News
Lawyers more worried about cybersecurity after Panama Papers leak
Partners in Spain and Portugal more concerned about cyberattacks following high-profile law firm leak , but firms have failed to step up security following infamous hack
Despite the fact most law firm partners in Spain and Portugal have become more concerned about their firm suffering a cyberattack following the ‘ Panama Papers ’ leak earlier this year , the majority say their firm has failed to take steps to address the issue following the incident .
The Panama Papers was the name given to the leak of 11.5 million files from the database of Panama-based law firm , Mossack Fonseca . A new survey of partners at law firms in Spain and Portugal – conducted by Iberian Lawyer – found that the majority of respondents said they were more concerned about their law firm ’ s cybersecurity following the Panama Papers leak . However , despite the growing worries , 58 per cent of those surveyed said their law firm had not taken steps to improve its cybersecurity following the leak . And this was despite the fact that every respondent said the outcome for their firm if someone other than their client or a privileged third party was able to gain access to shared documents would be “ extremely damaging ”.
The general perception among lawyers in Iberia is that law firms are facing growing cybersecurity risks . A total of 85 per cent of partners surveyed said they thought cyberattacks against law firms are increasing . While most partners think that their firm would be able to withstand a cyberattack , what will be of concern to clients is that 44 per cent of those who responded did not say they were confident that their firm could cope . Of those , 11 per cent said they were not confident , while 33 per cent said they did not know whether their firm would be able to cope with a cyberattack .
Taking precautions The extent of the precautions taken when sending client-privileged communications via email appears to differ greatly from firm to firm . Only 38 per cent of respondents said they used email encryption ( that is , disguising the content of email messages in order to protect potentially sensitive information from being read by anyone other than intended recipients ). Almost half of respondents ( 48 per cent ) said they only shared links to documents stored on a secure site . However , only 29 per cent said they password-protect documents , and only 13 per cent said they required clients to provide written consent for transmission of client-privileged information via email . Even fewer respondents ( 6 per cent ) said they required clients to provide oral consent for transmission of such information . Firms not requiring oral consent run the risk of divulging confidential information to a hacker posing as a client via email .
Two-step verification The majority of partners surveyed said their firms did not use twostep verification ( a system whereby two forms of identification are required ) to protect confidential documents . IT experts are warning law firms to use two-step verification to prevent information being accessed by third-party contractors . A total of 55 per cent of respondents said their firm did not use two-step verification , while 16 per cent said they did not know what two-step verification is . However , 29 per cent of respondents said their firm did use two-step verification to protect confidential documents .
One in five respondents ( 22 per cent ) said they had used a free consumer file sharing service such as Dropbox , to share client privileged information . However , a bigger proportion of respondents ( 37 per cent ) said that they believed lawyers at their firm , and lawyers at other firms , were using free filesharing services , such as Dropbox , without the firm ’ s knowledge or approval for work purposes . Earlier this year , Dropbox was hacked resulting in 68 million users ´ details being leaked on the internet .
A total of 56 partners at law firms in Spain and Portugal took part in the research , which was conducted via an online survey in September and October 2016 .
www . iberianlawyer . com September / October 2016 • IBERIAN LAWYER • 5