Ethics 2.0(16) Ethical Issues in the Digital Age - Squarespace · Why the Dislike? Hughes Hubbard ... computers/laptop o Protect your password o Protect/Encrypt Emails & their Attachments

Ethics 2.0(16)Ethical Issues in the Digital Age

Ethics 2.0(16)Ethical Issues in the Digital Age

Charles W. CohenSeptember 23, 2016Charles W. CohenSeptember 23, 2016

Hughes Hubbard & Reed LLP ● Page 2

• Lawyer’s Duty of Competency with Technology

• Cybersecurity: Protecting Client Confidences

• Social Media: Clients & Adversaries• Internet of Things

Overview


Why Is this Important?


Client-Lawyer RelationshipABA Model Rule 1.1: Competence

“A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and

preparation reasonably necessary for the representation.”

Model Rule 1.1 & Lawyer’s Duty of Competency with Technology


Comment 8 to ABA Model Rule 1.1 (adopted by the ABA in 2012):

“To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks

associated with relevant technology ....”

Model Rule 1.1 & Lawyer’s Duty of Competency with Technology


• Adopted comment 8 but narrowed scope. Lawyer must “keep abreast of the benefits and risks associated with technology the lawyer uses to provide services to clients or to store or transmit confidential information.”

• Adopted comment 8, explicitly incorporating it into a lawyer's duty to remain current with changes in the law and its practice.

• Formal petition to support adoption of comment 8 filed in April 2016 before the Florida Supreme Court. Pending.

Other States’ Treatment of Comment 8

NY

PA

FL


23 States have since adopted Comment 8

Model Rule 1.1 & Commentary 8

CAUT

TX

ILOH

PA

NY

LAMS AL GA

NJ?

TNMD

FL

AR

IN

MN

MO VA

NM OK

KS

MA

KY

WA

MI

NC

WV CT

ORID

IA

SD

CO

NV

NH

MT

NE RI

ND

AZ

WIWY

DESC

HI

MEVT

AK

WA


Rule 1.1 & Commentary 8 Background and Explanation


Rule 1.1 & Commentary 8 Background and Explanation

“The Committee finds that it would not be appropriate to graft the…ABA language onto our New Jersey Rule.”


Why the Dislike?

New Jersey Rule of Professional Conduct 1.1:

A lawyer shall not:(a) Handle or neglect a matter entrusted to the

lawyer in such manner that the lawyer's conduct constitutes gross negligence.

(b) Exhibit a pattern of negligence or neglect in the lawyer's handling of legal matters generally.


1. Different Standards2. Money3. Ethics Opinion 701 (2006)

Why the Dislike?


Practical Ethical Takeaways


• Programs like Adobe, Word, Excel are now essential.

• But consider becoming familiar with the following to better manage your practice:

o Legal Analytics

o Document Management Databases & Software

o eFiling/eDocketing

o Secure FTP document/file transfer



• Understand how to protect your client’s confidences in the digital age.

• If you use social media for any reason (attorney advertising, jury research, client communication) you have an obligation to understand it’s benefits and risks.

• Keep abreast of the latest “connected” products that could pose litigation and ethical challenges.



• Generally refers to protecting computer systems and the electronic data stored in them.

• Growing area of legal practice: encompasses compliance, corporate due diligence, contract drafting, data breach notifications, and litigation.

• This is an issue that affects everylawyer and client.

Cybersecurity


Who’s Being Hacked?


• Opportunistic Hacking

o Technical challenge

o Reputation

o Political Statement

• Insiders/Disgruntled Employees

o Revenge

o Financial Gain

• Organized Crime

o Financial Gain

What are hackers trying to accomplish?


• This year alone:oPanama Papers LeakoPatricia Doran lawsuitoTwo well-known, large law firms

reported breaches

Cybersecurity: Law Firms Are No Exceptions!


• ABA Model Rule & NJ RPC 1.6(a); see also NJRPC 1.9(c).

• NJ Ethics Opinion 701 (2006)o An attorney may use the Internet to communicate with clients and store client files,

provided that the attorney uses reasonable care.

o Also requires New Jersey attorneys to “exercise sound professional judgment” in order to secure client confidences against hacking and other forms of unauthorized use of digital information.

o Attorney must also use as reasonable care to ensure that digital documents entrusted to a third party for analysis are preserved, confidential and secure.

• New Rule, effective September 1, 2016:

o NJ RPC 1.6(f): “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”

Cybersecurity: Protecting Client Confidences in the Digital Age


Comment to the Rule notes the following five factors to determine “reasonableness” of attorney’s efforts to keep client data safe:

1. the sensitivity of the information;

2. the likelihood of disclosure if additional safeguards are not employed;

3. the cost of employing additional safeguards;

4. the difficulty of implementing the safeguards;

5. the extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use).

What Are Reasonable Efforts Under Rule 1.6(f)?


• Phishingo Spoofing

o Spear-Phishing

o Whaling

o Attorney Phishing

• Voice Phishing/Social Engineeringo “smooth talking” those with access to give it up

• Smishing

Don’t Be Phish Bait


Don’t Be Phish Bait: Best E-Mail Practices to Protect Client Confidences


• NEVER open ANY data (hard drives, CD, discs, thumb drives etc.) from a client, a vendor, adversary or colleague. Not even a quick peek!

• Counsel may inadvertently change metadata after collection or expose your firm’s network to malware.

• Only let qualified technical personnel open media. But note your obligation to supervise!

Best Ethical Practices & Takeaways: Metadata & Cybersecurity


• What You See

Best Ethical Practices & Takeaways: Metadata

DOCUMENT FOR DISTRIBUTION

This is a perfectly appropriate document for distribution. It does not appear on the screen to have any problems.

But wait; could this document be hiding information you would rather not send?


• What You Send


DOCUMENT FOR DISTRIBUTION[BP1]

This is a perfectly appropriate document for distribution. [JOE: I am concerned that this might violate our policy on giving gifts. We should absolutely reconsider using this language before releasing this for distribution.]It does not appear on the screen to have any problems.

But wait; could this document be hiding information you would rather not send?

Wow, this comment tool is great. I wonder if it is ok for the recipient to see it…

BP1


• The Properties tab reveals the concerns of the commenter

• TITLE: MEMO (LAWYER SAID CANNOT GIVE GIFTS VERSION)

• RPC 4.4 now governs lawyer treatment of accidentally-sent metadata.

o Presumption that metadata is accidentally sent when it reflects privileged or work product information



Becomes more problematic given the types of client information you may have:

Cybersecurity: Protecting Client Confidences in the Digital Age


• Generallyo Make Someone Responsible

o Employee Training

o Confer with Clients & Insurers

• Firm Deviceso Use encryption to store data

o Passwords!

o Avoid USB Sticks

o Wipe Other Devices Regularly

o Avoid Communicating with Clients or Witnesses via “chat” applications

Best Ethical Practices & Takeaways: Reasonable Cybersecurity Care


• WiFio Do Not Use Public WiFi!

o Avoid HotSpots

o Maintain Separate WiFi Firm Access for Guests and Employees

• E-Mailo Do not use personal email for firm business

o Do not store firm documents or materials on your home computers/laptop

o Protect your password

o Protect/Encrypt Emails & their Attachments

o Create & Use Filters and Rules to Weed Out SPAM

Best Ethical Practices & Takeaways: Reasonable Cybersecurity Care


Social Media: Clients & Adversaries


Counseling Clients on Social Media


Confidential? LOL!

“Mama and Papa Snay won the case against Gulliver. Gulliver is now officially paying for my

vacation to Europe this summer. SUCK IT!”


Counseling Clients on Social Media: When To Delete?

• During a Virginia wrongful death suit, attorney instructed his client to remove incriminating photos from the client’s Facebook profile:

o Attorney advised the client via e-mail to “clean up” his Facebook page because “we do NOT want blow ups of other pics at trial so please, please clean up your facebook and myspace.”

o He also advised client via email that there were “other pics that should be deleted.”

o Client later deleted his Facebook account entirely, then denied doing so at a later deposition.


Counseling Clients on Social Media:When To Delete?

• Big Time Sanctions!

• Attorney referred to Virginia State Bar, ultimately suspended for 5 years.

• NY, PA and FL promulgated rules about advising clients to “clean up” their social media accounts during litigation.


• NJ Personal injury suit - attorney directed paralegal to “friend” plaintiff on Facebook to get impeachment material.

• Paralegal used real name/profile when friending plaintiff.

• Office of Attorney Ethics: “ruse and subterfuge”! o RPC 4.2

o RPC 5.1(b) and (c)

o RPC 5.3(a), (b) and (c)

o RPC 8.4(c) and (d)

Social Media with Adversaries


WHAT HAPPENED?



• Issue: Whether OAE may investigate an RPC violation after the District Ethics Committee declined to prosecute it.

• Trial Court: Dismissed; lack of subject matter jurisdiction

• Appellate Division: Affirmed

• NJ Supreme Court: Affirmed in April 2016, but noted that this matter “presents a novel ethical issue . . . [n]o reported case law in our State addresses the question.”

• Outcome: OAE decision remains in effect and can proceed; underlying issue on Facebook friending adversaries not reached. OAE proceeding against Robertelli on-going.



• A lawyer representing a client in pending litigation may access the public pages of another party's social networking website. o New York State Bar Association, Committee on Professional Ethics, Op. 843

(Sept. 10, 2010).

• A lawyer may not attempt to gain access to a social network under false pretenses, either directly or through an agent. o The Association of the Bar of the City of New York, Committee on Professional

Ethics, Formal Opinion 2010-2.

• Attorneys May Not Ethically Contact a Represented Person Through a Social Networking Websiteo Pennsylvania Bar Association Formal Opinion 2014-300

Affirmatively Using Social Media


Social Media: Not A Place to Vent!


The Next Big Ethical Dilemma: Internet of Things


Wearables

Internet of Things


Consumer Appliances

Internet of Things

Home Monitoring Systems


Internet of Things

Medical Devices


• Why?o Easier to implemento Reduces costso Makes processes more efficiento Prevents human errorso Safeguards against lost/stolen company assets

Internet of Things: Corporate Uses


Internet of Things: A Legal Nightmare?


Internet of Things: Privacy

• Privacy ConcernsoCollection of large amounts of sensitive

personal information over long (potentially unlimited) time period

oNotice & Consent To UsersoWays that Data is UsedoWho Owns the Data Being Collected?


• In age discrimination suit, Plaintiffs sought certain information and reports from Salesforce.com, a cloud-based sales management program

• Defendants pushed back, at first saying they didn’t have possession, custody or control of data and they did not export or preserve the data (despite numerous notices to do so)

• Cloud provider only maintained backups for 3-6 months

IoT & eDiscovery: Who Controls and Who Maintains?


• “..counsel had an affirmative obligation to speak to the key players at Tellermate so that counsel and client together could identify, preserve, and search the sources of discoverable information.”

• Court sanctioned defendant and counsel and precluded defendant from using their strongest defense strategy.

• “Appalling example of discovery run amok…”!

IoT & eDiscovery: Who Controls and Who Maintains?


Internet of Things: Security

• Safety & Security Concernso Hacking into devices

• Medical Devices• TVs• Security Cameras• Cars• HVAC systems• Industrial equipment

(Stuxnet)o Network attackso Obsolete Devices


Charles W. CohenHughes Hubbard & Reed LLPOne Battery Park PlazaNew York, NY 10004(212) [email protected]

Questions?

Ethics 2.0(16) Ethical Issues in the Digital Age - Squarespace · Why the Dislike? Hughes Hubbard ... computers/laptop o Protect your password o Protect/Encrypt Emails & their Attachments

Documents