Among the many issues COVID-19 has raised for business professionals, increased risk is chief among them. And not just health risk, but legal risk.

Those who feel they have been harmed, either by the economy or the pandemic, might look to hold accountable those they perceive to have harmed them. If they believe there are deep pockets involved, the motivation to “be made whole” can intensify. This is a formula for a rise in claims, and attorneys are not immune.

In fact, the risks for attorneys and their firms are not insignificant.

As courts have closed, then reopened, and then closed again in some cases, courthouses all around the United States have seen docket backlogs grow, as well as filing deadlines delayed, extended or left untouched and, ultimately, missed. With the pandemic wreaking such havoc on the U.S. judicial system, even the most attentive attorneys have been exposed to error.

Meanwhile, countless lawyers and their staff are working remotely, outside of both the office and its measurably more secure technology environment. Sensitive data that might once have only existed on secure firm servers shielded by firewalls, virus protection and a tech-support team might now reside on stray laptops and mobile devices connected to far-less secure home wifi networks.

While these data security issues and filing errors are not new risks, they open attorneys to tremendous liability. We can expect claimants to examine these situations closely in the wake of, or in response to, the COVID-19 crisis.

Other areas where we expect to see a rise of risk includes labor and employment law, as well as wills, trusts and estates.

Where employment law is concerned, there are obvious questions and concerns involving workers returning to the workplace. Those deemed essential workers are likely at high risk of filing claims should they develop COVID-19 and decide the workplace is a factor in their infection. The same is true for attorneys and staff who shifted to remote work and either have or will soon return to the workplace environment. In all cases, workers with preexisting health conditions are of most concern for resulting potential legal exposure. Solo practitioners and firm managers should carefully review their liability insurance prior to mandating any return-to-work requirements now or in the future.

In addition, the potential rise of work in the wills, trusts and estate arena simply means there will be more opportunity for potential claims. More members of the public are thinking about putting their legal house in order given the health threat. Related risks involving family dynamics or the client making claims of poor or misrepresentation each pose threats to attorneys in this space as these practice areas experience a burst of abnormal activity.

Ensuring your professional liability insurance coverage is equal to the unusual environment COVID-19 has created has never been more important. Contacting your insurance representative to conduct an audit of your coverage and the rise of COVID-19 related risk to your practice is a prudent course of action to ensure you, your firm and your practice are best protected.

If you’ve ever received an email from a foreign prince asking for your help to park his money in the United States in return for making you rich, then you’ve been the target of a social engineering attack. In the many years since this entrepreneurial prince started sending emails, these attacks have become much more sophisticated. Law firms are major targets of these schemes.

Why are hackers interested in law firms? They’re targeting the money that law firms administer, manipulating individuals into divulging confidential or personal information. They’re also good at it.

Social engineering attacks occur in several ways: via email, in person, by phone and more recently via text messaging. In each instance, hackers will attempt to provide a level of detail or personal information to convince the recipient it is safe to share that information or detail. More often, at least via email and text, the hacker will impersonate someone the recipient knows or otherwise would trust. By phone and in person, they often represent authority figures or parties to a transaction, and again, present enough information to make the situation appear legitimate.

Start with Training

Your best defense against the myriad of social engineering schemes is to train your staff on what to look for and how to handle these schemes when discovered. Conducting this training, under the guidance of a skilled cyber security firm or well-trained information technology professional can drastically reduce a law firm’s susceptibility to a social engineering hack. From examining full email addresses and looking for spelling and grammar errors, to following firm-prescribed verification procedures, an ounce of training can save the firm thousands of dollars.

Conduct Your Own Hack-a-Thon

Hiring a reputable cyber security company to test for vulnerabilities is a great way to get buy-in from all firm stakeholders. Many of these companies will conduct a mock attack at the request of management. Once completed, they present their work to appropriate managers and firm leadership. As partners, associates and staff see firsthand how easily hackers might manipulate them into putting the firm at risk, everyone is typically eager to receive training and not end up as “the one” who facilitated a hack.

Create a Cyber Security Policy

Working with your IT team, human resource representative and insurance provider, your firm should have its own cyber security policy. This policy should clearly state the types of cyber risks, including social engineering, that are of concern and address what steps members of the firm should take if they suspect an attack. These steps should include potential response strategies for digital, telephonic and in-person social engineering attacks. Your cyber policy must also document who at the firm is authorized to conduct financial transfers and procedures for verifying any such transfer requests, among other details.

Finally, your cyber policy should include recommendations to reduce employee risk of being a target. This should include cautions about providing contact information online, how much work-related detail they should or shouldn’t share on social media and what work-related information can and cannot be shared outside of the firm’s secure network and devices.

Know Your Risk

Social engineering attacks are frequent and severe. As a result, finding insurance coverage with high limits has become harder than ever. Only firms operating best-in-class controls are able to secure coverage.

Speak with your insurance agent or broker today to find out if you have the appropriate level of cyber risk insurance coverage you need, and what steps you should be taking to secure this coverage if you don’t already have it.

In the 1996 movie, Ransom, Mel Gibson plays a multi-millionaire business executive whose son is kidnapped and … big surprise … held for ransom. It’s a remake of a 1956 Glenn Ford movie of the same name. In both films the main characters follow along with the ransom demands … until they don’t. Much drama ensues.

In real life and in the movies, and in instances of ransomware, victims may be counselled to simply pay the ransom. Or sometimes they’re not. Unlike Hollywood, however, there’s no guarantee either storyline leads to a happy ending — including when law firms are deciding how to handle a ransomware attack.

The best possible scenario, of course, is to avoid being the subject of a ransomware attack entirely. It’s easier said than done, but not impossible.

Five Steps to Protect Against Ransomware

First, and especially with many U.S. employees still working from home at least part of the time, law firms must ensure all remote or work-from-away employees have access to a virtual private network. It’s strongly recommended that the firm, through its IT staff or IT contractors, take responsibility for setting up the VPNs used by all employees. This will ensure the most secure remote work environment possible and help to avoid potential attacks. Because cybercriminals are aware large numbers of business professionals are working remotely due to COVID-19, formerly unexceptional suburban enclaves are now priority number one for many industrious cybercriminals.

Second, employees should be trained to use their work computers as just that: work computers. Online shopping, personal downloads and social media should be restricted to personal devices only. Companies that enforce a work-product-only policy on law firm devices can significantly reduce the risk of ransomware attacks against the firm.

Third, help employees know what to look for. Ransomware comes in a variety of formats. These include stray links, a file that needs to be downloaded, phishing emails designed to look reputable that require employees to take a specific and timely action and malicious code hidden in software. Employees should receive guidance from IT professionals regarding how to identify suspicious attachments, what file extensions should raise a red flag (possibly blocking them entirely), and counseled on avoiding giving out personal or firm information without proper verification of who is on the other end of that communication – digital or otherwise.

Fourth, password encryption is strongly recommended. Platforms like LastPass, RoboForm, Sticky Password and others are good ways for law firms to not only manage access security, but also help employees to better remember, or at least access, certain networks or online tools in a responsible way.

Five, simple steps like disabling Autoplay on work computers and switching off wireless connections when not in use, including Bluetooth, can shut down additional common means for cybercriminals to gain access to law firm computers. Because digital media often default to allow Autoplay, this feature creates an ideal and low barrier point of entry for ransomware attacks. The same can be true for wireless connections.

What to Do If You Are Attacked

Even law firms that do almost everything right can fall victim to an opportune cybercriminal who shows up at an inopportune moment.

As soon as anyone in the firm notices unusual activity on a firm system or clicks on something they think better of a moment later, they should immediately remove or disable any network connectivity and shut down the computer. There’s usually a hotline provided with your firm’s cyber liability policy. Call that number immediately. The cyber response team on the other end of that hotline will begin a well-established, organized process that will activate a range of vendors who will begin immediate work to limit the damage and manage the resulting lifecycle of the breach itself.

The next call is to your firm’s IT team or consultant.

Your cyber liability policy can be quite extensive, providing for a crack cyber security team to stop and repair the damage, along with business interruption coverage, public relations and crisis communications support, and potentially even new hardware or software purchases depending on the extent of the breach or ransomware event.

The key, however, is to educate your attorneys and support staff. Also, treat your network security like an annual physical. This means making sure your IT team does a thorough evaluation not only of the network, but how attorneys and staff are operating within that network. Finally, make sure you have a detailed discussion with your insurance agent not only to ensure you understand your cyber liability coverage, but also to ensure coverage is adequate to help your firm get back to business as quickly as possible in the event of an attack.

Failing some or all of the above, you can be assured that in cases where a ransom is demanded for your technology, like in the case of actors Gibson and Ford, much drama will ensue.

Hard truths can be managed. They can even be overcome in some instances. But lies? Well, to paraphrase Butch Cassidy, “it’s the lie that’s gonna kill ya.” At least, that’s what will happen where professional liability insurance applications are concerned.

The consequences of a lie, or even a seemingly innocent omission on an application for professional liability insurance or a statement involving a professional liability claim can quickly lead to a recission of the policy. The end result can be massive exposure for the attorneys and/or the firm involved.

While lies of this nature seem like an obvious line that would not be crossed, a surprising number of attorneys have done so. And common misrepresentations of this type often stem from malpractice actions previously brought against an attorney. Some of these actions are settled, while others are litigated through the courts.

After resolution of a malpractice claim, a few attorneys have been found to omit mention of these malpractice suits from applications for professional liability insurance. Perhaps they do this in an effort to avoid higher insurance rates or simply to avoid an embarrassing mistake. But in doing so they virtually ensure exposure to future claims and a void of their liability coverage. Moreover, any client work conducted during the voided policy period that results in a claim will not be covered under a policy rescission.

Even if the misrepresentation isn’t discovered immediately, or in a timely fashion, once it is uncovered through an investigation the exposure, fines and ethical implications can be tremendous. In addition to the liability of the attorney involved, if their insurance agent or broker was aware of any material facts misrepresented or omitted from the insured’s application, they too can be held liable.

The best advice is to include everything on your application for professional liability insurance coverage, even the unpleasant parts. Yes, it may impact your premiums. The alternative is no coverage at all and the risk of significant exposure.

You’re going to be sued.

At some point in your legal career—if you haven’t been already—someone is going to sue you for malpractice. It’s very nearly guaranteed.

That doesn’t mean the lawsuit will have merit. It doesn’t mean you’ll lose. What it does mean is you need to be prepared for the day you are notified a lawsuit has been filed against you. Even a skilled attorney will find that first, and hopefully only, malpractice lawsuit to be a numbing experience.

A Foregone Conclusion

The rise of professional liability insurance claims, driven by lawsuits against attorneys, includes their growth in severity, complexity and cost. Why? Many of the biggest claims relate to the practice of real estate law, and real estate itself—as well as the claims involved—is getting more expensive. Wealth, generally speaking, is growing, and that means the work of estate attorneys is becoming larger and more complex. The resulting transfer of that wealth is more complicated then ever. American society is also generally perceived to be litigious. And while one might assume many lawsuits involve personal injury claims, according to July 2020 Washington Post article by author and Rutgers Law School Professor Jay M. Feinman, about half of all civil lawsuits filed in state courts are actually contract disputes. Many involve malpractice claims.

In 2018, the American Bar Association published an article with the damning headline, “Solo Attorneys are Most Likely to Be Sued for Malpractice.” The article cited statistics previously reported by the ABA that found four out of five lawyers will be sued for malpractice at some point in their careers. Seventy percent of those claims tend to be against firms with one to five attorneys.

In short, claims against attorneys are on the rise and it is merely a matter of time before you, too, are facing a malpractice claim.

What Can You Do?

Besides bracing for the stress of being sued, there are steps you can take to ensure you are best prepared to protect yourself.

The most important step is to work with specialty insurance agents and underwriters who are experienced in attorney professional liability insurance coverage. The local agent who sold you your life insurance, or other general property and casualty insurance agent is unlikely to have direct access to the insights and types of coverage needed to adequately protect a practicing attorney.

Because attorney professional liability policies offer a wide range of covered professional services, having an agent who understands the practice of law, and your specific area(s) of practice in particular, is paramount. And if your role sometimes takes you outside of typically covered attorney services, such as that of an executor or lobbyist for example, you’ll want an agent who can recognize this reality and ensure the proper endorsements are added to the policy.

Another consideration for attorneys who have moved around, gone solo or resumed their practice after a period of inactivity, is exploring options regarding tail coverage. An experienced agent, broker or underwriter in this space can address this issue to ensure past actions don’t come back to haunt you.

Because you will almost certainly be sued at some point in your legal career, you need to ensure those who provide you with your professional liability coverage are experienced and have a full, unfettered picture of your practice. You wouldn’t hire a tax attorney to litigate a death penalty case, so why would you work with an insurance agent or broker who doesn’t specialize in attorney professional liability insurance?

The insurance industry has a perception problem. It’s true.

If you polled a wide cross section of the U.S. population, the industry at large would likely be described as follows: they collect premiums, but they don’t pay on claims.

In short, the public is more likely than not to believe the monolith insurance industry operates in bad faith. The reality is quite the opposite, although our industry does a less than stellar job of consistently demonstrating this point.

So, let’s tackle one myth about professional liability insurance that plays directly to the concerns of attorneys: ambiguous language proves harmful to claimants.

Attorneys, by their nature and training, focus on the nuance of language. They are inclined to look for options or opportunities to interpret the language of official documents to best position their clients, or in the case of a bad faith claim, themselves or their law firms. Insurance professionals do much of the same, seeking to clarify situations, qualify claim events and adhere to the legalities required of any binding agreement. In truth, insurance consumers have a great deal of protection when it comes to ambiguous policy language.

Yes, insurance policies have conditions and exclusions that restrict what is or is not a covered event or occurrence. That is true of any formal agreement among multiple parties.

However, legal precedent has established an insurer’s denial of a claim based primarily on ambiguous policy language is most often invalid. And you don’t have to be a lawyer to discern the intent of this legal doctrine. Put simply, if a reasonable person—in this case the insured—interpreted ambiguous policy language to mean coverage existed, the intention of the insurer through manipulation of the English language does not apply. In the language of attorneys, this is the doctrine of contra proferentem, meaning the courts generally favor the insured rather than the insurer.

Myths notwithstanding, the insurance industry serves as the lynchpin of a well-ordered society. Insurance coverage, such as that provided by a professional liability policy, affords opportunity for business and commerce to proceed; for clients to engage attorneys and for those attorneys to represent their clients with confidence.

Professional liability insurance offers both protection and recourse. And regardless of policy language, another area where the insurance industry can work to make improvements, the industry, by and large, acts in good faith to protect those it covers. It is, unambiguously, good business to do so.