AI cyber security needs boardroom attention

In a recent speech at Imperial College London, AI Minister Kanishka Narayan emphasised the importance of having cyber security "discussed in every boardroom in Britain, rather than simply delegated to middle management". His remarks come on the heels of the UK government's announcement of new measures to bolster defences against potential AI-enabled cyber attacks. The National Cyber Security Centre (NCSC) has raised alarms, indicating that AI "will almost certainly make elements of cyber intrusion more effective and efficient".

The technology chief of VENTRiQ, a part of New Chancery Lane, pointed out that many barristers' chambers still leave security responsibilities to a busy senior clerk or practice manager. With the rising capability of AI to generate convincing fraudulent emails, this issue becomes increasingly critical, necessitating engagement from those at the top levels of a set.

At New Chancery Lane, security is woven into the fabric of operations, with Chief Technology Officer Dr Keiran Fleming on the board and all staff completing annual cyber security training. Dr Fleming commented, "The minister's right that this can't be left to middle management. In chambers, the boardroom is the management committee, and too often security is just one more thing on a senior clerk's desk." He believes that integrating security into every major decision is crucial to protecting sensitive client information.

Chambers are attractive targets for cyber criminals, due to their possession of confidential documents, medical records, and financial information. The Bar Standards Board mandates that barristers maintain client confidentiality, adding another layer of pressure to ensure security measures are robust. The risks escalate further when one considers that clients may receive convincing emails purporting to be from their barrister's clerk, potentially leading to significant financial losses. As Fleming candidly stated, "The attack most chambers should worry about isn't someone breaking into a server. It's an email that looks exactly like it came from your clerk's room, asking a client to pay into a new account."

In light of these challenges, the government has provided guidelines that include two initial steps: Cyber Essentials certification—which addresses five basic security controls—and the NCSC's Early Warning Service, which is available at no cost to UK businesses. Chambers and legal practices interested in understanding their current security posture can use VENTRiQ's free cyber readiness self-assessment available at ventriq.co.uk/cyber-readiness.