in a legal documentation product from Laserform Hubs, owned by Advanced Computer Software Group Limited (and also reported in the Financial Times).

Cybercriminals will always attack the weakest link in the supply chain, so even if your firm has a nearly impenetrable network, you may still be vulnerable if a vendor has a weak cybersecurity posture.

INSIDER THREAT

Many data breaches are simply the result of human error. It can be sending sensitive information to the wrong person or failing to shred confidential documents that end up in the wrong hands.

Losing or failing to secure devices such as laptops, tablets, smartphones, and thumb drives are another way that employees put your firm’s data at risk. Likewise, your network is vulnerable when employees log in remotely using public WIFI as well as their home WIFI.

And, while we don’t like to think there are any bad actors in our firm, there is also the possibility of an employee intentionally leaking, stealing, or deleting client data for reasons such as revenge, financial gain, blackmail, or even mental instability. Fortunately, malicious insider threats are not very common.

UP NEXT

In our next blog, we’ll look at the ramifications of a data breach for your law firm.

UNTIL THEN: What Does 756 Gigabytes of Data Look Like?

Back to our last blog and the Grubman breach/ransomware attack. The hackers stole 756 gigabytes of data including “contracts, agreements, NDA, confidential information, court conflicts [and] internal correspondence with the firm.”

Given the different categories of data, it’s hard to quantify how many printed pages would result from 756 GB. For example, 1 GB would be roughly 100,000 pages of email, nearly 65,000 pages of Word files and almost 15,500 pages of images.

For reference, there are approximately 250 sheets of paper in an inch, so a foot would be 3000 pages. That makes a stack of 100,000 pages of email approximately 33 feet. Let’s look at some examples to visualize data amounts, assuming it is all printed email.

1 GB of printed email would be as tall as the columns of the Lincoln Memorial (we finally got to the headline reference!). But, there’s more. It would also stack up to Bebot in Philadelphia, the Trans Am Totem in Vancouver, the Looking Up sculpture in Austin, and the world’s largest office chair in Anniston, Alabama.
500 GB of these pages (16,500 feet) would just surpass the elevation of Ecuador’s Tungurahua Volcano at 16,480 feet.
750 GB of hardcopy emails would reach the top of Skyang Kangri in Pakistan, the world’s 36^th highest peak at 24,750.
1000 GB or 1 terabyte of email pages would get you to a cruising altitude of 33,000 feet, or the distance Vesna Vulovic fell from an exploding airplane without a parachute in 1972…and lived!
The Panama Papers hack we mentioned earlier resulted in the leak of 2.6 TB of data. That’s 2,600 Bebots!

August 19, 2020/by Jason Hwang

Blog

Why Are Law Firms an Attractive Target for Hackers?

LAW FIRMS ARE A ONE-STOP SHOP

It’s not difficult to fathom why law firms appeal to hackers. When you need groceries, you go to a supermarket and when you’re looking to
redecorate your living room, you go to a furniture store. Sure, you could visit several stores buying a few things at each one, but that’s not efficient. Or, you could opt for a visit to Walmart, but your choices will be much more limited and skewed toward the lower end of quality.

So, if you’re a hacker and you want the most valuable data with the least amount of effort and the greatest chance of success, a law firm is your Land of Plenty.

The American Bar Association (ABA) says that one-in-four (26%) law firms has been the victim of a some sort of data breach,
and an additional 19%, or one-in-five, firms was honest enough to admit they didn’t actually know if they had been breached or not.

So, for the remaining 65% of firms that report they haven’t been breached, it’s possible that some have been compromised without knowing it or simply decided not to report it. While all states have security breach notification laws, there are differences in harm thresholds, what constitutes personally identifiable information (PII), and even the definition of a breach.

When any one company’s network is hacked, it will likely provide access to PII about its employees and customers and maybe some trade secrets or useful financial information. But there is also a lot of useless data to cull through to find the good stuff.

ENTER THE LAW FIRM

A law firm has all of that good stuff tied up in a bow. Most of their data is confidential or sensitive information and can include embarrassing secrets or illegal activity that can damage a client’s reputation. Law firm files may also contain information that makes it easier to hack into a client’s network.

Consider all the confidential information that law firms have on intellectual property, trade secrets, contracts, business strategies and nondisclosure agreements, which represent valuable information for a company’s competitors…or for that matter, China. And let’s not forget the financial gain of a well-timed stock purchase or short. Law firms house all the nonpublic information that could impact a company’s stock price when that nonpublic information becomes public: information on mergers & acquisitions, research & development, investment plans, and pending legal or financial trouble, as a start.

LAW FIRMS HAVE A BAD REPUTATION IN THE CYBERSECURITY DEPARTMENT

Whether it’s true or not, hackers consider law firms to be easy targets and lagging in cybersecurity sophistication. What is true, however, is that lawyers tend to be continually time-pressured, which can lead to cutting corners on security practices.

Further, the ABA TECHREPORT 2019: CYBERSECURITY indicates that only 44% of law firms use file encryption, 38% use email encryption, and 22% use disk encryption. Local backups were made by a mere 27% of the survey’s respondents and only 23% performed vendor due diligence. Just last month it was reported that data from 193 U.K. law firms that had been uploaded to a legal software company’s database, was exposed.

This highlights another problem for law firms — data in motion is the data that is most vulnerable to attack, yet lawyers regularly communicate sensitive information to clients and third parties, mostly in electronic form, and frequently unencrypted and via unsecured channels.

MORE TO COME

The Grubman, Shire, Meiselas & Sacks hack highlights that law firms store valuable data. In this case it was 756 gigabytes of data, which is not insignificant. In our in our next blog, we’ll have some fun exploring what 756 GBs looks like.

June 16, 2020/by Jason Hwang

Blog

“Repeat After Me…CMMC Will Not Happen Overnight”

We’ve got the DoD’s final certification standards, but a lot is still unknown

By Chris Sullins

February 12, 2020

The headline quote was from Katie Arrington, Special Assistant to the ASDA for Cybersecurity, at CMMC Impact On GovCon: Now and in 2020, an event hosted in late January by law firm, Holland & Knight.

It’s Not as Close as You Think

While September 2020 is the goal for implementation of the Cyber Maturity Model Certification Program (CMMP), Arrington said it was highly unlikely that any contracts containing CMMC requirements would be awarded before 2021. Certification is not required for a company to bid on a new contract, only to be awarded one. And, how many government contracts are awarded within three months of an RFP?

In practice, CMMC is expected to take five years to be fully implemented as existing contracts aren’t affected until renewal or modification. So, it will be FY26 before every Department of Defense (DoD) contract will have CMMC certification requirements.

The Roll Out Will Be Thorny…for the Regulators

Despite the presumed burden of CMMC compliance within the DoD supply chain, Arrington explains, “Level 1 will be on the bulk share of Department of Defense contracts.”

Level 1 consists of 17 basic cyber hygiene controls and essentially is equivalent to FAR 52.204-21. However, the larger obstacle to getting certified is more likely to involve difficulty locating and scheduling a qualified assessor than being prepared to pass the certification audit.

Why? The regulatory bodies have two staggering supply/demand-imbalance challenges ahead of them given the fast-approaching roll out of CMMC.

There will be a significant shortage of assessors

Self-certification, which was possible under NIST 800-171, is not an option with CMMC. The only avenue for certification is through a certified assessor at a credentialled C3PAO (CMMC Third-Party Assessment Organization).

But, there are no certified C3PAOs or assessors at this time. And, the requirements to become a C3PAO haven’t been established, nor has a training curriculum been developed for assessors.

Yet, training is slated to start this spring. Trainers are needed to run these classes, but they also need to be trained. Several iterations of training/feedback/tweaking are envisioned to determine what training is (and isn’t) successful in the curriculum.

The security clearance backlog is worrisome

Assessors will be required to have a security clearance to conduct CMMC audits, although the clearance level has not been defined. While the security clearance backlog has decreased substantially from the April 2018 peak of 725,000 to around 200,000 in January 2020, CMMC will add upwards of 10,000 assessors (over time) who need to be fast-tracked.

In addition to the backlog, there is processing time. While clearance processing times also are improving, they’re too long for the CMMC timetable. In 4Q19, it took 181 days on average to obtain a Secret clearance. As of this writing, September 1, 2020 is only 202 days away and 2021 starts in 324 days. (Again, clearance level hasn’t been specified).

But, Have Faith in Those Who Accepted the Challenge

During another presentation at the Holland & Knight event, Ty Schieber, Chair of the newly established CMMC Accreditation Board (CCMCAB), acknowledged the concerns.

“There is a lot of uncertainty and angst about what (CMMC) is or isn’t (due to) a lack of information or misinformation. And, a lot of the information that people want to know is still undecided,” he said. “The job of the Accreditation Board is to turn unknowns into knowns as soon as possible.”

The CMMCAB is keenly aware of the impending shortage of qualified, credentialled assessors and they expect the deficit to persist for the first six months to a year. As such, they are committed to mitigating the effects.

“We will come up with a system that allows prioritization for people who have contracts that they are planning (to bid) on, or contracts that they have bid on and are anticipating a possible award. We’re going to make sure that the system works, but we don’t know how yet. We’ll figure it out.” said Board member Mark Berman.

Of fundamental importance to the CMMCAB is ensuring that a contract earned by a cyber-ready company isn’t lost due to audit scheduling. “At the end of the day,” noted Berman, “the Accreditation Board cannot be the roadblock between a business and its contract.”

Likewise, the onerous hurdle created by the security clearance requirement for assessors is not lost on the CMMCAB or the DoD. Currently, the DoD is investigating ways to speed the clearance process for CMMC assessors, so it doesn’t become a chokepoint in the process.

Why the Rush?

It may seem that CMMC came out of nowhere and is moving at a rapid pace. In fact, several defense industry associations have urged the DoD to slow down. But, the CMMCAB contends that they are being deliberate and carefully considering decisions, while appreciating the sense of urgency.

Even so, Arrington says we’re running out of time. “Electronic warfare is not static” she said. “You solve one problem, the adversary finds another.”

For example, our adversaries exfiltrate about $600 billion a year from the U.S., which is nearly the size of the defense budget and costs taxpayers $4,000 per citizen…after tax.

What’s more, Arrington said that the next five years will bring the commercial availability of both Quantum computing and 5G. Together, these technologies have the potential to be catastrophic: Quantum computing breaks basic level encryption and 5G provides open access.

At that point, $600 billion could look like peanuts.

Be Part of the Process

The board views CMMC as a collaborative effort and wants input from the industry. The CMMCAB website provides a way to contribute with their “One Thing” question. It reads, “If you have experienced an audit or assessment from a regulating authority before, what is one thing that would have made it a better experience for your organization?”

Everything submitted on the website is read. Also on the website is a stakeholders section where you can subscribe for updates.

Embrace CMMC

Like anything new, the introduction of CMMC could experience hiccups or require revisions. Nonetheless, it’s worth noting that everyone I’ve encountered who is involved in the development and/or implementation of CMMC is passionate about their mission and unwavering in the belief that the DoD and our industrial base must be secure.

Asked why he wanted to take on his role, Scheiber replied, When you look at the significance of this in terms of the threat to the nation, that’s why I get up every day.”.

“We have an opportunity here to change the world…to make this a safer country,” Berman added. He also shared his regret that his career path did not include military service. “This is my chance, that I didn’t take when I was in my twenties (to serve the country.)”

February 12, 2020/by Jason Hwang

Blog

Do You Know All of the Devices Connected to Your Network?

If not, you’re not alone

A troubling statistic in IT security is that 30% of IT managers do not know how many devices are on their networks, according to a 2018 LogMeIn report. Likewise, 10% of IT administrators surveyed by the Sans Institute said they didn’t know how many management servers they were using. Even more surprising, Gartner disclosed results from a survey of clients who found 60% more endpoints on their networks than they thought by using an automated IT asset management tool.

What’s behind the lack of visibility?

There are several trends that contribute to poor network visibility.

1. Decentralized networks. Companies with several locations increase the complexity of the network and introduce the potential for security gaps. For instance, almost half of participants in a 2018 survey by SANS Institute reported having at least six operating systems and 12% said they have at least 11.

2. Bring Your Own Device (BYOD). A 2018 report from Bitglass found that 85% of the companies surveyed allow BYOD to not only employees, but also contractors (27%), partners (25%), customers (22%), and suppliers (19%). And, many employees use multiple connected devices at work, which aren’t always authorized or known by the IT department.

3. Internet of Things (IoT). Many IoT devices are not added to the inventory list of connected devices so they’re not detected by network scans.

What’s the Risk?

Lack of network visibility is a critical issue facing IT managers given the inherent vulnerability of connected devices. According to IDC, 70% of breaches occur on endpoint devices. Research from Absolute Software found that 42% of endpoints are without security at any point in time. As a weakly protected path to the network, connected devices are an appealing target for cyber criminals.

Complicating this issue is the rapid growth of devices that connect to corporate networks. Statista estimates that there were 22 billion devices connected to corporate networks and the internet at the end of 2018. That number is expected to reach more than 30 billion by 2020 and over 75 billion by 2025. Consider also, that these devices have their own apps and software.

What to do?

IT departments must make device visibility a priority. It’s essential to know and inventory all devices on the network, when the devices are connected, who is using them, what is running on them, and what’s their security posture.

Keep in mind that it only takes one unknown or unprotected device to provide a gateway for hackers to infiltrate your network.

December 12, 2019/by Jason Hwang

Blog

How Your Social Media Activity Can Make You a Sitting Duck

For many companies, social media is a powerful marketing and recruiting tool, fostering brand awareness and connection to current and potential customers. For a small business with limited resources, social media can function as an inexpensive advertising mechanism to a wide-ranging audience.

It’s also a highly engaged audience with the average global user spending 2 hours and 36 minutes a day on social media sites in 2018, according to statista.

But, have you considered that the information your company posts to social media can also make it an easy target for cybercriminals?

THE PROBLEM

The personal privacy risks associated with oversharing on social media is generally accepted by the typical user, whether or not they act accordingly. But companies also put themselves at risk by providing seemingly safe corporate information on a regular basis to their social media feeds in the interest of having an online presence.

As corporate social media use increasingly looks like mainstream personal use, the same security concerns are brought into play. Posting photos of your events at your office could inadvertently reveal clues that could be used to social engineer an employee or expose a security weakness. Posting updates from your company’s annual trip alerts criminals that your office is empty or is operating with a skeleton staff.

And, it’s not just the posts on your company’s page that can be mined for data. The interrelated nature of social media makes the personal accounts of your employees valuable as additional sources of information as well as potential sources of entry to your network.

Likewise, vendors and partners who are linked to or follow and comment on your social media accounts represent another attack vector, especially if they have a poor cybersecurity profile.

HOW COMPANIES GET HACKED

If you think like a hacker, you know that trying to hack past a company’s firewall and compromise highly guarded information without being detected is much harder than developing customized social engineering campaigns using the information you can find easily on social media sites.

People are wired to want to connect, which makes social media so appealing to us and so productive for cybercriminals. People’s willingness to share combined with the trust-based nature of social media is why phishing campaigns are more successful on this platform than via email.

Further, statista found that 81% of social media traffic in the third quarter of 2019 came from mobile. That’s important because the user interface on mobile can make users more likely to fall for phishing scams.

So, what methods are cybercriminals using on social media to infiltrate your network?

· According to FireEye, email is the vehicle used in 91% of cybercrime. The personal information that is common on social media makes it much easier to impersonate another employee or senior management.

· Malicious links are more effective on social media, where people are less suspicious than they are with email links. Hackers can pose as someone you know and send malicious links through direct messages.

· Fake accounts can be created using photos and details of actual people or companies to create real-looking, but fake profiles to attract connections and distribute malware.

· Similarly, profile hacking, like the August 2019 hack of Jack Dorsey’s twitter account, are generally undertaken to embarrass people or companies and damage their reputation.

· Old social media accounts, that still exist but are neglected, present an easier opportunity for profile hacking than active accounts and could be used for illegal activity under the guise of your company.

· Shortened URLs, such as those from Ow.ly and Bitly, can easily hide malicious links.

· Hackers can pose as a customer service employee of any of the social media platforms and send an email that your account has been cancelled or compromised. Reinstating the account requires you to input your information.

· Social media quizzes are a way for hackers to acquire personal information that can be used to socially engineer you or your friends.

· Social media accounts are easily accessed on mobile devices, which makes them easy to compromise if a hacker gains possession of a lost or stolen employee device.

HOW TO PROTECT YOUR COMPANY & EMPLOYEES

First, be clear on why your company needs a social media presence. Maybe it doesn’t. That’s a tough sell, especially to a new or small business, but companies were able to grow for years before social media existed.

Nonetheless, if your company does maintain social media accounts, know which channels you’re on and which employees have administrative access.

Most importantly, have a social media policy that lays out what is and isn’t acceptable to post about the company. Then, train employees on how their personal use of social media can be detrimental to them and the company. Some general best practices include:

· Use two-factor authentication.

· Don’t connect with people you don’t know.

· Don’t click on questionable links in social media posts. Instead, type the URL into your browser to view.

· Don’t share information about yourself or the company that could be the answer to security questions used to identify you.

· Don’t use the same password across platforms or for business purposes.

· Utilize the privacy settings on each platform.

· Don’t access your personal accounts or the company’s accounts over public Wi-Fi.

· Report any suspicious activity immediately.

MONEY TALKS…

So, you know what walks, right? It’s understood that there’s a tradeoff between free social media and complete privacy and most are willing to make the exchange. However, the amount of privacy that’s relinquished tends to be more than people anticipate or understand. For social media companies, the business model is to generate revenue by selling your personal information to advertisers. So, it’s in the best interest of these companies (and their shareholders) to encourage you to provide plenty of identifiable data about yourself.

It’s in the best interests of cyber-scammers too, who have created a $3+ billion social media crime industry using the data they collect from these sites.

November 14, 2019/by chris_sullins

Blog

eDiscovery: Bags of Money Not Required

“It’s unwise to pay too much, but it’s worse to pay too little.” John Ruskin

Being frugal is admirable. Believe me, I hate waste and I can make a dollar talk. But there are some expenses, such as medical care, insurance, financial and legal advice…even paint, where pinching pennies ends up being more expensive. The same is true for eDiscovery.

Having said that, there are simple ways to bring down the cost of eDiscovery and it involves:

· Recognizing that a knowledge gap exists

· Thorough planning ahead of time

· Expert advice and guidance

THE KNOWLEDGE DISCONNECT

When it comes to eDiscovery, there is a knowledge gap for both clients and attorneys.

For clients, it’s hard to comprehend the unpredictable and opaque nature of eDiscovery costs and the wide fluctuation of these costs across individual cases. This is a justified frustration and a challenge that eDiscovery providers need to overcome.

For instance, a frequently-cited 2012 RAND study, identifies the average costs for eDiscovery production spanned a range of $17,000 to $27 million ($1.8 million median) for individual cases. That’s a meaningless estimate.

As for corporate eDiscovery, a 2018 survey by the Corporate Legal Operations Consortium (CLOC) found the average eDiscovery expense per year for companies was $2.8 million. (Mid-sized companies with annual revenue over $1B were 39.5% of respondents while large companies with $10B+ represented 46.5%).

Confusing cost structures is likewise an issue for litigators, but it’s the given process of eDiscovery that’s most burdensome. Attorneys need to have a level of knowledge about the available tools and technologies for a client’s specific eDiscovery needs, which is outside their area of expertise. For lawyers, it’s best to accept that your time is better spent on billable legal matters.

PLANNING AHEAD OF TIME IS KEY

Thoughtful planning with the goal of standardizing repeatable processes is the biggest initiative you can take toward reducing eDiscovery costs. While not everything can be standardized, think in terms of timelines and templates in keeping with best practices.

eDiscovery planning also includes collecting metrics to use as a reference for forecasting future costs and identifying any unnecessary outlays.

More than anything, planning eliminates the turmoil usually associated with eDiscovery. Getting started early and creating plans and protocols in advance is your best strategy for successfully navigating the process.

Create an ESI Protocol

Before a meet and confer, create a document with answers to frequently asked questions. Make sure you have extensive knowledge of your client’s data and the costs associated with the data you’re requesting from opposing.

Develop your ESI protocol so that it clearly addresses all necessary practices and procedures related to ESI in the case. This involves the technologies used, collection and culling methods, production specifications, and claw back provisions.

Cooperation between parties is essential because adversarial behavior makes eDiscovery very expensive. The earlier the terms of the ESI protocol are set and agreed upon, the lower the eDiscovery costs will be.

Proper Use of Legal Holds

According to Federal Rule of Civil Procedure Rule 26(b)(1), discovery in a civil case is available for “any nonprivileged matter that is relevant to any party’s claim or defense” and is proportional.

Therefore, when issuing a legal hold, it is helpful to have a process in place that lays out the specific data preservation expected and allows for negotiating cost-saving strategies such as phased discovery, sometimes referred to as data sweeps, and targeted data set collections.

Be specific about the data and documents that must be preserved and be sure to address automated IT functions so those operations can be stopped before data is unintentionally deleted, thereby hindering data acquisition.

Identify the Right People and Data Sources

Interviewing custodians is a quick way to identify the key people involved in the case, the relevant data, and where that data is located.

Ask custodians about devices, applications, and online accounts that might be tied to data sources, such as mobile and personal devices, and cloud-based storage. Recognize that archives, data backups or obsolete systems may contain important data and come into play when targeted data sources come up short or spoliation of the ESI has occurred.

This is also the time to inquire about data encryption, password controls and to request a data map of an organizations data and network structure.

Data Collection

Simply reducing the volume of data involved in eDiscovery is a surefire way to significantly lower costs. Use collection tools that filter data by time frame and file type. Cull data for responsive, non-privileged, and non-duplicative documents.

Phased discovery is another cost-saving approach that focuses on the most relevant data first and could decrease or eliminate the need for further discovery. It sweeps data sources to see what results are produced using targeted search terms and is a good means to triage data sources (are these the drones your looking for?)..

Keep in mind, mobile devices may not be the best source of data and may only produce more data to search through, so be selective when requesting devices.

Storage

Once data is collected, it must be stored in a secure repository, so consider the cost benefits of a shared repository.

Data Production

Production specifications ought to be addressed in the ESI Protocol. For added cost savings at this stage, explore rolling production, which starts with a limited production set (usually of the most critical data) and continues in stages.

The benefits of a rolling production include:

· Early identification of problems with production

· Timely agreement between parties that production matches the ESI protocol

· Access to critical data before all production is completed

Data Review

This is the costliest stage of the eDiscovery process with most estimates assigning 70-80% of discovery costs to document review.

The earlier stages of eDiscovery have focused on reducing the volume of data that gets to this stage. To realize additional cost savings, you need a clear and detailed review protocol in place, including a coding template.

Another option is Technology Assisted Review (TAR), which uses predictive coding to reduce costs. The caveat here is that TAR should only be done be someone with both legal and technical knowledge, or jointly with an expert in each discipline.

HIRING AN EXPERT IS GAME CHANGING

It’s expensive to bring an eDiscovery expert into your case and even more expensive if the case requires digital forensics. Nonetheless, it will likely be the difference between winning and losing. Better yet, you can share a neutral third-party expert with opposing counsel as a way to reduce this cost.

eDiscovery and digital forensics are complex fields that require years of training, including persistent continuing education to develop and maintain skills and techniques in the evolving technologies.

Experts have extensive knowledge of the variety of available forensic software applications and when to use them. Because they understand the types of data existing on different devices and can work across the wide range of operating system versions, they can provide invaluable advice during meet and confers and in preparing the ESI protocol.

Depending on the types of ESI being requested, an expert can advise the attorney on the proper data sources and devices to target. Moreover, an expert knows which types of data and approaches will be prudent in searching for answers and finding relevant ESI.

In fact, an eDiscovery expert can assist you in every stage of the eDiscovery process, which can bring down the overall discovery expense while you focus on the legal strategy.

October 9, 2019/by chris_sullins

Blog

The ESI SmackDown

When Electronically Stored Information Reveals You’re a Horrible Human Being or a Halfwit

When my son was eight- and nine-years-old, our Friday nights were spent eating pizza and watching WWE SmackDown. By the grace of God, it was a relatively short-lived period for him and not a life’s calling.

Yet, for all the exaggerated theatrics and “Hero v. Villain” grudge matches, professional wrestling pales in comparison to the astounding performances that play out in some court cases – the one’s where you ask, “What were they thinking?!”

The following three examples are cases where electronically stored information (ESI) was used as evidence. These are simplified recounts and I’ve focused on the details of each case that describe the baffling conduct of the party that fell victim to the “ESI SmackDown.”

Now entering the ring…

Breach of Contract case: ComLab Corp. v. Kal Tire

In this case, ComLab claimed to have entered into an intranet service contract with Kal Tire.

As evidence, ComLab produced 20 printed invoices. However, Kal Tire denied ever entering into an agreement with ComLab or receiving any services from them. Kal Tire did acknowledge receipt of four invoices from ComLab, leaving 16 “Contested Invoices.”

Doubting the authenticity of the Contested Invoices, Kal Tire requested to receive the invoices in their digital native format. In response, ComLab produced 13 paper hard copies of the emails it used to send the invoices (essentially printouts, not the digital originals).

Why hard copies? Well, the original emails were destroyed when the computer they were stored on was wiped after allegedly becoming infected with a virus. Luckily, ComLab’s president had the good judgement to save the emails as PDFs before they were gone for good.

Kal Tire’s expert witness testified that the metadata from several of the invoices attached to the e-mails contained “Last modified” dates and times that followed their “Date last saved,” suggesting something shady was going on.

The Court determined ComLab “fabricated and spoliated evidence” and “that these acts were egregious, intentiona, and outrageous.” Ouch!

ComLab’s case was dismissed with prejudice and the company was ordered to pay all of Kal Tire’s fees and costs, which came to $313,138.67.

***

Next up…

Breach of Contract, Trade Secret Misappropriation and Unfair Competition: OmniGen Research v. Wang

In February 2016, OmniGen sued its former employee Dr. Yongqiang Wang, as well as his wife Ms. Yan Zheng and their company, Bioshen. OmniGen alleged that while still in its employ, Wang stole trade secrets and used them to secretly create two rival businesses.

Earlier in July 2015, OmniGen sent a cease-and-desist letter to Wang claiming breach of contract and misappropriation of trade secrets. OmniGen also demanded that Wang make available to them all electronically stored information contained on his devices and the Court agreed.

Instead, he travelled to China without producing his laptop, as required, to present at a scientific conference sponsored by Bioshen, Mirigen (Wang’s other company) and others.

At the conference, Wang presented from an existing (and copyrighted) OmniGen slide deck on feed additive research, though he altered the slides to replace OmniGen’s logo with Mirigen’s. It would have been a clever deception, except Wang got sloppy and gave an electronic version of the slides to the conference organizers and attendees, which revealed OmniGen’s confidential notes that were not visible in the projected slides.

While Wang was in China, another hearing was held and the Court ordered him to make a copy of the contents of his computer and mail it to his counsel. He was also ordered to make available any computer and portable storage data within seven days.

When OmniGen finally received Wang’s laptop data and had it inspected, the expert discovered more than 4,000 files had been deleted. Likewise, emails were deleted on the iPad used by Wang’s wife.

Zheng’s iPad was carelessly left in airplane mode when delivered to OmniGen, with her downloaded Yahoo emails still visible. Attachments in download emails can only be opened with an internet connection, which then removes the emails. In one email from Zheng to Wang, the attachment was inconspicuously named “feed additive.docx.”

In his defense, Wang claimed that the deleted files were not relevant to the case. What’s more, he shamelessly asserted he was tricked by OmniGen into signing a much more restrictive employee agreement than what he initially reviewed. Wang’s proof was a version of the original agreement he saved to a thumb drive before deleting this significant document from his laptop.

You already know what comes next. The metadata for the “old” agreement on the thumb drive reveals it was modified after litigation started. What’s more, the alleged original agreement on the thumb drive was generated in the newer .docx Word format, where the agreement Wang signed in July 2009 was in the older .doc format.

The judge granted OmniGen’s Motion for Terminating Spoliation Sanctions and a default judgement was entered in favor of OmniGen. OmniGen was awarded $3.85 million.

***

And, last up…

Title VII Gender Discrimination and State Law Claims: Lee v. Trees, Inc.

In this last case, Lee sued her employer, Trees, as well as her supervisor and former suitor, Sims, after she was terminated from her job as a flagger.

Lee claimed she wanted to end her romance with Sims in June 2013, but was forced to continue in the relationship, on threats of losing her job (as a flagger, mind you). After four months of this alleged harassment, Lee ended the relationship for good and was terminated ten days later.

Lee filed two administrative complaints with the Bureau of Labor and Industries (BOLI) and the U.S. Equal Employment Opportunity Commission in December 2013 and March 2014 alleging sexual harassment by Sims and several other co-workers, a hostile work environment, and retaliation. She also claimed to have text messages to and from Sims as evidence that she “asked [Sims] to stop the relationship” and was fired for doing so.

Lee sent printouts of her text messages to her attorney, who forwarded them to BOLI, who issued Notices of Substantial Evidence Determinations and right to sue letters.

When Trees requested the text messages in their digital native format, Lee gave them the same printouts that were forwarded to BOLI. On a second request, Lee produced only one cell phone of the “three or four” or “maybe five” she had while employed by Trees. (Seriously, FIVE?! Who does that?).

When Trees’ forensic examiner inspected Lee’s phone, he found that many of texts from the printouts were fabricated, but at least 44 of the messages on the printouts really did exist. Trouble is, they were in the phone’s “unsent” folder and were time-stamped a year after the alleged harassing.

While Lee denied fabricating the texts, the judge was unconvinced, stating, “Lee carefully and intentionally manipulated and interspersed Sims’s actual text messages with strategically crafted false text messages to lend support for her claims. She also failed to preserve her phones and withheld the native, electronic versions of the text messages, in all likelihood to conceal her wrongdoing.”

Trees’ motion for terminating sanctions was granted and Lee’s claims were dismissed with prejudice.

***

Electronically stored information can serve to exonerate or demonstrate guilt. These were just three of many cases where the introduction of ESI as evidence exposed wrongdoing. But, ESI can also uncover character.

Circling back to the subtitle of this post, what do you think motivated the bad behavior in these cases? Are the ESI SmackDown victims morally bankrupt or just lacking common sense? Perhaps its some combination of both, with some arrogance and delusion thrown in mix.

September 6, 2019/by chris_sullins

Blog

Cyber Insurance is Better Than You Think Part 2

In Part 1, we addressed some of the negative perceptions that exist for cyber insurance, the need for a standalone cyber policy and the difficulty carriers have in pricing premiums. In Part 2, we will explore the premium pricing practices and what to look for in a cyber policy.

How Do Carriers Price Premiums?

According to Founder Shield, underwriters use the following information to price cyber insurance premiums.

Systems vulnerabilities
Security training protocols
Loss history
Types of data collected and stored

An Advisen whitepaper from 2014 indicates that cyber policy underwriters are also interested in the amount of data a company retains, where data is stored (company server or cloud), and vendor management controls. But, there is no mention of loss history or security training.

In 2016, Jeremiah Grossman, Chief of Security Strategy at SentinelOne said to ITSPmagazine that premiums were based on only two factors – the company’s industry and the number of records it’s stored. In 2017, he added revenue to the equation in an article with Insurance Business.

What’s more interesting is a study done by researchers at RAND. They reviewed policies on file with the insurance commissions in three states (CA, NY, and PA) between 2007 and 2017 to identify how carriers are assessing and pricing cyber risk. The researcher’s analysis revealed five pricing determinants.

1. Outside advice or loss data from industry, academic, and government reports;

2. Competitor’s pricing;

3. The experience and knowledge of the company’s underwriters;

4. Pricing from other insurance lines; and

5. Guesswork.

“From our analysis, the first and most important firm characteristic used to compute insurance premiums was the firm’s asset value (or revenue) base rate, rather than specific technology or governance controls.”

Wait…what?! Cyber insurers don’t care about cyber resilience or best practices?

To be fair, most policies analyzed in the RAND study required self-assessment questionnaires that asked for varying levels of detail related to a company’s security posture. However, questions were mostly focused on data type and volume and not on the security infrastructure.

To address the need for more sophisticated cyber risk assessments, insurers are increasingly turning to technology companies to provide analytics to develop coverage and pricing models. These companies are usually referred to as AppSec or InsurTech providers.

According to The World Insurance Report 2019, over 50% of insurers interviewed indicated partnerships with InsurTech firms or other risk analytics companies. By providing machine learning, aritificial intelligence-based products or advanced analytics, these companies enable underwriters to price risk on limited data.

What to Look For in a Cyber Policy

Before you start to evaluate cyber policies, be sure to select a broker and/or carrier that solely focuses on cyber insurance. Most companies look to buy insurance based on a budget rather than their actual risk exposure. A cyber-experienced broker can guide you to the appropriate coverage specific to your business.

So, what factors are important to consider when reviewing a cyber insurance policy?

First, all policies list losses that are covered and those that are not. The RAND study compiled lists of the 10 most covered losses and the top 10 exclusions.

Most common covered losses

Most common exclusions

Next, don’t assume the common policy exclusions listed above are written in stone. Most exclusions can be negotiated.

· Be careful if you see a War and Terrorism Exclusion clause since 23% of cyber attacks are committed by nation states, according to Verizon.

· Look for indirect cost coverage, such as potential bankruptcy costs when a cyber attack compromises Intellectual Property.

· Investigate coverage for claims against you for breaches caused by you or your vendors on an outside network. As such, require cyber insurance for your vendors.

· Expect the policy to include Full Prior Acts coverage, which will cover any event that occurred in the past. This is vital considering many cyber events occur long before they are discovered.

· Be sure cybercrime events that utilize social engineering are covered. This includes Funds Transfer Fraud, Corporate Identity Theft and Phishing. According to the Willis Towers Watson 2017-2018 Reported Cyber Claims Index, the human element continues to be the leading cause of cyber loss, representing 61% of claims.

· Examine coverage for cyber-related property damage. Most cyber policies want to exclude it as a redundant coverage with General Liability policies. However, many General Liability policies exclude damage related to cyber event.

Take note of when coverage is triggered. For example, under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), which goes into effect in January 2020, privacy violations can occur in the absence of a breach. This wording is not likely in your policy.

Lastly, companies who can demonstrate a comprehensive cybersecurity plan with proven levels of security and internal controls receive better premium pricing. A cybersecurity services firm can prepare you by assessing your security infrastructure and making recommendations to lower your risk of a cyber event. They also can help with developing incident response plans and documenting security best practices.

The time to buy cyber insurance is now! Given the industry’s growth and profitablity, new carriers are entering the market and pressuring premium pricing. In fact, analysis of cyber incidents relative to their cyber premiums conducted by AIR indicates, “it’s likely that premiums being charged in the market are less than adequate to fully cover all sources of insured loss.”

July 24, 2019/by chris_sullins

Blog

Cyber Insurance is Better Than You Think Part 1

“I could tolerate any insurance seminar. For days, I could sit there and listen to them go on and on with a big smile on my face. They’d say, ‘How can you stand it?’ And I’d say, ‘Because I’ve been with Del Griffith. I can take anything!’” ~Steve Martin as Neal Page in Plains, Trains and Automobiles

That’s one of the many memorable moments from one of my all-time favorite movies, “Planes, Trains and Automobiles.” While the scene is both funny and poignant as the camera moves back-and-forth from a ranting Neal (Steve Martin) to a crestfallen Del (John Candy), it also illustrates the pessimism we tend to associate with insurance. Not only is the subject matter tedious, but we’ve all either experienced first-hand or heard stories about insurance companies managing to pay out as little as possible – if at all – on a claim due to obscure or ambiguous exclusionary language in the policy.

Despite being a relative newcomer* to the industry, cybersecurity insurance is getting the same bad rap. High-profile pay out denials, such as Zurich’s refusal to cover the losses Mondelez suffered from 2017’s NotPetya ransomware attack (currently in litigation), have helped to support this negative view. In fact, a recent CPO Magazine article suggested that many cyber policies are “worthless.”

However, cyber policies pay claims at rates comparable to other types of insurance. But, it’s the big-dollar cyber claim disputes that get attention and skew perceptions. Many are the result of poorly negotiated policies, or even more to be claims that are filed against a non-cyber policy, such as claim against a general liability policy.

The financial fallout from a cyber event can be staggering, so relying on a non-cyber policy to cover losses related to a cyber-attack is perilous at best as these policies don’t address specific cyber-related losses. What’s more, loss exposure is hard enough to quantify in a cyber policy, because in the end many factors will be weighed regarding the company, the type of attack, the motivation for the attack, and the value of data and information.

Even historical cyber-attack data will factor in loss valuations that are all over the board (see Notes). The wide disparity in these loss calculations is attributable to the absence of a standard for assessing risk among insurers. Further, cyber-insurance models aren’t consistent across carriers and rely on limited actuarial data that has been insufficient for accurate premium pricing. This lack of transparency is another blemish for cyber insurers, which makes it difficult for companies to compare coverages and inherently exposes carriers to extreme losses and systemic risks that is nearly impossible to predict.

Fortunately, the industry is evolving. As more data is collected, insurers are discovering trends and learning what coverages are needed. Underwriters are going onsite to inspect a company’s infrastructure and network, as well as their security protocols to develop a risk profile from which a premium can be determined. While premium pricing challenges lessen for carriers, most companies remain unqualified to assess their own security posture and are not aware of the factors that impact premium pricing. Before contacting a cyber insurance company, it would be wise to engage a cybersecurity expert to perform a cyber risk assessment. The expert will identify threats and vulnerabilities and make detailed recommendations for improving the company’s cyber risk profile.

Insurance carriers award cheaper premiums to companies with the appropriate cyber tools in place, written plans for incident response and disaster recovery, least privilege policies and encrypting sensitive data, among other things.

But, don’t wait for a cyber incident to happen before exploring cyber insurance. That loss event, even if it’s small, already means a higher premium.

—

*Cybersecurity insurance has been around for about 20 years. Initially, it was mostly used by large companies in technology, financial services, and health care and only provided third-party coverage.

Notes:

The 2019 Hiscox Cyber Readiness Report indicates the average cyber incident loss over a 12-month period is $369,000 with large companies averaging $395,000 and small companies at $9,000 (globally). The per incident average is $34,000.

A survey by Kapersky’s Lab conducted with over 6,000 employees around the world from March 2017 to February 2018 found the average cost of a cyber incident was $1.23 million. The average for small and medium businesses (SMBs) was $120,000. In North America, the average cost of a data breach was $1.6M with SMBs averaging $149K.

With regard to data breaches, the 2018 Cost of a Data Breach Study by the Ponemon Institute, indicates that the average total cost of a breach in the United States is just shy of $9 million with an average cost per lost or stolen record of $233. Globally, the average total cost is $3.86 million and $148 per record.

July 17, 2019/by chris_sullins