Risk Update

Information Risk for Real — COO Departure + Data Drive = Serious Allegations and “Anger”

Law firm Proskauer sues ex-COO, claiming data theft” —

  • “U.S. law firm Proskauer Rose on Tuesday [December 27, 2022] sued its former chief operating officer, alleging he stole a trove of confidential information about the firm’s finances, lawyer compensation and clients before leaving his job there this month.”
  • “The lawsuit, filed in Manhattan federal court, claims Jonathan O’Brien deceived Proskauer staff members into allowing him to copy sensitive internal documents to USB files and then wrongfully deleted thousands of emails before giving notice that he was leaving.”
  • “‘Mr. O’Brien knew this information would be highly useful to Proskauer’s competitors, as it would enable them to effectively target and recruit Proskauer’s partners, practice groups, and clients,’ the lawsuit said. The firm asked the court to block O’Brien from misusing its data and is seeking unspecified damages.”
  • “According to the complaint, O’Brien in November created a list of documents to steal, including each partner’s client list, financial compensation and performance; software the firm developed to create proprietary reports; and confidential strategies for lateral partner recruiting. He then allegedly tricked a technology employee into letting him copy the data, saying it has been requested by an outside consultant.”
  • “Proskauer said it does not know where O’Brien plans to work, but the complaint claims he told a fellow employee that the firm would be ‘very angry’ when it learned about his new employer.”
  • “O’Brien could not immediately be reached for comment. The firm said it believes he is on vacation in Mauritius.”

The complaint itself is worth reading, for even more detail:

  • “For several years, Mr. O’Brien had been subject to a litigation hold, meaning that his emails could not be deleted as they might be evidence in potential litigation. In December 2022, Mr. O’Brien overrode the Firm’s controls to remove his litigation hold. Circumventing the Firm’s General Counsel, who is responsible for instituting and removing litigation holds, Mr. O’Brien directed one of the Firm’s e-Discovery consultants to lift his litigation hold. She complied. When a hold is lifted, all emails older than one year are instantaneously deleted.”
  • Mr. O’Brien was subject to a ‘litigation hold.’ A litigation hold preserves data relating to actual or potential litigation, and, among other things, prevented Mr. O’Brien from successfully deleting any emails or other information from his Proskauer Outlook mailbox. If a litigation hold is not in place, a Proskauer user’s email inbox is subject to ordinary document retention policies, under which emails older than one year are automatically deleted unless the user takes steps to archive them.”
  • “With rare exceptions, Proskauer partners do not have access to all the information Mr. O’Brien stole, including the proprietary systems and methods by which it was calculated, preserved, and administered, some of which was developed over years and at great expense and all at the center of the Firm’s ability to operate and preserve its ecosystem of culture, internal trust, and external obligation of confidence to its clients.”
  • “The legal industry is in an era of intense competition for partner talent and clients. The methods by which partners are compensated and the processes for doing so are highly confidential and would be of great value to a competitor. They also are deeply personal and the threat to disclose such information could be used to pressure, intimidate, and extort partners and the Firm.”
  • “Proskauer’s financial systems record detailed financial information about individual clients. That information is at the essence of the Firm’s duty to preserve and protect client confidences. There is almost no limit to how such data could be abused.”
  • “On December 5, 2022, Mr. O’Brien called Kevin Polakoff, the Firm’s Director of Technology Support (and one of Mr. O’Brien’s reports), and asked Mr. Polakoff to grant him an exception to the system restriction that prevents copying data to removable media.”
  • “Based on Mr. O’Brien’s false representation, and having no reason to suspect wrongdoing by the Firm’s COO (and his ultimate supervisor), Mr. Polakoff submitted a ‘Policy Exception’ request on Mr. O’Brien’s behalf, which his team granted. Because Mr. O’Brien was the Firm’s COO, Mr. Polakoff’s team treated Mr. O’Brien’s request as fully authorized and compliant – just as Mr. O’Brien expected they would.”

And a more recent update: “Proskauer Wins Temporary Restraining Order Against Former Chief Operating Officer” —

  • “Among the relief sought by the complaint was an ex parte temporary restraining order to preventing O’Brien from disseminating the internal documents he downloaded. And that’s exactly what Southern District of New York Judge John Cronan granted in the case. O’Brien left on a paid vacation to Mauritius on December 22 and is scheduled to return to the country January 4.”
  • “Although it remains unclear where O’Brien planned to work when he turned in his notice at Proskauer, according to the complaint, O’Brien indicated firm leaders would not be ‘happy’ when they learned of his new employer. But Cronan’s order would also apply to that party:”
  • “[T]he temporary restraining order also applies to ‘anyone acting in concert’ with him and it temporarily bars O’Brien from working or consulting for any entities with whom he has discussed or disseminated the allegedly stolen material.”