{"id":3489,"date":"2015-06-01T12:00:46","date_gmt":"2015-06-01T12:00:46","guid":{"rendered":"http:\/\/ncjolt.org\/?p=3489"},"modified":"2020-06-04T20:53:36","modified_gmt":"2020-06-04T20:53:36","slug":"ransomware-and-its-implications-on-the-legal-field","status":"publish","type":"post","link":"https:\/\/journals.law.unc.edu\/ncjolt\/blogs\/ransomware-and-its-implications-on-the-legal-field\/","title":{"rendered":"Ransomware and its Implications on the Legal Field"},"content":{"rendered":"

A recent trend in law firm server hacking is something called Ransomware. Ransomware<\/a> \u201cis a type of malware that prevents or limits users from accessing their system. Once infected the malware will lock the user out of their data, or hide the data until the user pays a ransom to get access back. Some of the more recent Ransomware has the capability to \u201cencrypt<\/a> files over network shares even if they are not mapped to a drive letter.\u201d This happened in February to a California law firm. After notifying the FBI the firm then notified clients that the firm had been hacked, but that the firm was refusing to pay the hackers in order to get access to their data back.
\nThis week a sleeper Ransomware called \u201cLocker\u201d came alive in computers across the nation. This Ransomware is just the most recent to wreak havoc on computers. One screenshot from a user whose computer was hacked showed a ransom letter stating: \u201cWarning<\/a> any attempt to remove damage or even investigate the Locker software will lead to immediate destruction of your private key on our server!\u201d The letter then stated that in order to uninstall the Ransomware from the computer the user must transfer 0.1 Bitcoin (around $23 dollars) into an account, by a certain date. The ransom in this case is fairly small compared to the usual amount asked for, which is around $500 dollars<\/a>.
\nMy aunt, a partner at a large law firm in the southeast, recently told me that people try to hack her firm\u2019s servers every single day. If you think about the number of firms out there, the amount of data that each of those firms\u2019 servers holds, the payday for those who create Ransomware will probably only grow. In the midst of all the potential growth law firms will need to consider whether or not they would pay the kidnappers of their data. If they choose not to do so what will be the implications for their firm? These implications include the ethical obligation to keep client information confidential. It also includes the impact on the business side of the firm, and having to reconstruct countless man-hours of work just to get the firm back to where they were before the hack.<\/p>\n

Law firms will also need to think about ways to improve their data security, and about how they will notify clients, other firms, and the government in the event of a breach.<\/p><\/blockquote>\n

In a recent report released by Citigroup<\/a>, law firms as a whole were called out for not doing enough to protect data and for being unwilling to acknowledge breaches. This report said that law firms were \u201c\u2019high risk<\/a> for cyberintrusions\u2019 and would \u2018continue to be targeted by malicious actors looking to steal information on highly sensitive matters such as mergers and acquisitions and patent applications.\u2019\u201d
\nIn addition to dealing with what to do when hackers attack, law firms are also dealing with what to do about liability issues that stem from these attacks. A recent article in Corporate Counsel<\/a> tries to answer this question. This article<\/a> discusses Data Breach Liability by exploring the trend of IT service providers to try to resist unlimited liability for data and privacy breaches. Instead of allowing unlimited liability, IT companies are arguing that: \u201cthey offer unlimited liability for breaches of confidentiality, asserting the customer\u2019s risk of a data breach<\/a> would be covered as a breach of confidentiality, and arguing that unlimited liability for breaches of data protection obligations is simply double dipping.\u201d As a result of this stance law firms, as well as consumers, will need to start protecting themselves not only against would-be data kidnappers but also against their IT service providers. This article suggests that customers should be \u201cDefining \u2018confidential information<\/a>\u2019 to ensure it encompasses all personal data the customer may disclose to the IT service provider,\u201d including obligations on the IT service provider that will satisfy the federal and state rules that the customer must follow, and seeking to increase the liability cap for data breaches.
\nFor more discussion regarding this topic\u00a0consider attending the NC JOLT 2016 Symposium\u00a0on Data Privacy.\u00a0Look for more\u00a0Symposium details coming this Fall.<\/p>\n","protected":false},"excerpt":{"rendered":"

A recent trend in law firm server hacking is something called Ransomware. Ransomware \u201cis a type of malware that prevents or limits users from accessing their system. Once infected the malware will lock the user out of their data, or hide the data until the user pays a ransom to get access back. Some of …<\/a><\/p>\n","protected":false},"author":1,"featured_media":3490,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[51],"tags":[],"_links":{"self":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts\/3489"}],"collection":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/comments?post=3489"}],"version-history":[{"count":1,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts\/3489\/revisions"}],"predecessor-version":[{"id":7331,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts\/3489\/revisions\/7331"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/media\/3490"}],"wp:attachment":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/media?parent=3489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/categories?post=3489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/tags?post=3489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}