Information Security and Law Degree

TrainingDaze

So the professor teaching one of my classes works for a top5 defense contractor and informed us that several of her coworkers and associates are going to law school as "they see a future demand for IT security pros who possess a law degree".

Seeing as how this forum is populated with very knowledgeable (and ambitious) IT professionals....I'd like to hear your opinions on whether or not getting a law degree will be marketable and cost effective for IT security pros?

I know technical background and law school is very lucrative for patent attorneys (with EE backgrounds usually), but I just don't entirely see a future market for security experts. With the exception of perhaps expert witnesses trained in computer forensics....anyone care to share their thoughts or predictions?

dynamik

This is something I've strongly considered, but I ultimately passed on it because I didn't think I'd enjoy the work. The legal arena is definitely hurting for infosec professionals (as well as people who have a basic grasp on technology). Information technology laws are in general really far behind; old laws such as trespassing are having to be retrofitted to address activities such as hacking. Technologies and related conflicts are emerging faster than the courts can keep up with. I see this becoming increasingly important, so I'm going to side with your professor on this one.

Also, you don't need to be a lawyer or have a law degree to be an expert witness.

veritas_libertas

dynamik wrote: »

Also, you don't need to be a lawyer or have a law degree to be an expert witness.

This is true. My Father-in-Law has acted as an expert witness on circuit design. I'm hoping he keeps with this kind of thing because I believe it could end up being lucrative for him.

QHalo

I work very closely with our e-discovery attorneys. Knowing the law in information security is a very powerful asset in my eyes and it's cool to be able to get a techie as well. I'm sure this side of information security is extremely lacking professionals that possess not only the legal know-how, but the technology skills to bring it all together.

TrainingDaze

dynamik: Thanks for the reply, I've followed and learned a lot from many of your posts and am currently following in your footsteps of cissp > ceh > oscp I'm not surprised that you contemplated the JD because of your competitive and driven nature. I agree with your assessment of the courts lagging painfully behind the technology, but just haven't seen verification of a demand when browsing the job postings.

QHalo: Thanks for sharing your experience with e-discovery law and your thoughts on the need for IT security pros in the legal field. My concern is that law school carries such a high price tag , and in this economy I'd really want to be certain that the initial investment would pay off.

QHalo

I did some dice searching last night and didn't find much. I'd look in the digital forensics or investigation areas as those are probably more in line with the law and technical nature. Our e-discovery guys are EnCase certified as well as having their JD's. But they're also attorneys and it doesn't really sound like you want to be an attorney necessarily, just have the legal knowledge.

I guess you could just always study the laws of the state you're in concerning the major information security bills and laws; GLB, SOX 404, HIPAA, etc. Most of the jobs that I see for information security require intermediate to extensive knowledge at least in the higher jobs so that would be a good place to start in my opinion. If studying those and your state laws appeals to you then maybe look into it. But I wouldn't shell out another very large sum of money on something like that unless I was extremely interested or the benefits outweighed the cost and time associated.

dynamik

The online job sites might not be the best indicator of the demand. This is definitely a very specialized niche, so I wouldn't expect to see many postings online. Unless you partner with a law firm or another related organization, you would probably be doing consulting or running your own business.

Why don't you see if you can find some lawyers or other people who might have some insight into the situation and conduct an informational interview? Some will probably turn you down, but a lot of people are flattered that you ask them, and you can get a wealth of information out of it and possibly make contacts for the future. Just ask for an hour of their time and buy them lunch.

veritas_libertas

e-Discovery is another area that a Law Degree or Paralegal could help with I would imagine.

edit: Sorry, I didn't see that this would already mentioned...

pml1

Here's an interesting read about this subject:

Legal Careers for Security Pros

Personally, I think it could make for a very interesting career. I just don't know how I could fit law school in at this stage in my life.

GAngel

My gf is actually studying IP law. She has a job secured at a big bank when she leaves (her former company). Most of the people in her class will end up as corp lawyers working on paper work because that's where the vast majority of demand is. Patents, trademarks etc there really is nothing exciting about it. I'd suggest doing a job shadow before you decide on any field to see if that's truely how you want to spend your career.

TrainingDaze

I agree, I just can't see myself enjoying copyright and trademark litigation and thus haven't been necessarily excited about the prospect of practicing IP law. However the article that pml1 shared is very interesting: ensuring corporate compliance to the ever evolving federal guidelines, serving as counsel during information breaches, and working to implement necessary risk management and intrusion detection measures sounds like something that I could really enjoy!!

docrice

There was actually a lengthy discussion about this a little while ago on a SANS mailing list about the lack of legal counsels who are well-versed in technology, how to interpret current laws and apply them to different scenarios, how to support electronic evidence, etc.. If you ever go to any "hacker" con (Defcon, Black Hat, etc.), you'll find that the legal talks are some of the most entertaining and eye-opening because due to legal technicalities and ambiguities a lot of issues aren't so cut-and-dry as many of us might make them out to be.

With technology greatly outpacing most people's ability to understand them beyond the superficial, I foresee a great demand for legal professionals who can understand compliance law, how a particular business may or may not be subject to them, what the boundaries of responsibilities are, privacy issues, etc.. Much like infosec, this is a rapidly-changing area.

Take a look at the kind of issues the EFF is tackling on and the challenges they face. There are probably some posts on YouTube on past legal-related talks at the cons. Most informative.

Devilsbane

dynamik wrote: »

This is something I've strongly considered, but I ultimately passed on it because I didn't think I'd enjoy the work. The legal arena is definitely hurting for infosec professionals (as well as people who have a basic grasp on technology). Information technology laws are in general really far behind; old laws such as trespassing are having to be retrofitted to address activities such as hacking. Technologies and related conflicts are emerging faster than the courts can keep up with. I see this becoming increasingly important, so I'm going to side with your professor on this one.

Also, you don't need to be a lawyer or have a law degree to be an expert witness.

I've seriously thought about it. All it takes to get into law school is a bachelor's degree. 3 years of law schools and you can get your PhD. But I think that would be 3 years of near hell.

Bl8ckr0uter

Devilsbane wrote: »

I've seriously thought about it. All it takes to get into law school is a bachelor's degree. 3 years of law schools and you can get your PhD. But I think that would be 3 years of near hell.

I don't think it would be that bad. I would consider it.

QHalo

Really depends on what law school you get into.

TrainingDaze

Devilsbane wrote: »

I've seriously thought about it. All it takes to get into law school is a bachelor's degree. 3 years of law schools and you can get your PhD. But I think that would be 3 years of near hell.

It's much more costly if you factor in the opportunity cost of foregone income for 3 years and add that number to the tuition cost which can run well over 100K. It depends on the student but in our field it might make more sense to earn the degree part-time so that you don't allow yourself to go too far in the red. It such a personal and financial sacrifice that I can't imagine it being worthwhile unless you are: a.) completely in love with the field and can't imagine anything else more fulfilling or b.) a true masochist who can't pass up on 3-5 years of putting themselves through hell

powerfool

Only about 50% of law school graduates actually become practicing attorneys. While some of that has to do with not passing the bar, for others it is a choice. I have long considered law school, but it would be after completing an MBA, which will be after the MSISA@WGU. Having a great understanding of the law makes you very valuable in a legally sensitive area, even if you aren't handling court issues.

phantasm

I agree. But if I'm in the IT field with a law degree, the pay had better be on par with my education. For example, my sister-in-law just passed the bar and as a first year at the law firm she's clearing $120k. Find me an entry level IT job that pays like that and I'll jump in a heart beat! lol.

QHalo

Not to knock your sister and the $120k as that's awesome and alot of money, but she's gonna earn every penny. First years around here have it rough even into their 2nd and 3rd. It's all about performance and billable hours. Our first years make more than $120k though. We used to start them at $150k but those numbers have gone down significantly. We're also talking people that have 100k+ in debt after law school too so nothing like a house payment right out of school! There's also tremendous amount of pressure to be an attorney too hence the high pay. I'd never cut it.

NightShade03

QHalo wrote: »

We're also talking people that have 100k+ in debt after law school too so nothing like a house payment right out of school!

I actually know a few people in law school right now (3rd years) on a full ride so loans aren't an issue. I think finding a job at all, regardless of salary is very difficult for lawyers in area right now.

GAngel

phantasm wrote: »

I agree. But if I'm in the IT field with a law degree, the pay had better be on par with my education. For example, my sister-in-law just passed the bar and as a first year at the law firm she's clearing $120k. Find me an entry level IT job that pays like that and I'll jump in a heart beat! lol.

lawyers work like dogs. 80-100 hrs to make 120k is a joke. I seriously hope you were joking. Ask your sis in a year how it it. The first 3 years are hell. There is a reason so many get out first chance after they pay back there loans or move to small firms so they can have a life.

QHalo

NightShade03 wrote: »

I actually know a few people in law school right now (3rd years) on a full ride so loans aren't an issue. I think finding a job at all, regardless of salary is very difficult for lawyers in area right now.

I can attest to the latter part of that. We've shorted first years to law clerks. It's rather sad, they bring them in and then pay them **** and make them do the **** work. Eventually they'll be upgraded to associate level but it's pretty sad to come out of school and not get any offers. That's just our firm though. There are plenty of others that are paying. Law is highly competitive. It's definitely not for the faint of heart.

Devilsbane

QHalo wrote: »

Law is highly competitive. It's definitely not for the faint of heart.

It opens lots of different doors though. A law degree can help get your way into most government positions.

InfoSecLawGuy

So I feel as I'm a bit late to the party as this chain is almost a year old, but figured I'd chime in, just in case any of you were interested. I've been working in Info Sec/Assurance for 12+ years, have a BS and MS already and I'm a second year (2L) law student. Most of my career has been in federal space, though now I work for a private company. The advantages of a legal education within IS/IA are to many to note here, but the first and foremost is that you learn to think differently when in law school. Secondly, I believe that more than half of what we do on a daily basis as security professionals is either directly related to or is some derivative of a statute or regulation. Finally one thing that is little known, is how the law actually effects what we do. A holding by a court effects all of the lower courts within that jurisdiction, this could effectively mean that your organization has two (or more) separate, distinct and possibly conflicting requirements leveraged on it.

So to wrap up, a legal education is a great credential to attain as a security professional. The time commitment can be a bit challenging, but I don't think that it is any worse than a PhD or MBA.

WFMAH

Old thread, but it could get some new good discussion about the topic. I live in eastern Kentucky, very rural I know 30-40 lawyers on a social basis. I am coming back to IT after many years away, and I haven't ever had a discussion with any of them where they needed a computer expert in litigation. However, I know MD, CPA, RN, and Real Estate licensees that are utilized in litigation as expert witnesses. These witnesses can be paid $200+/hour for the expert witness time.

Notice that all of the "experts" require state licensing?

I definitely think there is a great opportunity in this field. However, there are not any "legal" requirements (?please tell me where there are requirements) to be an expert regarding information technology in the courts. I would even argue that holding a JD and not passing the bar in a jurisdiction would be a liability in the eyes of the court.

I welcome the thoughts of others that are more knowledgable in the area.

Devilry

Well, typically i'm the noob around here and need to listen to lots of info given from you all professionals.

I was in IT before going into law nearly 6 years ago, and I have been in civil/corporate and also IP (technology) law.

If you have anyone who is in your family who is a lawyer, ask their opinion, they will tell you to run.

Lawyer salary reviews is more inflated than the CompTIA A+ salary projections, if you don't goto a T15 school with
graduating in the top 10% of your class, you will make 75-100k in a 'big' market. Only the best get the $125-150k out
of school jobs, and law IS NOT hiring. I worked for one of the largest firms in the world, they have been downsizing
for half a decade now.

Working in IP law is not doing anything with technology, I can tell you that, I was under that impression when
I made the career change, and boy was I wrong. Let me show you what a IP lawyer/paralegal does:
United States Patent: 7991715
^^ They create this, read this, seriously from start to finish. The client gives you the info on the patent, and you write the most technical
language you can about it. You have to submit to the USPTO and then they challenge issues that already exist and you
keep refining until they accept it.

Law is the most stressful environment you could ever be in, maybe besides a astronaut or surgeon. If you have a problem
working overtime, consider than most all law firms work under the gun constantly and working a 60 hour week is very nominal,
working 75-80 is normal for a new grad for at least 2-3 years.

Law school? It's b.s., it does not teach you anything, its the history and theory of law, not the practice of law.
Unless you score absolutely amazing on a LSAT (168+) you are going to pay 6 figures for school, thats some
serious debt. If you are not spending that, you wont get the top tier jobs. Go pickup 'actual lsat exams' and take
one, the rule is whatever you get with no study you will only be able to get 5-10 more points of studying.
The test is how your mind interpret things, so its not very easy to alter that.

Anyway, that is the end of my rant, everyone I came in contact with (multiple family lawyers) told me
not to get in, but I did anyway, so im just passing it along in hopes of saving someone the feeling
I have of wasting my time of life.