With the combination of new tech businesses and older companies employing artificial intelligence and other innovations, Virginia needs lawyers who know the difference between bitcoin and blockchain.

As the commonwealth becomes home to more defense contracting giants, along with Amazon.com Inc.’s HQ2, law firms and law schools are busy bringing attorneys and students up to speed on digital privacy laws, cryptocurrency trends, cybersecurity issues and more.

William & Mary Law School’s course listings for the 2022-2023 academic year, for example, included offerings such as “AI and More,” “Electronic Discovery,” “Data and Democracy” and “Cyber and Information Security Essentials.” Other law schools also have been revamping their curricula, and the Virginia State Bar is offering continuing legal education programs focusing on data privacy, social media’s impact on trademarks and laws governing the use of AI technology.

“They’ve been doing a good job of turning the ship,” says Beth Burgin Waller about this shift, and she should know. As cybersecurity and data privacy practice chair at Woods Rogers Vandeventer Black PLC in Roanoke, her entire caseload is cyber-focused. She’s also an adjunct law professor at Washington and Lee University, where she teaches tech-centric classes to law students.

Burgin Waller believes that Virginia is in a good position to navigate the rough and sometimes uncharted legal waters of electronic matters thanks to its robust tech sector, which routinely mixes innovation and entrepreneurship. The state has “a deep bench of tech lawyers,” she says. “It is a mini-Silicon Valley.” 

That deep bench serves both established tech giants such as Microsoft Corp. with presences in Virginia, and lesser-known tech companies pioneering innovations in areas such as autonomous vehicles, drones and biotech, Burgin Waller says. With the world’s largest concentration of data centers, Virginia in particular has an abundance of corporate clients needing legal assistance with permitting and approvals processes for data centers. But the demand for tech-savvy lawyers doesn’t stop there. Virtually any business can face legal issues regarding technology, ranging from cybercrime issues to compliance with data privacy laws.

Although mass layoffs at Google, Meta and Amazon have dominated headlines in recent months, Burgin Waller sees this backpedal as an anomaly. “Layoffs will not thwart innovation or the ongoing need for tech-focused lawyers,” she says.

‘No guardrails yet’

The ethical and moral questions posed by artificial intelligence creations such as chatbot ChatGPT and image generator Midjourney have led to stories focused on concerns over AI stealing jobs or creating controversies by whipping up realistic photos of former President Donald Trump resisting arrest, but fast-moving developments in AI technology also are creating opportunities for lawyers to advise clients in the absence of clear case law.

When OpenAI released ChatGPT in November 2022, 100 million people immediately began using it, some for nefarious purposes. No comprehensive federal laws govern the technology’s use or abuse, however, and although 17 states introduced AI-related bills in 2022, Virginia was not among them. 

“There’s going to be a need to regulate this,” says Burgin Waller, “but there are no guardrails yet.” 

So far, AI laws passed in four states are focused on just studying the technology, says Sharon D. Nelson, a former president of the Virginia State Bar and president of Sensei Enterprises Inc. in Fairfax, which specializes in IT, cybersecurity and digital forensics services. 

This lack of coherent law will create more court cases, but that’s not necessarily a problem, says Washington and Lee Law Professor Joshua A.T. Fairfield, who specializes in technology law areas such as cryptocurrency and data privacy. “The basic assumption is that technology is faster than the law, but the law is a series of rules that we work out all the time,” he says. “The oldest cases sometimes can handle new areas. Congress often comes along after that process. We don’t have to wait for that.” 

AI is already on its way to becoming a must-have tool for lawyers. It can greatly reduce the hours that attorneys must spend on mundane tasks such as tracking down precedents.

“Imagine having a paralegal that could find exactly the case you were thinking of in six seconds rather than [taking] weeks of research,” Fairfield says. AI is “better than humans doing [research] by hand, and you make far more mistakes if you don’t use it,” he continues. Fairfield predicts that law firms that don’t deploy AI could soon find themselves at a disadvantage. The firms “with the biggest dataset will win,” he says, “and that might squeeze out smaller competitors.”

Nelson has been using ChatGPT in her research and has found it useful, yet she cautions that its help comes with some caveats attached. “You have to be careful about what you put in there,” she warns, because once confidential attorney-client information is uploaded to a chatbot’s database, it stays there. And another troubling aspect of chatbots is their penchant for spewing out falsehoods. Sometimes ChatGPT “hallucinates,” Nelson says. One time, for instance, it provided her with court cases that either didn’t exist or were misconstrued. 

This unreliability may be a temporary or diminishing problem as the technology bounds forward. In March, OpenAI released GPT-4, which it says is far more accurate, multimodal and concise than its predecessor. For instance, it scored among the top 10% of test takers on a simulated bar exam, while its previous incarnation scored in the bottom 10%.

Another recently released AI chatbot, Harvey, was designed specifically for the legal profession, and it promises that any confidential data uploaded to it can be siloed — even within a law firm. About 3,500 lawyers at the international firm of Allen & Overy LLP have tested Harvey, and the firm now is integrating its use into its practice.

“Lawyers are going to do foolish things with AI, no doubt,” Nelson says. “There will be many lawsuits. But at the end of the day, AI is about money, and no one can afford not to be on board.”

The jury is still out on just how many courtroom challenges will be generated from using AI as a robotic paralegal or attorney surrogate, but Fairfield is adamant that it will never take the place of human lawyers.

“By its very essence, it is not capable of crafting new narratives,” he says. “The fundamental role of lawyers — to advance the law by advancing new frameworks for how to see a question — will remain untouched by AI.” 

‘Out of control’

AI has seemingly come on the scene with the sudden force of an explosion, but data privacy is a longstanding, simmering issue. Unlike the European Union, however, which has stringent privacy laws dating back to the late 1990s, the United States still lacks a comprehensive statute regulating the harvesting of personal data.

“Data collection is shockingly under regulated in this country,” Fairfield says. “Companies gather everything they can because they can always sell it. It’s out of control.”

Congress is moving to address this concern slowly, so regulatory decisions have defaulted to the states, only a handful of which have so far passed laws concerning data harvesting.

The upshot is a “patchwork of privacy rights based on where you live,” says Burgin Waller, and lawyers are left to deal with “dissonance among these little regimes.”

In January, Virginia’s Consumer Data Protection Act (VCDPA) took effect, governing any company doing business in the commonwealth — not just those headquartered here. It allows customers to opt out of their personal data being shared or sold to other businesses. While this seems like a simple aim, compliance with varying state laws such as these can be tricky for companies and the attorneys advising them.

For one thing, Virginia’s data privacy
law “does not apply to every business out there. A wide swath is exempted,” says Robert Michaux, a lawyer with Richmond firm Christian & Barton LLP and chairman of the Virginia Bar Association’s intellectual property and information technology law section.

Among many other exceptions, VCDPA does not cover government entities or protocols associated with the federal Health Insurance Portability and Accountability Act (HIPAA), which already includes restrictions on access to individuals’ medical information.

Attorneys often look to California, the first state to enact a data privacy law, for guidance, as well as to the European Union, but Burgin Waller notes that keeping up with technology law requires vigilance and keeping up with the latest, ever-changing tech trends.

“I’m constantly in touch with global news to be on top of new incidents and regulations to hit the highest mark we need to hit,” she says. 

‘Ransomware 2.0′

Cybersecurity and cybercrime are intertwined and expanding specialty areas for attorneys. Burgin Waller’s practice now includes tasks such as assisting clients in drafting third-party vendor agreements to protect themselves from litigation, as well as advising clients in obtaining cyber insurance policies.

“Ransomware 2.0,” as she terms it, has evolved into a more insidious threat, moving from holding information hostage for a payout to criminals selling stolen data or posting it online. Today, AI can be used to spam many people at once with phishing emails, and chatbots can help hackers break encryption codes and gain access to bank account numbers and other sensitive information.

All this tech-related criminal activity means that “a lot of lawyers are moving toward data breach and data privacy” specialties, says Nelson. These lawyers investigate breaches, counsel companies on paying ransoms, identify what data was compromised and work with digital forensics experts to determine how breaches occurred. They may also act as a corporate liaison to law enforcement and other government agencies. After an attack, Nelson says, lawyers also help with remediation and public relations. “Most often, a class-action suit is filed, so there’s a lot of money in defending against such a suit,” she explains.

“It’s definitely an open field,” says George F. Leahy, a law student at William & Mary and president of the Data Privacy and Cybersecurity Legal Society, a student organization that hosts speakers and provides a forum for students interested in these legal specialties. “These are brand-new issues, and lawyers will have a lot more work,” he says.

Although “the law has been slow to react” to regulating new technology, Leahy notes, William & Mary has not. The university, he says, has done a good job of preparing tech-savvy law grads with a comprehensive array of relevant courses.

The bottom line on this everything-everywhere-all-at-once situation regarding technology and the law is that Virginia’s attorneys would seem to hold a winning brief: No matter what area of tech law may anchor their practices, they should have no shortage of casework.  The implications and consequences for society, by contrast, remain more questionable.

Legal and technological “complexity reveals opportunity,” says Fairfield, “but what is good for the lawyers is not necessarily good for the country.”