The advent of technology has made many things easier, as well as harder. Phishing, cryptoviruses, data loss, data breaches, ransomware, spyware, etc. have all crept up over time and can make people’s lives very difficult. As an old and well-established profession, many lawyers think that technological concerns are separate from their business concerns. This couldn’t be farther from the truth.
Lawyers and Law Firms as Targets
Lawyers and law firms tend to be the target of many cyber criminals. Why? Because they are usually experts in law, not in technological defenses, and often deal with large issues that involve a considerable amount of money. Whether it’s real estate transactions, litigation, mergers and acquisition activity, intellectual property, business transactions, or any other legal matter you can think of, there is a great deal of confidential information that could do great harm if in the wrong hands. Below are just a few of the example scenarios that can occur:
- During a real estate transaction, a hacker intercepts a wiring instruction email and changes out the account info for something they have access to. By the time you realize what happened after the money is transferred, it is often too late. The money has already been transferred to other accounts, with very little hope at recovery.
- During a big case, ransomware infiltrates your systems and locks you out of all your case files, along with all your other files. The perpetrator may end up demanding a large amount in cryptocurrency to unlock the files and/or keep them from being released to the public. The case files include your trial strategy, confidential information, and memorialized weaknesses in your case. Since you do not have access to your files, you may not be able to continue in court.
- Even on a normal day, cryptoviruses can wreak havoc on your business. Dealing with the matter can be like a full time job, let alone all the work it takes to keep the business going. Worse, the files may include intellectual property and other confidential information that could devastate a client’s business if released to the public or put in the wrong hands.
- A data breach may cause many client’s confidential information, including personally identifiable information (PII) to be released to nefarious actors who could steal identities, infiltrate accounts, or release the information to the public.
- In the midst of a merger, a data breach could let out what the client’s strategies were and what their ranges for the deal were. This information could end up costing the client an immense amount of money, or cause the deal to fall through.
- While attempting to email a client, the wrong email address populated and sensitive information was sent to the wrong party.
While these are all terrible things that hurt the client, they can also hurt the attorney. After such an event, word may get out and nobody would want to do business with them. Insurance may not cover certain aspects of the loss and then it would be on the attorney. Even worse, it could cause an issue for the attorney’s law license.
Lawyers Use of Technology is Tied to Competency
In addition to the financial liability that may be incurred by cyber incidents, attorneys must now also worry about whether they will be deemed incompetent and have their law license affected. Although the profession of law is an old and established one, the rules governing it are often updated to reflect the times and current landscape. Even without the updates to the comment sections of the rules, the duties of competence and confidentiality still exist and govern all attorneys actions. Regardless, states have made efforts to be EXTREMELY CLEAR when it comes to the duties , whether in case law, opinions, or comments to the rules:
- Almost every state has a model rule 1.1 that deals with competency and how technology use is included in that duty. Hawaii became the 40th state to adopt an express duty of technological competency in 2022. Although many states felt it was covered, adding it expressly puts everyone on notice.
- The New York State Bar published new comments in spring 2022 regarding regarding the sharing of information through technology and how it is a breach of confidentiality without waiver.
- Reckless use of technology can lead to claims of the breach of confidentiality, which can not only adversely affect clients, but also put the attorney under review with the state bar.
What Can Lawyers Do?
The easy answer is: become an expert on all things technology. Since that is probably impossible (lawyers already have to be experts on the law, which is a full-time job), the next best thing is to get the experts that can take care of it for you and educate you on best practices. ABA Model Rule 5.3 (Responsibilities Regarding Non-Lawyer Assistance) specifically speaks to this in one of the comments:
A lawyer may use nonlawyers outside the firm to assist the lawyer in rendering legal services to the client. Examples include the retention of an investigative or paraprofessional service, hiring a document management company to create and maintain a database for complex litigation, sending client documents to a third party for printing or scanning, and using an Internet-based service to store client information. When using such services outside the firm, a lawyer must make reasonable efforts to ensure that the services are provided in a manner that is compatible with the lawyer’s professional obligations. The extent of this obligation will depend upon the circumstances, including the education, experience and reputation of the nonlawyer; the nature of the services involved; the terms of any arrangements concerning the protection of client information; and the legal and ethical environments of the jurisdictions in which the services will be performed, particularly with regard to confidentiality.
ABA Model Rule 5.3: Responsibilities Regarding Nonlawyer Assistance – Comment
For more information on what duties exist for attorneys on technology, the American Bar Association has an on-demand CLE course that can be found here.
What Managed Service Providers (MSPs) Can Do For You
MSPs can help implement reasonable safeguards for your practice and help educate you along the way. Below is an overview of what you might do:
Institute and Maintain Reasonable Technical Safeguards
- Assessing risks in network and software design
- Assessing risks in information processing, transmission, and storage
- Detecting, preventing, and responding to attacks or system failures
- Regularly testing and monitoring the effectiveness of key controls, systems, and procedures.
Institute and Maintain Reasonable Physical Safeguards
- Assessing risks of information storage and disposal
- Detecting, preventing, and responding to intrusions
- Protecting against unauthorized access to or use of private information during or after the collection, transportation, and destruction or disposal of the information
- Disposing of private information within a reasonable amount of time after it is no longer















