Shelley v. Kraemer

Ten years after Gaines, Black lawyers in Missouri were once again responsible for the elimination of racial barriers which denied equal opportunities to Black citizens. The Supreme Court's decision in Shelley v. Kraemer was the result of an organized effort involving hundreds of cases over a 30-year period. As in the school desegregation cases, the NAACP's network of Black attorneys facilitated the campaign against housing discrimination. In its 1930 grant application to the Garland fund, the NAACP had specifically targeted racially restrictive covenants. Numerous cases had been litigated in the ensuring years without much success. As a consequence, in 1945, the NAACP convened a series of conferences to discuss the restrictive covenant cases and to develop an overall strategy for securing a victory in the Supreme Court. In 1948 four cases were decided together in two separate opinions: Shelley v. Kraemer from St. Louis and McGhee v. Sipes from Detroit and two cases involving properties located in the District of Columbia, Hurd v. Hodge and Uricolo v. Hodge. Thurgood Marshall handled the District of Columbia cases and George Vaughn represented the Shelleys.

The property that the Shelleys purchased was located at 4600 Labadie Avenue in St. Louis. After the Shelleys indicated an interest in purchasing the home, a Black realtor arranged a sale through a white intermediary. The intermediary negotiated a sale to a "straw" purchaser who later transferred title to the Shelleys' agent, who purchased the property and immediately re-sold the property to the Shelleys. When the Shelleys took possession of the Labadie Street property on October 9, 1945, they were unaware of the existence of the restrictive covenant. Consequently, they were quite surprised when they were served with a lawsuit which sought their eviction on October 10. The Shelleys were represented by George L. Vaughn, a Black attorney who had served as the first president of the Mound City Bar Association.

The covenant at issue in Shelley provided the properties covered by the covenant could not be "occupied by any person not of the Caucasian race.”⁴³ When Kraemer v. Shelley came to trial, Vaughn implemented the litigation strategy that was outlined in the meetings convened by the NAACP.⁴⁴ Vaughn argued that the covenant was defective because it contained faulty property descriptions and had not been executed by all of the property owners. Vaughn argued further that the character of the neighborhood had changed since a number of black families already resided in the vicinity. Vaughn also claimed that the covenant violated the Missouri Constitution, the United States Constitution and the 1866 Civil Rights Act. Vaughn's witnesses also testified about overcrowded conditions within St. Louis' Black district and the effects of overcrowding on health and crime. After two days of hearings, the trial court ruled that that covenant was defective because it had not been signed by all of the property owners to which it purported to apply.

The decision was appealed and the Supreme Court of Missouri, sitting en banc, entered an order reversing the trial court's decision on December 9, 1946. The Court held that the signatures of all of the property owners were not required since the covenant was limited to the properties whose owners had actually executed the 1911 covenant. The Court also held that the exclusion of certain parcels from the covenant's coverage did not affect the agreement's validity because there was never any intent to cover the excluded properties. It held that covenants did not violate public policy because "agreements restricting property from being transferred to or occupied by Negroes have been consistently upheld by the courts of this state,"⁴⁵ and that "the restriction does not contravene the guarantees of civil rights of the Constitution of the United States.” ⁴⁶

Vaughn filed a petition for a writ of certiorari on April 21, 1947. The request was granted on June 23, 1947.47 After learning that certiorari had been granted in Shelley v. Kraemer, Thurgood Marshall prepared a writ of certiorari for McGhee v. Sipes. Certiorari was eventually granted in that case and in Houston's District of Columbia cases. Following the practice which was established 10 years earlier in Gaines, a dry run was held at Howard Law School prior to the oral arguments in Shelley. The Dean of the Law School arranged the rehearsal for the Shelley arguments, and it is said that a second-year student asked a long and rambling question which was ultimately vindicated when the same point was raised during oral argument, by Justice Frankfurter.⁴⁸

Vaughn presented the argument in Shelley. He argued that the judicial enforcement of covenants constituted state action and stressed his claim that that covenants violated the Civil Rights Act of 1870.⁴⁹ Vaughn characterized racial restrictive covenants as "the Achilles heel" of American democracy.⁵⁰ In what observers remembered as the most dramatic point in the seven hours of argument, Vaughn, the son of a slave, stated in a voice that reverberated through the corridors of the Court, that the "Negro knocks at America's door and cries, Let me come in and sit by the fire. I helped build the house.”51 Vaughn emphasized the "American door" remarks by rapping sharply on the counsel table. The sound of his knuckles striking the table resonated throughout the then silent courtroom and supplied a climax to his argument that mere words never could.⁵²

On May 3, 1948, the Supreme Court issued its decision in Shelley v. Kraemer and McGhee v. Sipes.⁵³ Chief Justice Vinson delivered the Court's decision. After noting that the Fourteenth Amendment "erects no shield against private conduct however discriminatory or wrongful,"⁵⁴ the Court directed its discussion to a consideration of the types of state action involved in previous decisions involving direct action by legislatures. In those cases, the Court said, state action was clearly involved because the challenged actions involved statutes or ordinances that were enacted by legislative bodies. This case, in contract, involved "the patterns of discrimination and the areas in which the restrictions are to operate are determined, in the first instance, by the terms of an agreement among private individuals."⁵⁵ Since the state's involvement in this case was limited to the enforcement of private agreements, the critical question here involved a determination of whether judicial enforcement of the restrictive covenants was "state action" for purpose of the Fourteenth Amendment. The answer to that question, in the Court's view, was affirmative. "[T]hat the action of state courts in their official capacities is to be regarded as action of the state within the meaning of the Fourteenth Amendment, is a proposition which has long been established by the decisions of this court."⁵⁶

After citing a number of cases in which the actions of state courts were held unconstitutional under the Fourteenth Amendment, the Court reasoned that the Fourteenth Amendment was not restricted to situations in which the judicial proceedings were themselves found to be procedurally unfair. The Court stated that judicial enforcement of a common law right may violate the Fourteenth Amendment even where the judicial proceedings were themselves in complete accord with the most rigorous standards of procedural due process. As a result, the Court concluded that the "state action" contemplated by the Fourteenth Amendment "includes action of state courts and state judicial officials.” ⁵⁷

The Court reasoned further that there had "been state action in these cases in the full and complete sense of the phrase."⁵⁸ To support this determination, the Court observed that without the intervention of the state courts, the Black families involved in Shelley would have been free to occupy the properties in question without interruption. The Court believed that it did not matter that the state's involvement arose from a private agreement because "the Fourteenth Amendment refers to exertions of state power in all forms."⁵⁹

Turning finally to the contentions of the respondents - that there was no denial of equal protection because Black families were free to execute covenants prohibiting the sale of properties to whites and they were equally free to secure judicial enforcement of such covenants - the Court illuminated the specious basis of this argument by observing that there had never been a reported instance in which a Black family had attempted to exclude a white family from a Black neighborhood. On a more substantive note, the Court noted in the opinion's most memorable passage that "[e]qual protection of the law is not achieved through indiscriminate imposition of inequalities."⁶⁰ For these reasons, the Court concluded that "in granting judicial enforcement of the restrictive agreements in these cases, the states have denied petitioners equal protection of the laws."⁶¹

Conclusion

The Gaines and Shelley cases were significant strides towards the elimination of legally sanctioned racial

discrimination. Gaines marked the beginning of the end of the separate but equal legal fiction and the 1948 decision in Shelley set the stage for Brown which was decided just six years later. The organized legal campaign begun in 1930 with the grant from the Garland fund and the NAACP's litigation strategy reached its climax when the Supreme Court reversed the Plessey decision with Brown. All of these decisions stand as monuments to the NAACP and the Black attorneys who implemented that organization's legal strategy.

Up to the late 1950s, the thrust of the Civil Rights movement was directed through the Courts. Without the NAACP's success in Brown v. Board of Education in 1954, the freedom marches of the 50's and 60's might not have occurred. These accomplishments would not have been possible without the assistance of the hundreds of Black attorneys who maintained practices in the cities and towns across the nation. They shared a common vision and they endured years of sacrifice and effort to accomplish their goals. The efforts of "very able lawyers" like Charles Houston, Sidney Redmond and George Vaughn made these victories possible.

Part 1

Part 2

Part 3

Part 4

Endnotes

1 305 U.S. 337 (1938).

2 334 U.S. 1 (1948).

3 See generally, Nathan Young, Early Black Lawyers in St. Louis, THE ST. LOUIS BLACK JOURNAL 30:4 (Spring 1984); Anne-Marie Clarke, The History of the Black Bar, THE ST. LOUIS BAR JOURNAL 30:4 (Spring 1984).

4 St. Louis Argus, January 13, 1922 p. 1, reprinted in, Clark, The History of the Black Bar, supra, at p. 19.

5 Id.

6 See Smith, The Black Bar Association and Civil Rights, 15 CREIGHTON L. REV. 651 (1982).

7 Stanford Richardson, Homer G. Phillips: the Man, the Hospital, THE ST. Louis BAR JOURNAL 30:4 (Spring 1984).

8 Richardson, Homer Phillips, supra, at p.33.

9 See generally, Genna Rae McNeil, CHARLES HAMILTON HOUSTON AND THE STRUGGLE FOR CIVIL RIGHTS (University of Penn. Press 1983); Mark V. Tushnet, THE NAACP's LEGAL STRATEGY AGAINST SEGREGATED EDUCATION 1925-1950 (University of North Carolina Press 1987); Richard Kluger, SIMPLE JUSTICE: A HISTORY OF BROWN V. BOARD OF EDUCATION AND BLACK AMERICA'S STRUGGLE FOR EQUALITY (Vantage Press 1975).

10 Tushnet, supra, p. 7.

11 Id. p. 14.

12 163 U.S. 537 (1896).

13 Id.

14 McNeil, supra, at 86-105.

15 Note, 35 HARV. L. REV. 950 (1922).

16 Raymond Logan, HOWARD UNIVERSITY: THE FIRST HUNDRED YEARS (1969).

17 Tushnet, supra pp. 1-24; McNeil, supra, pp. 86-106.

18 Kluger, supra, p. 203.

19 182 A.2d 591 (1936).

20 Kluger, supra, 203-204; McNeil, supra, pp. 144-144. See also Lucille Bluford, The Lloyd Gaines Story, 32 JOURNAL OF EDUCATIONAL SOCIOLOGY 243 (1959); Larry Grothaus, The Inevitable Mr. Gaines, 26 ARIZONA AND THE WEST 21 (1984).

21 Kluger, supra, at p. 203.

22 Id.

23 Id. at 203-204.

24 118 S.W2d 785.

25 Id. at 786.

26 Id.

27 Id. at 787.

28 Id. at 788.

29 Id. at 789.

30 Id.

31 Id.

32 Id. at 790.

33 118 S.W2d at 791.

34 McNeil, supra, 143-144.

35 305 U.S. at 346.

36 Id. at 347.

37 Id. at 345.

38 Id. at 348.

39 Id. at 349.

40 Id. at 350.

41 Id. at 351.

42 The actual integration of the University of Missouri was delayed for several years after Gaines disappeared. In the interim, the State of Missouri hastily established a law department at Lincoln University which operated in St. Louis until the early 1950s.

3 Kraemer v. Shelley, 198 S.W.2d 679, 681 (Mo. 1946).

44 At the first meeting, Charles Houston urged the attorneys present to assert various technical and Constitutional defenses and to demonstrate with expert testimony, the role of restrictive covenants in the overcrowded and deteriorating conditions of ghetto housing.

45 198 S.W2d at 682.

46 Id.

47 331 U.S. 803 (1947).

48 McNeil, supra, p. 162; personal recollection of Professor Gerald T Dunne of conversation, 1960, with Herman Wilier.

49 Arguments Before the Court: Enforcement of Restrictive Covenants, 16 U.S. L. WEEK 3219-20 (Jan. 20, 1948). Charles Houston argued on behalf of the Black home purchasers in the two District of Columbia cases and Thurgood Marshall argued McGhee v. Sipes. Solicitor General Phillip Perlman argued for the United States which appeared as amicus in support of the NAACP

50 Id. at 3220.

51 Id.

52 Personal recollection of Professor Dunne, of conversation with Herman Wilier, 1960. Herman Wilier, who was Vaughn's co-counsel, followed Vaughn with a summation of the primary legal arguments.

53 334 U.S. 1 (1948).

54 334 U.S. at 13.

55 Id.

56 Id.

57 334 U.S. at 18.

58 Id. at 19.

59 Id. at 20.

60 334 U.S. at 23.

61 Id. In the Hodge case, the Court relied on a nearly forgotten District of Columbia statute to invalidate the racially restrictive covenants challenged in those cases. 334 U.S. 24 (1948).

Missouri ex rel. Gaines v. Canada

A St. Louis lawyer, Sidney Redmond, had an instrumental role in an important equalization case. Mr. Redmond was a 1923 graduate of Harvard College and he received a law degree from Harvard University in 1927. Redmond moved to St. Louis from Mississippi in 1929. In 1935 there were only forty-five Black attorneys in the state of Missouri, and thirty of those practiced in St. Louis. A total of three Black attorneys had been admitted to the Missouri bar in the previous five years, but there were fewer Black practitioners in the State in 1936 than there had been ten years earlier.¹⁸

In 1936, Houston's equalization strategy prevailed in a case against the University of Maryland, Pearson et al. v. Murray.¹⁹ In that case, the Maryland Court of Appeals held that the state was obligated, under the equal protection clause, to admit a Black student since it had established a state-supported law school for white students but had not done so for Black students. After the victory in Murray, the NAACP was anxious to pursue its litigation strategy in other states. When Redmond recommended that the NAACP file a civil action on behalf of a Black student in Missouri, Houston agreed.

Lloyd Gaines was a 1935 graduate of Lincoln University who wanted to become a lawyer. After his application to the University of Missouri was denied, he became the plaintiff in the Missouri case. Sidney R. Redmond and Henry D. Espy of St. Louis (who were both members of the Mound City Bar Association) and Charles Houston represented Gaines. Houston arrived in St. Louis to complete the final research for the case several days prior to the trial. On July 10, 1935, the day of the trial, Houston rose at 4:15 a.m. to prepare for the 120-mile drive to Columbia. By the time Gaines and the other lawyers had assembled, it was six o'clock. An unanticipated detour caused further delays. Houston, Redmond, Espy and Gaines did not arrive at the Boone County Courthouse until 9:15 a.m. ²⁰

During that summer, Boone County had been suffering from a severe drought. As a result, dozens of farmers were in town to visit officials at the county relief agencies located in the county courthouse. Several of the farmers wandered into the courtroom to watch the Gaines proceedings. In addition, nearly a hundred students who were attending a summer session at the University of Missouri also crowded into the courtroom. Before long, the courtroom was filled to capacity. The opposing counsel shook hands cordially and they all shared a single table. An arrangement "odd to us," Houston reported later. In a memorandum to his office, Houston explained that "all during the trial we were looking down one another's throats. For private conferences at the table we almost had to go into a football huddle.”²¹ Although the courtroom was filled with spectators, there were no hostile demonstrations or outbursts during the trial. Furthermore, unlike many courthouses during that period, the Boone County courthouse did not provide racially segregated facilitates. Houston noted that during the recess, some of the farmers "looked a little strange at us drinking out of the same fountain and using the same lavatories with them, but they did not say anything."²²

Houston reported that the University's lawyers, practitioners from a Kansas City firm, were "driving and dramatic" in their opening presentation. They contended that Gaines' remedy lay with the officials of Lincoln University. During the trial, it was admitted that Gaines was otherwise qualified for admission to the law school and that he was denied admission solely on the basis of his race. Nevertheless, the disposition of the trial judge was clear enough to Houston. In the memorandum to his office, he concluded that "it is beyond expectation that the court will decide in our favor, so we had just as well get ready for the appeal.”²³ The court eventually entered a judgment for the University.

The case was later appealed to the Supreme Court of Missouri. When the case reached that court, it held that "the established public policy of this State has been and now is, to segregate the white and Negro races.”²⁴ The Court also concluded that the laws providing for separate schools were not forbidden by the Fourteenth Amendment of the Federal Constitution. Houston and Redmond argued that the laws requiring segregation did not extend to state-supported colleges and universities. After reviewing various statutes establishing Lincoln University "for the higher education for the Negro race,”²⁵ the Court disagreed and held that there was "a clear intention on the part of the Legislature to separate the white and Negro races for the purpose of higher education."²⁶

Houston and Redmond also contended that broadly worded statutory language, which made state-supported higher education available to "all youths" who were residents of Missouri, could not be interpreted to restrict admission to white students. According to the Court, however, such an expansive reading would be "at war" with other statutory provisions which, in the Court's view, evidenced a "clear and unmistakable intention on the part of the Legislature to separate the races for the purpose of higher education."²⁷

Houston and Redmond also claimed that the state's actions denied Gaines equal protection of the law.

After explaining somewhat cryptically that "color carries with it natural race peculiarities" and that "[t]hese differences create different social relations," the Court relied on Plessy v. Ferguson to conclude that "[e]quality" and not identity of privileges and rights, is what is guaranteed to the citizen."²⁸ Based on this reasoning, the Court held that Gaines would not be deprived of any property rights in violation of the Federal or Missouri Constitutions if the educational opportunities provided by the State were substantially equal to those furnished to white citizens of the State." ²⁹

Addressing this question, the Court noted that Gaines had not applied for admission to Lincoln University but if he had done so, the Board of Curators at Lincoln would have been obligated to establish a law school "or furnish him opportunity for training elsewhere, substantially equal to that furnished white students at the University of Missouri."³⁰ The Court further stated that the law departments of universities located in adjacent states admitted non-resident Black students, and that the programs of instruction offered at those institutions were as "sound, comprehensive [and] valuable"³¹ as the University of Missouri's curriculum. In an effort to bolster its finding of "substantial equality," the Court observed that the distance Gaines would be required to travel to attend law schools located in adjacent States would not be any greater than the distance white residents in some areas of Missouri would have to travel to attend the University of Missouri.

In an apparent attempt to placate Gaines, the Court struck down a statutory provision which would have limited the funds supplied to Gaines to the difference between the tuition and fees charged by the University of Missouri and the cost of attending an out-of-state law school and held that the State of Missouri would be required instead to pay "full tuition in the law department of the university of an adjacent state.”³²

Houston and Redmond's final argument was that the Missouri Court should follow the Maryland Court's reasoning in Murray. In the Court's view, however, the circumstances which prompted the Murray decision in Maryland were "radically different" because unlike Missouri, Maryland had not made adequate provisions for the higher education of Black students as Missouri had done with Lincoln University. Based on these findings, the Supreme Court of Missouri held "that the opportunity afforded [Gaines] for a law education in the university of an adjacent State is substantially equal to that offered to white students by the University of Missouri.”³³

Gaines was appealed to the United States Supreme Court. On the day before the oral arguments, Houston rehearsed his argument before a group of students and professors at Howard University Law School. This was one of the first of several "dry runs" that were conducted at Howard in Civil Rights cases.³⁴ On the following day, the University argued that Gaines was not entitled to a writ of mandamus because "if, on the date when [Gaines] applied for admission to the University of Missouri, he had instead applied to the Curators of Lincoln University it would have been their duty to establish a Law School.“³⁵ The Supreme Court found no such "mandatory duty" because the statute on which the University relied left "to the judgment of the curators to decide when it will be necessary and practicable to establish a law school."³⁶ More important, the Supreme Court acknowledged the realities of the situation when it stated that "the fact remains that instruction in law for Negroes is not now afforded by the State either at Lincoln University or elsewhere in the State."³⁷ Based on these findings, the Court reasoned that the real issue was "the question of whether the provision for the legal education in other States of Negro residents of Missouri is sufficient to satisfy the constitutional requirement of equal protection."³⁸

In the Court's view, the quality of legal education provided by States adjacent to Missouri was irrelevant since it determined that the question to be resolved was "what opportunities Missouri itself furnishes to white students and denies to Negroes solely upon the ground of color."³⁹ According to the Court, each state has an independent constitutional obligation to provide equal educational opportunities and this requirement could not be shifted from one state to another.⁴⁰ The Court also concluded that the right to equal protection is a "personal one." Therefore, "the State was bound to furnish [Gaines] within its borders facilities for legal education substantially equal to those which the State there afforded for persons of the white race."⁴¹ Since the State had, in this instance, failed to establish a law school for Black students, the Court held that Gaines was entitled to admission to the University of Missouri Law School.

The Gaines decision was important because the Supreme Court recognized that Black students were entitled to equal educational opportunities and that this obligation could not be satisfied by the provision of out-of state scholarships. For perhaps the first time, the Court actually held that a State was obligated to admit a Black student to a racially segregated school. Houston's "equalization" strategy had borne fruit and the fight against segregation in public schools was well underway. After Gaines, equalization cases were filed in several states and by 1950, the groundwork for the successful direct challenge in Brown had been carefully and firmly established.⁴²

Part 1

Part 2

Part 3

Part 4

The NAACP Connection 

The NAACP was organized to eliminate racial discrimination in 1909. A Harvard undergraduate, Charles Garland, received a bequest from his father in 1919 of more than one million dollars which he used to establish the American Fund for Public Service in 1922. The Fund was devoted to the support of liberal causes, and Roger Baldwin, the director of the newly-formed American Civil Liberties Union, became the chief administrator of the Fund. In 1930, the Fund's Committee on Negro Work, whose members included James Weldon Johnson, the Executive Secretary of the NAACP, Morris Ernst, a member of the NAACP's Legal Committee, and Lewis Garnett, who was also active in the NAACP developed a proposal for a grant to the NAACP. When the proposal was submitted to the Garland Fund, it requested financial assistance for a large-scale campaign to secure the constitutional rights of Southern Blacks designating specifically equal rights in the public schools, voting, transportation, housing and juries.⁹ The Garland Fund initially approved an allocation of $100,000. 

The Fund established a committee to administer the grant and it specifically authorized an "intensive campaign" against "unequal apportionment of school funds, barring Negroes from juries, jim crow cars, and residential segregation by property holder's covenants, disenfranchisement and civil liberties defense.”¹⁰ In its proposal, the NAACP had also indicated that it would retain the services of a "very able lawyer" who would personally direct the campaign.¹¹ On October 4, 1930, the NAACP hired Nathan Margold, a Harvard graduate, as a consultant to develop a litigation strategy. On May 31, 1931, Margold delivered a preliminary report concerning the educational campaign and three days later, he submitted another report which dealt with racially restrictive covenants. With regard to segregation in public schools, Margold recommended a direct challenge to the separate but equal doctrine which was established in Plessy v. Ferguson.¹² In his report, Margold urged that "if we boldly challenge the constitutional validity of segregation ... we can strike directly at the most prolific sources of discrimination." ¹³ According to Margold's analysis, racial segregation, coupled with discrimination, denied equal protection of the law under the Fourteenth Amendment of the United States Constitution. 

Not long after he submitted his report, Margold went to work for the Solicitor of the Department of the Interior. Consequently, the NAACP still needed a "very able lawyer" to conduct its litigation campaign. In 1934, Walter White, who had succeeded James Weldon Johnson as the Executive Secretary of the NAACP, recruited a Black attorney, Charles Hamilton Houston, who was then Dean of Howard University's Law School, to serve full time as the organization's legal counsel. ¹⁴ Houston had graduated from Amherst College with honors in 1915 after being elected to Phi Beta Kappa. He served as an officer in World War I, and later enrolled in Harvard Law School, where he became the first Black student elected to serve on the editorial board of the Harvard Law Review.¹⁵ Houston received an LL.B. and S.J.D. from Harvard. He was awarded a Sheldon Traveling Fellowship which he used to study law for an additional year in Spain at the University of Madrid. 

In 1924, Houston joined the faculty of Howard's Law School and was appointed to serve as Dean in 1929. During his tenure at Howard, Houston transformed the law school from an unaccredited part-time program to a fully accredited institution.¹⁶ In addition to raising standards and improving the program of instruction at Howard, Houston served as the mentor for a generation of Black lawyers who devoted their careers to the Civil Rights cause. Houston believed that the inequities of the American system of racial segregation, which were sanctioned by Supreme Court decisions like Plessy v. Ferguson, could be successfully challenged through innovative litigation.  

The Margold report was a compelling document but Houston disagreed with the direct attack strategy. He did not want to risk, in the mid-1930s, a reaffirmation of Plessy. Houston believed that the NAACP should adopt a more gradual approach, beginning in an area where the separate but equal fiction was most vulnerable and least likely to generate massive opposition when challenged. Houston calculated that the inequalities of the segregated school system were most obvious at the graduate and professional school level. With the exception of Howard University in Washington D.C. and Meharry Medical College in Nashville, Tennessee, there were no graduate or professional schools in any of the Black colleges in the South. 

In Houston's view, if civil actions were filed challenging the southern states' failure to provide graduate educational opportunities for Black students, the states would be required to bear the enormous expense of building and operating separate schools for Black students, or to admit them to white schools. Because of the small number of studentss who would be involved, Houston believed that the opposition would not be as severe at the graduate level as it might be at other levels. If the graduate schools could be desegregated, the NAACP could later direct its attention to colleges and thereafter to secondary and grade schools. This "equalization" strategy was the course which the NAACP elected to pursue under Houston's leadership. ¹⁷ 

After Houston accepted the position of Special Counsel to the NAACP in 1935, a network of Black attorneys evolved which spread itself across the nation. The network combined Howard University Law School, the NAACP's Legal Committees, and the National Bar Association. By the late 1930s, these organizations had become a far-flung network of interconnected Civil Rights organizations which played the pivotal role in Civil Rights litigation. A Missouri case, Missouri ex rel. Gaines v. Canada, was one of the first of several important Supreme Court victories in the equalization cases which eventually led to the 1954 decision in Brown v. Board of Education. 

Part 1

Part 2

Part 3

Part 4

Black attorneys have been active in Missouri for more than a century. However, because the American and local bar associations originally denied membership to Black attorneys, the Mound City Bar Association was established in St. Louis in 1922. After a national organization of Black attorneys was organized in 1926, the Mound City Bar Association became an affiliate chapter of that organization. During the same period, Black attorneys led the NAACP's efforts to eliminate racial discrimination.

The NAACP's legal campaign consisted of a carefully planned litigation strategy involving hundreds of cases over several decades. These cases eventually led to several significant Supreme Court victories and ultimately to the Civil Rights legislation of the 1960s. Two of the most important cases that were involved in that process, Missouri ex rel. Gaines v. Canada¹ and Shelley v. Kraemer,² arose in Missouri and were handled by Black attorneys from St. Louis. Gaines was an important victory in the effort to eliminate racially segregated schools and Shelley was a major step toward the elimination of discrimination in housing.

This article will examine the history of Black lawyers in Missouri during the late nineteenth and early twentieth centuries. It will describe the development of the Mound City Bar Association and explain the relationship of that organization to the National Bar Association. This article will also analyze the development of the NAACP's legal strategy against racial discrimination. And, focusing primarily on the Gaines and Shelley cases, this article will discuss the contributions of Missouri lawyers to that effort.

The Formative Years: 1877-1930

St. Louis' first Black attorney was probably Albert Burgess. Mr. Burgess commenced his practice in 1877 and was active for more than 50 years until his death in 1933. He was an honor graduate of the University of Michigan and served as counselor to the City of Carondelet's Police Court. Burgess was also a vestryman in the All Saints Episcopal Church.³ Another Black attorney, Hutchings Inge, moved to St. Louis from Virginia. Inge received an undergraduate degree from Oberlin College and after completing a law course settled in St. Louis in the mid-1880s.

In 1887, Walter Moran Farmer became the first Black student to be admitted to Washington University's Law School. Farmer endured a hostile atmosphere and attempts were made to force him to leave. Despite these difficulties, Farmer was able to complete his studies in 1889. The law school's graduation ceremonies were delayed that year when the students refused to march with Farmer in the graduation procession. This impasse was finally resolved when the dean of the law school accompanied Farmer down the aisle. Farmer practiced for a period in St. Louis but he eventually moved to Chicago.

By 1921, the number of Black lawyers practicing in St. Louis was sufficient to support the establishment of a professional association. The decision to formally organize is reflected in the following notice which appeared in the St. Louis Argus on December 23, 1921, and on January 6, 1922:

Believing that a closer relationship of the members of the Bar will redound to the benefit of the race and the profession, and with a view of bringing about this much needed result, the undersigned attorneys hereby cordially invite all Negro members of the bar to meet at Pythian Hall, 3137 Pine Street on January 7, 1922 at 8:00 p.m. for the purpose of perfecting a Bar Association. Geo. L. Vaughn, Daniel W. Bowles, Homer G. Phillips, S.E. Garner, Geo. B. Jones, WR. Hill, Jos. A. Smith, Robert N. Owens, Emanuel Williams, N.A. Mitchell. E.H. Taylor, Hutchings Inge, J.H. Roberts and Freeman L. Martin.⁴

The Argus reported later that the attorneys had organized the St. Louis Negro Bar Association and elected George L. Vaughn, President; Robert Owens, Vice-President; Albert Burgess, Treasurer; and George R. Jones, Secretary.⁵

Since the American Bar Association refused to admit Black lawyers, a national organization of Black attorneys, the National Bar Association, was organized in 1926.⁶ The Mound City Bar Association (the Bar Association changed its name in the mid-1920's) later joined the National Bar Association, as an affiliate chapter. Black attorneys from St. Louis served in prominent roles in the national organization. The third president of the National Bar Association, Homer G. Phillips, was elected in 1927. Another St. Louisan, Sidney Redmond, served as the National Bar Association's president from 1939 to 1941. The National Bar Association held its 26th^th annual meeting in St. Louis in August of 1951. During that convention, a St. Louis attorney, Scovel Richardson, was elected president. The National Bar Journal was edited by a St. Louisan, Freeman L. Martin.

During the 1920's, Homer Phillips was one of the most active and influential lawyers in St. Louis. He was born in Sedalia, Missouri, on April 1, 1880. His father was a Methodist minister. Phillips graduated from Howard University Law School in Washington, D.C. After settling in St. Louis, Phillips became active in the city's political arena and was reputed to have a large following among Black voters.⁷ During his lifetime, Phillips fought for equal accommodations for Black citizens on railroad trains, the inclusion of Black students in appointments to West Point, and the improvement of the condition of Black farmers. The Homer Phillips Hospital, which was named in honor of Phillips, served the Black citizens of St. Louis until it was closed in the early 1980's.

The peculiar circumstances of Philips' death provide one of the most mysterious episodes in the history of Black lawyers in St. Louis. On June 18, 1931, the 51-year-old Phillips left his home at 1121 Aubert Avenue, and proceeded south on Aubert to Delmar Boulevard, where he apparently intended to take a streetcar to his office at 23 N. Jefferson. Near the intersection of Delmar and Aubert, Phillips stopped to purchase a newspaper. After selecting a newspaper, Phillips sat on the window-ledge of a business, opened his newspaper and waited for the streetcar. The events which followed were described by a witness who gave the following account to the police:

Phillips was sitting on a low window ledge alongside the Rubicam Business School on the east side of Aubert Avenue reading a newspaper. Suddenly two Negroes appeared. One had an automatic pistol in his hand. He walked up to Phillips and said something. Phillips lowered his paper and looked up. The Negro struck Phillips in the jaw and then opened fire. Phillips swung around just as the Negro started shooting. Six shots were fired. The two assassins ran north on the east side of Aubert to an alley, east in the alley and then north in a bisecting alley, where I lost sight of them.⁸

Phillips' death was a great loss to the St. Louis community. Reports of his death appeared on the front pages of all three of the city's newspapers. Two Black youths were arrested and tried for the murder, but were ultimately acquitted. The murder of Homer Phillips remains officially unsolved.

Part 1

Part 2

Part 3

Part 4

The right of citizens of the United States to vote shall not be denied or abridged by the United States or by any State on account of sex. Congress shall have power to enforce this article by appropriate legislation.

The 19th Amendment to the U.S. Constitution gave all women in the nation the right to vote in 1920. However, the women’s suffrage movement began more than 50 years earlier and Missouri was on the front line. The first petition to allow women to vote came before the Missouri legislature in 1867. It was easily defeated at the time.

That same year, Virginia Minor founded the Woman Suffrage Association of Missouri. This organization predated the American Woman Suffrage Association founded by Lucy Stone the same year and the National Woman’s Suffrage Association founded in 1869 by Elizabeth Cady Stanton and Susan B. Anthony.

Two years later, St. Louis played host to a National Woman Suffrage Convention. At this meeting, Missourians Virginia Minor and her husband Francis proposed the idea that the 14th Amendment (which guaranteed citizenship to all persons born in the U.S. and equal protection of the laws) already protected women’s right to vote.

The argument that it was unconstitutional to deny women citizens the same rights as men under the 14th Amendment was embraced by suffragists and women began showing up at local polling places demanding to be allowed to vote. This tactic was successful in some places. Wyoming was the first state to grant universal suffrage in 1869 followed by Utah in 1870.

On Oct. 15, 1872, Minor was turned away from her local registrar’s office after attempting to register to vote. In November of the same year, Anthony was arrested for voter fraud for voting for Ulysses S. Grant for president in Rochester, New York.

The Minors responded by suing the St. Louis ward registrar Reese Happersett in the St. Louis Circuit Court. The case had to be brought by Francis rather than Virginia because married women could not legally sue in Missouri courts. The Minors’ suit contended that women were U.S. citizens under the 14th Amendment and should thereby not be prevented from exercising the right to vote. The Minors lost in circuit court in 1873 and immediately appealed to the Supreme Court of Missouri. That same year, the state Supreme Court also did not find for them, deeming that the 14th Amendment only granted voting rights to newly freed slaves to protect themselves against oppression.

They appealed again, this time to the U.S. Supreme Court. In Minor v. Happersett, Francis Minor presented the argument for women’s suffrage to the nation’s highest court. In October of 1874, the U.S. Supreme Court ruled that “the Constitution of the United States does not confer the right of suffrage upon anyone,” and upheld the state’s right to determine who was eligible to vote within their jurisdiction.

It was not until March 1919 that Missouri lawmakers allowed women a limited right to vote in presidential elections. The point became moot that year when the 19th Amendment to the Constitution was endorsed and sent to states to ratify. On Aug. 18, 1920, Tennessee became the 36th state to ratify the amendment resulting in women finally gaining the legal right to vote throughout the nation.

2020 marks the centennial celebration of women’s suffrage. A constitutional right which grew from Virginia Minor’s perseverance to see that right become a reality for all women through her ongoing efforts from St. Louis to the U.S. Supreme Court and beyond.

Melinda J. Bentley

Melinda J. Bentley is Legal Ethics Counsel for the Advisory Committee of the Supreme Court of Missouri.

How do you become competent in making those selections and using those technologies? What if there is a loss of a device or data? How do you train your staff? While the Rules of Professional Conduct (Rules) cannot tell you what to buy, fortunately, they do give you clear standards, and further guidance is provided through the Comments to the Rules to assist you with implementing and using technology devices and systems in your practice.² Further, by having a keen understanding of the Rules and Comments, you, as a lawyer, can be proactive in both preventing potential problems and being able to respond efficiently and ethically if a difficulty, large or small, occurs.

Key Ethics Rules: Building A Framework of Understanding

Three key ethics obligations are at the forefront of establishing a lawyer’s understanding in order to prevent potential technology problems: competence, confidentiality, and responsibilities regarding nonlawyer assistants.

Rule 4-1.1 – Competence

The first key ethics obligation underlying a lawyer’s use of technology is found in Rule 4-1.1, which states that “[a] lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.” Further, Comment [6] provides that “[t]o maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education, and comply with all continuing legal education requirements to which the lawyer is subject.” (emphasis added.)

Rule 4-1.6 – Confidentiality of Information

The second key ethics obligation underlying a lawyer’s use of technology is found in Rule 4-1.6(a), which generally prohibits a lawyer from revealing information relating to the representation of a client unless an exception is met. In 2017, the Supreme Court of Missouri adopted an additional requirement for lawyers in Rule 4-1.6(c) that “[a] lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of the client.” Such disclosure or access to confidential client information not only applies to physical information, such as paper documents in a client file, but also to electronically stored information. Think of the large amount of confidential client information lawyers have electronically. That electronic confidential client information makes lawyers’ duty of technology competence under Rule 4-1.1 that much more critical.

Reasonable Efforts on Unauthorized Access and Inadvertent or Unauthorized Disclosure. What constitutes reasonable efforts by a lawyer to safeguard confidential client information to prevent inadvertent or unauthorized disclosure, or unauthorized access? Comment [15] provides guidance to Rule 4-1.6(c) that lawyers are required to act competently regarding safeguarding this information. First, Comment [15] specifically creates three categories of safeguarding information from: (1) unauthorized access by third parties; (2) inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client; (3) and/or inadvertent or unauthorized disclosure by those who are subject to the lawyer’s supervision. When describing these categories, Comment [15] references Rules 4-1.1 (Competence), 4-5.1 (Responsibilities of Partners, Managers, and Supervisory Lawyers), and 4-5.3 (Responsibilities Regarding Nonlawyer Assistants).

Second, Comment [15] provides factors to consider in determining the reasonableness of the lawyer’s efforts, including but not limited to:

the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use).

Comment [15] notes that there is no violation of Rule 4-1.6(c) “if the lawyer has made reasonable efforts to prevent the access or disclosure.”³

Additionally, Comment [15] provides guidance that the client may require the lawyer to implement special security measures that are not required by Rule 4-1.6, but it also notes that a client may give informed consent to forgo otherwise required security measures under Rule 4-1.6. “Informed consent,” as defined in Rule 4-1.0(e), requires communication of “adequate information and explanation about the material risks of and reasonably available alternatives to the proposed course of conduct.” Per Rule 4-1.0(e), guided by Comment [6], informed consent in this context means discussing the material advantages and disadvantages of forgoing security measures, discussing available options and alternatives, and possibly advising the client to seek other counsel on this decision. Factors as to reasonableness will depend on the experience of the client or if the client is independently represented by counsel.⁴

Further, Comment [15] references that it is beyond the scope of the Rules to determine if state or federal data privacy laws require additional safeguards over client confidential information, or notification in the event of a loss of electronic information or unauthorized access to such information.

Finally, Comment [15] advises lawyers to consult Rule 4-5.3 (Responsibilities Regarding Nonlawyer Assistants) and its Comments [3] and [4] regarding supervision of nonlawyer assistants outside the firm.

Reasonable Precautions in Transmission. Comment [16] to Rule 4-1.6 notes that a “lawyer must take reasonable precautions to prevent … information [relating to the representation of a client] from coming into the hands of unintended recipients.” In offering guidance on this responsibility, Comment [16] provides two factors to consider when determining if the lawyer can have a reasonable expectation of confidentiality: first, the “sensitivity of the information,” and second, “the extent to which the privacy of the communication is protected by law or by a confidentiality agreement.”

Comment [16] provides that no special security measures are required “if the method of communication affords a reasonable expectation of privacy.”⁵ Just as with the considerations previously discussed in Comment [15], Comment [16] provides guidance that the client may require the lawyer to implement special security measures that are not required by Rule 4-1.6, but it also notes that a client may give informed consent to forgo otherwise required security measures under Rule 4-1.6. Further, a lawyer may be required to take additional steps to comply with other law, but that is an issue beyond the scope of the Rules.

Rule 4-5.3 – Responsibilities Regarding Nonlawyer Assistants

The third key ethics obligation underling a lawyer’s use of technology is found in Rule 4-5.3, which applies to a lawyer’s responsibilities for the conduct of nonlawyers who are “retained by or associated with a lawyer.” Rule 4-5.3(a) sets the requirements for firm-wide measures to ensure that partners or lawyers with comparable managerial authority make reasonable efforts to make sure the firm has measures in place to give reasonable assurance that the nonlawyer assistant’s conduct is compatible with the professional obligations of the lawyer. Similarly, Rule 4-5.3(b) requires a lawyer with direct supervisory responsibility to make reasonable efforts to make sure the nonlawyer assistant’s conduct is compatible with the professional obligations of the lawyer. Per Rule 4-5.3(c), lawyers are responsible for the conduct of nonlawyer assistants who they employ, retain, or associate with if the conduct of the nonlawyer assistant would be a violation of the Rules of Professional Conduct if engaged in by the lawyer and if one of two scenarios is present:

(1) the lawyer orders or, with the knowledge of the specific conduct, ratifies the conduct involved; or

(2) the lawyer is a partner, or has comparable managerial authority in the law firm in which the person is employed, or has direct supervisory authority over the person and knows of the conduct at a time when its consequences can be avoided or mitigated but fails to take reasonable remedial action.

Comment [2] to Rule 4-5.3 provides guidance on supervising the conduct of nonlawyer assistants employed by a lawyer, including but not limited to administrative assistants, investigators, law student interns, and paralegals. It describes making sure such assistants receive “appropriate instruction and supervision concerning the ethical aspects of their employment,” particularly on preserving confidentiality.⁶ Ways to ensure appropriate instruction include written policies and protocols, as well as regular instruction on the Rules of Professional Conduct and relevant substantive areas of law in which the nonlawyer is providing assistance. Further, specific protocols should be implemented within the law firm to ensure appropriate supervision of the work product of the nonlawyer.

Comment [3] to Rule 4-5.3 provides guidance on using nonlawyer assistants outside the firm who assist the lawyer in rendering legal services to a client, including but not limited to retaining investigative or paraprofessional services, hiring a document management company, sending client documents to a third party for printing or scanning, and using a service based on the internet to store client information. Lawyers using these services still must make reasonable efforts to ensure that the services are provided in a manner compatible with the lawyer’s professional obligations, and the extent of those efforts will depend on the circumstances.⁷

Applying the Rules to Potential Technology Issues

The Growing Need for Technology Competence

As provided for in Rule 4-1.1 and its Comment [6], lawyers do have an ethical obligation to be competent in technology, including its risks and its benefits, in a lawyer’s practice. For example, a lawyer in Oklahoma was publicly censured in 2016 based on a reciprocal discipline from the United States Bankruptcy Court for the Western District of Oklahoma where the lawyer was suspended for failure to file documents in a manner that was compatible with applicable rules.⁸ The lawyer failed to report his discipline in the Bankruptcy Court to the Oklahoma Bar Association and also failed to timely notify his clients of his suspension.⁹ During the hearing before the trial panel of the Oklahoma Bar Association’s Professional Responsibility Tribunal, the lawyer “acknowledged his problems with the bankruptcy court were caused by his lack of expertise in computer skills and his frustration trying to meet the federal court’s expectations with electronic pleading requirements.” The trial panel reported that the lawyer’s problems were not with his knowledge of substantive bankruptcy law, but instead “technological proficiency.”¹⁰ The Supreme Court of Oklahoma, in issuing its public censure of the lawyer, encouraged him to “continue to improve his computer skills, or better, to hire an adept administrative assistant to do his pleadings.”¹¹

While hiring adept support staff is helpful in some circumstances when properly supervised per Rule 4-5.3, it is not a substitute for a lawyer’s own technology competency as required by Rule 4-1.1. What are some ways to gain technology competency skills? The answers will be different for each lawyer depending on the lawyer’s practice setting and level of technological savvy. One of the best ways to gain the requisite skill and knowledge about the risks and benefits of relevant technology for a law practice is by taking continuing legal education programs related to technology.¹² While Missouri does not require that lawyers receive specific minimum continuing legal education (MCLE) credits related to technology competence, it does offer MCLE accreditation of a number of technology programs that help lawyers gain and maintain professional competence as it relates to the practice of law, professional responsibility, or law office management.¹³

There are several resources readily available to help lawyers build their technology competence, including articles, publications, blogs, podcasts, and more. When it comes to these resources, lawyers should be sure to check that they are receiving information from reputable sources that are appropriate for their practice settings.¹⁴ Malpractice insurance providers may also have resources or standards for insureds.

Additionally, lawyers should read the terms and conditions of service carefully for each new hardware or software item they consider incorporating into their practices to ensure the item has appropriate safeguards for maintaining client confidential information.¹⁵ Further, lawyers should consider consulting an information technology (IT) professional for assistance.¹⁶

Email and Other Electronic Communications

If lawyers are using email to communicate with clients, they must take reasonable precautions to prevent the unintended interception of confidential client information and should only use email upon proper consideration of Rule 4-1.6 and Comments [15]-[16].¹⁷ While email may be appropriate in some circumstances, other circumstances where the lawyer is transmitting highly sensitive information may require special security measures to comply with Rule 4-1.6.¹⁸ Special security measures may include using email encryption software, placing password protection on attachments, or using “a well vetted and secure third-party cloud based file storage system to exchange documents.”¹⁹ Remember that Rule 4-1.6(c) requires a lawyer to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of the client.” In looking to the factors discussed in Comment [15] to Rule 4-1.6 as to reasonable efforts to prevent access or disclosure, consider having a conversation with the client at the outset of the representation to determine if email is an appropriate means of communication. Some points to consider are:

• How do the lawyer and the client want to use email to communicate?
• What information will the lawyer and client be exchanging by email?
• What are the terms and conditions of the platforms that host both the lawyer’s email and the client’s email? Are the platforms ensuring privacy or are they mining emails for personal information?
• How is the client going to be accessing the email?²⁰ On a personal or work phone or computer? Who else has access to that device or the email account?

Consider these points, as well as the sensitivity of the information being transmitted, to determine if additional security measures are necessary or if email should even be used.²¹ By asking some of these questions, it should help the lawyer determine if he or she is acting reasonably in using email as a form of communication.

Other forms of electronic communication may include online client portals that have communication features or by texting. Similar questions about confidentiality and appropriateness of the medium should be asked for each of these other potential forms of electronic communication.

Also, lawyers should be mindful that if they are using one of these forms of electronic communication with clients, the correspondence needs to be retained for the client files in accordance with Rule 4-1.22 (Retaining Client Files) and Advisory Committee of the Supreme Court of Missouri Formal Opinions 115 (no withholding of property belonging to the client to enforce payment of fees or expenses) and 127 (scanning client files).²²

Data Backups, Case and Document Management Systems, and Electronic File Retention

When considering how to backup data, a lawyer should consider the nature of the information to be backed up. Most of it will likely be confidential client information, but it may include items such as trust account records, business records, and much more. Whether a lawyer is considering online (i.e., cloud)and/or on-site backups, those backups pertaining to confidential client information are governed by Rule 4-1.6 and guided by Comments [15] and [16].²³

Guidance is provided to lawyers regarding cloud backups in Missouri Informal Advisory Opinion 2018-09. It describes how lawyers need to maintain competence in using relevant technology per Rule 4-1.1, safeguard confidential client information per Rule 4-1.6(c), and supervise per Rule 4-5.3.²⁴ It also cautions lawyers to read the terms and conditions of service carefully to determine ownership and security of client information and the level of access the attorney and provider will have to that client information. It goes on to describe what constitutes reasonable efforts to safeguard confidential client information while using cloud computing, including but not limited to:

• Security measures protecting confidentiality of client information during transmission and storage;
• Prompt notification of attorney in the event of a security breach or provider’s receipt of a subpoena for client information;
• Ownership of data solely by attorney or attorney’s firm;
• No access rights by the provider to client information, except as required by law;
• Regular data backup by the provider;
• Handling of client information in the event attorney’s relationship with the provider is terminated;
• Compliance with applicable law regarding data storage and transmission;
• Reliable access to data by attorney;
• No access to data by third parties, including advertisers, except as required by law; and
• Domestic storage of data or, alternatively, storage in a jurisdiction subject to United States data protection laws or equivalent.²⁵

It also provides guidance that lawyers should review the provider policies and practices periodically, as these can change.²⁶

For on-site backups, lawyers should consider such things as the physical security of the equipment storing the confidential information, level of encryption, and redundancy (the same data being stored in multiple ways in case one system fails). Lawyers should consult with an IT professional to assist in properly setting up and maintaining this system.

Many case or document management systems are now provided by vendors as cloud-based services, though some are still provided for on-site network usage. When selecting a case or document management system, lawyers should consider similar factors as just discussed for cloud or on-site back-ups.

When backing up client information, lawyers should be mindful that they are required to securely store client files for six or 10 years after the completion or termination of the representation absent having an agreement with the client based on informed consent confirmed in writing.²⁷ The six-year client file retention applies to client files where the representation was completed or terminated on or after July 1, 2016, and the 10-year requirement applies where the representation was completed or terminated prior to July 1, 2016.²⁸ “Client files, except for items of intrinsic value, may be maintained by electronic, photographic, or other media provided that printed copies can be produced. These records shall be readily accessible to the lawyer.”²⁹ Advisory Committee of the Supreme Court of Missouri Formal Opinion 127 permits the destruction of paper files (except for items of intrinsic value) prior to the expiration of the required retention period if the files are maintained electronically for the required period in accordance with the Rules of Professional Conduct.³⁰

Keeping Client Confidential Information Secure on Phones, Laptops, Tablets, Etc.

Just as lawyers have an obligation to secure physical files of clients from unauthorized access, the same is true of electronic files lawyers maintain on portable electronic devices such as phones, laptops, tablets, and other similar devices.³¹ Whether the devices are those of the firm, or lawyers and employees are permitted to bring their own devices and use them for firm business, reasonable measures may include some of the following suggestions:

• Take reasonable steps to ensure confidentiality by, at a minimum, having strong passwords to access these devices.³²
• Passwords should be changed periodically.³³
• Consider additional safeguards such as encrypting the data on these devices, using multi-factor authentication to access firm systems.³⁴
• Avoid public Wi-Fi and only choose secure Wi-Fi, as well as consider using a virtual private network (VPN).³⁵
• For lost or stolen devices, have a way to remotely disable the devices and destroy the data contained on those devices.³⁶
• Implement firewalls, keep updated anti-malware, anti-spyware, and anti-virus protections on all devices where confidential client information is stored or transmitted.³⁷
• Apply all security patches and updates for software and devices.³⁸

These suggestions are some starting points for what constitutes reasonable measures to secure client confidential information and are not intended to be an exclusive list. As previously suggested, lawyers should be sure to consider the type of client confidential information and applicable state and federal laws. The prudent lawyer will consider consulting with an IT professional, the lawyer’s malpractice insurance carrier, and other appropriate resources for additional guidance.

Metadata

Another source of client confidential information lawyers should be mindful of securing is metadata, meaning electronically embedded data.³⁹ Informal Advisory Opinion 2014-02 asks in the litigation context if a lawyer “has an ethical obligation to make good faith efforts to prevent the inadvertent electronic transmission of embedded metadata to opposing party or counsel?” Citing Rule 4-1.6, guidance is provided that the lawyer must use reasonable care to ensure that no confidential client information related to the representation is revealed without the client’s consent, including confidential information that is contained in embedded metadata.⁴⁰ It provides that this may require scrubbing documents of metadata before transmitting them.⁴¹ However, the Informal Advisory Opinion goes on to note:

Efforts to protect confidential information must be exercised in light of Attorney’s obligation pursuant to Rule 4-3.4(a) not to unlawfully obstruct another party’s access to evidence or unlawfully alter, destroy, or conceal evidence. Removing metadata with evidentiary value before transmitting certain documents may constitute a violation of laws governing discovery and therefore violate Rule 4-3.4(a). This informal opinion does not render an opinion about the existence of discoverable evidence in particular metadata or about the effect on substantive legal privileges of the pre-transmission removal or lack of removal of metadata.⁴²

Responding to a Loss of Client Confidential Information Due to a Lost Device or File, Data Breach, or Cyberattack

Lawyers are custodians of highly sensitive information and can be prime targets for hackers.⁴³ Missouri Informal Advisory Opinion 2017-02 discusses a lawyer’s ethical duties when a nonlawyer assistant has disclosed client confidential information to third parties, but the ethics analysis as it relates to disclosing this breach to the client will be similar in the event of a lost device or file, data breach, or cyberattack. It advises that lawyers have an obligation under Rule 4-1.4 (Communication) to disclose the confidentiality breach to the affected client and explain the matter to the extent necessary for the client to make an informed decision about the representation. That disclosure also needs to occur in the event of a lost device or file where client confidential information is disclosed, whether lost by the lawyer or a nonlawyer assistant employed or retained either inside or outside the law firm, as the lawyer is responsible for that conduct under Rule 4-5.3. A similar communication is also necessary in the event of a data breach or cyberattack where confidential client information is disclosed.⁴⁴

Rule 4-1.6(c), requiring reasonable efforts to prevent inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation, also notes in Comments [15] and [16] that state and federal data privacy laws may govern or impose notification requirements upon a loss of electronic information or unauthorized access, so lawyers should be mindful of these laws both in how they choose to safeguard confidential client information and handle a loss of such information.

Working with IT Professionals and Vendors Outside the Law Firm

While lawyers may be aware of the obligations to train and supervise nonlawyer assistants within the firm, Rule 4-5.3, Comment [3] reminds lawyers that these same obligations apply regarding nonlawyer assistants employed or retained outside the firm. These include outside IT professionals lawyers may hire to help support their firms and vendors who provide services based on the internet to store client information such as data backup provides, case or document management programs, or other similarly based services used within the firm. Lawyers have the obligation to make reasonable efforts to ensure that the services are provided in a manner compatible with their professional obligations under the Rules.

Reasonable efforts will vary depending on the circumstances, “including the education, experience and reputation of the nonlawyer; the nature of the services involved; the terms of any arrangements concerning the protection of client information; and the legal and ethical environments of the jurisdictions in which the services will be performed, particularly with regard to confidentiality.”⁴⁵ Directions should be communicated to the nonlawyer in a manner appropriate under the circumstances so as to give reasonable assurance that the conduct of the nonlawyer is compatible with the professional obligations of the lawyer.⁴⁶ Missouri Informal Advisory Opinions 20070008 and 20050068 both suggest confidentiality agreements should be used when working with nonlawyer vendors and service providers outside the firm. Such agreements are also advisable when working with outside IT professionals, as well as direct training, as appropriate, on confidentiality and other applicable professional obligations of lawyers to ensure the IT professionals’ conduct is compatible with the conduct of lawyers.

Be Aware of Scams

Lawyers are frequently the targets of potential scams, as lawyers may hold trust account funds for clients as well as sensitive confidential client information. These potential scams often start as emails from those purporting to be legitimate sources, such as potential clients, known clients, financial institutions, businesses, government entities, etc., but are actually phishing attempts to gain access to funds and/or personal information of lawyers or clients. Additionally, emails containing links or attachments from known or unknown senders may contain viruses, malware, spyware, ransomware, or other mechanisms to corrupt computer systems and/or gain access to sensitive information. Lawyers must be savvy to these potential scams and train themselves and their nonlawyer assistants to prevent these breaches.

Trust account scams are some of the most common attacks against lawyers. Lawyers who believe they may have clients who have provided fraudulent checks in an effort to obtain good funds from lawyers’ trust accounts wonder how to ethically proceed. Guidance has been provided in Informal Advisory Opinion 2018-06, which addresses such a potential scam scenario in which a lawyer’s purported prospective client sent the lawyer a bogus check for deposit into the trust account. That Informal Advisory Opinion discusses whether the lawyer may report this purported prospective client to law enforcement. Whether a lawyer-client relationship exists is a question of law and fact that is outside the scope of the Rules of Professional Conduct, but if the lawyer had a prospective client relationship under Rule 4-1.18, the lawyer would not be able to use or disclose information gained in the consultation except as would be permitted under Rule 4-1.9 as though this person were a former client.⁴⁷ If no lawyer-client relationship existed, and this person was not a prospective client, the lawyer would not have a duty of confidentiality and would be free to make a report to law enforcement authorities.⁴⁸

Conclusion

As a lawyer, you should work to gain and maintain competence in technology, engage in reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of clients, and exercise appropriate professional responsibilities over the conduct of nonlawyer assistants both inside and outside the law firm. Focusing on these key ethics rules will assist you in selecting technology devices and systems in your firm, and help prevent breaches of client confidential information. If you have questions about the Rules of Professional Conduct regarding incorporating technology into your law practice, you are encouraged to contact the Legal Ethics Counsel office (www.MO-Legal-Ethics.org) to seek an informal advisory opinion about your prospective conduct.

Endnotes

1 Melinda J. Bentley is Legal Ethics Counsel for the Advisory Committee of the Supreme Court of Missouri.

2 See Rule 4, Scope [14].

3 Rule 4-1.0(h) defines “reasonable” or “reasonably” to be “conduct of a reasonably prudent and competent lawyer.”

4 See Rule 4-1.0, Comment [6].

5 See infra discussion of email.

6 See also Mo. Informal Advisory Opinions 2018-04 and 2017-02 (interpreting Rule 4-5.3 as it applies to nonlawyer assistants within a law firm). Informal Advisory Opinions are published on The Missouri Bar’s website at: https://mobar.org/site/Lawyer_Resources/Legal_Ethics_Opinions/site/content/Lawyer-Resources/Legal_Ethics_Opinions.aspx

7 See Mo. Informal Advisory Opinion 2018-09 (interpreting Rule 4-5.3 as it applies to use of a cloud computing vendor outside the firm).

8 State of Oklahoma ex rel., Oklahoma Bar Ass’n v. Oliver, 2016 OK 37, 369 P.3d 1074 (2016).

9 Id. at ¶15, 369 P.3d at 1077.

10 Id. at ¶5, 369 P.3d at 1075.

11 Id. ¶15, 369 P.3d at 1077.

12 See Mo. Informal Advisory Opinion 2018-09 (providing guidance on technology competence through continuing legal education courses).

13 See Rule 15.04(b): “A program or activity may be an accredited program or activity if it directly contributes to the professional competency of lawyers or judges and has significant intellectual or practical content related to the development or practice of law, professional responsibility, or law office management.” See also Rules Related to The Fla. Bar, Ch. 6, R. 6-10.03(b) (requiring Florida lawyers to take at least three of 33 MCLE credit hours every three years in approved technology programs), and 27 N.C.A.C. Ch. 1D – § .1518(a)(2) (requiring North Carolina lawyers to take at least one hour annually of MCLE devoted to technology training.)

14 See Mo. Informal Advisory Opinion 2018-09.

15 See Id. and Rule 4-1.6, discussion supra; see also Legal Ethics Counsel Resource Page — Electronic Comunication Resources, http://molegalethics.org/electronic-communication-resources/.

16 See Id. and Rules 4-1.6 and 4-5.3, discussion supra.

17 See Mo. Informal Advisory Opinion 2012-01 (providing guidance on use of email).

18 Id.

19 ABA Comm’n on Ethics & Prof’l Responsibility, Formal Opinion 477R (revised May 22, 2017).

20 See Mo. Informal Advisory Opinion 990007 (providing guidance on use of email, including consideration of settings of sender and receiver).

21 See Rule 4-1.6, Comment [15].

22 Mo. Sup. Ct. Advisory Committee Formal Opinions are published on the website of the Supreme Court of Missouri at: http://www.courts.mo.gov/page.jsp?id=11696.

23 See supra discussion of Rule 4-1.6.

24 See supra discussions of Rules 4-1.1, 4-1.6, and 4-5.3.

25 Mo. Informal Advisory Opinion 2018-09.

26 Id.

27 See Rule 4-1.22.

28 Id.

29 Id.

30 See also Legal Ethics Counsel Resource Page, File Retention Resources, http://molegalethics.org/file-retention-resources/.

31 See Mo. Informal Advisory Opinion 980030 (providing guidance on preventing physical client file access in an office-sharing arrangement) and Rule 4-1.6(c).

32 ABA Comm’n on Ethics & Prof’l Responsibility, Formal Opinion 477R (2017) (revised May 22, 2017).

33 Id.

34 Id.

35 Id. See also Jill D. Rhodes & Robert S. Litt, The ABA Cybersecurity Handbook 35 (2d ed. 2018) (“Wireless communication creates opportunities for hackers to intercept sensitive data such as passwords for logging in to corporate networks and online banking sites. Public Wi-Fi locations such as airports, hotels, and coffee shops — convenient places to check email — often do not have security features necessary to protect confidential client data.”).

36 ABA Formal Opinion 477R, supra note 32.

37 Id.

38 Id. See also Rhodes & Litt, supra note 35, 21-22 (2d ed. 2018), (describing cyber-attacks against law firms due to outdated software that had not been updated).

39 See Rule 4-4.4, Comment [2] (describing metadata as a form of electronically stored information).

40 Mo. Informal Advisory Opinion 2014-02.

41 Id.

42 Id.

43 See ABA Comm’n on Ethics & Prof’l Responsibility, Formal Opinion 483 (2018).

44 Id.

45 Rule 4-5.3, Comment [3].

46 Id.

47 Mo. Informal Advisory Opinion 2018-06.

48 Id.

For the past 60 years, Missouri lawyers have learned the same statutory requirements for the creation of a valid last will and testament in Missouri: (1) it must be in writing; (2) it must be signed by the testator or someone at her direction and in her presence; and (3) it must be witnessed by two or more competent witnesses in the presence of the testator.[2]

But in reality, the requirements for the valid creation of a will have been around much longer. Missouri draws its Statute of Wills from the English Statute of Frauds of 1677,[3] and these requirements were also included in Missouri’s territorial laws prior to statehood.[4] These basic elements have remained largely unchanged for the past 450 years.

In the age of the smartphone, social media, and cloud storage, should these requirements evolve? Further, given the number of will substitutes available with less onerous execution requirements (including trusts and pre-death and on-death transfers), wills are of decreasing importance. Technological advances are nothing new, and in many ways Missouri laws have stayed current.[5] Restraint is justified to avoid fads, but the question remains whether it is time to reconsider the inviolate requirements of will preparation, execution, and probate.

The Missouri Bar recently created a subcommittee on electronic wills to consider just this issue. Missouri will not be the first state to consider permitting some form of electronic will, and it likely will not be the last. Given that there are already multiple states that permit electronic wills, the reality is that Missouri practitioners and courts will have to deal with some aspects of electronic wills – including the probate thereof.[6]

“Electronic Wills” Are Already Here

Assume you have recently been hospitalized and are told that you have only days to live.[7] You do not have much in the way of assets, but you do want to ensure that the right people receive your limited assets upon death. You have no paper and no pen, but you do have the iPad you have used to watch Netflix the past couple of weeks in the hospital. Your family and friends are at your side and you tell them that you want to make a will. You tell your sister what you want to say, and she dutifully writes everything down on the iPad with a stylus. She reads it back to you to make sure it is exactly correct. It is short – all it says is that upon your death, you want your house to go to your friend, your car to your brother, and your treasured baseball card collection to your nephew. You sign the iPad using the stylus, and so do your parents. Your mother retains the password-protected iPad until your death two days later and thereafter. A month later, your mother arrives at the probate court and asks for the forms to admit your will and open probate. Should your “iPad will” be admitted? Although the issue has never been presented in Missouri, the answer appears to be “yes.”

Present Missouri law requires that all wills be “in writing.”[8] Nowhere in Chapter 474 is “in writing” defined, but elsewhere in Missouri law, applicable to “the statutory laws of this state,” that phrase is interpreted to include “printing, lithographing, or other mode of representing words and letters.”[9] Missouri courts have consistently held that “[a]nything written, in any form, goes for a will, if it reveals the intention of the maker to dispose of his property at death.”[10] So, your iPad may well be “in writing” under Missouri law.

Missouri law also requires that the will be “signed by the testator, or by some person, by his direction, in his presence.”[11] Again, that requirement is not further discussed in Chapter 474, but it is elsewhere stated that “in all cases where the signature of any person is required, the proper handwriting of the person, or his mark, is intended.”[12] Given that you signed the iPad with the stylus, it appears that you properly “signed” your will. Indeed, had your sister signed your name or made your mark at your direction, this would have been sufficient – even if you had the ability to sign it yourself.

Finally, your will must be “attested by two or more competent witnesses subscribing their names to the will in the presence of the testator.”[13] The testator is required to “publish” her will to the witnesses – that is, she must “either by words, acts, signs or conduct make it clear to the witnesses that he intends the paper signed to be his will….”[14] There are additional considerations for will witnesses. Although a will is not invalid because a witness receives something thereunder, if there are not two or more disinterested witnesses, interested witnesses must “forfeit so much of the provisions therein made for him as in the aggregate exceeds in value, as of the date of the testator’s death, what he would have received had the testator died intestate.”[15] Because your parents, who receive nothing under this iPad will, were the witnesses, it was properly witnessed.

Based on the foregoing, it appears your iPad will may well be valid and should be probated in the State of Missouri. While there may be additional difficulties in the probate process given the lack of compliance with the self-proving will statute,[16] the unique form and presentation of this document should not destroy your donative intent. This was exactly the situation in the Ohio case of In re: Estate of: Javier Castro, Deceased (“Castro”).[17] In Castro, the probate court for Lorain County, Ohio, probated a will prepared and signed on a tablet.[18] It determined that the requirements for a valid Ohio will (which are similar to those in Missouri) were satisfied by the tablet, which was signed by the testator and two witnesses.[19] The Castro court then opened probate for the decedent to be administered in accordance with the tablet will.[20]

While these types of “offline” electronic wills have been exceedingly rare in the law, their frequency will increase with time.[21] Both to address these scenarios,[22] as well as more fully electronic wills, a number of states and the Uniform Law Commission (“ULC”) have considered, and are considering, electronic will legislation.

The Genesis of Electronic Wills

In 2000, Congress passed the Electronic Signatures in Global and National Commerce Act,[23] which allowed for electronic signatures in “any transaction in or affecting interstate or foreign commerce.”[24] But like Missouri’s adoption of the Uniform Electronic Transactions Act,[25] that statute specifically excepted any “statute, regulation, or other rule of law governing the creation and execution of wills, codicils, or testamentary trusts.”[26] Consequently, current law was of no assistance to those seeking to execute an electronic will.

One year later, however, the Nevada Legislature passed Senate Bill 33, which was signed into law by Gov. Kenny Guinn on June 6, 2001.[27] What could have been a revolutionary change in probate law, however, never really came about. The 2001 Nevada statute provided that electronic wills were valid so long as they (1) are written, created, and stored in an electronic record; (2) contained the date and the electronic signature of the testator and which includes, without limitation, at least one authentication characteristic of the testator; and (3) created and maintained such that (i) only one authoritative copy exists; (ii) that copy is maintained by the testator or custodian; and (iii) authoritative copies are readily identifiable as such.[28] The requirement for an “authentication characteristic” included things such as a “fingerprint, a retinal scan, voice recognition, facial recognition, [or] a digitized signature.”[29] These requirements were seen as onerous, especially in a state that allows for holographic wills.[30] As a result, Nevada electronic wills under the 2001 statute never gained wide popularity.

The Recent Push for Electronic Wills

Over the past several years, there have been renewed discussions regarding electronic wills. Companies that seek to offer online electronic will services have advocated for an overhaul of states’ probate codes to allow for those documents.[31] Three states have joined Nevada in allowing electronic wills, and the ULC recently passed a model act.[32]

Nevada revised its electronic will statute in 2017.[33] The state expanded on the provisions allowing for a valid electronic will by adding notarial certification and dual witnessing as alternatives to the existing “authentication characteristic.”[34] But Nevada went a step further. There, required notarial certification and/or witnessing can be performed remotely. While the notary and/or witnesses must be in the “presence” of the testator, presence includes “[d]ifferent physical locations but can communicate with each other by means of audio-video communication.”[35] Further, the Nevada statute provides that a will can be validly executed under Nevada law even outside the State of Nevada so long as (1) the document states that Nevada law applies; (2) the witnesses or notary are in Nevada; or (3) the testator understands and intends to make a Nevada will.[36] The net result of this is that a Missouri testator, from the comfort of his or her couch, can make a legally binding Nevada electronic will without ever leaving the state. And when that testator dies, Missouri courts will be left to struggle with whether and how to probate that will.

Similar legislation was proposed in Florida and passed by the legislature in 2017,[37] but was ultimately vetoed by Gov. Rick Scott.[38] In his veto letter, Scott raised concerns regarding the electronic notary and other provisions, including remote witnessing.[39] Scott recommended that the legislature “address the issues comprehensively during the next legislative session.”[40] In 2019, the Florida Legislature passed, and Gov. Ron DeSantis signed, House Bill 409 that will go into effect January 1, 2020.[41] Similar to the prior proposed legislation, this new law will permit remote witnessing and notarization.[42] Importantly, however, Florida will not permit “vulnerable adults”[43] to have documents recorded in electronic format, remotely notarized, or remotely witnessed.[44]

In 2018, the Indiana Legislature passed, and Gov. Eric Holcomb signed, House Bill 1303, which permitted for the first time electronic wills in Indiana.[45] That bill added a new Chapter 21 to the Indiana Probate Code. The Indiana electronic will law does not allow for remote notarization or remote witnessing.[46] It provides for significant regulations that must be followed, including directions to the testator, maintenance of the electronic will, filing of the electronic will, and revocation of the electronic will.[47] Indiana further states that electronic wills are only valid if they were validly executed (1) in Indiana; (2) in the state where the testator was physically present at execution; or (3) where the testator died.[48]

Arizona has also passed electronic will legislation that went into effect July 1, 2019.[49] Similar to Indiana, Arizona also requires the physical presence of the testator, witness, and notary public.[50] To be self-proving, the electronic will must also designate a custodian who is neither related to the testator nor a recipient of any bequest under the electronic will.[51] That qualified custodian must also maintain a photograph of the testator and the witnesses, a video and audio recording of the execution, and copies of all parties’ relevant identification.[52] Similar to Indiana, that bill also contains other procedural mechanisms and safeguards.[53]

Other states and territories, including New Hampshire, Virginia, California, and the District of Columbia have either introduced or considered legislation relating to electronic wills. To date, none of these has become law.

The ULC Process

The ULC (formerly known as the National Conference of Commissioners on Uniform State Laws), “established in 1892, provides states with non-partisan, well-conceived and well-drafted legislation that brings clarity and stability to critical areas of state statutory law.”[54] Missouri has adopted, either in whole or in part, dozens of uniform state laws. In the probate and trust context, this includes the Uniform Trust Code, the Uniform Fiduciary Access to Digital Assets Act, the Uniform Simultaneous Death Act, the Uniform Transfers to Minors Act, and others. Often, Missouri practitioners will be involved either directly with the drafting of, or input into, the proposed uniform law.

In October 2017, the ULC Committee on Electronic Wills began working on drafting a model statute. In considering legislation, the committee considered 10 key issues:

1. What is an electronic will?

2. What definitions will be needed?

3. How is an electronic will created?

4. How should an electronic will be signed?

5. How will an electronic will be stored?

6. What is the effect of a codicil?

7. How is an electronic will revoked?

8. Will an electronic will executed in one state be valid in another?

9. Should there be a supervisory entity for service providers?

10. What are potential costs and fiscal notes?[55]

In March 2018, this committee produced its first draft of a model electronic wills act.[56] That draft legislation attempted to answer certain of the aforementioned questions, but in a way that would allow states maximum flexibility given varying probate laws. That committee continued its work and ultimately approved and recommended for enactment in all states the Uniform Electronic Wills Act during its July 2019 annual conference.[57]

Caution is Justified

A balance must be achieved between recognizing the traditional functions of a will or other testamentary document and the benefits of evolving technology. It has been stated (and recognized by ULC)[58] that a will traditionally serves four functions:

1. The evidentiary function: One of the primary purposes of a will is to provide the court and the beneficiaries with evidence of the testator’s intent and wishes;

2. The channeling function: Wills force testators to formally set forth their wishes in a somewhat standardized format;

3. The cautionary function: By maintaining a seriousness to formal will execution and probate, the testator’s true and final intentions are realized; and

4. The protective function: The heightened requirements of will execution tend to discourage improper influence, as well as forgeries and perjury.

With these goals in mind, the question is whether these same functions can be achieved in a time of ever-evolving technology. Missouri may avoid “will by text message” or “will by Twitter,” but there are certainly options that can be considered to modernize Missouri’s requirements to incorporate technology while maintaining the safeguards and functions identified above. In so doing, one temptation to be avoided is to look at electronic wills only in terms of today’s technology. What would have happened if Missouri passed “will-by-fax” legislation in the 1980s or 1990s?

Regardless of whether statutory modification is ultimately adopted, it should at least be considered. As stated above, these issues may already arise, such as the Castro tablet will. And given the fact that other states now permit electronic wills, Missouri will need to address how to probate them. Statutory modification will prevent the likely haphazard results that would come with 115 probate courts independently considering tablet and foreign electronic wills, and, if completed correctly, will similarly avoid the need to wait for appellate guidance on what could be, by that time, outdated technology.

Even though some states have already enacted electronic will legislation, and others undoubtedly will, there is no need to rush into comprehensive electronic will legislation. Much will be learned from the experiences of the ULC and the other states that are considering this issue. More ideas will emerge, and Missouri can be guided by reviewing many different options for potential implementation. The likelihood of harm is much greater with rushed legislation than with addressing a small number of fact-specific probate inquiries. The ULC has stated that the goals of a statute on electronic wills should include:

1. To allow a testator to execute a will electronically, while maintaining the safeguards wills law provides for wills executed on something tangible (usually paper);

2. To create execution requirements that, if followed, will result in a valid will without a court hearing to determine validity, if no one contests the will; and

3. To develop a process that would not enshrine a particular business model in the statutes.[59]

These goals are worthy of consideration. Missouri occupies an odd position when it comes to probate and trust laws. In some areas, it is a leader and one of the first to adopt legislation. But in others, it is less willing to consider changes adopted in other states. By way of example, Missouri still does not allow holographic wills (unless the formalities of Missouri’s Statute of Wills are met); nor does it allow for even harmless errors in the execution of wills. One thing for which Missouri is well known, however, is the careful and deliberate consideration of changes to its probate and trust laws. Electronic wills should be no different.

Items to Consider

In moving forward in this process, there are a number of things to consider. These are not dissimilar to the questions that the ULC has identified above, but Missouri has a few unique issues. Missouri still operates largely on its own probate code that was adopted in the 1950s. Missouri did not adopt the totality of the Uniform Probate Code, on which aspects of the ULC model legislation is based. As a result, Missouri will need to review its probate statutes to determine which provisions would need to change to allow for electronic wills.

Assuming the threshold question of whether Missouri wants to consider electronic wills is answered in the affirmative, the next issue will be in what form and how far Missouri will go. There are ways to draft electronic will legislation that looks much more like a traditional will execution as opposed to “will by text.” Many believe the functions listed above and the safeguards in the current Statute of Wills can be maintained yet updated. Others are likely to say that the current system works just fine. But the reality is the majority of the members of Generation X and later do not have estate plans. Specific issues to consider would include the following:

1. Should Missouri require the witnesses and the notary to be in the same physical location as the testator, or should it embrace the concept of “electronic presence”?

2. Should Missouri consider changes to the notary public laws to allow for remote online notarization irrespective of the electronic wills issue?

3. Should Missouri require that the electronic will be in a written medium, or should it consider audio or video wills?

4. How should Missouri handle the revocation of electronic wills where many electronic copies may exist?

5. Should Missouri consider utilizing custodians for these documents?

6. Should Missouri create a procedure for creating a paper copy of the electronic document to be probated?

7. Should Missouri consider a “harmless error” statute for written or electronic wills such that documents not in conformity with the statutory requirements could still be admitted based on a showing of clear and convincing evidence?

Even assuming Missouri does not wish to enact comprehensive electronic wills legislation, it must still address whether to admit to probate electronic wills from other states. Currently, Missouri courts will probate a will if it is validly executed “where the will is executed.”[60] Given that states such as Nevada and Florida will deem electronic wills executed in those states even when done so remotely (including from Missouri), that statute should be addressed regardless.[61]

Missouri must also decide whether this discussion should include trusts as well as wills.[62] Our state law already recognizes that trusts have lower execution requirements than wills. Missouri trusts are not even required to be in writing (unless they transfer an interest in land).[63] It would therefore make sense – if changes are considered to the requirements for the execution of a will to allow for electronic wills – that clarifications are also considered on electronic trusts and potentially other electronic estate planning documents as well.

Conclusion

“[I]n this world nothing can be said to be certain, except death and taxes.”[64] Missouri law has, for longer than its statehood, recognized that its citizens are free to dispose of their property by will. Now, centuries later, there are available technologies that could make it easier than ever for Missourians to express their donative intent. But as with all technology, these changes come with consequences and potential dangers. Missouri should consider if, and how, to allow for the drafting, execution, and probate of electronic wills.[65]

Endnotes

1 John M. Challis is the chairperson of The Missouri Bar Subcommittee on Electronic Wills and chairperson of The Missouri Bar Fiduciary Litigation Committee. He is a partner in the St. Louis office of Kirkland Woods & Martinsen, LLP. Challis is a frequent speaker on topics related to probate and trust administration and litigation throughout Missouri. He can be reached at (314) 944-5201 or jchallis@kwm-law.com.

2 Section 474.320, RSMo 2017. A narrow exception applies for noncupative (oral) wills made by persons in “imminent peril of death” that are limited to $500 in property. Section 474.340, RSMo 2017.

3 29 Car 2 c 3.

4 Act July 4, 1807, 1 Terr. L., p. 131, § 18.

5 By way of example, in 2003 Missouri adopted the Uniform Electronic Transactions Act. Section 432.200, RSMo 2017, et seq. This act provides, in part, that “[a] record or signature shall not be denied legal effect or enforceability solely because it is in electronic form.” Section 432.230, RSMo 2017. Anyone who has used DocuSign or similar services is familiar with these types of documents. But this act specifically does not apply to the “creation and execution of wills, codicils, or testamentary trusts.” Section 432.210.2, RSMo 2017.

6 Section 474.360, RSMo 2017, provides that a will is valid and may be probated in this state if it is “executed in compliance with: . . . (2) The laws, as of the time of execution, of the place where the will is executed.” As a result, if an electronic will is validly created in any state that permits such documents, it can be admitted to probate in Missouri.

7 Further assume that you are at least 18 years of age and of sound mind, such that you are capable of making a will. Section 474.310, RSMo 2017.

8 Section 474.320, RSMo 2017.

9 Section 1.020(22), RSMo 2017.

10 Adams v. Simpson, 213 S.W.2d 908, 913 (Mo. 1948).

11 Section 474.320, RSMo 2017.

12 Section 1.020(22), RSMo 2017.

13 Section 474.320, RSMo 2017. It should be noted that although most wills prepared by practitioners contain “attestation clauses” that will recite the matters witnessed – specifically the capacity of the testator, the request of the testator to witness the document, and the presence with the testator – such clauses are not required in Missouri to create a valid will. Burkland v. Starry, 234 S.W.2d 608, 611 (Mo. 1950).

14 Hodges v. Hodges, 692 S.W.2d 361, 369 (Mo. App. S.D. 1985).

15 Section 474.330, RSMo 2017.

16 Section 474.337, RSMo 2017 provides that a will may be self-proving (and thus eliminating the need for the witnesses to testify as to its admission) if the statutory form is followed, including the presence of a notary public. While self-proving wills are advisable and easier to admit to probate, a non-self-proving will may still be admitted to probate upon proof in solemn form.

17 No. 2013ES00140 (Lorain Co. Ct. of Common Pleas, Jun. 19, 2013), available at 27 Quinnipiac Prob. L.J. 412 (2014).

18 Id. at 414.

19 Id. at 416-17.

20 Id. at 418.

21 The lack of legislation also leaves open questions, including whether a /s/ or other electronic signature would suffice in Missouri. A court in Tennessee has already held that it is sufficient under that state’s law. Taylor v. Holt, 134 S.W.3d 830, 831 (Tn. Ct. App. 2003).

22 While these facts lead to the likely conclusion that the “tablet will” is admissible to probate, one could imagine slight changes to this scenario that would make the question of the admissibility a much more difficult question. For example, the Michigan Court of Appeals admitted an unsigned electronic note on the decedent’s phone under the Michigan “harmless error” statute. Estate of Horton, 925 N.W.2d 207 (Mich. Ct. App. 2018). These types of “harmless error” statutes permit the admission of a will that does not comply with the statutory requirements. Only 11 states have such statutes, and Missouri is not one of them.

23 114 Stat. 464 (2000).

24 15 U.S.C. § 7001.

25 Section 432.210.2, RSMo 2017.

26 15 U.S.C. § 7003(a)(1).

27 Nev. S.B. 33, 71st Session (2001).

28 Nev. Rev. Stat. § 133.085 (2001).

29 Id.

30 Holographic wills are those which are written and signed by the testator, but otherwise not witnessed or executed with the normal formalities of a will. See Nev. Rev. Stat. § 133.090 (2001). Missouri does not permit holographic wills to be validly executed Missouri wills, but will probate holographic wills validly executed in other states. Section 474.360, RSMo 2017; see also 5 Mo. Prac., Probate Law & Practice § 254.

31 Willing.com, Modernizing The Law To Enable Electronic Wills, available at https://willing.com/learn/modernizing-the-law-to-enable-electronic-wills.html (last visited Oct. 5, 2019).

32 Information related to the ULC’s efforts on electronic wills is available at https://www.uniformlaws.org/committees/community-home?CommunityKey=a0a16f19-97a8-4f86-afc1-b1c0e051fc71 (last visited Oct. 5, 2019).

33 Nev. A.B. 413, 79th Session (2017).

34 Nev. Rev. Stat. § 133.085 (2017).

35 Nev. Rev. Stat. § 133.088 (1)(a)(2) (2017).

36 Nev. Rev. Stat. § 133.088(1)(e ) (2017).

37 Fla. Comm. Sub, H.B. 277, 2017 Session (2017).

38 Letter from Gov. Rick Scott to Secretary of State Ken Detzner (June 26, 2017), https://www.flgov.com/wp-content/uploads/2017/06/HB-277-Veto-Letter.pdf (last visited Oct. 5, 2019).

39 Id.

40 Id.

41 Fla. Comm. Sub, H.B. 409, 2019 Session (2019).

42 House of Representatives Staff Analysis of Fla. Comm. Sub, H.B. 409, 2019 Session (2019) available at https://www.flprobatelitigation.com/wp-content/uploads/sites/206/2019/09/h0409z1.CJS_-1.pdf (last visited Oct. 5, 2019).

43 “‘Vulnerable adult’ means a person 18 years of age or older whose ability to perform the normal activities of daily living or to provide for his or her own care or protection is impaired due to a mental, emotional, sensory, long-term physical, or developmental disability or dysfunction, or brain damage, or the infirmities of aging.” Fla. Stat. Ann. § 415.102(28) (2019).

44 Fla. Comm. Sub, H.B. 409, 2019 Session (2019).

45 Ind. H.B. 1303, 2018 Session (2018).

46 Ind. Code § 29-1-21-3(1) (2018); Ind. Code § 29-1-21-4 (2018).

47 Ind. Code § § 29-1-21-6 - 29-1-21-18 (2018).

48 Ind. Code § 29-1-21-7 (2018). This would appear to avoid the issue of Nevada or other wills remotely executed from Indiana being probated in Indiana.

49 Ariz. H.B. 2471, 53rd Session (2018).

50 Ariz. Rev. Stat. § 14-2518.

51 Ariz. Rev. Stat. § 14-2519

52 Ariz. Rev. Stat. § 14-2520.

53 Ariz. Rev. Stat. §§ 14-2518 - 14-2523.

54 ULC, About the ULC, UniformLaws.org, http://www.uniformlaws.org/aboutulc/overview (last visited Oct. 5, 2019).

55 ULC, Memorandum to Electronic Wills Drafting Committee, UniformLaws.org, https://www.uniformlaws.org/HigherLogic/System/DownloadDocumentFile.ashx?DocumentFileKey=3cb4e4f1-3f38-1e03-2bc1-43c3dabc0af5&forceDialog=0 (last visited Oct. 5, 2019)

56 ULC, Draft Electronic Wills Act for March 2-3 Meeting, UniformLaws.org, https://www.uniformlaws.org/HigherLogic/System/DownloadDocumentFile.ashx?DocumentFileKey=52b77166-bcfe-ca8c-4e78-284605a64781&forceDialog=0 (last visited Oct. 5, 2019).

57 ULC, Uniform Electronic Wills Act, UniformLaws.org, https://www.uniformlaws.org/HigherLogic/System/DownloadDocumentFile.ashx?DocumentFileKey=1dec19cc-1300-7d16-c652-6bb8e5b9d959&forceDialog=0 (last visited Oct. 5, 2019).

58 John H. Langbein, Substantial Compliance with the Wills Act, 88 Harv. L. Rev. 489 (1975).

59 ULC, Uniform Electronic Wills Act, Prefatory Note, UniformLaws.org, https://www.uniformlaws.org/HigherLogic/System/DownloadDocumentFile.ashx?DocumentFileKey=1dec19cc-1300-7d16-c652-6bb8e5b9d959&forceDialog=0 (last visited Oct. 5, 2019).

60 Section 474.360, RSMo 2017.

61 Ohio, for example, recently revised its probate laws to state that in order to be validly executed in another state, the testator must be “physically present” in that state at the time of execution. Ohio Rev. Code § 2107.18.

62 Missouri’s version of the Uniform Electronic Transfers Act specifically excludes “testamentary trusts,” but no mention is made of trusts created during the grantor’s life. Section 432.230, RSMo 2017. Consequently, an argument can be made that such lifetime trusts can already be executed electronically. But given the lack of certainty, additional statutory modifications should be considered.

63 Section 456.4-401, RSMo 2017 et seq.

64 John Bigelow, The Works of Benjamin Franklin, Vol XII (1817).

65 If you would like to be involved in the process of considering electronic will legislation in Missouri, please contact the author.

June 16 will be a red-letter day for Missouri’s legal community as The Missouri Bar marks its 75th birthday.

It was on June 16, 1944, that the Supreme Court of Missouri issued a rule creating the integrated Missouri Bar. The Court’s action followed an October 1943 resolution of Missouri lawyers seeking integration of the practice of law in this state and a recommendation from the Court’s own Committee on the Integration of the Bar.

During the last three-quarters of a century, our Missouri Bar has played an instrumental role in countless projects that have helped its members better serve their clients; improved public understanding of the law as well as citizens’ rights and responsibilities; and improved the justice system for the benefit of all Missourians. And it has all been because of the time, effort and collective strength of Missouri’s lawyers united under the banner of the integrated state bar.

The Missouri Bar will be marking this landmark birthday throughout 2019, including during the recent Solo and Small Firm Conference and The Missouri Bar Annual Meeting (Sept. 18-20 in Branson).

Missouri Bar members will also want to check out our interactive timeline of select Missouri Bar moments, as well as the May-June issue of the Journal of The Missouri Bar. That issue features a cover story looking at some of the organization’s more prominent achievements during the past 75 years, along with birthday-focused columns from 2018-19 Missouri Bar President Ray Williams and Executive Director Sebrina Barrett. 

More than 50 years ago, then-executive director Wade Baker aptly said that the Bar “lives on borrowed time,” noting that a primary source of a Bar’s talent is “the time it is able to beg or borrow from busy lawyers.”

That is certainly true. Throughout The Missouri Bar’s rich 75-year history as a unified bar, countless volunteer leaders have given their time and talents to their profession, and these members have been instrumental in our Bar’s decades of success. 

In my nearly 10 years at The Missouri Bar, I’ve worked with leaders who not only are giving, but who also are grateful. They frequently acknowledge that another key component of the Bar’s success are the contributions of a dedicated, professional, highly-engaged, and experienced staff. I couldn’t let this anniversary pass without recognizing the people who I am honored to work with each day in Jefferson City. They carry on a tradition of service that has greatly benefitted both Missouri’s lawyers and citizens. 

In 1960, the Bar, which at the time had a membership of 7,000, employed eight staff members, two of which were full-time administrative professionals. In an article titled, “Service is Our Business,” Baker wrote that “[t]heir typewriters are going at top speed continually writing letters, typing mats for reproduction and carrying on the many other services to aid the directors in their work.” 

Nearly 60 years later, 45 full-time staff members support hundreds of activities and initiatives to help more than 30,000 Missouri lawyers even better serve their clients and communities. Like the profession, the Bar’s staff has grown, and while the speed of their work hasn’t slowed in the slightest, much has changed, including trading in our typewriters for the technology of today, thanks to the recent implementation of a broad technology audit. Your Missouri Bar staff remains efficient, with one staff member for every 662 members. Other unified bars our size average one staff member for every 365 members.

Once they have joined our team, members of our staff tend to stay. In 2010, then-President Skip Walther wrote in the Journal that the average years of service for Missouri Bar staff employees was 14.3 years. He noted that this longevity “adds value to all Missouri attorneys because our staff is experienced and diligent and efficient in their work.” In the same article, Walther stated that the 1994 enrollment fee increase was projected to last five years, but instead lasted 14 years because “the efficiency of our staff stretched this timeline out almost three times longer than anticipated.” 

The Bar is blessed with several staff members who have been with us for tenures ranging from 10 to 35 years. Currently, with the retirement of my executive assistant after 44 years of service to the Bar, our longest-serving full-time staff member is Gary Toohey, who has ably worked as editor of this publication for 35 years. But Toohey isn’t the longest serving member of our current team. Carol Sandbothe has provided part-time help for the past 12 years in our accounting department, after 39 years of full-time service, for a total of 51 years! Sandbothe initially joined the team just two years after the Bar Center was built in 1965. The institutional knowledge and expertise of our long-serving staff complement the fresh perspectives and diverse experience of new staff members who have joined our team due to several recent retirements. Regardless of whether a staff member has been with us one week or several decades, their contributions are essential to the fulfillment of our mission of helping lawyers even better serve their clients. 

A tradition of excellence is the hallmark of our staff. Many former and current staff have held leadership positions in national organizations, such as the Association for Continuing Legal Education (ACLEA) and the National Association of Bar Executives (NABE). Both Baker and former executive director Keith Birkes are past presidents of NABE, and former Director of Information Wally Richter has an NABE award named after him. Further, many of our staff members are called upon frequently to share their expertise with bar association professionals and bar leaders across the nation.

On the Bar’s 60th anniversary in 2004, the Board of Governors recognized the contributions of our staff with a resolution that stated in part, “The Missouri Bar’s staff consists of a talented and dedicated group of professionals who epitomize the necessary teamwork, collegiality, creativity and ‘can-do’ spirit that is responsible for The Missouri Bar achieving the status of one of the most preeminent bar associations in the United States.”

I realize I am biased, but I wholeheartedly concur. As we have been for the past 75 years, the Bar staff is available to provide information or assistance to the public and our members. We are simply a call, email, or tweet away. And, as Birkes stated in a Journal column more than 30 years ago, “the staff will be responsive, informed and capable” of handling your requests. We mean it when we say we are here to help, but we are human. “We hope we serve you well,” Baker wrote in 1975. “If we don’t, be kind and tell us where we have failed.” When we get it wrong, let us know, and we will try to make it right. As we celebrate the Bar’s 75 years of unification, it is humbling to serve alongside the best Bar staff in the nation – a group of individuals who care about lawyers and the clients they serve.

Trends in other industries make it clear that lawyers must prepare for ransomware attacks. Here’s how to get started.

Earlier this year, ransomware cyber attacks at Hollywood Presbyterian Medical Center in Los Angeles, California and MedStar Health, based in Columbia, Maryland, made headlines and alarmed health providers and patients. The ransomware attacks, which involve a virus that is designed to hold data hostage until the victim pays for a “key” to regain access to their data, should also serve as a warning to lawyers.

Indeed, in a recent ransomware case involving the Brown Law Firm in Jacksonville, Florida, the firm was not able to access its client data.[2] Instead, the firm received a message stating that their data was not accessible and it would be destroyed unless the firm paid the equivalent of $2,500 in Bitcoins to the hackers behind the attack. Although the firm hired an information technology (IT) professional, it ultimately decided to pay the ransom on the advice of that IT contractor; the risk of losing the data by attempting to circumvent the ransomware was too great. Such attacks are often successful because the hackers behind the assault ask for a relatively small amount, knowing they can spread fees over many victims. This attack strategy also makes it an easier choice for the lawyer to pay.

What is Ransomware?

Ransomware is a malicious computer program (also known as malware) that is introduced into a computer system like a virus and allows the attacker to block access to the victim’s computer data and demand payment for restoring the data. Typically, there is a time element to the ransom demand: The owners of the data are threatened with its destruction if the ransom is not paid within a predefined number of hours. If you do not represent likely targets of ransomware, does this affect you as an attorney? Yes, because your law firm or corporate legal department is a target.

What is the Risk?

Lawyers, just like health and finance professionals, maintain confidential and sensitive information which they are obligated to protect and need to access to serve their clients. Lawyers can be locked out of data, and the data may be sold or made public.

Should I Pay?

This is the big question, and one without a great answer. If you pay, you are likely to get your data back. However, you will be a more likely target in the future and you will unwillingly be funding attacks on other lawyers. Further, there is no guarantee the hackers will honor the agreement.[3] Prevention is ideal, but if you are the victim of an attack, you will have to evaluate whether you can both restore data and protect against its release without paying the hacker. Ironically, sometimes even the police are left with no better option than paying the ransom.[4] The FBI has sent mixed signals on whether to pay or not, most recently advising against it.[5] Consulting with an IT professional and law enforcement will help you with the decision-making process.

Preventing Ransomware Attacks

While there is no means of attainng perfect assurance against a ransomware attack, the following precautions can help to mitigate risk and to diminish the impact of a breach on your practice.

Good backup: If you have a backup, you can restore the data to the point of last back up. But you still have a confidentiality issue[6] and the requirement to safeguard client property.[7] You will be obligated to report client data was compromised.

Good firewall: A firewall is the watch guard of the firm’s network. Think of the firewall as a security bubble. If you turn it on high, you can shut down virtually all communications, but users will complain that system is unusable. If you turn it down too much, you will be open to attack. So you have to find the right balance.

Training: Make sure you and your staff are trained to avoid infecting your network with ransomware. End users can enable breaches by downloading a suspicious attachment or clicking on an unknown link. Hackers use “human engineering” to trick you into clicking on attachments. If you receive a communication that normally would not come by email, do not open the attachment. Call the sender to confirm. Working from home on an unsecured computer can also compromise the network. Network security is only as good as the weakest link. Any device connected to the network needs to be inspected. Educate your staff on how to avoid risks. Use strong passwords and keep them secure. Keep your antivirus software current, but don’t assume it is protecting you.

Encrypt your data: This may not prevent an attack, but it will mean an attacker cannot release your clients’ confidential data without great effort.

Install an ad blocker: Some ransomware can be delivered via pop-up advertisements.

Hire an expert: Lawyers know what happens when their clients go DIY (do-it-yourself) on complex legal work. Likewise, you should considering hiring an IT professional to evaluate your network’s security rather than relying on your own knowledge of cyber security.

Use work computers only for work: Have a computer not connected to your law office network for surfing the Internet, or consult your IT professional for other ideas to isolate and protect sensitive areas of your network.[8]

Screen and monitor employees: As noted above, an employee might accidentally open a suspicious attachment or click or an inappropriate link, but in addition some employees might sell your password. According to a recent survey, 56 percent of employees would sell passwords for $1,000 or less.[9]

Review your insurance coverage: Do not assume you have coverage for cyber attacks. Check with your carrier.[10]

Dealing With Ransomware Attacks

If, despite your best efforts, you become the victim of a ransomware attack, there are several things you will need to do.

IT: Call for IT help, whether internal or an external consultant. Do not undertake any measures on your own unless you are a cyber security expert.

Insurance: Call your insurance carrier. They may be able to help you unwind the problem. And in any case, you may have a notification requirement to secure coverage for an event.

Law enforcement: Call law enforcement.

Work your plan: If you are part of an organization, contact those individuals internally who are identified in your plan, such as partners.

Assess the situation: Can you fix it with a backup? Was data actually accessed? Is paying a ransom advisable?

Determine notification requirements: Once the attack has been resolved and you are up and running, determine notification requirements. You will want to review the ethics rules as well as any state law requiring notification of a breach. Further, if you have any health data, you may have notification requirements under HIPAA.[11] Failing to disclose, even if you are not required to, may have negative consequences from a trust and public relations standpoint. Weigh your options carefully.

Reassess: Once you are up and running and the system is all clear, take some time to figure out what went wrong and how you can avoid problems in the future.

Ransomware attacks on lawyers are likely to increase. When the Hollywood and Medstar medical data attacks happened, it seemed like the beginning of a trend. Turns out a recent survey shows that half of the hospitals participating in the research had been subjected to ransomware attacks.[12] So the two publicized episodes were public confirmation of a trend, not the possible beginning of one. It may well be the same in the legal industry. Once hackers see success with victims motivated to recover and protect their clients’ data, they will continue the attacks as long as it remains profitable. This summer, we learned hackers are targeting lawyers using phony ethics complaints to trick them into downloading an attachment infected with ransomware.[13]

Staying up to date is part of your defense. The ABA’s Cyber Security Legal Taskforce is a good source of information.[14] The Better Business Bureau and the FTC have scam alerts. ABA members can also sign up to receive FBI Cybersecurity Alerts.[15] You should document your cyber security policy and use it to train your employees and have as a reference in case of attack. Your will want to have it in paper form in case you cannot access your computers. Your policy should outline the procedures for your response. You don’t want to be trying to figure out what to do when your office is paralyzed by an attack.

Lawyers are obligated to keep up with technology to protect their clients’ interests or to hire someone with the expertise to do it for them.[16] By keeping up with the risks and educating and monitoring your staff, you can avoid having to pay a ransom for your data and the possibility of seeing your clients’ data compromised.

This article originally appeared in the September 2016 issue of Bench & Bar of Minnesota, the official magazine of the Minnesota State Bar Association, and is reprinted with permission.

Endnotes

1 Shaun Jamison is a professor of law with Concord Law School of Kaplan University and is the former chair of the Minnesota State Bar Association Practice Management and Marketing Section. Jamison teaches CyberLaw, Legal Research, and the Future of Law Practice. He may be contacted at sgjamison@gmail.com.

2 “Florida Law Firm Hit by Ransomware Scheme” (2/16/2016) http://www.batblue.com/florida-law-firm-hit-by-ransomware-scheme/ (now https://opaq.com/)

3 Katie Dvorak, “Hackers return for more money in ransomware attack at Kansas hospital,” FierceHealthCare (5/23/2016) http://www.fiercehealthcare.com/it/hackers-return-for-more-money-ransomware-attack-at-kansas-heart-hospital.

4 “When hackers cripple data, police departments pay ransom,” Boston Globe (4/6/2016) https://www.bostonglobe.com/business/2015/04/06/tewksbury-police-pay-bitcoin-ransom-hackers/PkcE1GBTOfU52p31F9FM5L/story.html.

5 Paul, “FBI’s Advice on Ransomware? Just Pay The Ransom,” Security Ledger (10/22/2015) https://securityledger.com/2015/10/fbis-advice-on-cryptolocker-just-pay-the-ransom/, but see a more recent declaration from FBI Cyber Division Assistant Director James Trainor saying companies should not pay ransom: Katie Dvorak, “Hackers return for more money in ransomware attack at Kansas hospital,” FierceHealthCare (5/23/2016) https://www.fiercehealthcare.com/it/hackers-return-for-more-money-ransomware-attack-at-kansas-heart-hospital.

6 ABA Model Rule 1.6(c) – A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.

7 ABA Model Rule 1.15 – … property shall be identified as such and appropriately safeguarded. Complete records of such account funds and other property shall be kept by the lawyer and shall be preserved for a period of [five years] after termination of the representation.

8 Scott Perry, “Law Firms Kill Web Access In the Name of Cybersecurty,” (5/26/2016) Above the Law http://abovethelaw.com/?sponsored_content=it-security-vs-users&rf=1.

9 Tara Seals, “Employees Would Sell Passwords for $1000 or Less,” retrieved 4/15/2016: http://www.securion.io/#!Employees-Would-Sell-Passwords-for-1000-or-Less/c14jh/56f137afOcf266a29260bfe.

10 Peter S. Vogel, “Bad news for P.F. Chang – Court rules that all claims for 2014 data breach are not covered under its cyberinsurance!” Lexology (6/2/2016) https://www.lexology.com/library/detail.aspx?g=4dc04202-1357-4b3c-8c96-43aeac63e00f.

11 Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (1996).

12 Katie Dvorak, “Poll: Most hospitals have been targets of ransomware attacks,” FierceHealthIT, retrieved 4/12/2016: https://www.fiercehealthcare.com/it/poll-most-hospitals-have-been-targets-ransomware-attacks.

13 Mike Mosedale, “Ransomware scam targets lawyers with phony ethics complaints,” Minnesota Lawyer (6/7/2016) http://minnlawyer.com/2016/06/07/yikes-ransomware-scam-targets-lawyers-with-phony-ethics-complaints/.

14 ABA Cyber Security Legal Taskforce, https://www.americanbar.org/groups/cybersecurity/

15 Log in to sign up to receive alerts at this link: https://shop.americanbar.org/eBus/MyABA/MyLists.aspx.

16 ABA Model Rule 1.1 – A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.

Every law firm in the world, whether a solo practice or a global giant, shares one common feature, powered by one fundamental assumption. This feature and this assumption are so basic that we often don’t even notice them. But they underlie our whole conception of law firms – and as they start to crumble, the entire law firm edifice above them is going to start giving way.

The characteristic is this: Every law firm consists of lawyers. The assumption is this: You need lawyers to have a law firm.

Now, to be fair, this has been a perfectly sensible assumption throughout the history of the legal market. Lawyers preceded and enabled law firms, in much the same way that merchants preceded shops and priests preceded churches. Law firms only developed in the first place because, at some point in history, one or more lawyers decided to set up a commercial platform for the convenient and profitable provision of their services. Lawyers; ergo, law firms.

Over the next several years, this is going to change. Lawyers will no longer be considered essential to law firms’ ability to deliver legal services. A growing number of legal tasks can already be carried out by para-professionals, systematized and automated processes, and a rapidly multiplying legion of software products. You can get work done in a law firm right now without requiring a lawyer to do it. Technological innovations and regulatory developments promise more of the same into the foreseeable future.

The population of legal problems that can be resolved solely by the direct, real-time application of lawyers’ efforts is going to shrink a little more, and eventually a lot more, every year. This is going to change everything we believe to be true about law firms.

What’s a Law Firm Without Lawyers?

Across the legal market, from the smallest local firm to the largest global colossus, law firm leaders are starting to ask themselves some truly thought-provoking, even groundbreaking questions.

 “Could we deliver some legal services without using lawyers?”

 “Could we be more productive and effective if we solved clients’ issues without assigning lawyers to the job?”

 “Could we grow our business opportunities by offering clients solutions that don’t require lawyers?”

It’s not exactly a secret within the legal industry that lawyers aren’t the easiest assets to manage. As a general rule, they tend to be expensive, autonomous, difficult to lead, and prone to decamp to competing businesses without warning. The more experienced and expert the lawyer, the more these characteristics will manifest themselves. So when you consider the volatile and mercurial nature of this valuable resource, and if you heard that some of this resource’s functions could be rendered by other assets that suffer from none of these liabilities – well, you’re at least going to try to learn a little more, right?

The traditional law firm is a commercial vehicle whose structure is very familiar to us: a collection of lawyers gathered in a central location under a single brand name to deliver legal services, supported by staff members and various other resources.

The “engine room” of this vehicle is the lawyer. Law firms’ ownership, profit-sharing, workflow, billing, compensation, governance, and culture all revolve around lawyers. Law firms’ naming conventions are almost universally based on the surnames of their individual founding lawyers. Law firms go so far as to divide their personnel into two airtight categories: lawyers and everybody else (a.k.a. “nonlawyers”). And if a law firm’s lawyers don’t believe something is worth doing, the firm ain’t doing it.

Lawyers, in other words, are absolutely essential to the traditional law firm – not just to the firm’s revenue and sales, but also to its very definition and identity. I suspect the only reason we say “law firm” rather than “lawyer firm” is to economize on syllables.

This traditional law firm model is now, slowly, giving way to a new vision of law firms, one that resolves not around lawyers, but around the firm’s capacity to deliver services of value to clients. The new law firm’s “engine room” is not comprised of collected lawyers, but of collected legal expertise, applied to client needs through the use of systems, processes, technology, and expert professionals, as well as of lawyers.

A potent combination of advanced technology, powerful databases, sophisticated analytics, and streamlined procedures is enabling law firms to deliver solutions to clients without necessarily requiring the real-time application of lawyers’ efforts. Put differently, law firms are discovering that they can provide some legal services to clients using only applied knowledge resources and technology. This will change everything.

The Rise of the Productivity Engine

Consider the following products rolled out by large law firms in the United States and Europe in the past few years:

• Software that provides regulatory gap analyses in data and privacy risk areas;
• Client-facing claims management systems and loss prevention tools;
• An online dashboard that lets corporations navigate the financial regulatory landscape;
• Artificial intelligence systems for e-discovery, cybersecurity, and contract and document review;
• Machine-learning systems for document review during merger and acquisition transactions; and
• Tools that calculate potential client damages in class actions and identify litigation risks.

These and other technology-powered products and services are essentially “productivity engines.” They enhance the user’s ability to complete a task or reach a solution while reducing the amount of time and money required to achieve that goal. Earlier, I talked about the new “engine rooms” of law firms; these are the actual engines.

There is no disputing that using these products and services increases legal productivity. There is equally no disputing that this outcome is antithetical to the traditional law firm’s ability to generate revenue.

These high-productivity engines share two characteristics. The first is that, yes, lawyers’ efforts and knowledge invariably contributed to their development. Expert systems, for example, require lawyers’ expertise to populate the databases and provide direction to the algorithms that will reach conclusions. But lawyers are not required to directly deploy their efforts and knowledge for clients’ use in real time. Their expertise has been distilled and “embedded” within the system, so that it can be applied over and over again, many times a day in many different locations by many different clients. Lawyers are needed at various stages to help build the systems that carry out this work. But lawyers are not needed to actually carry out the work themselves.

In other words, clients can access a lawyer’s expertise directly, by themselves, without having to call the lawyer up and set the timer running. This is a clear benefit to the client, who saves time and money while gaining more control over the process of finding answers and solutions to his or her questions. Equally, the time and effort that lawyers would have had to personally devote to delivering these services can be freed up and applied to other revenue-generating activities, or even dispensed with altogether. This is a clear benefit to the lawyer as well – although a lawyer who is compensated and promoted based in part on his or her billable hours won’t necessarily see it that way.

The second characteristic shared by these productivity engines is that in almost every case, the core element of the offering is information: both legal knowledge and nonlegal data, applied and leveraged by technology. Every law firm in the world possesses information, whether assembled in precedents kept inside servers and filing cabinets, stored up in libraries and online subscription services, or tucked away in the labyrinthine recesses of their lawyers’ brains.

For law firms, information has always been a static resource, tapped when required but otherwise lying latent and dormant. The development of productivity engines is transforming that information into a dynamic resource, an asset that can provide value all on its own, without needing to be picked up and wielded by a human with a J.D. Up until now, to provide legal solutions of value to their clients, law firms could only deploy lawyers, or the occasional experienced clerk or paralegal. Today, however, firms can also unleash their information through advanced systems that can deliver answers and solutions.

This means that for the first time, law firms have other resource options beyond lawyers alone for the development and delivery of value to clients. They can access, analyze, and apply information already prevalent in their systems or their markets. They can use this information to develop new business lines and generate viable income streams independent of lawyer activity. Legal information is widespread, can be accessed with relative ease, and doesn’t complain about partnership profits or threaten to join the law firm down the street.

From the law firm’s point of view, information deployed through productivity engines is a formidable asset. From the individual lawyer’s point of view, on the other hand, it’s a formidable rival.

What we’re witnessing, therefore, is the start of the gradual de-lawyering of law firms. So long as lawyers’ equity is still required to finance the capital and operations of a law firm, lawyers will still constitute a significant percentage of a law firm’s total personnel. But they will constitute a steadily diminishing percentage of the law firm’s revenue-generating assets and competitively significant personnel. Sources of law firm productivity and profitability, at one time a club exclusively open to lawyers, will start to include law librarians, legal knowledge engineers, legal data analysts, and legal productivity engines developed to harness the information the firm has assembled and applied.

Today, lawyers generate more than 99 percent of a law firm’s revenue. Once productivity engines are ubiquitous in law firms, that percentage will drop below 50 percent.

Why would law firms commit themselves to such a radical transformation of their businesses? Simply put, because the market will reward those firms that adopt these advances and punish those that resist. The firms that adopt and develop these productivity engines will be able to sell their services at a lower price without having to compromise on quality. It’ll be a simple matter of competitive mathematics.

The Post-Lawyer Law Firm

If you plan to build or lead a law firm through the end of the 2010s and into the 2020s, the coming “inessentiality” of lawyers is a critical development to understand and act on. A law firm whose value is defined in terms of its clients and its markets needs to focus on building systems that can meet those needs, rather than the interests of its equity-owning lawyers. The only thing that matters in building those systems is that they are effective, not whether the people who operate those systems come with a law degree.

Law firms need to give lawyers the appropriate, rather than maximum possible, degree of importance in delivering law firm services. That degree will be significantly less in the future than it’s been in the past. The implications of this development for law firms, as you might image, are enormous.

Law firm culture is modeled on lawyer culture. Law firms (like lawyers) value and encourage analytical, individual, critical, and risk-averse behavior. As lawyers begin to decline as a percentage of law firms’ business generators, these characteristics will also start to decline, while other behavior – empathetic, collaborative, constructive, and entrepreneurial behavior – will begin to rise. Collective action in the interest of the enterprise will become easier to encourage and exemplify, if only because there will be fewer lawyers in positions of power over the firm’s business to resist it.

Law firm workflow has long consisted of assigning tasks to a lawyer and waiting for the lawyer to sequentially and painstakingly carry them out, often with only glancing attention to standardized procedures. As other professionals and technicians become more involved in the creation of legal services, and as automated systems and programs take on more tasks previously carried out by lawyers, law firm workflow will become more standardized and productivity that doesn’t require lawyers’ direct involvement will increase. Lawyers will no longer be the only ones whose priorities determine how work gets done.

Law firm compensation systems are currently built around lawyers’ billed hours and lawyers’ business origination activities. As services start to be delivered through, and clients come to be attracted by, the performance mechanisms of the enterprise, firms will find more sophisticated and accurate ways of measuring and rewarding individuals’ provision of value. Lawyers’ time and efforts will be the source of a decreasing percentage of the firm’s revenue, opening the door to a reconsideration of what we’re actually paying lawyers to do. Firms will get better at incentivizing the contribution of real value.

Law firm pricing is currently founded on lawyers’ billable rates and hours worked. As more products and services are created and delivered with minimal lawyer involvement, through the use of other professionals and advanced software, law firms will develop new pricing mechanisms that don’t require the crutch of lawyers’ hourly rates. They will start integrating buyer’s circumstances, and the unique value of a legal service in those circumstances, into their pricing equations. Competitive intelligence will become key to profitability. Lawyers’ hourly rates will no longer determine what buyers pay. The market will do that instead.

Law firms’ leaders have traditionally been lawyers with robust practices who could command respect for their legal accomplishments, regardless of whether those lawyers possessed leadership skills. At many law firms, you could not hope to serve as managing partner or group leader unless you also brought in a lot of business or billed a lot of hours. But as lawyers’ revenue-generating efforts constitute less of a firm’s overall income, those efforts will also play a smaller role in leadership discussions. Professional law firm businesses, employing a diverse range of employees, will require professional leadership, exercised by people whose credentials extend beyond the size of their origination credit.

I want to be clear: A “post-lawyer” law firm is not the same thing as a “lawyer-free” law firm or a “zero-lawyer” law firm – nor would those be sensible or worthwhile objectives. The goal of successful law firms in the new market is not to dispense with lawyers altogether, but to use lawyers appropriately and proportionately, in order to maximize the overall productivity of the firm and the value it provides to clients.

But if the “no-lawyer” firm is not a desirable goal, then the “all-lawyer” firm is no longer a sustainable one. The personal, direct, real-time involvement of a lawyer is not necessary to complete a growing number of legal tasks, and firms’ operations will evolve to reflect that. We no longer require lawyers to carry out every legal function that the market requires, and that will be clearer to the legal profession over the next several years.

Lawyers will provide many law firm services in the future, maybe even most – but never again all.

Life After Lawyers

The individual lawyer is moving toward a more proportionate role in the law firm business. Sometimes, that role will be an owner or a shareholder of the firm. Sometimes, it will be a leader and strategic executive officer. Sometimes, it will be a manager of people and processes. And sometimes, it will be a supplier of high-value expertise and insight. But I seriously doubt it will be all four at once, or even more than one or two at a time. Lawyers have very specific and high-value skill sets, but law firms will need more than what lawyers can provide in order to function effectively.

A traditional law firm exists to provide buyers with access to solutions for their law-related challenges through the application of a lawyer’s time and effort. The future law firm will answer to the same description, minus the last nine words. So you must think of your law firm as a business entity that helps buyers overcome legal challenges and meet legal opportunities – not as a hotel for lawyers, which is the description to which most law firms answer today.

In the end, you need to ask yourself: “Is our law firm a platform for lawyers to sell their services? Or is it a business that delivers value to buyers of legal services?” How you answer those questions will determine all your coming decisions about what kind of law firm you’re going to build and maintain.

This article originally appeared in the April 2017 issue of Wisconsin Lawyer, the official publication of the State Bar of Wisconsin, and is reprinted with permission.

Endnote

 1 Jordan Furlong is a Fellow of the College of Law Practice Management and a member of the Advisory Board of the American Bar Association’s Center for Innovation. He is a leading analyst of the global legal market and forecaster of its future development. He helps lawyer think differently about the services they provide and counsels law firm leaders about reengineering their firms’ purposes, strategy, and operations. He has addressed law firms, state bars, courts, law schools, and numerous legal associations throughout the United States, Canada, Great Britain, Europe, and Australia. This article is excerpted from his book Law is a Buyer’s Market: Building a Client-First Law Firm, available at law21.ca/books.

Nearly 100 years ago, when Judge Cardozo famously commented, “law never is, but is always about to be,”³ he could not have anticipated the concept of “virtual assistants” like Amazon’s Alexa, Apple’s Siri, Google’s Assistant, Microsoft’s Cortana, or Samsung’s Bixby. Yet, his quote perfectly sums up the new frontier in law as more and more people integrate speech recognition technology into their everyday lives.

Although “speech recognition” may sound like a lofty term, it simply refers to what most of us do daily, when we use our voices to ask our phones to dial our friends, our cars for directions, and our speakers to play our favorite songs. Speech recognition is “the ability to speak naturally and contextually with a computer system in order to execute commands or dictate language.”⁴ Technology rivals are hard at work creating irresistible versions of easy-to-use devices with which we can talk and have questions answered.⁵ For the most part, this technology has become so good that a simple command, or “wake word” (“Alexa?!”), allows us to ask our virtual assistants a host of questions from what is today’s weather to who was the fifth President of the United States.⁶

Amazon, maker of the Echo (Alexa), a hands-free speaker you control with your voice, touts that the Alexa Voice Service, which is integrated into the Echo, is “always getting smarter.”⁷ When you interact with Alexa, she streams audio to the cloud. Amazon’s Terms of Use for the Echo duly notifies users that “Alexa processes and retains your Alexa Interactions, such as your voice inputs, music playlists, and your Alexa to-do and shopping lists, in the cloud to provide and improve our services.”⁸

For most people, their virtual assistants’ ability to always be listening for their “wake words” is helpful. When we are driving, this allows us to complete tasks hands-free, avoiding distractions, as well as moving violations. While we are making breakfast in the morning, contemplating getting to work or to court on time, we can ask Alexa how long the morning commute will take. Alexa also allows us to use voice commands to turn on the light while walking into a dark room, without having to search for the light switch.

Many large tech companies believe that voice commands and intelligent assistants will become the primary ways in which people interact with technology, possibly even more significant than touch screens and keyboards.⁹ Voice control has rapidly evolved from a quirky and interesting technology to a “must have” capability in new devices.¹⁰ Virtual assistants are being adopted seamlessly to stay.¹¹ Microsoft reports that Cortana, launched in 2014, now has 145 million users and has handled 18 billion tasks.¹² Apple claims it has reached two billion Siri interactions each week, with [an estimated] 41.4 million currently active users….¹³

This “space age” technology sounds great. However, if you believe that all artificial intelligence designed to serve us can do us no harm, just consider any number of science-fiction movies, which now seem more real than fiction, where humans are nearly done in by artificial intelligence machines, which were created with the intent of serving, not harming, us.¹⁴

Defense attorneys are among those lawyers who should consider how they can use virtual assistants’ recordings to shed light not only on how accidents occur, but also to challenge plaintiffs’ personal injury claims. The recent Arkansas trial of James Bates for the murder of his friend, Victor Collins, who was found dead, floating face-up in Mr. Bates’ bathtub, sparks debate regarding the first issue: Can Alexa actually record a murder or, in the personal injury context, an accident?¹⁵ In Bates, the prosecution asked Amazon to disclose recordings from Mr. Bates’ Amazon Echo.¹⁶ Amazon refused, citing privacy concerns.¹⁷ Ultimately the issue went unresolved, without addressing Amazon’s position regarding privacy concerns, when Mr. Bates voluntarily turned over the recordings.¹⁸

While the Bates case does not resolve the constitutional issue of whether Amazon may use the First Amendment’s protection of free speech to refuse to disclose the recordings gathered by our Amazon Echoes, it does highlight the fact that users have access to their recordings and, therefore, can willingly disclose them. Amazon’s Alexa App keeps a history of the voice commands that follow the wake word (“Alexa!”). Specifically, in response to a user’s question, “Can I review what I have asked Alexa?”, Amazon states “Yes, you can review voice interactions with Alexa by visiting History in Settings in the Alexa App. Your interactions are grouped by question or request. Tap an entry to see more detail, provide feedback, or listen to audio sent to the Cloud for that entry by tapping on the play icon.”¹⁹

We also know that Alexa can record events, such as a crime or an accident, because Echo is equipped with seven microphones that use beam-forming technology and enhanced noise cancellation. Alexa also has a camera, though it is off until a user activates it by asking Alexa or using the Echo Look App to take a photo, video, or use live preview. Alexa’s evidentiary value can also be found in the circumstantial evidence she can provide regarding a plaintiff’s day-to-day life, which can assist defense attorneys preparing for depositions and trial. Questions and commands from parties to their virtual assistants can provide valuable information regarding the places parties have visited since the alleged incident, their hobbies, and activities in which they are involved.

For example, by knowing that plaintiffs have asked their virtual assistants about the commute times to a certain office building, or their requests for Alexa to hail an Uber for them, defense counsel can ask more targeted questions during depositions, including whether plaintiffs have worked since the accident or have traveled or gone on vacation. The value of these records can be immeasurable, given the wide array of commands to “virtual assistants,” including giving definitions of new terms and phrases (“Siri, what is meant by ‘Big Data’?”); playing music (“Alexa, play songs by the Judybats”); assisting in recreation (“Siri, where can I play court tennis in the United States?”); (Alexa, how can I play golf at High Ridge Country Club?”); answering any number and variety of factual questions (“Siri, for which projects has Sciame Construction won awards?”); (“Alexa, which famous people are named ‘Oona’?”); (“Cortana, how do I apply for a Fulbright Scholarship in The Netherlands?”); (“Bixby, what were the ‘moral imperatives’ in ‘Real Genius’?”); (“Siri, who are the leading female poets in New York City?”); (“Google, which movie directors live in Brooklyn?”); (“Bixby, when did the Beach Boys record ‘I Get Around’?”); (“Siri, who is Phil Ochs?”); (“Cortana, how did Holly Golightly in ‘Breakfast at Tiffany’s’ support herself financially?”); going to events (“Bixby, where is the Songwriters Hall of Fame located?”); and securing prices for travel (“Alexa, ask Kayak how much it costs to fly from New York to Easter Island.”). Virtual assistants can also set up timers and alarms, thereby providing defense counsel with valuable information regarding when a person gets up in the morning and their appointments during the day. Alexa can even be used to begin a workout (“Alexa, ask Random Workout to pick a workout.”), which can be significant in those cases where plaintiffs claim to have sustained substantial physical limitations as a result of an accident.

It cannot be overstated how valuable this information can be to gain insight into a plaintiff’s everyday activities, which is often the essential element of most personal injury claims. Defense attorneys know that, when it suits plaintiff’s interests, plaintiffs often do not provide a wealth of information regarding their past day-to-day activities. Armed with a compendium of plaintiffs’ virtual assistants’ searches, however, defense counsel can refresh plaintiffs’ recollections regarding what people did on a certain day, even whether plaintiffs tried to call 911 for help,²⁰ thereby leading to more effective and meaningful questioning. This may be especially helpful if plaintiffs are trying to conceal their actual lifestyles. Like Facebook photos from a vacation, Alexa can be used to expose those plaintiffs who fail to testify truthfully and candidly regarding their injuries and ability to carry on activities of daily life.

The other side of the coin is that those plaintiffs who are ethically challenged can conceivably use their virtual assistants strategically, for example, by asking Alexa for information which would tend to validate their false narratives. For example, someone who is basically physically fine but nevertheless eyeing a potential personal injury suit as a result of an accident may be tempted to ask, “Alexa, add knee brace, cervical collar and Aleve to my shopping list.” – personalized “fake news,” if you will. As it is, this past July, British Security Researcher Mark Barnes warned of a technique that can be used to install malware on Amazon Echo that would silently stream audio from the hacked device to a faraway server, in essence, tapping the Echo.²¹ Since AI assistants can provide a “real time” autobiography, with malware, that autobiographical information can be read by those who were never intended to have access to that private information. Forewarned is forearmed.

Amazon Echo is not the only piece of technology that has the ability to alter the way we practice by collecting valuable information. Other smart devices, including the pedometer feature on our iPhones and Fitbits, can also provide valuable information regarding a person’s fitness level, including the number of steps a person takes and when they take them. This data, like other documentary evidence, is likely to be more accurate and informative than deposition testimony, which was taken only after a preparation session with an attorney and relies on a person’s memories of events that may have occurred years before the deposition. Opposing counsel devote considerable time and effort to obtain definitive answers from plaintiffs, pinning down physical fitness regimes before and after an accident, with some plaintiffs testifying that they used a run a 5K every weekend and now run “less,” “not as much,” or “not at all.” Plaintiffs have been known to respond with limited or vague answers to these probing questions at depositions. Now, however, the raw data from these devices can provide information that defense counsel can analyze to accurately determine plaintiffs’ actual fitness levels before and after an accident. Defense experts can also use this definitive information from plaintiff’s virtual assistants to construct a baseline from which they can assess a plaintiff’s physical changes, pre- and post-accident.

Using the discovery process to obtain data from plaintiffs’ Alexa or Cortana will most certainly be met with opposition from plaintiffs’ counsel, on the grounds of privacy and prejudice. That opposition will continue until the law begins to develop parameters regarding this type of discovery. However, since those who turn on virtual assistants presumably know, or should know, how they work, they should not be heard later to complain when the devices perform as advertised. One self-help solution is to unplug AI assistants when we do not want Siri or Alexa to overhear and record what is being said in their presence, something most people have not been doing.²² Keeping virtual assistants unplugged, unless or until needed, or taking the precaution of unplugging the virtual assistant when engaging in intended confidential conversations, may become common practice, if not also good common sense.²³

The situation becomes more problematic when it involves guests in someone’s home who do not realize they are being recorded.²⁴ Upon entering a person’s house or apartment, are we now expected to ask whether their virtual assistant is on, listening to and recording every word we say? Expectations of privacy therefore now change. As attorneys bring these issues before the courts, judges will weigh the right to a proper defense for defendants against the important right to privacy of plaintiffs. In doing so, courts will determine whether plaintiffs have true expectations of privacy regarding the data and recordings of their smart devices when they have put their physical conditions at issue in personal injury litigation. Simply put, why should the information collected by virtual assistants be treated any differently in discovery than the information contained in personal diaries or cell phone data? To state the proposition is to reject it.

Attorneys who understand the potentially valuable information these devices can provide to our clients should begin to question adversaries about them during discovery and be ready to defend their own witnesses for cross-examination when called upon to testify. When appropriate, counsel should also seek rulings on disclosure of this information if opposing counsel object to providing it. Significantly, Amazon Echo users can delete their voice recordings, which are stored in the History section of the Alex App. Some plaintiffs, with or without advice or counsel, may therefore log on to Amazon.com/myx, find their Echo, and delete old voice recordings.²⁵ Deletions can also be made on Google’s Assistant.²⁶ Knowing this, it will be prudent for defense counsel to serve opposing parties with a demand at the beginning of litigation for the preservation of evidence, requesting plaintiffs to retain that information in the Cloud and not to dispose of any recordings in the History section of the Alexa App, a fair quid pro quo for demands by plaintiffs for the preservation of any CCTV believed to have captured an accident, often served at or prior to the commencement of a lawsuit. To obtain that information, authorizations directed to Amazon, Apple, Google, Microsoft and Samsung should also be requested, in order to access important data from Alexa, Siri, Google’s Assistant, Cortana and Bixby, respectively.

Moreover, the evidentiary value of this newly available information extends well beyond casualty litigation, to any area of law where liability hinges on proof of what someone said or knows and when they said it or knew it, thereby encompassing all practice areas. For just one example, information from virtual assistants will be valuable to attorneys handling securities fraud and insider trading cases, as Alexa can be the “fly on the wall,” overhearing conversations regarding which stock to buy or sell and when. Attorneys litigating sexual harassment or Title VII immigration cases that look to the context surrounding what was said behind business decisions will be able to benefit heavily from this technology, which provides unvarnished insight into what was previously disputed “he said/she said” conversations. Trademark, copyright, and patent attorneys, piecing together the origination of ideas, may also find useful the data that virtual assistants can now make readily available.

Information from digital assistants is not limited to the United States and now has direct application to cases and litigants worldwide. Just this past October, Yandex, the largest search engine in Russia, often referred to as the Russian equivalent of Google, introduced Alice, its first conversational, intelligent assistant.²⁷ This new girl in town is touted to be the most capable Russian language assistant of its kind.²⁸ Accordingly, the search for information acquired by virtual assistants will soon be across borders, in any country where AI assistants are located.

As Kyle Rees cautioned Sarah Connor in the first “Terminator” movie, “Listen and understand. That terminator is out there. It can’t be bargained with. It can’t be reasoned with. It doesn’t feel pity, or remorse, or fear.” So, too, are digital personal assistants, who can and will record our every statement, which can later be used as evidence by lawyers who understand and make full use of this new technology.²⁹ The next generation of artificial intelligence platforms may provide attorneys access to even more information which previously was assumed to be private and non-discoverable.

Whether in the board room, the living room, the proverbial “smoke filled room” or the office, the defense of “plausible deniability,” used conveniently when confronted with previously hard to prove facts, will not be less successful in voiding disclosure of what actually took place. If, during conversations intended to be secret, Siri, Alexa, Google’s Assistant or Cortana are present in the room, unobtrusively sitting on a table, bookshelf or mantel, silently listening to and recording all that is being said, it will be far harder for the participants of that meeting to later deny what was said, when, and by whom.

Remembering Judge Cardozo’s remark that “law never is, but is always about to be,” and Chief Justice John Roberts’ comment this past July that “advancing technology poses one of the biggest challenges for the Supreme Court,”³⁰ forward thinking attorneys should not shy away from putting these issues before the court, as attorneys and judges (perhaps with the help of AI devices) together grapple with this new technology, directly applicable in today’s world, both real and virtual. We are now at the start of an era in which previously unavailable data can be accessed, become discoverable, and later be introduced into evidence. Attorneys who fail to recognize this will be left behind.

Reprinted with permission from New York State Bar Association Journal, November/December 2017, published by the New York State Bar Association, One Elk Street, Albany, NY 12207.

Endnotes

 1 Robert D. (“Bob”) Lang (RDLang@damato-lynch.com) is a senior partner at the firm of D’Amato & Lynch, LLP in New York City, where he manages the Casualty Department.

 2 Lenore E. Benessere (LBenessere@damato-lynch.com) is an associate of the firm. The authors would like to thank paralegal Megan Kessig for her help, and Alexa, Bixby, Siri, Google’s Assistant, and Cortana for their assistance.

 3 Benjamin Cardozo, Lecture, The Nature of the Judicial Process, Yale Law School (1921).

 4 Stacey Gray, Always On: Primary Implications of Microphone-Enabled Device, Future of Privacy Forum (April 4, 2017).

 5 George Anders, “Alexa, Understand Me,” M.I.T. Tech. Rev. (Aug. 9, 2017).

 6 Alexa tells us the president is James Monroe.

 7 Amazon, https://www.amazon.com/Amazon-Echo-Bluetooth-Speaker-with-Alexa-Black/dp/B00X4WHP5E/ ref=sr_1_1?s=amazon-devices&ie=UTF8&qid=1500487675&sr=1-1&keywords=echo.

 8 Amazon, Terms of Use, https://www.amazon.com/gp/help/customer/display.html/ref=hp_left_v4_sib?ie=UTF8%nodeId=201809740.

 9 Nick Wingfield, Amazon Wants to Wake You Up With Alexa, and That’s Just the Start, N.Y. Times (Sept. 29, 2017).

 10 Peter Nowak, Why It’s No Longer Strange to Talk to Your Home Appliances, The Globe and Mail (Oct. 2, 2017).

 11 Adrian Cutler, The Virtual Revolution of the Digital Assistant, IT ProPortal (Oct. 5, 2017).

 12 Artificial Intelligence, The Invincible Revolution Than Can Change Everything, Latin American Herald Tribune (Oct. 16, 2017).

 13 Martin Courtney, Alexa, Cortana, Siri, et al: Do Our Digital Assistants Hear More Than We Want Them To?, E&T Magazine (Oct. 13, 2017).

 14 Consider the computer HAL 9000 in 2001: A Space Odyssey; Skynet in The Terminator movies; the computer WOPR in WarGames; the NS-5 robots in I, Robot; Gatekeeper in The Net; ARIA in Eagle Eye; GLaDOS in Portal; the Terrans in the X game series; SHODAN in the System Shock series; SID 6.7 in Virtuosity; X.A.N.A. in Code Lyoko; AI Omega in Red vs. Blue; and the comely computer Ava (apparently no relation to Alexa) in Ex Machina.

 15 Eliott C. McLaughlin and Keith Allen, Alexa, Can You Help With This Murder Case?, CNN (Dec. 28, 2016); Agatha French, Alexa May Be Listening, but Will She Tell on You?, L.A. Times (Jan. 5, 2017).

 16 Hailey Sweetland Edwards, Alexa Takes the Stand: Listening Devices Raise Privacy Issues, Time (May 4, 2017); Jill Bleed, Alexa a Witness to Murder? Prosecutors Seek Amazon Echo Data, Yahoo.com (Dec. 27, 2016); Sarah Buhr, An Amazon Echo May Be the Key to Solving a Murder Case, TechCrunch (Dec. 27, 2016).

 17 Gerald Sauer, A Murder Case Tests Alexa’s Devotion to Your Privacy, Wired (Feb. 28, 2017).

 18 Shona Ghosh, Amazon Handed Over Alexa Recordings to Police in a Murder Case, Business Insider (Mar. 7, 2017); Chris Perez, Amazon Abandons Legal Fight Over “Alexa Data”, N.Y. Post (Mar. 7, 2017).

 19 Amazon, Alexa and Alexa Device FAQs, https://www.amazon.com/gp/help/customer/display.html?nodeId=201602230.

 20 Jefferson Graham, “Alexa, Call 911” Won’t Work. Here’s What Will, USA Today (July 19, 2017).

 21 Andy Greenberg, A Hacker Turned an Amazon Echo into a “Wiretap”, Wired (Aug. 1, 2017).

 22 Siri and Alexa Are Spying on Us, Gotham Girl (Aug. 26, 2017).

 23 In reaching to turn off virtual assistants, some may have flashbacks to any number of science-fiction books and movies, such as 2001: A Space Odyssey by Arthur C. Clarke and Stanley Kubrick, where the artificial intelligence device resists and actively defends itself when people seek to turn it off. Our advice: notwithstanding your fears, summon your courage and turn off your virtual assistants when you do not want them listening to and recording what you are saying.

 24 Alexa, How Much Is My Privacy Worth?, Salem News (Aug. 1, 2017).

 25 Jake Swearingen, Can an Amazon Echo Testify Against You?, N.Y. Mag. (Dec. 27, 2017).

 26 Kevin Murnane, How to Delete the Recordings of Your Interactions With Alexa and Google Home, Forbes (Oct. 2, 2017).

 27 Radu Tyrsina, Cortana Gets New Competition from Alice, Courtesy of Yandex, Window Report (Oct. 4, 2017).

 28 Brian Heather, Yandex Introduces Alice, An Alexa-Like Assistant, That Speaks Russian, TechCrunch (Oct. 11, 2017); Pradeep, Yandex Release Its Cortana Competitor in Russia, MSPowerUser (Oct. 11, 2017); David Reid, Russian Launches Its Own Version of Amazon Alexa With ‘Near-Human Levels’ of Speech Recognition, CNBC (Oct. 10, 2017).

 29 Kevah Waddell,  The Privacy Problem With Digital Assistants, The Atlantic (May 24, 2016).

 30 Nick Perry, In Overseas Remarks, Roberts Says Technology Poses Challenge for Courts, N.Y. L.J. (July 26, 2017).

We all experience password fatigue, that feeling when you receive yet another notification to create or change a password. The password must meet certain criteria, typically a minimum number of characters containing a combination of uppercase, lowercase, numbers, and/or symbols. Exasperated, you ask yourself, “How am I going to remember a new password?” So you take the easy route and add an additional exclamation point to your current password or use a password from a different account.

While you are more likely to remember these passwords, re-using or creating predictable passwords leaves you vulnerable to hackers. Stolen passwords, phishing, spear-phishing, and ransomware are serious threats to any internet user, but particularly so for attorneys, who are mandated to protect confidential client information.

Best Practices for Creating Strong Passwords

You know the basics of password security. Do not store your written passwords under your keyboard; do not use your username, the word “password,” qwerty, or personal/confidential information as a password; and finally, do not use a single dictionary word. So how do you protect yourself?

Stop Re-Using Pa5sw0rds! Even if you create a strong password, using it for a number of accounts increases the likelihood that it may be stolen. While it is less critical to create unique passwords for each site you visit that does not store your personal or confidential information, never use that password for any site storing such information. Most importantly, you should never re-use your email password at any online site. If your do and one of the eCommerce sites is hacked, your email account is compromised.

Longer is Better.  While many sites require a minimum of eight characters, you should create a longer password. Each additional character you add will exponentially increase your password strength. A password consisting of 15 lowercase letters offers better security than an eight-digit password containing mixed, but predictable, characters.

Even So, Mix It Up. Many users make it easier on themselves (and hackers) by placing their capital letter at the beginning and the number and/or special character at the end. Your password will be far stronger if capital letters, lower case letters, numbers and special characters are not bunched together. Mixing it up also means that you avoid easily predictable keyboard patterns such as qwerty or 1qaz@wsx.

Don’t Change So Often.  For some of us, frequent change is required by the IT department. If you have a choice, though, it is generally a better policy to create a strong password and keep it for a longer period of time. While this may seem counterintuitive, frequently changing a password makes it tougher for the user to remember, which makes the user more likely to create easily recalled passwords or to simply incrementally increase the number at the end each time a change is required.

Use a Password Manager. If you have a unique password for each site you visit, you have far too many passwords to remember which password is connected to which site. You probably are also frequently locked out of accounts or having to reset your passwords. Good news – there’s an app for that! Password managers create and store credentials for each site you use and log you in automatically. Your database of passwords is encrypted with a master password. The benefit of a password manager is that you will have unique and strong passwords for all of your online accounts. The downside is that you absolutely must remember your master password. There are numerous excellent password managers. Dashlane, KeePassX, Password Boss, and LastPass are just a few of the many options and most have both free and paid versions.

Use Two-Factor Authentication. While these password tips provide a good start to better online security, you should also enable two-factor authentication for any account that offers that option. Two-factor authentication will require that you enter a temporary code sent to your phone along with your regular password. This additional layer can help protect you from attack if your passwords are compromised. This is a particularly good idea for online banking and eCommerce accounts. You can often designate your own personal computer and phone as trusted once it is set up and can avoid the bother of having to enter a code each time you access your account from those devices.

Whether you are technologically savvy or not, these tips provide easily achievable steps to better secure your online presence. Resolve to make your 2017 more secure by putting these password systems into practice.

Endnote

 1 Cindy Neagle is Law Practice Management Attorney for The Missouri Bar.

“The fact is, we’re looking for a very small number of very evil needles in a very large haystack ...”

Charles Clarke, member of British Parliament, and Home Secretary (2004 – 2006)

 The practice of law continues to change, albeit slowly. Nowhere does this change impact the legal field more profoundly than the volume of data created by clients, lawyers, courts, and the public. Society has gone well beyond being “data rich” to being “data swamped.” Computers, phones, cars, even household appliances, generate enormous amounts of data every day. The practice of law requires attorneys to account for much of this data. They must understand not only the data they handle, but also their client’s data. Failure to maintain this understanding can result in state or federal penalties, adverse court decisions, sanctions to both attorney and client, or potentially even disbarment. Yet even the tech aware attorney can become overwhelmed.

 A simple discovery request might include a benign-looking and well-intended request such as: “All emails sent, received, or otherwise exchanged by Acme Corporation employees relating to Joe Smith.” However, when a lawyer sends this request on to a client, or the technician who handles their technology, such a request becomes a nightmare. Each employee sends or receives an average of 125 emails per day. If Joe Smith’s controversy spanned six months and involved ten Acme employees, the volume of email to search would be in the neighborhood of 225,000. This fails to count any email attachments, which also need to be examined.

 Sheer volume alone hides some nasty challenges. For example, some of those emails may have been archived (stored on backup disks), or come from another email account an employee used such as a web-based email provider. Extracting email from archives and collecting from external email servers will keep your poor technician busy for days on end. And the job isn’t over once emails have been collected. Now they must be reviewed to prevent disclosure of privileged, or otherwise confidential, information (i.e. Social Security numbers, health data, and human resource issues).

 Manually reviewing such a mountain of email can’t be performed efficiently, especially when reviewers spend a majority of their time sifting through email that has nothing to do with Mr. Smith. Traditionally, 90 percent of the email collected for review has nothing at all to do with him. One could simply perform a search on the email with the words “Joe” and “Smith,” which would likely reduce that 225,000 email mountain significantly. However, keyword searches, which utilize single words or even combinations of words, both over-collect emails and miss many others. For example, if one employee had a husband named Joe, such a search would return all those emails. Alternatively, if employees referred to Joe Smith as JS, such a search would find none of those emails.

 Technology provides the ability to continually create and store data that can be revised and shared at a moment’s notice. However, the ability to save all that data and then find something in it becomes a challenge. In the days of paper records, a law office had no choice but to manually review every piece of paper related to the case at hand. With the technology of today, we can now search these documents faster and more accurately. Using technology to assist document review allows us to reduce one of the most fallible links in the discovery chain: humans. Review that requires humans to spend days reading documents results in errors – lots of them. There is no doubt that machines will make errors too, but human review guided by smart technology reduces the probability of missing otherwise potentially relevant or privileged documents.

Legal Framework

 The duty to preserve suffers the most profound impact of this data deluge. Just as an attorney must preserve a vehicle involved in an accident, client and other data must be preserved in the electronic data world. Unfortunately many lawyers struggle to understand technology and therefore see data preservation as a form letter to a client or a technologist. This is not the case, as data preservation requires a hold letter that specifies what to preserve.

 A legal hold letter may result from current or reasonably anticipated litigation, audit, government investigation, or other such matter that suspends the normal disposition or processing of data. Legal holds may encompass procedures affecting email, document storage, database records, social media content, and even text messages. Accessibility of this data may be reasonable, or not reasonable at all – try retrieving your text messages from six months ago.

 The obligation to preserve evidence arises when a party has notice that the evidence is relevant to litigation or when a party should have known that the evidence may be relevant to future litigation. Identifying the boundaries of the duty to preserve involves two related inquiries: When does the duty to preserve attach and what evidence must be preserved?² It is not enough to wait until litigation has commenced to start preserving data; preservation begins much sooner than that. This becomes very important as companies often have data-retention policies that would eliminate the data before litigation could commence to require preservation.

 The duty to preserve extends to those employees likely to have relevant information, including the retention of all relevant documents or tangible things in existence when the duty attaches.³ While this initially seems like a large task, “a party need not preserve all backup tapes even when it reasonably anticipates litigation” as doing so would cripple large clients.⁴ Instead the duty to preserve extends to those employees likely to have relevant information, and not the entire corporate database.⁵

 More data results in more problems, in that the likelihood of inadvertent disclosure of privileged information to opposing counsel increases. Fortunately, in 2008 the Federal Rules of Evidence were amended, providing much needed help.

 Rule 502 generally provides for protection of traditional “subject-matter waiver” standards when the protected information is inadvertently provided to the opposing party.⁶ To clarify, the committee directly addressed the cost/benefit problem, commonly referred to as proportionality, when discussing Rule 502, responding to the “widespread complaint that litigation costs necessary to protect against waiver . . . have become prohibitive due to [disclosure concerns].”⁷ While some courts previously held that even unintentional disclosure of protected information constituted waiver, Rule 502 now expressly protects this information. This is certainly helpful to those weary of having to manually review every document or email in order to ensure protection of privileged information.

 Rules of evidence require authentication, which can be especially challenging with digital evidence. Such authentication can be done using metadata; however, asking for metadata with a discovery request should be done sparingly as gathering metadata associated with every document or email requires significantly more work and expense.

 The term “metadata” seems to float around digital evidence and electronic discovery like pollen in the spring. However, what exactly constitutes metadata seems to escape many who use the term. Metadata can be thought of as data about data. For example, documents contain words and sentences — clearly this is data. However, metadata contains data about that document, including when it was created and modified, by whom, on which computer, and when. Metadata can be thought of as a set of unique library catalog cards, one for each document or email you create, read, modify, or copy. Thus, just as a catalog card provides background information on a book, metadata provides background information on documents, emails, messages, pictures, blog posts, web site visits, and a host of other electronic items and actions.

 While metadata can be used to authenticate, admissions will always be more common. Only when someone fails to admit involvement in creating, editing or viewing a document, or sending or receiving an email will metadata be needed to authenticate. Of course data processing and electronic discovery vendors will be very happy to provide metadata at attractive rates – attractive to themselves.

Ethical Standards

 ABA Model Rule 1.1 of Professional Conduct expresses in a few words the lawyer’s duty to represent all clients competently. In 2013, the ABA accepted a proposal of the ABA Commission on “Ethics 20/20” to modify one of the comments to this rule in order to make clear that a lawyer must continuously maintain familiarity with technological change in order to comprehend the manner in which technology may affect a particular representation. The added language reads, “To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject.”⁸ Lack of knowledge as to digital evidence cannot excuse a lawyer from such diligence. What’s a lawyer to do? The California Rules of Professional Conduct may supply an answer. Recent changes in California rules included this ominous passage:

 Attorneys who handle litigation may not ignore the requirements and obligations of electronic discovery. Depending on the factual circumstances, a lack of technological knowledge in handling e-discovery may render an attorney ethically incompetent to handle certain litigation matters involving e-discovery, absent curative assistance under rule 3-110(C), even where the attorney may otherwise be highly experienced. It also may result in violations of the duty of confidentiality, notwithstanding a lack of bad faith conduct.⁹

 This may be the future across the nation. Regardless, the volume of data will not shrink in the future, nor will the importance of some of the needles in the growing haystack of data. The outcome of cases will turn on these needles, as will the ability of lawyers and law firms to compete with those who leverage technology to reduce costs.

 Even the most tech-savvy lawyer, using software to find that needle, will likely require the expertise of technology professionals — data from multiple sources, in multiple formats, doesn’t simply appear within a software product without retrieval and conversion. The ABA addressed this issue in a formal opinion, providing that a lawyer who engages a non-lawyer (or lawyer) to provide outsourced services is required to ensure that person’s compliance with Rules 5.1 and 5.3.¹⁰ Therefore, utilizing help from outside vendors to complete a complicated e-discovery task is not unethical. It is, however, the supervising lawyer’s obligation to ensure that those tasks are delegated to individuals competent to engage in them.

Data Review

 Document review continues to employ methods that date back to the invention of paper – manual review. According to the Best Practices Commentary by the Sedona Conference,“[e]ven assuming that the profession had the time and resources to continue to conduct manual review of massive sets of electronic data sets (which it does not), the relative efficacy of that approach versus utilizing newly developed automated methods of review remains very much open to debate.”¹¹ New associates fear and loath the traditional review of documents, namely sitting in a room with other young lawyers reviewing reams of documents, electronically or in paper form, for days on end. Not only is this effort mentally exhausting but in the age of computers it requires the review of exponentially greater amounts of documents than ever before. Even if it were affordable, manual review of that amount of data leads to error rates of 35-40 percent.¹²

 Technology assisted review (TAR) includes a software component that goes beyond simple display of electronic data within the review process. Even though the legal profession views manual review as the gold standard compared to other forms of review, the use of TAR produces accurate, efficient results while still maintaining compliance with applicable discovery rules. “One point must be stressed — it is inappropriate to hold TAR to a higher standard than keywords or manual review. Doing so discourages parties from using TAR for fear of spending more in motion practice than the savings from using TAR for review.”¹³ Thus TAR should be viewed on an even playing field with manual review.

 Just as when you buy a new computer, there are many choices when it comes to TAR. The three primary types of software available utilize Continuous Active Learning (CAL), Simple Active Learning (SAL), or Simple Passive Learning (SPL). In a study performed by two of the most renowned experts in e-discovery, any active learning process (CAL or SAL) greatly outweighs passive learning (SPL), especially when compared to traditional review techniques.¹⁴

 Active learning differs from passive in that active learning software provides the user with the most likely relevant documents to review while passive selects documents randomly, or allows the user to select documents. Active learning leverages user actions to provide increased accuracy and efficiency of the searching and tagging performed by a user while passive learning treats all data the same and provides data to the user that better represents the entire data set (based on random sampling the user sees the data set as a whole). Both processes continually learn from reviewer actions. Both methods use statistical measurements to determine when to let the software mark the remaining documents. After the software marks a set of documents, the user reviews these and corrects any mistakes. The cycle continues until statistical measurements reach pre-set goals, often set as a part of the cost/benefit analysis. Once the software has done enough analysis, the software then marks documents yet to be reviewed by the user. In this way many documents get marked but the user reviews only a portion of them.

 Two very simple terms can be used to convey the effectiveness of TAR: precision and recall. Precision is the percentage of correctly marked documents within all marked documents. Recall is the percentage of correctly marked documents within all documents in the dataset. Essentially, precision measures how accurately a TAR technology uses reviewer markings to mark unreviewed documents. For example, if a user marks 100 documents relevant, and the software marks 1,000 of the remaining 9,000 documents relevant, then precision would be the percentage of the 1,000 documents the software marked that the reviewer confirms as being relevant. Recall works similarly by calculating the number of relevant documents within the remaining unmarked 9,000 documents the software should have marked relevant. An attorney can utilize these measurements to judge the progress of document review and substantiate both the use and accuracy of TAR.

 As more time is spent to get closer to that ever-elusive high precision/high recall result, an exponential amount of money is spent. However, the amount of time spent trying to get one more percentage point higher recall or precision may not be proportional to the value of the case. Thus, courts often reiterate that their rulings regarding proportionality for one particular case should not be applied to other cases.¹⁵

 In early 2012, federal Magistrate Judge Andrew Peck opined one of the first legal affirmations for TAR, stating that “judicial opinion now recognizes that [TAR] is an acceptable way to search for relevant ESI in appropriate cases.”¹⁶ It has been three years since that ruling was published, and courts have generally approved the use of TAR in discovery.¹⁷ It is important to note that while courts approve of the usage of TAR, it is up to the parties to determine when TAR is appropriate. Courts generally have not required TAR in discovery where the party has shown that the benefits do not outweigh the cost.¹⁸

 Many lawyers fear TAR as they assume they must be statisticians or mathematicians to use it. While it is necessary to understand how the technology works, a lawyer need not understand the detailed statistics or programming behind TAR. The choice in technology lies with the producing party as courts resist dictating the use of TAR or what type of TAR to use. Thus, the system used should be dependent on the specifics of the data within the case at hand, which can only be determined on a case-by-case basis.

Production

 Data can be produced in one of four formats: native, near-native, near-paper, or paper. Each has its benefits and drawbacks, so the process used for one case may not fit the next.

 A request for production may include metadata and, if so, such metadata should be delivered with the document in native format. This metadata acts much like a digital fingerprint and can be imperative in authenticating the document. Native production refers to the form ordinarily used by the producing party to store and revise the document. For example, with Microsoft Word, documents would be stored in .doc or .docx format. Production in this format delivers metadata but presents challenges when applying a Bates stamp, performing redaction, and controlling privileged or confidential data. Additionally, if the native format requires special software, such as a Computer Assisted Drawing (CAD) package, the opposing party will have no feasible way to view the native file.

 The near-native production keeps as much of the original data as possible, but places all documents in a commonly read file format more easily used by the opposing party. For example, CAD drawings can be converted to PDF files. This also makes Bates stamping and redaction easier to perform.

 Near-paper production simply produces an electronic file with each document presented as if it were printed and scanned into an electronic file. For example, a group of emails can be exported from Outlook into a single, multi-page, PDF file. Converting to this format allows for Bates stamping, redaction, removal of confidential information, and control of metadata. Traditionally lawyers would collect the data to be produced, print it, and then scan it back into a PDF, a costly and inefficient process. Software now allows this process to be performed seamlessly by the user when extracting data, thus decreasing cost and making this an often preferred method of production for data.

 Lastly, the paper format is just as it sounds, production completely in paper. As in near-paper, this provides the ability to completely control redaction, Bates stamping, and removal of confidential information. However paper will not include any metadata and, unlike all methods above, will not allow the party to electronically search the information.

Technology That Fits

 Currently, discovery extends to any non-privileged matter relevant to any party’s claim or defense, making it very broad and far reaching. Proposed changes to the Federal Rules of Civil Procedure include a change to Rule 26, limiting discovery to be “proportional to the needs of the case.” The motivation for this change stems from an effort to decrease cost and increase efficiency in the age of growing data volumes. The current interpretation of Rule 26 has led to increased costs and delays as firms struggle to sift through large amounts of data even though the expense often far outweighs the benefit to either party. Opinions vary on the impact of such changes but most agree that the proportionality standard will require substantiation beyond legal arguments – namely based on technical and resource expenditures. Most attorneys struggle with these types of arguments, requiring technical experts to weigh in as to the limits and accuracy of the software used when courts require a party to prove proportionality.

 Many cases and controversies settle without data volume becoming a factor, and without a thorough examination of documents and emails. A case with 1,000 pages of documents and email may appear too small for technology, yet paralegals and lawyers struggle to keep the content of that data organized mentally, especially when handling dozens of matters simultaneously. A case with 10,000 pages requires more than the human memory. However, a matter valued at $200,000 may not warrant a five-figure technology investment. What technology fits a case like this?

 Practicing attorneys can answer this question without the need to become technology geeks. Simple tools that merely organize data into a table of contents linking file names to file locations provide very little value. Tools that truly assist in analyzing, relating, and understanding the content in a dataset provide the real assistance needed. Software such as Encase, Logikull, iPro, and START:Review fill this space. The current market offers varying solutions, from cloud-based data review to on-site software. With each vendor having their own methods to perform the complicated analyzation required, this allows lawyers to shop around, finding the right features, at the right price, to find those needles in their haystack of data.

Conclusion

 E-discovery is an area of the law that every lawyer should embrace and understand enough to work in. Big data is not going away, and sooner or later the time will come that requires the use of complicated software to navigate a case. Understanding how TAR can help you wade through a seemingly impossible task is the first step in embracing e-discovery, and is your obligation to effectively serving your client by providing them more bang for their buck.

This article was originally published in the August 2015 (Vol. 40, Issue 9) edition of Montana Lawyer, the official publication of the State Bar of Montana, and is reprinted with the permission of the authors.

Endnotes

 1 Joel Henry, Ph.D., J.D., is a professor of computer science at the University of Montana and adjunct professor of law at the university’s Alexander Blewett III School of Law. Michael Pasque is a third-year candidate for J.D., 2016, from the University of Montana Alexander Blewett III School of Law.

 2 Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 216 (S.D.N.Y. 2003).

 3 Id. at 217; Fed. R. Civ. P. 34(a).

 4 Id. (emphasis added).

 5 Id.; Fed. R. Civ. P. 34(a).

 6 Fed. R. Evid. 502(a)-(b).

 7 Fed. R. Evid. 502 Advisory Committee Notes.

 8 ABA Model R. of Professional Conduct, 1.1, cmt. 1 (2013) (emphasis added).

 9 State Bar of Calif. Standing Comm. on Prof’l Responsibility & Conduct, Formal Op. Interim No. 11-0004 (2015).

 10 ABA Standing Comm. on Ethics & Prof’l Responsibility, Formal Op. 08-451, (2008).

 11 The Sedona Conference, The Sedona Conference Best Practices Commentary on the Use of Search and Information Retrieval Methods in E-Discovery, 8 Sedona Conf. J. 189, 199 (2007).

 12 Id.

 13 Rio Tinto PLC v. Vale S.A., 306 F.R.D. 125, 129 (S.D.N.Y. 2015).

 14 Cormack, G. V., & Grossman, M. R., Evaluation of machine-learning protocols for technology-assisted review in electronic discovery, Proceedings of the 37th international ACM SIGIR conference on Research & development in information retrieval, 153-162 (ACM 2014).

 15 Moore v. Publicis Groupe, 287 F.R.D. 182, 193 (S.D.N.Y. 2012) adopted sub nom. Moore v. Publicis Groupe SA, 11 CIV. 1279 ALC AJP, 2012 WL 1446534 (S.D.N.Y. Apr. 26, 2012); Rio Tinto, supra note 12.

 16 Id. at 183.

 17 Green v. Am. Modern Home Ins. Co., No. 14–CV–04074, 2014 WL 6668422 at 1 (W.D.Ark. Nov. 24, 2014); Aurora Coop. Elevator Co. v. Aventine Renewable Energy–Aurora W. LLC, No. 12 Civ. 0230, Dkt. No. 147 (D.Neb. Mar. 10, 2014); Edwards v. Nat’l Milk Producers Fed’n, No. 11 Civ. 4766, Dkt. No. 154: Joint Stip. & Order (N.D.Cal. Apr. 16, 2013); Bridgestone Am., Inc. v. IBM Corp., No. 13–1196, 2014 WL 4923014 (M.D.Tenn. July 22, 2014); Fed. Hous. Fin. Agency v. HSBC N.A. Holdings, Inc., 11 Civ. 6189, 2014 WL 584300 at 3 (S.D.N.Y. Feb. 14, 2014); EORHB, Inc. v. HOA Holdings LLC, No. Civ. A. 7409, 2013 WL 1960621 (Del.Ch. May 6, 2013); In re Actos (Pioglitazone) Prods. Liab. Litig, No. 6:11–MD–2299, 2012 WL 7861249 (W.D.La. July 27, 2012) (Stip. & Case Mgmt. Order); Global Aerospace Inc. v. Landow Aviation LP, No. CL 61040, 2012 WL 1431215 (Va.Cir.Ct. Apr. 23, 2012).

 18 In re Biomet M2a Magnum Hip Implant Prods. Liabl. Litg., 2013 WL 1729682 & 2013 WL 6405156; Kleen Prods. LLC v. Packaging Corp. of Am., 2012 WL 4498465.

The advent of health-surveillance tools and mobile fitness applications has ushered in a new era of consumer health care that holds enormous promise. Individuals are more empowered than ever to take control of their health, and it is possible to provide real-time tracking and reporting of critical information about fitness to physicians, swiftly and across vast distances.

Yet all this potential poses a challenge in terms of health data privacy and security that rivals – if not surpasses – the threats associated with financial data. For more than a decade, consumers have battled the prying eyes of data brokers and hackers to protect their financial information. Now, the battlefront has shifted to include health and lifestyle information that could prove even more sensitive and consequential if hacked.

“Health data is more vulnerable in general as a data set than financial data because you can’t replace it like you can a credit card,” says Michelle De Mooy, deputy director of the Consumer Privacy Project at the Center for Democracy & Technology, a Washington, D.C.-based nonprofit that advocates for civil liberties and human rights on the Internet. “When you have a diagnosis, it’s something that’s a part of your medical history for life. When people are victims of medical identity theft or their medical records have been hacked, there are very few good remedies for those situations. They are unprotected, and sometimes their whole families are unprotected.”

That matters, De Mooy says, because wearables such as fitness wristbands and monitors have become so sophisticated, designed to track user activity and share their data with a multitude of applications and devices, with few if any restrictions. These tools are capable of measuring brain activity, calorie intake, miles walked and run, swimming strokes, blood oxygen and blood sugar levels, and heart rates. They are both fitness coach and a proverbial “black box” for a consumer’s health. They also are a gateway to the lives of their users.

Up to now, informed consumers have been willing to sacrifice a little privacy to gain the benefits associated with fitness trackers and smartwatches: improved wellness, vanquishing unhealthy eating habits, and feeling more liberated to manage their health care. No question these are worthy goals, but legal experts believe Americans may be reaching a critical juncture on health and fitness data because now it is under more threat than ever. Where it was once both taboo and illegal for hackers and corporations to poke around in certain types of health records, this data is being viewed by some as the missing piece in consumer profiles.

A Federal Trade Commission (FTC) study released in May 2014 revealed that 12 mobile health applications and devices transmitted information to 76 different third parties, and some of the data could be linked back to specific users. In addition, 18 third parties received device-specific identifiers, 14 received consumer-specific identifiers, and 22 received other key health information.

“What we have is this vast amount of information that is being created, and, as the Federal Trade Commission has found, not a lot of attention yet being paid by consumers to how it’s being used and shared,” says Kristi Wolff, special counsel at Kelley Drye & Warren, LLP. “A lot of companies are coming out with innovative products, but they’re new and not taking some of the necessary precautions that more established companies would take in terms of data privacy and security.”

With so much at stake, privacy advocates are debating how best to protect consumer wellness and fitness information. Medical or health data generated by doctors, hospitals, and other clinicians is covered by the Health Insurance Portability and Accountability Act (HIPAA), which limits access to patient health records and punishes those who violate the protections. But the information generated through fitness trackers, smartphones, and mobile applications is generally not covered by HIPAA regulations.

Industry officials argue that additional government regulation, if it comes, would be slow and stifling to an enterprise that relies on innovation at the speed of light. Likely, rules would be outdated the moment they are adopted, and they would be solving yesterday’s problems rather than forecasting the privacy concerns of tomorrow’s devices.

Many believe the best way forward is to encourage companies to adopt a best-practice model on data privacy for fitness trackers and applications. Best practices in privacy policies might focus on keeping health data on the device rather than in the cloud, letting the user choose with which applications to share their information, and prohibiting the stats from being sold to data aggregators for behavioral advertising.

What is indisputable is that there is a great deal of flux and uncertainty in how consumers and technology companies operate within the new digital economy and digital ecology, suggests Jennifer S. Geetter, a partner at McDermott Will & Emery, LLP. Businesses, consumers, lawyers, regulators, policymakers, and investors are not only operating under a different set of rules, but also a different set of possibilities.

“We are in the midst of an important dialogue about our digital world, and one vitally important piece of that is our digital health world,” Geetter says. “I expect we’re going to continue to see volatility and flexibility because the technologies are changing. People always talk about innovation on the technology side, but we’re going to have to be legal innovators as well.”

Small Devices, Big Business

Most consumers are familiar with wearable devices, if they’re not wearing one now. Many look like space-age watches and have the functionality of desktop computers. They are a part of the Zeitgeist where people compare the number of steps they’ve taken or flights of stairs climbed around the “water cooler” or on Facebook. Many predict that one day these devices will be as ubiquitous as cell phones.

Among wearable devices, Fitbit captured the public’s imagination first and to the greatest extent with its trim, multi-colored plastic wristbands that resembled the Livestrong yellow bracelets, but without the controversy. What began as a homely, hyped-up pedometer in 2007 has turned into a handsome tracking device, monitoring sleep habits, blood glucose levels, calories, heart rate, distances traveled, and routes used.

But Fitbit isn’t alone in the vast frontier of health-tracking tools. Today there is a long list of competitors producing nearly identical lollipop-colored wristbands and mind-boggling applications. Its rivals range from Garmin to Jawbone, Under Armour to Google, and Xiaomi to Misfit. Even jewelry company Swarovski has entered the fray with its bejeweled Shine. Of course, casting a long shadow over the entire category is the Apple Watch, part designer adornment, part lifestyle computer. The Apple Watch, like most Apple products, became a wearable industry leader even before it was shipped to stores in April 2015.

Sales of wearable gadgets – smartwatches, smart eyewear, and fitness-tracking devices – have exploded in popularity in recent years, and they are expected to register some 30.9 million units in sales in 2015, according to the U.S. Consumer Electronics Sales and Forecasts, the semiannual industry report of the Consumer Electronics Association (CEA). The forecast, which was released in January 2015 and updated in July, estimated that health and fitness trackers would lead sales among wearable devices with projected sales of 20 million units, and revenues reaching $1.8 billion in 2015, an 18 percent increase over [2014].

International Data Corporation (IDC), a global marketing research firm, reported that consumer spending on wearable devices tripled in 2014 compared to 2013. IDC predicts that production of health trackers will jump from 20 million units in 2014 to more than 120 million units in 2019. Meanwhile, the NPD Group, a sales tracking company, reported that more than 25 percent of U.S. consumers already use fitness apps.

Observers believe wearable tech sales will remain robust as long as the applications market follows suit. The availability of applications from third-party developers will ensure the long-term growth of the tracker and smartwatch markets, but it also creates a tsunami of new health information and privacy concerns.

Applications such as Runkeeper, Fit-Star Personal Trainer, Nike+ Training Club, and Fitnet allow consumers to use their smartphones to set their physical regimen and monitor their fitness goals. (Fitnet even uses a smartphone’s camera to evaluate whether users are exercising the right way.) A 2014 report released by ACT: The App Association, an industry group for application makers, shows that the number of health and medical apps doubled between 2012 and 2014, and analysts are expecting revenues to reach $26 billion by 2017.

“It’s one of those odd confluences in that everyone is interested in the same thing, which is improved patient outcomes,” says Morgan Reed, executive director of ACT. “What we’re really trying to do is have healthier and more able people to be in charge of their own lives and be able to connect to a doctor when they want.”

Connecting to doctors presents another series of opportunities and hurdles. Nearly 100 million wearable remote patient monitoring (RPM) devices – such as pulse oximeters, blood pressure cuffs, ECG monitors, and continuous glucose monitoring tools – are expected to be produced over the next four years, according to ABI Research, which follows global connectivity and emerging tech trends. Already, Apple, Google, and Samsung have signaled that they plan to produce RPM devices.

RPM devices, most often recommended by physicians and covered under HIPAA, are transitioning some health care activities away from the doctor’s office into people’s homes. By collecting data from a variety of devices and applications, and sharing it securely over the Internet, patients and physicians can be more closely connected in designing treatments, experts say. They also can provide even broader community benefits.

One such device is Propeller Health’s inhaler, which has built-in sensors, connects through Bluetooth to smartphones, and lets individuals respond to asthma attacks while also tracking where those attacks occur. Working with Propeller Health, the city of Louisville, Kentucky, is moving beyond the individual to the community to find asthma hotspots. Launched back in 2012, Louisville deployed a network of air sensors, along with giving away 500 inhalers, to map out areas that coincided with individual asthma attacks. The data was used to monitor air pollution and then devise treatment plans for local asthma sufferers.

The whiz-bang qualities of these devices are many, but they still suffer the fair-weather nature of consumers. Much like other once-popular tech gadgets, 3D glasses and PDAs among them, fitness trackers are plagued by the same problems as other smart devices: the short attention span of consumers. The NPD Group reports that 40 percent of activity-tracker owners stop using the devices within six months of purchasing them. That may account for forecasts that smartwatch sales could eventually overtake fitness tracker sales, as it is easier to remain loyal to a watch than to a monitor, the sole purpose of which is to remind consumers to keep their New Year’s resolutions.

The Internet of Things

Fitness-tracking devices live in a much larger world of technology than health care, one that technologists have described as The Internet of Things (IoT). The IoT is a place where devices are linked and communicate with each other, an amalgam of sensors, programs, and connectivity. It is a universe where physical objects, from coffee pots to furnaces to automobiles, come to life at their owners’ bidding. The FTC estimates that some 25 billion connected objects and devices will be online in 2015.

Last January, FTC Chair Edith Ramirez expressed concerns about the privacy risks posed by the IoT, and she encouraged the tech industry to address those concerns or risk losing the confidence of consumers and the full adoption of IoT’s promise. “IoT has the potential to provide enormous benefits for consumers, but it also has significant privacy and security implications,” warned Ramirez in her remarks at the 2015 Consumer Electronics Show, which has become an annual pilgrimage for tech geeks.

“Connected devices that provide increased convenience and improve health services are also collecting, transmitting, storing, and often sharing vast amounts of consumer data, some of it highly personal, thereby creating a number of privacy risks,” Ramirez added.

Attorneys believe that the three primary privacy challenges for the IoT, which includes health tracking devices, are the ubiquitous data collection that exposes a deep well of personal information; the potential for unexpected uses of consumer data by everyone, from employers to insurance companies, and the adverse consequences that could arise from those uses; and heightened security risks from hackers who may be tempted to commit larceny by the sheer volume of data.

“It’s inevitable that we move to an Internet of Things approach,” says Elliot Golding, counsel at Crowell & Moring LLP. “It’s hard to see how a washer talking to a refrigerator becomes an application that excites us, but there is a place where integrated and automated devices will improve the quality of life. But when you have all these devices talking to each other, the least secure device becomes the security level for all your devices.”

Given that reality, FTC’s Ramirez encourages companies to “bake” privacy into their devices or applications from the start. The strategy would be to push companies to build devices with privacy elements such as additional sets of passwords and encryption; to reduce the amount of data that devices collect and store; to make data as anonymous as possible; and to increase company transparency with additional consumer notices on devices – particularly if companies plan to share the data with third parties – and the ability to consent or not to data collection.

“In my mind, the question is not whether consumers should be given a say over unexpected uses of their data; rather, the question is how to provide simplified notice and choice,” Ramirez said.

Privacy of What?

Observers say that what constitutes health data these days changes as quickly as the technology that creates it, which makes it hard to figure out what to do with that data and whether it needs to be protected. After all, the number of steps a person takes daily isn’t the same data as one’s white blood cell count, or is it?

The answer to that question will be an important factor in deciding where to draw the line on privacy with newly generated information from fitness trackers, mobile apps, and smartwatches. It’s a question government regulators are already trying to answer. Industry is also wrestling with its desire to avoid tough privacy regulations while touting the health benefits of their applications.

Most people can agree that information collected about patients by health care providers – doctors, hospitals, or health clinics, to name a few – to guide medical treatment decisions and care qualifies as health data. And that information is and should be protected under HIPAA and HITECH, the Health Information Technology for Economic and Clinical Health Act, which was enacted to promote the adoption and use of health-information technologies. But can consumers really expect privacy when their tracker sends off their GPS coordinates at the same time as it shares their steps in the cloud?

The jury’s out on whether a person’s stair or step count could be included under HIPAA or state regulations governing health privacy or security breaches. Part of the problem for government and industry has been balancing the benefits of these gadgets with the myriad of ways user information is being collected and shared with third parties, such as advertising firms and app developers.

“In most cases, HIPAA is not going to apply to the devices or the information,” Crowell’s Golding says. “What rules are going to govern how we handle very sensitive information is an issue that we’ll need to carefully think about. How do you protect privacy and security in a smart way, both at the outset of creating a device and on an ongoing basis?”

Because privacy and security policies tend to be reactive, their use will likely depend on the evolution of how the public defines health information over the next few years. An individual’s heart rate or blood glucose levels certainly seem to qualify as health data, but are they exempt from health privacy regulations because people create that data on their smartphones? It is a muddle.

“There’s a huge debate right now about what to do with all this health care information that’s being gathered outside of the existing HIPAA regulatory structure,” says Kirk Nahra, a partner at Wiley Rein LLP. “There’s an increasing consensus that we do something and no consensus on what we do.

“Information we would normally think of as health information is getting collected and analyzed outside the normal hospital and doctor’s office settings,” Nahra adds. “It doesn’t necessarily mean the companies in this business are doing bad things with the data, but they could.”

At the moment, however, the majority of consumers seems largely disconnected from and unfazed by health privacy concerns. No horrendous breach of consumer-generated health data has captured the public’s attention. In fact, consumers are more likely to marvel at the cool devices or the space-age apps than be creeped out by the thought of some unseen data broker collecting their information and selling it.

Legal experts say the disconnect reflects a common pattern in public discussions about privacy over the last few decades, and especially during the Internet era. It is always an evolving process as society comes to better understand what are reasonable expectations of privacy for consumers, and how those match with the public’s interest in accessing these devices.

"I think people really do care about privacy, but they don’t really know what to do about it,” says De Mooy of the Center for Democracy &Technology. “The data sharing that’s happening isn’t visible to them. There’s a lot of backend to these technologies that people don’t know about. Companies need to be educated on how to be transparent, and people need to be educated on who they can and should trust.”

Expectations of privacy tend to evolve over time, and they are definitely being transformed with these new technologies, likely faster than the public knows. There are innumerable societal factors at play here because the devices serve multiple roles for many different people, and their expectations about the applications are countless.

Partly there is a generational divide, where Millennials may feel perfectly comfortable sharing health data while the stodgy Baby Boomers fear the specter of Big Brother over their shoulder. There’s also the reasoning of some that people who don’t have anything to hide can ignore the potential of privacy breaches. After all, they’re healthy, active, and trim, so what would it matter if an insurance company or their employer acquired their fitness records?

Partly the situation may be the result of ignorance. It is unclear whether people understand how their data is used and how it moves between fitness trackers to the Internet and beyond. For example, few consumers know that hidden deep within most privacy policies is a clause that allows companies to turn over data to the government for valid law enforcement queries and other legal requests.

Most consumers also feel somewhat protected by the privacy policy check-off boxes on registration pages, mobile apps, or desktop interfaces, even though those sign-offs are so breezily automatic these days it would be nearly impossible to find anyone who has scrolled down and read the entire policy before checking the agreement box.

Attorneys say privacy policies are useless in the face of nefarious hackers, which is why there is so much emphasis on building stronger hardware and software security functions into devices and the systems that govern them. Privacy policies only come into force when dealing with a company’s choices about collecting and sharing consumer data.

The marketplace for data is a fierce one, and data brokers buy information as quickly as it is created. They in turn sell it to any number of companies, from insurers looking to determine premiums or sell policies to employers doing background checks on new hires. Consumer expectations of privacy cannot keep pace with this kind of technology, experts say, and that could pose some real problems for health and fitness data generated by and about them.

“This is an area that is simultaneously extremely exciting and kind of scary,” Golding says. “In my view, wearables have the potential to be a truly disruptive technology that can help society and help people. Yet, there’s so much danger with them in dealing with the potentially sensitive information they create.”

Corporate Best Practices

Industry officials acknowledge the dangers of unrestricted disclosures of fitness and well-being information, but they fear that an aggressive approach by government to limit the collection and sharing of data could prove a wet blanket on innovation. It could thwart industry and consumers from realizing the benefits of the IoT, especially the potential of health-monitoring devices.

“One reason that we’re where we are with these new technologies is they’ve grown out of an open environment,” says Anna L. Spencer, a partner at Sidley Austin LLP. “I’m very hesitant to say and impose requirements on a technology that is nascent and that could really transform health care, which desperately needs transforming.”

While the FTC’s Ramirez appreciates the importance of keeping the door open for innovation to advance technology and the U.S. economy, she seems particularly unwilling to give the industry a fully open field in which to operate. “I question the notion that we must put sensitive consumer data at risk on the off chance a company might someday discover a valuable use for the information,” she noted.

Industry has responded in the past year by pressing for a corporate best-practices model in addressing privacy concerns, hoping to avoid the heavy hand of federal and state regulation. Corporations already have adopted policies that better communicate privacy information to consumers, that focus on more thoughtful approaches to the security architecture and data discipline, and that vow not to sell or share data with third parties. And app makers have begun to offer free and paid versions of apps where consumers can get more privacy restrictions if they want to pay for them.

The best-practices approach received its heartiest endorsement in September 2014, when Apple Chief Executive Officer Tim Cook wrote an open letter to consumers that effectively set the standard for corporate transparency on privacy, data collection, and data sharing. Cook’s letter – and Apple’s accompanying consumer privacy Web site – was a response to the hacking of iCloud accounts and complaints that Apple hadn’t done enough to protect customer data.

“Our business model is very straightforward: We sell great products,” Cook wrote. “We don’t build a profile based on your email content or web browsing habits to sell to advertisers. We don’t ‘monetize’ the information you store on your iPhone or in iCloud. And we don’t read your email or your messages to get information to market to you.”

Legal experts believe that corporations such as Apple, Microsoft, and dozens of other top-line technology companies are defining best practices with their very public privacy policies, and they believe it is the best way forward to guard consumer privacy while balancing the desire to pursue innovation.

“The leaders in the industry are going to look to the importance of their brand,” Kelley Drye’s Wolff says. “Consumers have impressions of brands, and they ask themselves whether they can trust a company. They recognize there are always going to be risks, but I think there is value in the consumer mind and the company mind in terms of offering a good product with robust consumer protections.”

Adopting a regulatory scheme that relies on industry best practices also has the advantage of timeliness. “Nobody wants technology at the speed of government,” ACT’s Reed says. “That is especially true here in the personal health information space. I think that industry best practices are going to be the first step for highlighting and clarifying for consumers what’s going on.”

While the FTC has provided some guidance for companies, outside groups are also stepping in to offer up sample privacy foundations. In August 2015, the Online Trust Alliance (OTA), a nonprofit think tank, issued a privacy and security framework that companies could adopt for IoT devices, although it initially focused on home automation and health-wearable technologies. The principles underlying the recommendations are transparency and data security, which are based on the Fair Information Practice Principles (FIPPs), the FTC’s widely accepted guidelines for privacy-focused data collection practices.

“Security and privacy by design must be a priority from the onset of product development and be addressed holistically,” the OTA noted in releasing the framework, which covers everything from consumer access to privacy policies to breach response and consumer notification plans. “It must be a forethought versus an afterthought, focusing on end-to-end security and privacy.”

A Role for Government

The push for a best-practices approach to privacy protections has won wide support within the industry, and even some privacy advocates say there are good reasons to give companies a chance to solve the most egregious problems with tighter internal controls over information. There is a general fear that an aggressive regulatory scheme is the last thing these technologies need to grow.

Yet, technological innovation is always going to force a conversation about what is reasonable expectation of privacy for consumers, especially in a fast-changing technological age, and that may be a question that is best resolved by government, some say. While personal-generated health information may not rise to the level of HIPAA, it is closely watched by government agencies, from the FTC to the U.S. Food and Drug Administration (FDA) to the U.S. Department of Health and Human Services (HHS) and its agencies to state regulatory bodies.

For some attorneys, the fuss about adding new privacy restrictions on device usage and information sharing is little more than window dressing. They believe there are enough statutes and regulations on the books today to successfully enforce privacy rights and protections in the United States.

“It’s not that there is a complete absence of law,” says Sidley’s Spencer. “Just because HIPAA doesn’t apply, that doesn’t mean it is a free-for-all. It’s not. There are restrictions such as enforcement of the FTC Act, which prohibits unfair and deceptive trade practices. The FTC has, through its enforcement, focused on privacy and ensuring companies comply with their privacy notices. There are a myriad of unfair and deceptive practice statutes that state attorneys general use all the time to fight businesses engaging in practices that harm consumers.”

Still, for some, the best solution is a government one. “If companies of fitness devices have the ability to sell personal health data to insurers, employers, and others, users should be alerted and given the opportunity to decline. The FTC should require fitness devices and app companies to adopt new privacy measures that will help conceal the identity of individuals and develop policies to protect consumer information in the event of a security breach,” said U.S. Senator Charles Schumer (D–N.Y.) in a written statement in August 2014.

Many observers believe the FTC does a pretty good job of using the tools at hand to monitor and enforce consumer privacy protections guarded by the FTC Act. It regularly brings legal actions against companies that violate privacy rights or fail to maintain security. And it frequently applies section 5 of the Act to ensure companies are not employing unfair and deceptive practices in their dealings. Even friends of the FTC say that its approach to regulation could be strengthened, as could its penalties, to send a more forceful message to tech companies about the importance of privacy.

In January 2015 the FDA issued a draft guidance paper, titled “General Wellness: Policy for Low Risk Devices,” noting that it doesn’t plan to regulate “low risk general wellness products” that are being described by retailers and manufacturers as “medical devices” under the Federal Food, Drug, and Cosmetic Act. Many expect the FDA, however, to keep an eye on the growth of these devices and their health claims.

Some have suggested that the privacy of new data being created could be addressed by expanding HIPAA to cover consumer-generated health and fitness information. It would have the benefit of not creating an entirely new statute, and it would stake out clearly the parameters of what “health data” means today.

“When we wrote the HIPAA rules, we defined the health care industry by law in a certain way that most accurately reflected it at the time. It has become less accurate over time,” Wiley Rein’s Nahra says. “You could change HIPAA to have it cover all health information regardless of where it’s coming from. Right now, it has to come from the right place for it to be health information and protected.”

HHS has already proven that it is open to changing what constitutes a covered entity under HIPAA. In January 2013 it issued new rules under HIPAA and HITECH that included “business associates,” or contractors or subcontractors for covered companies, to capture the increasing use of third-party cloud companies for storage of protected medical information. The same could be done for consumer-generated devices and their corporate developers.

Regulating the devices and applications more broadly would likely prove complex, however. Small changes in functionalities or how the product is offered can shift the regulatory location from the FTC to the FDA, and that can add to consumer confusion as to expectations of privacy. It can also be difficult for innovators who are trying to invent new devices but aren’t sure where to look for guidance on how best to protect consumers in the process.

“I think the FTC will have to decide for itself what it feels is the best way to convey to the commercial community what its regulatory expectations are and a way to communicate to consumers what their reasonable expectations of privacy can be,” McDermott’s Geetter says.

Meanwhile, there has been interest at the state level to adopt new regulations for health-tracking devices. Already, 47 states have separate data breach notification statutes, and California, Florida, and Texas have expanded their laws recently to widen the scope of information that qualifies as personal, such as medical history, treatment, or condition. In Texas, the Texas Medical Records Privacy Act covers any person who comes into possession of personal health data, and it bans the sale of that information without authorization.

Not surprisingly, industry leaders are loathe to face a medley of new state regulations governing the privacy of wearable devices and imposing new limits on how consumer-generated information can be shared. “The problem is when you end up with a patchwork of state regulation . . . you end up with harm to smaller, innovative companies that are trying to do something innovative in the market,” ACT’s Reed says.

The FTC dipped back into the public debate at its November 2015 workshop examining the privacy issues that arise with advertising and marketing, and the tracking of consumer activities across different devices. Some of the trouble stems from consumers who end up interacting with various platforms, applications, and software when using their smartphones and wearable devices.

“More consumers are connecting with the Internet in different ways, and industry has responded by coming up with additional tools to track their behavior,” said Jessica Rich, director of the FTC’s Bureau of Consumer Protection, in a statement. “With the advent of new tracking methods, though, it’s important to ensure that consumers’ privacy remains protected as businesses seek to target them across multiple devices.”

Privacy as Collateral Damage

Talk to most attorneys about the IoT or wearable devices, and there is a sense of inevitability that these remarkable technological devices will eventually fail in protecting consumer privacy and all this newly generated information. This brave, new world of technology is unforgiving when it comes to data because data is its currency.

“A few years ago, users of Internet services began to realize that when an online service is free, you’re not the customer,” wrote Cook in his famous letter last year. “You’re the product.”

Certainly, attorneys, privacy advocates, and government officials believe that best practices can go a long way toward protecting data. They all are reluctant to engage the full force of government on the problem because it will always come at a cost. Most likely the price will be paid in innovation, as privacy requirements limit the choices of designers and developers looking to create that next generation of application or device.

“Privacy protections are about choices; as you add privacy protections you, by definition, restrict how data is used and disclosed,” Geetter says. “Finding the right balance between what we want to do, who we want to share the data with, and how to protect it is the exciting challenge.

“We don’t know what we’re going to invent tomorrow,” Geetter adds. “We know we’re going to invent something. The challenge for our privacy regulation landscape is to try to accept that we need a model that can spring into action as innovation occurs. We cannot afford to develop a privacy and security framework that works only for today and is out of date tomorrow.”

All this effort by tech companies and government is designed to protect consumers, in part, from themselves. Everyone loves these new technological devices and the free tools found in applications. The public has grown accustomed to tools like Gmail and Yahoo arriving on their virtual doorstep for free. In fact, some would argue that it has made individual consumers particularly lazy in being advocates for their own privacy, and it has made it very easy to discard those hard-won protections.

Last year a Canadian court became one of the first courts worldwide to accept data from a Fitbit as evidence in a personal injury case. The plaintiff was injured five years ago, and once the case goes to trial, her lawyer plans to analyze the data from the Fitbit to prove her daily activity levels were below those of someone her age and profession. She was a personal trainer.

While it is certain fitness trackers will end up as part of litigation below the border, it is not clear whether they will help or hurt a case. A lack of standardization, users’ failure to wear, charge, or sync their devices, and the unreliability of logged activity, which could be generated with a wave of the hand, make wearable devices unreliable witnesses.

What’s important here, observers say, is not the reliability of the device to be used in court as much as consumers’ decisions to give up their privacy protections for convenience. Many individuals are more than willing to open up their lives for expediency in court, or in their workplace when offered bonuses or discounts from employers for wearing health trackers, or with life insurance companies that reduce premiums for customers who wear smart watches.

“Our longing for convenience means we’ve created a matrix that can and will be used against us,” wrote software analyst R. “Ray” Wang in his Harvard Business Review article, “Beware Trading Privacy for Convenience,” in June 2013. “Most of us just don’t know it yet.”

This article appeared in the December 2015 issue of Washington Lawyer, the official publication of the District of Columbia Bar, and is reprinted with permission.