Georgina Bond
When TLANZ President Tony Herring took part in what he thought was a simple exercise on cyber security, he had no idea it would be such a wake-up call to how real the risks have become.
Ahead of a lunch at a professional forum, Herring was asked by technology consultancy NSP to join an online call and speak for 45 seconds on any topic of his choice.
“So, I talked about marathon running — that’s the only thing I really talk about,” he says, having clocked up 20 marathons over 20 years.
After his short talk, Herring stepped away for a drink and rejoined colleagues at the lunch. But when he returned, he got the shock of his life.
On the big screen in the room, he appeared to be speaking fluent Russian.
“I don’t speak Russian,” he says. “But it was my voice in the Russian language and it was my lips moving. It was amazing, so convincing. Everyone was looking at me and laughing.”
Click to watch the full deepfake video of Tony Herring here
Herring says the experience of being deepfaked was “frighteningly fascinating”.
“On one hand, it showed what technology can do now. But then, when I started thinking about it, it was quite frightening really. This was created within an hour on free software available on the internet. And that was a year ago. It’s already so much more sophisticated now.”
Herring, a partner at Gibson Sheat, says the experiment drove home the importance of vigilance in an industry where the stakes are high.
“The whole point of the exercise was to scare us into realising how easy it was for someone to hack you. Within an hour, they turned me into a fluent Russian speaker, using my own voice.”
Property settlements
The implications for law firms are particularly serious, Herring says.
“Firms like ours handle large amounts of money in trust accounts every day – often many millions in conveyancing transactions. Yet the insurance on offer doesn’t come close to covering that risk. Premiums are high and you have to wonder: is it even worth it?”
The concern is that a convincing deepfake could be used to trick staff or clients into authorising payments.
“Some cyber thief could take over your image and try to fool people it’s you, to get payment,” he says. “If you’re someone like me who has done a podcast, they could grab my voice. How would you know it’s really me?”
That challenge is particularly stark in property settlements.
“If you instruct me to sell your property and I do your settlement, I have to ring the client and ask them to confirm their bank account number. But how do I know it’s really them? Now, I’d have to get a client into the office, be with them and write the account number down.”
It may be inconvenient, he admits, but there is no alternative.
“I think it’s just a really good reminder for everyone to be vigilant and not take anything at face value. Which is sad but you just have to be really vigilant all the time. It’s a balancing act, because clients might get tired of the checks, but we can’t take shortcuts. I can’t let someone just ring me and tell me their bank account number. Everything has to be independently verified.”
His advice to fellow lawyers: “Always be on your guard, stay ahead of the curve and be aware of the techniques these teams use. We just have to be constantly thinking about it.”
And the bottom line, he says, is reputation.
“You know what they say — it takes a long time to build and only a moment to destroy.”
When you can’t trust the voice on the phone
Geordie Stewart
NSP chief information security officer Geordie Stewart says the demonstration with Herring was designed to show how it is getting increasingly difficult to rely on voice or video to authenticate a communication – especially an instruction for payment.
“The advice we are giving is that if there is any doubt about a communication (email, voice or video) then it is a good idea to call the person back on a trusted number. Don’t assume that someone is who they say they are if they called you and asked for something unusual.”
Michael Wallmansberger
Cybersecurity consultant and TLANZ council member Michael Wallmansberger says the rise of artificial intelligence and deepfake tools has made social engineering – tricking people into giving away access or information – much harder to detect.
AI-generated voices, videos and emails are now so polished that attackers no longer fit the stereotype of poorly written spam messages. Instead, firms may face smooth, convincing calls from people who sound authoritative, fluent and professional, he says.
“The imitations today are really good. You might get a really smooth approach from someone trying to find their way into the organisation,” he says.
That makes law firms especially vulnerable. Attackers may persuade a payroll clerk to release a one-time code, convince a staff member to install malicious software or subtly modify a computer setting that opens the door to client data.
But there are still red flags to watch out for, the first being the sense of urgency.
“Most scams will come with some kind of urgency or implied threat and often from someone you would perceive as being in a position of authority, for example a CEO or CFO,” Wallmansberger says. “If you feel that sense of urgency – stop and think twice. Then get help and advice to validate the request offline before you act.”
This week is Cyber Smart Week – an annual campaign in New Zealand to increase cyber resilience. Later in the week, LawNews will bring you articles on other risks law firms face and tips to keep your passwords safe.
0 Comments