It all seemed so routine, so straightforward. The case was settled, with a $500,000 payment to be made to the approved settlement administrator. The law firm received an email from the administrator with wire transfer directions, and the settlement funds were sent per the instructions. Just one problem – the email didn’t come from the administrator, the receiving bank was not the right bank, and the half million dollars evaporated. Poof – gone in an instant.
Sure, it would’ve been prudent for the law firm to have picked up the phone and independently verified the email sender and instructions. But how did the bad guys know precisely when and to whom to send the phony email, and exactly what to say? Was it from publicly available information in the court file? Was there a rogue insider at the firm, or at one of the other litigant’s firms, or at the court, or with the settlement administrator? Or was someone’s email account illicitly monitored after being compromised by malware or through phished access credentials?
Continue Reading Bad news on law firm data security
How time flies. Seventeen years ago, I went to work for a small, visionary company based in Seattle—Computer Forensics, Inc. Indeed, the founder was so early in the e-discovery and forensics industry that our URL was forensics.com. Laptop drives typically had 8 GB of storage, and servers were more often than not simply a bigger box that sat in a closet.
The grousing began within 24 hours of Equifax’s 
In the early 1990s, NSA Director Mike McConnell created a brand-new position at the National Security Agency: Director of Information Warfare. McConnell appointed Rich Wilhelm, with whom McConnell had worked closely on U.S. counter-command & -control intelligence operations during the first Iraq war. After just a few weeks settling into his new job, Wilhelm walked into Director McConnell’s office and said “Mike, we’re kind of f***ed here.”
A swarm of zombies, led by Byte Walkers, surges inexorably onward to penetrate a massive perimeter wall by force and stealth. Sounds like Game of Thrones, right? Instead, this is our cyberthreat reality. And in an ironic twist that would make George R. R. Martin blush under his beard, it’s now painfully real for 
Many years ago, before common sense kicked in, I thought it would be a good idea to rent a storage space for all the extra furniture and other stuff I could not fit in my new house. Knowing it would only be temporary, I stashed everything from upholstered and leather furniture, to boxes of books. Fast forward twelve months. The rental agreement was expiring, and I realized that I would never need nor have room for all that I’d stored, so I decided to have a sale to dispose of it. When I went to the storage space I was horrified to see that everything was covered in a thin film of mold. (This was years before climate-controlled storage was widely available.) I had no choice but to trash it all, which both cost me money and prevented me from converting my goods to profit.
While preparing for an upcoming presentation for in-house lawyers on data security, I dusted off the events of three months ago, when Yahoo! Inc. unceremoniously fired its general counsel on March 1st, the very same day it filed its