9.02.01. Duty to Maintain Competence in Technology [Rule 1.1, Comment 8]

The most recent amendment to Rule 1.1 is the following (seemingly benign) statement: “To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology….”[1]  Those who opposed this amendment felt that it would place too great a burden on lawyers to understand technological advances.  However, there is no doubt that, as technology becomes more and more pervasive, a lawyer’s duty of competence must begin to include an obligation to have a basic understanding of technology. 

Competence in technology includes the responsibility to understand cybersecurity and how client information can be compromised.  The simple reality is that law firms keep a lot of information that hackers would love – business strategies, social security numbers, bank records.  That is why hacking the usernames and passwords of law firms is much more valuable than other businesses.  Furthermore, client data can be stored in expected locations – for example, the copy machine or fax machine may store digital images of documents.  For example, a health-care company had to pay a $1.2 million fine because the lease was up on its copier and it failed to take steps to scrub the saved data from the machine – putting medical information of 344,000 indivduals at risk.[2]

Therefore, a lawyer should be familiar with the basics of protecting client information, and should constantly be vigilant about potential vulnerabilities. A lawyer has an ethical obligation to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to” information related to the representation.[3]  No system is impenetrable – so the ethical standard is what is reasonable under the particular circumstances the lawyer is facing.  For example, in most circumstances sending information over regular email is fine; however, if the lawyer knows that the information is particularly sensitive, there is an obligation to consider additional safeguards for the information.  The key is reasonableness.  Comment [18] to Rule 1.6 sets out a list of factors for a lawyer to analyze to determine reasonableness:  “the sensitivity of the information, the likelihood of disclosure  if additional safeguards are not employed, the cost of employing additional safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients…”

The factors set out in Comment [18] were intentionally vague because the drafters felt that technology was changing to rapidly to set out particular measures.  In 2017, however, the ABA issued Formal Opinion 477, which provided the following more concrete gudiance to assist lawyers in evaluating reasonableness:  (1)  How sensitive is the information?  Is it at a higher risk for cyber-intrustion?; (2) Understand how client information is transmitted and stored in the firm; (3) Use reasonable security measures (secure network, strong passwords, etc.); (4) Discuss with client how confidential information should be protected; (5) In communications label confidential information as “privileged and confidential”; (6) Train lawyers and non-lawyers in firm about technology and information security; and (7) Conduct due diligence on third-party vendors that provide communication technology.[4] 

Although the Rules and the Ethics Opinion set out general statements, here are some more specific actions to consider: (1) encrypt sensitive information; (2) password protect everything –  passwords for work information should be much more difficult than the passwords for personal devices; (3) have a plan of action if a device is lost or stolen (be able to wipe clean data remotely); and (4) have a plan in case of a security breach.[5]  To date, 48 states have data breach notification laws that require that notice be given when data has been compromised.[6] These concerns have become so prominent that some states have mandated technology training as part of a lawyer’s continuing legal education (CLE) requirement.[7]

In addition to the concerns about protecting the storage and confidentiality of client information, technology has also become important in the traditional litigation process.  For example, electronic discovery is a relatively new form of discovery whereby a party is required to turn over documents – such as emails – that are stored electronically.  The failure to understand the how e-discovery operates and to both ensure that clients comply with e-discovery requests and to protect clients from overly inclusive e-discovery requests can have serious consequences for both the client and the lawyer.

Alicia Attorney has represented Big Box, Inc. for many years.  She consistently provides excellent legal advice.  Recently, Little Box, Inc., a competitor, has sued Big Box.  As part of its discovery requests in the law suit, Little Box requests electronically stored documents (particularly emails).  Attorney is familiar with e-mail but has not dealt with electronic discovery requests.  Therefore, when opposing counsel offered that they would jointly come up with search terms for documents, Attorney said fine.  After the search, Attorney turned over all of the documents that were captured to the other side. Opposing counsel threatened sanctions because numerous email chains had been deleted.  They had been deleted in the normal course of business (but after the lawsuit was filed).  Attorney then started to look through the documents and realized that she had produced documents which contained highly sensitive client information.  Attorney realized that these documents contained the search terms but were not relevant to the suit.  Is Attorney subject to discipline?  [Cal. Standing Comm. On Prof. Resp. and Conduct, Formal Opinion No. 11-0004]

Yes.  Competence includes the obligation to understand how to handle e-discovery.  The ethics opinion from California cited in the hypothetical put it this way:

The ethical duty of competence requires an attorney to assess at the outset of each case what electronic discovery issues, if any, might arise during the litigation, including the likelihood that e-discovery will or should be sought by either side.  If it is likely that e-discovery will be sought, the duty of competence requires an attorney to assess his or her own e-discovery skills and resources as part of the attorney’s duty to provide the client with competent representation.  If any attorney lacks such skills and/or resources, the attorney must take steps to acquire sufficient learning and skill, or associate or consult with someone with appropriate expertise to assist. 

Can you see why some members of the bar would oppose the amendment to the ethics rules making technology a basis for discipline?  With the rate of change of technology, lawyers are forced to inform themselves about areas that are only tangentially related to the practice of law.     

[1] ABA Rule 1.1, Comment [8].

[2] Jason Tashea, “Yesterday’s Technology, Today’s Problem,” ABA J. (Nov. 2018).

[3] Rule 1.6(c).

[4] ABA Formal Op. 477 (May 11, 2017).

[5] These suggestions were included in How Law Firms Can Protect Client Confidences and Private Data from Hackers published in U.S. Law Week (10/28/14).

[6] See Miss. Code Ann. § 75-24-29.  For a listing of all security breach laws:  http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx (last visited April 15, 2017).

[7] Florida requires three hours of technology training over three years.  North Carolina mandates a 1-hour-per year in technology training.