Why I came back

My introduction to cyber was a dramatic one. In January 2020, amid extreme bushfires on the east coast of Australia and the onset of the Covid-19 pandemic, Toll was hit by a vicious cyberattack. Toll was hit again in May 2020. The company’s response to these attacks necessarily caused widespread disruption. The hackers dropped stolen data on the dark web for many months following the attacks.

I played a key role in coordinating Toll’s legal response. Among other things, this involved reviewing compromised data, regulatory engagement, assessing contractual compliance risk and drafting communications targeting staff, customers and suppliers. We were expertly supported by Cam Whittfield and his team (then at PwC).

I was fascinated by the multifaceted impacts of a cyber crisis, and the integral role played by legal advisers in that setting. I decided to pursue further education and use the experience as an opportunity to commit my time to cyber and privacy risk management. This pivot took me to GenesisCare, an international cancer care provider, where I worked as senior legal counsel on the privacy and data side.

In the meantime, the Australian cyber risk landscape was rapidly evolving. High-profile cyberattacks were refocusing government, regulatory and industry attention on the risks posed by poor cyber resilience. Cam had returned to HSF in 2022 (see Alumni Matters 2022), entrusted with building out the firm’s data, information security and cybersecurity practice in APAC. Cam asked if I could be tempted by returning to private practice and all of a sudden the band was back together.

On returning to HSF in 2023, I was delighted to see many familiar faces and the elevation of some of its finest to senior leadership roles in the global network, including Carolyn Pugsley and Nick Baker.

Cyberattacks are increasing in terms of scale, frequency and sophistication and their consequences can be catastrophic for victims. In the context of increased scrutiny from government, regulators and the public, lawyers now play a lead role in coordinating an organisation’s response to a cyberattack. Missteps managing the various response workstreams can have major legal and regulatory consequences.

In addition to incident response and recovery, much of our work is focused on preparing organisations for a cyber crisis before it arises, so they can respond more efficiently and minimise its impacts. We brief boards about their obligations, review policies and procedures and run elaborate cyber simulation exercises for clients to test their systems and decision-making under pressure.

Returning to HSF has been a breath of fresh air. There are many familiar faces and the facilities and support are truly outstanding. The firm’s agile working policy is a distinct change. I ‘grew up’ at HSF at a time when junior staff did not have work laptops, let alone worked from home. There were no video calls with colleagues or clients, and the physical location of one’s desk in the office was meaningful. Returning to a post-Covid HSF has been welcoming in that respect.

The new policy acknowledges the full and busy lives led by HSF staff, and trusting them to work remotely ultimately facilitates the delivery of outstanding outcomes for our clients. Now that I am raising young children in my personal life, I am very grateful for this flexible style of working.

I’ve also been pleased (but perhaps not surprised) to see the evolution of HSF’s Alternative Legal Services practice. The service is particularly valuable for cyber risk management. It is now critical that businesses understand how their data is stored, used, secured and destroyed. And organisations impacted by a cyber incident need to understand what data has been accessed or exfiltrated, to assess the impact to individuals and other stakeholders and potential legal and regulatory risk. The ALT team is trained and resourced to support with these tasks.

I welcomed my second child in July 2023. The firm has been very supportive of me taking some time off to care for my growing family. When things are a little calmer, I love hiking, camping, and beach holidays with family, friends and our boisterous cocker spaniel.

We have a reputation for putting our cases reasonably, which is especially important in my line of work now, where I am dealing with regulators. Added to that, clients are reassured if you demonstrate calmness, explaining the process and working with them to achieve the best outcome. However, we are not afraid to be robust in our arguments, where the case merits it.

I moved on to contentious regulatory work as a result of a secondment with BNP Paribas. There, I was brought into the bank’s litigation and investigations team. I liked the work, the extra responsibility and the interfacing with regulators I was given as a relatively junior lawyer, so I joined the bank permanently in 2013. There were more regulatory investigations, post-Libor, and I think there was an advantage of being in-house and being immersed in the company’s business when dealing with regulators. The variety of work, direct client contact and responsibility for matters gave me a great opportunity to grow as a lawyer.

In-house, whatever the particular issue is, you are a fixer. I tell people it goes from the sublime, where you are handling global regulatory investigations, to the ridiculous, where you’d have bailiffs coming round to try to take paintings off the wall, even though any debt had long been paid by the bank.

I had always kept contact with people at the firm. Jenny Stainsby mentioned that there was an opportunity in the team. I rejoined in July 2018. Some of the people were new, and that was exciting to get to know them. The one thing that hadn’t changed was the furniture! However, that position has since improved.

Since I have come back I have been much more focused on contentious regulatory work. My background in commercial litigation is helpful. Clients tend to think in terms of risk rather than different specialisms, but it is always useful to bring in people with different specialist skills as needed, which we are able to do. I collaborate with colleagues throughout the firm and in different offices. I am currently working with colleagues in the corporate crime team on a skilled persons review of a bank’s financial crime controls and we often work with the employment team – for example, where internal investigations impact senior people within companies.

I enjoy being involved in regulatory work. There is the political angle, because regulators ultimately answer to politicians who have their own agendas, as well as what they think is important in the market. As a regulatory lawyer, you have to be aware of what’s going on in the outer world and how that’s impacting regulators and then, in turn, impacting clients that we are advising. Recently, I have been following closely the increasing use of artificial intelligence (AI) in financial services and worked with UK Finance and their member firms to produce a white paper on the fair use of AI in financial services.

The sheer volume of regulations, the growing accountability placed on senior managers, the impact of non-compliance on companies’ reputations, the pressure imposed on companies to conduct investigations quickly and thoroughly have all combined to make the firm’s contentious regulatory practice a core one. We have a leading practice and the plan is continue to grow it to meet client demand

I live in Wiltshire, so if I’m not working, I’ll take the opportunity to go out for some lovely walks over the Pewsey Downs and play sports with my son. He’s mad about football and cricket. And if at the end of all of that I have some time to sit down and have a glass of wine and speak to my wife, that’s a bonus!