Law firms among businesses testing the cybersecurity waters

Listen to this article

Now every business — big or small — could be a target, and not all know where to start when it comes to protecting the sensitive customer information they hold.

Law firms like Harrisburg-based McNees Wallace & Nurick LLC are hoping to be that starting point for businesses engaged in cybersecurity planning. In February, the firm announced a new, seven-lawyer privacy and data security practice group to advise clients on cybersecurity issues.

Devin Chwastyk, the firm’s practice area chairman, said as data breaches have become big news over the last few years, more McNees clients have inquired about what it takes to protect their businesses.

The new practice area gives the firm a combined force of lawyers who can help those clients, he said. The firm will be looking to bring on new clients through the practice area as well.

“Only in the last few years has the awareness of cybersecurity risk gotten down to regional companies, that they realized they needed to take this stuff seriously,” Chwastyk said. “They need to make sure they’re on a level playing field with their competitors. We had lawyers in a lot of different practice areas that were dealing with different aspects of (cybersecurity), but by bringing these people together in one practice area, we could cement our knowledge together and counsel companies regardless of the industry.”

Chwastyk said he’s been doing outreach to promote the new practice area, and already has seen successful results with clients who are realizing the need to improve cybersecurity practices and policies.

“We’ve had dozens of clients responding,” he said. “They’ve been worrying about (cybersecurity), but didn’t know how to deal with it.”

A growing field

The American Bar Association isn’t pushing firms to enter the cybersecurity realm, according to Vincent I. Polley, a member of the ABA’s Cybersecurity Legal Task Force and an editor of the ABA Cybersecurity Handbook. The association’s cybersecurity task force is designed to help lawyers protect themselves, not clients.

Nonetheless, Polley has helped firms start cybersecurity practices and has seen many firms across the country enter the field. He said firms start these practices with one of two missions, to gain new clients, or to serve existing clients.

“If you are going out to try and find new clients, that’s a pretty steep road to climb,” Polley said. “Most firms are using it to satisfy a need in their existing client base. You can do that and then go about how to backfill the expertise.”

Expertise, however, is an issue for firms trying start cybersecurity practices. Polley estimated there are “about 100” senior-level lawyers in the country who are experts in cybersecurity.

Jeffrey A. Franklin of Berks County-based Prince Law Offices PC has that kind of expertise. He’s been practicing in the cybersecurity field for about 20 years, and moved to Prince, which has offices in Lancaster and Lebanon counties, about a year ago to help the firm build a cybersecurity practice.

“This is not just large companies at risk now,” Franklin said. “Medium and smaller-sized companies are targets for cyber criminals as well. Those are the ones that often can’t survive a data breach. They need to be advised on what their responsibilities and requirements are legally. These are the companies that can have one event and have to close their doors.”

Roberta D. Anderson, a partner at Pittsburgh-based K&L Gates LLP, which has an office in Harrisburg, is the co-chair of the firm’s cybersecurity, privacy and data protection group. The group works with clients on risk mitigation, regulatory compliance and incident-response planning. It also counsels clients when a data breach happens.

“It’s a very dynamic space,” she said. “That’s a challenge, but it’s also an opportunity, because clients really need our help in getting their arms around what the best position is for them to be in.”