Awareness of cyber risk is increasingly catching the attention of boards of directors and senior executives. For Electronic Transaction Consultants (ETC), cybersecurity has been a top risk priority for a long time. As a leading provider of smart mobility solutions, including electronic tolling solutions, we manage back-office systems and roadside systems for many prominent state tollways. That means we are dealing with personally identifiable information, payment data and a range of other sensitive data that we need to keep secure.

Regardless of the sector a business operates in, I would argue that cybersecurity is now a primary risk. The frequency of attacks and the aggressiveness and skill of the threat actors perpetrating them has grown exponentially. Threat actors are hitting ever larger targets, and the widespread use of cryptocurrency has aided the ability of threat actors to obtain money. In the absence of national or global legislation that restricts the ability of companies to pay ransom, threat actors will always be able to find an opportunity. But it is worth remembering that most of this crime is opportunistic. From the threat actors’ perspective, cybercrime is a business – potentially a very lucrative one. For general counsel, reducing these opportunities is essential.

It behooves any GC to understand what protections they have in place and to test whether they are adequate in the current threat environment. Lawyers may not feel cutout for this, but their ability to spot gaps in a defence strategy – even if only at a conceptual level – is often hugely important. Fortunately, many of the most effective steps an organisation can take do not rely on a high degree of technical familiarity with IT systems.

There are steps that organisations can take to enhance their cybersecurity regime, including using Endpoint Protection, implementing remote monitoring, tracking and remediation. Updating remote access protection, installing virtual firewalls and multi-factor authorisation are all very important as well. Of course, you don’t want to stop your company doing business, so even with things like multi-factor authentication you need to think about how often it is required and whether it needs to cover every device or network.

In a hybrid or work-from-home environment this is especially important. Again, there are simple tools that can make a big difference. Office 365 Advanced Threat Protection helps to detect and block potentially malicious files from entering document libraries or team sites, or locking the file and preventing anyone from accessing it once it’s been identified as malicious. Also, these files are included in a list of quarantined items, so members of the security team can download, release, report or delete them from the system.

The other element that GCs must keep in mind is training, whether for their own team or the organisation more broadly. First, regular training is essential. If you only train once a year [the message] loses its impact and offers minimal protection. The form of the training is also important, and it pays to get creative. There are services available that do mock attacks with a fake phishing email sent around, and then if someone clicks on the link in error, they must take a remediation course and will ideally not make the same mistake again.

Of course, even the best protections and training cannot prevent a cyber incident from occurring, and having a robust response plan is essential to any cyber risk framework. A lot of companies will pull up a one-size-fits-all cyber response plan, but that’s really not good enough. A bespoke cyber response plan needs to be custom crafted for both you and your industry, and you should have a cyber response committee within the company. Everyone on this should know they’re on the team and know exactly what to do when an attack occurs. That response plan should be periodically tested in a mock attack, so it becomes part of the team’s muscle memory.

Cyber rigor, like any other part of a company’s overhead, can be seen as a non-essential cost. It is not. If you are a senior member of a public company, you’d do well to look at the SEC, the NYSE and NASDAQ who are all really pushing cybersecurity. A cyber incident is already an event requiring an 8k event form be filled out within three days, but it is increasingly becoming a potentially catastrophic reputational risk.

Ask yourself: Do you want this on the front page of the Wall Street Journal, New York Times or the Washington Post? Do you want to have to answer to your board of directors, or to the securities regulators or to the investors or to the general public? If not, then taking the risk seriously now is the best defence.

From all of us here at World Services Group, it is my pleasure to welcome you to the fourth edition in our series of GC Special Reports, examining the impact and influence that technology continues to have on legal practice.

The past two years have seen the legal profession impacted by technology more than any other period in history, a fact of course driven not by a single seismic innovation, but rather by necessity. And by all accounts – as the pages that follow in this report detail – both in-house and private practice teams alike have thrived, as our collective work environments, habits and processes have shifted, in almost every case, literally overnight.

But amongst the litany of success stories that have emerged, so too did several material challenges faced by businesses as a direct result of these shifts in our professional lives – challenges that are sure to shape the face of the profession for years to come. Data privacy, protection and integrity, cybersecurity, as well as of course, specialist legal technology, are near-universal issues faced by enterprises – and more specifically – their legal departments.

As corporate leaders, general counsel and their teams will be on the front lines during this transition, charged with both setting the rules of engagement for their business and guiding the wider organisation throughout a period that is likely to be characterised as much for its upheaval as it is for the evolution it represents.

At World Services Group, our membership have made it clear that they not only want to be a part of this change – they want to be in a position to lead it. Collectively, we strive to be part of the solution to the issues facing our industry and profession at large and together, we have an opportunity to affect positive change for the profession as a whole.

With an international mandate and broad sectoral representation at World Services Group – in addition to a forward-looking digital prospectus – our network is in an ideal position to capitalise on the bold digital transformation set to define what it means to be a successful legal department in this new digital age.

I would like to extend my sincere thanks to all of those in the legal community who continue to contribute to the ongoing success of this series. By sharing the benefit of your own experiences and actively engaging in discourse around these pertinent issues for the wider profession, collectively, we can chart a brighter future for the lawyers of today and tomorrow.

Ramon Ignacio Moyano
Chairman
World Services Group

Partner
Beccar Varela

Apple, Amazon, Facebook, Google, Microsoft, Netflix – the last year and a half has been hard, but without these familiar names it would have been unthinkable.

Ever since Bill Hewlett and David Packard founded HP in a Palo Alto garage in 1937, the young and tech-smart have been engines of economic growth across the US. Pandemic aside, the S&P 500 is surging at an all-time high, with companies in the tech sector proving to be the safest bet.
Five of the above listed companies alone – Apple, Amazon, Facebook, Microsoft and Google-parent Alphabet – already represent over 20% of the S&P 500’s total market cap. With the pandemic-induced shift to e-commerce and remote working, it is a trend that is unlikely to end any time soon.

Surely in the US, with an economy skewed heavily toward innovation and a premium placed on doing things better, faster and smarter, the lawyers must be doing things differently? Well, not quite. For all the talk of a quiet revolution taking place in the corporate legal teams of US and Canadian blue chips, the reality is much more complicated.

To make sense of it all, GC magazine teamed up with World Services Group to get the inside story on legal tech in North America. Drawing on a detailed survey of over 200 general and senior counsel working at a variety of companies across both the US and Canada – including many of the global leaders in their sectors – our findings show that tech has not been quite the disrupter many predicted. Yet…

Stacking it up

In spite of the advantages legal teams in the US and Canada have when it comes to the availability of legal tech, many feel they are no further ahead in their adoption of new ways of working.

Fewer than half of respondents to our survey (46%) felt that their teams were in a good place to capitalise on technology compared to their peers. Even more surprisingly, legal teams in the tech sector were just as likely to struggle as those in other industries. Just under two thirds (60%) of respondents working for technology businesses felt confident that they benchmarked favourably in their use of legal tech. In fact, across all the sectors surveyed, those employed in the tech industry (broadly defined) were among the least likely to feel that their use of technology was adequate.

Of course, they were also the most likely to be aware of the technological shortcomings of the legal team. As Liz Benegas, GC of enterprise management software provider Totango, comments:

‘When you’re in an environment that really pushes technology as a solution to business problems, you can find yourself asking a lot more questions about how you approach your own work. That can lead to a lot of new ideas, but it also puts you under pressure to bring your “A” game to everything you do.’
Another respondent, senior counsel at a global technology business, gave an even simpler answer: change is hard, particularly when it comes to tech.
‘[Our company] is generally seen to be at the forefront when it comes to bringing tech to market, and I would say we are way ahead of the curve in terms of our own use [within the legal team].

But still, large parts of what we do are built onto a tech stack that has been around for years. When we look to introduce a new contracting system or cloud-based technology we can’t just assume it will work well with what we have in place. I would imagine these problems only increase when you’ve got an older or more complicated stack to deal with.’

Plus ça change

For many general counsel the first year of working in-house comes as an epiphany. The experience of working at a law firm had shown them a world where partners and associates – often some of the most capable, knowledgeable and dedicated people they had ever known – were forced to work in an environment that either did not seem to support them or that actively worked against them by making highly-qualified people undertake work in an absurdly inefficient fashion. After making the move in-house, the realisation comes: “It’s not the law firms, it’s the lawyers”.

The average GC continues to have the same worries that their team is behaving in an inefficient or technologically unsophisticated way. The central problem, as one senior counsel at a global entertainment and media company observed, is how to continue to deliver value while eliminating bottlenecks. ‘Lawyers will not be replaced by technology, just as doctors will not be replaced by technology. The problem we must solve is how we get rid of bad habits while retaining the good ones. That is something we are only just starting to find answers to.’

The problem with technology, respondents to our survey agreed, is not having too little of it. It is having too many resources that are not used properly. Legal teams in North America are, for the most part, able to access the tools and systems they want. In fact, nearly all of those we surveyed (97%) reported that their legal functions were using more technology now compared to five years ago, with well over half (58%) saying they were using significantly more tech.

But having access to technology is only ever a partial solution to the problem of efficiency. Knowing what to do with it is just as important, and it is often not within the skillset of GCs to make sure a department is joined up when it comes to its use of technology.

Our survey shows North America’s in-house lawyers are less worried about technology than they are about their profession’s ability to use it effectively. Fewer than half (48%) of those polled said they were confident in their team’s ability to harness tech effectively.

Positive externalities

If anything is likely to push legal teams to adopt technology, it will be a global pandemic that has forced large numbers of businesses to shift to remote work. The first challenge for many legal teams when the call to work from home was issued was the realisation that existing ways of tracking and managing work were no longer going to cut it. Knowing what the team is doing can be relatively simple when most of its members are sitting in the same office. Asking, “What are you busy with right now?” over Zoom is not entirely practical.

While it is no surprise to see that 67% of those surveyed said their businesses had ramped up investments in tech as a result of the pandemic, the direct – and, many suspect, lasting – change this has had on the way legal teams handle work is something that caught a number of respondents off guard.

Nearly four fifths (78%) of respondents reported making greater use of technologies such as Zoom and Teams to keep their departments functioning during lockdown, while nearly half (48%) had moved their work onto platforms shared with the rest of the business to make handling matters more effective.

‘What Covid really did’, comments one general counsel for a medium-sized US software company, ‘was shine a light on how poorly aligned a lot of departments were across the business. It forced us to move from a situation where everyone had developed their own practices and habits – either as a team or as an individual – to a situation where we all had to move in lockstep to keep the planes from falling out the sky.’

But finding new ways to manage workflows is only the start of it. When nobody can leave their house, getting documents signed is a problem. Except it is not. As many legal teams have come to realise, the problem was relying on ways of thinking and acting that had already outlived their utility.

By forcing teams to rethink the ways in which legal work is completed, Covid has given impetus to a far more radical transformation in the in-house legal function. Nearly a quarter (24%) of the teams surveyed said that they had already redesigned their processes to cope with lockdown, and the results have been positive. As one respondent, director and assistant general counsel for a US-headquartered multinational consumer goods corporation, put it: ‘Having to serve business remotely was probably the best thing that ever happened to us.’

‘With the call to “work from home where possible” we had to take a step back and think about what it actually means to support the various divisions of our business. That was a moment of crisis, but it was also a period of productive reflection.

Instead of automatically following the same steps each time without ever thinking about outcomes, we had to think about what the intended outcomes were and plot the best path to them. Sure, we still have to process sales requests, but do we need people to do it, or is there some better way of getting to the same point?’

Now, as many lawyers return to the office, there is a feeling that legal work will never be quite the same as before. As Michael Shour, GC and secretary for Banyan Software, comments, ‘Especially with the Covid pandemic, it just makes so much sense for a lot of this stuff to move online. Whether it’s sharing information with colleagues or signing documents, we have seen how easy it is to digitise this type of thing and it will be very difficult to unlearn those lessons and go back to the old ways of working.’