It was just an exercise, but not everyone knew that. Janine McKelvey, General Counsel Group Data Governance, Privacy and Ethics Officer at British Telecommunications (BT), recalls a tabletop drill at a previous employer involving a security breach. People started "to communicate wildly with everyone," recalls McKelvey, often by mass emails, including to third-party vendors. Privilege and confidentiality issues went out the window. "We had to tell people it was only an exercise," she recalls. Lessons were learned, pre-pandemic, about who was in charge of communications, and how those communications should be delivered. "The lawyer has to be the police officer on the beat," she said, making sure lines of responsibility are clear.