MTC: What is the common sense approach lawyers can learn from 23andMe’s recent client data breach?

What can 23andme’s client data breach teach lawyers about keeping their own client’s data secure?

I can’t stress enough that as legal professionals, we bear a dual responsibility when it comes to personal identification information (PII): safeguarding our own data and protecting our clients' sensitive information. 

The 23andMe Incident: A Wake-Up Call

Last week’s report of the 23andMe breach serves as a stark reminder of the vulnerabilities inherent in storing sensitive personal information online. Hackers gained access to user profiles, including genetic data, names, birth years, and ancestry report. This incident underscores the need for heightened awareness and caution when sharing personal identification information (PII) with online companies. THIS data breach serves as a perfect reminder of the critical importance of data security in our increasingly digital world, especially for those of us in the legal field.

Legal Ethics and Client Confidentiality

The cornerstone of the attorney-client relationship is confidentiality, extending far beyond our physical offices in today's digital age. We are bound by ethical rules mandating the protection of client information. The American Bar Association's Model Rule 1.6(c) explicitly states that "A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” But our legal ethics responsibilities just don’t stop there!

Even small law firms are not immune from cyberattacks!

ABA Model Rule 1.1 Comment 8 (Rule 1.1[8]) requires lawyers to stay informed about changes in the law and its practice, including the benefits and risks associated with relevant technology. This comment explicitly recognizes that competent representation in today's legal landscape involves understanding and effectively using pertinent technology. Lawyers must be aware of the security levels, general operational status, and potential risks and actual data breaches of the services and software they use, both in-office and cloud-based. While the goal isn't to transform lawyers into tech experts, it's crucial that we can leverage technology (even with the assistance of more technically proficient experts) to provide efficient, effective, and ethical legal services to our clients.

Implications of Data Breaches

The 23andMe incident highlights the potential consequences of a data breach, which for lawyers could include:

1. Violation of ethical obligations

2. Potential malpractice claims

3. Loss of client trust and reputation damage

4. Regulatory penalties and sanctions

Protecting Client and Our Own Information in the Digital Age

To fulfill our ethical obligations and protect our clients' PII, we must implement robust data security measures:

Secure Data Storage and Transmission

Utilize encrypted cloud storage solutions and secure file transfer protocols when handling client data. Avoid using public Wi-Fi networks for accessing or transmitting sensitive information. And if you do, be sure to use a reliable Virtual Private Network (VPN) when on public Wi-Fi.

Client Communication Practices

Lawyers need not be tech experts but they need to know how to use tech to not only for their clients but use it to protect their client’s Data.

Implement secure client portals for document sharing and communication. Educate clients on the risks of sending sensitive information via unsecured email, and advise them on what information should never be shared electronically.

Vendor Due Diligence

Carefully vet third-party service providers, ensuring they adhere to stringent data protection standards. This includes practice management software, e-discovery platforms, and cloud storage providers.

Here are Some Best Practices for Personal and Professional Data Protection

1. Implement strong authentication: Use multi-factor authentication for all professional and personal accounts. Consider using a password manager that creates and stores complex passwords.

2. Separate personal and professional online presence: Maintain distinct profiles and accounts for personal and professional use.

3. Regularly update security measures: Stay informed about the latest cybersecurity threats and update your protection strategies accordingly.

4. Minimize data sharing: Critically assess what personal information is truly necessary to share online, and refrain from providing sensitive data unless absolutely essential.

Lawyers Are Important Participants to the Future Legal Landscape 

The 23andMe breach raises important questions about the adequacy of current data protection laws. As legal professionals, we have a responsibility to:

1. Advocate for stronger data protection legislation: Support and contribute to the development of comprehensive data privacy laws that protect individuals and businesses.

2. Stay informed on data privacy regulations: Keep abreast of evolving laws such as The European Union's General Data Protection Regulation (GDPR) and California's Consumer Privacy Act (CCPA), and industry-specific regulations like Health Insurance Portability and Accountability Act (HIPAA).

3. Advise clients on data protection: Provide guidance on compliance with data protection laws and best practices for safeguarding sensitive information, including when to refrain from sharing certain types of data altogether.

maybe we don’t need to put all of our information on the internet?

The Fundamental Lesson: Some Data Should Never Be Shared

Perhaps the most crucial takeaway from the 23andMe incident is that certain types of information are so sensitive and personal that they may not belong in anyone else's hands, regardless of the security measures in place. This is particularly true for genetic data, which is immutable and deeply personal. As lawyers, we must critically evaluate what information truly needs to be shared or stored externally, always erring on the side of caution.

My Final Thoughts

The 23andMe incident serves as a critical reminder of the vulnerabilities inherent in our digital ecosystem and the importance of discerning what information should never be shared. As lawyers, we must be at the forefront of data protection efforts, not only to safeguard our own information but also to uphold our ethical obligations to our clients. By implementing robust security measures, staying informed about evolving threats and regulations, and advocating for stronger data protection laws, we can help mitigate the risks associated with sharing PII in our increasingly interconnected world.

In this digital age, protecting personal identification information is not just a matter of individual privacy—it's a fundamental aspect of legal ethics and professional responsibility. As tech-savvy lawyers, we must lead by example in implementing and promoting best practices for data security, ensuring that we maintain the trust and confidentiality that form the bedrock of our profession. Most importantly, we must always question whether certain information needs to be shared at all, recognizing that the best protection sometimes lies in not disseminating sensitive data in the first place.

MTC

My Two Cents: How President Biden’s Executive Order on AI Impacts the Practice of Law - it does and doesn't.

President Biden's recent Executive Order (Order) on Safe, Secure, and Trustworthy Artificial Intelligence marks a significant milestone in the governance of AI technologies. This comprehensive directive aims to establish robust standards for AI safety and security. Its goals include protecting privacy and civil rights while promoting innovation and protecting intellectual property rights. For attorneys, this announcement is of paramount importance as it directly impacts the practice of law, introducing new dimensions to legal compliance, ethical considerations, and the overall legal landscape. Legal innovators and industrialists like Jack Newton, CEO of CLIO, see this Order as an important step taken by the government: I am hopeful that the newly introduced AI legislation will not only uphold the highest standards of security and privacy but also ensure equitable access and unbiased application within legal frameworks.

Here is a summary of the impact it will have on lawyers:

AI Safety and Security:

The Order mandates developers of powerful AI systems to share safety test results and critical information with the U.S. government. For attorneys, this introduces a new layer of compliance and due diligence. Legal professionals will need to guide their clients through these requirements, ensuring that AI systems adhere to the mandated safety and security standards. This is particularly crucial for companies dealing with AI technologies that pose serious risks to national security or public health. Likewise, lawyers representing parties who have been harmed by a company's use of AI will need to know the latest in AI technology in order to advocate the best strategy for their clients.

Privacy and Data Protection:

With AI’s capability to extract and exploit personal data, the Order calls for heightened privacy protections. The directive’s emphasis on privacy-preserving techniques and evaluation of data collection practices necessitates an attorney’s thorough understanding of AI technologies and their implications on privacy. Attorneys will play a crucial role in advising clients on data protection strategies, ensuring compliance with privacy laws, and navigating the legal complexities of AI-driven data processing. Attorneys must also ensure their use of AI in their practice protects their client’s Personal Identifiable Information (PII).

Equity and Civil Rights:

The Order addresses the potential of AI to perpetuate discrimination and bias, particularly in sectors like housing, healthcare, and criminal justice. Legal professionals will need to stay vigilant, ensuring that AI systems employed by their clients do not result in discriminatory outcomes or violate civil rights. Likewise, Attorneys who are prosecuting parties using AI to discriminate against members of the public will need to have a solid understanding of how AI works in these matters.

Consumer Protection:

the president’s order will likley set forth new regulations and policies that will affect most practicing lawyers.

AI technologies can potentially transform consumer experiences but also raise concerns about potential harms and deceptive practices. The Executive Order calls for standards and best practices to detect AI-generated content and authenticate official communications. Attorneys working in consumer protection will need to familiarize themselves with these standards, advising clients on compliance, advising clients who are victims, and addressing potential legal challenges arising from AI-driven consumer interactions.

Immigration Law

Although the Order is not directly focused on immigration law, it could indirectly affect the field. One specific aspect of the Order calls for using existing authorities to expand the ability of highly skilled immigrants and nonimmigrants with expertise in critical areas, including AI, to study, stay, and work in the United States. This could lead to changes in visa criteria and processes, potentially affecting how immigration attorneys advise clients in the tech sector. The emphasis on AI could lead to a higher demand for skilled workers in this field, possibly influencing the landscape of employment-based immigration. Immigration lawyers may need to stay updated on any new policies or procedural changes resulting from this Order to guide their clients through the visa application process.

Supporting Workers:

The impact of AI on the workforce is a critical aspect of the Order. Attorneys specializing in labor law will find this directive particularly pertinent, as it addresses issues related to job displacement, workplace equity, and labor standards. Legal professionals will play a vital role in navigating the legal complexities of AI in the workplace, ensuring that workers’ rights are protected, and advising employer-clients on best practices to mitigate potential harms.

Promoting Innovation and Competition and Protecting Intellectual Property:

The Order emphasizes the need to maintain America’s leadership in AI innovation and competition. For attorneys working in intellectual property, technology, and antitrust law, this directive underscores the importance of fostering a competitive AI ecosystem while protecting intellectual property rights. Legal professionals will need to stay abreast of developments in AI technologies, advising clients on innovation strategies, and ensuring compliance with copyright, intellectual property, and antitrust laws.

Attorneys Working for the Government:

The Order will affect government attorneys twofold -

First, government attorneys must be abreast of the same issues discussed in this post, like any private attorney. Government attorneys basically have the same legal and ethical duties as private attorneys. They, too, have the same security, bias, privacy, civil rights, and intellectual property concerns private practitioners have with this Order.

Second, government attorneys will be tasked with ensuring that government agencies comply with enhanced AI safety and security protocols, protect privacy, advance equity, defend civil rights, and promote innovation while protecting intellectual property rights. They will also play a critical role in developing and enforcing guidelines for the ethical use of AI within federal operations, potentially influencing procurement processes and the deployment of AI in public services. Moreover, as the government seeks to lead by example in the responsible use of AI, these attorneys will be instrumental in setting precedents that could shape future AI governance across all sectors.

Conclusion:

Lawyers already have an ethical duty to stay abreast of technology advancements including ai.

It is not surprising that as AI continues to evolve, legal professionals will play a crucial role in guiding their clients through this complex terrain. But, the Order does not bring anything new to an attorney’s quiver of responsibilities. With or without the Order, attorneys already have the Model Rules of Professional Conduct to guide them on their duties around technology (including AI). The Rules require us to stay current on AI, its constant changes, and how it may impact their clients—whether attorneys are using AI to assist their clients or if their clients or those whom attorneys are advocating against are using AI in their business.  Reference Model Rules 1.1, 1.1[8], 1.3, 1.4 & 1.6.  So, don't let the Order serve as a starting point.  Let it serve as a reminder that we must stay competent in our use and understanding of technology as it applies to our work in the legal arena.

Sound Quality versus Privacy – What is more important to a lawyer in a smart speaker?

Sound Quality versus Privacy – What is more important to a lawyer in a smart speaker?

MacRumors came out with an article comparing the mini-smart speakers currently on the market.  The candidates are the Amazon's Echo, Apple’s Homepod mini and Google's Nest Audio. They all retail for about $99.  It looks like hands down the Echo and Nest beat the Homepod-mini for quality and depth of music.

The audio specs break down:

• Echo: 76mm woofer and two 20mm tweeters.

• ‌HomePod mini‌: Full range driver and dual passive radiators.

• Nest Audio: 75mm woofer and one 19mm tweeter.

BUT IS SOUND QUALITY WORTH THE TRUE “COST” OF THE DEVICE:

Certainly, if you are vested in the Amazon Alexa or Google Assistant platforms, I can see the draw to remain in the respective platforms’ microverse.  But sound quality and smart-assistant integration are not THE major concern for attorneys – It’s Privacy!

Amazon Alex and Google Assistant do not have a great reputation for protecting your privacy.  Apple Homepods have had its share of fairly recent problems too!  But Apple’s Siri is more active in protecting your privacy.  The inherency of its “sandboxed” software makes it more likely prying eyes 👀 (or in this case ears 👂🦻!) will not be obtaining your private or your client’s confidential information!

PROFESSIONAL RESPONSIBILITY ALERT!
Remember, the Model Rules of Professional Conduct require you have to be both competent in your use of technology in your office Rule 1.1 [8] and take reasonable efforts to ensure your client’s information is protected, Rule 1.6 (c).

Granted, I am a Mac user in my private practice.  So, I would naturally gravitate toward Homepods.  But I do use Windows machines when it comes to the blog.  And IMHO the overall risk right now in buying an Amazon Alexa or Google Assistant is just not worth risk – even with the discounts you may be finding on Amazon!

MTC

Happy Lawyering!!!