Law Times

Page 10 July 11, 2016 • law Times www.lawtimesnews.com Cybersecurity lawyers defend against attacks BY MICHAEL MCKIERNAN For Law Times A s Canadian businesses beef up their defences against cyberattack, some of the country's biggest law firms are growing their own cybersecurity teams in an attempt to match client demand. "Ten years ago, when you heard about a data breach, it was quite an isolated event," says Ber- nice Karn, a Toronto-based part- ner at Cassels Brock & Blackwell LLP, and a member of its cyber- security practice. "Now, it seems like they happen all the time. It's becoming more and more preva- lent in business, so clients are looking for advice on it." Just last month, the Univer- sity of Calgary admitted making a $20,000 payment to cyber- criminals, becoming one of the highest-profile victims of a ran- somware attack. The university paid the cash in order to unfreeze almost 10,000 faculty and staff e-mail accounts compromised by the virus. A number of U.S.-based hos- pitals have made similar pay- ments after falling victim to vir- tually identical scams, which are growing in popularity among cybercriminals, according to Imran Ahmad, a Miller Thom- son LLP partner with a practice focused on cybersecurity issues. He says an unknown number of less spectacular ransoms have also been paid by smaller orga- nizations anxious to avoid the hassle and embarrassment that can result from a successful hack of their systems. Precise statistics are hard to come by in the Canadian cy- bersecurity world because of the very limited circumstances under which companies are re- quired to report data breaches, according to Ahmad, but there is no shortage of reports attempt- ing to put numbers to the prob- lem. In June, the Ponemon Insti- tute and IBM Security's annual survey of global businesses found cybersecurity incidents jumped 64 per cent last year around the world compared with 2014. The survey also put the aver- age cost of a data breach at US$4 million, a 29-per-cent jump over the number in 2013. For Canadian-based compa- nies who took part, the cost was even higher, at about $6 million per breach. With figures like that, Ah- mad says the focus of clients should be on the proactive side: preventing attacks from hap- pening in the first place and pre- paring a plan should the worst happen. "There are studies out there that suggest organizations that fail to invest in pre-breach mea- sures will end up paying two to three times more to deal with an attack," he says. "There is a lot of work you can do beforehand. From a gov- ernance perspective, you want policies and protocols in place. Cyber-insurance is also a good thing to have, as well as backups and encryption for confidential information." Ahmad says his concentra- tion on cybersecurity grew out of his privacy practice, driven by demands from clients in that field. However, things really took off towards the end of 2013 when Target revealed a hack of its systems had resulted in the theft of credit and debit card data related to about 40 mil- lion of its customers in the U.S., bringing home the reality of the cybercrime threat to companies who may never have considered it a priority before then. Within a year, another high-profile hack at Sony Pictures Entertainment reinforced the danger as thou- sands of leaked e-mails and per- sonal information of the compa- ny's employees dominated news headlines worldwide for weeks. "It's hard to pinpoint a turn- ing point, but those two events seemed to shift a lot of mind- sets," Ahmad says. Kristin Ali, a cybersecurity lawyer at Blake Cassels & Gray- don LLP in Toronto, says Ameri- can cases often provide valuable lessons for Canadian lawyers and businesses due to the scar- city of cybersecurity case law north of the border. Before joining Blakes in 2013, she practised at Boston firm Ropes & Gray LLP, litigating cases in the emerging field. "They have more breaches in the U.S., so it's important to keep up to date with developments there," Ali says. "A lot of the clients I've been dealing with here and in the U.S. are large, sophisticated business- es that understand their boards of directors, corporate counsel, and IT professionals all have to work together to maintain their cybersecurity programs." At Cassels Brock, the firm has developed a cybersecurity team over the last year to cover all le- gal aspects of a breach. Accord- ing to Karn, most of her work comes after the event, helping clients deal with the fallout from an attack. "At the earliest stages, you want to preserve privilege to the extent possible. If they don't already have an action plan in place to deal with a breach, then you develop one, and begin taking steps to con- tain and investigate the prob- lem," she says. Ahmad says the immediate aftermath of a breach can be a chaotic time. "It's a very intense situation. It can be very stressful for man- agement, and for employees, depending on the scope of the breach," he says. "It can get pretty complicated very quickly, and how you deal with it in the first 24 hours is key. The trick is to bounce back as quickly as possible." LT FOCUS Bernice Karn says data breaches are becoming more prevalent, and clients are looking for advice. This is more than a phone book. It is your instant connection to Canada's legal network. With Canadian Law List 2016 you have access to: • an up-to-date alphabetical listing of more than 80,000 barristers, solicitors and Quebec notaries, corporate counsel, law fi rms and judges across Canada • all contact information supplied for the Supreme Court of Canada, the Federal Court of Canada, Federal Cabinet Ministers, departments, boards, commissions and Crown Corporations • legal and government contact information related to each province for the Courts of Appeal, Supreme Courts, County and District Courts, Provincial Courts, law societies, law schools, Legal Aid and other important law-related offi ces THE LATEST CONTACT INFORMATION IN A USER-FRIENDLY FORMAT THAT IS BEYOND TRADITIONAL LISTINGS Continually updated by a dedicated team of professionals, Canadian Law List includes value added features such as: • last name fi rst identifi cation in the federal and provincial listings • separate section of corporate law departments for more than 1,250 companies • professional cards of prominent Canadian law fi rms • International Agency Referral Cards AREAS OF PRACTICE AND ENHANCED LISTING INDEX The enhanced listing index is displayed in bold type with detailed practice information. It also: • lists fi rms and lawyers that have expanded their practice information in their provincial listing • is organized by areas of practice by province, city and page reference in their provincial listings Hardbound • Published February each year • L88804-765 • On subscription $169* • One time purchase $188* Multiple copy discounts available * Plus shipping/handling and applicable taxes ORDER YOUR COPY TODAY! Call 1.800.387.5164 or visit www.carswell.com KEEPING PACE WITH THE CHANGING LEGAL COMMUNITY FOR OVER 130 YEARS Untitled-3 1 2016-07-06 9:48 AM Platinum Sponsor Silver Sponsor Bronze Sponsor Hosted in Partnership With Date: Sept. 8, 2016 Location: Arcadian Court, Toronto 6 p.m. Cocktail Reception 7 p.m. Gala Dinner and Awards Presentation Keynote Speaker: Brian Zubert, Director, Thomson Reuters Labs - Waterloo Region Dress: Business Attire Innovation. It's in our DN The Canadian Lawyer InHouse Innovatio Awards celebrate in-house counsel, both individuals and teams, who have found ways to show leadership by becoming more efficient, innovative and creative in meeting the needs of their organizations within the Canadian legal market. innovatio-awards.com Bronze Sponsor Presented by Bronze Sponsor Untitled-3 1 2016-07-06 9:51 AM

• Cover