MTC: Can Lawyers Ethically Use Generative AI with Public Documents? 🤔 Navigating Competence, Confidentiality, and Caution! ⚖️✨

Lawyers need to be concerned with their legal ethics requirements when using AI in their work!

After my recent interview with Jayne Reardon on The Tech-Savvy Lawyer.Page Podcast 🎙️ Episode 99, it made me think: “Can or can we not use public generative AI in our legal work for clients by only using publicly filed documents?” This question has become increasingly relevant as tools like ChatGPT, Google's Gemini, and Perplexity AI gain popularity and sophistication. While these technologies offer tantalizing possibilities for improving efficiency and analysis in legal practice, they also raise significant ethical concerns that lawyers must carefully navigate.

The American Bar Association (ABA) Model Rules of Professional Conduct (MRPC) provide a framework for considering the ethical implications of using generative AI in legal practice. Rule 1.1 on competence is particularly relevant, as it requires lawyers to provide competent representation to clients. Many state bar associations provide that lawyers should keep abreast of the benefits and risks associated with relevant technology. This scrutiny highlights AI’s growing importance in the legal profession.

However, the application of this rule to generative AI is not straightforward. On one hand, using AI tools to analyze publicly filed documents and assist in brief writing could be seen as enhancing a lawyer's competence by leveraging advanced technology to improve research and analysis. On the other hand, relying too heavily on AI without understanding its limitations and potential biases could be seen as a failure to provide competent representation.

The use of generative ai can have complex ethic's’ requirements.

The duty of confidentiality, outlined in 1.1, presents another significant challenge when considering the use of public generative AI tools. Lawyers must ensure that client information remains confidential, which can be difficult when using public AI platforms that may store or learn from the data input into them. As discussed in our October 29th editorial, The AI Revolution in Law: Adapt or Be Left Behind (& where the bar associations are on the topic), state bar associations are beginning (if not already begun) scrutinizing lawyers use of generative AI. Furthermore, as Jayne Reardon astutely pointed out in our recent interview, even if a lawyer anonymizes the client's personally identifiable information (PII), inputting the client's facts into a public generative AI tool may still violate the rule of confidentiality. This is because the public may be able to deduce that the entry pertains to a specific client based on the context and details provided, even if they are "whitewashed." This raises important questions about the extent to which lawyers can use public AI tools without compromising client confidentiality, even when taking precautions to remove identifying information.

State bar associations have taken varying approaches to these issues. For example, the Colorado Supreme Court has formed a subcommittee to consider recommendations for amendments to their Rules of Professional Conduct to address attorney use of AI tools. Meanwhile, the Iowa State Bar Association has published resources on AI for lawyers, emphasizing the need for safeguards and human oversight.

The potential benefits of using generative AI in legal practice are significant. As Troy Doucet discussed in 🎙️Episode 92 of The Tech-Savvy Lawyer.Page Podcast, AI-driven document drafting systems can empower attorneys to efficiently create complex legal documents without needing advanced technical skills. Similarly, Mathew Kerbis highlighted in 🎙️ Episode 85 how AI can be leveraged to provide more accessible legal services through subscription models.

Do you know what your generative ai program is sharing with the public?

However, the risks are equally significant. AI hallucinations - where the AI generates false or misleading information - have led to disciplinary actions against lawyers who relied on AI-generated content without proper verification. See my editorial post My Two Cents: If you are going to use ChatGTP and its cousins to write a brief, Shepardize!!! Chief Justice John Roberts warned in his 2023 Year-End Report on the Federal Judiciary that "any use of AI requires caution and humility".

Given these considerations, a balanced approach to using generative AI in legal practice is necessary. Lawyers can potentially use these tools to analyze publicly filed documents and assist in brief writing, but with several important caveats:

1. Verification: All AI-generated content must be thoroughly verified for accuracy. Lawyers cannot abdicate their professional responsibility to ensure the correctness of legal arguments and citations.

2. Confidentiality: Extreme caution must be exercised to ensure that no confidential client information is input into public AI platforms.

3. Transparency: Lawyers should consider disclosing their use of AI tools to clients and courts, as appropriate.

The convergence of ai, its use in the practice of law, and legal ethics is here now1

4. Understanding limitations: Lawyers must have a solid understanding of the capabilities and limitations of the AI tools they use.

5. Human oversight: AI should be used as a tool to augment human expertise, not replace it.

This blog and podcast has consistently emphasized the importance of these principles. In our discussion with Katherine Porter in 🎙️ Episode 88, we explored how to maximize legal tech while avoiding common pitfalls. In my various posting, there has always been an emphasis on the need for critical thinking and careful consideration before adopting new AI tools.

It's worth noting that the legal industry is still in the early stages of grappling with these issues. As Jayne Reardon explored in 🎙️ Episode 99 of our podcast, the ethical concerns surrounding lawyers' use of AI are complex and evolving. The legal profession will need to continue to adapt its ethical guidelines as AI technology advances.

While generative AI tools offer exciting possibilities for enhancing legal practice, their use must be carefully balanced against ethical obligations. Lawyers can potentially use these tools to analyze publicly filed documents and assist in brief writing, but they must do so with a clear understanding of the risks and limitations involved. As the technology evolves, so too must our approach to using it ethically and effectively in legal practice.

MTC

🚨 BOLO 🚨 : Beware of phishing emails impersonating federal court CM/ECF notifications!

🚨 Today, I received notices from two different courts about illicit emails posing as court communications (see pictures below). 📨 It can sometimes be easy to ignore the “generic” clerk’s e-mail.

🔒 Remember, scammers may send fake emails with malicious links or attachments claiming to be from courts. Always verify emails before clicking links or downloading files. Access court documents directly through official PACER/CM/ECF portals. 🛡️

🚫 Report suspicious emails to your court.

Stay vigilant to protect sensitive case information and maintain cybersecurity. 🛡️💻

From the United States District Court of Maryland…

From the United States Southern District Court of indiana…

MTC: Cloud-Based Legal Drafting: Assessing the Safety of Google Workspace and Microsoft 365 for Lawyers.

Is working on your briefs in the “cloud” secure? 🤷

As law firms increasingly embrace cloud technologies, many attorneys are questioning the safety of using platforms like Google Workspace and Microsoft 365 to draft sensitive legal documents such as briefs. This concern is well-founded, given the ethical obligations lawyers have to protect client confidentiality (see generally MRPC 1.6(a). Let’s examine the security measures these platforms offer and consider the implications for legal professionals.

Security Features of Google Workspace and Microsoft 365

Both Google Workspace and Microsoft 365 provide robust security measures designed to protect user data:

1. Encryption: Both platforms offer encryption for data at rest and in transit.

2. Multi-factor Authentication: This additional layer of security helps prevent unauthorized access.

3. Data Loss Prevention (DLP): Policies can be set to prevent sensitive information from being shared inappropriately.

4. Advanced Threat Protection: Both services include features to detect and prevent malware, phishing, and other cyber threats.

Compliance and Legal Considerations

For lawyers, compliance with industry standards is crucial. Both platforms address this need:

• Google Workspace adheres to standards such as Systems and Organization Controls (SOC1™, SOC2™, SOC3™), ISO27001, HIPAA, and GDPR.

• Microsoft 365 complies with FISMA, HIPAA, and EU Model clauses.

These certifications indicate that both platforms have undergone rigorous third-party audits to ensure they meet stringent security and privacy requirements.

Specific Considerations for Legal Drafting

When it comes to drafting legal briefs, consider the following:

1. Version Control: Both platforms offer robust version control features, allowing lawyers to track changes and revert to previous versions if necessary.

2. Access Controls: Administrators can set granular permissions to ensure that only authorized individuals can access sensitive documents.

3. eDiscovery: Both Google Workspace and Microsoft 365 include tools for eDiscovery, see Google Vault and Microsoft Purview eDiscovery, respectively, which can be crucial in legal proceedings.

4. Data Residency: For firms handling matters with specific jurisdictional requirements, both platforms offer options to specify where data is stored.

Potential Risks and Mitigation Strategies

While these platforms offer strong security measures, there are still risks to consider:

1. User Error: The biggest risk often comes from within. Implement regular training on security best practices for all staff.

2. Third-Party Apps: Be cautious when integrating third-party applications, as they may not adhere to the same security standards.

3. AI and Machine Learning: When integrating AI tools like Microsoft's Copilot, be aware of potential data exposure risks when using these features for legal drafting.

4. Ethical Considerations: Ensure that your use of cloud services complies with your jurisdiction's ethical rules regarding client confidentiality.

Conclusion

Lawyers must keep in mind their ethical obligations when working online!

While no system is 100% secure, both Google Workspace and Microsoft 365 offer robust security features that, when properly configured and used, can provide a safe environment for drafting legal briefs. The key is to:

1. Understand and implement the security features available.

2. Regularly train staff on security best practices.

3. Stay informed about updates and new features that could impact security.

4. Consult with IT professionals to ensure proper configuration.

5. Regularly review and update your firm's security policies.

By taking these steps, law firms can leverage the benefits of cloud-based platforms while maintaining the security and confidentiality required in legal practice. As always, it's crucial to stay informed about the latest developments in legal technology and security to ensure your firm's practices remain both efficient and ethically compliant.

MTC

Happy Lawyering!

🎙️Ep. 99: Navigating the Intersection of Law Ethics and Technology with Jayne Reardon.

Meet Jayne Reardon, a nationally renowned expert on legal ethics and professionalism who provides ethics, risk management, and regulatory advice to lawyers and legal service providers. Jayne is an experienced trial lawyer who has tried cases in state and federal courts across Illinois and on appeal up to the United States Supreme Court. She also sits on the national roster of the American Arbitration Association for Commercial and Consumer Arbitration. Moreover, she is a certified neutral in the Early Dispute Resolution Process. Jayne's experience includes service as Executive Director of the Illinois Supreme Court Commission on Professionalism, an organization dedicated to promoting ethics and professionalism among lawyers and judges, and disciplinary counsel for the Illinois Attorney Registration and Disciplinary Commission.

In today's conversation, Jayne explores ethical concerns for lawyers using AI, focusing on ABA Model Rules. She also discusses billing ethics, advising transparency in engagement letters and time tracking. Furthermore, Jayne highlights online civility, warning against impulsive posts and labeling, and real-life cases to underscore the importance of ethical vigilance in AI-integrated legal practice.

Join Jane and me as we discuss the following three questions and more!

1. What are your top three warnings to lawyers about using AI in line with the ABA model rules of ethics?

2. Some lawyers are creating DIY services online through chatbots, AI for clients, through chatbots and AI for clients to handle their legal affairs. What are the top three ethical concerns these lawyers should be wary of when creating these services?

3. What are your top three suggestions about lawyers being civil to one another and others online?

In our conversation, we cover the following:

[01:11] Jayne's Current Tech Setup

[04:50] Handling Tech Devices and Daily Usage

[08:51] Ethical Considerations for AI in Legal Practice

[19:21] Ethical Considerations for AI-Assisted Services

[26:37] Civility in Online Interactions

[30:58] Connect with Jayne

Resources:

Connect with Jayne:

• E-mail: jayne.reardon@fisherbroyles.com

• LinkedIn: linkedin.com/in/jaynereardon/

Hardware mentioned in the conversation:

• AirPods: apple.com/airpods/

• Apple Watch: apple.com/watch/

• iPad: apple.com/ipad/

• iPhone: apple.com/iphone/

• Mac: apple.com/mac/

• PC (Windows device): microsoft.com/en-us/windows

Software & Cloud Services mentioned in the conversation:

• LexisNexis AI: lexisnexis.com/en-us/gateway.page

• Westlaw AI: legal.thomsonreuters.com/en/products/westlaw-edge

* the “W-Calendar” program I refered to apparently is no longer an active software program available for purchase.

The AI Revolution in Law: Adapt or Be Left Behind (& where the bar associations are on the topic).

Its a pivotal moment for attorneys as generative ai has made a huge impact on the field of law.

Recently in a groundbreaking revelation at the 2024 Clio Cloud Conference, Jack Newton, CEO and founder of CLIO, unveiled a startling statistic that's set to reshape the legal landscape. "79% of legal professionals [are] now incorporating AI tools into their daily work—a significant jump from just 19% in 2023" Newton announced, highlighting an unprecedented rate of technology adoption in the legal sector.

This meteoric rise in AI usage among lawyers is not just impressive; it's transformative. Newton emphasized the critical nature of this shift, stating, "If you don't embrace AI, you are at a fundamental competitive disadvantage, and you will lose". Despite this blogs ongoing drum beat that AI is significantly impacting the practice of law, his words should serve as a wake-up call to legal professionals worldwide: the AI revolution is here, and it's moving faster than any technological advancement we've seen before.

The rapid adoption of AI in law practice isn't just about staying current; it's about survival in an increasingly competitive field. As AI tools become more sophisticated and integrated into daily legal work, lawyers who fail to adapt risk falling behind their tech-savvy counterparts. From streamlining document review to enhancing legal research capabilities, AI is proving to be an indispensable tool in the modern law office.

However, with great power comes great responsibility. As lawyers rush to incorporate AI into their practices, they must navigate the complex ethical landscape that comes with this new technology. State bar associations across the country are scrambling to issue guidelines and ethics opinions to ensure that the use of AI aligns with professional standards and client interests. 

Lawyers who don’t embrace technology and AI into their practice of law are going to find themselves left behind by others who do!

The American Bar Association has taken a lead role in this effort, issuing Formal Opinion 512 on "Generative Artificial Intelligence Tools" in July 2024. This opinion emphasizes that while lawyers need not become AI experts, they must develop a "reasonable understanding of the capabilities and limitations" of the AI tools they use[1]. Many state bars are following suit, Below, I have attempted to provide a comprehensive list of bar associations that have “required,” “suggested,” or are “studying” ethical requirements that lawyers follow when using generative AI in their work.  (This list is up-to-date as of October 27, 2024.)

At The Tech-Savvy Lawyer.Page, we've been at the forefront of this discussion, providing in-depth analyses and practical advice for lawyers navigating the AI landscape. Our recent posts on "Understanding the Ethical Implications of AI in Law Practice" and "The White House's New Ai Guidelines: What Lawyers Need To Know!" offer valuable insights into how to integrate AI tools ethically and effectively.

As the legal profession stands at this technological crossroads, it's clear that embracing AI is no longer optional—it's imperative. Lawyers must not only learn to use these tools but also understand the ethical obligations that come with them. State bar requirements are evolving rapidly, and staying informed is crucial.

The message is clear: adapt, learn, and thrive in this new AI-driven legal landscape, or risk being left behind. The future of law is here, and it's powered by artificial intelligence. Are you ready to lead the charge?

MTC

List of Bar Associations that have “REQUIRED,” “SUGGESTED,” or are “STUDYING” Ethical Requirements that lawyers follow when using generative AI in their work.  (This list is up-to-date as of October 27, 2024.)

📋

List of Bar Associations that have “REQUIRED,” “SUGGESTED,” or are “STUDYING” Ethical Requirements that lawyers follow when using generative AI in their work.  (This list is up-to-date as of October 27, 2024.) 📋

Required:

1. California State Bar - https://calawyers.org/california-lawyers-association/ethics-guidelines-for-lawyers-using-generative-ai/

2. DC Bar Association - https://www.dcbar.org/for-lawyers/legal-ethics/ethics-opinions-210-present/ethics-opinion-388

3. Florida Bar - https://news.bloomberglaw.com/litigation/ai-guidance-from-florida-bar-builds-on-familiar-ethics-rules

4. Illinois State Bar Association - https://www.isba.org/sections/ai

5. Iowa State Bar Association - https://www.iowabar.org/?blAction=showEntry&blogEntry=111125&pg=IowaBarBlog

6. Missouri Bar - https://mo-legal-ethics.org/informal-opinion/2024-11/

7. New Hampshire Bar Association - https://www.nhbar.org/using-artificial-intelligence-in-practice/

8. New Jersey State Bar Association - https://njbiz.com/nj-supreme-court-releases-preliminary-ai-guidelines-for-lawyers/

9. North Carolina Bar Association - https://nydailyrecord.com/2024/03/04/north-carolina-adds-to-growing-body-of-ai-ethics-guidance-for-lawyers/

10. Oregon State Bar - https://www.osbar.org/bulletin/issues/2024/2024April/offline/download.pdf

11. Pennsylvania Bar Association - https://www.lawnext.com/2024/06/new-legal-ethics-opinion-cautions-lawyers-you-must-be-proficient-in-the-use-of-generative-ai.html

12. Utah State Bar - https://www.jdsupra.com/legalnews/utah-adopts-new-ai-disclosure-law-that-3770503/

13. Virginia State Bar - https://nydailyrecord.com/2024/08/30/practical-and-adaptable-ai-guidance-arrives-grom-the-virginia-state-bar/

14. Washington State Bar Association - https://watech.wa.gov/policies/interim-guidelines-purposeful-and-responsible-use-generative-artificial-intelligence-ai-washington

Suggested:

1. Hawaii Bar Association - https://histatelawlibrary.com/about/artificial-intelligence-usage-recommendations/

2. Kentucky State Bar - https://cdn.ymaws.com/www.kybar.org/resource/resmgr/ethics_opinions_(part_2)_/kbae457artificialintelligenc.pdf

3. Louisiana State Bar Association - http://www.lsba.org/documents/News/LSBANews/LASCLetterAI.pdf

4. Massachusetts Bar Association - https://natlawreview.com/article/american-bar-association-issues-formal-opinion-use-generative-ai-tools

5. Michigan State Bar - https://www.michbar.org/journal/Details/Lawyering-in-the-age-of-GenAI?ArticleID=4873

6. Minnesota State Bar Association - https://www.mnbar.org/resources/publications/bench-bar/columns/2024/09/03/ethics-guidance-for-generative-ai-use

7. New York State Bar Association - https://associationsnow.com/2024/04/legal-group-ai-guidelines/

8. Oklahoma Bar Association - https://www.okbar.org/barjournal/september-2024/a-cautionary-tale/

9. Tennessee Bar Association - https://www.tba.org/?blAction=showEntry&blogEntry=110838&pg=LawBlog

10. West Virginia State Bar - https://www.intelligencer.net/news/top-headlines/2024/06/legal-watchdog-provides-west-virginia-attorneys-guidance-on-ai/

Studying:

1. Alabama State Bar Association - https://www.attorneysinsurancemutual.com/post/aba-issues-first-ethics-guidance-on-a-lawyer-s-use-of-artificial-intelligence-tools-alabama-and-ten

2. Colorado Bar Association - https://cl.cobar.org/features/the-legal-ethics-of-generative-ai-part-3/

3. Delaware State Bar Association - https://media1.dsba.org/public/Publications/BarJournal/January2024DSBABarJournal.pdf

4. Georgia State Bar - https://natlawreview.com/article/american-bar-association-issues-formal-opinion-use-generative-ai-tools

5. Mississippi Bar Association - https://www.phelps.com/insights/the-mississippi-bar-presents-benefits-of-artificial-intelligence-in-law-practice.html

6. Montana State Bar - https://www.montanabar.org/Membership-Regulatory/Ethics-Resources

7. Nevada State Bar - https://nvbar.org/events/cle-ai-and-the-practice-of-law/

8. South Carolina Bar Association - https://www.americanbar.org/news/abanews/aba-news-archives/2024/07/aba-issues-first-ethics-guidance-ai-tools/

9. Texas State Bar - https://www.law.com/texaslawyer/2024/07/22/new-ai-legal-ethics-rules-coming-texas-state-bar-drafting-recommendations-on-artificial-intelligence/

MTC: Navigating the Perils of Online Reviews!

How lawyers handle online reviews can be a matter of your bar license!

In today's digital age, lawyers must be increasingly cautious about their online presence and interactions. A recent case involving an Illinois attorney serves as a stark reminder of the potential consequences of mishandling online reviews. Let's explore the key takeaways and best practices for legal professionals in the digital realm.

The Cautionary Tale

An Illinois attorney recently faced bar charges for his response to negative online reviews[1]. This incident highlights the importance of maintaining professionalism and ethical standards, even in the face of criticism on digital platforms.

What Not to Do with Online Reviews

Don't Disclose Confidential Information

The attorney in question allegedly revealed confidential client information in his responses to negative reviews[1]. This is a fundamental breach of attorney-client privilege and can lead to severe consequences, including disciplinary action from the bar.

Avoid Emotional Responses

Not all reviews are going to be great - lawyers need to be mindful they handle them.

It's natural to feel defensive when faced with criticism, but responding emotionally can lead to poor decision-making. The Illinois attorney's responses were described as "intemperate" and "discourteous"[1], which only exacerbated the situation.

Don't Engage in Harassment

The charges against the attorney included allegations of harassment[1]. It's crucial to remember that any form of harassment, whether online or offline, is unacceptable and can result in serious professional repercussions.

Best Practices for Handling Online Reviews

Maintain Professional Composure

When faced with a negative review, take a step back and compose yourself before responding. A calm, professional response is always more effective than an emotional outburst.

Respect Client Confidentiality

Never disclose any information about a client or case without explicit permission, even if you're trying to defend yourself against criticism. Client confidentiality is paramount and must be maintained at all times.

Respond Thoughtfully and Constructively

always “act” and “not react” to negative online reviews!

If you choose to respond to a review, do so in a way that addresses the concerns raised without becoming defensive or confrontational. Focus on providing factual information and expressing a willingness to resolve any issues.

Consider Not Responding

In some cases, the best course of action may be to not respond at all. If a review is particularly inflammatory or you're unsure how to respond appropriately, consult with a colleague or seek advice from your bar association.

Proactive Measures

Cultivate Positive Reviews

Encourage satisfied clients to leave reviews on reputable platforms. A strong base of positive reviews can help offset the impact of occasional negative feedback.

Monitor Your Online Presence

Regularly check your online reviews and mentions. Early awareness of negative feedback allows you to address issues promptly and professionally.

lawyers should regularly monitor their online presence!

Implement a Review Response Policy

Develop a clear policy for handling online reviews within your practice. This can help ensure consistent, professional responses across all platforms.

The Bigger Picture

While online reviews can be a valuable tool for potential clients, they also present unique challenges for legal professionals. The case of the Illinois attorney serves as a reminder that the rules of professional conduct apply just as much in the digital world as they do in traditional practice settings.

As tech-savvy lawyers, we must navigate this landscape with care, always prioritizing ethical standards and client confidentiality. By maintaining professionalism in our online interactions, we not only protect ourselves from potential disciplinary action but also uphold the integrity of our profession in the digital age.

Remember, in the world of online reviews, discretion and professionalism are your best allies. Let's use technology to enhance our practices, not compromise them.

MTC

Happy Lawyering!

MTC: What is the common sense approach lawyers can learn from 23andMe’s recent client data breach?

What can 23andme’s client data breach teach lawyers about keeping their own client’s data secure?

I can’t stress enough that as legal professionals, we bear a dual responsibility when it comes to personal identification information (PII): safeguarding our own data and protecting our clients' sensitive information. 

The 23andMe Incident: A Wake-Up Call

Last week’s report of the 23andMe breach serves as a stark reminder of the vulnerabilities inherent in storing sensitive personal information online. Hackers gained access to user profiles, including genetic data, names, birth years, and ancestry report. This incident underscores the need for heightened awareness and caution when sharing personal identification information (PII) with online companies. THIS data breach serves as a perfect reminder of the critical importance of data security in our increasingly digital world, especially for those of us in the legal field.

Legal Ethics and Client Confidentiality

The cornerstone of the attorney-client relationship is confidentiality, extending far beyond our physical offices in today's digital age. We are bound by ethical rules mandating the protection of client information. The American Bar Association's Model Rule 1.6(c) explicitly states that "A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” But our legal ethics responsibilities just don’t stop there!

Even small law firms are not immune from cyberattacks!

ABA Model Rule 1.1 Comment 8 (Rule 1.1[8]) requires lawyers to stay informed about changes in the law and its practice, including the benefits and risks associated with relevant technology. This comment explicitly recognizes that competent representation in today's legal landscape involves understanding and effectively using pertinent technology. Lawyers must be aware of the security levels, general operational status, and potential risks and actual data breaches of the services and software they use, both in-office and cloud-based. While the goal isn't to transform lawyers into tech experts, it's crucial that we can leverage technology (even with the assistance of more technically proficient experts) to provide efficient, effective, and ethical legal services to our clients.

Implications of Data Breaches

The 23andMe incident highlights the potential consequences of a data breach, which for lawyers could include:

1. Violation of ethical obligations

2. Potential malpractice claims

3. Loss of client trust and reputation damage

4. Regulatory penalties and sanctions

Protecting Client and Our Own Information in the Digital Age

To fulfill our ethical obligations and protect our clients' PII, we must implement robust data security measures:

Secure Data Storage and Transmission

Utilize encrypted cloud storage solutions and secure file transfer protocols when handling client data. Avoid using public Wi-Fi networks for accessing or transmitting sensitive information. And if you do, be sure to use a reliable Virtual Private Network (VPN) when on public Wi-Fi.

Client Communication Practices

Lawyers need not be tech experts but they need to know how to use tech to not only for their clients but use it to protect their client’s Data.

Implement secure client portals for document sharing and communication. Educate clients on the risks of sending sensitive information via unsecured email, and advise them on what information should never be shared electronically.

Vendor Due Diligence

Carefully vet third-party service providers, ensuring they adhere to stringent data protection standards. This includes practice management software, e-discovery platforms, and cloud storage providers.

Here are Some Best Practices for Personal and Professional Data Protection

1. Implement strong authentication: Use multi-factor authentication for all professional and personal accounts. Consider using a password manager that creates and stores complex passwords.

2. Separate personal and professional online presence: Maintain distinct profiles and accounts for personal and professional use.

3. Regularly update security measures: Stay informed about the latest cybersecurity threats and update your protection strategies accordingly.

4. Minimize data sharing: Critically assess what personal information is truly necessary to share online, and refrain from providing sensitive data unless absolutely essential.

Lawyers Are Important Participants to the Future Legal Landscape 

The 23andMe breach raises important questions about the adequacy of current data protection laws. As legal professionals, we have a responsibility to:

1. Advocate for stronger data protection legislation: Support and contribute to the development of comprehensive data privacy laws that protect individuals and businesses.

2. Stay informed on data privacy regulations: Keep abreast of evolving laws such as The European Union's General Data Protection Regulation (GDPR) and California's Consumer Privacy Act (CCPA), and industry-specific regulations like Health Insurance Portability and Accountability Act (HIPAA).

3. Advise clients on data protection: Provide guidance on compliance with data protection laws and best practices for safeguarding sensitive information, including when to refrain from sharing certain types of data altogether.

maybe we don’t need to put all of our information on the internet?

The Fundamental Lesson: Some Data Should Never Be Shared

Perhaps the most crucial takeaway from the 23andMe incident is that certain types of information are so sensitive and personal that they may not belong in anyone else's hands, regardless of the security measures in place. This is particularly true for genetic data, which is immutable and deeply personal. As lawyers, we must critically evaluate what information truly needs to be shared or stored externally, always erring on the side of caution.

My Final Thoughts

The 23andMe incident serves as a critical reminder of the vulnerabilities inherent in our digital ecosystem and the importance of discerning what information should never be shared. As lawyers, we must be at the forefront of data protection efforts, not only to safeguard our own information but also to uphold our ethical obligations to our clients. By implementing robust security measures, staying informed about evolving threats and regulations, and advocating for stronger data protection laws, we can help mitigate the risks associated with sharing PII in our increasingly interconnected world.

In this digital age, protecting personal identification information is not just a matter of individual privacy—it's a fundamental aspect of legal ethics and professional responsibility. As tech-savvy lawyers, we must lead by example in implementing and promoting best practices for data security, ensuring that we maintain the trust and confidentiality that form the bedrock of our profession. Most importantly, we must always question whether certain information needs to be shared at all, recognizing that the best protection sometimes lies in not disseminating sensitive data in the first place.

MTC

MTC: Lawyers and Law Firms: Think Twice Before Implementing Bossware!

Bossware does not help develop employee moral!

In the legal profession, where confidentiality and trust are paramount, the use of employee monitoring software, or "bossware," may seem like an attractive solution for managing productivity and ensuring security. However, law firms and legal departments should carefully consider the potential risks and drawbacks before implementing such tools.

The Allure of Bossware

It's understandable why some legal professionals might be tempted by bossware. The ability to track billable hours, monitor case progress, and ensure compliance with ethical guidelines can be appealing. Moreover, with the rise of remote work, there's a natural desire to maintain oversight and productivity.

Legal and Ethical Concerns

However, the use of bossware in legal settings raises significant legal and ethical concerns:

• Client Confidentiality: Monitoring software that captures screenshots, records keystrokes, or accesses webcams could potentially compromise attorney-client privilege and violate ethical obligations.

• Employee Privacy: Lawyers are well-versed in privacy laws and should be particularly sensitive to the invasion of privacy that bossware represents.

• Labor Law Violations: The National Labor Relations Board has signaled its intention to protect employees from intrusive electronic monitoring, which could lead to legal challenges for firms using bossware.

Productivity Paradox

Studies show that bossware can lead to decreased not increased productivity!

While bossware is often implemented with the goal of increasing productivity, it may have the opposite effect:

• Stress and Anxiety: Research shows that 56% of monitored employees feel stress and anxiety about surveillance, which can lead to decreased productivity and burnout.

• Counterproductive Behaviors: Monitored employees are more likely to engage in rule-breaking behaviors, including taking unapproved breaks and purposefully working at a slow pace.

• Trust Erosion: In a profession built on trust, implementing invasive monitoring tools can severely damage the relationship between partners, associates, and staff.

Security Risks

Ironically, bossware can create new security vulnerabilities:

• Data Breaches: Collecting extensive personal data through monitoring software increases the risk and potential impact of data breaches.

• Shadow IT: Employees may resort to using personal devices or unauthorized software to avoid surveillance, creating new security risks.

Alternative Approaches

Instead of relying on intrusive monitoring, law firms and legal departments should consider alternative strategies:

• Focus on Outcomes: Evaluate employees based on the quality and timeliness of their work rather than micromanaging their daily activities.

• Transparent Policies: If any monitoring is necessary, be fully transparent about what data is collected and why.

• Minimal Data Collection: Adopt a "data minimization" approach, collecting only the information absolutely necessary for legitimate business purposes.

• Invest in Culture: Foster a culture of trust, open communication, and mutual respect, which can naturally boost productivity and engagement.

Final Thoughts

While the temptation to implement bossware may be strong, especially in a profession as detail-oriented as law, the potential risks far outweigh the perceived benefits. Law firms and legal departments should lead by example, respecting employee privacy and fostering a culture of trust. By focusing on outcomes rather than surveillance, legal employers can maintain productivity and security without compromising their ethical standards or risking legal challenges.

In an era where privacy concerns are at the forefront of legal and societal discussions, lawyers should be at the vanguard of protecting individual rights, starting with their own employees. The legal profession has always been about upholding justice and ethical standards – let's ensure that these principles extend to how we treat our own.

MTC

PSA: Phishing Awareness Training: Protecting Your Law Firm from Cyber Threats!

Be aware of “Phishing” as it can jeopardize your office’s cybersecurity!

For October 2024’s Cybersecurity Month, we need to remember that in today's digital age, law firms are increasingly becoming targets of sophisticated cyber attacks, with phishing being one of the most prevalent and dangerous threats. As legal professionals, we handle sensitive client information and confidential data daily, making it crucial to stay vigilant against these malicious attempts. This article will explore the importance of phishing awareness training for law firms and provide practical strategies to safeguard your practice.

Understanding the Phishing Threat Landscape

Phishing attacks have evolved significantly over the years, becoming more targeted and convincing. Cybercriminals often employ social engineering tactics to manipulate unsuspecting victims into divulging sensitive information or clicking on malicious links. For law firms, the consequences of a successful phishing attack can be devastating, potentially leading to data breaches, financial losses, and reputational damage.

The Importance of Comprehensive Training

One key strategy in combating phishing attacks is to conduct regular phishing awareness training sessions. These sessions should educate legal professionals on how to spot and avoid phishing attempts, emphasizing the importance of verifying sender identities and checking for red flags in emails.

Best Practices for Phishing Defense

To mitigate cybersecurity risks and safeguard sensitive information effectively, legal professionals should be trained on the following best practices:

1. Implement multi-factor authentication and encryption protocols

2. Encourage a culture of vigilant reporting for suspicious activities

3. Verify sender identities before responding to emails

4. Check for red flags such as misspellings or urgent requests for personal information

5. Avoid clicking on suspicious links or downloading attachments from unknown sources

Effective Training Strategies

“Phishing” is a cyber attack where scammers impersonate legitimate entities to trick individuals into revealing sensitive information, like passwords or financial details.

To ensure that your phishing awareness training program is effective and engaging, consider implementing the following strategies:

Simulated Phishing Exercises

Conducting simulated phishing exercises can provide practical, hands-on experience for your legal team. These exercises help staff members identify common tactics employed by cybercriminals and improve their ability to detect suspicious emails.

Interactive Learning Modules

Incorporate interactive learning modules into your training program to reinforce key concepts and best practices in cybersecurity. These modules can include quizzes, case studies, and scenario-based learning to keep participants engaged and enhance knowledge retention.

Continuous Training and Updates

Given the ever-evolving nature of cyber threats, it's crucial to ensure that training is an ongoing process rather than a one-time event. Regular refresher courses and updates on emerging threats can help your legal staff remain vigilant and prepared to defend against phishing attacks.

Creating a Culture of Cybersecurity Awareness

Fostering a culture of cybersecurity awareness within your law firm is essential for long-term success in combating phishing threats. Here are some strategies to achieve this:

1. Lead by example: Ensure that partners and senior staff members actively participate in training sessions and demonstrate good cybersecurity practices.

2. Encourage open communication: Create an environment where staff members feel comfortable reporting suspicious emails or potential security breaches without fear of repercussions.

3. Recognize and reward vigilance: Acknowledge and reward employees who successfully identify and report phishing attempts, reinforcing the importance of staying alert.

Handling Suspicious Emails and Potential Phishing Attacks

Cyber security awareness should not just be practiced once a month every year but every day!

It's crucial to provide clear guidelines on how legal staff should handle suspicious emails or suspected phishing attacks:

1. Avoid clicking on any links or providing personal information.

2. Report the suspicious email to the IT department or security team immediately.

3. If a potential phishing attack is suspected, change passwords immediately and monitor accounts for any suspicious activity.

Implementing a Comprehensive Phishing Awareness Program

To create an effective phishing awareness program for your law firm, consider the following steps:

1. Conduct a risk assessment to identify vulnerabilities specific to your firm

2. Develop tailored training materials that address your firm's unique needs

3. Implement regular training sessions for all staff members, including lawyers and support staff

4. Use a variety of training methods, such as in-person workshops, online modules, and simulated phishing exercises

5. Regularly evaluate and update your training program to address new threats and evolving tactics

Leveraging Technology to Enhance Phishing Defense

While training is crucial, it's also important to leverage technology to strengthen your firm's defenses against phishing attacks. Consider implementing the following tools and strategies:

1. Email filters and anti-spoofing tools to reduce the number of phishing emails reaching users' inboxes

2. Anti-spoofing solutions to identify and remove impostor websites before they can deceive your users

3. Email server authentication to prevent email spoofing and improve the overall security of your firm's email communications

Measuring the Success of Your Phishing Awareness Program

being cyber aware and cyber secure can easily be seen as a MPR 1.1[8] Requirement!

To ensure the effectiveness of your phishing awareness training, it's important to track and measure its success. Consider the following metrics:

1. Reduction in successful phishing attempts

2. Increase in reported suspicious emails

3. Improved performance in simulated phishing exercises

4. Higher scores on cybersecurity knowledge assessments

My Final Thoughts

As legal professionals, we have a responsibility to protect our clients' sensitive information and maintain the integrity of our practices. By implementing a comprehensive phishing awareness training program and fostering a culture of cybersecurity awareness, we can significantly reduce the risk of falling victim to these malicious attacks.

Remember, cybersecurity is an ongoing process, and staying informed about the latest threats and best practices is crucial. By investing in regular training and leveraging technology, we can create a robust defense against phishing attacks and ensure the long-term security of our law firms.

Happy Lawyering!

Shout Out: Your The Tech-Savvy Lawyer Blogger/Award-Winning Podcaster Will Be A Speaker at the 2025 ABA Techshow!

I’ll be co-presenting on two sessions in chicago at the aba techshow 2025!

I'm thrilled to share some exciting news with The Tech-Savvy Lawyer community! I've been invited to speak at the ABA Techshow 2025, taking place April 2-5, 2025, at the Hyatt Regency McCormick Place. This annual event brings together the brightest minds in legal technology, and I'm honored to contribute my expertise. I'll be co-presenting two sessions: "How to Leverage Video to Build Your Brand, Dominate SEO, and Attract The Best Clients" and "Innovations in Client Intake: Leveraging Technology for Better Outcomes." I'm looking forward to sharing insights and connecting with fellow legal tech enthusiasts.

I can’t wait to see you all there!!!

Stay tuned for more details on this incredible opportunity!