Prologue
I have long considered, lectured and written about law firm competitive intelligence from the perspective of CI prepared and used in service to the firm’s goals as a business entity. However, CI can also be conducted by law firms and its vendors in service to its clients’ goals. Today’s post addresses that use of CI by law firms.
This post also addresses the counterintelligence challenges of a post-Wikileaks world, where law firms and their vendors can be targeted by disgruntled employees, hackers and social engineers. Today’s professional culture encourages us to communicate via email, texting and social media, which are so familiar we forget they are susceptible to revelation – on purpose and through carelessness, through both legal and illegal means. Even sophisticated people ignore these dangers, as today’s post illustrates.
The events described below read like they were lifted from Stieg Larson’s “The Girl with the Dragon Tattoo” novel series. However, they were all reported during the past two weeks by the Financial Times, The New York Times, The Washington Post, The Observer, American Lawyer Media, Wired, Salon and dozens of other publications, blogs, online chat rooms and message boards.
I apologize if I have failed to insert the word “allegedly” everywhere it should appear in the following severely summarized account. Therefore, I hereby stipulate it has been alleged that …
What has been reported?
Last fall Hunton & Williams invited three data security companies (HBGary Federal, Palantir Technologies and Berico Technologies) to work with the firm to prepare a joint new business pitch for the U.S. Chamber of Commerce, a firm client. This pitch related to some of the Chamber’s political initiatives and investigations and handling of its antagonists.
H&W also invited the same three security companies to help prepare a second new business pitch for Bank of America, also a firm client. This pitch related to a BoA internal investigation into documents that Wikileaks had obtained, possibly from one or more BoA insiders, and threatened to publish on the Internet.
As these events were unfolding, HBGary Federal’s CEO, Aaron Barr, wanted to strengthen his street cred to support the H&W and other business development efforts HBGary Federal was involved in.
Barr was already hanging out online with members of Anonymous, a highly secretive, loose collective of activists and hackers. He believed he could elevate his sleuthing reputation by analyzing information on internet chat logs, Facebook, Twitter and elsewhere to identify Anonymous’s secretive leaders and key players. Barr planned to describe his unmasking methodology in a presentation at a February 2011 security conference and was able to publicize this presentation in a news story published on February 4, 2011, in the Financial Times.
For a day or so after the February 4 Financial Times story came out, Barr and Anonymous traded online insults. Anonymous then retaliated by hitting HBGary Federal’s corporate network, eventually taking down the company’s site, extracting 70,000 emails and publishing them online. To insult Barr further, Anonymous said their takedown team included a 16-year-old girl who had social engineered an HBGary Federal company IT admin into revealing another HBGary Federal admin’s logins and passwords.
Among the thousands of HBGary Federal emails that Anonymous published were those emails HBGary Federal had exchanged with H&W lawyers while the law firm and three data security companies were preparing the Chamber of Commerce and BoA pitches. Anonymous also uploaded the PowerPoint presentations the three security companies had prepared in consultation with H&W for use prior to or during H&W’s pitches.
Those PowerPoint files described the services the three companies would perform, including investigations and possible actions to be taken against lobbying groups, union employees, journalists and others whose allegiances and interests were counter to those of H&W’s clients. Those actions included developing fake personas, preparing and leaking fake information to H&W clients’ adversaries to discredit them, and discouraging commentary by journalists who are “... established professionals that have a liberal bent, but ultimately most of them if pushed will choose professional preservation over cause, such is the mentality of most business professionals.”
Where do things stand now?
1. HBGary Federal’s web site is still down.
2. Palantir and Berico have apologized for their involvement in these events and severed all ties with HBGary Federal. Palantir also suspended the 26-year-old engineer who worked on the PowerPoint presentations.
3. The Chamber of Commerce denied hiring any of the three companies or H&W.
4. Bank of America said they have never seen the presentation described in the emails, have never evaluated it, and have no interest in it.
5. H&W has refused to comment.
6. Some of those named as the Chamber’s adversaries in the hacked emails and PowerPoint files have announced their intention to file ethics charges next week with the DC bar association against three of H&W’s lawyers.
Lessons learned?
Whether the activities allegedly contemplated in the HBGary Federal hacked emails and PowerPoint files were competitive intelligence or corporate espionage or worse, they violated the Society of Competitive Intelligence Professionals’ Code of Ethics. As I have said many times before, including here, law firm competitive intelligence workers should all read that brief code of ethics, take its seven elements to heart and agree to abide by it. I now recommend that lawyers do so, too.
These events also have sobering implications for law firms’ own network security challenges. If a data security firm can be hacked and all its emails and attachments posted online, how well would most law firm networks stand up to such an assault? And if the firm’s network were breached in this way, what would be the costs to the firm and its clients and prospects? This law firm counterintelligence challenge requires not only technological safeguards, but also full recognition that lawyers and law firm employees are just as susceptible as anyone else to social engineering.
I have no doubt that everyone associated with this dog’s breakfast wishes it had never happened. Some blame the mess on security carelessness. Others see the leaked emails and PowerPoint files as evidence of ethical lapses and possibly criminal intent.
Optimistically, I view these events as an opportunity to remind ourselves, once again, of the ethical limits of competitive intelligence activities. Above all professions and industries, lawyers and law firms cannot be ignorant of or ignore these ethical limits.
Showing posts with label SCIP. Show all posts
Showing posts with label SCIP. Show all posts
Sunday, February 20, 2011
Wednesday, April 22, 2009
CI Pro Interview with Emily C. Rushing
Name: Emily C. Rushing
Title: Competitive Intelligence Specialist
Firm: Haynes and Boone, LLP
Since: September 2008
Profiles: You can find Emily at LinkedIn and Twitter.
Q: What is your job description at Haynes and Boone?
A: My role is primarily focused on developing and reporting strategic business and competitive intelligence. I support the Business Development and Marketing Departments, the CMO, the firm’s attorneys, and, most importantly, firm management.
Q: Who are your typical CI clients at Haynes and Boone?
A: My clients range from associates to the Managing Partner to marketing staff. My primary clients are the Business Development Managers who coordinate with me on behalf of their respective practice groups.
Q: What are three common KITs you’re often asked to address?
A: Topics for our intelligence frequently include: 1) profiling competitors’ practice areas and clients, 2) identifying business development opportunities for the firm among existing clients and developing strategic targeting programs, and 3) developing intelligence in preparation for business development meetings with existing or potential clients.
Q: How is the intelligence function organized at your firm? To whom do you report?
A: I am the firm’s only CI professional. I am directly supervised by the Director of Business Development, indirectly supervised by the CMO, and my role is situated within the Marketing department.
Q: What experience or training prepared you most for the CI work you do now at Haynes and Boone?
A: My years as a research specialist with King & Spalding were good training for the CI work I do for my current firm. I also developed technical skills with various softwares during my time working as a consultant and freelance technical librarian.
Q: What formal CI training have you had?
A: Very little CI-specific training. I studied social sciences and statistics in college and went on to achieve a Juris Doctorate and Master’s of Library and Information Sciences. These are highly analytical areas of study, and I feel that the training I received in those programs were wonderful preparation for my career in CI.
Q: Where do you go for ongoing CI training and mentoring?
A: Since accepting this position, I have attended webinars and tried to expose myself to the basic literature. I also have been mentored by colleagues via professional organizations like SCIP and SLA’s CI division, for which I am very grateful. From librarian to CI professional isn’t as jarring a transition as lawyer to librarian, but has required some adaptation.
Q: What specific adaptations have you found necessary in your transition from librarian to CI professional?
A: The most helpful adaptation I have made has been to change my patron/client focus from transaction-oriented (retrieve article, locate book on shelf, instruct on research techniques, build bibliography, perform catalog search) to results-oriented (find and understand the client, prepare for the meeting, get the business, maximize the relationship). My new, CI perspective looks less at the question "What is the patron asking me to give them?" or even "What do we need to know?" than it looks to the question "What should we do and how can intelligence help us make a better decision?" Once I really understood my present role in terms of the latter phrase, rather than either of the first two phrases, CI made sense to me and I was able to more smoothly transition from a research practice to an intelligence practice.
Q: What do law firms most often misunderstand about CI? What should they know about CI that you’re afraid is often misunderstood?
A: There is some misunderstanding about the process of developing KITs and CI. It is a two-way street, and a successful CI program requires that management and decision-makers share information with the CI professional. For CI to simply generate a report on a set of data or research into a particular topic is not a successful use of CI. CI must be actionable and must help inform management’s decisions, but that requires that management perceive CI as an integral part of the decision-making process.
Title: Competitive Intelligence Specialist
Firm: Haynes and Boone, LLP
Since: September 2008
Profiles: You can find Emily at LinkedIn and Twitter.
Q: What is your job description at Haynes and Boone?
A: My role is primarily focused on developing and reporting strategic business and competitive intelligence. I support the Business Development and Marketing Departments, the CMO, the firm’s attorneys, and, most importantly, firm management.
Q: Who are your typical CI clients at Haynes and Boone?
A: My clients range from associates to the Managing Partner to marketing staff. My primary clients are the Business Development Managers who coordinate with me on behalf of their respective practice groups.
Q: What are three common KITs you’re often asked to address?
A: Topics for our intelligence frequently include: 1) profiling competitors’ practice areas and clients, 2) identifying business development opportunities for the firm among existing clients and developing strategic targeting programs, and 3) developing intelligence in preparation for business development meetings with existing or potential clients.
Q: How is the intelligence function organized at your firm? To whom do you report?
A: I am the firm’s only CI professional. I am directly supervised by the Director of Business Development, indirectly supervised by the CMO, and my role is situated within the Marketing department.
Q: What experience or training prepared you most for the CI work you do now at Haynes and Boone?
A: My years as a research specialist with King & Spalding were good training for the CI work I do for my current firm. I also developed technical skills with various softwares during my time working as a consultant and freelance technical librarian.
Q: What formal CI training have you had?
A: Very little CI-specific training. I studied social sciences and statistics in college and went on to achieve a Juris Doctorate and Master’s of Library and Information Sciences. These are highly analytical areas of study, and I feel that the training I received in those programs were wonderful preparation for my career in CI.
Q: Where do you go for ongoing CI training and mentoring?
A: Since accepting this position, I have attended webinars and tried to expose myself to the basic literature. I also have been mentored by colleagues via professional organizations like SCIP and SLA’s CI division, for which I am very grateful. From librarian to CI professional isn’t as jarring a transition as lawyer to librarian, but has required some adaptation.
Q: What specific adaptations have you found necessary in your transition from librarian to CI professional?
A: The most helpful adaptation I have made has been to change my patron/client focus from transaction-oriented (retrieve article, locate book on shelf, instruct on research techniques, build bibliography, perform catalog search) to results-oriented (find and understand the client, prepare for the meeting, get the business, maximize the relationship). My new, CI perspective looks less at the question "What is the patron asking me to give them?" or even "What do we need to know?" than it looks to the question "What should we do and how can intelligence help us make a better decision?" Once I really understood my present role in terms of the latter phrase, rather than either of the first two phrases, CI made sense to me and I was able to more smoothly transition from a research practice to an intelligence practice.
Q: What do law firms most often misunderstand about CI? What should they know about CI that you’re afraid is often misunderstood?
A: There is some misunderstanding about the process of developing KITs and CI. It is a two-way street, and a successful CI program requires that management and decision-makers share information with the CI professional. For CI to simply generate a report on a set of data or research into a particular topic is not a successful use of CI. CI must be actionable and must help inform management’s decisions, but that requires that management perceive CI as an integral part of the decision-making process.
Wednesday, September 3, 2008
SCIP offers CI training in fall 2008
I’ve long believed law firm CI workers should belong to the Society of Competitive Intelligence Professionals (www.scip.org). For many years I’ve been a member of SCIP and think it’s a great organization for education, mentoring, and networking.
SCIP has some good programs coming up in the next few months. A couple of good courses for those new to law firm CI will be on tap next week in the Washington, DC area:
CI 101® and CI 202™
September 8-9, 2008
Westin Hotel, Alexandria, VA
Starting and Managing a CI Function (New!)
September 10-11, 2008
Westin Hotel, Alexandria, VA
European Summit 08
October 20-22, 2008
Crowne Plaza, Rome, Italy
Financial Analysis Courses I through IV
December 2-5, 2008
Hilton Old Town, Alexandria, VA
For fuller listings and descriptions of SCIP’s 2008 fall training offerings, visit SCIP’s Events Calendar.
SCIP has some good programs coming up in the next few months. A couple of good courses for those new to law firm CI will be on tap next week in the Washington, DC area:
CI 101® and CI 202™
September 8-9, 2008
Westin Hotel, Alexandria, VA
Starting and Managing a CI Function (New!)
September 10-11, 2008
Westin Hotel, Alexandria, VA
European Summit 08
October 20-22, 2008
Crowne Plaza, Rome, Italy
Financial Analysis Courses I through IV
December 2-5, 2008
Hilton Old Town, Alexandria, VA
For fuller listings and descriptions of SCIP’s 2008 fall training offerings, visit SCIP’s Events Calendar.
Subscribe to:
Posts (Atom)
Posts
