Cover me

While ‘cyber-’ is now a commonplace prefix, with references to ‘cybercrime’, ‘cyber-attacks’ and ‘cyber terrorism’ in the news every day, there remains a great deal of confusion as to whether ‘cyber’ is a risk in its own right. In this article, we suggest that cyber-risks might be said to have three facets – informational, operational and physical – all of which pose varying degrees of risk to law firms.

It is not safe to assume that the PII minimum terms and conditions will cover the costs of a cyber-incident; they simply were not drafted with a view to protecting a business in such circumstances

Informational cyber-risks arise due to the digitisation of the data and information that an organisation holds, and the interconnectivity of that data through global networks. Furthermore, the legal liability that attaches to the various types of electronic data held by organisations is increasing.

Operational cyber-risk arises as a result of organisations’ unprecedented reliance on electronic systems to operate as a business: computers, telephones and mobile devices underpin the typical working day. If those electronic systems are disrupted or denied, significant interruption to business can occur.

Finally, physical risk arises as a result of the connectivity between physical and virtual worlds, to the extent that changes in the virtual can have effects in the physical. Driverless cars, medical devices and household appliances now have functionality to connect autonomously to the internet, and all have been shown to be ‘hackable’. Law firms are not as exposed to physical cyber-risk as other industries – such as manufacturing – but the risk of firms suffering physical losses as a result of cyber-events is not implausible.

Informational cyber-risk

The risks posed to client data and the associated duties of confidentiality are not new concepts. What is new is the exponential increase in the threat posed by placing the information in an electronic environment.

Client data

In 2012, Berezovsky v Abramovich [2012] EWHC 2463 (Comm) became the highest-value litigation to be heard in the English courts. In this case, a hacker was reported to have stolen crucial documents from one party’s lawyers and leaked them to the opposing party. The potential liability to a law firm losing such confidential information, coupled with the uncertainty for other clients as to whether their advisers are secure, can be devastating. The recent breach of Panamanian law firm Mossack Fonseca has highlighted this only too well.

But it is not just client data that poses a risk to law firms. Solicitors hold vast quantities of other electronic data, including marketing lists and financial information. Such data can also be extremely valuable for criminals, and carries increasing legal liability.

In particular, the legal regime surrounding personal data and privacy is changing, and organisations which inadvertently lose or misuse data can incur significant financial costs, sanctions and liability. The use of personal data is currently governed by the Data Protection Act 1998 (DPA 1998) and regulated by the Information Commissioner’s Office (ICO), which is empowered to issue fines of up to £500,000.

On 25 May 2018, the DPA 1998 will be replaced by the General Data Protection Regulation (GDPR), which introduces enhanced regulatory sanctions, including fines of up to €20m or 4 per cent of global worldwide turnover. The GDPR also introduces a requirement to notify the ICO of data breaches within 72 hours and affected individuals without ‘undue delay’.

The really interesting aspect of data protection regulation is that it creates a legal obligation to the data subject, regardless of any client relationship. Law firms could therefore find themselves on the end of a regulatory fine or civil claim, by holding their clients’ client data or even a list of defendants on behalf of a claimant client (as happened to ACS Law in 2011).

It remains to be seen whether the UK will have left the EU before the introduction of GDPR on 25 May 2018, but our general view is that the UK will have to adopt the same or similar provisions if it wants to continue to trade with the EU. Indeed, under the current DPA 1998, companies cannot transfer data outside of the EU to jurisdictions that do not uphold similar protection for data subjects. It would therefore be a high-risk strategy for any firm to wait and see what happens instead of taking steps to address the GDPR now.

Hacking

A firm can also be directly targeted by criminals seeking to extort the firm by using information that has been obtained either through hacking, or sometimes through publicly available channels.

These attacks, often referred to as ‘CEO scams’ or ‘Friday afternoon scams’, are increasingly common and can result in the theft of millions of pounds. Attackers use a combination of technological hacking techniques and social engineering to send a seemingly normal email to someone in an organisation with the power to make transfers of funds. By posing as a legitimate client, service provider, or even the CEO or CFO of the company, using information that is either available online or has been obtained by hacking email servers and monitoring ongoing communications, they convince the individual to make significant payments to the hacker’s bank account.

Operational cyber-risk

Businesses now rely heavily on their electronic systems and access to the internet. For lawyers, case management systems, client files and business documents are now held virtually, with key business functions such as paying settlement or completion funds and filing court documents reliant on internet connectivity. A failure and interruption of the firm’s IT systems would cause a loss of fee-earning time, and could even result in a failure to meet court deadlines, respond to client instructions or complete transactions.

Ransomware attacks

Ransomware attacks are on the rise, and law firms are vulnerable. In June 2016, an IT security company was reported as having advised 14 law firms that had fallen victim to ransomware in the previous three months.

Typically, ransomware attackers send the firm’s employees an email inviting them to click on an innocuous-looking link. The link will then download software onto the firm’s IT system which encrypts and blocks access to the system until a ransom is paid. Attacks are becoming more sophisticated, using software that targets hard drives and is virtually impossible to remove unless a ransom is paid.

Dealing with such an attack is time-consuming, requires expensive expert advice, and can result in several weeks of downtime for the business. Although effective backups can mitigate risk, backup restoration can take time, result in lost data and disrupt a business.

Distributed denial of service attacks

Businesses that rely on their web presence to operate can be disrupted by distributed denial of service (DDoS) attacks. These attacks involve overloading a web server with requests so that it ceases to function. It is a common misconception that such attacks only threaten companies with an online retail presence; many businesses, including law firms, conduct support functions or deliver services via web portals and depend on their online presence, so firms should give serious consideration to the threat from DDoS attacks.

Insurance

Legal professionals benefit from wide insurance coverage under the Solicitors Regulation Authority’s minimum terms and conditions of professional indemnity insurance (the minimum terms). Firms could be forgiven for thinking that the minimum terms will protect them in the event that they suffer a data breach or cyber-incident. However, the protection afforded against cyber-risk by professional indemnity insurance is limited. This is understandable, when one considers that a dominant purpose of the minimum terms is to protect clients from negligent acts of the solicitor, not to reimburse the firm for its own exposures.

While cyber-insurance policies continue to develop, there are certain typical insurance coverages emerging which are not insured under the minimum terms.

In the case of operational cyber-risk, many cyber-insurance policies will insure lost revenue or profits as a result of a business interruption (BI) caused by a cyber-event. Of course, BI insurance has been around for many years, but only in relation to a physical peril. BI cover under cyber-insurance policies provides cover that is simply unavailable under physical peril BI and the minimum terms.

Such cyber-policies may also provide access to experts to deal with a disruptive cyber-event itself. For example, in the case of cyber-extortion and ransomware, insurers may provide access to or pay for extortion and technical specialists to bring the interruption to an end. Some insurance policies even indemnify ransom demands, in jurisdictions where it is lawful to do so.

In the case of informational cyber-risk, most cyber-insurance policies will indemnify the financial consequences of a data breach including legal, forensic IT specialist and notification costs. Such costs can be significant: a well-known UK telecoms company reported costs of up to £60m following its breach in 2015.

The minimum terms are not designed to insure against data breach events. The purpose of the minimum terms is to protect clients and indemnify a policyholder on a ‘claims made’ basis. In the event of a data breach, current regulatory guidance, which will become law under the GDPR, demands that firms investigate suspected breaches and notify regulators and data subjects well before a claim is made.

Indeed, in many circumstances, a claim might never be made, although the ICO may still conduct an intensive and long investigation and impose financial sanctions. In such circumstances, the minimum terms may not provide any comfort at all.

When it comes to a third-party claim arising out of a cyber-incident, it may be that both a cyber-insurance policy and the minimum terms provide insurance cover. This has led to some insurers adding some of the additional coverages set out above to professional indemnity policies, rather than providing a separate cyber-insurance policy which duplicates the third-party liability cover. This has in turn led to a seemingly difficult decision as to whether a firm ought to purchase a standalone cyber-insurance policy or increase coverage by way of a policy extension or endorsement.

The reality is that each method has its own place, depending on the needs of the firm: one firm might not want to affect its professional indemnity limit or excess and may purchase a separate policy, while another firm may simply want a single policy with a single premium.

Conclusion

Due to law firms’ unprecedented use of and reliance on electronic systems, increased storage of electronic data, and escalating regulation and legal liabilities, there are new exposures that simply did not exist 10 years ago. It is not safe to assume that the minimum terms will cover the costs of a cyber-incident; they simply were not drafted with a view to protecting a business in such circumstances. Law firms should seriously consider investing in a specialist cyber-insurance policy to ensure such losses would be covered if (or indeed, when) the worst occurs.