Ride the Lightning
Cybersecurity and Future of Law Practice Blog
by Sharon D. Nelson Esq., President of Sensei Enterprises, Inc.
Wiley Rein Law Firm Breached by Chinese Hackers
July 30, 2012
Bloomberg has reported that Washington D.C. law firm Wiley Rein LLC was breached last year by Chinese hackers. It was by no means alone in its misery. The European Union council, Halliburton and others suffered the same fate.
Byzantine Candor, the team of hackers responsible, is known in security circles as the Comment group for its trademark of infiltrating computers using hidden webpage computer code known as “comments.”
30 North American security researchers watched the hackers work and documented their findings. 20 victims were identified, many of whom had data that could give China an advantage as it seeks to become the world's largest economy. The targets included lawyers pursuing trade claims against the country’s exporters and an energy company getting ready to drill in waters claimed by China.
A former FBI official calls the hackers' activity "the biggest vacuuming up of U.S. proprietary data that we’ve ever seen. It’s a machine.”
Exploiting a hole in the hackers’ own security, the researchers created a digital diary, logging the intruders’ every move as they snuck into networks, shut off anti-virus systems, camouflaged themselves as system administrators and covered their tracks, making them invisible to their victims.
Byzantine Candor was linked to China’s military, the People’s Liberation Army, by a 2008 diplomatic cable released by WikiLeaks. Two former intelligence officials verified the essence of the document.The hacking group has been active at least since 2002 and is thought to have penetrated more than 1000 entities.
National Security Agency director Keith Alexander said earlier in July that cyber espionage constitutes “the greatest transfer of wealth in history,” and cited a figure of $1 trillion spent globally every year by companies trying to protect themselves.
Of the 10 Comment group victims reached by Bloomberg, those who learned of the hacks chose not to disclose them publicly, and three said they were unaware they’d been hacked until contacted for this story.
Wiley Rein apparently did know, according to the Bloomberg story.
Dale Hausman, Wiley Rein’s general counsel, said he couldn’t comment on how the breach affected the firm or its clients. Wiley Rein has since strengthened its network security, Hausman said. Well, that's good – if a tad late. My question is – and I'd sure like an answer – did the firm notify its clients? D.C. does have a data breach notification law – and most experts believe that ethical rules require firms to notify clients. Anyone from Wiley Rein want to comment?
Listen to the Podcast
