ABA: Use of Unencrypted E-Mail ‘Not Always Reasonable’

By Samson Habte

The changing technological landscape and rising incidence of “cyber intrusion” prompted the ABA’s ethics committee to update an 18-year-old opinion on whether lawyers must use encrypted e-mail when communicating with clients (ABA Standing Comm. on Ethics & Prof’l Responsibility, Formal Op. 477, 5/11/2017).

"[C]yber-threats and the proliferation of electronic communications devices have changed the landscape and it is not always reasonable to rely on the use of unencrypted email,” the committee said in a May 11 opinion that updated guidance issued in 1999, before the spread of smartphones and cloud-based data storage systems.

“Each device and each storage location offer an opportunity for the inadvertent or unauthorized disclosure of information relating to the representation, and thus implicate a lawyer’s ethical duties,” the committee said.

The committee declined to adopt a bright-line rule prohibiting lawyers from communicating with clients via unencrypted e-mail—which, the opinion said, “generally remains an acceptable method of lawyer-client communication.”

But “it is not always reasonable to rely on the use of unencrypted email,” the committee said.

Rather, lawyers “must, on a case-by-case basis, constantly analyze how they communicate electronically about client matters, applying the Comment [18] factors to determine what effort is reasonable,” the committee advised, referring to a comment added to Model Rule 1.6 (confidentiality) in 2012.

That comment says lawyers must act competently to prevent unauthorized access to client information. But it also outlines something of a safe harbor, explaining that the interception or inadvertent disclosure of confidential information “does not constitute a violation of [Rule 1.6(c)] if the lawyer has made reasonable efforts to prevent the access or disclosure.”

The committee said it was “beyond the scope of an ethics opinion to specify the reasonable steps that lawyers should take under any given set of facts.” But it did list seven “considerations” for lawyers to weigh when determining the means by which they communicate with clients.

‘Understand the Nature of the Threat’

Those considerations included an admonition to “understand the nature of the threat.”

“Understanding the nature of the threat includes consideration of the sensitivity of a client’s information and whether the client’s matter is a higher risk for cyber intrusion,” the committee said.

“Client matters involving proprietary information in highly sensitive industries such as industrial designs, mergers and acquisitions or trade secrets, and industries like healthcare, banking, defense or education, may present a higher risk of data theft,” the committee added, and “reasonable efforts” in “higher risk scenarios generally means that greater effort is warranted.”

Lawyers should also “understand how their firm’s electronic communications are created, where client data resides, and what avenues exist to access that information,” the committee said. “Understanding these processes will assist a lawyer in managing the risk of inadvertent or unauthorized disclosure of client-related information,” it added.

“The lawyer’s task is complicated in a world where multiple devices may be used to communicate with or about a client and then store those communications,” the committee warned. “Each access point, and each device, should be evaluated for security compliance.”

‘Reasonable Electronic Security Measures’

The committee said lawyers should also “understand and use electronic security measures to safeguard client communications and information.”

There are a “variety of options” to consider in this regard, the panel said. Those options, it said, include the use of “secure internet access methods to communicate, access and store client information (such as through secure Wi-Fi, the use of a Virtual Private Network, or another secure internet portal.”

Other electronic security measures lawyers should consider include the use of “unique complex passwords, changed periodically,” and the use of anti-malware software on all devices used to store or transmit confidential information.

“Each of these measures is routinely accessible and reasonably affordable or free,” the committee noted. “Lawyers may consider refusing access to firm systems to devices failing to comply with these basic methods.”

This Device Will Self-Destruct in 3, 2, 1 ..

“It also may be reasonable to use commonly available methods to remotely disable lost or stolen devices, and to destroy the data contained on those devices, especially if encryption is not also being used,” the committee said.

“In the electronic world, ‘delete’ usually does not mean information is permanently deleted, and ‘deleted’ data may be subject to recovery,” the committee warned. “Therefore, a lawyer should consider whether certain data should ever be stored in an unencrypted environment, or electronically transmitted at all.”

Establish Ground Rules With Client

The committee said that lawyers and clients should, at the outset of a representation, “discuss what levels of security will be necessary for each electronic communication about client matters.”

“A lawyer also should be cautious in communicating with a client if the client uses computers or other devices subject to the access or control of a third party,” the committee warned. “If so, the attorney-client privilege and confidentiality of communications and attached documents may be waived, and the lawyer must determine whether it is prudent to warn a client of the dangers associated with such a method of communication.”

Label Privileged Material

The committee suggested that lawyers should also use disclaimers that identify communications about a matter as “privileged and confidential.”

Doing so, the committee said, may help a lawyer take advantage of the protections in Rule 4.4(b), which governs the duties of lawyers who receive inadvertently transmitted confidential information from adversaries. That rule provides that the recipient of such information must “promptly notify” the sender.

“A clear and conspicuous appropriately used disclaimer may affect whether a recipient lawyer’s duty under [Rule 4.4(b)] is satisfied,” the committee said.

Training Employees, Vetting Vendors

The committee also emphasized the importance of “periodically train[ing] employees, subordinates and others assisting in the delivery of legal services, in the use of reasonably secure methods of electronic communication with clients.”

The committee said that such training—and the establishment of policies and procedures for safeguarding confidential information—is required under Rules 5.1 and 5.3, which govern the supervisory obligations of lawyers with managerial authority in a firm.

Those supervisory obligations also apply to third-party vendors that lawyers use “when outsourcing legal and nonlegal services,” the committee noted, citing ABA Formal Ethics Op. 08-451, 24 Law. Man. Prof. Conduct 466 (2008).

“That opinion identified several issues a lawyer should consider when selecting the outsource vendor, to meet the lawyer’s due diligence and duty of supervision,” the committee said. “Those factors also apply in the analysis of vendor selection in the context of electronic communications.”

To contact the reporter on this story: Samson Habte in Washington at shabte@bna.com

To contact the editor responsible for this story: S. Ethan Bowers at sbowers@bna.com

Copyright © 2017 American Bar Association and The Bureau of National Affairs, Inc. All Rights Reserved.