UNSAFE AT ANY SPEED: CYBERSECURITY FOR LAWYERS MICHAEL P. HANNIGAN - - PDF document

9/19/2018 1

UNSAFE AT ANY SPEED: CYBERSECURITY FOR LAWYERS

MICHAEL P. HANNIGAN KONICEK & DILLON, P.C.

UNDERSTANDING THE PROBLEM

• Insecure Communications vs. Insecure Credentials

9/19/2018 2

IMPORTANT TERMS

• Phishing
• Spear Phishing
• Social Engineering
• Spoofing
• Human Error

METHODS

• Email attachments
• Insecure servers
• Inadequate protocols

9/19/2018 3

EXAMPLES

• 16 Year Old “C0mrade” Hacks Marshall Space Flight Center
• NASA Shut Down for 21 Days
• Hacked Defense Threat Reduction Agency
• Hacked Military Computers
• 15 Year Old Hacks US Intelligence Officials
• Accesses CIA, DOJ, and Homeland Security
• 15 Year Old “MafiaBoy” crashes Yahoo, CNN, Ebay, Amazon, and Dell
• 19 Year Old Hacks FBI-Interpol Conference Call on Hacking

EXAMPLES

• Demonstrations of hacking law firms

using inexpensive software available

• nline
• 12 Year Old “Cyber Ninja”
• Demonstrates how easy it is to turn any

computer into a listening, recording, or visual device

9/19/2018 4

IMPACT ON LAWYERS

• Real Estate industry vulnerable and primary

target

• New duties imposed on attorneys as

technology changes

• Undefined standard of care
• Need to take new precautions
• Need to reassess risks and exposure
• “IMPORTANT NOTICE: Never trust wiring

instructions sent via email. Cyber criminals are hacking email accounts and sending emails with fake wiring instructions. These emails are convincing and sophisticated. Always independently confirm wiring instructions in person or via a telephone call to a trusted and verified phone number. Never wire money without double-checking that the wiring instructions are correct.”

RULE 1.1 COMPETENCE

• “A lawyer shall provide competent representation to a client. Competent

representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.”

9/19/2018 5

COMMENT 8 TO RULE 1.1

• “To maintain the requisite knowledge and skill, a lawyer should keep abreast
• f changes in the law and its practice, including the benefits and risks

associated with relevant technology, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject.”

PROFESSIONAL NEGLIGENCE ELEMENTS

• Duty of care arising from an attorney-client relationship
• Breach
• Proximate Cause
• Actual Damages

9/19/2018 6

JURY INSTRUCTION – PROFESSIONAL NEGLIGENCE

• “A lawyer must possess and use the knowledge, skill, and care ordinarily used by a reasonably

careful lawyer. The failure to do something that a reasonably careful lawyer would do, under circumstances similar to those shown by the evidence, is ‘professional negligence.’

• “The phrase ‘deviation from the standard of care’ means the same thing as ‘professional

negligence.’

• “The law does not say how a reasonably careful lawyer would act under these circumstances. That

is for you to decide. In reaching your decision, you must rely upon opinion testimony from qualified witnesses and evidence of professional standards.

• “You must not attempt to determine how a reasonably careful lawyer would act from any personal

knowledge you may have.”

BEST PRACTICES

• Preventative Protocols
• Staff
• Attorneys
• Self
• Two-factor authentication
• Instructions to clients
• Disclaimers and Warnings on Emails
• Immediate Response
• Kill Chain Process