Attorneys in the Cloud May Get ABA Wake-Up Call With Proposed Rules

For lawyers struggling to cut costs and boost efficiency, Internet-based data storage and client service has been a popular alternative. But those who have their heads in the clouds when it comes to client confidentiality concerns may get a wake-up call by the American Bar Association.

The ABA's Commission on Ethics 20/20 has issued proposed changes to the Model Rules of Professional Conduct designed to remind lawyers of the need to safeguard client confidentiality when engaging in “cloud computing,” a phrase that refers to storing, managing, and processing data on remote Internet servers rather than on a personal computer.

Proposed rules would require lawyers to take reasonable steps to stay abreast of the benefits and risks associated with technology used by Dropbox and other popular cloud computing services.

The rules changes, which would have to be adopted by individual states, are part of a review of Internet-based client service and marketing by lawyers. Also coming are guidelines on lawyer use of social media, blogs, and websites.

Commission member Frederick S. Ury, a partner at Ury & Moskow in Fairfield, CT, says the recommendations strike a balance between the legal profession's need to tap the benefits of technology and the need to protect clients.

“We should look at the rules as they exist to at least give lawyers some guidance as to how they should operate,” Ury says. “The rules should not be constructed in such a way that it prevents lawyers from taking advantage of new technologies to have their practices be more efficient. We were very, very careful to try to balance those two.”

Bruce H. Stanger, a West Hartford, CT, attorney who is on the Professional Responsibility Committee of the Connecticut Bar Association, says the proposed changes merely refine what is already required of lawyers: competence and confidentiality.

“I think what they're attempting to do is to acknowledge the need for lawyers to be aware of technological changes both in the management of their offices as well as the providing of services to the public,” he says. “I think the reality is, whether or not there is a rule change, every lawyer has a responsibility to understand the technology they use.”

Solos Most Impacted

The proposed rule changes have sparked concern nationwide from small firms and solo practitioners, who have been turning to cheaper, remote electronic data storage ' as well as Internet-based client service and marketing. Susan Cartier Liebel, a Connecticut lawyer who is founder and CEO of SoloPracticeUniversity (http://solopracticeuniversity.com), a virtual learning center, says cloud computing software allows lawyers a less costly alternative to practice management and greater client access via virtual platforms that are accessible only to clients and their lawyers. “Positioned properly, having a virtual component is going where your clients want you to be.”

Carolyn Elefant, founder of myShingle.com (http://myshingle.com), is among those who sent comments to the ABA committee after it announced it was considering rule changes. She urged the panel not to adopt bright-line rules that would quickly become outdated by changes in technology, or to recommend penalties for confidentiality lapses already covered by state and federal privacy laws.

“Generally, I'm cautiously optimistic about the approach they took,” says Elefant, a solo practitioner with an energy law practice based in Washington, DC. “I also was very gratified to see that, in terms of the confidentiality issue, lawyers are afforded a great deal of flexibility. My concern was that there would be rules about encryption and all sorts of onerous requirements.”

According to the revised commentary for the proposed rules, lawyers will have to consider several factors, including the sensitivity of information being kept on a cloud computing site, the likelihood of disclosure, and the cost of employing additional safeguards.

Elefant says many small firm lawyers or solo practitioners would like to see the ABA and state ethics panels establish standards for Internet data storage providers and recommend providers that meet those standards, much the same way state bar foundations have a list of approved banks for client trust accounts. That way, if a third-party provider experiences a security breach, the lawyer is not responsible.

National Standards?

The rules changes concerning cloud computing are only the first to be unveiled by the ABA. Next up are proposals designed to guide lawyers who are using social media and other Internet-based means to draw clients.

Ury acknowledges that the proposals are being warily watched by lawyers who are increasingly turning to social media and blogging to get their messages out.

“It has generated a huge amount of concern that's not necessary; there's nothing that's going to come out of this commission that says you can't blog, you can't use social media,” he says.

Like Cartier Liebel, Elefant says any changes should be based on existing rules prohibiting false or deceptive advertising and ensuring client confidentiality. She is also calling for national standards instead of each state creating its own. As it stands, she says, lawyers who practice in multiple jurisdictions are at a competitive disadvantage because they must tailor their websites or social media use to the most restrictive state in order not to run afoul of ethics guidelines there.

On the other hand, she says she believes lawyers who pay ghostwriters to produce their blogs should have to disclose that someone else is writing the material. Otherwise, an unsuspecting client could expect to be hiring a great legal writer only to find out the attorney's writing skills are below average.

For lawyers struggling to cut costs and boost efficiency, Internet-based data storage and client service has been a popular alternative. But those who have their heads in the clouds when it comes to client confidentiality concerns may get a wake-up call by the American Bar Association.

The ABA's Commission on Ethics 20/20 has issued proposed changes to the Model Rules of Professional Conduct designed to remind lawyers of the need to safeguard client confidentiality when engaging in “cloud computing,” a phrase that refers to storing, managing, and processing data on remote Internet servers rather than on a personal computer.

Proposed rules would require lawyers to take reasonable steps to stay abreast of the benefits and risks associated with technology used by Dropbox and other popular cloud computing services.

The rules changes, which would have to be adopted by individual states, are part of a review of Internet-based client service and marketing by lawyers. Also coming are guidelines on lawyer use of social media, blogs, and websites.

Commission member Frederick S. Ury, a partner at Ury & Moskow in Fairfield, CT, says the recommendations strike a balance between the legal profession's need to tap the benefits of technology and the need to protect clients.

“We should look at the rules as they exist to at least give lawyers some guidance as to how they should operate,” Ury says. “The rules should not be constructed in such a way that it prevents lawyers from taking advantage of new technologies to have their practices be more efficient. We were very, very careful to try to balance those two.”

Bruce H. Stanger, a West Hartford, CT, attorney who is on the Professional Responsibility Committee of the Connecticut Bar Association, says the proposed changes merely refine what is already required of lawyers: competence and confidentiality.

“I think what they're attempting to do is to acknowledge the need for lawyers to be aware of technological changes both in the management of their offices as well as the providing of services to the public,” he says. “I think the reality is, whether or not there is a rule change, every lawyer has a responsibility to understand the technology they use.”

Solos Most Impacted

The proposed rule changes have sparked concern nationwide from small firms and solo practitioners, who have been turning to cheaper, remote electronic data storage ' as well as Internet-based client service and marketing. Susan Cartier Liebel, a Connecticut lawyer who is founder and CEO of SoloPracticeUniversity (http://solopracticeuniversity.com), a virtual learning center, says cloud computing software allows lawyers a less costly alternative to practice management and greater client access via virtual platforms that are accessible only to clients and their lawyers. “Positioned properly, having a virtual component is going where your clients want you to be.”

Carolyn Elefant, founder of myShingle.com (http://myshingle.com), is among those who sent comments to the ABA committee after it announced it was considering rule changes. She urged the panel not to adopt bright-line rules that would quickly become outdated by changes in technology, or to recommend penalties for confidentiality lapses already covered by state and federal privacy laws.

“Generally, I'm cautiously optimistic about the approach they took,” says Elefant, a solo practitioner with an energy law practice based in Washington, DC. “I also was very gratified to see that, in terms of the confidentiality issue, lawyers are afforded a great deal of flexibility. My concern was that there would be rules about encryption and all sorts of onerous requirements.”

According to the revised commentary for the proposed rules, lawyers will have to consider several factors, including the sensitivity of information being kept on a cloud computing site, the likelihood of disclosure, and the cost of employing additional safeguards.

Elefant says many small firm lawyers or solo practitioners would like to see the ABA and state ethics panels establish standards for Internet data storage providers and recommend providers that meet those standards, much the same way state bar foundations have a list of approved banks for client trust accounts. That way, if a third-party provider experiences a security breach, the lawyer is not responsible.

National Standards?

The rules changes concerning cloud computing are only the first to be unveiled by the ABA. Next up are proposals designed to guide lawyers who are using social media and other Internet-based means to draw clients.

Ury acknowledges that the proposals are being warily watched by lawyers who are increasingly turning to social media and blogging to get their messages out.

“It has generated a huge amount of concern that's not necessary; there's nothing that's going to come out of this commission that says you can't blog, you can't use social media,” he says.

Like Cartier Liebel, Elefant says any changes should be based on existing rules prohibiting false or deceptive advertising and ensuring client confidentiality. She is also calling for national standards instead of each state creating its own. As it stands, she says, lawyers who practice in multiple jurisdictions are at a competitive disadvantage because they must tailor their websites or social media use to the most restrictive state in order not to run afoul of ethics guidelines there.

On the other hand, she says she believes lawyers who pay ghostwriters to produce their blogs should have to disclose that someone else is writing the material. Otherwise, an unsuspecting client could expect to be hiring a great legal writer only to find out the attorney's writing skills are below average.