Cybersecurity Lawyers Getting Plenty of Company

High-profile data breaches in the past few years have been a wakeup call for corporate America ' and made cybersecurity and data privacy the next “it” practice for lawyers. There's been a gold rush to the field, practitioners say ' and the potential rewards have attracted some Johnny-come-latelies and pushed attorneys to seek out new ways of distinguishing themselves as experts.

“Recently, the client demand for these services has definitely gone through the roof,” says Greg Parks, co-chair of Morgan Lewis & Bockius' privacy and cybersecurity practice, who is based in Philadelphia. “It is an exploding hot area right now.”

Veterans of the field say the gold rush mentality has led some attorneys with thin cybersecurity credentials to brand themselves as security or privacy lawyers.

Andrew Serwin, San Diego-based co-chair of Morrison & Foerster's global privacy and data security practice, says he's seen “people who have worked in a somewhat related area, but not the same area, who are trying to pivot into that space.”

This has included class action litigators, as well as attorneys with information technology, health care, employment or regulatory practices, Serwin says. “The cybersecurity bar is a small space. We all kind of know each other. You know when there are people who are trying to say they are experts when they're not really experts,” says Serwin, who has been practicing cybersecurity law since the late 1990s. He says newcomers to the field could be prone to mistakes. “If your first breach is your first megabreach, you're probably going to have some problems.”

Randy Sabett, special counsel at Cooley in Washington, DC, and vice chair of the firm's privacy and data protection practice, says he thinks there may be attorneys out there who have handled one or two privacy-related matters but brand themselves as privacy attorneys.

As the field becomes crowded, lawyers are seeking out ways to distinguish themselves. Sabett, who worked as a crypto-engineer for the National Security Agency before his legal career, is credentialed as a Certified Information Systems Security Professional (CISSP). He says he's seen more and more lawyers working to earn this credential or others offered by the International Information System Security Certification Consortium.

Earning this credential requires some technical knowledge, as one must pass a test on security technologies, threats, standards and practices. And it is rare enough among lawyers that it does set its holders apart.

Having knowledge of security technologies isn't necessary for a cybersecurity lawyer, but “it does open doors that maybe you wouldn't even realize were there,” Sabett says. His background allows him to “essentially be the translator” between a company's directors and security technicians.

But technical expertise can be gained in other ways, says Aravind Swaminathan, co-chair of Orrick's cybersecurity and data privacy team. While the firm does have attorneys possessing consortium credentials, “we put our effort into constant learning” and “have a team of lawyers who are truly 'geeked out' by cyber- and privacy-focused technologies.”

Experts expect the clamor for lawyers with cybersecurity cred ' or who hold themselves out as such ' to continue. “The reason you're seeing people come in is because the demand for services really outstrips the supply of high-quality cybersecurity lawyers,” Serwin says.

Patience Haggin writes for The Recorder, an ALM sibling of e-Commerce Law & Strategy. She can be reached at [email protected].

High-profile data breaches in the past few years have been a wakeup call for corporate America ' and made cybersecurity and data privacy the next “it” practice for lawyers. There's been a gold rush to the field, practitioners say ' and the potential rewards have attracted some Johnny-come-latelies and pushed attorneys to seek out new ways of distinguishing themselves as experts.

“Recently, the client demand for these services has definitely gone through the roof,” says Greg Parks, co-chair of Morgan Lewis & Bockius' privacy and cybersecurity practice, who is based in Philadelphia. “It is an exploding hot area right now.”

Veterans of the field say the gold rush mentality has led some attorneys with thin cybersecurity credentials to brand themselves as security or privacy lawyers.

Andrew Serwin, San Diego-based co-chair of Morrison & Foerster's global privacy and data security practice, says he's seen “people who have worked in a somewhat related area, but not the same area, who are trying to pivot into that space.”

This has included class action litigators, as well as attorneys with information technology, health care, employment or regulatory practices, Serwin says. “The cybersecurity bar is a small space. We all kind of know each other. You know when there are people who are trying to say they are experts when they're not really experts,” says Serwin, who has been practicing cybersecurity law since the late 1990s. He says newcomers to the field could be prone to mistakes. “If your first breach is your first megabreach, you're probably going to have some problems.”

Randy Sabett, special counsel at Cooley in Washington, DC, and vice chair of the firm's privacy and data protection practice, says he thinks there may be attorneys out there who have handled one or two privacy-related matters but brand themselves as privacy attorneys.

As the field becomes crowded, lawyers are seeking out ways to distinguish themselves. Sabett, who worked as a crypto-engineer for the National Security Agency before his legal career, is credentialed as a Certified Information Systems Security Professional (CISSP). He says he's seen more and more lawyers working to earn this credential or others offered by the International Information System Security Certification Consortium.

Earning this credential requires some technical knowledge, as one must pass a test on security technologies, threats, standards and practices. And it is rare enough among lawyers that it does set its holders apart.

Having knowledge of security technologies isn't necessary for a cybersecurity lawyer, but “it does open doors that maybe you wouldn't even realize were there,” Sabett says. His background allows him to “essentially be the translator” between a company's directors and security technicians.

But technical expertise can be gained in other ways, says Aravind Swaminathan, co-chair of Orrick's cybersecurity and data privacy team. While the firm does have attorneys possessing consortium credentials, “we put our effort into constant learning” and “have a team of lawyers who are truly 'geeked out' by cyber- and privacy-focused technologies.”

Experts expect the clamor for lawyers with cybersecurity cred ' or who hold themselves out as such ' to continue. “The reason you're seeing people come in is because the demand for services really outstrips the supply of high-quality cybersecurity lawyers,” Serwin says.

Patience Haggin writes for The Recorder, an ALM sibling of e-Commerce Law & Strategy. She can be reached at [email protected].