Paul Unger is a lawyer, speaker, and author in the field of legal technology. He has lectured in the United States, Canada, and Australia. Contact Unger at punger@affinityconsulting.com.

If you get 150 emails, 50 messages, 20 telephone calls, 15 walk-in interruptions, 25 social media notifications, and 50 email or internet curiosity breaks, that totals 310 digital interruptions. Divide that into 480 workday minutes and you have an interruption every 1.5 minutes! 

A 2025 Microsoft study indicated the average American worker is interrupted every two to three minutes — 275 times a day — by meetings, emails, or chats during core work hours.¹ Researchers in a 2007 Microsoft study concluded that it takes about 15 minutes to return back to work following an electronic-based interruption.² 

If lawyers are interrupted every two minutes, and it takes 15 minutes to return back to work they were performing, it can feel almost impossible to get anything done during the workday. This is why you may look at your timesheet some days at 5 p.m. and see only two hours of billable time, but feel like you put in a 14-hour day. 

The reality is we live in an age of information overload. We are constantly connected to the world, from smartphones, social media, 24-hour news networks, tablets, and computers. Unfortunately, this constant information overload may worsen our attention span. 

Between document filing deadlines, meetings with clients, case law research, and other tasks, an interruption every couple of minutes could greatly hinder a lawyer’s ability to effectively practice law and serve their clients. 

One way lawyers can help overcome the inability to focus is by learning attention management skills. Here are five attention management tips you can implement today that are easy, practical, and will make a big impact on your ability to focus and practice law. 

1. Turn off ALL notifications 

Why would you want to give the world a hotline to your brain? Turn all notifications off, and I mean all of them. 

In Microsoft Outlook, email notifications can be turned off by navigating to “File” > “Options” > “Mail” and deselecting the four different methods of notifications when a new message arrives. On an iPhone, go to Settings > Notifications and turn off notifications by app. As a recent Microsoft article notes: “The inbox may still be the front door to work, but too often it opens to a flood of unprioritized chaos.”³ 

You can also schedule “Do Not Disturb” times on your phone and computer to limit the texts, calls, and other notifications you receive. 

2. Practice single-tasking 

Clear your desk and your multiple monitors of information that is not directly relevant to the project you are executing. 

For example, email creates distraction explosions every 30 seconds to five minutes. How can lawyers possibly focus if they see those explosions hit in their inboxes? You should always minimize your email platform on your monitor unless you are batch processing emails or planning upcoming tasks.

Just because you have two or three monitors doesn’t mean you need to have something displayed on them, especially if the information displayed derails your ability to focus on the task in front of you. 

3. Use the Pomodoro method 

Pomodoro is a technique that utilizes a 25-minute timer. You work on a single task, preferably deep-thought work, for 25 minutes and then take a break and do whatever you want for five minutes. In other words, work in intervals. 

The human brain functions well when maintaining attention to a single task for 25 minutes. After 25 minutes, studies show workers begin to lose focus. By giving yourself a five-minute break, you can return to deep-thought legal work for another 25 minutes easily. 

Once you get a little momentum going and are immersed in the project, it becomes a lot easier to make progress on the task at hand. 

This technique can make a huge impact on productivity and help combat procrastination. 

4. Tackle deep-thought work early in the day 

Dive into deep-thought work, writing, or projects in the morning. Our brains function better following quiet time or sleep. In addition, this is theoretically the time before other tasks pop up throughout the day that could derail your attention. This can be one of the most productive times of the day since there could be far fewer interruptions. 

5. Create rituals 

Rituals are small checklists or short rigid schedules designed to execute the same desired tasks during a set period of time. Rituals can help form positive habits and prevent you from taking email or internet curiosity breaks. They also remind us to do things we frequently forget. 

By adding rituals and checklists, lawyers can greatly enhance their ability to focus and do those things that seem to always fall off their radars. 

By implementing these five attention management tips, lawyers can take back control of their workdays, make progress on their to-do lists, and continue to serve their clients in a timely and ethical manner.

Endnotes
1 MICROSOFT, 2025 WORK TREND INDEX ANNUAL REPORT: 2025: THE YEAR THE FRONTIER FIRM IS BORN (April 2025), https://www.microsoft.com/en-us/worklab/work-trend-index/2025-the-year-the-frontier-firm-is-born.
2 Steve Lohr, Slow down, brave multitasker, and don’t read this in traffic, N.Y. Times (March 25, 2007), https://www.nytimes.com/2007/03/25/business/25multi.html.
3 Breaking down the infinite workday, MICROSOFT (June 17, 2025), https://www.microsoft.com/en-us/worklab/work-trend-index/breaking-down-infinite-workday.

William C. Martucci, who holds an LL.M. from Georgetown University in Washington, D.C., practices nationally in business and employment litigation. He focuses on complex class litigation, including wage and hour litigation, in California, Massachusetts, and New York, as well as business-to-business litigation, executive compensation disputes, business torts, and unfair competition. A nationally regarded trial lawyer, Martucci is often sought out for high-stakes jury work. His jury work has been featured in The National Law Journal.

Burcu Erbaz defends clients in business and employment litigation matters. She graduated first in her class at the University of Missouri-Kansas City School of Law, where she was on the editorial board of the UMKC Law Review. Erbaz also served as a judicial intern for Hon. Stephen R. Bough in the U.S. District Court for the Western District of Missouri, conducting legal research and drafting memoranda.

Minha Jutt represents clients in business litigation matters, including complex commercial disputes, restrictive covenants and trade secrets, and design and construction. Her experience extends to all stages of litigation, ranging from initial client counseling and fact investigation to dispositive motion practice to preparation for appeal. An honors graduate of the University of Kansas School of Law, where she served as the executive comments editor of the Kansas Law Review, Jutt clerked for Hon. Julie A. Robinson, U.S. District Court for the District of Kansas.

The integration of artificial intelligence into the legal profession has rapidly shifted from an experimental novelty to a foundational technological trend, representing in many respects a transformational shift comparable to earlier technological revolutions in the law practice. 

AI systems — especially generative AI tools such as large language models — are being adopted across law firms and courts to support key functions like legal research, drafting, document review, and administrative workflow automation. These technologies can process vast amounts of information and surface relevant statutes, precedents, and legal arguments more quickly than traditional manual methods, ultimately increasing efficiency and enabling legal professionals to prioritize strategic thinking over routine tasks. 

Missouri lawyers now routinely encounter AI in research platforms, document drafting tools, litigation analytics, and client-facing technologies. Used properly, these tools offer meaningful efficiencies, including faster access to information, assistance with initial drafting, and improved access to justice for self-represented litigants. Used improperly, however, generative AI poses serious ethical and professional risks. 

What distinguishes generative AI from earlier tools is not merely speed or convenience, but autonomy. Generative AI systems do not solely retrieve information; they generate content. That distinction is ethically significant. AI-generated outputs are statistical in nature and can produce inaccurate or misleading information, often referred to as “hallucinations.” These hallucinations are not rare anomalies; they are a known limitation of large language models.¹ 

These issues have already drawn judicial ire. As courts across the country have now documented, generative AI can fabricate case law, misstate holdings, and present false information in a manner that appears authoritative.² Several U.S. courts recently sanctioned lawyers for submitting briefs containing fabricated citations derived from unchecked AI output.³ 

Missouri’s ethical legal framework does not prohibit the use of AI. To the contrary, Missouri has long recognized that lawyers must adapt to technological change.⁴ Rule 4-1.1 of the Missouri Rules of Professional Conduct requires competent representation, and Comment [6] expressly includes a duty to stay abreast of “the benefits and risks associated with relevant technology.”⁵ Missouri Informal Opinion 2024-11, issued by the Office of Legal Ethics Counsel, confirms that generative AI is simply the latest technology subject to this longstanding principle.⁶ 

For Missouri lawyers, the ethical issue is not whether AI may be used, but how it may be used consistent with duties of competence, candor, confidentiality, and supervision.⁷ Missouri Informal Opinion 2024-11 properly frames generative AI as analogous to a nonlawyer assistant or external service provider: It’s a tool that may assist the lawyer, but it can never replace the lawyer’s independent judgment or responsibility for accuracy.⁸ 

Using AI in legal practice 

In various practices, perhaps one of the most widely advertised uses of AI is performing traditionally labor-intensive tasks in initial discovery, such as document review and e-discovery. Proponents of AI contend that AI-assisted tools can expedite labor-intensive tasks such as locating key documents, identifying key custodians, and summarizing documents. When performed accurately and thoroughly, these functions can streamline lawyers’ processes and save client expenditures on discovery — ultimately permitting lawyers to expend more time and client funds on more strategic and substantive phases of legal practice. 

Proponents of AI also contend that AI-assisted tools have the potential to streamline legal research by assisting lawyers in quickly locating on-point statutes and case law amidst vast databases. While the accuracy of these tools remains largely untested, they may develop into beneficial aids moving forward. 

AI platforms also have predictive analytic capabilities based on historical data. These capabilities can assess potential case outcomes and settlement ranges, as well as the possibility of the success of a motion based on district and judge-specific data. 

On the transactional side, AI-assisted tools can analyze dense legal terminology to spot inconsistencies, vague or unclear language, and potential risks and unfavorable terms. 

Ultimately, while these developing technologies may streamline and enhance the efficiency of various legal tasks, lawyers remain responsible for ensuring their use of AI complies with their professional obligations. 

Developing guidelines and case law: Missouri ethics and national enforcement trends 

Missouri’s ethics-first approach 

Missouri has addressed the use of AI primarily through ethical interpretation rather than prescriptive court rules. Informal Opinion 2024-11 provides a comprehensive road map for Missouri lawyers considering the use of generative AI.⁹ The opinion emphasizes several core principles:

• Competence (Rule 4-1.1): Lawyers must understand how generative AI works, what it can and cannot reliably do, and the risks associated with its use.¹⁰
• Confidentiality (Rule 4-1.6): Lawyers must evaluate whether AI platforms store, reuse, or expose client data and must make reasonable efforts to prevent unauthorized disclosure.¹¹
• Candor to the tribunal (Rule 4- 3.3): Lawyers may not submit false statements of fact or law, including fabricated citations or mischaracterized authority.¹²
• Supervision (Rules 4-5.1 and 4-5.3): AI output must be supervised just as work performed by nonlawyer assistants, vendors, or junior lawyers is supervised.¹³

The opinion is explicit that lawyers may not rely blindly on AI-generated content. Any work product generated with AI assistance must be independently reviewed and verified by the lawyer before it is used in representation.¹⁴ 

In parallel with these ethical guidelines, Missouri legislators have also proposed statutory guidance over the last couple of years, including in 2025 through HB 1462, the AI Non-Sentience and Responsibility Act.¹⁵ This bill, which did not pass the Missouri Legislature, attempted to codify key principles regarding the legal status and responsibilities associated with AI systems, including:

• Nonsentience: AI systems would have been declared nonsentient and could not hold legal personhood, personal relationships, or corporate roles.
• Human accountability: Owners, developers, and manufacturers would have remained legally responsible for AI outputs, including harm caused through intended or unintended use. Misuse by users would not transfer liability to the AI itself.
• Oversight and safety: Owners would have been required to maintain proper supervision and risk controls over AI systems, with liability for negligence or foreseeable harm. Developers and manufacturers would have to prioritize safety mechanisms and assess risks proactively.
• Piercing corporate veils: The statute made clear that corporate structures could not shield human actors from liability if AI-caused harm resulted from recklessness, negligence, or deceptive practices.

Together, the informal opinion and the proposed legislation reflect a dual approach in Missouri: The ethical guidance ensures lawyers remain competent and responsible in practice, while legislation could establish a clear legal framework assigning human responsibility and preventing AI from being treated as a legal actor. Both underscore that reliance on AI does not absolve lawyers or organizations from accountability. 

Missouri case law: Kruse v. Karlen 

Missouri courts have already enforced these principles. In Kruse v. Karlen, the Missouri Court of Appeals sanctioned a litigant for submitting an appellate brief containing fictitious AI-generated case citations.¹⁶ The court dismissed the appeal and imposed damages, emphasizing that citing nonexistent authority violates fundamental appellate obligations regardless of whether the error arose from AI use.¹⁷ 

Kruse is significant because it demonstrates that Missouri courts do not view AI misuse as a technical lapse, but as a serious breach of professional responsibility.¹⁸ The decision aligns squarely with Informal Opinion 2024-11’s insistence on verification and supervision.¹⁹ 

The federal approach and the push for certification 

Federal courts have likewise responded forcefully to AI-related misconduct. 

Missouri federal courts 

Some judges in the U.S. District Court for the Eastern District of Missouri have individualized standing orders emphasizing the proper use of AI. As an example, Rule 18 of U.S. District Judge Joshua M. Divine’s requirements provides: 

Mandatory Certification Regarding Generative Artificial Intelligence: All attorneys and pro se litigants appearing before the Court must file a certificate on the docket, together with their notice of appearance, attesting either that no portion of any filing will be drafted by generative artificial intelligence (such as ChatGPT, Harvey. AI, or Google Bard) or that any language drafted by generative artificial intelligence will be fully checked for accuracy by a human being, using print reporters or traditional legal databases.²⁰

In addition, the Eastern District of Missouri has issued guidance for self-represented litigants that prohibits filings drafted by any form of AI and emphasizes that litigants — including lawyers — are responsible for the contents of their filings, including portions generated with AI, under Federal Rule of Civil Procedure 11.²¹ 

Kansas federal courts 

Newly promulgated Standing Order 26-01 guides the use of artificial intelligence in preparing court filings in the U.S. District Court for the District of Kansas.²² The order cautions that AI tools may generate false statements of fact or law, including fabricated citations, and reminds litigants that they remain fully responsible for the accuracy of all filings submitted to the court. 

Lawyers and parties must review and verify any AI-assisted content — including legal authority, quotations, factual assertions, and legal analysis — before filing. The order further warns that failure to verify AI-generated material may result in sanctions, including the striking of filings, monetary penalties, referral to disciplinary authorities, disqualification of counsel, filing restrictions, or dismissal of claims. In addition, the court retains discretion to require parties to disclose the use of AI in filings and to certify that any AI-generated material has been personally reviewed and verified for accuracy. 

In a decision on Feb. 2, 2026, District Judge Julie A. Robinson sanctioned multiple lawyers for their improper use of generative AI without independently verifying the legal authority cited in their filings.²³ The court imposed monetary sanctions of $1,000-$5,000 after five lawyers signed briefs containing fabricated and misrepresented case law generated by an AI tool.²⁴ The court emphasized that the use of generative AI in legal practice is not inherently improper; rather, the violation arose from the lawyers’ failure to verify that the cited authorities actually existed and supported the propositions for which they were cited.²⁵ 

As the court explained, the duty to conduct a reasonable inquiry into the law is nondelegable under Federal Rule of Civil Procedure 11, and lawyers who sign filings certify that the legal authorities contained therein have been reviewed and verified through human judgment.²⁶ Robinson further stressed that reasonably competent lawyers should be aware of the well-publicized risks associated with unverified generative AI research, including the potential for hallucinated legal authority, and that reliance on such tools without verification falls short of the objective standard required by Rule 11.²⁷ 

In Moore v. City of Del City,²⁸ the 10th U.S. Circuit Court of Appeals dismissed an appeal as a sanction after a pro se litigant cited numerous fabricated cases that the court determined were generated by AI.²⁹ The court emphasized that failure to verify citations wastes judicial resources and undermines confidence in the legal system.³⁰ Importantly, the 10th Circuit imposed a prospective certification requirement, ordering the litigant to disclose future AI use and verify citation accuracy under penalty of perjury.³¹

While Missouri has not adopted a formal certification rule, a functional equivalent already exists. Every Missouri lawyer who signs a pleading or brief certifies — by signature — that the authority cited exists and supports the propositions asserted.³² The use of AI does not alter that obligation. 

National cases 

In Mata v. Avianca, Inc., lawyers relied on ChatGPT to draft a motion that cited six nonexistent judicial decisions.³³ The U.S. District Court for the Southern District of New York found that counsel failed to verify the AI-generated authorities before filing and imposed $5,000 in sanctions, while also ordering the lawyers to notify the judges whose names had been falsely attributed to fabricated opinions.³⁴ Widely regarded as the first major sanctions decision addressing generative AI in federal litigation, Mata established the now-frequently cited principle that the use of AI does not excuse violations of Rule 11.³⁵ 

More recently, in February 2026, the 5th U.S. Circuit Court of Appeals reaffirmed that traditional sanction rules adequately govern AI-related misconduct. In Fletcher v. Experian Information Solutions, Inc., the court observed that although generative AI represents a new technology, existing procedural rules already provide sufficient mechanisms to address inaccurate or fabricated legal citations.³⁶ The court emphasized that the same professional and procedural obligations apply regardless of whether legal research is performed by traditional means or assisted by AI.³⁷ 

Similarly, in Lifetime Well LLC v. Ibspot.com, the U.S. District Court for the Eastern District of Pennsylvania highlighted the supervisory responsibilities of lawyers when AI tools are used in preparing filings.³⁸ The court warned that a lack of diligence and supervision — particularly where less experienced lawyers rely on generative AI without adequate review — may lead to both monetary and nonmonetary sanctions when filings contain false or fabricated legal authority.³⁹ 

Together, these cases reinforce a consistent judicial message: While AI may assist with legal research and drafting, the responsibility for verifying legal authority and ensuring the accuracy of court filings remains squarely with the lawyer. 

The American Bar Association 

The American Bar Association issued formal ethical guidance on lawyers’ use of AI in ABA Formal Opinion 512 and through interpretations of the ABA Model Rules of Professional Conduct. These authorities do not prohibit the use of AI in legal practice but instead require that lawyers employ such tools in a manner consistent with their professional obligations. 

Formal Opinion 512 explains that existing ethical rules fully apply when lawyers use AI-assisted tools.⁴⁰ The duties of competence, confidentiality, supervision, candor to the tribunal, and reasonable fee practices remain the responsibility of the lawyer.⁴¹ Lawyers must independently review and verify AI-generated outputs before relying on them in legal work and must take care to avoid entering confidential client information into publicly accessible AI systems.⁴² 

The opinion further encourages law firms to implement internal policies and supervisory measures governing the use of AI.⁴³ In addition, lawyers must ensure that court filings contain verified legal authority and may need to disclose the use of AI to clients when it materially affects legal strategy, confidentiality, or costs.⁴⁴ 

In essence, once again, the responsibility for the final legal work product rests with the lawyer — not with the AI system — and lawyers remain accountable for verifying the accuracy and integrity of any AI-assisted work.

Judicial AI misuse 

A recent Bloomberg Law article reported that two federal judges issued erroneous rulings after chambers staff used generative AI tools without adequate review.⁴⁵ While these incidents sparked concern about judicial oversight, their relevance to Missouri lawyers lies elsewhere: They reinforce that accountability follows authority.⁴⁶ Just as judges remain responsible for opinions issued under their names, Missouri lawyers remain responsible for filings submitted under theirs. 

Considering AI in practice 

Proper training 

While AI-assisted tools continue to be developed, they are not infallible. Law firms should provide training to their lawyer and nonlawyer employees about the ethical and practical considerations to be made regarding the use of AI. Law firms should also establish clear policies regarding permissible uses of AI. 

Lawyers must familiarize themselves with the extent of the capabilities and limits of the AI-assisted tools. Just as law students and lawyers traditionally underwent training for Westlaw and LexisNexis, they should similarly undergo training for each AI-assisted tool they intend to deploy. A lawyer should be able to understand and articulate the mechanism an AI tool uses in its analysis, especially when that analysis influences an important strategic decision. 

Beyond attending vendor-led trainings, lawyers should independently explore and test AI-assisted tools to ensure they can fulfill their intended purposes. For example, a lawyer may ask an AI-assisted tool to review and summarize an email or contract the lawyer has already reviewed before deploying the tool more widely. 

Confidentiality

Lawyers must ensure that AI-assisted tools preserve the confidentiality of the information — both client confidentiality and any information marked as confidential through a protective order or similar mechanism. Under Missouri law, lawyers must make reasonable efforts to protect client information. In the context of AI, law firms and lawyers should ensure all AI systems used are “closed,” meaning the systems store information in protected databases. Law firms should consult with IT or cybersecurity professionals to assess risks associated with security, data privacy, and unauthorized data retention. Lawyers should review applicable terms of use for each platform to assess the risk of unauthorized disclosure. 

Lawyers should further advise their clients regarding the use, risks, and benefits of AI before obtaining informed consent from the client if necessary. 

Supervision 

All work products generated with AI assistance should be independently reviewed and verified by a lawyer before the work product is used in client matters. As numerous case law and anecdotal examples demonstrate, AI is not infallible. Lawyers should scrutinize all AI-generated work product for accuracy, bias, and thoroughness and correct any deficiencies. 

Over-reliance 

Lawyers should not over-rely on AI-assisted tools for tasks such as legal research, contract analysis, or predictive capabilities. Instead, lawyers should assess case needs, client goals, varying strategies, possible outcomes, and risks to make an informed decision regarding the best use of AI to supplement the lawyer’s own analysis rather than replace it. 

Looking ahead: Practical and ethical implications for Missouri lawyers 

Missouri is entering a phase of normalization of AI usage coupled with heightened accountability. AI will remain embedded in legal practice, but tolerance for careless or unsupervised use is rapidly disappearing. For Missouri practitioners, the road map is clear. 

First, courts are increasingly unwilling to accept ignorance, delegation, or automation as excuses for inaccurate filings. Therefore, verification must become routine. Missouri lawyers should assume courts will expect every citation, quotation, and legal proposition — whether AI-assisted or not — to be independently confirmed. This expectation is not merely aspirational, it is increasingly being enforced, and the risk of sanctions is real. As Kruse and Moore demonstrate, courts are expanding sanctions beyond monetary penalties and are willing to dismiss cases, strike filings, and impose prospective restrictions when AI misuse results in false authority or misrepresentations of the law. 

Second, law firms must address supervision explicitly. Verification obligations apply regardless of who uses the AI — lawyer, intern, nonlawyer assistant, or law clerk. Informal Opinion 2024-11 makes clear that partners and managers bear responsibility for ensuring that lawyers and nonlawyers understand appropriate AI use. 

Third, confidentiality analysis is essential. Missouri lawyers must scrutinize AI platform terms of service and data-handling practices, particularly where client information is involved. 

Finally, Missouri lawyers should resist the false choice between innovation and ethics. Banning AI outright is neither realistic nor desirable. The ethical path forward is informed, careful, and accountable use. 

Looking forward, Missouri courts may consider whether to formalize AI practices through standing orders, appellate rules, or administrative guidance, particularly as federal courts experiment with disclosure and certification requirements. Even absent such rules, Missouri’s existing Rules of Professional Conduct and Missouri Informal Opinion 2024-11 already supply a workable ethical framework: Educate yourself on the technology, safeguard confidentiality, supervise its use, verify its output, and never abdicate professional judgment. 

Generative AI does not change the lawyer’s role as gatekeeper, advocate, and officer of the court. It amplifies that role. It is a powerful tool that magnifies both competence and carelessness. For Missouri lawyers, the ethical question is not whether AI will be used, but whether it will be used in a way that preserves the competence, candor, and integrity of the profession.⁴⁷

Endnotes 
1 What are AI Hallucinations?, Google Cloud, https://cloud.google.com/discover/what-are-ai-hallucinations (last visited Dec. 30, 2025). 
2 Moore v. City of Del City, No. 25-6002, 2025 WL 3471341, at *2 (10th Cir. Dec. 3, 2025); see also Wadsworth v. Walmart Inc., 348 F.R.D. 489, 497 (D. Wyo. 2025) (“It is ... well-known in the legal community that AI resources generate fake cases.”). 
3 Daniel Wu, Lawyers Using AI Keep Citing Fake Cases in Court. Judges Aren’t Happy, WASH. POST (June 3, 2025), https://www.washingtonpost.com/nation/2025/06/03/attorneys-court-ai-hallucinations-judges/. 
4 MO. RULES OF PRO. CONDUCT R. 4-1.1 cmt. [6] (2025). 
5 Id.
6 MO. INFORMAL OP. 2024-11. 
7 MO. INFORMAL OP. 2024-11, supra note 4. 
8 Id. 
9 Id. 
10 Id.; MO. RULES OF PRO. CONDUCT R. 4-1.1. 
11 Id.; MO. RULES OF PRO. CONDUCT R. 4-1.6. 
12 Id.; MO. RULES OF PRO. CONDUCT R. 4-3.3. 
13 Id.; MO. RULES OF PRO. CONDUCT R. 4-5.1 and 4-5.3. 
14 MO. INFORMAL OP. 2024-11, supra note 4. 
15 AI Non-Sentience and Responsibility Act, H.B. 1462, 101st Gen. Assemb., Mo. (2025), available at https://legiscan.com/MO/text/HB1462/id/3141592 (last visited Mar. 16, 2026). 
16 Kruse v. Karlen, 692 S.W.3d 43, 49 (Mo. Ct. App. 2024), reh’g and/or transfer denied (Apr. 9, 2024). 
17 Id. at 53–54. 
18 Id.
19 MO. INFORMAL OP. 2024-11, supra note 4.
20 Requirements, Hon. Joshua M. Divine, U.S. Dist. Ct. for the E.D. Mo. (revised August 2025), available at https://www.moep.uscourts.gov/judge/joshua-m-divine. 
21 See Guidance for Self-Represented Litigants on the Use of Generative Artificial Intelligence (United States District Court for the Eastern District of Missouri), available at https://www. moed.uscourts.gov/self-represented-litigants-srl. 
22 U.S. Dist. Ct. for the Dist. of Kan., Standing Order No. 26-01 (2026), available at https://www.ksd.uscourts.gov/news/notice-proposed-amendment-local-rules-issuance-so-26-01-and-changes-form-protective-order (last visited Mar. 16, 2026). 
23 Doc. 218, Memorandum and Order, at 1, Overstock.com, Inc. v. Lexos Media IP, LLC, No. 2:22-cv-02324-JAR-ADM (D. Kan. Feb. 2, 2026).
24 Id. at 35–36. 
25 Id. at 20–21. 
26 Id. at 19–21. 
27 Id. at 26–28.
28 25-6002 (10th Cir. Dec. 03, 2025).
29 Moore, 2025 WL 3471341, at *3, supra note 5. 
30 Id. at *2.
31 Id. at *3.
32 MO. RULES OF PRO. CONDUCT R. 4-3.1.
33 Mata v. Avianca, Inc., 678 Fed. Supp. 3d 443, 451–52, 465–66 (S.D.N.Y. 2023). 
34 Id. 
35 Id. at 461–62 (explaining that fabricated authorities generated by AI cannot constitute "existing law” for purposes of Rule 11); see also Wadsworth v. Walmart Inc., 348 F.R.D. 489, 493 (D. Wyo. 2025) (sanctioning attorneys under Rule 11 for filing a motion that cited multiple nonexistent cases generated by AI). 
36 Fletcher v. Experian Info. Sols., Inc., No. 25-20086, 2026 WL 456842, at *3 (5th Cir. Feb. 18, 2026). 
37 Id. at *5–6. 
38 Lifetime Well, LLC v. Ibspot.com, Inc., No. 23-cv-02203, 2026 WL 195644, at *1 (E.D. Pa. Jan. 26, 2026). 
39 Id. at *4–5. 
40 See ABA Formal Op. 512 (2024). 
41 Id. at 2–4, 7–10 (2024). 
42 Id. at 5–6. 
43 Id. at 10. 
44 Id. at 7–9. 
45 Justin Henry, Judges Admit to Using AI After MadeUp Rulings Called Out, BLOOMBERG LAW (Oct. 23, 2025), https://news.bloomberglaw. com/business-and-practice/judges-called-out-for-nonfactual-rulings-admit-to-use-of-ai.
46 Stephen Gillers (Prof., NYU Law), quoted in Judges Admit to Using AI After MadeUp Rulings Called Out, BLOOMBERG LAW, supra note 47 (discussing the need for judges and lawyers to verify AI-generated citations); For additional insights regarding AI in this context of judicial engagement, see generally Anika Jaitley, Daniel W. Linna Jr., Hon. Xavier Rodriguez, V.S. Subrahmanian & Siyu Tao, Artificial Intelligence in Federal Courts: A Random-Sample Survey of Judges, 27 SEDONA CONF. J. __ (forthcoming 2026). 
47 See generally New York State Bar Association, Report and Recommendations of the New York State Bar Association Task Force on Artificial Intelligence (April 2024). “Among the many comments and insights offered in connection with the New York State Bar Association Task Force on Artificial Intelligence, the conclusion is instructive in the insights provided. This report offers no “conclusions.” As AI continues to evolve, so will the work of NYSBA and the groups tasked with ongoing monitoring. As a profession, lawyers and judges must continue to refine the initial guidelines suggested in this report and audit the efficacy of proposed rules and regulations. Legal professionals are encouraged to liken this journey to the mindset of ancient explorers: Be cautious, be curious, be vigilant, and be brave.”

Jeffrey Schoenberger is a senior consultant at Affinity Consulting Group LLC.

Artificial intelligence is everywhere. According to a Forbes Advisor survey, 97% of business owners believe tools like ChatGPT will help their businesses.¹ At the American Bar Association’s TECHSHOW in March, there were more than 15 sessions about AI.² And yet, lawyers continue to make headlines for citing cases that never existed — because an AI platform confidently made them up. 

That contrast tells us something important. AI is powerful, but it is not magical. Like any other tool in your firm, AI can help or hurt depending on how — and where — you use it.

The goal is not simply to “use AI,” but instead to leverage AI effectively in certain situations, with minimal risks and maximum results. 

Start with the right model 

Different AI tools generally serve different purposes, and many can outperform traditional search engines when you want an answer that synthesizes several sources. Below are five “general-purpose” AIs and how they may help your firm — without using them for legal research or analysis. 

• ChatGPT has become a household name and excels at more general inquiries like brainstorming, outlining, and producing first drafts.
• Claude tends to be more cautious, more structured, and better with long inputs. It is less “salesy” and more deliberate.
• Google Gemini has the advantage of access to Google’s ecosystem and your stored data.
• Microsoft Copilot shines inside Microsoft 365 — summarizing email threads, manipulating Excel data, and helping draft responses in Outlook or Word.
• Perplexity combines AI summaries with citations, which is helpful for market research, tech evaluations, and comparisons. 

These tools are not designed to do legal research or final-form legal writing. Treating AI platforms as substitutes for legal judgment is how lawyers could end up embarrassing themselves — and worse, explaining themselves to disciplinary authorities. 

The safest and most effective approach is simple: 

• Use AI for administrative work or for early drafts in areas where you are already knowledgeable.
• If you can confidently spot errors, omissions, or bad advice, you are in the right territory. 

Example 1: marketing 

Many lawyers know what they want to say but dread sitting down to write it. Marketing content, such as blog posts, newsletters, and social media, often stalls out at the blank page stage. 

That is where AI earns its keep. 

In this example, start by asking ChatGPT for ideas. The quality of the results depends on the prompt.

An OK prompt: “Give me ideas for social media posts for an estate planning firm.” 

A better prompt: “I am the owner of a solo estate planning firm. I primarily work with single mothers, and I am a single mother myself. I need ideas for blog posts aimed at single mothers who do not yet have an estate plan.” 

Specific context produces better output. Once you find an idea you like, ask ChatGPT for a draft. If the draft misses the mark, tell it why and ask for a rewrite. 

You will still need to edit and factcheck. But if writer’s block is your bottleneck, AI can get you moving. 

Rule of thumb: If something feels wrong, fix it. If you are unsure, verify it or remove it. 

Example 2: writing email responses 

Not every email requires legal analysis. Many require clarity, tone control, or a nudge toward action. 

For example, Copilot can help by drafting a response based on your instructions: “I need to follow up politely but firmly and ask the client to respond.” 

That differs from asking for legal advice. Used this way, Copilot may save time and reduce friction. 

This can work particularly well for re-engaging clients who have gone silent for months. Sometimes the hardest part is figuring out what to say and how to say it. AI can help you get over that hump. 

Example 3: drafting firm policies 

Policies are another area where AI can provide leverage without undue risk. 

For example, suppose you want to formalize a work-from-home policy. You already know the rules: 

• Two days remote per week
• Three days in the office, and
• Two weeks’ advance notice for planned remote days. 

Feed that information into ChatGPT and ask it to draft the policy. You will likely receive a surprisingly thorough draft covering objectives, eligibility, approval processes, communication expectations, equipment, security, and acknowledgments. 

Will it make assumptions? Yes. 

Will it include things you do not want? Probably. 

But reviewing and refining a draft is far easier than starting from scratch. It may also surface issues you had not considered. 

A critical rule: Always start fresh 

One final operational note that matters more than people realize: When you switch topics, start a new chat in the AI platform. 

Reusing an existing conversation confuses the model and degrades output quality. Treat each task as a clean slate. You will get better results faster and with less frustration. 

The takeaway 

AI is neither a silver bullet nor a ticking time bomb. It is a productivity tool — one that rewards clear thinking, good judgment, and appropriate boundaries. 

Start by using it where the stakes are low and your expertise is high. That is how you can transform your legal practice using AI without becoming an example in an ethics presentation.

Endnotes 
1 Katherine Haan and Rob Watts, How Businesses Are Using Artificial Intelligence, FORBES (April 24, 2023), https://www.forbes.com/advisor/business/ software/ai-in-business. 
2 American Bar Association, TECHSHOW, Chicago, Ill. (March 25-28, 2026), https://www. techshow.com.

Jeffrey S. Krause is a senior consultant at Affinity Consulting Group LLC.

There is a common misperception that solo and small firm lawyers cannot afford the same level of tech security as larger firms. While it is true that firms with larger budgets can afford a larger security infrastructure, it does not necessarily mean their security is better than what a smaller firm can obtain. 

More likely, a larger security infrastructure results from more employees, including those whose job it is to maintain security, and from being a more prominent target. Small firms can also implement robust security to protect their firms and clients. Smaller firms may have fewer weak spots to protect, but they need to know those weak spots and implement security to guard them. They might also find they already pay for the tools they need.

Here are some easy ways to greatly enhance your firm’s security going into 2026 while spending little-to-no money. 

Duty 

One thing is clear: All lawyers have a duty to protect their clients’ data. The Missouri Rules of Professional Conduct, Rule 4-1.6(c) states: “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of the client.”

Unless you want to argue about reasonableness, Rule 4-1.6(c) does not provide an exception for solo and small firm lawyers, giving them leeway due to firm size or budget. The duty is the same — you must take reasonable steps to protect client information. In doing so, you are also taking reasonable steps to protect business and personal information. 

Security weak spots 

High-profile security breaches are often reported as if a genius hacker cracked an elaborate system designed to prevent unauthorized access. While this occasionally happens, most security breaches are much less interesting. Users are careless with already-weak passwords that they may use on multiple sites. 

For example, an employee’s password to the firm’s Clio may be the same as their Netflix password, their Facebook login, and, most dangerously, that one sketchy website they visited four years ago. Affinity Consulting’s resource on password managers, located in the connect.MOBAR forms bank, can help you familiarize yourself with good password principles and password management programs. 

Some organizations do not require strong passwords or an additional layer of security if a password is compromised. Devices may be lost without the data being properly secured. In other words, solo and small firm data security is about protecting data from our own mistakes. 

Microsoft 365 

The good news is that you likely have the tools to provide sophisticated security to your clients and their data. Microsoft 365 is nearly ubiquitous among solo and small firms and provides many of the features needed to protect data. Microsoft 365 Business Standard costs $12.50 per user per month and provides almost everything you need. You might also consider Microsoft 365 Business Premium, which has additional features related to security, at $22 per user per month. 

Both the standard and premium plans include multi-factor authentication and an extensive list of security defaults. Both plans provide anti-spam, anti-malware, and anti-phishing features, and allow users to control access to SharePoint and OneDrive files. Correctly using these features provides a significant level of security.

The premium plan adds conditional access features, advanced anti-phishing, safe links and safe attachments, sensitivity labels, and data loss prevention services. You may decide the $9.50 per user per month is worth it to protect yourself from unforced errors. For example, the data loss prevention service notifies you when you attempt to share credit card numbers or content falling under HIPAA and may catch you from sharing that information in an insecure way. The service also provides a report of any information you shared. Proactive features like this help prevent errors, break bad sharing habits, and give you a list of information you have released “into the wild.” 

Passwords and multi-factor authentication 

An easy way to address security weak spots is to consider password strength. With any Microsoft 365 plan, you can set password policies. Interestingly, Microsoft’s guidance regarding passwords is different than what you may have heard previously. While it does caution against easy-to-guess passwords or passphrases, it does not state that longer is necessarily better, complex character requirements are necessary, or periodic resets serve a purpose. Instead, much of the guidance centers around multi-factor authentication. 

Most of us are familiar with MFA. It requires the user to provide two or more verification factors to gain access. For example, when a user attempts to log in from a new device or location, they enter their login and password as normal. If this information is correct, a message is sent to their phone. The message contains a code that must be entered before the user can proceed. 

Not only does Microsoft include MFA for Microsoft 365 components, MFA can also be configured to work with other applications via Azure AD (Active Directory). In addition to text message-based codes, many sites offer software-based codes, which can be stored and viewed in programs such as Microsoft Authenticator, Google Authenticator, or Twilio’s Authy. 

With MFA, compromised passwords cannot be used to gain full access unless the bad actor also possesses and is able to successfully log in to the device to which the message is sent. This is where device encryption comes in. 

Device encryption 

Encrypting your computers, laptops, tablets, and phones is another critical step in protecting data. If you enter a code to access your tablet or phone, you are already using encryption. Entering the wrong code too many times can lock or even erase the device. Good luck getting the MFA code from a locked phone. This simple encryption protects against a lost or stolen phone being used to compromise your data.

For computers and laptops, a little more work is required. For Windows Pro devices, turn on BitLocker to encrypt the device hard drive. It does not stop someone with the credentials from accessing the computer. However, a thief would have to know how to access the stolen laptop. If they do not know the credentials, they may attempt to remove the hard drive and access data that way. They cannot do this without the BitLocker code. A similar encryption tool, FileVault, is available for Mac users. 

Conclusion 

No security is bulletproof, and a short article cannot cover every aspect of security. However, Microsoft 365 and Windows, which most solo and small firms already use, offer powerful security features. Implementing just a few of them can fortify the most common weak points in your firm’s security. Combined with strong passwords, your security fortifications will rival most firms, irrespective of size.

Jeffrey S. Krause is a senior consultant at Affinity Consulting Group LLC.

Jeffrey R. Schoenberger is a senior consultant at Affinity Consulting Group LLC.

For lawyers, relationships are not just important — they are fundamental to success and longevity. While most of the business world uses customer relationship management software, the legal industry has been slow to adopt it, despite the undeniable importance of relationships in legal practice. 

This slow adoption represents a missed opportunity. CRM software can provide essential tools for lawyers to track important information about the people they meet and turn that information into mutually beneficial business relationships, helping foster strong, long-lasting connections. 

Keep track of facts 

You know the names of your client Sally’s spouse and children, her hobbies, favorite sports teams, and so on. Knowing that Sally’s spouse is Jim, she has a son, Thomas, in high school who plays volleyball, and she enjoys building ships in bottles has no bearing on legal work for her small business. But, of course, it’s courteous, it could be interesting — maybe you like ships in bottles, too — and it builds connections and rapport. 

For basic facts like these, you don’t need a heavyweight program. David Rockefeller, chief executive of Chase Manhattan Corporation, did it all with Rolodex cards.¹ 

Whether you use Apple or Google Contacts, Microsoft Outlook, or just a folder with text files in your default notes app, capture the relevant information in a way that makes sense to you. Complexity can hinder, especially if you value mobile access. 

In Apple Contacts, for example, in addition to name, phone, email, and address, it includes a “related name” field. Based on the example above, you could add two related names and relationships: “spouse” for Jim and “son” for Thomas. The related name field can hold whatever you like. Instead of just Thomas, you could write “Thomas (volleyball; middle blocker).” It’s just a text field. Outlook contains a similar feature. 

What about hobbies (ships in bottles), business wins, or other news Sally shares? You will find contact apps limiting. You could use a combination of the notes fields and a TextExpander snippet to keep a log of events, as one example. Suppose Sally said September was her business’s first month of $200,000-plus sales. You could open Contacts, click in the “note” section, type the date, and then type “first month of over $200,000 revenue.”

Whether it’s Apple Contacts, Outlook, or a cross-platform notes app, this system travels with you.

Use facts for business growth 

What the above-described system offers in simplicity, speed, and mobility, it sacrifices in flexibility, reporting, and automation. For example, to us humans, “court clerk,” “ct clerk,” and “clerk of courts” are the same person or office. Not to a computer. If you wanted to create an email list of everyone you noted talking to about an issue with the court clerk’s office, it’d be a mess to pull together because the data isn’t “sanitized.” You’re looking at a labor-intensive process to assemble an email list. 

Programs like Clio Grow, Lawmatics, and HubSpot provide organizational structure, reporting, and communications tools that humble contacts apps cannot match. Fullfledged CRM programs manage all stages of recruiting a new client or a new matter for an existing client. Suppose Sally wants to buy the building she currently rents for her business. You would create a new matter in Lawmatics (or an intake in Clio Grow) and add Sally as the contact. You can now track all interactions with Sally in persuading her to hire your firm to handle the commercial real estate purchase. 

CRM software tracks matter stages such as new lead, under review, engagement agreement, and retained. Each matter contains a calendar-centric timeline where you can add notes, schedule appointments, track emails, assign tasks, and send and receive documents. 

These capabilities may remind you of practice management software. While there are similarities, significant distinctions come in reporting and marketing tools. The more you use the CRM software, the more you can report on — for example, what percent of commercial real estate prospects greater than $500,000 become clients. Or how many inquiries resulted from an educational event you held at the community center. Or the average estimated value of clients who hire you versus those who do not. Where do you see the best return on your time? Does reporting show that Sally introduces you to lots of individuals who become clients? 

This is where CRM software shines. Lawyers traditionally market in one of two ways. One way is loud. They broadcast their name in any way they can, obtain a large number of leads, and hope that some are of sufficient quality. The other way is to quietly rely on word of mouth. Not as many leads come in, but they tend to be of higher quality. Unfortunately, neither of these methods are very targeted.

CRM software allows you to identify patterns you might miss and take advantage of them. If you market loudly, is your television ad working as well as your radio ad or your billboard? Which timeslot is working best? If you market quietly, what patterns can you identify in your best referral sources? Which sources are providing you with the best referrals? What patterns exist in those referrals and the work you do for them? This type of information lets you put your marketing dollars to work where they are most effective. 

Where practice management software focuses on handling matters for clients, CRM software focuses on the steps from prospect to signed client. In our example, once Sally agrees to representation on the purchase, a CRM tool like Lawmatics can send an engagement agreement template for her to electronically sign along with an option to pay any retainer. It can then transfer the collected information to practice management programs. 

Get started

For facts and mobility, start with either Apple Contacts or Google Contacts. Both support related names and notes. Google Contacts also supports user-defined fields. Each is accessible from the web. 

For a complete CRM solution, look for one that connects with your practice management system. A robust integration will save you time as you turn more tidbits into leads into clients.

Endnotes 
1 Joann S. Lublin, David Rockefeller’s Rolodex Was the Stuff of Legend. Here’s a First Peek. The Wall Street Journal (Dec. 5, 2017), www.wsj.com/articles/davidrockefellers-famous-rolodex-is-astonishing-heres-a-first-peek-1512494592.

Scott E. Vincent is the founding member of Vincent Law, LLC in Kansas City.

Labeled “Protect your clients, protect yourself,” this year’s annual campaign included forums and several news releases by the IRS.¹ 

The news releases focus on the concern that tax and legal professionals are prime targets of criminal syndicates that either trick or hack their way into professionals’ computer systems to access client data. Even when client data is stored in a secure platform, such as the cloud, lack of strong authentication can make information vulnerable. For example, in the tax system context, identity thieves use stolen data with real financial information to file fraudulent tax returns that are then difficult for the IRS and the states to detect. 

The IRS emphasizes tax and legal professionals need to focus on data security fundamentals and watch for emerging vulnerabilities, as well as new updates involving multi-factor authentication and the latest requirements for a Written Information Security Plan. The campaign highlights a series of actions that tax and legal professionals can take to better protect their clients and themselves from data theft. 

Create a security plan 

The Written Information Security Plan, or WISP, is an “easy-to-understand document developed by and for tax and industry professionals to keep customer and business information safe and secure.”² IRS Publication 5708 provides guidance and sample language for creating a WISP. The IRS also notes that the Federal Trade Commission requires a WISP to keep customer data safe. See IR-2024-208 for more details. 

Understand the different phishing scams 

Tax and legal professionals are “common, everyday target[s] of phishing scams designed to trick the recipient into disclosing personal information such as passwords, bank account numbers, credit card numbers, or Social Security numbers.”³ 

Phishing/Smishing 

“Phishing emails or SMS/texts (known as ‘smishing’) attempt to trick the recipient into clicking a suspicious link, filling out information, or downloading a malware file. Often phishing attempts are sent to multiple email addresses at a business or agency increasing the chance someone will fall for the trick.”⁴ 

Spear phishing 

In some phishing scams, potential scammers identify potential victims and deliver more realistic emails, commonly referred to as a “lure.” “These types of scams can be trickier to identify since they don’t occur in large numbers. They single out individuals, can be specialized, and make the email seem more legitimate.”⁵ 

For example, “fraudsters pretend to be real taxpayers [or clients] seeking tax [or legal] help. They use emails to try to get sensitive information or gain access to a practitioner’s client data. In these fake ‘new client’ schemes, the fraudster can send a malicious attachment or include a link to a site that the tax [or legal] professional thinks they need to access to obtain the supposed new client’s [… sensitive] information. But in reality, the site is collecting information from the [… professional], such as their email and password, or loading [malicious software] onto the [… professional’s] computer to gain access to their computer or system.”⁶ 

Clone phishing 

A newer type of phishing scam “clones a real email message and resends it to the original recipient pretending to be the original sender. The new message will have either an attachment that contains malware or [a] link that tries to steal information from the tax [or legal] professional or recipient.”⁷ 

Whaling 

“Whaling attacks are very similar to spear phishing, except these attacks are generally targeted to leaders or other executives with access to secure large amounts of information at an organization or business. Whaling attacks can also target people in payroll offices, human resource personnel, and financial offices.”⁸ 

Know the tell-tale signs of identity theft 

Many “professionals who report data theft to the IRS also say they were unaware of signs that a theft had already occurred.”⁹ Signs tax and legal professionals should watch for include “multiple clients suddenly receiving suspicious IRS letters requesting confirmation that they filed a tax return; tax professionals seeing e-file acknowledgements for far more tax returns than they filed; and tax pros’ computer cursors moving seemingly on their own.”¹⁰ See IR-2024-193 for more details. 

Utilize multi-factor authentication 

Lawyers and tax professionals should use multi-factor authentication, or MFA, to even better protect their clients’ information. The FTC even requires all tax professionals use MFA to protect clients’ sensitive information. “The June 2023 change mandates MFA to strengthen account security by requiring more than just a username and password to confirm an identity when accessing any system, application, or device.”¹¹ 

“The extra layers of different authentication factors include something only a user knows, like a username and password; something they have, like a token or random number sequence sent to their cell phone; or something unique, like biometric information. These provide extra assurance that a […] client, not an impostor, is gaining access.”¹² 

Understand the “Security Six” protections 

Here are six important security basics that form a critical defense against identity thieves and hackers: 

1. “Anti-virus software scans computer files or memory for certain patterns that may indicate there’s […] malware – on the device. Anti-virus vendors find new issues and update malware daily. This is why it’s important for users to install the latest updates of the software.”¹³ 

2. “Firewalls provide protection against outside attackers. The firewall shields computers and networks from malicious or unnecessary web traffic. This helps prevents malicious software from accessing the user’s system.”¹⁴ 

3. “Multi-factor authentication adds an extra layer of protection beyond a password. The returning user enters credentials like a username and password. Then, there’s another step, such as entering a security code, token or a biometric like a fingerprint.”¹⁵ 

4. “Backup software or services should be routinely used by tax [and legal professionals] to back up critical files on their computers and hard drives to external sources. This is helpful not just to protect against a cyber-attack but is also helpful in case of device failure or a natural disaster.”¹⁶ 

5. Drive encryption software, also known as disk encryption, “transforms data on the computer into protected files that are unreadable to outsiders. This means only people who are authorized to access the data can do so.”¹⁷ 

6. Virtual Private Network, or VPN, is important since many firms’ employees occasionally connect to unknown networks or work from home. “This allows for a more secure connection. A VPN provides a secure, encrypted tunnel to transmit data between a remote user over the internet and the company network.”¹⁸ 

Conclusion 

The “Protect your clients, protect yourself ” campaign highlights several important concerns for professionals relating to client and firm data security. Importantly, the current series also identifies some key federal requirements, including multi-factor authentication and 
implementation of a WISP, that may apply to your legal practice.

Endnotes 

1 Protect Your Clients; Protect Yourself — Summer 2024, INTERNAL REVENUE SERVICE (Aug. 27, 2024), https://www.irs.gov/tax-professionals/protect-your-clients-protect-yourself-summer-2024. 

2 IR-2024-180. 

3 Id. 

4 IR-2024-188. 

5 Id. 

6 IR-2024-183. 

7 Id. 

8 Id. 

9 IR-2024-180. 

10 Id. 

11 IR-2024-201. 

12 Id. 

13 IR-2024-218. 

14 Id. 

15 Id. 

16 Id. 

17 Id. 

18 Id. 

Lawyers and their firms interact with all manner of websites and services, and care that private information is safely managed. We also operate websites and services where consumers and our clients expect the same.

In this environment of ever-increasing data collection and aggregation and concomitant breaches, regulating bodies are starting to respond to consumer complaints and have begun to act. Your law firm’s website may soon be in their crosshairs, impacting your engagement and reach with current and potential clients.

Websites know no geographic boundaries, lawyers so regulations related to data collection affects lawyers in three ways:

1) what we disclose to website visitors about data-collection practices;

2) the ability of an individual to obtain a copy of that collected data; and

3) the ability of individuals to erase that data under limited circumstances. The most important of these is disclosure of data collection.

Data collection and cookies

Websites store information about visitors and track their interactions via tiny text files called “cookies.” Cookies are not inherently malicious and are often helpful. Amazon uses them so you can store contents in your shopping cart while continuing to click around. Cookies are also why you’re able to stay logged in to password-protected websites.

The privacy concerns with cookies arise from “tracking cookies” or “third-party tracking cookies.” These cookies “follow” you around the internet as you browse websites and build a more intimate and complete picture of you. Have you noticed how, when you search Google or Amazon for “Sonicare toothbrush,” you subsequently see electronic toothbrush ads on other websites you visit? You’ve experienced the power and reach of tracking cookies.

Go to wikihow.com/View-Cookies to learn how to review the cookies on your computer’s web browsers.

Requirements

To comply with the recent government regulations, websites must disclose their use of cookies. This is why, in visiting websites in the last couple of years, you’ve seen more and more “pop-up” disclosures regarding data collection and cookies.

What do you and your website need to do then?

- Your website must provide visitors with accurate and specific information about what every cookie your website uses does.

- You must obtain a website visitor’s consent before using any cookies beyond those necessary for essential website functions, such as allowing users to stay logged in as they bounce around and return to your website.

- Once the visitor consents, you must document and store that consent.

- Visitors must be able to access your site even if they reject certain types of nonessential cookies.

- Visitors must be able to withdraw or change their consent easily.

It’s entirely likely and reasonable that you don’t have the foggiest idea what cookies your website uses or what’s stored in those cookies on visitors’ computers. That’s OK. There are several websites that will examine your website for compliance and tell you where you are deficient. If you are responsible for your website’s backend, there are tools available for WordPress, Wix, and Squarespace.

If you have no idea what the preceding sentence means, there are plenty of companies willing to walk you through the process, such as OneTrust.

Missouri data disclosure laws

While Missouri has no laws specifically governing data disclosure, § 407.1500 RSMo. regulates consumer notifications of actual data breaches. The statue defines a breach as “unauthorized access to and unauthorized acquisition of personal information maintained in computerized form by a person that compromises the security, confidentiality, or integrity of the personal information.”

Personal information is an“individual's first name or first initial and last name plus one or more of the following:

- social security number,

- driver’s license number or other government identifying number,

- financial account numbers (in combination with a PIN or other access credentials),

- unique electronic identifier or routing code (in combination with a PIN or other access credentials),

- medical information, or

- health insurance information.

The statute provides two exceptions as to whether accessing such information qualifies as a breach. First, good faith access is not a breach. Second, a reportable breach occurs only if the accessed personal information is “not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable or unusable.” A breach of encrypted information need not be reported if the encryption key was not compromised.

Additionally, a breached party’s notification obligations may be tolled based on a law enforcement request (e.g., an ongoing investigation) or superseded by another law (e.g., HIPAA for healthcare organizations).

Notifications from the breached party to affected individuals must happen within 45 days of the breach’s discovery, which could be long after the breach’s occurrence. If the breach impacts more than 500 state residents, the business must notify the attorney general’s office.

Finally, the law provides a private right of action under which individuals may sue. Only those whose data was breached may sue for damages, and the Missouri Attorney General’s Office may also act.

For more resources about keeping your and your clients’ information safe, visit The Missouri Bar’s Law Practice Management Resource Center.

Jeffrey R. Schoenberger is a senior consultant at Affinity Consulting Group.

Therefore, you must educate yourself on proper social media usage to ensure that your private and professional lives do not conflict. 

Why are you on social media? 

As a first step, ask yourself, “Why do I use social media?” Do you use it to communicate with friends? To keep in contact with your children or other family members? Another reason? Perhaps you use social media to promote yourself or your business. 

Figuring out the “why” of social media for you helps you monitor your activity and allows you to use each individual platform appropriately. If you know why you use social media, then it is easier to determine how you should use it. 

One size doesn’t fit all 

Facebook, X (formerly Twitter), Snapchat, Instagram, LinkedIn, and the other platforms have distinct functions, customs, and expectations. Once you know why you use social media, you can better use the individual platforms. For example, you may want to communicate with distant family members on Facebook or show your Instagram followers a photo of yourself at an interesting location. Both activities would be inappropriate on LinkedIn, which is used to promote your professional self and business. 

Exactly which platforms you prefer to use for these purposes is up to you, but make sure you’re using the platform(s) appropriately. It can take time to learn the proper use for each, but that time is well spent. 

Understanding your digital presence 

It can be easy to forget that social media is not actually private. Something most social media platforms have in common is the ability for people to gather quite a bit of information about you from relatively basic searches, even if you have strict privacy settings on your accounts. Many platforms allow users to publicly display personal information – name, location, employment, interests, relationship status, family and friends, etc. – alongside public posts.

Besides being aware of what you post, you should also understand other outwardly visible activity on social media. For example, Facebook groups and followed accounts on Instagram all tell a story about you as an individual and, by extension, as a member of your organization. 

Know your social media presence and the impression it gives others about you – and your employer – when they search for your account. You want a positive portrayal on all social media platforms, especially considering your boss, coworkers, and current or potential clients may view your online interactions. 

Conduct self-audits 

Even if you believe your social media account(s) could not possibly upset another person, perform an occasional self-audit to ensure you are representing yourself well. Some platforms, such as LinkedIn, have ways to view your account as strangers would.

This is a helpful tool when analyzing your accounts from the perspective of others. 

You may only use social media to interact with friends and family but still keep communication clean and appropriate. You may only be directly communicating with someone you are close with but that communication could still be visible to, or passed along to, others. 

Conclusion 

You can only meet so many people in person, but you can connect with countless people digitally. Remember: The image you create of yourself digitally is visible to many more people (and for much longer) than in-person engagements. Make sure the version of you that others see online matches the version they meet in person.

Barron K. Henley
Barron K. Henley is a partner with Affinity Consulting Group.

If you were asked to list the number of logins and passwords that you have, you probably couldn’t do it. We try to use common words, kids’ names, or anniversaries, but every login we set up has different password requirements. Some prohibit you from using a password you have used in the past, a password that has any part of your name in it, and more. It makes creating and remembering passwords a real burden. However, it is a necessary burden. We rely now more than ever on subscriptions and services that require a login – for our own personal information, as well as our client information. To eliminate the stress of remembering it all or trying to write them all down somewhere, the answer is a password manager.

Why You Need a Password Manager

First, it’s a great place to store lots of key information. A good password manager allows you to share all that information – from simple things, like logins, to more critical things, like estate documents – with loved ones. Second, it’s a place to keep all your credentials and personal information in one place which you can access from any phone, tablet, or Mac/PC (provided you can authenticate yourself). All password managers will generate and store strong passwords so you don’t have to make them up. They can be long and complex; things you would never remember, much less invent. Password managers inform you if any of your passwords are weak and recommend that they be changed. Password managers can tell you how many different websites are using the same password (for security reasons, it’s not recommended that you use the same password for everything). Many also notify you if security breaches are reported for any of your accounts and recommend that you change those passwords.

The Features

Password managers come at a very small cost. And while some are free, we recommend paying for the tool – and getting all the features.

Two-Factor Authentication 
Protecting your password manager login with two-factor authentication is critical. Only requiring a simple username and password has made it easy for criminals to gain access to data that should be private – both your personal and client data. Two-factor authentication adds an extra layer of security because you must have your username, password, and some additional piece of information that only you will know (such as a code that is sent to your phone via text message by the password manager).

Fill Web Forms
Tired of filling out sign-up forms online? Have your password manager do the work for you! Not all products have this feature, but we recommend choosing one that offers it.

Identity
Another feature we like is the ability to have multiple “identities” in your password manager. Having a personal identity and a business identity is extremely convenient. Quickly being able to enter a work address and a business credit card on a registration form is a nice benefit.

Application Passwords
At the beginning of the article, we mentioned subscriptions and services – but you may very well have traditional software installed at your office that requires a login and password. Password managers can manage those, too – it’s not just for cloud-based logins.

Before password managers, many of us allowed Chrome, Edge, Safari, Firefox, or our browser of choice to “save” the login information for us. Having a password manager is a much safer way to do that, and it isn’t impacted when you get a new computer, clear out your cookies, or simply start using another browser. Even better, many password managers can import your saved logins from your browser.

Missouri Bar members have access to white pages and comparison sheets on password managers, two-factor authentication, and more. If you have questions, email a practice management expert or set up a no-cost consultation at MoBar.org/lpm.

Endnotes

1 Barron K. Henley is a partner with Affinity Consulting Group.

The American Bar Association recently released its 2021 Profile of the Profession, which compiles data the ABA collected from several surveys, most of which were conducted in 2020-2021. The report includes valuable information relating to the legal profession, including lawyer demographics and diversity, the COVID-19 pandemic and its impact on the practice of law, lawyers’ perspectives on retirement and the future, and more.

The report also includes interesting data about lawyers’ use of technology. Some of the most notable statistics from this year’s report provide insight into how lawyers use online legal resources, their cybersecurity efforts, and the hardware and software choices they make. No matter how you look at it, the data from the report offers evidence of an important lesson for lawyers: technology is no longer an option and instead is a pivotal component of a successful law practice.

Online legal resources

The legal research statistics from this year’s report are particularly interesting, in part because legal research was one of the first law firm processes to be impacted by technology. The transition to online legal research occurred decades ago, and since that time legal research efficiency has increased significantly. Despite the increased efficiency, according to the report, lawyers still spend a big chunk of their time – 18% of each workday – conducting legal research. For nearly a third of the lawyers surveyed, the starting point for most legal research projects is a free search engine such as Google. Another third (30%) turn to paid online search tools before conducting any other type of legal research.

Lawyers also obtain most of their daily legal news online from a variety of sources. Nearly half of lawyers surveyed shared that Law360 was their top legal news source (41%). Next was the Wall Street Journal (22%), followed by Bloomberg Law News at 8% and Bloomberg at 6%.

The online world has also made its mark when it comes to legal marketing. Gone are the days of relying solely on the Yellow Pages, park benches, billboards, and costly television ads for lawyer advertising. In 2021 – especially while we’re in the middle of a worldwide pandemic – the internet is where it’s at. According to the survey results, virtual and in-person event sponsorships were the top way that lawyers marketed their firms (48%), followed by three web-based marketing opportunities: LinkedIn (42%), email (41%), and Facebook (33%). Other less popular marketing methods included print (21%), Twitter (16%), and direct mail (14%).

Cybersecurity

In 2021, lawyers are more aware than ever of the importance of implementing strong cybersecurity measures. The reason for this newfound vigilance is due to the increase in cyberattacks in recent years. Notably, however, the increased focus on cybersecurity is paying off, and the lawyers surveyed reported lower numbers of viruses, spyware, and malware.

Specifically, 36% of lawyers shared that their law firms were affected by cyberattacks in 2020, down from 40% in 2018 and 43% in 2017. Law firms took several steps – including spam filters (81%), anti-spyware (76%), firewalls (74%), and popup blockers (72%) – to prevent such attacks.

Another noteworthy finding from the survey was that solo attorneys fared better than their larger firm counterparts when it came to cyberattacks. According to the report, only 19% of solos reported that they had experienced a breach, compared to 42% of lawyers from firms with 10-49 lawyers.

Hardware And software choices

Finally, let’s turn to the technologies lawyers used, starting with hardware. When it comes to smartphones, 79% of lawyers surveyed reported iPhones were their preferred smartphones. Android phones came in second at 18%, and the once-popular BlackBerry is used by only 1% of lawyers surveyed.

Lawyers also relied on mobile tools more, which wasn’t surprising given the increase in remote work due to the pandemic. According to the report, lawyers used their laptops significantly more in the past year; nearly half (47%) of lawyers reported that their laptops were their primary work computers, compared to 39% in 2017. In comparison, less than half (49%) of surveyed lawyers used desktops as their main work computers, compared to 60% in 2017. Finally, only 1% of lawyers used tablets as their primary computers.

Next up, let’s take a look at the legal software statistics. As part of the survey, lawyers were asked about the legal software available at law firms. Conflict checking software and case management or law practice management software were the top software surveyed lawyers used. Other types of software that lawyers reported their law firms offered were specialized practice software (37%) and rules-based calendaring software (38%).

Missouri Bar members receive discounted rates from top practice management solutions, including a 10% discount on MyCase. 

The Missouri Bar’s Manage a Practice section of its Practice Management site has everything you need to select a new laptop, move to a new practice management solution, and much more. Have legal technology or practice management questions? Members can schedule a no-cost, one-on-one consultation with the experts at Affinity Consulting Group. 

Reprinted with permission of MyCase. Originally published here.

Kevin Payne
Kevin Payne is a document management system consultant at Affinity Consulting Group and has a background in technology startups and client-facing roles. He believes technology’s role is to improve and streamline our clients’ lives, and he strives to do so from his hometown of Columbus, Ohio.

While the following situations might not always be the result of a dire virus, they can be signs of an infected computer and should be investigated.

Pop ups
To start, let’s talk about the most prevalent and recognizable sign: those pop ups. These can come from downloading seemingly benign programs or visiting a webpage that asks for more permissions than usual. While an ad for cheap medicine or singles in your area may seem harmless, that ad represents unwanted software on your computer that could be doing more than it lets on. If you’re seeing an influx of these ads, it would be wise to contact an outside technology expert.

New programs
Are you noticing strange programs or apps running in the background? If you’re seeing new software that you did not knowingly download, that’s a good sign your computer was infected and is now compromised. These programs can appear in many forms but are usually named something innocuous to escape notice. When shutting down your workstation for the day, if you notice a program or service that doesn’t close, that would be worthy of concern.

Slow performance
It can be frustrating when your computer starts performing sluggishly or is slow to react to requests. The cause? Background processes are busy with other tasks. If you’re not running an abundance of programs intentionally, slow speed may be a sign that somewhere along the way, your computer was infected and is now silently following the commands of a malicious program. This not only affects your daily workflow but can signify serious issues.

Memory issues
Your computer requires a certain amount of memory to run efficiently; a sudden spike in memory usage during daily tasks is another giveaway of an infected machine. Should you see this behavior, a simple check of your computer’s memory could save time and money down the road. This is also a good time to contact a tech pro, because even if it is not a virus, a slow computer can make the workday twice as long.

Error messages
Have you experienced sudden malfunctions in the programs you use every day? If you notice error messages appearing in a program that never had issues before, take note. These errors can also result in programs crashing or not responding, a major problem that can result in work loss.

Missing Files
Lost work? If the files you saved yesterday no longer appear today, you should absolutely inquire as to why. Malware can encrypt and rename files, as well as cause unexpected program failures that will result in the loss of your work and data. It is important to call attention to this immediately before more files go missing.

Browser Issues
A common sign of an infected machine is issues with your internet browser. Being redirected from your usual home page to another search engine you have never heard of should always give you pause. Any website that appears on its own should cause concern.

Emails
Sometimes, malware comes from a trusted source like your email. It might be disguised as a message from a prospective client or a harmless-looking attachment. While email filters are quite advanced, always err on the side of caution when it comes to suspicious messages. This is one of the more common methods of infection and should be something to keep an eye out for; when in doubt, reach out to your contact directly to confirm they did send an attached document. Also, avoid forwarding messages you suspect are harmful. Learn more about protecting your firm against cyber attacks, like phishing schemes, at news.mobar.org.

Hardware
One of the signs of malware can be detected in a decidedly low-tech way. If you can hear your computer’s fan or disc working overtime, it can be an indication it is working on something it shouldn’t be. The same goes for an overheating device. Ask a tech expert to take a look “under the hood.”

The Most Important Sign
The most important sign is simply that if somethings feels or looks wrong to you, it probably is. Malware comes in all shapes and sizes and there is always something more advanced around the corner. Some of these viruses don’t have any of the telltale signs listed above.

Being on the offensive is always the best defense. Missouri Bar members have access to white papers on antivirus and anti-malware software, law firm ransomware defense, two-factor authentication, and much more. Do you have questions about protecting your practice? Email them to a practice management expert or set up a no-cost consultation at mobar.org/LPM.

At The Missouri Bar’s Solo & Smal Firm Conference earlier this month, Mark Lanterman, chief technology officer at Minneapolis-based Computer Forensic Services, presented ways individuals can protect themselves against cyber attacks. 

The most common, and most successful, cyber attack is phishing – when someone sends a fraudulent email to trick another person into revealing sensitive information that the attacker can then use maliciously. Lanterman said he has seen “a significant increase in phishing attacks against lawyers,” particularly those with solo and small firms.  

“Don’t ever think, ‘Why would any hacker come after me? I’m just a small shop here,’” Lanterman said. “They don’t care. They don’t take the time to figure out if you’re big or small or medium. They cast a wide net, so be careful before you follow instructions you receive via email.” 

The best practices to avoid phishing schemes are to always be skeptical of the emails you receive and to confirm information via phone call before acting on email requests. A phishing email may contain a sense of urgency, poor spelling and grammar, and  fabricated email addresses. It may also ask you to download a document, click a link, or provide sensitive information – like passwords and credit card information. 

If a hacker does compromise your business and gain access to sensitive information, Lanterman said, do not pay the ransom the hacker requests. When individuals pay the ransoms, they are doing two things:  

1. They are identifying themselves as victims who are willing to pay ransoms, currently and in the future. 

“Once you pay, you don’t become best buddies with these guys,” Lanterman said. “They will come back because they know you have money and you’re willing to give it to them.” 

2. They are funding cyber terrorism. 

“This money will go toward paying coders to develop cyber weapons that will be used against you, your colleagues, your associates, corporations, the government,” Lanterman said. “These weapons, these cyber-attack tools, will be used against others and they will come back to be used against you.” 

Lanterman isn’t the only one encouraging companies to not pay the ransom. The U.S. Department of Treasury warned that if companies pay ransoms – which are commonly used to spur cyber terrorism – they may face sanctions for violating the Office of Foreign Assets Control’s regulations. 

If a company experiences a cyber threat, it should work with its information technology staff to recover from ransomware attacks. These types of cyber threats are in the news constantly, and IT staff should be prepared to recover from ransomware attacks, Lanterman said. 

Jason Cecil, chief technology officer with The Missouri Bar, recommended law firms hire outside consultants, if their budgets allow, and listen to the consultants’ recommendations. If law firms can’t afford to hire outside consultants, Cecil added, he recommended enabling multi-factor authentication on every account. 

“If the feature is available to you, turn it on and use it,” he said. “It is necessary in today’s world. If your password falls into the wrong hands, this is an additional layer of protection.” 

A couple of other options lawyers can use to protect their law firms include routinely changing their account passwords and contracting with companies that provide tools to educate staff about phishing scams.  

While these tips may seem obvious, and many individuals may think they would not fall for such schemes, Lanterman has seen hundreds of examples where regular employees have thrown their businesses into turmoil – all with one click of the mouse. Unfortunately, Lanterman added, these cyber threats will never stop since “they make criminals money.” 

Missouri Bar members have access to discounted services, including some to help protect businesses from cyber threats. Click here to review your member benefits. 

Lawyers have an ethical obligation to preserve client confidentiality. For that reason, the need to protect client information has always been a top priority for lawyers. This means that when lawyers and their staff work remotely – a practice that has become commonplace due to the pandemic – it’s all the more imperative for lawyers to ensure that confidential client data is protected when communicating electronically. 

Because so many lawyers and staff have worked remotely over the past year, law firms have increasingly relied on online communication and collaboration tools when interacting with clients. Of course, this newfound uptick in the use of electronic communication methods has impacted the ethical obligations that lawyers have when it comes to preserving client confidentiality. That’s why it’s important for law firm leaders to understand cybersecurity issues and how those problems may affect their displaced workforces, especially since lawyers and other law firm employees will likely continue working remotely and communicating electronically for many more months. The good news is law firms have solid options when it comes to secure online communication. 

Client portals: a more secure option than email 

Since the mid-1990s, lawyers have communicated with clients via electronic means, and for many years email was an accepted way to interact with clients electronically. However, because email is inherently unsecure and is like sending a hand-written postcard through the post office, it has begun to fall out of favor – both ethically and practically – as technology continues to improve. 

That’s why ethics committees and cybersecurity security experts have increasingly recommended methods other than unencrypted email when communicating and collaborating with clients online. For example, in 2017, the American Bar Association Committee on Professional Ethics concluded in ABA Opinion 477R that due to “cyber-threats and (the fact that) the proliferation of electronic communications devices have changed the landscape … it is not always reasonable to rely on the use of unencrypted email.” Instead, the committee recommended that for particularly sensitive matters, lawyers should consider using encrypted communications, including encrypted email and the encrypted client communication portals built into law practice management software. 

Florida issues secure communication guide 

Recently, The Florida Bar issued an updated secure communications guide that included recommendations relating to remote work during the pandemic. This comprehensive guide, “Best Practices for Professional Electronic Communication,”offers an in-depth overview of the issues that arise when lawyers communicate and collaborate with clients electronically. The types of electronic communications addressed in the guide include texting, email, social media, telephones and cellphones, laptops, and court appearances via videoconference. 

Email is easily hacked 

The authors of The Florida Bar’s communications guide focused on the technology issues that lawyers need to keep in mind when communicating with clients through unencrypted email. An important factor emphasized in the guide was the need for lawyers to understand the risks associated with using technology, including email. The authors emphasized how unsecure traditional email is and encouraged lawyers to find a more secure way of communicating with clients. 

As they explained, the reason for this recommendation is that email is easily hacked. That’s why, according to the authors, if the situation should arise where a lawyer must use email, it’s important to scan each and every email that is received and sent: “Attachments may contain malicious software code. Use scanning software for both outbound and inbound emails.” 

Emails can be easily intercepted 

The authors also addressed the likelihood of bad actors interfering when using email. They cautioned that because email is inherently unsecure, it can be easily intercepted. Fortunately, they explained, one way to mitigate that risk is to use an encrypted email service: “There is always a chance that your email may be intercepted. Many of these risks are mitigated if not entirely eradicated when using an encrypted email service.” 

Of course, email encryption technology often requires the assistance of an IT expert with the ability to set up this type of system – something that can oftentimes be a complex endeavor. Nevertheless, for some law firms, encrypted email can be a viable option. 

Client ports are a secure and easy-to-use form of communication 

The authors also turned to secure client portals. Due to the risks inherent in email, they recommended that lawyers consider using secure client portals like the ones built into law practice management software. They shared that client portals are a secure, safe, and easy-to-use alternative that is one of the best ways to ensure that confidential information is preserved whenever you communicate and collaborate online with clients: “Secure client portals are an emerging and safe alternative to email. There are many case and practice management systems that offer a client portal component. You should seriously consider this option as a method of communication for confidential information.” 

Missouri Bar members receive discounted rates from top practice management solutions including MyCase. To find the practice management solution that’s best for you, check out The Missouri Bar’s practice management features checklist, cloud-based practice management comparison chart and traditional practice management comparison chart. Need additional help selecting a practice management solution? Members can schedule a no-cost, one-on-one consultation with the experts at Affinity Consulting Group.  

Reprinted with permission of MyCase. 

Jennifer M. Ramovs
Jennifer M. Ramovs is the director of practice management at Affinity Consulting. At no cost, Missouri lawyers can email their practice management questions to an expert or schedule a one-on-one, remote consultation. Ramovs is available at

Whether a firm is the new kid on the block or a venerable institution, it is undeniably susceptible to a catastrophe that can appear with little notice while wielding devastating results. However, that is not to say firms are helpless to the powerful hands of the fates. With a handful of best practices, Missouri lawyers can protect their firms, teams, and clients from a disaster that might knock the proverbial wind out of a business, but most importantly, never render it irreparably harmed. If lawyers are diligent with their preparation and willing to embrace beneficial technologies and procedures, these simple tips can insulate them from the constant threat of disaster.

Get Organized

The first step in preparing for the unforeseen is to organize all files, including client files and employee documentation. This critical, initial step should encompass paper files as well as electronic data, making sure everything is concise and put into its proper place. Lawyers should use offsite, deep storage facilities whenever appropriate, as long as the facility has its own adopted procedures and mechanisms to mitigate the impact of a disaster.

Leverage Technology

Obviously, in this digitized world, data plays a critical role in nearly every aspect of a firm’s operations. As such, preserving the integrity of that data in the face of a natural disaster should be an ongoing priority for every firm. Continuing the previous step of getting organized, proper offsite storage of vital digital information must be adequately secured from both the forces of nature as well as human-based threat.

Any cloud-based data storage must be properly encrypted and secured to prevent highly sensitive information from slipping into the hands of the black hats of the world. Finding and maintaining such protocols should be mandatory for a firm’s IT department as a constant influx of case files, documentation, and client communication requires a continually fluid yet perpetually secure storage solution.

Neither courts nor clients will pause if a disaster strikes a firm, so it’s important to be prepared to seamlessly hit the ground running, no matter what catastrophes might come. Remember, locally based servers providing data backup can still make a firm susceptible to disaster if a regional calamity strikes a business, the storage provider, or the surrounding area.

Have a Preparedness Plan

Of course, in the event of a disaster, the immediate priority must be to protect staff from harm. Routinely practicing evacuation procedures makes certain all team members know precisely what to do in the event of an emergency. Regarding the office itself, lawyers should formalize a disaster plan with the office manager or equivalent, creating a list of all parties a firm might need to contact.

A preparedness plan should include insurance companies, vendors, property management, financial institutions, local first responders, and any contracted security providers or alarm systems. Firm leaders should also keep ongoing, detailed files of belongings – including office equipment, furniture, and anything else that would need to be replaced by an insurance carrier.

While it is impossible to completely shield a firm from the significant impact of disaster, even unforeseen and devastating events are not insurmountable with a bit of time, effort, and diligence. Most importantly, lawyers shouldn’t think disasters can’t or won’t strike their firms; staff, clients, and efforts are too important to underestimate nature’s indifference. Lawyers can check out The Missouri Bar’s Law Practice Management site at mobar.org/LPM for more resources to be prepared.

Endnote

1 Jennifer M. Ramovs is the director of practice management at Affinity Consulting. At no cost, Missouri lawyers can email their practice management questions to an expert or schedule a one-on-one, remote consultation. Ramovs is available at jramovs@affinityconsulting.com.

Kayla Kemp

Kayla Kemp is staff counsel at the Office of Chief Disciplinary Counsel.¹

Thankfully, there are an abundance of resources and technological solutions which can be utilized to facilitate practicing during a pandemic. As lawyers, we must be mindful to ensure that as we adapt, we must continue to meet our ethical duties under the Missouri Rules of Professional Conduct (“Rules”). 

Planning for Incapacitation During a Pandemic

Lawyers should be prepared to adapt to a rapidly changing environment, whether that be a natural disaster, pandemic, or some other act of God. Not only do we need to be prepared for abrupt changes to the ways in which we meet with clients or appear before courts, but we also need to be prepared for incapacity, more so now than ever before. Like the general population, our profession’s population is increasingly aging. According to the 2020 American Bar Association Profile of the Legal Profession, the median age of lawyers as of 2019 was 47.5 years old.² Nearly one in six lawyers are 65 or older.³ This is notable because the Center for Disease Control (CDC) warns the risk for severe illness with COVID-19 increases with age. Those who are 50-64 years of age are four times more likely to be hospitalized than the comparison group, which consisted of those 18-29 years old. The risk of death was 30 times higher for those 50-64 years old compared to the comparison group.⁴ Those figures increase with each following age group. Nonetheless, every lawyer must consider the possibility of becoming incapacitated with little to no notice.

Lawyers should ensure that, in the event of incapacity, they are comporting with ethical obligations. One way to ensure compliance is to have a succession plan in place. Rule 5.26 allows lawyers to take an important step in ensuring that representation is not disrupted by sudden incapacity. Now is a good time to consider designating a trustee pursuant to Rule 5.26, which allows a lawyer to choose someone who can take over the lawyer’s legal practice upon an unexpected absence. By selecting a trustee, you can involve that same trustee in your succession plan. By actively preparing for the possibility of incapacity, a lawyer can better facilitate a smooth transition in the event the unexpected occurred. Aside from designating a trustee, a plan should be developed for any event which may keep you out of your physical office. This plan should encompass how your usual means of communication will continue to be monitored. Someone will need to go to your physical office to check mail, voicemails, or faxes. Also, be sure to include clear instructions regarding receiving and retaining client records and property. For additional resources in succession planning, visit The Missouri Bar’s website, MoBar.org.⁵

Mental Health Concerns

The physical threat COVID-19 presents is not the only health risk. On Feb. 19, 2020, the American Lawyer released the results of its year-long “Mental Health and Substance Abuse Survey,” which found that 31.2% of the more than 3,800 respondents surveyed reported they were depressed. Additionally, 64% reported anxiety, 10.1% reported an alcohol problem, and 2.8% reported a drug problem.⁶ These findings predate the onset of the pandemic in the United States.

The CDC released findings noting that in June of 2020 the rates of depression and anxiety amongst adults in the United States were three to four times higher than the corresponding point in 2019.⁷ Approximately 40% of those surveyed reported struggling with mental health or substance abuse. According to the same study, rates of suicidal ideation, substance abuse, and alcohol consumption are steadily rising. Lawyers should familiarize themselves with the mental health and substance use resources available through The Missouri Bar.⁸ Depression and anxiety can result in lawyers neglecting their responsibilities and, therefore, harming their clients. Just as lawyers ought to be proactive in planning for physical incapacitation, lawyers should also be proactive in caring for their mental well-being. A lawyer who is grappling with these serious health issues needs to make every effort to seek help, such as through the Missouri Lawyers’ Assistance Program (MOLAP).⁹ Through MOLAP, all Missouri Bar members can speak with a licensed clinical social worker by calling 800-688-7859. The program is free and confidential.

Competence Amidst Chaos

The first obligation set forth in the Rules is that of competence. Rule 4-1.1 – Competence – Comment [6] dictates “[t]o maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology ... .”

Keeping abreast of changes to the practice of law necessities brings an awareness of the risks associated with working remotely. Despite the challenges presented during the current pandemic, lawyers have the duty to remain competent. Comment [3] to Rule 4-1.1 provides guidance on a lawyer’s ethical obligation during such a situation as a global pandemic:

In an emergency a lawyer may give advice or assistance in a matter in which the lawyer does not have the skill ordinarily required where referral to or consultation or association with another lawyer would be impractical. Even in an emergency, however, assistance should be limited to that reasonably necessary in the circumstances, for ill-considered action under emergency conditions can jeopardize the client’s interest.

In the event of an emergency, a lawyer may give advice in a matter the lawyer does not possess the skill ordinarily needed to provide such advice. Of course, advising without the necessary skill is only acceptable where referral or consultation with another lawyer is impractical.

Lawyers must continue to educate themselves on technological innovations which can be utilized to virtually serve their clients. Also, lawyers need to stay current on any legal changes that allow them to continue to meet clients’ needs to enter into contracts, update wills, or create personal health care directives.

Remote Notarization

On April 6, 2020, Gov. Mike Parson issued Executive Order 20-08 suspending a statutory requirement that a notary public must conduct such notarization of official documents while the signer personally appears. Executive Order 20-08 was set to expire June 15, 2020; then, Executive Order 20-12 extended remote notarization to Aug. 28, 2020. Subsequently, Executive Order 20-14 and Executive Order 20-19 extended remote notarizations until March 31, 2021.

The practice of remote notarization provides a secure and safe method to execute legal documents. Notarization can occur while utilizing audio-video technology, provided certain conditions are met: 

(1) If the signatory is not personally or otherwise known to the notary, the signatory must display a valid photo ID to the notary during the video conference;

(2) The signatory must affirmatively represent that they are physically situated in the State of Missouri, and the notary must be physically located in the State of Missouri and say in which county they are physically located for the jurisdiction on the notarial certificate;

(3) The video conference must be a live and interactive audio-visual communication between the signatory, notary, and any other necessary persons to allow for direct interaction at the time of signing;

(4) The notary must record in their journal the exact time and software used to perform the notarial act, along with all other required information; and

(5) The document must contain a notarial certificate, a jurat, or acknowledgement, which states that the signatory appeared remotely pursuant to Executive Order 20-14.

Electronic Notarization

While Missouri already permits electronic notarization, which is the use of electronic signatures and seals, Executive Order 20-14 allows for remote and electronic notarization to occur together when:

(1) The notary public is registered as an electronic notary public with the Missouri Secretary of State;

(2) The document must be electronically signed with a software approved by the Missouri Secretary of State; and

(3) The notary must affix the electronic notary seal to the electronic document.

Lawyers should do their due diligence and check with the Missouri Secretary of State to confirm they are using a registered remote notary¹⁰ and the software used to electronically sign the document¹¹ is approved.

Cyber Security

While there are many benefits to utilizing technology to facilitate legal services, there are also risks. For example, Zoom – a platform used to facilitate virtual audio and visual meetings – has had security breaches. In July 2019, a vulnerability in Zoom’s Macintosh desktop client was found which let malicious websites turn on a Macintosh user’s webcam without that user’s knowledge.¹² Then, in January 2020, another vulnerability was discovered. Unauthorized users could enter Zoom meetings that were not password protected and did not have Zoom’s Waiting Room feature – which allows for manual admission into Zoom meetings – enabled. Security flaws such as these are not unique to Zoom. Consequently, when utilizing third-party platforms, lawyers ought to take precautions such as using updated software and taking reasonable security measures.

Rule 4-1.6(c) specifies “[a] lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information of the client.” Comment [15] details the factors to be considered in determining whether a lawyer acted completely by undertaking reasonable efforts to prevent inadvertent or unauthorized disclosure of information related to client representation. The ABA’s Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 477R, “Securing Communication of Protected Client Information,” which provides guidance as to security measures that should be employed given the ever-increasing cybersecurity threats that exist when transmitting information over the internet:¹³

However, cyber-threats and the proliferation of electronic communications devices have changed the landscape and it is not always reasonable to rely on the use of unencrypted email. For example, electronic communication through certain mobile applications or on message boards or via unsecured networks may lack the basic expectation of privacy afforded to email communications.¹⁴

While cyber security was a matter of grave concern in 2017, the threat of harm has only increased.¹⁵ In 2019, there were more than 5,000 data breaches reported.¹⁶ These breaches amounted to approximately 8 billion exposed records. Educating yourself on the various types of cyberattacks which can leave your client-confidential information vulnerable is the first step.¹⁷

Third-party Service Providers

For those lawyers whose devices are managed by a third party, include explicit terms in your contracts detailing which security practices are to be followed. These security features can include audits that report security status and the health of your devices. The National Institute for Standards and Technology and the Institute for Standards Organization provide best practices for guidance on how to strengthen your network’s defenses. Lawyers should consider including clauses in their contracts which detail how third parties will secure remote access. Methods to help secure remote access to your network include VPNs, multi-factor authentication, and rotating strong passwords. After all, Comment [1] to Rule 4-5.3 – Responsibilities Regarding Nonlawyer Assistants requires lawyers with managerial authority make reasonable assurances that the nonlawyers in the firm and those who work outside the firm act in a way compatible with the ethical obligations of the lawyer.

As technology evolves, so does our obligation to act reasonably under the Rules of Professional Conduct. And as we adapt, we must consider what further efforts we can take to meet our ethical duties. The current global pandemic has shifted our way of life, both at work and at home. It is important for every lawyer to understand the resources available to help alleviate the burden they may feel.

Endnotes

1 Kayla Kemp is staff counsel at the Office of Chief Disciplinary Counsel. Special thanks to Melinda J. Bentley, legal ethics counsel, whose presentation, “Ethical Considerations for Missouri Lawyers Practicing During the COVID-19 Pandemic: A Conversation with the Chief Disciplinary Counsel & Ethics Counsel,” was invaluable.

2 Am. Bar Ass’n, 2020 American Bar Association Profile of the Legal Profession (2020), https://www.americanbar.org/news/reporter_resources/profile-of-profession/.

3 Am. Bar Ass’n, 2020 American Bar Association Profile of the Legal Profession (2020), https://www.americanbar.org/news/reporter_resources/profile-of-profession/.

4 Centers for Disease Control and Prevention, COVID-19: Older Adults (2020), https://www.cdc.gov/coronavirus/2019-ncov/need-extra-precautions/older-adults.html.

5 The Missouri Bar, Planning Ahead: A Guide to Protect Your Clients’ and You Survivors’ Interests in the Event of Your Disability of Death (2005).

6 Lizzy McLellan, Lawyers Reveal True Depth of Mental Health Struggles, Law.com (Feb. 19, 2020, 11:00 AM), https://www.law.com/2020/02/19/lawyers-reveal-true-depth-of-the-mental-health-struggles/.

7 Czeisler MÉ et al., Mental Health, Substance Use, and Suicidal Ideation During the COVID-19 Pandemic – United States, June 24–30, 2020, MMWR Morb. Mortal Wkly. Rep. 2020;69:1049-1057 (2020). 

8 Coronavirus Resource Center for Lawyers, https://mobar.org/site/content/Lawyer-Resources/Coronavirus_Resource_Center_for_Lawyers.aspx?WebsiteKey=dd54fe1d-87c8-4d7e-9547-e59fcd729541 (last visited Jan. 11, 2021).

9 Missouri Lawyers’ Assistance Program, https://mobar.org/molap/ (last visited Jan. 11, 2021).

10 Registered Electronic Notaries, https://www.sos.mo.gov/RegisteredElectronicNotary (last visited Jan. 11, 2021).

11 Approved Notary Software Vendors, https://s1.sos.mo.gov/Business/Notary/softwarevendors (last visited Jan. 11, 2021).

12 Jonathan Leitschuh, Zoom Zero Day: 4+ Million Webcams & Maybe an RCE? Just Get Them to Your Website!, Medium.com (July 8, 2019), https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5.

13 ABA Committee on Ethics & Pro. Resp., Formal Op. 477R (2017).

14 Id. at pg. 5.

15 Microsoft Digital Defense Report, September 2020, https://www.microsoft.com/en-us/security/business/security-intelligence-report (last visited Jan. 11, 2021).

16 Rae Hodge, 2019 Data Breach Hall of Shame, cnet.com (Dec. 27, 2019, 4:00 AM), https://www.cnet.com/news/2019-data-breach-hall-of-shame-these-were-the-biggest-data-breaches-of-the-year/.

17 See Melinda J. Bentley, Ethics: The Ethical Implications of Technology in Your Law Practice: Understanding the Rules of Professional Conduct Can Prevent Potential Problems, 76 J.MoBar (2020).

Melinda J. Bentley

Melinda J. Bentley is Legal Ethics Counsel for the Advisory Committee of the Supreme Court of Missouri.

How do you become competent in making those selections and using those technologies? What if there is a loss of a device or data? How do you train your staff? While the Rules of Professional Conduct (Rules) cannot tell you what to buy, fortunately, they do give you clear standards, and further guidance is provided through the Comments to the Rules to assist you with implementing and using technology devices and systems in your practice.² Further, by having a keen understanding of the Rules and Comments, you, as a lawyer, can be proactive in both preventing potential problems and being able to respond efficiently and ethically if a difficulty, large or small, occurs.

Key Ethics Rules: Building A Framework of Understanding

Three key ethics obligations are at the forefront of establishing a lawyer’s understanding in order to prevent potential technology problems: competence, confidentiality, and responsibilities regarding nonlawyer assistants.

Rule 4-1.1 – Competence

The first key ethics obligation underlying a lawyer’s use of technology is found in Rule 4-1.1, which states that “[a] lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.” Further, Comment [6] provides that “[t]o maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education, and comply with all continuing legal education requirements to which the lawyer is subject.” (emphasis added.)

Rule 4-1.6 – Confidentiality of Information

The second key ethics obligation underlying a lawyer’s use of technology is found in Rule 4-1.6(a), which generally prohibits a lawyer from revealing information relating to the representation of a client unless an exception is met. In 2017, the Supreme Court of Missouri adopted an additional requirement for lawyers in Rule 4-1.6(c) that “[a] lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of the client.” Such disclosure or access to confidential client information not only applies to physical information, such as paper documents in a client file, but also to electronically stored information. Think of the large amount of confidential client information lawyers have electronically. That electronic confidential client information makes lawyers’ duty of technology competence under Rule 4-1.1 that much more critical.

Reasonable Efforts on Unauthorized Access and Inadvertent or Unauthorized Disclosure. What constitutes reasonable efforts by a lawyer to safeguard confidential client information to prevent inadvertent or unauthorized disclosure, or unauthorized access? Comment [15] provides guidance to Rule 4-1.6(c) that lawyers are required to act competently regarding safeguarding this information. First, Comment [15] specifically creates three categories of safeguarding information from: (1) unauthorized access by third parties; (2) inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client; (3) and/or inadvertent or unauthorized disclosure by those who are subject to the lawyer’s supervision. When describing these categories, Comment [15] references Rules 4-1.1 (Competence), 4-5.1 (Responsibilities of Partners, Managers, and Supervisory Lawyers), and 4-5.3 (Responsibilities Regarding Nonlawyer Assistants).

Second, Comment [15] provides factors to consider in determining the reasonableness of the lawyer’s efforts, including but not limited to:

the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use).

Comment [15] notes that there is no violation of Rule 4-1.6(c) “if the lawyer has made reasonable efforts to prevent the access or disclosure.”³

Additionally, Comment [15] provides guidance that the client may require the lawyer to implement special security measures that are not required by Rule 4-1.6, but it also notes that a client may give informed consent to forgo otherwise required security measures under Rule 4-1.6. “Informed consent,” as defined in Rule 4-1.0(e), requires communication of “adequate information and explanation about the material risks of and reasonably available alternatives to the proposed course of conduct.” Per Rule 4-1.0(e), guided by Comment [6], informed consent in this context means discussing the material advantages and disadvantages of forgoing security measures, discussing available options and alternatives, and possibly advising the client to seek other counsel on this decision. Factors as to reasonableness will depend on the experience of the client or if the client is independently represented by counsel.⁴

Further, Comment [15] references that it is beyond the scope of the Rules to determine if state or federal data privacy laws require additional safeguards over client confidential information, or notification in the event of a loss of electronic information or unauthorized access to such information.

Finally, Comment [15] advises lawyers to consult Rule 4-5.3 (Responsibilities Regarding Nonlawyer Assistants) and its Comments [3] and [4] regarding supervision of nonlawyer assistants outside the firm.

Reasonable Precautions in Transmission. Comment [16] to Rule 4-1.6 notes that a “lawyer must take reasonable precautions to prevent … information [relating to the representation of a client] from coming into the hands of unintended recipients.” In offering guidance on this responsibility, Comment [16] provides two factors to consider when determining if the lawyer can have a reasonable expectation of confidentiality: first, the “sensitivity of the information,” and second, “the extent to which the privacy of the communication is protected by law or by a confidentiality agreement.”

Comment [16] provides that no special security measures are required “if the method of communication affords a reasonable expectation of privacy.”⁵ Just as with the considerations previously discussed in Comment [15], Comment [16] provides guidance that the client may require the lawyer to implement special security measures that are not required by Rule 4-1.6, but it also notes that a client may give informed consent to forgo otherwise required security measures under Rule 4-1.6. Further, a lawyer may be required to take additional steps to comply with other law, but that is an issue beyond the scope of the Rules.

Rule 4-5.3 – Responsibilities Regarding Nonlawyer Assistants

The third key ethics obligation underling a lawyer’s use of technology is found in Rule 4-5.3, which applies to a lawyer’s responsibilities for the conduct of nonlawyers who are “retained by or associated with a lawyer.” Rule 4-5.3(a) sets the requirements for firm-wide measures to ensure that partners or lawyers with comparable managerial authority make reasonable efforts to make sure the firm has measures in place to give reasonable assurance that the nonlawyer assistant’s conduct is compatible with the professional obligations of the lawyer. Similarly, Rule 4-5.3(b) requires a lawyer with direct supervisory responsibility to make reasonable efforts to make sure the nonlawyer assistant’s conduct is compatible with the professional obligations of the lawyer. Per Rule 4-5.3(c), lawyers are responsible for the conduct of nonlawyer assistants who they employ, retain, or associate with if the conduct of the nonlawyer assistant would be a violation of the Rules of Professional Conduct if engaged in by the lawyer and if one of two scenarios is present:

(1) the lawyer orders or, with the knowledge of the specific conduct, ratifies the conduct involved; or

(2) the lawyer is a partner, or has comparable managerial authority in the law firm in which the person is employed, or has direct supervisory authority over the person and knows of the conduct at a time when its consequences can be avoided or mitigated but fails to take reasonable remedial action.

Comment [2] to Rule 4-5.3 provides guidance on supervising the conduct of nonlawyer assistants employed by a lawyer, including but not limited to administrative assistants, investigators, law student interns, and paralegals. It describes making sure such assistants receive “appropriate instruction and supervision concerning the ethical aspects of their employment,” particularly on preserving confidentiality.⁶ Ways to ensure appropriate instruction include written policies and protocols, as well as regular instruction on the Rules of Professional Conduct and relevant substantive areas of law in which the nonlawyer is providing assistance. Further, specific protocols should be implemented within the law firm to ensure appropriate supervision of the work product of the nonlawyer.

Comment [3] to Rule 4-5.3 provides guidance on using nonlawyer assistants outside the firm who assist the lawyer in rendering legal services to a client, including but not limited to retaining investigative or paraprofessional services, hiring a document management company, sending client documents to a third party for printing or scanning, and using a service based on the internet to store client information. Lawyers using these services still must make reasonable efforts to ensure that the services are provided in a manner compatible with the lawyer’s professional obligations, and the extent of those efforts will depend on the circumstances.⁷

Applying the Rules to Potential Technology Issues

The Growing Need for Technology Competence

As provided for in Rule 4-1.1 and its Comment [6], lawyers do have an ethical obligation to be competent in technology, including its risks and its benefits, in a lawyer’s practice. For example, a lawyer in Oklahoma was publicly censured in 2016 based on a reciprocal discipline from the United States Bankruptcy Court for the Western District of Oklahoma where the lawyer was suspended for failure to file documents in a manner that was compatible with applicable rules.⁸ The lawyer failed to report his discipline in the Bankruptcy Court to the Oklahoma Bar Association and also failed to timely notify his clients of his suspension.⁹ During the hearing before the trial panel of the Oklahoma Bar Association’s Professional Responsibility Tribunal, the lawyer “acknowledged his problems with the bankruptcy court were caused by his lack of expertise in computer skills and his frustration trying to meet the federal court’s expectations with electronic pleading requirements.” The trial panel reported that the lawyer’s problems were not with his knowledge of substantive bankruptcy law, but instead “technological proficiency.”¹⁰ The Supreme Court of Oklahoma, in issuing its public censure of the lawyer, encouraged him to “continue to improve his computer skills, or better, to hire an adept administrative assistant to do his pleadings.”¹¹

While hiring adept support staff is helpful in some circumstances when properly supervised per Rule 4-5.3, it is not a substitute for a lawyer’s own technology competency as required by Rule 4-1.1. What are some ways to gain technology competency skills? The answers will be different for each lawyer depending on the lawyer’s practice setting and level of technological savvy. One of the best ways to gain the requisite skill and knowledge about the risks and benefits of relevant technology for a law practice is by taking continuing legal education programs related to technology.¹² While Missouri does not require that lawyers receive specific minimum continuing legal education (MCLE) credits related to technology competence, it does offer MCLE accreditation of a number of technology programs that help lawyers gain and maintain professional competence as it relates to the practice of law, professional responsibility, or law office management.¹³

There are several resources readily available to help lawyers build their technology competence, including articles, publications, blogs, podcasts, and more. When it comes to these resources, lawyers should be sure to check that they are receiving information from reputable sources that are appropriate for their practice settings.¹⁴ Malpractice insurance providers may also have resources or standards for insureds.

Additionally, lawyers should read the terms and conditions of service carefully for each new hardware or software item they consider incorporating into their practices to ensure the item has appropriate safeguards for maintaining client confidential information.¹⁵ Further, lawyers should consider consulting an information technology (IT) professional for assistance.¹⁶

Email and Other Electronic Communications

If lawyers are using email to communicate with clients, they must take reasonable precautions to prevent the unintended interception of confidential client information and should only use email upon proper consideration of Rule 4-1.6 and Comments [15]-[16].¹⁷ While email may be appropriate in some circumstances, other circumstances where the lawyer is transmitting highly sensitive information may require special security measures to comply with Rule 4-1.6.¹⁸ Special security measures may include using email encryption software, placing password protection on attachments, or using “a well vetted and secure third-party cloud based file storage system to exchange documents.”¹⁹ Remember that Rule 4-1.6(c) requires a lawyer to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of the client.” In looking to the factors discussed in Comment [15] to Rule 4-1.6 as to reasonable efforts to prevent access or disclosure, consider having a conversation with the client at the outset of the representation to determine if email is an appropriate means of communication. Some points to consider are:

• How do the lawyer and the client want to use email to communicate?
• What information will the lawyer and client be exchanging by email?
• What are the terms and conditions of the platforms that host both the lawyer’s email and the client’s email? Are the platforms ensuring privacy or are they mining emails for personal information?
• How is the client going to be accessing the email?²⁰ On a personal or work phone or computer? Who else has access to that device or the email account?

Consider these points, as well as the sensitivity of the information being transmitted, to determine if additional security measures are necessary or if email should even be used.²¹ By asking some of these questions, it should help the lawyer determine if he or she is acting reasonably in using email as a form of communication.

Other forms of electronic communication may include online client portals that have communication features or by texting. Similar questions about confidentiality and appropriateness of the medium should be asked for each of these other potential forms of electronic communication.

Also, lawyers should be mindful that if they are using one of these forms of electronic communication with clients, the correspondence needs to be retained for the client files in accordance with Rule 4-1.22 (Retaining Client Files) and Advisory Committee of the Supreme Court of Missouri Formal Opinions 115 (no withholding of property belonging to the client to enforce payment of fees or expenses) and 127 (scanning client files).²²

Data Backups, Case and Document Management Systems, and Electronic File Retention

When considering how to backup data, a lawyer should consider the nature of the information to be backed up. Most of it will likely be confidential client information, but it may include items such as trust account records, business records, and much more. Whether a lawyer is considering online (i.e., cloud)and/or on-site backups, those backups pertaining to confidential client information are governed by Rule 4-1.6 and guided by Comments [15] and [16].²³

Guidance is provided to lawyers regarding cloud backups in Missouri Informal Advisory Opinion 2018-09. It describes how lawyers need to maintain competence in using relevant technology per Rule 4-1.1, safeguard confidential client information per Rule 4-1.6(c), and supervise per Rule 4-5.3.²⁴ It also cautions lawyers to read the terms and conditions of service carefully to determine ownership and security of client information and the level of access the attorney and provider will have to that client information. It goes on to describe what constitutes reasonable efforts to safeguard confidential client information while using cloud computing, including but not limited to:

• Security measures protecting confidentiality of client information during transmission and storage;
• Prompt notification of attorney in the event of a security breach or provider’s receipt of a subpoena for client information;
• Ownership of data solely by attorney or attorney’s firm;
• No access rights by the provider to client information, except as required by law;
• Regular data backup by the provider;
• Handling of client information in the event attorney’s relationship with the provider is terminated;
• Compliance with applicable law regarding data storage and transmission;
• Reliable access to data by attorney;
• No access to data by third parties, including advertisers, except as required by law; and
• Domestic storage of data or, alternatively, storage in a jurisdiction subject to United States data protection laws or equivalent.²⁵

It also provides guidance that lawyers should review the provider policies and practices periodically, as these can change.²⁶

For on-site backups, lawyers should consider such things as the physical security of the equipment storing the confidential information, level of encryption, and redundancy (the same data being stored in multiple ways in case one system fails). Lawyers should consult with an IT professional to assist in properly setting up and maintaining this system.

Many case or document management systems are now provided by vendors as cloud-based services, though some are still provided for on-site network usage. When selecting a case or document management system, lawyers should consider similar factors as just discussed for cloud or on-site back-ups.

When backing up client information, lawyers should be mindful that they are required to securely store client files for six or 10 years after the completion or termination of the representation absent having an agreement with the client based on informed consent confirmed in writing.²⁷ The six-year client file retention applies to client files where the representation was completed or terminated on or after July 1, 2016, and the 10-year requirement applies where the representation was completed or terminated prior to July 1, 2016.²⁸ “Client files, except for items of intrinsic value, may be maintained by electronic, photographic, or other media provided that printed copies can be produced. These records shall be readily accessible to the lawyer.”²⁹ Advisory Committee of the Supreme Court of Missouri Formal Opinion 127 permits the destruction of paper files (except for items of intrinsic value) prior to the expiration of the required retention period if the files are maintained electronically for the required period in accordance with the Rules of Professional Conduct.³⁰

Keeping Client Confidential Information Secure on Phones, Laptops, Tablets, Etc.

Just as lawyers have an obligation to secure physical files of clients from unauthorized access, the same is true of electronic files lawyers maintain on portable electronic devices such as phones, laptops, tablets, and other similar devices.³¹ Whether the devices are those of the firm, or lawyers and employees are permitted to bring their own devices and use them for firm business, reasonable measures may include some of the following suggestions:

• Take reasonable steps to ensure confidentiality by, at a minimum, having strong passwords to access these devices.³²
• Passwords should be changed periodically.³³
• Consider additional safeguards such as encrypting the data on these devices, using multi-factor authentication to access firm systems.³⁴
• Avoid public Wi-Fi and only choose secure Wi-Fi, as well as consider using a virtual private network (VPN).³⁵
• For lost or stolen devices, have a way to remotely disable the devices and destroy the data contained on those devices.³⁶
• Implement firewalls, keep updated anti-malware, anti-spyware, and anti-virus protections on all devices where confidential client information is stored or transmitted.³⁷
• Apply all security patches and updates for software and devices.³⁸

These suggestions are some starting points for what constitutes reasonable measures to secure client confidential information and are not intended to be an exclusive list. As previously suggested, lawyers should be sure to consider the type of client confidential information and applicable state and federal laws. The prudent lawyer will consider consulting with an IT professional, the lawyer’s malpractice insurance carrier, and other appropriate resources for additional guidance.

Metadata

Another source of client confidential information lawyers should be mindful of securing is metadata, meaning electronically embedded data.³⁹ Informal Advisory Opinion 2014-02 asks in the litigation context if a lawyer “has an ethical obligation to make good faith efforts to prevent the inadvertent electronic transmission of embedded metadata to opposing party or counsel?” Citing Rule 4-1.6, guidance is provided that the lawyer must use reasonable care to ensure that no confidential client information related to the representation is revealed without the client’s consent, including confidential information that is contained in embedded metadata.⁴⁰ It provides that this may require scrubbing documents of metadata before transmitting them.⁴¹ However, the Informal Advisory Opinion goes on to note:

Efforts to protect confidential information must be exercised in light of Attorney’s obligation pursuant to Rule 4-3.4(a) not to unlawfully obstruct another party’s access to evidence or unlawfully alter, destroy, or conceal evidence. Removing metadata with evidentiary value before transmitting certain documents may constitute a violation of laws governing discovery and therefore violate Rule 4-3.4(a). This informal opinion does not render an opinion about the existence of discoverable evidence in particular metadata or about the effect on substantive legal privileges of the pre-transmission removal or lack of removal of metadata.⁴²

Responding to a Loss of Client Confidential Information Due to a Lost Device or File, Data Breach, or Cyberattack

Lawyers are custodians of highly sensitive information and can be prime targets for hackers.⁴³ Missouri Informal Advisory Opinion 2017-02 discusses a lawyer’s ethical duties when a nonlawyer assistant has disclosed client confidential information to third parties, but the ethics analysis as it relates to disclosing this breach to the client will be similar in the event of a lost device or file, data breach, or cyberattack. It advises that lawyers have an obligation under Rule 4-1.4 (Communication) to disclose the confidentiality breach to the affected client and explain the matter to the extent necessary for the client to make an informed decision about the representation. That disclosure also needs to occur in the event of a lost device or file where client confidential information is disclosed, whether lost by the lawyer or a nonlawyer assistant employed or retained either inside or outside the law firm, as the lawyer is responsible for that conduct under Rule 4-5.3. A similar communication is also necessary in the event of a data breach or cyberattack where confidential client information is disclosed.⁴⁴

Rule 4-1.6(c), requiring reasonable efforts to prevent inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation, also notes in Comments [15] and [16] that state and federal data privacy laws may govern or impose notification requirements upon a loss of electronic information or unauthorized access, so lawyers should be mindful of these laws both in how they choose to safeguard confidential client information and handle a loss of such information.

Working with IT Professionals and Vendors Outside the Law Firm

While lawyers may be aware of the obligations to train and supervise nonlawyer assistants within the firm, Rule 4-5.3, Comment [3] reminds lawyers that these same obligations apply regarding nonlawyer assistants employed or retained outside the firm. These include outside IT professionals lawyers may hire to help support their firms and vendors who provide services based on the internet to store client information such as data backup provides, case or document management programs, or other similarly based services used within the firm. Lawyers have the obligation to make reasonable efforts to ensure that the services are provided in a manner compatible with their professional obligations under the Rules.

Reasonable efforts will vary depending on the circumstances, “including the education, experience and reputation of the nonlawyer; the nature of the services involved; the terms of any arrangements concerning the protection of client information; and the legal and ethical environments of the jurisdictions in which the services will be performed, particularly with regard to confidentiality.”⁴⁵ Directions should be communicated to the nonlawyer in a manner appropriate under the circumstances so as to give reasonable assurance that the conduct of the nonlawyer is compatible with the professional obligations of the lawyer.⁴⁶ Missouri Informal Advisory Opinions 20070008 and 20050068 both suggest confidentiality agreements should be used when working with nonlawyer vendors and service providers outside the firm. Such agreements are also advisable when working with outside IT professionals, as well as direct training, as appropriate, on confidentiality and other applicable professional obligations of lawyers to ensure the IT professionals’ conduct is compatible with the conduct of lawyers.

Be Aware of Scams

Lawyers are frequently the targets of potential scams, as lawyers may hold trust account funds for clients as well as sensitive confidential client information. These potential scams often start as emails from those purporting to be legitimate sources, such as potential clients, known clients, financial institutions, businesses, government entities, etc., but are actually phishing attempts to gain access to funds and/or personal information of lawyers or clients. Additionally, emails containing links or attachments from known or unknown senders may contain viruses, malware, spyware, ransomware, or other mechanisms to corrupt computer systems and/or gain access to sensitive information. Lawyers must be savvy to these potential scams and train themselves and their nonlawyer assistants to prevent these breaches.

Trust account scams are some of the most common attacks against lawyers. Lawyers who believe they may have clients who have provided fraudulent checks in an effort to obtain good funds from lawyers’ trust accounts wonder how to ethically proceed. Guidance has been provided in Informal Advisory Opinion 2018-06, which addresses such a potential scam scenario in which a lawyer’s purported prospective client sent the lawyer a bogus check for deposit into the trust account. That Informal Advisory Opinion discusses whether the lawyer may report this purported prospective client to law enforcement. Whether a lawyer-client relationship exists is a question of law and fact that is outside the scope of the Rules of Professional Conduct, but if the lawyer had a prospective client relationship under Rule 4-1.18, the lawyer would not be able to use or disclose information gained in the consultation except as would be permitted under Rule 4-1.9 as though this person were a former client.⁴⁷ If no lawyer-client relationship existed, and this person was not a prospective client, the lawyer would not have a duty of confidentiality and would be free to make a report to law enforcement authorities.⁴⁸

Conclusion

As a lawyer, you should work to gain and maintain competence in technology, engage in reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of clients, and exercise appropriate professional responsibilities over the conduct of nonlawyer assistants both inside and outside the law firm. Focusing on these key ethics rules will assist you in selecting technology devices and systems in your firm, and help prevent breaches of client confidential information. If you have questions about the Rules of Professional Conduct regarding incorporating technology into your law practice, you are encouraged to contact the Legal Ethics Counsel office (www.MO-Legal-Ethics.org) to seek an informal advisory opinion about your prospective conduct.

Endnotes

1 Melinda J. Bentley is Legal Ethics Counsel for the Advisory Committee of the Supreme Court of Missouri.

2 See Rule 4, Scope [14].

3 Rule 4-1.0(h) defines “reasonable” or “reasonably” to be “conduct of a reasonably prudent and competent lawyer.”

4 See Rule 4-1.0, Comment [6].

5 See infra discussion of email.

6 See also Mo. Informal Advisory Opinions 2018-04 and 2017-02 (interpreting Rule 4-5.3 as it applies to nonlawyer assistants within a law firm). Informal Advisory Opinions are published on The Missouri Bar’s website at: https://mobar.org/site/Lawyer_Resources/Legal_Ethics_Opinions/site/content/Lawyer-Resources/Legal_Ethics_Opinions.aspx

7 See Mo. Informal Advisory Opinion 2018-09 (interpreting Rule 4-5.3 as it applies to use of a cloud computing vendor outside the firm).

8 State of Oklahoma ex rel., Oklahoma Bar Ass’n v. Oliver, 2016 OK 37, 369 P.3d 1074 (2016).

9 Id. at ¶15, 369 P.3d at 1077.

10 Id. at ¶5, 369 P.3d at 1075.

11 Id. ¶15, 369 P.3d at 1077.

12 See Mo. Informal Advisory Opinion 2018-09 (providing guidance on technology competence through continuing legal education courses).

13 See Rule 15.04(b): “A program or activity may be an accredited program or activity if it directly contributes to the professional competency of lawyers or judges and has significant intellectual or practical content related to the development or practice of law, professional responsibility, or law office management.” See also Rules Related to The Fla. Bar, Ch. 6, R. 6-10.03(b) (requiring Florida lawyers to take at least three of 33 MCLE credit hours every three years in approved technology programs), and 27 N.C.A.C. Ch. 1D – § .1518(a)(2) (requiring North Carolina lawyers to take at least one hour annually of MCLE devoted to technology training.)

14 See Mo. Informal Advisory Opinion 2018-09.

15 See Id. and Rule 4-1.6, discussion supra; see also Legal Ethics Counsel Resource Page — Electronic Comunication Resources, http://molegalethics.org/electronic-communication-resources/.

16 See Id. and Rules 4-1.6 and 4-5.3, discussion supra.

17 See Mo. Informal Advisory Opinion 2012-01 (providing guidance on use of email).

18 Id.

19 ABA Comm’n on Ethics & Prof’l Responsibility, Formal Opinion 477R (revised May 22, 2017).

20 See Mo. Informal Advisory Opinion 990007 (providing guidance on use of email, including consideration of settings of sender and receiver).

21 See Rule 4-1.6, Comment [15].

22 Mo. Sup. Ct. Advisory Committee Formal Opinions are published on the website of the Supreme Court of Missouri at: http://www.courts.mo.gov/page.jsp?id=11696.

23 See supra discussion of Rule 4-1.6.

24 See supra discussions of Rules 4-1.1, 4-1.6, and 4-5.3.

25 Mo. Informal Advisory Opinion 2018-09.

26 Id.

27 See Rule 4-1.22.

28 Id.

29 Id.

30 See also Legal Ethics Counsel Resource Page, File Retention Resources, http://molegalethics.org/file-retention-resources/.

31 See Mo. Informal Advisory Opinion 980030 (providing guidance on preventing physical client file access in an office-sharing arrangement) and Rule 4-1.6(c).

32 ABA Comm’n on Ethics & Prof’l Responsibility, Formal Opinion 477R (2017) (revised May 22, 2017).

33 Id.

34 Id.

35 Id. See also Jill D. Rhodes & Robert S. Litt, The ABA Cybersecurity Handbook 35 (2d ed. 2018) (“Wireless communication creates opportunities for hackers to intercept sensitive data such as passwords for logging in to corporate networks and online banking sites. Public Wi-Fi locations such as airports, hotels, and coffee shops — convenient places to check email — often do not have security features necessary to protect confidential client data.”).

36 ABA Formal Opinion 477R, supra note 32.

37 Id.

38 Id. See also Rhodes & Litt, supra note 35, 21-22 (2d ed. 2018), (describing cyber-attacks against law firms due to outdated software that had not been updated).

39 See Rule 4-4.4, Comment [2] (describing metadata as a form of electronically stored information).

40 Mo. Informal Advisory Opinion 2014-02.

41 Id.

42 Id.

43 See ABA Comm’n on Ethics & Prof’l Responsibility, Formal Opinion 483 (2018).

44 Id.

45 Rule 4-5.3, Comment [3].

46 Id.

47 Mo. Informal Advisory Opinion 2018-06.

48 Id.

Nearly 100 years ago, when Judge Cardozo famously commented, “law never is, but is always about to be,”³ he could not have anticipated the concept of “virtual assistants” like Amazon’s Alexa, Apple’s Siri, Google’s Assistant, Microsoft’s Cortana, or Samsung’s Bixby. Yet, his quote perfectly sums up the new frontier in law as more and more people integrate speech recognition technology into their everyday lives.

Although “speech recognition” may sound like a lofty term, it simply refers to what most of us do daily, when we use our voices to ask our phones to dial our friends, our cars for directions, and our speakers to play our favorite songs. Speech recognition is “the ability to speak naturally and contextually with a computer system in order to execute commands or dictate language.”⁴ Technology rivals are hard at work creating irresistible versions of easy-to-use devices with which we can talk and have questions answered.⁵ For the most part, this technology has become so good that a simple command, or “wake word” (“Alexa?!”), allows us to ask our virtual assistants a host of questions from what is today’s weather to who was the fifth President of the United States.⁶

Amazon, maker of the Echo (Alexa), a hands-free speaker you control with your voice, touts that the Alexa Voice Service, which is integrated into the Echo, is “always getting smarter.”⁷ When you interact with Alexa, she streams audio to the cloud. Amazon’s Terms of Use for the Echo duly notifies users that “Alexa processes and retains your Alexa Interactions, such as your voice inputs, music playlists, and your Alexa to-do and shopping lists, in the cloud to provide and improve our services.”⁸

For most people, their virtual assistants’ ability to always be listening for their “wake words” is helpful. When we are driving, this allows us to complete tasks hands-free, avoiding distractions, as well as moving violations. While we are making breakfast in the morning, contemplating getting to work or to court on time, we can ask Alexa how long the morning commute will take. Alexa also allows us to use voice commands to turn on the light while walking into a dark room, without having to search for the light switch.

Many large tech companies believe that voice commands and intelligent assistants will become the primary ways in which people interact with technology, possibly even more significant than touch screens and keyboards.⁹ Voice control has rapidly evolved from a quirky and interesting technology to a “must have” capability in new devices.¹⁰ Virtual assistants are being adopted seamlessly to stay.¹¹ Microsoft reports that Cortana, launched in 2014, now has 145 million users and has handled 18 billion tasks.¹² Apple claims it has reached two billion Siri interactions each week, with [an estimated] 41.4 million currently active users….¹³

This “space age” technology sounds great. However, if you believe that all artificial intelligence designed to serve us can do us no harm, just consider any number of science-fiction movies, which now seem more real than fiction, where humans are nearly done in by artificial intelligence machines, which were created with the intent of serving, not harming, us.¹⁴

Defense attorneys are among those lawyers who should consider how they can use virtual assistants’ recordings to shed light not only on how accidents occur, but also to challenge plaintiffs’ personal injury claims. The recent Arkansas trial of James Bates for the murder of his friend, Victor Collins, who was found dead, floating face-up in Mr. Bates’ bathtub, sparks debate regarding the first issue: Can Alexa actually record a murder or, in the personal injury context, an accident?¹⁵ In Bates, the prosecution asked Amazon to disclose recordings from Mr. Bates’ Amazon Echo.¹⁶ Amazon refused, citing privacy concerns.¹⁷ Ultimately the issue went unresolved, without addressing Amazon’s position regarding privacy concerns, when Mr. Bates voluntarily turned over the recordings.¹⁸

While the Bates case does not resolve the constitutional issue of whether Amazon may use the First Amendment’s protection of free speech to refuse to disclose the recordings gathered by our Amazon Echoes, it does highlight the fact that users have access to their recordings and, therefore, can willingly disclose them. Amazon’s Alexa App keeps a history of the voice commands that follow the wake word (“Alexa!”). Specifically, in response to a user’s question, “Can I review what I have asked Alexa?”, Amazon states “Yes, you can review voice interactions with Alexa by visiting History in Settings in the Alexa App. Your interactions are grouped by question or request. Tap an entry to see more detail, provide feedback, or listen to audio sent to the Cloud for that entry by tapping on the play icon.”¹⁹

We also know that Alexa can record events, such as a crime or an accident, because Echo is equipped with seven microphones that use beam-forming technology and enhanced noise cancellation. Alexa also has a camera, though it is off until a user activates it by asking Alexa or using the Echo Look App to take a photo, video, or use live preview. Alexa’s evidentiary value can also be found in the circumstantial evidence she can provide regarding a plaintiff’s day-to-day life, which can assist defense attorneys preparing for depositions and trial. Questions and commands from parties to their virtual assistants can provide valuable information regarding the places parties have visited since the alleged incident, their hobbies, and activities in which they are involved.

For example, by knowing that plaintiffs have asked their virtual assistants about the commute times to a certain office building, or their requests for Alexa to hail an Uber for them, defense counsel can ask more targeted questions during depositions, including whether plaintiffs have worked since the accident or have traveled or gone on vacation. The value of these records can be immeasurable, given the wide array of commands to “virtual assistants,” including giving definitions of new terms and phrases (“Siri, what is meant by ‘Big Data’?”); playing music (“Alexa, play songs by the Judybats”); assisting in recreation (“Siri, where can I play court tennis in the United States?”); (Alexa, how can I play golf at High Ridge Country Club?”); answering any number and variety of factual questions (“Siri, for which projects has Sciame Construction won awards?”); (“Alexa, which famous people are named ‘Oona’?”); (“Cortana, how do I apply for a Fulbright Scholarship in The Netherlands?”); (“Bixby, what were the ‘moral imperatives’ in ‘Real Genius’?”); (“Siri, who are the leading female poets in New York City?”); (“Google, which movie directors live in Brooklyn?”); (“Bixby, when did the Beach Boys record ‘I Get Around’?”); (“Siri, who is Phil Ochs?”); (“Cortana, how did Holly Golightly in ‘Breakfast at Tiffany’s’ support herself financially?”); going to events (“Bixby, where is the Songwriters Hall of Fame located?”); and securing prices for travel (“Alexa, ask Kayak how much it costs to fly from New York to Easter Island.”). Virtual assistants can also set up timers and alarms, thereby providing defense counsel with valuable information regarding when a person gets up in the morning and their appointments during the day. Alexa can even be used to begin a workout (“Alexa, ask Random Workout to pick a workout.”), which can be significant in those cases where plaintiffs claim to have sustained substantial physical limitations as a result of an accident.

It cannot be overstated how valuable this information can be to gain insight into a plaintiff’s everyday activities, which is often the essential element of most personal injury claims. Defense attorneys know that, when it suits plaintiff’s interests, plaintiffs often do not provide a wealth of information regarding their past day-to-day activities. Armed with a compendium of plaintiffs’ virtual assistants’ searches, however, defense counsel can refresh plaintiffs’ recollections regarding what people did on a certain day, even whether plaintiffs tried to call 911 for help,²⁰ thereby leading to more effective and meaningful questioning. This may be especially helpful if plaintiffs are trying to conceal their actual lifestyles. Like Facebook photos from a vacation, Alexa can be used to expose those plaintiffs who fail to testify truthfully and candidly regarding their injuries and ability to carry on activities of daily life.

The other side of the coin is that those plaintiffs who are ethically challenged can conceivably use their virtual assistants strategically, for example, by asking Alexa for information which would tend to validate their false narratives. For example, someone who is basically physically fine but nevertheless eyeing a potential personal injury suit as a result of an accident may be tempted to ask, “Alexa, add knee brace, cervical collar and Aleve to my shopping list.” – personalized “fake news,” if you will. As it is, this past July, British Security Researcher Mark Barnes warned of a technique that can be used to install malware on Amazon Echo that would silently stream audio from the hacked device to a faraway server, in essence, tapping the Echo.²¹ Since AI assistants can provide a “real time” autobiography, with malware, that autobiographical information can be read by those who were never intended to have access to that private information. Forewarned is forearmed.

Amazon Echo is not the only piece of technology that has the ability to alter the way we practice by collecting valuable information. Other smart devices, including the pedometer feature on our iPhones and Fitbits, can also provide valuable information regarding a person’s fitness level, including the number of steps a person takes and when they take them. This data, like other documentary evidence, is likely to be more accurate and informative than deposition testimony, which was taken only after a preparation session with an attorney and relies on a person’s memories of events that may have occurred years before the deposition. Opposing counsel devote considerable time and effort to obtain definitive answers from plaintiffs, pinning down physical fitness regimes before and after an accident, with some plaintiffs testifying that they used a run a 5K every weekend and now run “less,” “not as much,” or “not at all.” Plaintiffs have been known to respond with limited or vague answers to these probing questions at depositions. Now, however, the raw data from these devices can provide information that defense counsel can analyze to accurately determine plaintiffs’ actual fitness levels before and after an accident. Defense experts can also use this definitive information from plaintiff’s virtual assistants to construct a baseline from which they can assess a plaintiff’s physical changes, pre- and post-accident.

Using the discovery process to obtain data from plaintiffs’ Alexa or Cortana will most certainly be met with opposition from plaintiffs’ counsel, on the grounds of privacy and prejudice. That opposition will continue until the law begins to develop parameters regarding this type of discovery. However, since those who turn on virtual assistants presumably know, or should know, how they work, they should not be heard later to complain when the devices perform as advertised. One self-help solution is to unplug AI assistants when we do not want Siri or Alexa to overhear and record what is being said in their presence, something most people have not been doing.²² Keeping virtual assistants unplugged, unless or until needed, or taking the precaution of unplugging the virtual assistant when engaging in intended confidential conversations, may become common practice, if not also good common sense.²³

The situation becomes more problematic when it involves guests in someone’s home who do not realize they are being recorded.²⁴ Upon entering a person’s house or apartment, are we now expected to ask whether their virtual assistant is on, listening to and recording every word we say? Expectations of privacy therefore now change. As attorneys bring these issues before the courts, judges will weigh the right to a proper defense for defendants against the important right to privacy of plaintiffs. In doing so, courts will determine whether plaintiffs have true expectations of privacy regarding the data and recordings of their smart devices when they have put their physical conditions at issue in personal injury litigation. Simply put, why should the information collected by virtual assistants be treated any differently in discovery than the information contained in personal diaries or cell phone data? To state the proposition is to reject it.

Attorneys who understand the potentially valuable information these devices can provide to our clients should begin to question adversaries about them during discovery and be ready to defend their own witnesses for cross-examination when called upon to testify. When appropriate, counsel should also seek rulings on disclosure of this information if opposing counsel object to providing it. Significantly, Amazon Echo users can delete their voice recordings, which are stored in the History section of the Alex App. Some plaintiffs, with or without advice or counsel, may therefore log on to Amazon.com/myx, find their Echo, and delete old voice recordings.²⁵ Deletions can also be made on Google’s Assistant.²⁶ Knowing this, it will be prudent for defense counsel to serve opposing parties with a demand at the beginning of litigation for the preservation of evidence, requesting plaintiffs to retain that information in the Cloud and not to dispose of any recordings in the History section of the Alexa App, a fair quid pro quo for demands by plaintiffs for the preservation of any CCTV believed to have captured an accident, often served at or prior to the commencement of a lawsuit. To obtain that information, authorizations directed to Amazon, Apple, Google, Microsoft and Samsung should also be requested, in order to access important data from Alexa, Siri, Google’s Assistant, Cortana and Bixby, respectively.

Moreover, the evidentiary value of this newly available information extends well beyond casualty litigation, to any area of law where liability hinges on proof of what someone said or knows and when they said it or knew it, thereby encompassing all practice areas. For just one example, information from virtual assistants will be valuable to attorneys handling securities fraud and insider trading cases, as Alexa can be the “fly on the wall,” overhearing conversations regarding which stock to buy or sell and when. Attorneys litigating sexual harassment or Title VII immigration cases that look to the context surrounding what was said behind business decisions will be able to benefit heavily from this technology, which provides unvarnished insight into what was previously disputed “he said/she said” conversations. Trademark, copyright, and patent attorneys, piecing together the origination of ideas, may also find useful the data that virtual assistants can now make readily available.

Information from digital assistants is not limited to the United States and now has direct application to cases and litigants worldwide. Just this past October, Yandex, the largest search engine in Russia, often referred to as the Russian equivalent of Google, introduced Alice, its first conversational, intelligent assistant.²⁷ This new girl in town is touted to be the most capable Russian language assistant of its kind.²⁸ Accordingly, the search for information acquired by virtual assistants will soon be across borders, in any country where AI assistants are located.

As Kyle Rees cautioned Sarah Connor in the first “Terminator” movie, “Listen and understand. That terminator is out there. It can’t be bargained with. It can’t be reasoned with. It doesn’t feel pity, or remorse, or fear.” So, too, are digital personal assistants, who can and will record our every statement, which can later be used as evidence by lawyers who understand and make full use of this new technology.²⁹ The next generation of artificial intelligence platforms may provide attorneys access to even more information which previously was assumed to be private and non-discoverable.

Whether in the board room, the living room, the proverbial “smoke filled room” or the office, the defense of “plausible deniability,” used conveniently when confronted with previously hard to prove facts, will not be less successful in voiding disclosure of what actually took place. If, during conversations intended to be secret, Siri, Alexa, Google’s Assistant or Cortana are present in the room, unobtrusively sitting on a table, bookshelf or mantel, silently listening to and recording all that is being said, it will be far harder for the participants of that meeting to later deny what was said, when, and by whom.

Remembering Judge Cardozo’s remark that “law never is, but is always about to be,” and Chief Justice John Roberts’ comment this past July that “advancing technology poses one of the biggest challenges for the Supreme Court,”³⁰ forward thinking attorneys should not shy away from putting these issues before the court, as attorneys and judges (perhaps with the help of AI devices) together grapple with this new technology, directly applicable in today’s world, both real and virtual. We are now at the start of an era in which previously unavailable data can be accessed, become discoverable, and later be introduced into evidence. Attorneys who fail to recognize this will be left behind.

Reprinted with permission from New York State Bar Association Journal, November/December 2017, published by the New York State Bar Association, One Elk Street, Albany, NY 12207.

Endnotes

 1 Robert D. (“Bob”) Lang (RDLang@damato-lynch.com) is a senior partner at the firm of D’Amato & Lynch, LLP in New York City, where he manages the Casualty Department.

 2 Lenore E. Benessere (LBenessere@damato-lynch.com) is an associate of the firm. The authors would like to thank paralegal Megan Kessig for her help, and Alexa, Bixby, Siri, Google’s Assistant, and Cortana for their assistance.

 3 Benjamin Cardozo, Lecture, The Nature of the Judicial Process, Yale Law School (1921).

 4 Stacey Gray, Always On: Primary Implications of Microphone-Enabled Device, Future of Privacy Forum (April 4, 2017).

 5 George Anders, “Alexa, Understand Me,” M.I.T. Tech. Rev. (Aug. 9, 2017).

 6 Alexa tells us the president is James Monroe.

 7 Amazon, https://www.amazon.com/Amazon-Echo-Bluetooth-Speaker-with-Alexa-Black/dp/B00X4WHP5E/ ref=sr_1_1?s=amazon-devices&ie=UTF8&qid=1500487675&sr=1-1&keywords=echo.

 8 Amazon, Terms of Use, https://www.amazon.com/gp/help/customer/display.html/ref=hp_left_v4_sib?ie=UTF8%nodeId=201809740.

 9 Nick Wingfield, Amazon Wants to Wake You Up With Alexa, and That’s Just the Start, N.Y. Times (Sept. 29, 2017).

 10 Peter Nowak, Why It’s No Longer Strange to Talk to Your Home Appliances, The Globe and Mail (Oct. 2, 2017).

 11 Adrian Cutler, The Virtual Revolution of the Digital Assistant, IT ProPortal (Oct. 5, 2017).

 12 Artificial Intelligence, The Invincible Revolution Than Can Change Everything, Latin American Herald Tribune (Oct. 16, 2017).

 13 Martin Courtney, Alexa, Cortana, Siri, et al: Do Our Digital Assistants Hear More Than We Want Them To?, E&T Magazine (Oct. 13, 2017).

 14 Consider the computer HAL 9000 in 2001: A Space Odyssey; Skynet in The Terminator movies; the computer WOPR in WarGames; the NS-5 robots in I, Robot; Gatekeeper in The Net; ARIA in Eagle Eye; GLaDOS in Portal; the Terrans in the X game series; SHODAN in the System Shock series; SID 6.7 in Virtuosity; X.A.N.A. in Code Lyoko; AI Omega in Red vs. Blue; and the comely computer Ava (apparently no relation to Alexa) in Ex Machina.

 15 Eliott C. McLaughlin and Keith Allen, Alexa, Can You Help With This Murder Case?, CNN (Dec. 28, 2016); Agatha French, Alexa May Be Listening, but Will She Tell on You?, L.A. Times (Jan. 5, 2017).

 16 Hailey Sweetland Edwards, Alexa Takes the Stand: Listening Devices Raise Privacy Issues, Time (May 4, 2017); Jill Bleed, Alexa a Witness to Murder? Prosecutors Seek Amazon Echo Data, Yahoo.com (Dec. 27, 2016); Sarah Buhr, An Amazon Echo May Be the Key to Solving a Murder Case, TechCrunch (Dec. 27, 2016).

 17 Gerald Sauer, A Murder Case Tests Alexa’s Devotion to Your Privacy, Wired (Feb. 28, 2017).

 18 Shona Ghosh, Amazon Handed Over Alexa Recordings to Police in a Murder Case, Business Insider (Mar. 7, 2017); Chris Perez, Amazon Abandons Legal Fight Over “Alexa Data”, N.Y. Post (Mar. 7, 2017).

 19 Amazon, Alexa and Alexa Device FAQs, https://www.amazon.com/gp/help/customer/display.html?nodeId=201602230.

 20 Jefferson Graham, “Alexa, Call 911” Won’t Work. Here’s What Will, USA Today (July 19, 2017).

 21 Andy Greenberg, A Hacker Turned an Amazon Echo into a “Wiretap”, Wired (Aug. 1, 2017).

 22 Siri and Alexa Are Spying on Us, Gotham Girl (Aug. 26, 2017).

 23 In reaching to turn off virtual assistants, some may have flashbacks to any number of science-fiction books and movies, such as 2001: A Space Odyssey by Arthur C. Clarke and Stanley Kubrick, where the artificial intelligence device resists and actively defends itself when people seek to turn it off. Our advice: notwithstanding your fears, summon your courage and turn off your virtual assistants when you do not want them listening to and recording what you are saying.

 24 Alexa, How Much Is My Privacy Worth?, Salem News (Aug. 1, 2017).

 25 Jake Swearingen, Can an Amazon Echo Testify Against You?, N.Y. Mag. (Dec. 27, 2017).

 26 Kevin Murnane, How to Delete the Recordings of Your Interactions With Alexa and Google Home, Forbes (Oct. 2, 2017).

 27 Radu Tyrsina, Cortana Gets New Competition from Alice, Courtesy of Yandex, Window Report (Oct. 4, 2017).

 28 Brian Heather, Yandex Introduces Alice, An Alexa-Like Assistant, That Speaks Russian, TechCrunch (Oct. 11, 2017); Pradeep, Yandex Release Its Cortana Competitor in Russia, MSPowerUser (Oct. 11, 2017); David Reid, Russian Launches Its Own Version of Amazon Alexa With ‘Near-Human Levels’ of Speech Recognition, CNBC (Oct. 10, 2017).

 29 Kevah Waddell,  The Privacy Problem With Digital Assistants, The Atlantic (May 24, 2016).

 30 Nick Perry, In Overseas Remarks, Roberts Says Technology Poses Challenge for Courts, N.Y. L.J. (July 26, 2017).

We all experience password fatigue, that feeling when you receive yet another notification to create or change a password. The password must meet certain criteria, typically a minimum number of characters containing a combination of uppercase, lowercase, numbers, and/or symbols. Exasperated, you ask yourself, “How am I going to remember a new password?” So you take the easy route and add an additional exclamation point to your current password or use a password from a different account.

While you are more likely to remember these passwords, re-using or creating predictable passwords leaves you vulnerable to hackers. Stolen passwords, phishing, spear-phishing, and ransomware are serious threats to any internet user, but particularly so for attorneys, who are mandated to protect confidential client information.

Best Practices for Creating Strong Passwords

You know the basics of password security. Do not store your written passwords under your keyboard; do not use your username, the word “password,” qwerty, or personal/confidential information as a password; and finally, do not use a single dictionary word. So how do you protect yourself?

Stop Re-Using Pa5sw0rds! Even if you create a strong password, using it for a number of accounts increases the likelihood that it may be stolen. While it is less critical to create unique passwords for each site you visit that does not store your personal or confidential information, never use that password for any site storing such information. Most importantly, you should never re-use your email password at any online site. If your do and one of the eCommerce sites is hacked, your email account is compromised.

Longer is Better.  While many sites require a minimum of eight characters, you should create a longer password. Each additional character you add will exponentially increase your password strength. A password consisting of 15 lowercase letters offers better security than an eight-digit password containing mixed, but predictable, characters.

Even So, Mix It Up. Many users make it easier on themselves (and hackers) by placing their capital letter at the beginning and the number and/or special character at the end. Your password will be far stronger if capital letters, lower case letters, numbers and special characters are not bunched together. Mixing it up also means that you avoid easily predictable keyboard patterns such as qwerty or 1qaz@wsx.

Don’t Change So Often.  For some of us, frequent change is required by the IT department. If you have a choice, though, it is generally a better policy to create a strong password and keep it for a longer period of time. While this may seem counterintuitive, frequently changing a password makes it tougher for the user to remember, which makes the user more likely to create easily recalled passwords or to simply incrementally increase the number at the end each time a change is required.

Use a Password Manager. If you have a unique password for each site you visit, you have far too many passwords to remember which password is connected to which site. You probably are also frequently locked out of accounts or having to reset your passwords. Good news – there’s an app for that! Password managers create and store credentials for each site you use and log you in automatically. Your database of passwords is encrypted with a master password. The benefit of a password manager is that you will have unique and strong passwords for all of your online accounts. The downside is that you absolutely must remember your master password. There are numerous excellent password managers. Dashlane, KeePassX, Password Boss, and LastPass are just a few of the many options and most have both free and paid versions.

Use Two-Factor Authentication. While these password tips provide a good start to better online security, you should also enable two-factor authentication for any account that offers that option. Two-factor authentication will require that you enter a temporary code sent to your phone along with your regular password. This additional layer can help protect you from attack if your passwords are compromised. This is a particularly good idea for online banking and eCommerce accounts. You can often designate your own personal computer and phone as trusted once it is set up and can avoid the bother of having to enter a code each time you access your account from those devices.

Whether you are technologically savvy or not, these tips provide easily achievable steps to better secure your online presence. Resolve to make your 2017 more secure by putting these password systems into practice.

Endnote

 1 Cindy Neagle is Law Practice Management Attorney for The Missouri Bar.