Thoughts on Email Encryption Michael Kennedy Bar Counsel 1 - - PDF document

8/29/2016 1

2016 National Federation of Paralegal Associations Annual Conference and Policy Meeting

E‐Mail Encryption Tech Ethics Online Reputation Management

Thoughts on Email Encryption

Michael Kennedy Bar Counsel

8/29/2016 2

Rule 1.6

• A lawyer shall not reveal

– Information relating to the representation of a client – Unless the client gives informed consent , or, – The disclosure is impliedly authorized to carry out the representation; or – The disclosure is required or permitted by this rule

Information Relating to the Representation

• Is much broader than the a/c privilege
• “applies not only to maters communicated in

confidence by the client, but to all information relating to the representation, no matter the source.” Comment [4]

8/29/2016 3

Duty to Preserve Confidentiality

• “A lawyer must act competently to safeguard

information relating to the representation of a client against inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client or who are subject to the lawyer’ supervision.”

• Rule 1.6, Comment [16]

Comment 17

• When transmitting information relating to the

representation, lawyer must:

• Take reasonable precautions to prevent

information from coming into hands of unintended recipients

8/29/2016 4

Comment 17

• Lawyer’s duty:

– Does not require lawyer to take special security measures – As long as the method of communication affords a reasonable expectation of privacy

Comment 17

• Special circumstances might warrant special

precautions.

– Sensitivity of the communication – Extent to which privacy of info is protected by law

• r by security agreement

8/29/2016 5

Comment 17

• However, a client may require the lawyer to

implement special security measures not required by this rule OR May give informed consent to use of a means of communication otherwise prohibited by this rule

Competently Preserving Confidences

• Rule 1.1 requires lawyers to provide

competent representation.

• Competence includes keeping abreast of

technology and advising clients as to the benefits and risks of relevant technology.

8/29/2016 6

Failing to Act Competently to Protect Confidences

• Ideas as to recent examples in Vermont?

Admonition for Violating Rule 1.6

• PRB Decision 183 (January 2015)

– Clients fire lawyer – Call to ask to stop by to pick up file between 12 ‐2 – Lawyer calls back and says that works – Clients show up, lawyer isn’t there, office is locked. – File on floor in common hallway shared by other tenants in the building

8/29/2016 7

Admonition for Violating Rule 1.6

• PRB Decision 4 (2000)

– Attorney described prior outcome in such detail that new client figured out identity of previous client

Admonition for Violation Rule 1.6

• PRB Decision 3 (2000)
• Lawyer sold her computer. Her work
• computer. It had a hard drive.

8/29/2016 8

E‐Mail

• Right now, in Vermont, what is an attorney’s

duty with respect to using email?

Rule 1.6

• It’s most likely information relating to the

representation.

• So, duty is not to disclose it absent client consent or an

exception.

• Also, duty is to act competently to keep it from falling

into hands of unintended recipients.

• And, to take reasonable precautions with the

transmission.

8/29/2016 9

So, encrypt?

• Thoughts?

Comment 17

• No duty to use special security measures.
• Is encryption a special security measure?

8/29/2016 10

VBA Advisory Opinion 97‐05

• A lawyer does not violate the rules by

communicating with a client via unencrypted email.

• Why not?

VBA Advisory Opinion 97‐05

• Not a violation to communicate via

unencrypted email because:

– 1. no less of an expectation of privacy in email than with an ordinary phone call. – 2. Intercepting an email is against the law. – Also suggests: encryption (and decryption) are difficult and very expensive

8/29/2016 11

Expectation of Privacy

• Things I’ve seen:

– Reply‐all – Shared accounts – Forwarding emails

Against the Law

• Closing the barn door after the horses have

escaped isn’t the best idea.

8/29/2016 12

A Changing Tide – ABA Opinion 11

• When communicating via electronic means, a

lawyer must:

• Warn client about risk if there is a significant

chance a third party might gain access.

• Employers – work issued computers & mobile devices,

and email accounts

• Spouses, significant others, family members

ABA Opinion 11‐459

• Instances of risk will depend on

circumstances.

• Lawyer must consider whether “given the

client’s situation, there is a significant risk that third parties will have access.”

8/29/2016 13

State Bar of California Formal Opinion 2010‐079

• Whether attorney violates duty of confidentiality will depend on particular

circumstances, including:

• Level of security attendant to particular device/technology
• Legal ramifications to third party who intercepts
• Degree of sensitivity of the information
• Possible impact on client of inadvertent disclosure
• Urgency of situation that led to communication
• Client’s instructions regarding means of communication

Competence = Tech Competence

• Cal Bar Opinion cited one factor as:

Ability to ass level of security attendant to particular device/technology

• 1. On the attorney
• 2. Includes how one technology differs from others
• 3. What precautions can, or cannot, be taken with each

technology

• 4. Can third parties access it

8/29/2016 14

• Cal. Bar Opinion 2010‐179
• Encrypting email may be:

– a reasonable step for an attorney to take in an effort to ensure the confidentiality of such communications – Required when the circumstance calls for it, particularly if the information at issue is highly sensitive and the use of encryption is not onerous

Cal Bar Opinion – Attorneys Must Take Steps to Protect Client Confidences

• “Because of the evolving nature of technology

and differences in security features that are available, the attorney must ensure the steps are sufficient for each form of technology being used and must monitor the efficacy of such steps.”

8/29/2016 15

Encryption

• It has become:

–Less expensive –Less burdensome So, is it a reasonable precaution?

State Bar of Wisconsin

• Encryption made easy for lawyers:
• http://www.wisbar.org/NewsPublications/Wis

consinLawyer/Pages/Article.aspx?Volume=86 &Issue=10&ArticleID=11225

8/29/2016 16

Ethics of Online Reputation Management

Think Twice, Be Nice

“Reputational Capital”

• A “measure of trust & goodwill in the marketplace”
• Reputation & goodwill are valuable assets

8/29/2016 17

Online Reviews Matter

• When in need of an attorney:

2005 2014

• Ask friend or relative:

65% 29%

• Internet:

5% 38%

Online Reviews Matter

• 90% of consumers more likely to buy if product

has positive reviews

• 86% of consumers less like to buy if product has

negative reviews

• 70% of clients who went online to find an

attorney said they would be willing to commute farther to an attorney with positive reviews

8/29/2016 18

Clients Most Likely to Find Lawyer Online

• NOT corporate/transactional clients
• More likely:

» Middle to lower income groups » Younger » Facing high conflict

• Conviction/incarceration
• Financial loss
• Family disruption

Lawyer Reviews Increasing

• Historically:

» Amazon – consumer goods » Travel Industry » Resturant Industry » Professional Services

• Doctors
• Teachers
• Lawyers

8/29/2016 19

Motivation to Post Review

• Anger/Dissatisfaction not primary drivers
• Most reviews of doctors/hotels/restaurants

are positive

Motivation to Review Lawyer Online

• Perhaps less likely to be positive
• Reasons:

– Emotionally charged – Most interactions also involve an opposing lawyer – Client’s only “voice”, especially for vast majority of clients who fear confrontation with lawyer

8/29/2016 20

Risks for Lawyers

• Practical

: Usually high sense of self‐esteem/confidence in competence as a lawyer & professional identity : not used to being criticized publicly : potential harm to business success

• Ethical

: Duty to maintain confidentiality of information related to the representation : Duty of loyalty to the client : Duty to refrain from dishonest conduct

Cue

BE NICE, THINK TWICE.

8/29/2016 21

Practical – Be nice!

• Practical

– While negative reviews impact choices, they do not impact as much as improvident responses – Consumers care more about professionalism than particular facts of somebody else’s experience – Consumers will not hire someone who responds defensively, aggressively, or who personally attacks a critic

Ethics – Think Twice

• As Kevin & I have often preached – Rule 1.6 protects all

“information relating to the representation’”

• NO MATTER THE SOURCE
• NO EXCEPTION FOR INFORMATION THAT IS PUBLIC
• MUCH BROADER THAN THE A/C PRIVILEGE

8/29/2016 22

Rule 1.9(c)

• A lawyer who has formerly represented a client shall

not: : Use information relating to the representation to the disadvantage of the former client except as the rules permit or require, or when the information has become generally known; or : Reveal information relating to the representation except as the rules permit or require

In re Skinner, 758 S.E. 2d 788 (Ga. 2014)

• Divorce client fires lawyer for no work, post

negative online reviews

• Lawyer responds with client’s identity,

employer, total legal fee, fact that client has boyfriend.”

• Public reprimand for violation Rule 1.6
• Rule 1.9(c) applies 1.6 principles beyond

termination of representation

8/29/2016 23

In re Tsamis, Illinois ARDC

• Client loses claim for unemployment benefits
• Gives lawyer negative online review:
• “She only wants your money, claims ‘always on

your side is a huge lie. Paid her to help me secure unemployment, she took my money knowing full well a certain law in Illinois would not let me collect unemployment. Now is billing me for an additional $1500 of her time.”

Response from Attorney Tsamis

• “This is simply false. The person did not reveal all the

facts of his situation up front in our first and second

• meeting. {sic} When I received his personnel file, I

discussed the contents of it with him and informed him that he would likely lose unless the employer chose not to contest unemployment. Despite knowing that he would likely lose, he chose to go forward with a hearing to try to obtain benefits. I dislike it very much when my clients lose but I cannot invent positive facts for clients when they are not there. I feel badly for him but his own actions in beating up a female coworker are what caused the consequences he is now so upset

• ver.”

8/29/2016 24

Self‐Defense Exception?

• Rule 1.6(c) allows a lawyer to reveal information relating to

the representation:

– To establish a claim or defense on behalf of the client in a controversy between the lawyer and the client; – To establish a defense to a criminal charge or civil claim against the lawyer based upon conduct in which the client was involved; or, – To respond to allegations in any proceeding concerning the lawyer’s representation of the client.

NYSBA Ethics Opinion 1032

October 30, 2014

• Exception doesn’t apply online.
• Applies to “formal proceedings” in which a

lawyer’s conduct has been placed in issue

• Proceeding must have judicial or quasi‐judicial

imprimatur, where sanction or penalty result

• Not our job to decide whether client’s negative

review is a waiver of the a/c privilege

8/29/2016 25

L.A. County Bar Association Formal Opinion 525 (2012)

• Ethical to respond to online review only if

– Attorney does not disclose confidential info – Attorney does not respond in a manner that will injure the former client in a matter involving the former representation – Attorney’s response is proportionate and restrained

New Hampshire Bar News – Tip

February 19, 2014

• Rule 1.6 only allows disclosure of confidential information

that is necessary to such a defense.

• Disclosure in response to a negative review, while effective

in rebutting the allegations, is not absolutely necessary.

• Avvo’s General Counsel has written: “As I often tell

attorneys, there are very effective ways to respond to negative reviews that don’t involve saying anything about the case and risking disclosure of client confidences. It’s less important to ‘set the record straight’ than it is to communicate that the lawyer is responsive, professional and takes client feedback seriously.”

8/29/2016 26

Ethics of Astroturfing

• What is it?
• Paying for positive reviews that are not real
• 8.4(c)
• Probably violates Terms of Service
• Might violate FTC rules

Asking Clients to Post Positive Reviews

• It’s still info related to the representation that client

might not want disclosed – you haven’t violated 1.6, but be aware of Rules 1.1 and 1.7 »Competent advice »Your interest in a positive review vs. client’s interests in anonymity, keeping information private

8/29/2016 27

Asking Clients for Positive Reviews

• Some providers discourage inviting reviews
• Yelp!
• Algorithms will try to weed out “planted”

reviews

Asking Clients for Positive Reviews

Fee discount for a positive review?

8/29/2016 28

Paying for Positive Reviews

• Rule 7.2(b)
• A lawyer shall not give anything of value to a person

for recommending a lawyer’s services except a lawyer may :

» Pay reasonable costs of ads » Pay charges of qualified, non‐profit, lawyer referral plan » Pay for a law practice » Refer clients to another professional in exchange for referrals

NYSBA Ethics Opinion 1052

• A lawyer may give clients a $50 credit on their legal bills if

they rate a lawyer on an internet website such as Avvo that allows clients to evaluate their lawyer, provided that: – Credit on bill not contingent on content of rating – Client is not coerced or compelled to rate the lawyer – Rating and reviews are done by the client, not the lawyer