Data Vulnerability Toughens Lawyers' Confidentiality Rules

=" There is (as they say in the academic literature) "much more work to be done.""

as I have noted ocassionally: you cannot build a castle on a foundation of sand.

this means getting things on a solid footing before starting work on the castle, and in the area of security this requires that we address the problem of un-authorized programming aka "malware"

there was an old "just for grins memo" that used to circulate.  I'll post a copy of it here just for grins:

NOTICE

This place requires NO Physical Fitness Program:

Everyone gets enough exercise

• jumping to conclusions
• skipping requirements
• dodging responsibility
• running down the boss

and

• pushing their luck

we have been skipping and dodging too long

It is difficult for the ABA (or any bar group) to set definitive standards in this area.  The circumstances of lawyers and law firms vary widely.  The technology keeps changing.  The ABA Commission has, helpfully, raised the profile of the issue within the profession.  There is (as they say in the academic literature) "much more work to be done."

Duke:=" Find a way to make email encryption both easy and universal, and the world will beat a path to your door, whether a committee says it's relevant or not."

Encryption is available and easy to use.  Check into Outlook with PGP\Desktop, or if you like open source: Try Thunderbird with ENIGMAIL and GnuPG

the "universal" bit comes rather a good bit harder: we need learners and teachers...

PGP provides all 3 key elements of security

1. authentication
2. integrity
3. security

Authentication: allows you to verify who you are talking to

Integrity: allows you to verify that the message you are reading has not been altered in-transit

Secirity: allows you to be reasonably sure no one other than the intended recipient(s) can read the plain text of the message

SCB:="Awareness is the first step toward action."

I absolutely agree with that. and hopefully IEv is helping, at least some

I would like to note however that this hacking problem has been festering for quite some time

too, a lot of folks have made every effort available to them to addresss the issue

my point is that in order to obtain a satisfactory resolution we will need stronger action and this will need to be in the form of rules for OEM software makers, and product liability rules to act as persuaders, as well as requirments and regulations to establish limits on liability

basically a computer holding a commercial certification should pass a software audit.  if it does the ball is in the user(s) court, if not the O/S OEM is responsible for cleaning out the malware.  this should make things manageable on both sides of the ball: each side, user and OEM, will be responsible for those aspects of security he\she can understand and control.

e.g.

you: use the encryption software

OEM: make sure malware does not bypass the encryption software.

~

I'm mildly shocked that the ABA's committee took such a passive stance on the matter.

I'm not sure that it needs to delineate precise standards.  But I would have expected more stringent language about expectations in this.

I'm not sure what to make of it that they didn't engage the discussion that way.

Between lawyers, at least, there are some ethical obligations regarding mis-directed communications.  A lawyer may be required to notify an adversary when something obviously has been misdirected, and may also be required to return or destroy the message.  (That, in part, is the purpose of the reminder notes that many lawyers attach to their emails).  But those ethical obligations do not solve the general problem of data security.  And there are plenty of means for loss and intrusion into data, in the law firm setting. 

Just to put the other side of the case: when I worked in a legal environment, fax machines were a notorious security risk.  Confidential documents would be left on fax machines, faxed to the wrong number, or faxed to a supposedly right number which turned out to be a machine sitting in a corridor, with dozens of people walking past every five minutes.

The particular danger with faxes is that quite simple human error could lead to a document being faxed to attorneys on the other side of a case.  I recall faxes being sent to an attorney at a meeting at the other side's law offices.

Email doesn't seem to me to be any worse than faxes.  The real danger, as with faxes, is inadvertently addressing the email to someone concerned with the matter who shouldn't see it.

The general vulnerability of emails doesn't seem to me to be the issue here -  because most emails between attorneys and clients are of no value or interest to third parties, unlike, for example, bank account info.

An interesting point, just how far must law firms go in protecting their confidential info from prying eyes? I can see suits now by clients proposing the lawyer's files got out over the internet, and the lawyer is now liable for damages.

There will undoubtedly be firms specializing if internet theft sometime in the near future, as the digital "Willie Suttons" go where the money is, stealing info over the internet.

Willie Sutton (famous criminal of the last century) once said that he robbed banks because "that's where the money is."  Today, law firms and other major institutions have become targets of data security attacks because "that's where the information is."  The ABA Ethics 20/20 report is, at least, a wake-up call to the profession, that this issue will not magically go away.  Awareness is the first step toward action.

SCB:=" there are different levels of data security, and security technologies attuned to those different levels."

that is a very good point

I would add that each of us should feel obliged to effect "due diligence" in protecting both provider and client information

we should regard this as a business obligation that would apply to vendors as well as to customers for communications systems

due diligence then should extend beyond attaching a confidentiality note to e\mail messages to insisting on general improvement in the over-all environment

IEv is one effort in this regard but there is a wide assortment of weblogs that deal with security efforts

but reporting problems is not enough: our electronic communications services require corrective service: action must be taken.

i think an industry council is needed to guide the FTC in writing Security Rules.  These rules should define requirements and assign liabilities so that it becomes everone's best interest to attend to security.

the Army teaches us: Hope is not a method