Attorneys for Targets of Activist Ire Warned to Weigh Cyber Retaliation Risks
SAN FRANCISCO -- Hactivist group Anonymous has its thumb on the scales of justice, lawyers said at the RSA Conference on network security: Attorneys now must pause before taking action on behalf of clients that activists have grievances against, to take the risk of cyberattack into account in giving their advice and in their own decisions on IT security. “The risk of electronic retaliation for litigation is kind of new,” said Steven Teppler of Edelson McGuire.
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
Lawyers face charges under longstanding ethical rules, penalties under more recent data-protection statutes, and civil liability if they allow confidential information or money they're watching for others to be compromised, said Teppler, who’s on the Florida Bar Professional Ethics Committee. No attorney has gotten into hot water this way, but it’s just a matter of time, Teppler said. Lawyers are “going to have commercially reasonable security measures imposed upon them” as regulatory requirements, he said. At the same time, though, “your duty to zealously represent your client” remains in full effect, said Tanya Forsheit of the Information Law Group.
"Lawyers are a target-rich environment,” Teppler said. Puckett & Faraj of Alexandria, Va., was attacked without even having initiated legal action, he said. It defended the Marine accused of running a 2005 massacre in Haditha, Iraq. “Law firms can easily be targets in addition to their clients,” Teppler said. The value of information held by attorneys is shown by the $25,000 to $30,000 that a lawyer’s notebook computer can fetch on the black market, he said.
Firms must pay more attention to their own network security and that of touchy clients than they have, speakers said. “We don’t see a lot of lawyers at RSA,” because “most of them have their head in the sand” when it comes to security, Teppler said. Anonymous has more often attacked plaintiff business interests such as the MPAA, the RIAA and Sony for filing intellectual property complaints, Teppler said. The new risks require attorneys to start holding conversations early with clients about possible PR problems and cyberattacks and conversations with their own IT professionals, Forsheit said.
"It’s really hard to predict what might bring on an attack,” because hackers’ motivations vary widely, said Marcia Hofmann, an Electronic Frontier Foundation lawyer. But high among the causes are actions regarded as “bad for the Internet or bad for the hacker ethic,” she said. Even the civil-liberties foundation’s site went down once after a tweet about Anonymous, Hofmann said.
* * * * *
Anonymous attracts new members from takedowns like the arrests this week of 25 Europeans and South Americans accused of taking part in the activist hacking network, an FBI investigator said. Law-enforcement activity like “that scares off some, but it also attracts many, because of the notoriety they gain,” said Chief Eric Strom of the bureau’s Cyber Initiative and Resource Fusion Unit. But the group also is “much more open” than other cyberattackers, he said in an RSA keynote late Wednesday. “Very media savvy. So it makes it, really, easier to identify who and where they are.” Companies’ biggest mistake with Anonymous is “taking it too lightly,” Strom said. To many “people this is just a bunch of kids fooling around,” he said. But “they could destroy a business.” Strom said the group breaks down into “a very small group that have the technical know-how,” including IT professionals, and the ability to influence others and, on the other hand, “a broader group” of impressionable people. “The challenge of going after the larger group is, most of them are minors,” he said. “How do you prosecute them?” They “just get slapped on the wrist,” Strom said. The FBI is often reduced to telling on suspects to their parents, he said.