Lawyers’ Use of Technology is a Competency Issue

The advent of technology has made many things easier, as well as harder. Phishing, cryptoviruses, data loss, data breaches, ransomware, spyware, etc. have all crept up over time and can make people’s lives very difficult. As an old and well-established profession, many lawyers think that technological concerns are separate from their business concerns. This couldn’t be farther from the truth.

Lawyers and Law Firms as Targets

Lawyers and law firms tend to be the target of many cyber criminals. Why? Because they are usually experts in law, not in technological defenses, and often deal with large issues that involve a considerable amount of money. Whether it’s real estate transactions, litigation, mergers and acquisition activity, intellectual property, business transactions, or any other legal matter you can think of, there is a great deal of confidential information that could do great harm if in the wrong hands. Below are just a few of the example scenarios that can occur:

  • During a real estate transaction, a hacker intercepts a wiring instruction email and changes out the account info for something they have access to. By the time you realize what happened after the money is transferred, it is often too late. The money has already been transferred to other accounts, with very little hope at recovery.
  • During a big case, ransomware infiltrates your systems and locks you out of all your case files, along with all your other files. The perpetrator may end up demanding a large amount in cryptocurrency to unlock the files and/or keep them from being released to the public. The case files include your trial strategy, confidential information, and memorialized weaknesses in your case. Since you do not have access to your files, you may not be able to continue in court.
  • Even on a normal day, cryptoviruses can wreak havoc on your business. Dealing with the matter can be like a full time job, let alone all the work it takes to keep the business going. Worse, the files may include intellectual property and other confidential information that could devastate a client’s business if released to the public or put in the wrong hands.
  • A data breach may cause many client’s confidential information, including personally identifiable information (PII) to be released to nefarious actors who could steal identities, infiltrate accounts, or release the information to the public.
  • In the midst of a merger, a data breach could let out what the client’s strategies were and what their ranges for the deal were. This information could end up costing the client an immense amount of money, or cause the deal to fall through.
  • While attempting to email a client, the wrong email address populated and sensitive information was sent to the wrong party.

While these are all terrible things that hurt the client, they can also hurt the attorney. After such an event, word may get out and nobody would want to do business with them. Insurance may not cover certain aspects of the loss and then it would be on the attorney. Even worse, it could cause an issue for the attorney’s law license.

Lawyers Use of Technology is Tied to Competency

In addition to the financial liability that may be incurred by cyber incidents, attorneys must now also worry about whether they will be deemed incompetent and have their law license affected. Although the profession of law is an old and established one, the rules governing it are often updated to reflect the times and current landscape. Even without the updates to the comment sections of the rules, the duties of competence and confidentiality still exist and govern all attorneys actions. Regardless, states have made efforts to be EXTREMELY CLEAR when it comes to the duties , whether in case law, opinions, or comments to the rules:

  • Almost every state has a model rule 1.1 that deals with competency and how technology use is included in that duty. Hawaii became the 40th state to adopt an express duty of technological competency in 2022. Although many states felt it was covered, adding it expressly puts everyone on notice.
  • The New York State Bar published new comments in spring 2022 regarding regarding the sharing of information through technology and how it is a breach of confidentiality without waiver.
  • Reckless use of technology can lead to claims of the breach of confidentiality, which can not only adversely affect clients, but also put the attorney under review with the state bar.

What Can Lawyers Do?

The easy answer is: become an expert on all things technology. Since that is probably impossible (lawyers already have to be experts on the law, which is a full-time job), the next best thing is to get the experts that can take care of it for you and educate you on best practices. ABA Model Rule 5.3 (Responsibilities Regarding Non-Lawyer Assistance) specifically speaks to this in one of the comments:

A lawyer may use nonlawyers outside the firm to assist the lawyer in rendering legal services to the client. Examples include the retention of an investigative or paraprofessional service, hiring a document management company to create and maintain a database for complex litigation, sending client documents to a third party for printing or scanning, and using an Internet-based service to store client information. When using such services outside the firm, a lawyer must make reasonable efforts to ensure that the services are provided in a manner that is compatible with the lawyer’s professional obligations. The extent of this obligation will depend upon the circumstances, including the education, experience and reputation of the nonlawyer; the nature of the services involved; the terms of any arrangements concerning the protection of client information; and the legal and ethical environments of the jurisdictions in which the services will be performed, particularly with regard to confidentiality.

ABA Model Rule 5.3: Responsibilities Regarding Nonlawyer Assistance – Comment

For more information on what duties exist for attorneys on technology, the American Bar Association has an on-demand CLE course that can be found here.

What Managed Service Providers (MSPs) Can Do For You

MSPs can help implement reasonable safeguards for your practice and help educate you along the way. Below is an overview of what you might do:

Institute and Maintain Reasonable Technical Safeguards

  • Assessing risks in network and software design
  • Assessing risks in information processing, transmission, and storage
  • Detecting, preventing, and responding to attacks or system failures
  • Regularly testing and monitoring the effectiveness of key controls, systems, and procedures.

Institute and Maintain Reasonable Physical Safeguards

  • Assessing risks of information storage and disposal
  • Detecting, preventing, and responding to intrusions
  • Protecting against unauthorized access to or use of private information during or after the collection, transportation, and destruction or disposal of the information
  • Disposing of private information within a reasonable amount of time after it is no longer

What is OneDrive and Why is it Useful?

OneDrive is Microsoft’s cloud storage service that allows users to store, protect, and share files across multiple devices. Although that is a short description, it covers a lot. Here are the highlights for how it’s useful:

Syncs Your Files Across Devices. If you have multiple machines, making sure you have the right access to the files you need is a chore. Either you carry around a portable hard drive and just access file that way, or you utilize email, or you just keep those computers set for specific tasks/content. OneDrive takes care of that by always keeping a running list of your files and making sure that the most up-to-date.

Have Access When You Need It. Even if you have your main devices synchronized, you may need files when you are away from your devices. You can either login securely through the web portal on a guest device or you can access it via the mobile app on your phone. I cannot stress how useful this is. Trying to get warranty service on an item and you saved the receipt to OneDrive? You can pull up the receipt and deal with the issue right there. Lost your passport and need the copy of it you scanned and saved? You might just be able to avoid catastrophe by pulling up a copy of it. Need the information on what appliances were installed in your home so that you can get the right technician? If you saved the info there, you have access to it. The list goes on. The gist of it is that you have a reliable method for getting information you saved whenever you need it.

Automatic Backups. In the event a device is lost or malfunctions, you usually lose that data or have a hard time recovering it. Even if you do, it takes time, effort, and expertise to get there. In the event that you manually backed files up using a portable hard drive or a usb drive, they may not be up-to-date. Microsoft is always making backups since all devices automatically sync.

Be Secure. The whole system is encrypted with 256-bit encryption (whether in transit or at rest), which is considered the most secure standard available today. If you use multi-factor authentication (MFA), you are doing about as well as you can reasonably do. When you share out files, you can also make sure they are secure, whether by password, time-expiration, or specific user account. If you lose a device, you can disable the connection so they can no longer access OneDrive.

OneDrive Integrates Well. If you have a Windows machine, OneDrive is baked in inherently. Microsoft products have many features geared towards taking advantage of OneDrive’s cloud features. Collaboration on Office files (i.e., Word docs, Excel spreadsheets, PowerPoint presentations, etc.) is all very easy.

These alone should put you fully at ease. Regardless, below are some of the other hesitations we have heard.

Remaining Hesitations

Do I really want to use the cloud?
You absolutely do. There have been a lot of memes and jokes about “what is the cloud?” and “who understands the cloud, anyway?” and “the cloud? That’s how they get you.” In reality, you use it every day and it is probably more secure than anything you are doing today. The encryption makes it secure, but in the age of cryptoviruses and other catastrophic agents, the cloud is the easiest and most effective way to keep your data safe and have access to it when you need it.

Is it secure?
We threw numbers and standards at you above, but in short, it is secure. Not only is the technology secure if you use it right, Microsoft has a vested interest to not have data breach issues. They have hundreds of billions of dollars riding on it, so you know they are always working on it.

Is it hard to use, especially if you are technologically challenged?
Microsoft made it incredibly easy to use. While we might have wanted to see some other features and provide more control for the technologically advanced, Microsoft opted for simplicity and ease-of-use. As long as you can install the app and enter credentials, it just works. If you are trying to really make it work for you and you want to become a full digital convert, you just need to make sure you are organized and get in the habit of saving things there. How do you do that? Watch the tutorials or talk to an expert that can further explain how best to use this technology.

Other Good Resources

Metadata: Should I Be Concerned?

Everyone hears about it, but many don’t understand it. Metadata is akin to ‘the cloud’, with people saying “who understands it anyway?” Regardless of your profession, it is something you need to be aware of so that you can determine if you need to amend your behavior.

What is it? Metadata is data that provides information about other data, but not the content of the data itself. What’s that mean? It is data about the data, and it is usually hidden. Metadata can include information such as:

  • How, when, and by whom the data was collected
  • How the data is formatted
  • Revisions, and the associated dates
  • Comments
  • Template information
  • File properties
  • Summary information
  • The document’s title, author name, subject, and keywords
  • The purpose of the data
  • The location of the data
  • The file size

Does it really matter? It depends. If you don’t send anything externally and all your recipients are colleagues that know exactly how you work, then it’s probably not a problem that they are getting this data. If you are an attorney that reused a document as a template, it may be a big deal because you could be disclosing confidential information about another client unknowingly. Similarly, an attorney sending information to opposing counsel could unknowingly be providing sensitive information that could sink their client or case. If you are in business, your slide deck may include pricing schemes and discount tolerances in the presenter notes that you would never want to send to a client. If the document is a Word document with tracked changes and comments hidden, the recipient may unhide them and know exactly what the internal notes are, which may be unflattering or give away strategy.

On the flip side, if you are the recipient of information and want context or insight, looking at the meta data can be incredibly helpful. Knowing whether the document you are being sent was last saved a week ago or ten minutes ago may be helpful. Knowing who last saved or created the document may give you insight into which person you are actually negotiating with. Knowing when and where a picture was taken could make or break a case.

What can I do? You need to figure out whether the risk is worth the effort. If it has no effect on you either way, you may want to continue to do nothing and let whatever metadata exists to remain there. If you are redacting documents or sending out information during a deal, it may be incredibly important to remove the information. If you don’t know, you should talk to an expert to figure out what metadata exists in what you work with and then figure out how to systematically remove the information when you want to.