The "Dark Overlord" Strikes The Practice Of Law: What Law Firms Can Do To Protect Themselves
April 17, 2019 —
Ivo G. Danielle – Newmeyer & DillionCybersecurity breaches involving law firms are on the rise with each passing year. Law firms are prime targets for cyber criminals seeking confidential and sensitive information because of the various types of legal work that law firms normally handle for their clients. Whether it be mergers and acquisitions, the use of intellectual property, purchase agreements, bankruptcy or even litigation involving divorce, law firms are a rich depository for highly confidential and sensitive information. As a result, law firms must employ comprehensive security measures to protect themselves from security breaches or risk being on the losing end of a costly malpractice claim, and suffer severe reputational harm.
Law Firms Continue To Be Targeted By Cybercriminals
According to the American Bar Association ("ABA") 2018 Legal Technology Survey Report, 23% of the law firms who participated in the survey reported that their law firm experienced a data breach. Although this may be just a 1% increase from the 22% who reported a breach in 2017, it is important to understand that this is an increase of 8% from the stable percentages reported from 2013 through 2016.1 The 2018 survey report also revealed that security breaches fluctuated with firm size – 14% for solo law firms, 24% for firms employing 2-9 attorneys, approximately 24% for firms with 10-49 attorneys, 42% for firms with 50-99 attorneys, and approximately 31% for those firms employing 100 or more attorneys.
Latest Law Firm Security Breaches
The notorious criminal group called "The Dark Overlord" has a history of committing data breaches of high profile companies such as Gorilla Glue, Netflix, Larson Studios, multiple healthcare companies, and Little Red Door Cancer Agency. Their goal is simple – steal sensitive information and then extort payment from the victims by threatening to release the sensitive information to the public.
On December 31, 2018, this cybercriminal group announced to the world that they had acquired 18,000 documents containing highly sensitive legal information related to insurance based litigation connected to the 9/11 tragedy. The stolen information was the attorney/client property of Lloyd's of London, Silverstein Properties, and Hiscox Syndicates, Ltd. In its announcement, The Dark Overlord boasted that they were in possession of client sensitive information, such as: "emails; retainer agreements; non-disclosure agreements; settlements, litigation strategies; liability analysis; defense formation; collection of expert witness testimonies; communication with government officials in countries all over the world; voice mails; dealings with the FBI, USDOJ, DOD, confidential communications, and so much more."
Subsequent to the data breach, The Dark Overlord announced to the public that they designed a compensation plan that would allow for public crowd-funding for its organization to permit the public to view the stolen information in exchange for bitcoin payment. The more public funding it receives, the more stolen sensitive information will be unlocked and released to the public. It is estimated that this cybercriminal group already distributed information to the public on two separate occasions during the month of January 2019.
High profile cybersecurity breaches of law firms is nothing new – for example, the infamous Panama Papers breach, where cybercriminals leaked 11.5 million documents exposing the shadowy business of setting up offshore corporations as tax shelters for businesses, celebrities, and politicians - and the infamous Petya Malware attack which resulted in a digital lockdown of one of the world's largest law firms, DLA Piper. However, despite the infrequency of publicized cyber-attacks of law firms by the media, the FBI has recently announced that law firms should expect an increase in security attacks by cybercriminals because law firms are now viewed as "one-stop shops" for cybercriminals. Therefore, in order to combat the inevitable increase in cyber-attacks, law firms must get prepared.
How Law Firms Can Protect Themselves
All law firms will agree that the most serious consequence of a security breach for their firm would be the unauthorized access to sensitive client data. The American Bar Association's Model Rules of Professional Conduct, specifically Rules 1.1 and 1.62 and related Comments, require an attorney to take competent and reasonable measures to safeguard information relating to their clients. This duty to "safeguard' information imposes a significant challenge to firms when using technology in connection with protecting client information because most law firms are not savvy with technology and lack proper cyber security training.
In order for a law firm to protect itself from security breaches and inadvertently violate its duty of safeguarding a client's sensitive information, it is important to take the following actions:
- Start by taking an inventory and risk assessment of the firm to determine what needs to be protected – the inventory should include both technology and data;
- Develop, implement and maintain an appropriate cybersecurity program that complies with applicable ethical and legal obligations;
- Ensure the cybersecurity program addresses people, policies and procedures, and technology. The cybersecurity program must designate an individual or a group to be in charge and coordinate security;
- Develop an incident response plan scaled to the size of the firm;
- Continually train staff and attorneys to identify and understand potential cybersecurity threats;
- Consider implementing a third-party assessment of firm's cybersecurity program and policies;
- Purchase cyber liability for insurance which not only covers first party losses to law firms (like lost productivity, data restoration, and legal expenses) but also liability protection to third parties;
- Implement authentication and access controls for network, computers and mobile devices used by the firm's staff and attorneys;
- Consider the use of full-drive encryption for computers and mobile devices;
- Have staff and attorneys avoid and/or limit the use of public WiFi when working remotely; and
- Create a disaster recovery plan to backup all data in the event of a cyber-attack or natural catastrophe.
Continually reviewing, implementing, training and updating a firm's cybersecurity program and protocols will help safeguard sensitive and confidential client information and/or data. No law firm wants to be the next data breach headline – so take the necessary steps to avoid a potential disaster.
1 Past ABA Legal Technology Surveys reported 14% in 2016, 15% in 2015, 14% in 2014 and 15% in 2013.
2 On November 1, 2018, California adopted ethics rules patterned after the ABA Model Rules of Professional Conduct.
Ivo Daniele is a seasoned associate in Newmeyer & Dillion's Walnut Creek office. His practice includes representing private and public companies with both their transactional and litigation needs. You can reach Ivo at ivo.daniele@ndlf.com.
About Newmeyer & Dillion
For almost 35 years, Newmeyer & Dillion has delivered creative and outstanding legal solutions and trial results for a wide array of clients. With over 70 attorneys practicing in all aspects of business law, privacy & data security, employment, real estate, construction, insurance law and trial work, Newmeyer & Dillion delivers legal services tailored to meet each client's needs. Headquartered in Newport Beach, California, with offices in Walnut Creek, California and Las Vegas, Nevada, Newmeyer & Dillion attorneys are recognized by The Best Lawyers in America©, and Super Lawyers as top tier and some of the best lawyers in California, and have been given Martindale-Hubbell Peer Review's AV Preeminent® highest rating. For additional information, call 949.854.7000 or visit www.ndlf.com.
Read the court decisionRead the full story...Reprinted courtesy of
Defenses Raised Three-Years Too Late Estop Insurer’s Coverage Denial
February 21, 2022 —
Michael S. Levine & Yaniel Abreu - Hunton Insurance Recovery BlogLiability insurance typically affords broad defense coverage. But insurers sometimes reserve their right to challenge the insured’s right to a defense, or even outright terminate the defense. When this occurs after the insurer has been in exclusive control of the defense, some courts recognize that the consequences can be catastrophic for the insured defendant. Insurers, therefore, may be estopped from denying coverage where doing so will prejudice the insured. This is exactly what transpired in RLI Ins. Co. v. AST Engineering Corp., No. 20-214 (2d Cir. Jan. 12, 2022), where the Second Circuit affirmed the district court’s decision that an insurer’s attempt to withdraw the defense it had provided to its insured for three years would prejudice the insured.
In AST Engineering, RLI sought a declaration that it did not have to defend the insured, AST, in two underlying cases in which AST was sued as a third-party defendant. The underlying cases concerned a construction project in New York City for which AST provided engineering drawings on October 28, 2012.
Reprinted courtesy of
Michael S. Levine, Hunton Andrews Kurth and
Yaniel Abreu, Hunton Andrews Kurth
Mr. Levine may be contacted at mlevine@HuntonAK.com
Mr. Abreu may be contacted at yabreu@HuntonAK.com
Read the court decisionRead the full story...Reprinted courtesy of
Seattle Independent Contractor Ordinance – Pitfalls for Unwary Construction Professionals
October 09, 2023 —
Travis Colburn - Ahlers Cressman & SleightChapter 14.34 of the Seattle Municipal Code is a relatively new ordinance that can affect the parties to a construction contract for work performed within the City of Seattle’s city limits. The Independent Contractor Protection Ordinance (“ICPO”) was enacted to provide self-employed persons, or entities composed of not more than one person, regardless of corporate form, recourse for timely payment for work performed. The ICPO applies to contracts of $600[i] or more between an independent contractor and a hiring entity where the work, in whole or in part, is known to be performed within the City of Seattle’s city limits.[ii] The ICPO cannot be waived by parties to a contract.[iii]
Historically, the primary legal recourse for non-payment or late payment for work performed under a contract involves an expensive breach of contract action, and one reason the ICPO was enacted was to give greater protection to a growing number of Washington independent contractors who report problems with timely and accurate payment.
The ICPO affects “hiring entities” or any individual, partnership, association, corporation, business trust, or any entity, person or group of persons, or a successor thereof, that hires independent contractors to provide services within the scope of a hiring entity’s business or commercial activities. In the construction context, most general contractors, subcontractors, design professionals, and design consultants should be aware of this ordinance, as well as certain owners[iv] and development-side entities.
Read the court decisionRead the full story...Reprinted courtesy of
Travis Colburn, Ahlers Cressman & SleightMr. Colburn may be contacted at
travis.colburn@acslawyers.com
Clearly Determining in Contract Who Determines Arbitrability of Dispute
April 26, 2021 —
David Adelstein - Florida Construction Legal UpdatesAs you know from prior postings: “Arbitration provisions are creatures of contract and must be construed ‘as a matter of contract interpretation.’ ” Fallang Family Limited Partnership v. Privcap Companies, LLC, 46 Fla.L.Weekly D639e (Fla. 4th DCA 2021) (citation omitted). Thus, if you prefer to arbitrate potential disputes, instead of litigating potential disputes, you want to include an arbitration provision in your contract. While there are positives and negatives to arbitration, no different than litigation, these positives and negatives should be considered during the contract negotiation process when dealing with the dispute resolution process in the contract.
Generally, under the law, the arbitrability of a dispute is determined by the court. However, this can be deferred to the arbitrator with clear and unmistakable language in the contract.
By way of example, the American Arbitration Association includes a rule that allows an arbitrator to rule on the arbitrability of the dispute, i.e., the claims asserted are subject to the governing arbitration provision in the contract. Recent law has suggested that if the objective is to authorize an American Arbitration Association arbitrator to make this determination, the contract clearly and unmistakably needs to state this intent and generally referring to the American Arbitration Association rules is not good enough. For this reason, I have included in arbitration provisions language that specifically states, “In the event of any dispute as to the arbitrability of any claim or dispute, the parties agree that an appointed arbitrator within the American Arbitration Association shall make this determination.” I have also included in arbitration provisions the converse so that if there is a dispute as to the arbitrability of a claim or dispute, the court, and not the arbitrator, will make this determination.
Read the court decisionRead the full story...Reprinted courtesy of
David Adelstein, Kirwin Norris, P.A.Mr. Adelstein may be contacted at
dma@kirwinnorris.com
It’s Time to Change the Way You Think About Case Complexity
August 07, 2018 —
Ben Patrick - Gordon & Rees Construction Law BlogThere are few things that lawyers love more than telling war stories. Partially, that’s because many lawyers either only or primarily have friends who are lawyers, and war stories are a way for lawyers to relate to each other—your barber doesn’t understand the pain of reading through 5 paragraphs of irrelevant objections posed to each of 75 interrogatories, but your fellow lawyers will. One common feature of war stories is a note regarding how much was at issue in the case. “I was handling this $25 million claim once….” Lawyers include the dollar figure in dispute as a shorthand for the complexity of the case they’re talking about. “Oh, we’ll be in depositions for a month solid, this is a $10 million case!”
I don’t know where I picked up this habit, but I know exactly how I learned to rethink it. A friend of mine, as in-house counsel, was handling a case worth over a billion dollars. When he told me about it, my jaw dropped. One of the first things I asked him was, how do you manage a case that big? And he told me about the several law firms he had engaged, all the people working on it. But then he said: it’s not really a complicated case. There were only 4-5 real factual questions, and a similar number of legal ones. It’s just that every factual question had a very high price tag associated with it. The high price tag doesn’t make the factual question any more complex, or any harder to litigate. For example, your builders’ risk policy either has coverage for flood damage or it doesn’t. If it does, then it doesn’t matter whether the flood washed the whole building away or just some materials from the laydown area—coverage is coverage, irrespective of quantum.
Read the court decisionRead the full story...Reprinted courtesy of
Ben Patrick, Gordon & Rees Scully MansukhaniMr. Patrick may be contacted at
jpatrick@grsm.com
Housing Starts in U.S. Drop to Lowest Level in Three Months
February 23, 2016 —
Michelle Jamrisko – BloombergNew-home construction in the U.S. unexpectedly cooled in January, indicating there is a limit to how much gains in residential real estate will boost growth at the start of 2016.
Housing starts dropped 3.8 percent to a 1.1 million annualized rate, the weakest in three months, from a 1.14 million pace the prior month, a Commerce Department report showed Wednesday in Washington. The median forecast of 76 economists surveyed by Bloomberg was 1.17 million. Permits, a proxy for future construction, were little changed.
Read the court decisionRead the full story...Reprinted courtesy of
Michelle Jamrisko, Bloomberg
Is Arbitration Always the Answer?
April 20, 2016 —
Christopher G. Hill – Construction Law MusingsAfter a long (for me) hiatus due to Spring Break with my wonderful family followed by a crazy last two weeks for both personal and business reasons, I’m back and ready to muse again.
This week’s “musings” concern a topic that arises often in construction contracts and construction dispute resolution. The topic? Arbitration. Why does this come up often? Because in many form contracts such as the AIA documents, as well as in many construction contracts that are more specifically tailored, mandatory arbitration is at least a choice if not the only method of dispute resolution.
Read the court decisionRead the full story...Reprinted courtesy of
Christopher G. Hill, Law Office of Christopher G. Hill, PCMr. Hill may be contacted at
chrisghill@constructionlawva.com
California Court of Appeal Adopts Horizontal Exhaustion Rule
June 28, 2013 —
Tred Eyerly, Insurance Law HawaiiIn a long running suit regarding thousands of asbestos bodily injury claims brought against Kaiser Cement and Gypsum Corporation, the California appellate court held that the excess carrier's indemnity obligation did not attach until all collectible primary policies were exhausted. Kaiser Cement and Gypsum Corp. v. Ins. Co. of the State of Pennsylvania, 215 Cal. App.4th 210 (Cal. Ct. App. April 8, 2013).
Kaiser manufactured a variety of asbestos-containing products from 1944 through the 1970's. Truck Insurance Company provided primary insurance to Kaiser from 1964 to 1983, through four CGL policies covering 19 annual policy periods. The policy in effect from 1974 to 1981 contained a $500,000 "per occurrence" liability limit. Kaiser was insured by three other primary carriers between 1947 and 1987. ICSOP issued a first layer excess policy to Kaiser from 1974 through 1976.
Kaiser tendered numerous claims for bodily injury to Truck. By October 2004, Truck's indemnity payments exceeded $50 million and included at least 39 claims that resulted in payments in excess of $500,000. For claims alleging bodily injury in 1974, Kaiser selected Truck's 1974 policy to respond to each of the claims.
Read the court decisionRead the full story...Reprinted courtesy of
Tred EyerlyTred Eyerly can be contacted at
te@hawaiilawyer.com
