Jeffrey S. Krause is a senior consultant at Affinity Consulting Group LLC.

There is a common misperception that solo and small firm lawyers cannot afford the same level of tech security as larger firms. While it is true that firms with larger budgets can afford a larger security infrastructure, it does not necessarily mean their security is better than what a smaller firm can obtain. 

More likely, a larger security infrastructure results from more employees, including those whose job it is to maintain security, and from being a more prominent target. Small firms can also implement robust security to protect their firms and clients. Smaller firms may have fewer weak spots to protect, but they need to know those weak spots and implement security to guard them. They might also find they already pay for the tools they need.

Here are some easy ways to greatly enhance your firm’s security going into 2026 while spending little-to-no money. 

Duty 

One thing is clear: All lawyers have a duty to protect their clients’ data. The Missouri Rules of Professional Conduct, Rule 4-1.6(c) states: “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of the client.”

Unless you want to argue about reasonableness, Rule 4-1.6(c) does not provide an exception for solo and small firm lawyers, giving them leeway due to firm size or budget. The duty is the same — you must take reasonable steps to protect client information. In doing so, you are also taking reasonable steps to protect business and personal information. 

Security weak spots 

High-profile security breaches are often reported as if a genius hacker cracked an elaborate system designed to prevent unauthorized access. While this occasionally happens, most security breaches are much less interesting. Users are careless with already-weak passwords that they may use on multiple sites. 

For example, an employee’s password to the firm’s Clio may be the same as their Netflix password, their Facebook login, and, most dangerously, that one sketchy website they visited four years ago. Affinity Consulting’s resource on password managers, located in the connect.MOBAR forms bank, can help you familiarize yourself with good password principles and password management programs. 

Some organizations do not require strong passwords or an additional layer of security if a password is compromised. Devices may be lost without the data being properly secured. In other words, solo and small firm data security is about protecting data from our own mistakes. 

Microsoft 365 

The good news is that you likely have the tools to provide sophisticated security to your clients and their data. Microsoft 365 is nearly ubiquitous among solo and small firms and provides many of the features needed to protect data. Microsoft 365 Business Standard costs $12.50 per user per month and provides almost everything you need. You might also consider Microsoft 365 Business Premium, which has additional features related to security, at $22 per user per month. 

Both the standard and premium plans include multi-factor authentication and an extensive list of security defaults. Both plans provide anti-spam, anti-malware, and anti-phishing features, and allow users to control access to SharePoint and OneDrive files. Correctly using these features provides a significant level of security.

The premium plan adds conditional access features, advanced anti-phishing, safe links and safe attachments, sensitivity labels, and data loss prevention services. You may decide the $9.50 per user per month is worth it to protect yourself from unforced errors. For example, the data loss prevention service notifies you when you attempt to share credit card numbers or content falling under HIPAA and may catch you from sharing that information in an insecure way. The service also provides a report of any information you shared. Proactive features like this help prevent errors, break bad sharing habits, and give you a list of information you have released “into the wild.” 

Passwords and multi-factor authentication 

An easy way to address security weak spots is to consider password strength. With any Microsoft 365 plan, you can set password policies. Interestingly, Microsoft’s guidance regarding passwords is different than what you may have heard previously. While it does caution against easy-to-guess passwords or passphrases, it does not state that longer is necessarily better, complex character requirements are necessary, or periodic resets serve a purpose. Instead, much of the guidance centers around multi-factor authentication. 

Most of us are familiar with MFA. It requires the user to provide two or more verification factors to gain access. For example, when a user attempts to log in from a new device or location, they enter their login and password as normal. If this information is correct, a message is sent to their phone. The message contains a code that must be entered before the user can proceed. 

Not only does Microsoft include MFA for Microsoft 365 components, MFA can also be configured to work with other applications via Azure AD (Active Directory). In addition to text message-based codes, many sites offer software-based codes, which can be stored and viewed in programs such as Microsoft Authenticator, Google Authenticator, or Twilio’s Authy. 

With MFA, compromised passwords cannot be used to gain full access unless the bad actor also possesses and is able to successfully log in to the device to which the message is sent. This is where device encryption comes in. 

Device encryption 

Encrypting your computers, laptops, tablets, and phones is another critical step in protecting data. If you enter a code to access your tablet or phone, you are already using encryption. Entering the wrong code too many times can lock or even erase the device. Good luck getting the MFA code from a locked phone. This simple encryption protects against a lost or stolen phone being used to compromise your data.

For computers and laptops, a little more work is required. For Windows Pro devices, turn on BitLocker to encrypt the device hard drive. It does not stop someone with the credentials from accessing the computer. However, a thief would have to know how to access the stolen laptop. If they do not know the credentials, they may attempt to remove the hard drive and access data that way. They cannot do this without the BitLocker code. A similar encryption tool, FileVault, is available for Mac users. 

Conclusion 

No security is bulletproof, and a short article cannot cover every aspect of security. However, Microsoft 365 and Windows, which most solo and small firms already use, offer powerful security features. Implementing just a few of them can fortify the most common weak points in your firm’s security. Combined with strong passwords, your security fortifications will rival most firms, irrespective of size.

Lawyers and their firms interact with all manner of websites and services, and care that private information is safely managed. We also operate websites and services where consumers and our clients expect the same.

In this environment of ever-increasing data collection and aggregation and concomitant breaches, regulating bodies are starting to respond to consumer complaints and have begun to act. Your law firm’s website may soon be in their crosshairs, impacting your engagement and reach with current and potential clients.

Websites know no geographic boundaries, lawyers so regulations related to data collection affects lawyers in three ways:

1) what we disclose to website visitors about data-collection practices;

2) the ability of an individual to obtain a copy of that collected data; and

3) the ability of individuals to erase that data under limited circumstances. The most important of these is disclosure of data collection.

Data collection and cookies

Websites store information about visitors and track their interactions via tiny text files called “cookies.” Cookies are not inherently malicious and are often helpful. Amazon uses them so you can store contents in your shopping cart while continuing to click around. Cookies are also why you’re able to stay logged in to password-protected websites.

The privacy concerns with cookies arise from “tracking cookies” or “third-party tracking cookies.” These cookies “follow” you around the internet as you browse websites and build a more intimate and complete picture of you. Have you noticed how, when you search Google or Amazon for “Sonicare toothbrush,” you subsequently see electronic toothbrush ads on other websites you visit? You’ve experienced the power and reach of tracking cookies.

Go to wikihow.com/View-Cookies to learn how to review the cookies on your computer’s web browsers.

Requirements

To comply with the recent government regulations, websites must disclose their use of cookies. This is why, in visiting websites in the last couple of years, you’ve seen more and more “pop-up” disclosures regarding data collection and cookies.

What do you and your website need to do then?

- Your website must provide visitors with accurate and specific information about what every cookie your website uses does.

- You must obtain a website visitor’s consent before using any cookies beyond those necessary for essential website functions, such as allowing users to stay logged in as they bounce around and return to your website.

- Once the visitor consents, you must document and store that consent.

- Visitors must be able to access your site even if they reject certain types of nonessential cookies.

- Visitors must be able to withdraw or change their consent easily.

It’s entirely likely and reasonable that you don’t have the foggiest idea what cookies your website uses or what’s stored in those cookies on visitors’ computers. That’s OK. There are several websites that will examine your website for compliance and tell you where you are deficient. If you are responsible for your website’s backend, there are tools available for WordPress, Wix, and Squarespace.

If you have no idea what the preceding sentence means, there are plenty of companies willing to walk you through the process, such as OneTrust.

Missouri data disclosure laws

While Missouri has no laws specifically governing data disclosure, § 407.1500 RSMo. regulates consumer notifications of actual data breaches. The statue defines a breach as “unauthorized access to and unauthorized acquisition of personal information maintained in computerized form by a person that compromises the security, confidentiality, or integrity of the personal information.”

Personal information is an“individual's first name or first initial and last name plus one or more of the following:

- social security number,

- driver’s license number or other government identifying number,

- financial account numbers (in combination with a PIN or other access credentials),

- unique electronic identifier or routing code (in combination with a PIN or other access credentials),

- medical information, or

- health insurance information.

The statute provides two exceptions as to whether accessing such information qualifies as a breach. First, good faith access is not a breach. Second, a reportable breach occurs only if the accessed personal information is “not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable or unusable.” A breach of encrypted information need not be reported if the encryption key was not compromised.

Additionally, a breached party’s notification obligations may be tolled based on a law enforcement request (e.g., an ongoing investigation) or superseded by another law (e.g., HIPAA for healthcare organizations).

Notifications from the breached party to affected individuals must happen within 45 days of the breach’s discovery, which could be long after the breach’s occurrence. If the breach impacts more than 500 state residents, the business must notify the attorney general’s office.

Finally, the law provides a private right of action under which individuals may sue. Only those whose data was breached may sue for damages, and the Missouri Attorney General’s Office may also act.

For more resources about keeping your and your clients’ information safe, visit The Missouri Bar’s Law Practice Management Resource Center.

It's common to see news about cybersecurity spiral away from the helpful and actionable toward the sensational and convoluted. In the spirit of simple, direct, actionable solutions, here are seven suggestions to improve your cybersecurity situation.

Enable whole disk encryption

With in-person events picking up following the COVID-19 pandemic, our laptops are on-the-go and more people are visiting the office. Enable whole disk encryption on all laptops and desktops. If a thief steals your computer, they cannot access client information absent your username and password, even if they remove the physical hard drive from the stolen computer and install it in a different machine. Whole disk encryption is built in to Windows and macOS.

Enable “Find My”

Check whether your device’s remote location feature is enabled. Apple calls its service Find My, and Google’s is Find My Device. Microsoft's feature is also called Find My Device. With these services, you can locate the lost device, lock it, have it play a sound to help you find it, and, if necessary, remotely delete the device’s contents.

Apple’s service covers Macs, iOS devices, and some AirPods. Google’s service supports Android smartphones, tablets, and Chromebooks. Windows 10 and 11 users can enable Microsoft’s Find My Device.

Asset recovery tags

Larger organizations have long used numbered or barcoded stickers to track what equipment they have and where it is. Companies like Dynotag and ReturnMe take this inventory concept and make it accessible to individuals and small businesses.

You purchase an identity tag from the vendor, which could be a sticker (most common), keyring, luggage tag, or even a literal dog (or cat) tag. You then create an account and register the tag’s number to your account. If you misplace your tagged item, whoever finds the item calls an 800 number or visits a website (both listed on the tag) to arrange the item’s return.

Think of these tags as “Good Samaritan stickers.” They don’t prevent theft, but they make it easy for good people to be helpful.

Complex passwords

Unique, complex passwords remain essential for online security. Start with the LPM whitepaper on password managers for good information, but with one update: Replace LastPass with Bitwarden following the LastPass data breach in 2022. I have also used 1Password for years and am confident in recommending it.

If online password storage unnerves you, the open-source KeePass stores password data only locally on your machine, not in anyone’s cloud, but that makes you responsible for backing up and securing your data.

Finally, I recently learned one reason Rolodex still exists. A lawyer I met uses Rolodex cards for each of his passwords. For example, filed under “A” is a card for Amazon listing his email address and password. Considering the weaknesses of a single-copy paper record in one location, it’s imperfect but beats using the same password for many sites. If you prefer something more portable than a Rolodex, Amazon sells password notebooks.

Two-factor authentication

This LPM whitepaper provides a primer on two-factor authentication (2FA). Enable it on every web service you use that offers 2FA. Visit the 2FA Directory to discover whether your practice management software, bank, etc. makes 2FA available.

1Password, Dashlane, and Roboform support storing 2FA codes in their password managers. If you’re using another program, or a Rolodex or notebook, you’ll need an app like Google Authenticator, Microsoft Authenticator, or Twilio’s Authy.

Admin consoles

A practice larger than a solo lawyer, even just a single lawyer and one part-time support staffer, should buy or subscribe to the “business version” of most needed software or services. Business-tier plans typically include an administration dashboard to control device and user access.

Examine your vendors of subscription-based tools for document storage, productivity software, eSignatures, and more. Secure, centralized user access and content management are a lifesaver for a lost device, ease employee onboarding and departure, and add a “belt and suspenders” approach to client data when paired with whole disk encryption and a “find my” service.

VPN

If you’re working away from home or the office and need internet connectivity, don’t join whatever WiFi network is available, even if it’s “secured,” meaning anyone can ask the barista for the password. There are two sound ways to connect to the internet when away from your “known safe” networks.

First, use your smartphone as a WiFi hotspot. This will drain your phone’s battery and eat data, but it’s safe. Second, subscribe to and use virtual private network (VPN) software.

A VPN encrypts your internet traffic before it leaves your computer. Once the encrypted traffic arrives at the VPN vendor’s server, it’s decrypted and released onto the public internet. This approach prevents your coffeehouse or hotel lobby neighbors from eavesdropping. A VPN generally slows your internet connection, but it’s a tradeoff in favor of security. Visit the LPM comparison chart page to compare VPN providers.

Tackling these seven suggestions on a one-a-day schedule will dramatically boost your security in a week.

For more resources on opening, building, managing, protecting, and winding down a law practice, visit The Missouri Bar’s Law Practice Management Resource Center.

Note: This is the final piece of a three-part series from The Bar Plan Mutual Insurance Company. The first part (about legal malpractice insurance) ran Dec. 15, 2021, and the second part (about cyber liability insurance) ran Jan. 12. The author describes some of the common types of insurance that lawyers and law firms should consider purchasing. The coverages included are by no means an exhaustive list but are intended to provide you with a good starting point to determine the coverages that are necessary for you and/or your firm.  

Business owner’s policy (BOP)

The Hartford explains that “A Business Owner’s Policy (BOP) combines business property and business liability insurance into one business insurance policy.” 

A BOP generally includes three basic insurance coverages needed by business owners: 

General liability insurance to help protect you from lawsuits when your business causes injuries or property damage. For example, if a client gets hurt at your office, this can help. It also helps cover claims of slander and libel. 

Commercial property insurance coverage helps protect the physical location where you practice law. It also helps cover the items you use to conduct your legal business, whether it’s leased or owned. 

Business income insurance coverage helps pay for lost income if you’re forced to shut down due to a covered property loss. This includes damage from fire, wind, or theft. 

It is important to note that you can purchase these three types of coverages in standalone policies, but most people find it easier and more economical to purchase a BOP. 

Workers’ compensation insurance

With rare exceptions, Missouri law requires a business owner to carry workers’ compensation insurance if he or she has five or more employees. This type of insurance provides benefits to your employees if they suffer illnesses or injuries because of their jobs. These benefits usually cover medical care, replace lost wages during recovery, provide disability benefits, and give death benefits in the event of a work-place accident that results in death. For the business owner, workers’ compensation insurance often helps cover legal costs if an employee sues because of a workplace illness or injury. 

Life insurance

While planning for one’s own death is uncomfortable, it is necessary. Life insurance can help you take care of dependents, a spouse, and/or aging parents. It also often gets more expensive with age, so it is something that you should consider purchasing while young. When considering the amount of life insurance you need, consider things like your final expenses, outstanding debts, housing costs (remaining mortgage/rent expense, utilities, etc.), and the educational or medical needs of dependents. 

There are two categories of life insurance: term and whole life. Term life insurance allows one to lock in a certain death benefit for a certain number of years. Within the term category, there are two types: renewable and level term. Renewable insurance has premiums that will increase annually as you age. while the premium for a level term policy remains the same throughout the term.  

Whole life insurance also pays a predetermined death benefit while rates remain the same. However, unlike term life insurance, premium payments made on a whole life policy earn tax-deferred interest and sometimes dividends. You can also borrow against it (in the amount of the current value) or cash in your policy prior to your death. The downside to whole life insurance is that it is much more expensive than term. 

Employment practices liability insurance

Employment practices liability insurance (“EPLI”) provides coverage for employment-related claims made against you and/or your firm. Such claims could include sexual harassment, age and disability discrimination, and wrongful termination. While this is common insurance for a business, a law firm can purchase policies specifically tailored to its needs that include coverage for things like the failure to make someone a partner, third-party claims brought by nonemployees for harassment or discrimination, and claims related to a nonprofit controlled by the law firm. 

Business (commercial) auto insurance and non-owned auto insurance

Many people do not realize that most personal auto policies do not cover accidents that occur while traveling for the purpose of conducting business. Given this, business auto insurance is essential to protect you from uninsured personal liability for property damage, medical care, and personal injury. 

Likewise, most personal auto policies held by your employees do not provide them coverage when they are traveling in their personal vehicle for a work purpose. Non-owned auto insurance protects your employees from uninsured personal liability for property damage, medical care, and personal injury. 

Other miscellaneous insurance types

There are numerous insurance products made to specifically cater to the needs of lawyers and law firms. Here is a non-exhaustive list of a few of the more helpful ancillary coverages: 

Commercial umbrella insurance, like a personal umbrella policy, would step in and cover damages that exceed the policy limit on your BOP. 

Accounts receivable general business insurance provides protection if your accounts receivable data is lost. It can also provide coverage for interest on a loan you had to take out to offset uncollected monies. 

Valuable papers and records insurance is valuable if your firm has several physical files. This policy covers the replacement cost of your records if the same were lost due to a covered peril. 

Employee dishonesty insurance provides coverage in the event an employee commits fraud or embezzlement. 

The Missouri Bar has assembled scores of resources for members looking to protect a practice. Members can learn more about the insurance options available from Missouri Bar member benefit providers here. The Bar Plan is a proud Missouri Bar member benefit provider and the only endorsed carrier of Professional Liability Insurance for The Missouri Bar. 

This is the second article of a three-part series from The Bar Plan Mutual Insurance Company. The first part (about legal malpractice insurance) ran Dec. 15 and the third part will run Jan. 12, 2022. In the series, the author will describe the common types of insurance that lawyers and law firms should consider purchasing. The coverages included in this series are by no means an exhaustive list but are intended to provide you with a starting point to determine the coverages that are necessary for you and/or your firm.  

Cyber liability insurance 

Coalition, one of the largest providers of cyber insurance in the United States, reports that cybercrime “is increasing like never before.” The most common claim Coalition sees is business email compromise, with the average claim costing $37,000. Funds transfer fraud was the next most common, with the average amount of funds stolen being $247,000. Ransomware incidents have also increased, with the average ransomware demand being a whopping $1.2 million and the average ransomware claim costing $184,000. 

Most notably, Coalition reports that attacks are becoming increasingly automated, so it’s easier and more profitable for attackers to target medium and small businesses. Claims made against business with under 250 employees increased 57% from the first half of 2020 to 2021, according to Coalition. 

Business and tax consultant firm PBMares has a great summary of the common coverages to look for in a cyber liability policy here. At The Bar Plan, we recommend that you consider the following factors when assessing cyber liability coverage:  

• Does the policy provide full unknown prior acts coverage? 

• Are there separate limits for breach event costs (such as notification to clients) and additional defense costs (such as attorneys’ fees for any suit brought against you)? 

• Is there coverage for data that is stored with third parties? 

• Is the coverage worldwide? 

• Does the policy include proactive breach response costs and voluntary notification? 

• Does the policy cover the cost of providing credit monitoring services, identity theft assistance services, credit or identity repair, and restoration services to affected parties? 

• Does the policy provide system failure coverage, and does it apply to voluntary shutdowns that are necessary to protect your data? 

• Does the policy’s property damage exclusion apply to electronic data (you do not want it to)? 

• Does the coverage apply to breach of corporate information of all types? 

• Does the policy cover acts committed by rogue employees? 

• Does the policy cover privacy claims brought by employees? 

• Is there an extended reporting period on the policy? 

Most cyber liability policies provide first and third-party coverage. First-party coverage protects you from damages incurred by cyber liability events, while third-party coverage protects your clients and others affected by a cyber event. In that regard, consider whether the policy you’re looking to purchase includes the following types of coverage in each category. 

First-party coverage components 

• Breach event and remediation costs 

• Damages to your brand/reputation/image 

• System failure(s) 

• Cyber extortion (ransomware) 

• Cybercrime (fraudulent funds transfer) 

• Complete failure/loss of electronic equipment 

• Property damage loss 

• Payment of a reward for the provision of information 

• Court attendance costs 

• Business Interruption 

Third-party liability coverage components 

• Multimedia liability (copyright, libel, slander, etc.) 

• Security & privacy liability (the failure to protect a customer’s information) 

• Regulatory defense and penalties (fines and defense expenses from regulatory agencies) 

• PCI DSS (Payment card industry data security standard) liability 

• Bodily injury liability 

• Property damage liability 

• A TCPA (Telephone Consumer Protection Act) defense 

The cost of cyber liability insurance has risen dramatically over the past year. However, as demonstrated above, the potential liability is great. There are many cyber liability products in the market, both from traditional insurance companies and new “insurtechs” that leverage technology to write cyber liability policies with the backing of larger, established insurance companies. It is worth talking to a few different entities about cyber liability insurance until you find one that meets your needs. 

The Missouri Bar has assembled scores of resources for members looking to protect a practice. Members can learn more about the insurance options available from Missouri Bar member benefit providers here. The Bar Plan is a proud Missouri Bar member benefit provider and the only endorsed carrier of Professional Liability Insurance for The Missouri Bar.

This is the first article of a three-part series from The Bar Plan Mutual Insurance Company. The second part will be published Dec. 29 and the third part Jan. 12, 2022. In the series, the authors will describe the common types of insurance that lawyers and law firms should consider purchasing. The coverages included in this series are by no means an exhaustive list but are intended to provide you with a starting point to determine the coverages that are necessary for you and/or your firm.

Legal malpractice claims arise from a lawyer’s actions or omissions falling below the standard of care when providing legal services to a client. So, how necessary is it to get Lawyers’ Professional Liability “LPL” Insurance – a.k.a. legal malpractice insurance? I would argue it’s essential based on the risk shown by recent data.

The Missouri Department of Commerce & Insurance publishes a Legal Malpractice Insurance Report once a year and it recently released the 2020 report. In 2020, 138 legal malpractice claims were closed, with 63 resulting in payments totaling $11.6 million. The average payment for a successful claim was $184,606.

Nearly 97% of paid claims involved lawyers who had been practicing for 10 years or more. The areas of practice that saw the most claims were bodily injury/property damage – plaintiff; estate, trust, and probate; family law; bodily injury/property damage – defendant; and collection and bankruptcy.

Deanna Brady, senior claims counsel at The Bar Plan, previously wrote an article that summarized some of the factors to look for when purchasing an LPL policy. She emphasized that when making the decision on the amount of policy limits for legal malpractice insurance, there are many factors to consider, including the:

• potential exposure based upon the types of cases,
• cost of defense of a legal malpractice claim,
• jurisdiction in which a claim could be brought, and
• nature and extent of both business and personal assets as they could potentially be subject to collection under a judgment if the lawyer is underinsured.

“High risk” areas of practice

When considering lawyers’ professional liability insurance, certain areas of practice – such as trusts and estates, plaintiff’s personal injury, securities, and intellectual property – may carry a higher risk in terms of the likelihood of a legal malpractice claim or the cost to defend or resolve the claim. Many lawyers believe the risk of claims being filed against them is minimal. However, mistakes happen. Some may find themselves in a situation where they are liable for not only their own mistakes, but also mistakes by a partner, associate, paralegal, or legal assistant within their firms.

In addition to evaluating potential exposure based on the types of current cases your or your law firm handles, lawyers should also consider past cases – this is especially true for those that practice in trusts and estates. It may be that the lawyer no longer represents large estates. Therefore, he or she may believe lower limits of liability are now appropriate. However, trusts and estates pose more risks for legal malpractice claims as non-client beneficiaries may have standing to sue. Additionally, the statute of limitations may not begin until the death of the client and the alleged negligence is discovered. As most lawyers’ professional liability policies are claims-made and reported policies, lawyers could be exposed to potential liability from estate planning conducted decades in the past. If the estate was a large estate, the lawyer may not be adequately insured to pay the client or the third-party beneficiary completely or defend the merits of the claim based upon current limits of liability.

The cost to defend – even in other jurisdictions

When choosing policy limits, a lawyer should be concerned about the potential damages that may stem from a potential lawsuit, as well as the cost to defend the lawsuit. Most legal malpractice insurance policies, unless a separate defense expense limit is purchased, are eroding policies. These policies are also referred to as wasting or “pac-man” policies because the limits of liability are reduced by the cost for defense and any expenses incurred.

The defense expenses are paid first, which reduces the amount available to pay any potential damages. If the policy limits are exhausted by the defense costs, the insurance carrier may have no further duty to defend an insured lawyer, and there will be no limits remaining to pay on any judgment or settlement later reached. When this occurs, the insured lawyer’s business and personal assets could potentially be subject to collection under a judgment. If limits of liability are very low, it is possible that the costs of defense would exceed the policy limits; thus, making it very difficult for the lawyer to defend their actions.

It is also possible for a lawsuit to be filed in another, more costly jurisdiction, than the jurisdiction in which the lawyer practices. While the insured lawyer’s policy limits may be adequate to properly defend a claim and/or make an indemnity payment in the lawyer’s practicing jurisdiction, the same may not be said for the foreign jurisdiction.

Office sharing

If lawyers who share an office look like a firm to potential clients, it is possible for the negligence of one of the lawyers to be imputed to others who share the office. While steps should be taken to avoid any confusion, be aware of the potential damages that may stem from the liability of the other lawyers in the office. While one lawyer may practice in an area of law that poses low risk for legal malpractice claims, the same may not be said for other lawyers who share the office. If a claim is made against one for the negligence of another in an office-sharing group, lawyers may find they do not have adequate coverage to defend the claim or to make an indemnity payment.

Common misconceptions

A common misconception about legal malpractice claims is that having more insurance coverage would invite larger claims. However, if the limits of liability are low, an opposing lawyer may use that to their advantage and make an inflated opening demand to leverage their client for maximum recovery. While it is difficult to plan for this type of tactic, it is easier to defend the claim on its merits if sufficient limits of liability are in place.

While the lawyer and the insurance carrier want to compensate the claimant for the malpractice, given the low limits, the lawyer may not have the opportunity to dispute the damages or the merits of the underlying case. The lawyer may find themselves in a situation where a decision is made to pay the policy limits to the claimant rather than argue over damages and reduce the available limits for a potential judgment or settlement. Having adequate policy limits ensures that the insured lawyer can properly defend or settle a claim on its merits and not based on the amount of policy limits available.

Finally, when contemplating your limits of liability, consider all potential exposure based on your clients and the costs of defense for a legal malpractice claim. Being adequately insured affords lawyers the opportunity to make clients whole should a mistake occur, as well as defend themselves and their actions – especially when liability is questionable.

The Missouri Bar has scores of resources for members looking to protect a practice. Members can learn more about the insurance options available from Missouri Bar member benefit providers here. The Bar Plan is a proud Missouri Bar member benefit provider and the only endorsed carrier of Professional Liability Insurance for The Missouri Bar.

Depending on your firm’s size, you may be one of several people, one of a few, or the only person who know how to do important firm tasks. This compartmentalization has strengths and weaknesses. For example, limiting access to financial accounts reduces the possibility of theft or falling victim to a phishing or wire fraud scheme. Compartmentalization is a form of security. On the other hand, core business functions must continue even if the managing partner, office manager, or other high-ranking employee is unavailable or compelled to take an extended, unplanned absence. Most such events are unhappy occasions – perhaps an illness impacting the employee or an elderly parent’s health. You can’t put off payroll, health insurance premiums, or rent payments indefinitely because the person who “always does that” is unavailable for an indefinite period.

Moving from the grim to the practical, unlock the knowledge stored in each staffer’s head, including your own, by documenting fundamental business processes. This brings several advantages:

1. Nobody needs to be interrupted while on vacation because a coworker couldn’t complete a form or find something;
2. The firm has a resource to help train new hires;
3. The simple act of documenting your processes naturally leads you and your team to evaluate whether that process still makes sense; and
4. If you are a solo or small firm, when you choose to retire, your “process cookbook” adds value to the firm, offering interested parties something beyond a rolodex to buy (see this related blog on succession planning for lawyers firms).

Step by step

When working with firms to create good processes, I’ve found it helpful to speak in terms of a “cookbook” and “recipes” rather than “manuals” or “process maps.” Familiar vocabulary helps make what could be seen as a remote and unfamiliar activity more approachable. We’ve listed out what you need to complete a task (“ingredients”) and the order in which you do things to get the right result (the “steps” in our “recipe”). We’ll also group similar recipes together for easier locating later (our “cookbook”). Here’s an example:

Returning original documents to a client
Hopefully your firm has embraced paperless practicing. (If not, see this blog to get started down that path.) A core part of a paperless firm (or paper less if you’re still transitioning) is keeping those original documents you need for specific reasons – such as something that statutorily requires an original document – and returning all other original documents to the client.

Ingredients
To send originals back to the client, we need the following ingredients:

• the original documents;
• name and address of the client;
• a cover letter;
• a mailing label; and
• an appropriate envelope or other shipping container.

Steps
Here are the steps to prepare and mail the documents:

1. Confirm that the documents are scanned and in the firm’s document repository.
2. Decide how documents will be sent (e.g., US Mail, UPS, etc.).
3. Place documents in an appropriate envelope or shipping container.
4. Prepare a mailing label with the appropriate delivery service.
5. Open the cover letter template. If your firm doesn’t use document templates, see the Why Template Building is Critical for All Law Offices white paper and the “how to” checklist on Getting Started with Document Automation.
6. Type in the client’s information, method of delivery, and delivery tracking information.
7. If you don’t have a digital signature stamp, print the document for the sender to sign. If you do have digital signature stamps, apply the appropriate stamp to the document and print the letter. To learn more about digital signatures, take this CLE.
8. Place the cover letter in the envelope or shipping container.
9. Seal the envelope or container.
10. Place the mailing label on the envelope or container.
11. Place the envelope or container in the outbox or call for a pickup, as appropriate.

With that, we’ve written our first recipe together or, in business-speak, mapped our first process. You can probably already imagine similar recipes or processes that would accompany this one in a cookbook or employee manual: sending and receiving intake forms from new clients; sending and receiving discovery documents; and sending paper invoices and receipts of payment.

Learning along the way

The first time you and your team sit down and document the steps in fundamental processes – such as taking information from a client and generating draft corporate formation documents or estate planning documents for a lawyer to review – will take a while. Here are two tips to make this process easier:

Tip 1: Have the people who do the work lead that portion of the mapping. In our “returning originals” recipe above, if one person is responsible for drafting correspondence, that person takes the lead in outlining what happens currently. You gain nothing substantive by just having higher-ups guess or declaim what the process is or should be. There’s a reason the process works this way now. It could be good. For example, the typist always asks the lawyer for the client’s address because the firm’s central client address book is reliably inaccurate or incomplete. Or it could be bad. For example, the typist doesn’t look up the address in the central client address book because that person was never trained how to do so or lacks access to the system. The first step is knowing what happens now.

Tip 2: Through the process mapping exercise, you will discover things you’ll want to note for later examination or remediation. In reading our “returning originals” recipe above, maybe you learned about document templates for the first time. Creating a template so typists don’t continually recreate cover letters from scratch would save time. Same thing with digital signature stamps. Make a note and set it aside as two things to investigate for process improvement.

In the case of our typist lacking training or access to the client address book, that’s a remediation issue. Granting access is likely either a few clicks or the purchase of an additional license. If it’s a training issue, most vendors are happy to help train employees on their products. It’s a simple thing to solve.

Having the employees on the “front lines” leading the relevant process mapping gives you an honest view of what happens now, offering you the clearest perspective of where potential changes might bring great long-term gains or quickly eliminate initially unnoticed bottlenecks.

Getting started

Head over to our Practice Management Center to get started making your recipes for business success. Here are resources to guide the way:

• Everything has a Process Part 1 - How to Identify Yours: This whitepaper includes process mapping tips.
• Everything has a Process Part 2 - How to Improve Yours: This whitepaper discusses breaking large processes into smaller ones.
• Process Workflow Worksheet with Sample Workflow: This Excel document will guide you through documenting each step in a process.

Missouri Bar members have access to hundreds of white papers, checklists, comparison charts, and articles for those looking to open, build, manage, protect, or wind down a law practice. Have questions? At no cost, members can ask an expert their legal technology or practice management questions via email or by scheduling a one-on-one, remote consultation.

Lawyers have an ethical obligation to preserve client confidentiality. For that reason, the need to protect client information has always been a top priority for lawyers. This means that when lawyers and their staff work remotely – a practice that has become commonplace due to the pandemic – it’s all the more imperative for lawyers to ensure that confidential client data is protected when communicating electronically. 

Because so many lawyers and staff have worked remotely over the past year, law firms have increasingly relied on online communication and collaboration tools when interacting with clients. Of course, this newfound uptick in the use of electronic communication methods has impacted the ethical obligations that lawyers have when it comes to preserving client confidentiality. That’s why it’s important for law firm leaders to understand cybersecurity issues and how those problems may affect their displaced workforces, especially since lawyers and other law firm employees will likely continue working remotely and communicating electronically for many more months. The good news is law firms have solid options when it comes to secure online communication. 

Client portals: a more secure option than email 

Since the mid-1990s, lawyers have communicated with clients via electronic means, and for many years email was an accepted way to interact with clients electronically. However, because email is inherently unsecure and is like sending a hand-written postcard through the post office, it has begun to fall out of favor – both ethically and practically – as technology continues to improve. 

That’s why ethics committees and cybersecurity security experts have increasingly recommended methods other than unencrypted email when communicating and collaborating with clients online. For example, in 2017, the American Bar Association Committee on Professional Ethics concluded in ABA Opinion 477R that due to “cyber-threats and (the fact that) the proliferation of electronic communications devices have changed the landscape … it is not always reasonable to rely on the use of unencrypted email.” Instead, the committee recommended that for particularly sensitive matters, lawyers should consider using encrypted communications, including encrypted email and the encrypted client communication portals built into law practice management software. 

Florida issues secure communication guide 

Recently, The Florida Bar issued an updated secure communications guide that included recommendations relating to remote work during the pandemic. This comprehensive guide, “Best Practices for Professional Electronic Communication,”offers an in-depth overview of the issues that arise when lawyers communicate and collaborate with clients electronically. The types of electronic communications addressed in the guide include texting, email, social media, telephones and cellphones, laptops, and court appearances via videoconference. 

Email is easily hacked 

The authors of The Florida Bar’s communications guide focused on the technology issues that lawyers need to keep in mind when communicating with clients through unencrypted email. An important factor emphasized in the guide was the need for lawyers to understand the risks associated with using technology, including email. The authors emphasized how unsecure traditional email is and encouraged lawyers to find a more secure way of communicating with clients. 

As they explained, the reason for this recommendation is that email is easily hacked. That’s why, according to the authors, if the situation should arise where a lawyer must use email, it’s important to scan each and every email that is received and sent: “Attachments may contain malicious software code. Use scanning software for both outbound and inbound emails.” 

Emails can be easily intercepted 

The authors also addressed the likelihood of bad actors interfering when using email. They cautioned that because email is inherently unsecure, it can be easily intercepted. Fortunately, they explained, one way to mitigate that risk is to use an encrypted email service: “There is always a chance that your email may be intercepted. Many of these risks are mitigated if not entirely eradicated when using an encrypted email service.” 

Of course, email encryption technology often requires the assistance of an IT expert with the ability to set up this type of system – something that can oftentimes be a complex endeavor. Nevertheless, for some law firms, encrypted email can be a viable option. 

Client ports are a secure and easy-to-use form of communication 

The authors also turned to secure client portals. Due to the risks inherent in email, they recommended that lawyers consider using secure client portals like the ones built into law practice management software. They shared that client portals are a secure, safe, and easy-to-use alternative that is one of the best ways to ensure that confidential information is preserved whenever you communicate and collaborate online with clients: “Secure client portals are an emerging and safe alternative to email. There are many case and practice management systems that offer a client portal component. You should seriously consider this option as a method of communication for confidential information.” 

Missouri Bar members receive discounted rates from top practice management solutions including MyCase. To find the practice management solution that’s best for you, check out The Missouri Bar’s practice management features checklist, cloud-based practice management comparison chart and traditional practice management comparison chart. Need additional help selecting a practice management solution? Members can schedule a no-cost, one-on-one consultation with the experts at Affinity Consulting Group.  

Reprinted with permission of MyCase. 

Succession planning is all about leaving a legacy. Lawyers who built their firms from the ground up and who contributed blood, sweat, and tears to the firms deserve to leave their marks. Leaving your legacy requires years of strategic planning and decision making. 

When considering your legacy, you must think about the people who will carry the torch once you retire, the core processes that keep business running smoothly, and how to successfully transition work and clients to those who follow in your footsteps. 

First Rate Players: You can’t plan for succession without planning for those who will succeed you. Early identification of star players provides you with time to mold them into stellar leaders and rainmakers. The sooner you start working with these key players, the more time you have available to help shape them into whom the firm needs them to be. 

Fundamental Processes: Every firm is driven by numerous fundamental processes. Leaving a legacy requires identifying those processes and documenting every step in that process, from client intake to closing letter. Process documentation has immediate benefits. New hire on-boarding is more efficient, and process documentation helps get everyone in the firm on the same page. 

While documenting processes, look for areas of potential improvement and gaps in the firm’s coverage. Ensure there is a backup for each task. Should someone suddenly leave the firm, you don’t want to be left in the lurch. 

Future Transitions: Transitioning work and clients is never easy. The most successful transitions start before retirement is on the horizon. When possible, ensure that every client works with and trusts at least two lawyers in the firm. Your clients must be comfortable with your replacement before you decide to retire. 

Train associates to handle every type of matter that comes in. Work side-by-side on the complicated matters and provide them guidance on how to handle the thorniest issues. Then, when you are ready to retire, they will be ready to handle the workload. 

Succession planning isn’t easy. It requires strategic planning and must be kept in mind with every decision your firm makes. It is never too early to start planning for retirement. 

Missouri Bar members can access white papers, checklists, and charts related to succession planning and process documentation, including the Planning Ahead Guide, at mobar.org/LPM.   

Members can also email their questions to or set up a one-on-one remote consultation with Affinity Consulting Group. 

For example, the rule seeks to prohibit a lawyer who formerly worked for the government from improperly using confidential government information, say for the advantage of a future private client. The rule attempts to limit potential problems without unduly hampering the government’s ability to recruit good lawyers, primarily by loosening the strict imputation rule.

The Rule

It may be helpful to categorize Rule 4-1.11’s lettered subsections. Subsections (a), (b), and (c) are directed to lawyers who formerly served as government officers or employees. Subsection (d) addresses lawyers currently serving as government officers or employees. Subsection (e) applies to lawyers holding public office. Subsection (f) defines “matter” as it is used in Rule 4-1.11.

Subsection (a) prohibits a former employee of the government from representing a client in a matter in which the lawyer personally and substantially² participated when the lawyer worked for the government, unless the government gives informed consent,³ confirmed in writing,⁴ to the representation. Additionally, the former government lawyer is subject to Rule 4-1.9(c), which prohibits use or revelation of information relating to a matter in which the lawyer formerly represented a client.

An example of a scenario contemplated by subparagraph (a) follows. Unless the Missouri Department of Natural Resources gives written, informed consent, a former staff lawyer for the department who, while a department lawyer, worked on a case alleging a company released pollutants into the waterways in violation of state regulations is prohibited, or should be disqualified, from defending the company against those allegations after going to work for a law firm.

In accordance with subparagraph (b), the law firm, which had been defending the company before it hired the lawyer from DNR’s ranks, may continue representing the company if it promptly notifies DNR that the lawyer has become associated with the firm and timely screens the lawyer from any participation in the matter.⁵ The notice is intended to allow the government agency the opportunity to assure itself that proper screening has occurred. Further, the disqualified lawyer is prohibited from receiving any part of the fee directly relating to the representation.⁶ Continued representation by other lawyers in the firm, with notice and screening, is allowed here while it is not in a private practice to private practice scenario, where disqualification is imputed to all the lawyers in the new firm.⁷ The rationale for not imposing strict imputation in the government to private practice scenario is discussed in Comment 4. One factor is the fear that the stricter rule would inhibit government recruiting of qualified lawyers, who might shy away from government service if their future job prospects in the private sector are constrained by the prospect of a firm’s loss of clients due to strict imputation.

Subsection (c) prohibits a lawyer who previously worked for the government, and who acquired “confidential government information”⁸ about a “person” while so employed, from representing a client whose interests are adverse to that person in a matter in which the confidential government information could be used to the material disadvantage of that person. The firm with which the disqualified lawyer is now associated is permitted the continued representation if the disqualified lawyer is screened and is apportioned no part of the fee directly related to the representation.

As an example, if a lawyer learns, while working as an assistant attorney general, that the individual is about to be indicted for tax fraud, the now former assistant attorney general could not use that confidential information, say in settlement negotiations, to the material disadvantage of the individual in the course of litigation while practicing in his or her new firm. Again, the restriction is not imputed to other members of the firm, who may litigate against the individual so long as the former assistant attorney general is screened and apportioned no fee directly from the litigation.

Subsection (d) applies to lawyers currently serving as public officers or employees and addresses conflicts the lawyers may have with former client matters. The lawyers now working for the government are subject to Rule 4-1.7, the concurrent conflict of interest rule. The lawyer is also subject to all the provisions of Rule 4-1.9. Subsection (d) thus counsels a lawyer moving from private practice into government service from handling matters the lawyer participated in “personally and substantially” while in private practice. For example, a private practice lawyer who was defending a client in a criminal case should not continue the representation after taking a position as an assistant prosecuting attorney in the county where the charges were pending.⁹

A more complicated scenario occurs when a lawyer leaves a position as a government employee and moves to another government job, specifically when a public defender moves to a prosecuting attorney’s office. The Supreme Court of Missouri, in State v. Lemasters,¹⁰ discussed Rule 4-1.11 in the context of a lawyer who left the public defender’s office and went to work as an assistant prosecutor in the same county where she had been defending a client against criminal charges. The former client, Lemasters, moved to disqualify all of the lawyers in the prosecuting attorney’s office on the grounds that his former lawyer’s conflict disqualified all of the lawyers in the office.

The court found that Lemasters’ former lawyer, who was a former government lawyer due to her prior position in the Missouri State Public Defender system, was disqualified by Rule 4-1.11(a) from participating in any way in Lemasters’ prosecution. Rule 4-1.11(a)(1) also prohibited the lawyer from revealing any information relating to Lemasters to her new colleagues or using any information to Lemasters’ disadvantage. The evidence showed the new prosecutor had complied with these obligations.¹¹

Lemasters nevertheless argued that his former lawyer’s conflict should be imputed to all the lawyers in the prosecutor’s office. In analyzing Lemasters’ claim, the court found Rule 4-1.11(b)’s conflict imputation language did not apply to the “public defender to prosecutor” scenario because that subsection applies to a job move to a “firm,” a word that does not include lawyers working together as government employees, such as in a county prosecutor’s office.¹² Instead, the court found Rule 4-1.11(d), “which deals with conflicts arising from prior representations by current public officers or employees,” (emphasis in original) applied to the Lemasters scenario. The court noted there was no imputation language in Rule 4-1.11(d) and cited the language in Comment 2, which states the subsection does not impute the conflicts of a lawyer currently serving as a government employee to associated employees, while noting that screening would be prudent.¹³

Rule 4-1.11(d)(2)(ii) prohibits a lawyer currently working for the government from negotiating for a job with a party in a matter in which the lawyer is participating “personally and substantially.” An exception is made for judicial law clerks, so long as the clerk notifies the judge about the job negotiation.¹⁴

Subsection (e) addresses lawyers who “also hold public office” and prohibits engagement in activities in which the lawyer’s personal or professional interests conflict with the lawyer’s “official duties or responsibilities.”¹⁵ Comment 11 notes a public official’s position on policy matters may conflict with a client’s interests. Nor is the lawyer holding public office permitted to “attempt to influence any agency of any political subdivision” for which the lawyer serves as a public officer, except as part of the lawyer’s official duties or as authorized by §§ 105.450 RSMo to 105.496 RSMo.¹⁶ Other lawyers in a firm in which the lawyer holding public office is associated may continue or undertake a matter the public officer would be disqualified from pursuing so long as that lawyer is screened.¹⁷

Subsection (f) defines “matter” for the purposes of Rule 4-1.11. Notably, matter is defined to include decisions involving a specific party or parties, which may be a narrower definition than is found in Rule 4-1.9.¹⁸

Conclusion

Conflicts analysis can be complicated. Supreme Court Rule 4-1.11 specifically applies to a lawyer who leaves government service to work in the private sector, who leaves a private practice to join the government, or who moves between government positions. The rule should be read, and reread, by lawyers transitioning into and away from government service.

Endnotes

1 Sharon K. Weedin is staff counsel for the Office of Chief Disciplinary Counsel in Jefferson City.

2  Rule 4-1.0(l).

3  Rule 4-1.0(e).  See also Rule 4-1.11, Comment 1, where it is acknowledged that statutes or regulations may inhibit a government agency’s authority to give consent.

4  Rule 4-1.0(b).

5  Rule 4-1.0(k), and Rule 4-1.11, Comments 9, 10, and 11.

6  Rule 4-1.11, Comment 6 clarifies that the disqualified lawyer may receive any salary or partnership share established by independent agreement.

7  Rule 4-1.10, the general rule concerning imputation of conflicts of interest. In most cases, the conflicts of an incoming lawyer are imputed to all members of the firm, without the possibility of screening. Rule 4-1.10(d) specifically carves out an exception to the strict imputation rule for former or current government lawyers and cites Rule 4-1.11.

8  Confidential government information is defined in Rule 4-1.11(c) as “information that has been obtained under governmental authority” and which, at the time the rule is being applied, the government is prohibited from disclosing and is not otherwise available to the public.

9   In re Smith, 29 So.3d 1232 (La. 2010).

10 State v. Lemasters, 456 S.W.3d 416 (Mo. banc 2015).

11 Id. at *420.

12 Id. at *421.

13 The Court confirmed its Lemasters reasoning in State ex rel. Peters-Baker v. Round, 561S.W.3d 380 (Mo. banc 2018), in which a defendant unsuccessfully argued for the imputed disqualification of an entire prosecutor’s office due to his former public defender’s move to that office.

14 Rule 4-1.11(d)(2)(ii); Rule 4-1.12(b).

15 See Rule 4-1.7.  Subsection (e) in Missouri’s Rule 4-1.11 is not found in the Model Rules of Professional Conduct. 

16 Chapter 105, Public Officers and Employees, RSMo.

17 Rule 4-1.11, Comment 10, provides context for the word “matter” as it is used in this subsection.

18 See ABA Comm. On Ethics and Professional Responsibility Formal Op. 97-409 (1997).

Jennifer M. Ramovs
Jennifer M. Ramovs is the director of practice management at Affinity Consulting. At no cost, Missouri lawyers can email their practice management questions to an expert or schedule a one-on-one, remote consultation. Ramovs is available at

Whether a firm is the new kid on the block or a venerable institution, it is undeniably susceptible to a catastrophe that can appear with little notice while wielding devastating results. However, that is not to say firms are helpless to the powerful hands of the fates. With a handful of best practices, Missouri lawyers can protect their firms, teams, and clients from a disaster that might knock the proverbial wind out of a business, but most importantly, never render it irreparably harmed. If lawyers are diligent with their preparation and willing to embrace beneficial technologies and procedures, these simple tips can insulate them from the constant threat of disaster.

Get Organized

The first step in preparing for the unforeseen is to organize all files, including client files and employee documentation. This critical, initial step should encompass paper files as well as electronic data, making sure everything is concise and put into its proper place. Lawyers should use offsite, deep storage facilities whenever appropriate, as long as the facility has its own adopted procedures and mechanisms to mitigate the impact of a disaster.

Leverage Technology

Obviously, in this digitized world, data plays a critical role in nearly every aspect of a firm’s operations. As such, preserving the integrity of that data in the face of a natural disaster should be an ongoing priority for every firm. Continuing the previous step of getting organized, proper offsite storage of vital digital information must be adequately secured from both the forces of nature as well as human-based threat.

Any cloud-based data storage must be properly encrypted and secured to prevent highly sensitive information from slipping into the hands of the black hats of the world. Finding and maintaining such protocols should be mandatory for a firm’s IT department as a constant influx of case files, documentation, and client communication requires a continually fluid yet perpetually secure storage solution.

Neither courts nor clients will pause if a disaster strikes a firm, so it’s important to be prepared to seamlessly hit the ground running, no matter what catastrophes might come. Remember, locally based servers providing data backup can still make a firm susceptible to disaster if a regional calamity strikes a business, the storage provider, or the surrounding area.

Have a Preparedness Plan

Of course, in the event of a disaster, the immediate priority must be to protect staff from harm. Routinely practicing evacuation procedures makes certain all team members know precisely what to do in the event of an emergency. Regarding the office itself, lawyers should formalize a disaster plan with the office manager or equivalent, creating a list of all parties a firm might need to contact.

A preparedness plan should include insurance companies, vendors, property management, financial institutions, local first responders, and any contracted security providers or alarm systems. Firm leaders should also keep ongoing, detailed files of belongings – including office equipment, furniture, and anything else that would need to be replaced by an insurance carrier.

While it is impossible to completely shield a firm from the significant impact of disaster, even unforeseen and devastating events are not insurmountable with a bit of time, effort, and diligence. Most importantly, lawyers shouldn’t think disasters can’t or won’t strike their firms; staff, clients, and efforts are too important to underestimate nature’s indifference. Lawyers can check out The Missouri Bar’s Law Practice Management site at mobar.org/LPM for more resources to be prepared.

Endnote

1 Jennifer M. Ramovs is the director of practice management at Affinity Consulting. At no cost, Missouri lawyers can email their practice management questions to an expert or schedule a one-on-one, remote consultation. Ramovs is available at jramovs@affinityconsulting.com.

Have you tried to compare products or services slightly off the beaten consumer path? Or well-known products for a non-marquee feature? Despite that product’s market being worth tens to hundreds of millions of dollars, the information is difficult to come by. 

If you’re in the market for a pillow or bedsheets, there are obvious sources of information such as the website Consumer Reports that rate pillows and bedsheets on relevant categories like softness, durability, and ease of cleaning, for example. Easy enough. But suppose you want to buy a pillow made in America or in a union shop? It’s harder to come by that information in part because most buyers are not including those features in their buying decisions. In that case, your best recourse is to look for manufacturers who brag about location or employees. You could also look to sites that promote “Made in America” products. 

The same information gap occurs with tech products too. To begin with, honest feature comparison sites that aren’t littered with ads are hard to come by for the general consumer. And once found, those sites target the broadly relevant features. Websites like PC Magazine or CNET will compare Dropbox, OneDrive, and G Drive, but they’re unlikely to do so with a legal professional in mind. General audience news sources will talk price, speed, and ease of use, all relevant to legal professionals as well as the general public, but they won’t address more esoteric things important to lawyers. A PC Magazine comparison won’t address data center locations, what the service does when served with a subpoena or warrant, or how you could use a “roll your own” encryption on top of the service. 

For legal-specific products, the problem is worse. While potential buyers can compare Dropbox, OneDrive, and G Drive, software and services targeted at legal professionals have websites and marketing materials that often offer vague descriptions of capabilities, lacking important caveats, and many times hide pricing behind a “Request a Consultation” form that results in a sales call. 

These problems are exacerbated because lawyers, particularly those new to the profession or unaccustomed to comparing and choosing software, may lack a good idea of what features they want in a practice management solution, for example. 

Using Your Resources to Make Good Legal Tech Decisions 

That’s where the Law Practice Management Resource Center come into play. We’ve collected and analyzed information in key law practice tech areas so you don’t have to. Let’s walk through an example: 

Suppose you find your case and matter organization lacking. You can’t access documents unless you’re in the office. You rely on one or more people to figure out what, if anything, a client owes you and how much, if anything, the client has in their trust account. A client calls, texts, or emails you inquiring about case statuses, and you spend time rifling through emails, handwritten notes, and your memory to give updates. You talked with clients all day but, at the end of the day, are hard-pressed to remember who you talked to for how long and what was discussed. The clients are happy, but poor recollection has cost you billable time. Not good! 

If we treat this like a law school exam, we can unpack it and get an idea of issues this law office should address when evaluating a new practice management system. 

• Document access: You want to be able to access documents from outside the office. Is it just documents or do you also want access to case information? How important is it that access works well on tablets or iPhones, or is good laptop access enough? 

• Accounting: You want to know what the client owes and what’s in his trust account irrespective of whether the bookkeeper or support staffer, if any, is reachable. Do you want to know other financial information as well, like upcoming rent or office supply bills in the same program? If not, what accounting program do you use now, and will it share data with your prospective practice management program? Should clients be able to see and pay bills over the internet? 

• Case status: Most practice management programs hold general case information, party contact information, calendar dates, and tasks. Most also have some form of document storage. All would be an improvement over the “rifling lawyer” in our hypothetical scenario, but there are wrinkles in the options. How important is mobile access and from what device? Many programs can capture email and sync calendars and contacts but are you a Microsoft 365 or Google Workspace firm? Many products, particularly the web-based ones, offer client portals where the client can see upcoming appointments, share documents, exchange secure messages with the lawyer, and see bills. Is this case status “self-help” a feature you want? Some programs integrate with voice over internet phone (VOIP) systems so phone call numbers and length become proposed time entries, so you don’t lose billable time as in our hypothetical situation. How valuable is that? 

As with a law school exam, our one paragraph hypothetical became three paragraphs of additional questions and considerations. You don’t want to do all the leg work yourself! 

Our Law Practice Management Resource Center offers checklists and whitepapers to spur these types of questions. Find the checklists (here and here) and whitepaper relevant to practice management software on our Law Practice Management website. Once you’ve picked your “must have” features and prioritized their importance, then head over to the Checklists and Charts resource, scroll down to the “Manage a Practice” heading, and you’ll find two relevant comparison charts. The “Practice Management Server-based” comparison chart compares vendors offering software that would install on a desktop or server that you maintain. This route is popular with lawyers who have more complex needs, want to integrate with other desktop software such as PCLaw or Microsoft Word, and those who don’t want client data stored with a cloud-based provider. The “Practice Management Cloud-based” comparison chart compares vendors whose offerings run in a web browser, requiring little to no software maintenance on the user’s side. This route is better for lawyers newer to practice, those who are more mobile, those who desire tablet or smartphone apps, and those who don’t want to make an upfront investment in software and hardware to run traditional software. 

The comparison chart organization makes feature analysis easy. For example, if you are committed to desktop/server software over a web-based solution but want the ability to email or text appointment reminders to clients, then Coyote Analytics is your answer. Or if you’re committed to a web-based offering but want offline access to case information because you have spotty internet, then Smokeball is your answer. Missouri Bar members receive discounts on many top practice management programs, including Smokeball, at the Member Benefits section of the bar’s website. 

Finally, once you’ve selected a practice management solution, be sure to clean up your data before moving case and billing information to the new system. 

Much More to Discover 

Practice management software is just one example of high-value, legal tech decisions that the comparison charts can help you make. Comparisons exist for everything from document management solutions (that can talk to your practice management solution) to document assembly tools (that can pull information from practice management software into documents) to voice over internet phone (VOIP) that can automatically create times from phone calls. Visit all the checklists and comparison charts available for bar members. 

If you have any questions or want information from experts who’ve implemented these solutions for law practices and legal organizations, visit LPM’s Ask an Expert to email questions or schedule a phone or video call. 

Kayla Kemp

Kayla Kemp is staff counsel at the Office of Chief Disciplinary Counsel.¹

Thankfully, there are an abundance of resources and technological solutions which can be utilized to facilitate practicing during a pandemic. As lawyers, we must be mindful to ensure that as we adapt, we must continue to meet our ethical duties under the Missouri Rules of Professional Conduct (“Rules”). 

Planning for Incapacitation During a Pandemic

Lawyers should be prepared to adapt to a rapidly changing environment, whether that be a natural disaster, pandemic, or some other act of God. Not only do we need to be prepared for abrupt changes to the ways in which we meet with clients or appear before courts, but we also need to be prepared for incapacity, more so now than ever before. Like the general population, our profession’s population is increasingly aging. According to the 2020 American Bar Association Profile of the Legal Profession, the median age of lawyers as of 2019 was 47.5 years old.² Nearly one in six lawyers are 65 or older.³ This is notable because the Center for Disease Control (CDC) warns the risk for severe illness with COVID-19 increases with age. Those who are 50-64 years of age are four times more likely to be hospitalized than the comparison group, which consisted of those 18-29 years old. The risk of death was 30 times higher for those 50-64 years old compared to the comparison group.⁴ Those figures increase with each following age group. Nonetheless, every lawyer must consider the possibility of becoming incapacitated with little to no notice.

Lawyers should ensure that, in the event of incapacity, they are comporting with ethical obligations. One way to ensure compliance is to have a succession plan in place. Rule 5.26 allows lawyers to take an important step in ensuring that representation is not disrupted by sudden incapacity. Now is a good time to consider designating a trustee pursuant to Rule 5.26, which allows a lawyer to choose someone who can take over the lawyer’s legal practice upon an unexpected absence. By selecting a trustee, you can involve that same trustee in your succession plan. By actively preparing for the possibility of incapacity, a lawyer can better facilitate a smooth transition in the event the unexpected occurred. Aside from designating a trustee, a plan should be developed for any event which may keep you out of your physical office. This plan should encompass how your usual means of communication will continue to be monitored. Someone will need to go to your physical office to check mail, voicemails, or faxes. Also, be sure to include clear instructions regarding receiving and retaining client records and property. For additional resources in succession planning, visit The Missouri Bar’s website, MoBar.org.⁵

Mental Health Concerns

The physical threat COVID-19 presents is not the only health risk. On Feb. 19, 2020, the American Lawyer released the results of its year-long “Mental Health and Substance Abuse Survey,” which found that 31.2% of the more than 3,800 respondents surveyed reported they were depressed. Additionally, 64% reported anxiety, 10.1% reported an alcohol problem, and 2.8% reported a drug problem.⁶ These findings predate the onset of the pandemic in the United States.

The CDC released findings noting that in June of 2020 the rates of depression and anxiety amongst adults in the United States were three to four times higher than the corresponding point in 2019.⁷ Approximately 40% of those surveyed reported struggling with mental health or substance abuse. According to the same study, rates of suicidal ideation, substance abuse, and alcohol consumption are steadily rising. Lawyers should familiarize themselves with the mental health and substance use resources available through The Missouri Bar.⁸ Depression and anxiety can result in lawyers neglecting their responsibilities and, therefore, harming their clients. Just as lawyers ought to be proactive in planning for physical incapacitation, lawyers should also be proactive in caring for their mental well-being. A lawyer who is grappling with these serious health issues needs to make every effort to seek help, such as through the Missouri Lawyers’ Assistance Program (MOLAP).⁹ Through MOLAP, all Missouri Bar members can speak with a licensed clinical social worker by calling 800-688-7859. The program is free and confidential.

Competence Amidst Chaos

The first obligation set forth in the Rules is that of competence. Rule 4-1.1 – Competence – Comment [6] dictates “[t]o maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology ... .”

Keeping abreast of changes to the practice of law necessities brings an awareness of the risks associated with working remotely. Despite the challenges presented during the current pandemic, lawyers have the duty to remain competent. Comment [3] to Rule 4-1.1 provides guidance on a lawyer’s ethical obligation during such a situation as a global pandemic:

In an emergency a lawyer may give advice or assistance in a matter in which the lawyer does not have the skill ordinarily required where referral to or consultation or association with another lawyer would be impractical. Even in an emergency, however, assistance should be limited to that reasonably necessary in the circumstances, for ill-considered action under emergency conditions can jeopardize the client’s interest.

In the event of an emergency, a lawyer may give advice in a matter the lawyer does not possess the skill ordinarily needed to provide such advice. Of course, advising without the necessary skill is only acceptable where referral or consultation with another lawyer is impractical.

Lawyers must continue to educate themselves on technological innovations which can be utilized to virtually serve their clients. Also, lawyers need to stay current on any legal changes that allow them to continue to meet clients’ needs to enter into contracts, update wills, or create personal health care directives.

Remote Notarization

On April 6, 2020, Gov. Mike Parson issued Executive Order 20-08 suspending a statutory requirement that a notary public must conduct such notarization of official documents while the signer personally appears. Executive Order 20-08 was set to expire June 15, 2020; then, Executive Order 20-12 extended remote notarization to Aug. 28, 2020. Subsequently, Executive Order 20-14 and Executive Order 20-19 extended remote notarizations until March 31, 2021.

The practice of remote notarization provides a secure and safe method to execute legal documents. Notarization can occur while utilizing audio-video technology, provided certain conditions are met: 

(1) If the signatory is not personally or otherwise known to the notary, the signatory must display a valid photo ID to the notary during the video conference;

(2) The signatory must affirmatively represent that they are physically situated in the State of Missouri, and the notary must be physically located in the State of Missouri and say in which county they are physically located for the jurisdiction on the notarial certificate;

(3) The video conference must be a live and interactive audio-visual communication between the signatory, notary, and any other necessary persons to allow for direct interaction at the time of signing;

(4) The notary must record in their journal the exact time and software used to perform the notarial act, along with all other required information; and

(5) The document must contain a notarial certificate, a jurat, or acknowledgement, which states that the signatory appeared remotely pursuant to Executive Order 20-14.

Electronic Notarization

While Missouri already permits electronic notarization, which is the use of electronic signatures and seals, Executive Order 20-14 allows for remote and electronic notarization to occur together when:

(1) The notary public is registered as an electronic notary public with the Missouri Secretary of State;

(2) The document must be electronically signed with a software approved by the Missouri Secretary of State; and

(3) The notary must affix the electronic notary seal to the electronic document.

Lawyers should do their due diligence and check with the Missouri Secretary of State to confirm they are using a registered remote notary¹⁰ and the software used to electronically sign the document¹¹ is approved.

Cyber Security

While there are many benefits to utilizing technology to facilitate legal services, there are also risks. For example, Zoom – a platform used to facilitate virtual audio and visual meetings – has had security breaches. In July 2019, a vulnerability in Zoom’s Macintosh desktop client was found which let malicious websites turn on a Macintosh user’s webcam without that user’s knowledge.¹² Then, in January 2020, another vulnerability was discovered. Unauthorized users could enter Zoom meetings that were not password protected and did not have Zoom’s Waiting Room feature – which allows for manual admission into Zoom meetings – enabled. Security flaws such as these are not unique to Zoom. Consequently, when utilizing third-party platforms, lawyers ought to take precautions such as using updated software and taking reasonable security measures.

Rule 4-1.6(c) specifies “[a] lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information of the client.” Comment [15] details the factors to be considered in determining whether a lawyer acted completely by undertaking reasonable efforts to prevent inadvertent or unauthorized disclosure of information related to client representation. The ABA’s Standing Committee on Ethics and Professional Responsibility issued Formal Opinion 477R, “Securing Communication of Protected Client Information,” which provides guidance as to security measures that should be employed given the ever-increasing cybersecurity threats that exist when transmitting information over the internet:¹³

However, cyber-threats and the proliferation of electronic communications devices have changed the landscape and it is not always reasonable to rely on the use of unencrypted email. For example, electronic communication through certain mobile applications or on message boards or via unsecured networks may lack the basic expectation of privacy afforded to email communications.¹⁴

While cyber security was a matter of grave concern in 2017, the threat of harm has only increased.¹⁵ In 2019, there were more than 5,000 data breaches reported.¹⁶ These breaches amounted to approximately 8 billion exposed records. Educating yourself on the various types of cyberattacks which can leave your client-confidential information vulnerable is the first step.¹⁷

Third-party Service Providers

For those lawyers whose devices are managed by a third party, include explicit terms in your contracts detailing which security practices are to be followed. These security features can include audits that report security status and the health of your devices. The National Institute for Standards and Technology and the Institute for Standards Organization provide best practices for guidance on how to strengthen your network’s defenses. Lawyers should consider including clauses in their contracts which detail how third parties will secure remote access. Methods to help secure remote access to your network include VPNs, multi-factor authentication, and rotating strong passwords. After all, Comment [1] to Rule 4-5.3 – Responsibilities Regarding Nonlawyer Assistants requires lawyers with managerial authority make reasonable assurances that the nonlawyers in the firm and those who work outside the firm act in a way compatible with the ethical obligations of the lawyer.

As technology evolves, so does our obligation to act reasonably under the Rules of Professional Conduct. And as we adapt, we must consider what further efforts we can take to meet our ethical duties. The current global pandemic has shifted our way of life, both at work and at home. It is important for every lawyer to understand the resources available to help alleviate the burden they may feel.

Endnotes

1 Kayla Kemp is staff counsel at the Office of Chief Disciplinary Counsel. Special thanks to Melinda J. Bentley, legal ethics counsel, whose presentation, “Ethical Considerations for Missouri Lawyers Practicing During the COVID-19 Pandemic: A Conversation with the Chief Disciplinary Counsel & Ethics Counsel,” was invaluable.

2 Am. Bar Ass’n, 2020 American Bar Association Profile of the Legal Profession (2020), https://www.americanbar.org/news/reporter_resources/profile-of-profession/.

3 Am. Bar Ass’n, 2020 American Bar Association Profile of the Legal Profession (2020), https://www.americanbar.org/news/reporter_resources/profile-of-profession/.

4 Centers for Disease Control and Prevention, COVID-19: Older Adults (2020), https://www.cdc.gov/coronavirus/2019-ncov/need-extra-precautions/older-adults.html.

5 The Missouri Bar, Planning Ahead: A Guide to Protect Your Clients’ and You Survivors’ Interests in the Event of Your Disability of Death (2005).

6 Lizzy McLellan, Lawyers Reveal True Depth of Mental Health Struggles, Law.com (Feb. 19, 2020, 11:00 AM), https://www.law.com/2020/02/19/lawyers-reveal-true-depth-of-the-mental-health-struggles/.

7 Czeisler MÉ et al., Mental Health, Substance Use, and Suicidal Ideation During the COVID-19 Pandemic – United States, June 24–30, 2020, MMWR Morb. Mortal Wkly. Rep. 2020;69:1049-1057 (2020). 

8 Coronavirus Resource Center for Lawyers, https://mobar.org/site/content/Lawyer-Resources/Coronavirus_Resource_Center_for_Lawyers.aspx?WebsiteKey=dd54fe1d-87c8-4d7e-9547-e59fcd729541 (last visited Jan. 11, 2021).

9 Missouri Lawyers’ Assistance Program, https://mobar.org/molap/ (last visited Jan. 11, 2021).

10 Registered Electronic Notaries, https://www.sos.mo.gov/RegisteredElectronicNotary (last visited Jan. 11, 2021).

11 Approved Notary Software Vendors, https://s1.sos.mo.gov/Business/Notary/softwarevendors (last visited Jan. 11, 2021).

12 Jonathan Leitschuh, Zoom Zero Day: 4+ Million Webcams & Maybe an RCE? Just Get Them to Your Website!, Medium.com (July 8, 2019), https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5.

13 ABA Committee on Ethics & Pro. Resp., Formal Op. 477R (2017).

14 Id. at pg. 5.

15 Microsoft Digital Defense Report, September 2020, https://www.microsoft.com/en-us/security/business/security-intelligence-report (last visited Jan. 11, 2021).

16 Rae Hodge, 2019 Data Breach Hall of Shame, cnet.com (Dec. 27, 2019, 4:00 AM), https://www.cnet.com/news/2019-data-breach-hall-of-shame-these-were-the-biggest-data-breaches-of-the-year/.

17 See Melinda J. Bentley, Ethics: The Ethical Implications of Technology in Your Law Practice: Understanding the Rules of Professional Conduct Can Prevent Potential Problems, 76 J.MoBar (2020).

Open
In this section of the website, members will find technology checklists, purchasing guides, tips for finding the best deals on legal technology, and links to Missouri Bar member benefits, including discounts on services and products. Members will also find a guide for starting a law practice and a new lawyer’s guide to the bar.

Build
Tools for marketing, advertising, navigating social media, earning referrals, and, of course, links to articles and relevant ethics opinions on these topics are located under this section. We worked to think of everything bar members may need in one spot, so it’s easy to find, and easy to use.

Manage
This is the most densely populated area of the site, with helpful checklists and whitepapers on practice management; time billing and accounting; documents; e–filing; technology; time management; hiring and firing; working with clients; and limited scope representation. There are also comparison charts to help lawyers navigate software and technology options.

Protect
Lawyers have an ethical obligation to protect client data, and with so many devices being used to access and consume client and matter information, protecting it can be overwhelming. Lawyers owe it to their clients, employees, and law licenses to check out this section. Here, members will also find information for disaster preparedness, cybersecurity planning, and more.

Wind Down
Whether members are closing their practices and planning for retirement or merging law offices for a new venture, in this section of the website they will find helpful checklists to makes sure they have left no stone unturned. Succession planning checklists and guidelines live here, too – and it is never too early to start planning.

Ask an Expert
The resources don’t stop there. If bar members don’t find what they are looking for, they can email Affinity Consulting any question about the management and technology at their firms. While Affinity Consulting can’t provide legal advice, their experts can connect lawyers with the tools and re-sources to help open, operate, and wind down their practices.

Members can also schedule a short consultation with one of Affinity Consulting’s consultants. Best of all? These services are included in your Missouri Bar membership. No extra fees, and no separate login; just the resources Missouri Bar members need to make good decisions and run a successful law practice.

The Law Practice Management Center can be Missouri Bar members’ go-to resource for all their law office management and technology needs. Get started at MoBar.org/LPM.

Endnotes

1 As a Missouri Bar member benefit, lawyers can speak with Affinity Consulting experts regarding legal technology and law practice management questions. At no cost, Missouri lawyers can email their question to an expert or schedule a one-on-one, remote consultation. Learn more at MoBar.org/LPM.

Melinda J. Bentley

Melinda J. Bentley is Legal Ethics Counsel for the Advisory Committee of the Supreme Court of Missouri.

How do you become competent in making those selections and using those technologies? What if there is a loss of a device or data? How do you train your staff? While the Rules of Professional Conduct (Rules) cannot tell you what to buy, fortunately, they do give you clear standards, and further guidance is provided through the Comments to the Rules to assist you with implementing and using technology devices and systems in your practice.² Further, by having a keen understanding of the Rules and Comments, you, as a lawyer, can be proactive in both preventing potential problems and being able to respond efficiently and ethically if a difficulty, large or small, occurs.

Key Ethics Rules: Building A Framework of Understanding

Three key ethics obligations are at the forefront of establishing a lawyer’s understanding in order to prevent potential technology problems: competence, confidentiality, and responsibilities regarding nonlawyer assistants.

Rule 4-1.1 – Competence

The first key ethics obligation underlying a lawyer’s use of technology is found in Rule 4-1.1, which states that “[a] lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.” Further, Comment [6] provides that “[t]o maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education, and comply with all continuing legal education requirements to which the lawyer is subject.” (emphasis added.)

Rule 4-1.6 – Confidentiality of Information

The second key ethics obligation underlying a lawyer’s use of technology is found in Rule 4-1.6(a), which generally prohibits a lawyer from revealing information relating to the representation of a client unless an exception is met. In 2017, the Supreme Court of Missouri adopted an additional requirement for lawyers in Rule 4-1.6(c) that “[a] lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of the client.” Such disclosure or access to confidential client information not only applies to physical information, such as paper documents in a client file, but also to electronically stored information. Think of the large amount of confidential client information lawyers have electronically. That electronic confidential client information makes lawyers’ duty of technology competence under Rule 4-1.1 that much more critical.

Reasonable Efforts on Unauthorized Access and Inadvertent or Unauthorized Disclosure. What constitutes reasonable efforts by a lawyer to safeguard confidential client information to prevent inadvertent or unauthorized disclosure, or unauthorized access? Comment [15] provides guidance to Rule 4-1.6(c) that lawyers are required to act competently regarding safeguarding this information. First, Comment [15] specifically creates three categories of safeguarding information from: (1) unauthorized access by third parties; (2) inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client; (3) and/or inadvertent or unauthorized disclosure by those who are subject to the lawyer’s supervision. When describing these categories, Comment [15] references Rules 4-1.1 (Competence), 4-5.1 (Responsibilities of Partners, Managers, and Supervisory Lawyers), and 4-5.3 (Responsibilities Regarding Nonlawyer Assistants).

Second, Comment [15] provides factors to consider in determining the reasonableness of the lawyer’s efforts, including but not limited to:

the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use).

Comment [15] notes that there is no violation of Rule 4-1.6(c) “if the lawyer has made reasonable efforts to prevent the access or disclosure.”³

Additionally, Comment [15] provides guidance that the client may require the lawyer to implement special security measures that are not required by Rule 4-1.6, but it also notes that a client may give informed consent to forgo otherwise required security measures under Rule 4-1.6. “Informed consent,” as defined in Rule 4-1.0(e), requires communication of “adequate information and explanation about the material risks of and reasonably available alternatives to the proposed course of conduct.” Per Rule 4-1.0(e), guided by Comment [6], informed consent in this context means discussing the material advantages and disadvantages of forgoing security measures, discussing available options and alternatives, and possibly advising the client to seek other counsel on this decision. Factors as to reasonableness will depend on the experience of the client or if the client is independently represented by counsel.⁴

Further, Comment [15] references that it is beyond the scope of the Rules to determine if state or federal data privacy laws require additional safeguards over client confidential information, or notification in the event of a loss of electronic information or unauthorized access to such information.

Finally, Comment [15] advises lawyers to consult Rule 4-5.3 (Responsibilities Regarding Nonlawyer Assistants) and its Comments [3] and [4] regarding supervision of nonlawyer assistants outside the firm.

Reasonable Precautions in Transmission. Comment [16] to Rule 4-1.6 notes that a “lawyer must take reasonable precautions to prevent … information [relating to the representation of a client] from coming into the hands of unintended recipients.” In offering guidance on this responsibility, Comment [16] provides two factors to consider when determining if the lawyer can have a reasonable expectation of confidentiality: first, the “sensitivity of the information,” and second, “the extent to which the privacy of the communication is protected by law or by a confidentiality agreement.”

Comment [16] provides that no special security measures are required “if the method of communication affords a reasonable expectation of privacy.”⁵ Just as with the considerations previously discussed in Comment [15], Comment [16] provides guidance that the client may require the lawyer to implement special security measures that are not required by Rule 4-1.6, but it also notes that a client may give informed consent to forgo otherwise required security measures under Rule 4-1.6. Further, a lawyer may be required to take additional steps to comply with other law, but that is an issue beyond the scope of the Rules.

Rule 4-5.3 – Responsibilities Regarding Nonlawyer Assistants

The third key ethics obligation underling a lawyer’s use of technology is found in Rule 4-5.3, which applies to a lawyer’s responsibilities for the conduct of nonlawyers who are “retained by or associated with a lawyer.” Rule 4-5.3(a) sets the requirements for firm-wide measures to ensure that partners or lawyers with comparable managerial authority make reasonable efforts to make sure the firm has measures in place to give reasonable assurance that the nonlawyer assistant’s conduct is compatible with the professional obligations of the lawyer. Similarly, Rule 4-5.3(b) requires a lawyer with direct supervisory responsibility to make reasonable efforts to make sure the nonlawyer assistant’s conduct is compatible with the professional obligations of the lawyer. Per Rule 4-5.3(c), lawyers are responsible for the conduct of nonlawyer assistants who they employ, retain, or associate with if the conduct of the nonlawyer assistant would be a violation of the Rules of Professional Conduct if engaged in by the lawyer and if one of two scenarios is present:

(1) the lawyer orders or, with the knowledge of the specific conduct, ratifies the conduct involved; or

(2) the lawyer is a partner, or has comparable managerial authority in the law firm in which the person is employed, or has direct supervisory authority over the person and knows of the conduct at a time when its consequences can be avoided or mitigated but fails to take reasonable remedial action.

Comment [2] to Rule 4-5.3 provides guidance on supervising the conduct of nonlawyer assistants employed by a lawyer, including but not limited to administrative assistants, investigators, law student interns, and paralegals. It describes making sure such assistants receive “appropriate instruction and supervision concerning the ethical aspects of their employment,” particularly on preserving confidentiality.⁶ Ways to ensure appropriate instruction include written policies and protocols, as well as regular instruction on the Rules of Professional Conduct and relevant substantive areas of law in which the nonlawyer is providing assistance. Further, specific protocols should be implemented within the law firm to ensure appropriate supervision of the work product of the nonlawyer.

Comment [3] to Rule 4-5.3 provides guidance on using nonlawyer assistants outside the firm who assist the lawyer in rendering legal services to a client, including but not limited to retaining investigative or paraprofessional services, hiring a document management company, sending client documents to a third party for printing or scanning, and using a service based on the internet to store client information. Lawyers using these services still must make reasonable efforts to ensure that the services are provided in a manner compatible with the lawyer’s professional obligations, and the extent of those efforts will depend on the circumstances.⁷

Applying the Rules to Potential Technology Issues

The Growing Need for Technology Competence

As provided for in Rule 4-1.1 and its Comment [6], lawyers do have an ethical obligation to be competent in technology, including its risks and its benefits, in a lawyer’s practice. For example, a lawyer in Oklahoma was publicly censured in 2016 based on a reciprocal discipline from the United States Bankruptcy Court for the Western District of Oklahoma where the lawyer was suspended for failure to file documents in a manner that was compatible with applicable rules.⁸ The lawyer failed to report his discipline in the Bankruptcy Court to the Oklahoma Bar Association and also failed to timely notify his clients of his suspension.⁹ During the hearing before the trial panel of the Oklahoma Bar Association’s Professional Responsibility Tribunal, the lawyer “acknowledged his problems with the bankruptcy court were caused by his lack of expertise in computer skills and his frustration trying to meet the federal court’s expectations with electronic pleading requirements.” The trial panel reported that the lawyer’s problems were not with his knowledge of substantive bankruptcy law, but instead “technological proficiency.”¹⁰ The Supreme Court of Oklahoma, in issuing its public censure of the lawyer, encouraged him to “continue to improve his computer skills, or better, to hire an adept administrative assistant to do his pleadings.”¹¹

While hiring adept support staff is helpful in some circumstances when properly supervised per Rule 4-5.3, it is not a substitute for a lawyer’s own technology competency as required by Rule 4-1.1. What are some ways to gain technology competency skills? The answers will be different for each lawyer depending on the lawyer’s practice setting and level of technological savvy. One of the best ways to gain the requisite skill and knowledge about the risks and benefits of relevant technology for a law practice is by taking continuing legal education programs related to technology.¹² While Missouri does not require that lawyers receive specific minimum continuing legal education (MCLE) credits related to technology competence, it does offer MCLE accreditation of a number of technology programs that help lawyers gain and maintain professional competence as it relates to the practice of law, professional responsibility, or law office management.¹³

There are several resources readily available to help lawyers build their technology competence, including articles, publications, blogs, podcasts, and more. When it comes to these resources, lawyers should be sure to check that they are receiving information from reputable sources that are appropriate for their practice settings.¹⁴ Malpractice insurance providers may also have resources or standards for insureds.

Additionally, lawyers should read the terms and conditions of service carefully for each new hardware or software item they consider incorporating into their practices to ensure the item has appropriate safeguards for maintaining client confidential information.¹⁵ Further, lawyers should consider consulting an information technology (IT) professional for assistance.¹⁶

Email and Other Electronic Communications

If lawyers are using email to communicate with clients, they must take reasonable precautions to prevent the unintended interception of confidential client information and should only use email upon proper consideration of Rule 4-1.6 and Comments [15]-[16].¹⁷ While email may be appropriate in some circumstances, other circumstances where the lawyer is transmitting highly sensitive information may require special security measures to comply with Rule 4-1.6.¹⁸ Special security measures may include using email encryption software, placing password protection on attachments, or using “a well vetted and secure third-party cloud based file storage system to exchange documents.”¹⁹ Remember that Rule 4-1.6(c) requires a lawyer to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of the client.” In looking to the factors discussed in Comment [15] to Rule 4-1.6 as to reasonable efforts to prevent access or disclosure, consider having a conversation with the client at the outset of the representation to determine if email is an appropriate means of communication. Some points to consider are:

• How do the lawyer and the client want to use email to communicate?
• What information will the lawyer and client be exchanging by email?
• What are the terms and conditions of the platforms that host both the lawyer’s email and the client’s email? Are the platforms ensuring privacy or are they mining emails for personal information?
• How is the client going to be accessing the email?²⁰ On a personal or work phone or computer? Who else has access to that device or the email account?

Consider these points, as well as the sensitivity of the information being transmitted, to determine if additional security measures are necessary or if email should even be used.²¹ By asking some of these questions, it should help the lawyer determine if he or she is acting reasonably in using email as a form of communication.

Other forms of electronic communication may include online client portals that have communication features or by texting. Similar questions about confidentiality and appropriateness of the medium should be asked for each of these other potential forms of electronic communication.

Also, lawyers should be mindful that if they are using one of these forms of electronic communication with clients, the correspondence needs to be retained for the client files in accordance with Rule 4-1.22 (Retaining Client Files) and Advisory Committee of the Supreme Court of Missouri Formal Opinions 115 (no withholding of property belonging to the client to enforce payment of fees or expenses) and 127 (scanning client files).²²

Data Backups, Case and Document Management Systems, and Electronic File Retention

When considering how to backup data, a lawyer should consider the nature of the information to be backed up. Most of it will likely be confidential client information, but it may include items such as trust account records, business records, and much more. Whether a lawyer is considering online (i.e., cloud)and/or on-site backups, those backups pertaining to confidential client information are governed by Rule 4-1.6 and guided by Comments [15] and [16].²³

Guidance is provided to lawyers regarding cloud backups in Missouri Informal Advisory Opinion 2018-09. It describes how lawyers need to maintain competence in using relevant technology per Rule 4-1.1, safeguard confidential client information per Rule 4-1.6(c), and supervise per Rule 4-5.3.²⁴ It also cautions lawyers to read the terms and conditions of service carefully to determine ownership and security of client information and the level of access the attorney and provider will have to that client information. It goes on to describe what constitutes reasonable efforts to safeguard confidential client information while using cloud computing, including but not limited to:

• Security measures protecting confidentiality of client information during transmission and storage;
• Prompt notification of attorney in the event of a security breach or provider’s receipt of a subpoena for client information;
• Ownership of data solely by attorney or attorney’s firm;
• No access rights by the provider to client information, except as required by law;
• Regular data backup by the provider;
• Handling of client information in the event attorney’s relationship with the provider is terminated;
• Compliance with applicable law regarding data storage and transmission;
• Reliable access to data by attorney;
• No access to data by third parties, including advertisers, except as required by law; and
• Domestic storage of data or, alternatively, storage in a jurisdiction subject to United States data protection laws or equivalent.²⁵

It also provides guidance that lawyers should review the provider policies and practices periodically, as these can change.²⁶

For on-site backups, lawyers should consider such things as the physical security of the equipment storing the confidential information, level of encryption, and redundancy (the same data being stored in multiple ways in case one system fails). Lawyers should consult with an IT professional to assist in properly setting up and maintaining this system.

Many case or document management systems are now provided by vendors as cloud-based services, though some are still provided for on-site network usage. When selecting a case or document management system, lawyers should consider similar factors as just discussed for cloud or on-site back-ups.

When backing up client information, lawyers should be mindful that they are required to securely store client files for six or 10 years after the completion or termination of the representation absent having an agreement with the client based on informed consent confirmed in writing.²⁷ The six-year client file retention applies to client files where the representation was completed or terminated on or after July 1, 2016, and the 10-year requirement applies where the representation was completed or terminated prior to July 1, 2016.²⁸ “Client files, except for items of intrinsic value, may be maintained by electronic, photographic, or other media provided that printed copies can be produced. These records shall be readily accessible to the lawyer.”²⁹ Advisory Committee of the Supreme Court of Missouri Formal Opinion 127 permits the destruction of paper files (except for items of intrinsic value) prior to the expiration of the required retention period if the files are maintained electronically for the required period in accordance with the Rules of Professional Conduct.³⁰

Keeping Client Confidential Information Secure on Phones, Laptops, Tablets, Etc.

Just as lawyers have an obligation to secure physical files of clients from unauthorized access, the same is true of electronic files lawyers maintain on portable electronic devices such as phones, laptops, tablets, and other similar devices.³¹ Whether the devices are those of the firm, or lawyers and employees are permitted to bring their own devices and use them for firm business, reasonable measures may include some of the following suggestions:

• Take reasonable steps to ensure confidentiality by, at a minimum, having strong passwords to access these devices.³²
• Passwords should be changed periodically.³³
• Consider additional safeguards such as encrypting the data on these devices, using multi-factor authentication to access firm systems.³⁴
• Avoid public Wi-Fi and only choose secure Wi-Fi, as well as consider using a virtual private network (VPN).³⁵
• For lost or stolen devices, have a way to remotely disable the devices and destroy the data contained on those devices.³⁶
• Implement firewalls, keep updated anti-malware, anti-spyware, and anti-virus protections on all devices where confidential client information is stored or transmitted.³⁷
• Apply all security patches and updates for software and devices.³⁸

These suggestions are some starting points for what constitutes reasonable measures to secure client confidential information and are not intended to be an exclusive list. As previously suggested, lawyers should be sure to consider the type of client confidential information and applicable state and federal laws. The prudent lawyer will consider consulting with an IT professional, the lawyer’s malpractice insurance carrier, and other appropriate resources for additional guidance.

Metadata

Another source of client confidential information lawyers should be mindful of securing is metadata, meaning electronically embedded data.³⁹ Informal Advisory Opinion 2014-02 asks in the litigation context if a lawyer “has an ethical obligation to make good faith efforts to prevent the inadvertent electronic transmission of embedded metadata to opposing party or counsel?” Citing Rule 4-1.6, guidance is provided that the lawyer must use reasonable care to ensure that no confidential client information related to the representation is revealed without the client’s consent, including confidential information that is contained in embedded metadata.⁴⁰ It provides that this may require scrubbing documents of metadata before transmitting them.⁴¹ However, the Informal Advisory Opinion goes on to note:

Efforts to protect confidential information must be exercised in light of Attorney’s obligation pursuant to Rule 4-3.4(a) not to unlawfully obstruct another party’s access to evidence or unlawfully alter, destroy, or conceal evidence. Removing metadata with evidentiary value before transmitting certain documents may constitute a violation of laws governing discovery and therefore violate Rule 4-3.4(a). This informal opinion does not render an opinion about the existence of discoverable evidence in particular metadata or about the effect on substantive legal privileges of the pre-transmission removal or lack of removal of metadata.⁴²

Responding to a Loss of Client Confidential Information Due to a Lost Device or File, Data Breach, or Cyberattack

Lawyers are custodians of highly sensitive information and can be prime targets for hackers.⁴³ Missouri Informal Advisory Opinion 2017-02 discusses a lawyer’s ethical duties when a nonlawyer assistant has disclosed client confidential information to third parties, but the ethics analysis as it relates to disclosing this breach to the client will be similar in the event of a lost device or file, data breach, or cyberattack. It advises that lawyers have an obligation under Rule 4-1.4 (Communication) to disclose the confidentiality breach to the affected client and explain the matter to the extent necessary for the client to make an informed decision about the representation. That disclosure also needs to occur in the event of a lost device or file where client confidential information is disclosed, whether lost by the lawyer or a nonlawyer assistant employed or retained either inside or outside the law firm, as the lawyer is responsible for that conduct under Rule 4-5.3. A similar communication is also necessary in the event of a data breach or cyberattack where confidential client information is disclosed.⁴⁴

Rule 4-1.6(c), requiring reasonable efforts to prevent inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation, also notes in Comments [15] and [16] that state and federal data privacy laws may govern or impose notification requirements upon a loss of electronic information or unauthorized access, so lawyers should be mindful of these laws both in how they choose to safeguard confidential client information and handle a loss of such information.

Working with IT Professionals and Vendors Outside the Law Firm

While lawyers may be aware of the obligations to train and supervise nonlawyer assistants within the firm, Rule 4-5.3, Comment [3] reminds lawyers that these same obligations apply regarding nonlawyer assistants employed or retained outside the firm. These include outside IT professionals lawyers may hire to help support their firms and vendors who provide services based on the internet to store client information such as data backup provides, case or document management programs, or other similarly based services used within the firm. Lawyers have the obligation to make reasonable efforts to ensure that the services are provided in a manner compatible with their professional obligations under the Rules.

Reasonable efforts will vary depending on the circumstances, “including the education, experience and reputation of the nonlawyer; the nature of the services involved; the terms of any arrangements concerning the protection of client information; and the legal and ethical environments of the jurisdictions in which the services will be performed, particularly with regard to confidentiality.”⁴⁵ Directions should be communicated to the nonlawyer in a manner appropriate under the circumstances so as to give reasonable assurance that the conduct of the nonlawyer is compatible with the professional obligations of the lawyer.⁴⁶ Missouri Informal Advisory Opinions 20070008 and 20050068 both suggest confidentiality agreements should be used when working with nonlawyer vendors and service providers outside the firm. Such agreements are also advisable when working with outside IT professionals, as well as direct training, as appropriate, on confidentiality and other applicable professional obligations of lawyers to ensure the IT professionals’ conduct is compatible with the conduct of lawyers.

Be Aware of Scams

Lawyers are frequently the targets of potential scams, as lawyers may hold trust account funds for clients as well as sensitive confidential client information. These potential scams often start as emails from those purporting to be legitimate sources, such as potential clients, known clients, financial institutions, businesses, government entities, etc., but are actually phishing attempts to gain access to funds and/or personal information of lawyers or clients. Additionally, emails containing links or attachments from known or unknown senders may contain viruses, malware, spyware, ransomware, or other mechanisms to corrupt computer systems and/or gain access to sensitive information. Lawyers must be savvy to these potential scams and train themselves and their nonlawyer assistants to prevent these breaches.

Trust account scams are some of the most common attacks against lawyers. Lawyers who believe they may have clients who have provided fraudulent checks in an effort to obtain good funds from lawyers’ trust accounts wonder how to ethically proceed. Guidance has been provided in Informal Advisory Opinion 2018-06, which addresses such a potential scam scenario in which a lawyer’s purported prospective client sent the lawyer a bogus check for deposit into the trust account. That Informal Advisory Opinion discusses whether the lawyer may report this purported prospective client to law enforcement. Whether a lawyer-client relationship exists is a question of law and fact that is outside the scope of the Rules of Professional Conduct, but if the lawyer had a prospective client relationship under Rule 4-1.18, the lawyer would not be able to use or disclose information gained in the consultation except as would be permitted under Rule 4-1.9 as though this person were a former client.⁴⁷ If no lawyer-client relationship existed, and this person was not a prospective client, the lawyer would not have a duty of confidentiality and would be free to make a report to law enforcement authorities.⁴⁸

Conclusion

As a lawyer, you should work to gain and maintain competence in technology, engage in reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of clients, and exercise appropriate professional responsibilities over the conduct of nonlawyer assistants both inside and outside the law firm. Focusing on these key ethics rules will assist you in selecting technology devices and systems in your firm, and help prevent breaches of client confidential information. If you have questions about the Rules of Professional Conduct regarding incorporating technology into your law practice, you are encouraged to contact the Legal Ethics Counsel office (www.MO-Legal-Ethics.org) to seek an informal advisory opinion about your prospective conduct.

Endnotes

1 Melinda J. Bentley is Legal Ethics Counsel for the Advisory Committee of the Supreme Court of Missouri.

2 See Rule 4, Scope [14].

3 Rule 4-1.0(h) defines “reasonable” or “reasonably” to be “conduct of a reasonably prudent and competent lawyer.”

4 See Rule 4-1.0, Comment [6].

5 See infra discussion of email.

6 See also Mo. Informal Advisory Opinions 2018-04 and 2017-02 (interpreting Rule 4-5.3 as it applies to nonlawyer assistants within a law firm). Informal Advisory Opinions are published on The Missouri Bar’s website at: https://mobar.org/site/Lawyer_Resources/Legal_Ethics_Opinions/site/content/Lawyer-Resources/Legal_Ethics_Opinions.aspx

7 See Mo. Informal Advisory Opinion 2018-09 (interpreting Rule 4-5.3 as it applies to use of a cloud computing vendor outside the firm).

8 State of Oklahoma ex rel., Oklahoma Bar Ass’n v. Oliver, 2016 OK 37, 369 P.3d 1074 (2016).

9 Id. at ¶15, 369 P.3d at 1077.

10 Id. at ¶5, 369 P.3d at 1075.

11 Id. ¶15, 369 P.3d at 1077.

12 See Mo. Informal Advisory Opinion 2018-09 (providing guidance on technology competence through continuing legal education courses).

13 See Rule 15.04(b): “A program or activity may be an accredited program or activity if it directly contributes to the professional competency of lawyers or judges and has significant intellectual or practical content related to the development or practice of law, professional responsibility, or law office management.” See also Rules Related to The Fla. Bar, Ch. 6, R. 6-10.03(b) (requiring Florida lawyers to take at least three of 33 MCLE credit hours every three years in approved technology programs), and 27 N.C.A.C. Ch. 1D – § .1518(a)(2) (requiring North Carolina lawyers to take at least one hour annually of MCLE devoted to technology training.)

14 See Mo. Informal Advisory Opinion 2018-09.

15 See Id. and Rule 4-1.6, discussion supra; see also Legal Ethics Counsel Resource Page — Electronic Comunication Resources, http://molegalethics.org/electronic-communication-resources/.

16 See Id. and Rules 4-1.6 and 4-5.3, discussion supra.

17 See Mo. Informal Advisory Opinion 2012-01 (providing guidance on use of email).

18 Id.

19 ABA Comm’n on Ethics & Prof’l Responsibility, Formal Opinion 477R (revised May 22, 2017).

20 See Mo. Informal Advisory Opinion 990007 (providing guidance on use of email, including consideration of settings of sender and receiver).

21 See Rule 4-1.6, Comment [15].

22 Mo. Sup. Ct. Advisory Committee Formal Opinions are published on the website of the Supreme Court of Missouri at: http://www.courts.mo.gov/page.jsp?id=11696.

23 See supra discussion of Rule 4-1.6.

24 See supra discussions of Rules 4-1.1, 4-1.6, and 4-5.3.

25 Mo. Informal Advisory Opinion 2018-09.

26 Id.

27 See Rule 4-1.22.

28 Id.

29 Id.

30 See also Legal Ethics Counsel Resource Page, File Retention Resources, http://molegalethics.org/file-retention-resources/.

31 See Mo. Informal Advisory Opinion 980030 (providing guidance on preventing physical client file access in an office-sharing arrangement) and Rule 4-1.6(c).

32 ABA Comm’n on Ethics & Prof’l Responsibility, Formal Opinion 477R (2017) (revised May 22, 2017).

33 Id.

34 Id.

35 Id. See also Jill D. Rhodes & Robert S. Litt, The ABA Cybersecurity Handbook 35 (2d ed. 2018) (“Wireless communication creates opportunities for hackers to intercept sensitive data such as passwords for logging in to corporate networks and online banking sites. Public Wi-Fi locations such as airports, hotels, and coffee shops — convenient places to check email — often do not have security features necessary to protect confidential client data.”).

36 ABA Formal Opinion 477R, supra note 32.

37 Id.

38 Id. See also Rhodes & Litt, supra note 35, 21-22 (2d ed. 2018), (describing cyber-attacks against law firms due to outdated software that had not been updated).

39 See Rule 4-4.4, Comment [2] (describing metadata as a form of electronically stored information).

40 Mo. Informal Advisory Opinion 2014-02.

41 Id.

42 Id.

43 See ABA Comm’n on Ethics & Prof’l Responsibility, Formal Opinion 483 (2018).

44 Id.

45 Rule 4-5.3, Comment [3].

46 Id.

47 Mo. Informal Advisory Opinion 2018-06.

48 Id.

From the Bar Center’s front door, one can see Simonsen Ninth Grade Center, its windows shattered and now covered by plywood. The Missouri Bar Center received only minor roof damage; we were so fortunate. Sadly, many of our friends and neighbors were not, and flooding continues in many areas across Missouri.

Our state is geographically positioned to get its share of natural disasters, including severe storms such as ice storms and tornados, as well as flooding. According to the Federal Emergency Management Agency (FEMA), Missouri has had 70 disasters since 1953, including the devastating Joplin tornado in 2011 and the floods of 1993. During both of these significant disasters, Missouri lawyers stepped up to help their fellow citizens, just as they have during the recent flooding and storms.

Each time the rivers rise, it’s hard to avoid comparing the levels to that seen in the Great Flood of ‘93. For several months spanning the spring and summer of 1993, floodwaters affected nine states, covering 400,000 square miles and causing more than $15 billion in damage. Missouri Bar members assisted with the statewide sandbagging effort, where “[s]ore backs and good consciences were the only reward,” wrote then-President John Black in September 1993. The Missouri Bar Young Lawyers’ Section coordinated lawyer volunteers, who staffed Disaster Assistance Centers and helped people with insurance questions and legal documents that were lost in the flooding. Legal Services of Eastern Missouri prepared a training booklet for volunteer lawyers, and The Missouri Bar partnered with local bar associations across the state to help those impacted and working to rebuild.

As the floodwaters receded, consumer fraud became a concern. President Black wrote that “human vultures flock to the sites of disasters and prey on the downtrodden. Through an aggressive public education effort, lawyers helped alert flood victims to the risks posed by dishonest and exploitive people.” In this next phase of assistance, The Missouri Bar partnered with local bar associations to hold “Call-A-Lawyer” programs across the state, and President Black and then-Attorney General Jeremiah “Jay” Nixon appeared on a statewide call-in radio program to provide consumer rights advice. Helping Missouri’s citizens during this time was a huge team effort among legal services offices, the bar’s YLS, and local bar associations – an effort that would be repeated in the wake of the devastating 2011 tornado in Joplin.

The EF-5 tornado on the afternoon of May 22, 2011 – the seventh-deadliest tornado in our nation’s history – left more than 150 dead and 1,100 injured. With more than $2.8 billion in damage, many lost their homes, and six of our members lost their law offices. It’s hard to describe the devastation and power – we found photographs and documents on my parents’ farm, some 45 miles away as the crow flies. The Missouri Bar, aided by its YLS, provided free legal advice at multi-agency resource centers and through a legal hotline, as well as resources to help Missouri lawyers assist victims. As then-President John Johnston wrote at the time, despite their own losses, the Jasper County Bar “pushed aside its own sorrows, and is already giving free advice to other folks in distress.”

Each time disaster occurs, members of local bars, legal aid offices, and area attorneys come together to help those in need. As Johnston wrote, “Times like this define who we are. We are a great people. We demonstrate this every time something horrible happens to our neighbors. Together, we will help our neighbors get through this. On behalf of The Missouri Bar, our deepest gratitude to all our members who volunteer their expertise and make donations to those in need.”

On our 75th anniversary, we salute each of you who have stepped forward to assist a neighbor during a time of crisis and disaster. You are a significant part of why we are proud to be Missouri lawyers. Unfortunately, help is still needed as recent floodwaters recede, and we also need to be ready when the next disaster strikes. If you would like to volunteer for the free Disaster Recovery Legal Assistance hotline, you can sign up online at www.mobar.org or contact Brett Rowles, our legal and community services coordinator, at 573-638-2242 or browles@mobar.org. You can also sign up to do pro bono your way through a virtual, walk-in clinic where Missouri lawyers answer non-criminal legal questions from low-income Missourians at a time and place that best fits your schedule. Go to Missouri.FreeLegalAnswers.org and click “Volunteer Attorney Registration” to get started. Thank you for all you do to continue our profession’s legacy of service to Missouri citizens in need.

Trends in other industries make it clear that lawyers must prepare for ransomware attacks. Here’s how to get started.

Earlier this year, ransomware cyber attacks at Hollywood Presbyterian Medical Center in Los Angeles, California and MedStar Health, based in Columbia, Maryland, made headlines and alarmed health providers and patients. The ransomware attacks, which involve a virus that is designed to hold data hostage until the victim pays for a “key” to regain access to their data, should also serve as a warning to lawyers.

Indeed, in a recent ransomware case involving the Brown Law Firm in Jacksonville, Florida, the firm was not able to access its client data.[2] Instead, the firm received a message stating that their data was not accessible and it would be destroyed unless the firm paid the equivalent of $2,500 in Bitcoins to the hackers behind the attack. Although the firm hired an information technology (IT) professional, it ultimately decided to pay the ransom on the advice of that IT contractor; the risk of losing the data by attempting to circumvent the ransomware was too great. Such attacks are often successful because the hackers behind the assault ask for a relatively small amount, knowing they can spread fees over many victims. This attack strategy also makes it an easier choice for the lawyer to pay.

What is Ransomware?

Ransomware is a malicious computer program (also known as malware) that is introduced into a computer system like a virus and allows the attacker to block access to the victim’s computer data and demand payment for restoring the data. Typically, there is a time element to the ransom demand: The owners of the data are threatened with its destruction if the ransom is not paid within a predefined number of hours. If you do not represent likely targets of ransomware, does this affect you as an attorney? Yes, because your law firm or corporate legal department is a target.

What is the Risk?

Lawyers, just like health and finance professionals, maintain confidential and sensitive information which they are obligated to protect and need to access to serve their clients. Lawyers can be locked out of data, and the data may be sold or made public.

Should I Pay?

This is the big question, and one without a great answer. If you pay, you are likely to get your data back. However, you will be a more likely target in the future and you will unwillingly be funding attacks on other lawyers. Further, there is no guarantee the hackers will honor the agreement.[3] Prevention is ideal, but if you are the victim of an attack, you will have to evaluate whether you can both restore data and protect against its release without paying the hacker. Ironically, sometimes even the police are left with no better option than paying the ransom.[4] The FBI has sent mixed signals on whether to pay or not, most recently advising against it.[5] Consulting with an IT professional and law enforcement will help you with the decision-making process.

Preventing Ransomware Attacks

While there is no means of attainng perfect assurance against a ransomware attack, the following precautions can help to mitigate risk and to diminish the impact of a breach on your practice.

Good backup: If you have a backup, you can restore the data to the point of last back up. But you still have a confidentiality issue[6] and the requirement to safeguard client property.[7] You will be obligated to report client data was compromised.

Good firewall: A firewall is the watch guard of the firm’s network. Think of the firewall as a security bubble. If you turn it on high, you can shut down virtually all communications, but users will complain that system is unusable. If you turn it down too much, you will be open to attack. So you have to find the right balance.

Training: Make sure you and your staff are trained to avoid infecting your network with ransomware. End users can enable breaches by downloading a suspicious attachment or clicking on an unknown link. Hackers use “human engineering” to trick you into clicking on attachments. If you receive a communication that normally would not come by email, do not open the attachment. Call the sender to confirm. Working from home on an unsecured computer can also compromise the network. Network security is only as good as the weakest link. Any device connected to the network needs to be inspected. Educate your staff on how to avoid risks. Use strong passwords and keep them secure. Keep your antivirus software current, but don’t assume it is protecting you.

Encrypt your data: This may not prevent an attack, but it will mean an attacker cannot release your clients’ confidential data without great effort.

Install an ad blocker: Some ransomware can be delivered via pop-up advertisements.

Hire an expert: Lawyers know what happens when their clients go DIY (do-it-yourself) on complex legal work. Likewise, you should considering hiring an IT professional to evaluate your network’s security rather than relying on your own knowledge of cyber security.

Use work computers only for work: Have a computer not connected to your law office network for surfing the Internet, or consult your IT professional for other ideas to isolate and protect sensitive areas of your network.[8]

Screen and monitor employees: As noted above, an employee might accidentally open a suspicious attachment or click or an inappropriate link, but in addition some employees might sell your password. According to a recent survey, 56 percent of employees would sell passwords for $1,000 or less.[9]

Review your insurance coverage: Do not assume you have coverage for cyber attacks. Check with your carrier.[10]

Dealing With Ransomware Attacks

If, despite your best efforts, you become the victim of a ransomware attack, there are several things you will need to do.

IT: Call for IT help, whether internal or an external consultant. Do not undertake any measures on your own unless you are a cyber security expert.

Insurance: Call your insurance carrier. They may be able to help you unwind the problem. And in any case, you may have a notification requirement to secure coverage for an event.

Law enforcement: Call law enforcement.

Work your plan: If you are part of an organization, contact those individuals internally who are identified in your plan, such as partners.

Assess the situation: Can you fix it with a backup? Was data actually accessed? Is paying a ransom advisable?

Determine notification requirements: Once the attack has been resolved and you are up and running, determine notification requirements. You will want to review the ethics rules as well as any state law requiring notification of a breach. Further, if you have any health data, you may have notification requirements under HIPAA.[11] Failing to disclose, even if you are not required to, may have negative consequences from a trust and public relations standpoint. Weigh your options carefully.

Reassess: Once you are up and running and the system is all clear, take some time to figure out what went wrong and how you can avoid problems in the future.

Ransomware attacks on lawyers are likely to increase. When the Hollywood and Medstar medical data attacks happened, it seemed like the beginning of a trend. Turns out a recent survey shows that half of the hospitals participating in the research had been subjected to ransomware attacks.[12] So the two publicized episodes were public confirmation of a trend, not the possible beginning of one. It may well be the same in the legal industry. Once hackers see success with victims motivated to recover and protect their clients’ data, they will continue the attacks as long as it remains profitable. This summer, we learned hackers are targeting lawyers using phony ethics complaints to trick them into downloading an attachment infected with ransomware.[13]

Staying up to date is part of your defense. The ABA’s Cyber Security Legal Taskforce is a good source of information.[14] The Better Business Bureau and the FTC have scam alerts. ABA members can also sign up to receive FBI Cybersecurity Alerts.[15] You should document your cyber security policy and use it to train your employees and have as a reference in case of attack. Your will want to have it in paper form in case you cannot access your computers. Your policy should outline the procedures for your response. You don’t want to be trying to figure out what to do when your office is paralyzed by an attack.

Lawyers are obligated to keep up with technology to protect their clients’ interests or to hire someone with the expertise to do it for them.[16] By keeping up with the risks and educating and monitoring your staff, you can avoid having to pay a ransom for your data and the possibility of seeing your clients’ data compromised.

This article originally appeared in the September 2016 issue of Bench & Bar of Minnesota, the official magazine of the Minnesota State Bar Association, and is reprinted with permission.

Endnotes

1 Shaun Jamison is a professor of law with Concord Law School of Kaplan University and is the former chair of the Minnesota State Bar Association Practice Management and Marketing Section. Jamison teaches CyberLaw, Legal Research, and the Future of Law Practice. He may be contacted at sgjamison@gmail.com.

2 “Florida Law Firm Hit by Ransomware Scheme” (2/16/2016) http://www.batblue.com/florida-law-firm-hit-by-ransomware-scheme/ (now https://opaq.com/)

3 Katie Dvorak, “Hackers return for more money in ransomware attack at Kansas hospital,” FierceHealthCare (5/23/2016) http://www.fiercehealthcare.com/it/hackers-return-for-more-money-ransomware-attack-at-kansas-heart-hospital.

4 “When hackers cripple data, police departments pay ransom,” Boston Globe (4/6/2016) https://www.bostonglobe.com/business/2015/04/06/tewksbury-police-pay-bitcoin-ransom-hackers/PkcE1GBTOfU52p31F9FM5L/story.html.

5 Paul, “FBI’s Advice on Ransomware? Just Pay The Ransom,” Security Ledger (10/22/2015) https://securityledger.com/2015/10/fbis-advice-on-cryptolocker-just-pay-the-ransom/, but see a more recent declaration from FBI Cyber Division Assistant Director James Trainor saying companies should not pay ransom: Katie Dvorak, “Hackers return for more money in ransomware attack at Kansas hospital,” FierceHealthCare (5/23/2016) https://www.fiercehealthcare.com/it/hackers-return-for-more-money-ransomware-attack-at-kansas-heart-hospital.

6 ABA Model Rule 1.6(c) – A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.

7 ABA Model Rule 1.15 – … property shall be identified as such and appropriately safeguarded. Complete records of such account funds and other property shall be kept by the lawyer and shall be preserved for a period of [five years] after termination of the representation.

8 Scott Perry, “Law Firms Kill Web Access In the Name of Cybersecurty,” (5/26/2016) Above the Law http://abovethelaw.com/?sponsored_content=it-security-vs-users&rf=1.

9 Tara Seals, “Employees Would Sell Passwords for $1000 or Less,” retrieved 4/15/2016: http://www.securion.io/#!Employees-Would-Sell-Passwords-for-1000-or-Less/c14jh/56f137afOcf266a29260bfe.

10 Peter S. Vogel, “Bad news for P.F. Chang – Court rules that all claims for 2014 data breach are not covered under its cyberinsurance!” Lexology (6/2/2016) https://www.lexology.com/library/detail.aspx?g=4dc04202-1357-4b3c-8c96-43aeac63e00f.

11 Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (1996).

12 Katie Dvorak, “Poll: Most hospitals have been targets of ransomware attacks,” FierceHealthIT, retrieved 4/12/2016: https://www.fiercehealthcare.com/it/poll-most-hospitals-have-been-targets-ransomware-attacks.

13 Mike Mosedale, “Ransomware scam targets lawyers with phony ethics complaints,” Minnesota Lawyer (6/7/2016) http://minnlawyer.com/2016/06/07/yikes-ransomware-scam-targets-lawyers-with-phony-ethics-complaints/.

14 ABA Cyber Security Legal Taskforce, https://www.americanbar.org/groups/cybersecurity/

15 Log in to sign up to receive alerts at this link: https://shop.americanbar.org/eBus/MyABA/MyLists.aspx.

16 ABA Model Rule 1.1 – A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.

As our society, as well as our economy, rapidly evolves into a digital format, the law must come to grips with how to account for things that did not previously exist. The advent of the Internet spawned new ways to communicate, do business, and commit crimes. In the same way, electronic devices have fundamentally transformed the practice of law over the course of the last decade; briefcases have been replaced by iPads and fax machines by Microsoft Outlook.

Accordingly, entirely new categories of evidence have found their way into the courtroom: e-mails to prove a contract was breached, digital videos to prove an assault occurred, text messages to prove a parent is unfit, and metadata embedded in digital photographs to prove the location or identity of where the photograph was taken. Most of these intangible things can be converted into a tangible format by printing them off onto paper, but inherently intangible assets are by no means foreign concepts to the judiciary. The goodwill of a business has long been recognized as having value,² and digital music is now a viable commercial product.

We are currently experiencing the beginning of the next evolutionary step of our economy as blockchain technology weaves its way into the fabric of our financial and business transactions. One of the reasons blockchain and cryptocurrencies can be difficult to understand is because they are truly unique concepts with no reference point or previously existing thing with which to compare them. Cell phones had land lines, electric vehicles had combustion engines, and digital photographs had Kodak film and Polaroids, but digitally encrypted mathematical problems created and solved by supercomputers that are utilized for financial transactions aren’t quite as intuitive. In 2017, cryptocurrencies were thrust into the headlines and, accordingly, into the consciousness of the general public. As our society continues to transform into a digital format, it is reasonably foreseeable that cryptocurrencies will become more commonplace in the courtroom. This article will educate the reader about the basic concepts underpinning blockchain technology, explain the essential tenets of Bitcoin and other cryptocurrencies, examine the uses of smart contracts, and discuss how these assets, products, and services may soon be treated under the law.

Key Terms and Concepts

Some of the concepts discussed in this article are extraordinarily technical or abstract in nature. In order to facilitate a meaningful understanding of the issues discussed herein, the following definitions are provided:

Cryptocurrency: An electronic form of currency that has no tangible format.

Bitcoin: The most prominent of all cryptocurrencies.

Blockchain: An electronic ledger that records digital transactions.

Node: A supercomputer that is used to facilitate the creation and transaction of cryptocurrencies.

Cryptocurrency and the Law

The law must continually evolve to account for new things, and it takes time for the corpus of jurisprudence to make sense of something that did not previously exist. Although blockchain technology and cryptocurrency were both invented in 2008, they have only recently begun to be implemented on a large scale. As these two separate but interrelated technologies become more enmeshed into our economy and society, it is time for lawyers and judges alike to begin building a foundation of understanding on which will evolve the structural analysis of legal issues surrounding the private, commercial and criminal uses of cryptocurrencies.

Where It All Began

The Internet is a platform on which countless applications and products have been built, such as e-mail, social media, and online shopping, with smart phones as conduits for these products and services. Similarly, blockchain technology is a new platform on which cryptocurrencies, smart contracts, and other financial products and services are being created.

The genesis of Bitcoin and blockchain technology was in October 2008, when Satoshi Nakamoto published a white paper on a cryptography e-mail list entitled “Bitcoin: A Peer-to-Peer Electronic Cash System.” ³ In that publication, he introduced the world to blockchain technology and, simultaneously, a new unit of value called Bitcoin. He described Bitcoin as “[a] purely peer-to-peer version of electronic cash.”⁴ In January 2009, Nakamoto released the software on which the first units of Bitcoin were created.

The identity of Satoshi Nakamoto only contributes to Bitcoin’s ethereal nature, because it remains a mystery to this day. Theories have abounded as to the gender, age, and nationality of the person behind the screen name.⁵ Some have even postulated that Satoshi Nakamoto is actually the product of a conglomerate of individuals. Regardless of whether Satoshi Nakamoto is a person or many people, what is undeniable is that blockchain technology and cryptocurrency are very much part of our reality, and they are proving to be the next evolution in digital transactions. For example, “Ripple has licensed its blockchain technology to over 100 banks,”⁶ and in October 2017 American Express adopted Ripple’s blockchain technology.⁷

Blockchain Technology

“[F]or all of its merits, [blockchain technology] is not [entirely] a new technology.”⁸ “Rather, it is a combination of proven technologies applied in a new way. It was the particular orchestration of three technologies (the Internet, private key cryptography, and a protocol governing incentivization) that made . . . Satoshi Nakamoto’s idea so useful.”⁹ Essentially, blockchain is an open, public, decentralized ledger that records transactions between two parties in a permanent manner.

Traditional electronic payments such as credit cards, PayPal, ApplePay and Automated Clearing House (ACH) payments move through phone lines, cellular networks or the Internet, and utilize the software and hardware that is created and installed by the company that is facilitating the transaction. The same company that facilitates the transactions maintains a central ledger that keeps track of all transactions that flow through their network, software, and hardware.

By contrast, transactions sent through a blockchain enable one person or entity to send cryptocurrency directly to another person or entity without the use of a third-party intermediary. The ledger that records the transactions is public and available to all of the computers connected to that particular blockchain network. As a means of comparison, a similar file-sharing system, called Napster, was created in 1999 that allowed users (albeit illegally) to share music directly with one another. Although Napster had no central ledger of any kind, it was a way to transfer digital files directly between two people.

There are many different blockchain networks; each one has its own unique unit of value that is tailored to a particular use. Bitcoin is one of many different cryptocurrencies. As of the time of writing, the most popular “cryptos” are (in order of market capitalization) Bitcoin, Ethereum, Ripple, Bitcoin Cash, EOS, and Stellar.¹⁰

How Transactions Work (Generally Speaking)

In a practical sense, transferring cryptocurrencies is no different than paying bills or transferring money between accounts online or through an app on your smart phone; the process takes just a minute or two to complete (the actual transmission of funds can take anywhere from a few seconds to several days). Technically speaking, a transaction begins when User 1 initiates a request to send cryptocurrency to User 2. This is typically done through a smart phone app or a website. The supercomputers that are connected to that particular blockchain network first validate that User 1 owns the amount of cryptocurrency requested to be transferred. Next, they validate that User 1 hasn’t previously sent/spent the currency that will be transferred. This prevents cryptocurrency from being spent more than once.

Double-spending is a problem unique to digital currencies because digital information and assets can be reproduced relatively easily. Physical currencies do not have this issue because they cannot be easily replicated, and the parties involved in a transaction can immediately verify the bona fides of the physical currency. With digital currency, there is a risk that the sender/spender could make a copy of the digital currency and send it to a merchant or another party while retaining the original.⁸ To double-spend a cryptocurrency, digital bank robbers would need to rewrite the entire blockchain, and to do that they would have to control more than half of the network’s puzzle-solving capacity. Such a “51 percent attack” would be prohibitively expensive and complex. As of January 20, 2015, Bitcoin miners had 13,000 times more combined number-crunching power than the world’s 500 biggest supercomputers.¹¹ That collective computing power has increased exponentially in the last three years. The way the large-scale thefts of cryptocurrencies that have been covered in the media in recent years were not a result of this kind of “brute force” hack. Rather, they were the result of more traditional methods of online theft: tricking someone to disclose their login information or private key, reliance on an insecure/unstable third party, someone impersonating a cryptocurrency recipient, or an “exit scam” where individuals set up a digital wallet or exchange, confiscate all the cryptocurrency, and then claim they were hacked.¹²

Once a majority of computers on the network confirm that User 1 owns the amount of cryptocurrency requested to be transferred and hasn’t previously spent it, the transaction gets added to the public ledger as a “block” in the chain of transactions. Since there is no intermediary that controls the ledger, transactions cannot be reversed or changed in any way, because it would require undoing all of the blocks that came before the block being altered. This unique attribute of blockchain technology prevents the same cryptocurrency from being fraudulently transferred.

Cryptocurrencies are stored in accounts commonly referred to as wallets, which are essentially digital accounts that can be accessed by logging into a website or using a smart phone app. Unlike bank accounts, they are not insured by the FDIC. However, it does insure up to $250,000 of U.S. dollars in Coinbase wallets, if held by a U.S. citizen.¹³ Most wallets are not designed to contain U.S. dollars or euros.

Each wallet is randomly assigned a unique public key that is comprised of 34 alphanumeric characters that cannot be changed. Each public key has a corresponding private key that is a series of 64 alphanumeric characters. Using the example from above, User 1 would type in or scan User 2’s public key into their request to send funds, and then User 1 would authenticate and finalize the transaction with their private key. This history of the public keys of both users on the blockchain is then reviewed and approved by multiple supercomputers connected to the blockchain network.

Creation of Cryptocurrencies

Cryptocurrencies are created in one of two ways: by issue or by mining. Some companies, through massive amounts of computer code, have created their own currency and/or blockchain network, such as Ethereum and Ripple. These companies simply release a fixed number of their unique units of value (“coins”) onto their networks. Coins can also be released by the mining process. The term “mining” is misleading, because the process is nowhere near what the average person thinks of when they picture minerals being dug or blasted out of the earth. “Every ten minutes or so [supercomputers (called “nodes” or “miners”)] collect a few hundred pending bitcoin transactions (a “block”) [from the network] and turn them into a mathematical puzzle.”¹⁴

The first miner to find the solution announces it to others on the network. The other miners then check whether the sender of the funds has the right to spend the money, and whether the solution to the puzzle is correct. If enough of [the nodes on the network agree with the solution and announce] their approval, the block is cryptographically added to the ledger and the miners move on to the next set of transactions (hence the term “blockchain”). The miner who found the solution gets 25 Bitcoins as a reward, but only after another 99 blocks have been added to the blockchain ledger. All this gives miners an incentive to participate in the system by validating transactions.¹⁵

Understanding the Value of Cryptocurrencies

In order to begin to understand the value of cryptocurrency, one must first ask, “Why does anything have value?” The rhetorical answer is, “Because people believe it does.” The reason a yellow-colored mineral called gold has value is because people collectively believe it does. Why is a piece of paper produced by a slot machine with a bar code and numbers printed on it worth the stated value? Because people believe it is. Will the casino guaranty the exchange of that piece of paper for U.S. currency? In most cases, yes. Can you take that certificate to the gas station next door and trade it for fuel? No. The reason fiat currencies such as the U.S. dollar have been successful is because governments have convinced a critical mass of people that a rectangular piece of paper is worth the amount printed on the bill.

Moving on to digital transactions, if money is fraudulently transferred out of a bank account, the FDIC will put money back into that account. But what really happens? A series of digital transactions occur and people believe they have their money back because that’s what it says on their computer screen. If you want to buy a cup of coffee with a credit card, you swipe a plastic card in an electronic device, a series of computers in different locations communicate with each other to verify available funds and complete the transaction, and then – based on the faith in that computer system – the barista hands you a cup of coffee. We have been living in a digital economy for quite a while now; in that sense, cryptocurrencies do not require a very large leap of faith.

The two most common aspects of cryptocurrency that challenge the traditional notions of monetary value are:1) the absence of a centrally controlled ledger and an entity that controls all of the data, and 2) the lack of an entity that will replace or refund your money if it is stolen or if the entity that holds your money collapses. The cryptography and mathematical certainty of blockchain transactions negates the necessity of those two concepts.

Another hallmark of value is scarcity. When Satoshi Nakamoto unleashed Bitcoin, there were a total of 50 coins, and the mathematical formula would (and does) produce batches of new coins every 10 minutes. Nakamoto established a limit of 21 million Bitcoins that would ever be created. If the current rate of mining of Bitcoins sustains itself, that limit is expected to be reached around the year 2140. A total of 60 million Ether were created ¹⁶ and Ripple initially created 100 billion of its coins.¹⁷

Before a thing can be valued, it must first be clearly defined. A dollar is first and foremost a form of currency and means of exchange. A currency/asset hybrid is the American Gold Eagle, which is the official gold bullion coin of the United States. A Gold Eagle is utilized primarily as a store of value and it is regulated and traded as a commodity, but it can also be legally used as a means of exchange if two parties are willing to use it in that way.

Some cryptocurrencies will evolve into commodities, while others will become true means of exchange. As Bitcoin has ascended in value, transaction times have slowed due to a saturation of the network, government entities have begun to regulate it, and it is being treated more like a commodity. By way of comparison, while Bitcoin has become the digital cousin of gold, Litecoin is thought of as the digital cousin of silver – less valuable, with quicker transaction times, and thus more amenable as a means of exchange.

Valuing Cryptocurrency in Dissolutions of Marriage

As of the date of publication, no Missouri appellate court has issued an opinion that contains the word “cryptocurrency” or any variation thereof. Therefore, we must look at the existing framework of common law that defines how courts assign value to assets and commodities.

“[A] trial court is prohibited from entering a valuation of marital property not supported by evidence at trial, but the trial court, nonetheless, enjoys broad discretion in valuing marital property.”¹⁸ The trial court is entitled to believe or disbelieve the testimony of either party concerning the valuation of marital property in a dissolution proceeding, and can disbelieve expert testimony. The judicial determination of value must be an informed judgment, but fair “value” is not susceptible of determination by any precise mathematical computation.

Generally, “the appropriate date for valuing marital property in a dissolution proceeding is the date of trial.”¹⁹ “However, where the division of property is not reasonably proximate to the time of trial, the valuation date should be the date of the division of the property, ‘in that it cannot be said that distributions based upon stale valuations are based on value, for value is by no means a constant.’”²⁰ Market conditions and changing economic circumstances can render assets that had been valuable months or years earlier virtually worthless in the present, and vice versa.¹³ To distribute marital property without regard to such fluctuations would be illogical.¹³ Hence, in those cases where the date of trial is not reasonably proximate to the date of the actual distribution of the marital property, the court should hold another hearing to determine the value of the marital property at the time of its division.

Cryptocurrencies have existed for approximately 10 years, but in many ways they are still in their infancy. The wild fluctuations in value they experience should become less frequent as the technology matures, acceptance grows, and regulation increases. Until then, they will continue to have extreme vacillations in value in sometimes unpredictable ways. In order to prevent the value of cryptocurrencies from becoming stale, judgments must be entered in a timely manner; otherwise, subsequent evidentiary hearings will be necessary.

There is no single, universally recognized entity that announces the value of cryptocurrencies. The New York Stock Exchange is relied upon when valuing stocks or bonds. The values published by the NYSE are generally accepted by the public to be the actual, true value of the stocks listed on that exchange. In the same way, several web sites have been created to track the values of cryptocurrencies. However, the three largest cryptocurrency exchanges – Coinbase, Kraken, and Bitstamp – sometimes assign slightly different values to the same cryptocurrency. A court could base its valuation of cryptocurrency on a snapshot of one of these exchanges.

In addition to its spot price, a cryptocurrency’s market capitalization (the price of a cryptocurrency multiplied by the total number of coins issued) is displayed on these exchanges. This can be a useful means of valuation, but it is not always reliable, because sometimes the number of available coins on a particular blockchain do not yet exist because they have not yet been mined or are being released slowly into the market over time.

A more specific method of proving the value of a specific crypto wallet would be a screen shot of the wallet, which will display the current value of all cryptocurrencies held in that account, just like a bank account or brokerage account. It is possible that a litigant may have developed a proprietary blockchain during the marriage. In order to value the technology itself, Metcalfe’s law may be helpful. While more theoretical in nature, Metcalfe postulated that the value of a network is proportional to the square of the number of the users on the network. Common examples of this law are cellular telephone networks and social media platforms, such as Instagram, Twitter and Facebook; the more individuals who participate in the network, the more valuable the network becomes. If the blockchain that the litigant created has no users and is simply sitting on a hard drive somewhere, it may have relatively little value, but the more computers that are connected to that network and utilizing that blockchain’s technology, the more valuable it may be.

Written Discovery

Generally, cryptocurrencies should be clearly defined. A recommended definition of “cryptocurrency” is: A digital unit of value that utilizes blockchain technology and cryptography and includes, but is not limited to, Bitcoin, Bitcoin Cash, Litecoin, Ether, Ripple, and any other digital coin, token or alt-coin.

Recommended Requests for Production of Documents:

Screen shots that display the current balance of all cryptocurrencies in each wallet, exchange or other cryptocurrency account owned by you or any entity in which you have an ownership interest since the date of the marriage;

A ledger of all transactions (i.e., purchases/sales of cryptocurrency or exchange of cryptocurrency for goods or services) for each wallet, exchange or account listed above;

Copies of all bank statements that reflect transactions to or from a cryptocurrency wallet, exchange or cryptocurrency account of any kind since the date of the marriage;

Copies of all credit card statements that reflect transactions to or from a cryptocurrency wallet, exchange or cryptocurrency account of any kind since the date of the marriage;

Copies of all brokerage account statements that reflect transactions to or from a cryptocurrency wallet, exchange or cryptocurrency account of any kind since the date of the marriage; and

Copies of all text messages or emails that you have sent to another person or entity since the date of the marriage that discuss or pertain to any cryptocurrency owned by you at any point during the marriage (regardless of whether owned solely or jointly with another person or entity).

Recommended Interrogatories:

List the public key for all cryptocurrency wallets or cryptocurrency accounts of any kind owned by you or any entity in which you have an ownership interest or control over (regardless of whether owned solely or jointly with another person or entity) at any point in time during the marriage;

List all cryptocurrency wallets or accounts of any kind that you have owned (solely or jointly with another person or entity) since the date of the marriage;

List all individual cryptocurrencies that you have purchased, sold or otherwise transacted since the date of the marriage, the amount of each transaction, and the relevant date(s) of each transaction; and

State the source of funds (including the name of the financial institution and relevant account numbers) that was utilized to make all purchases of cryptocurrency since the date of the marriage. This includes any account from which debt or credit of any kind, U.S. dollars or other government currency was used to purchase or trade for cryptocurrency.

Smart Contracts

Smart contracts are digital transactions that incorporate blockchain technology in an “if-then” fashion. For example, the details of the sale of a vehicle (sales price, taxes and fees, all of the information otherwise contained on a certificate of title, verification of funds of the buyer) could be uploaded onto a blockchain network. Once both parties certify that the vehicle has physically changed possession from the seller to the buyer, the funds are transferred and the information from the sale becomes a permanent part of the blockchain’s public ledger, everything happening instantaneously and simultaneously. Rather than placing trust in the Department of Revenue to keep accurate records that are sometimes difficult to access and/or view, trust would be placed in the blockchain. The only source of error would lie with the individual who is building/coding the transaction by typing inaccurate data, but even much of that information would preexist on the blockchain (previous owners, VIN, make, model, year, and possibly maintenance and accident history), making the possibility of error negligible. Smart contracts can also implement business rules, such as transactions that take place only if two or more parties endorse them, or contingent transactions that are triggered only if another transaction has been completed first.

The sequential nature of blockchain networks naturally lends itself to transactions such as recording documents that transfer ownership of real estate or vehicles, as well as maintaining medical records, are processes that could benefit from this technology. The Recorder of Deeds’ office is especially predisposed to implementation of blockchain technology, because a large part of what they do is maintain a public ledger, so it would be a relatively small step to digitize and automate the process of recording real estate documents and even marriage certificates. Several years ago, Missouri transitioned away from a filing system that utilized fax machines and hand-delivered documents and moved to an electronic filing system. The next logical step would be to transition to a blockchain-based system. Each county would likely need to have its own blockchain network, which may be easily implemented, although the technicalities of how that might happen are outside the scope of this article. Obviously, achieving that reality will not happen any time soon, but if Moore’s Law (roughly stated: the speed of computing doubles every two years) is applied to blockchain technology in general, it will not be as far off as one might think.

Smart contracts are already gaining recognition under the law. “The governor of Tennessee [recently] signed a bill that legally recognizes blockchain data and smart contracts under state law.”²¹ The spread of blockchain networks is bad for centralized institutions and bureaucracies, such as banks and government authorities. It is possible that the need to have documents notarized may eventually become irrelevant or redundant, because all of the necessary information could be embedded into the blockchain and transferred instantly and infallibly. The public ledger would also remove the need for reconciling each transaction with a notary book. Given the increase in the hacking and theft of information from large companies such as retail stores, banks, and credit card companies, as well as governmental institutions like the United States Office of Personnel Management,²² transactions that are incapable of being modified or changed (and provide complete transparency of the public ledger) could be a good thing.

Looking to the Future

Although this article has focused on the relevance of cryptocurrency in the area of family law, the concepts discussed herein also apply to many other legal issues, including the collection of money judgments, whether or not punitive damages are appropriate, analyzing whether or not to file suit against an individual, piercing of the corporate veil, and a litany of bankruptcy issues. In a profession that frequently looks to the past for guidance on current issues, lawyers must begin to expand their thinking and analysis to accommodate the implications of cryptocurrencies, and not just in the courtroom.

Receipt of electronic payments is a major variable in the area of practice management. Gone are the days when clients might pay with a traveler’s check, and the use of cash as a payment method is in steady decline. “Credit cards and other forms of electronic payments have become an integral part of our nation’s commerce and the way many people prefer to pay. In 2009, credit cards officially surpassed paper check transactions in the United States.”²³ American Consumer Credit Counseling conducted a survey that found “80% of consumers use their debit card to pay for everyday purchases such as gas, meals, and groceries.”²⁴ The difference between Apple Pay and credit cards is that Apple Pay does not utilize a tangible card to make payments, and all aspects of the transaction are facilitated by an iPhone. As previously discussed, paying with a credit card, Apple Pay and now Bitcoin are seemingly small but significant steps away from traditional methods of transacting money and toward a fully digital economy. The full spectrum of legal professionals should endeavor to understand this relatively new development in our society and derive new methods of applying the law to this new means of currency and value.

Endnotes

1 Doug Fredrick received his bachelor’s degree in business administration and his Juris Doctor from the University of Missouri-Kansas City. He is a solo practitioner and focuses primarily in the areas of family law, business transactions and litigation, and real estate transactions and litigation. He has argued before the Supreme Court of Missouri and the Southern District of the Missouri Court of Appeals. He currently teaches Entrepreneurship 301 in the Breech School of Business at Drury University and serves as the faculty sponsor for the Cryptocurrency Club.

 2 Hanson v. Hanson, 738 S.W.2d 429, 434 (Mo. banc 1987).

 3 Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System, https://bitcoin.org/bitcoin.pdf.

 4 Id. (Abstract).

 5 L.S., Who Is Satoshi Nakamoto?, The Economist (Nov. 2, 2015), https://www.economist.com/blogs/economist-explains/2015/11/economist-explains-1.

 6 Jeff John Roberts, Is Ripple for Real? A Closer Look at the Company Behind the Third Most Valuable Digital Currency, Fortune (Oct. 23, 2017), http://fortune.com/2017/10/23/bitcoin-ripple-brad-garlinghouse/.

 7 Reuters, American Express Is Getting Into Blockchain-Based Payments With Ripple, Fortune (Nov. 16, 2017), http://fortune.com/2017/11/16/amex-payments-ripple-blockchain/.

 8 Nolan Bauerle, What is Blockchain Technology?, Coindesk, https://www.coindesk.com/information/what-is-blockchain-technology/.

 9 Id.

 10 Cryptocurrency Market, https://www.tradingview.com/markets/cryptocurrencies/prices-all/ (June 11, 2018).

 11 L.S., How Bitcoin Mining Works, The Economist (Jan. 20, 2015), https://www.economist.com/blogs/economist-explains/2015/01/economist-explains-11.

 12 Jeff John Roberts, How Bitcoin Is Stolen: 5 Common Threats, Fortune (Dec. 8, 2017), http://fortune.com/2017/12/08/bitcoin-theft/.

 13 How Is Coinbase Insured?, Coinbase, https://support.coinbase.com/customer/portal/articles/1662379-how-is-coinbase-insured.

 14 L.S., How Bitcoin Mining Works, The Economist (Jan. 20, 2015), https://www.economist.com/blogs/economist-explains/2015/01/economist-explains-11.

 15 Id.

 16 Ether: The Crypto-Fuel for the Ethereum Network, https://www.ethereum.org/ether.

 17 Selena Larson, Cryptocurrency Boom: Why Everyone Is Talking About Ripple, CNN Business (Jan. 4, 2018, 2:24 AM ET), http://money.cnn.com/2018/01/02/technology/what-is-ripple-cryptocurrency/index.html.

 18 Tarneja v. Tarneja, 164 S.W.3d 555, 559 (Mo. App. S.D. 2005).

 19 Romkema v. Romkema, 918 S.W.2d 294, 298 (Mo. App. E.D. 1996).

 20 Wright v. Wright, 1 S.W.3d 52, 57 (Mo. App. W.D. 1999).

 21 Nikhilesh De, Smart Contracts Now Recognized Under Tennessee Law, Coindesk (Mar. 23, 2018, 21:01 UTC), https://www.coindesk.com/blockchain-bill-becomes-law-tennessee/.

 22 Evan Perez, FBI Arrests Chinese National Connected to Malware Used in OPM Data Breach, CNN Politics (Aug. 24, 2017, 6:29 PM ET), https://www.cnn.com/2017/08/24/politics/fbi-arrests-chinese-national-in-opm-data-breach/index.html.

 23 Amy Porter, Get Paid Faster Than a Speeding Bullet: Accept Credit Cards, ABA GPSolo Magazine (June 29, 2017), https://www.americanbar.org/groups/gpsolo/publications/gp_solo/2011/july_august/get_paid_faster_than_speeding_bullet_accept_credit_cards/.

 24 ConsumerCredit.com, https://www.consumercredit.com/financial-education/infographics/infographic-cash-vs-card. “As of December 2017, 37 percent of . . . North America retailers” already accepted payment with Apple Pay. Statista The Statistics Portal, Digital Payment Methods That North American Retailers Accept or Plan to Accept as of December 2017, https://www.statista.com/topics/4322/apple-pay/.

We all experience password fatigue, that feeling when you receive yet another notification to create or change a password. The password must meet certain criteria, typically a minimum number of characters containing a combination of uppercase, lowercase, numbers, and/or symbols. Exasperated, you ask yourself, “How am I going to remember a new password?” So you take the easy route and add an additional exclamation point to your current password or use a password from a different account.

While you are more likely to remember these passwords, re-using or creating predictable passwords leaves you vulnerable to hackers. Stolen passwords, phishing, spear-phishing, and ransomware are serious threats to any internet user, but particularly so for attorneys, who are mandated to protect confidential client information.

Best Practices for Creating Strong Passwords

You know the basics of password security. Do not store your written passwords under your keyboard; do not use your username, the word “password,” qwerty, or personal/confidential information as a password; and finally, do not use a single dictionary word. So how do you protect yourself?

Stop Re-Using Pa5sw0rds! Even if you create a strong password, using it for a number of accounts increases the likelihood that it may be stolen. While it is less critical to create unique passwords for each site you visit that does not store your personal or confidential information, never use that password for any site storing such information. Most importantly, you should never re-use your email password at any online site. If your do and one of the eCommerce sites is hacked, your email account is compromised.

Longer is Better.  While many sites require a minimum of eight characters, you should create a longer password. Each additional character you add will exponentially increase your password strength. A password consisting of 15 lowercase letters offers better security than an eight-digit password containing mixed, but predictable, characters.

Even So, Mix It Up. Many users make it easier on themselves (and hackers) by placing their capital letter at the beginning and the number and/or special character at the end. Your password will be far stronger if capital letters, lower case letters, numbers and special characters are not bunched together. Mixing it up also means that you avoid easily predictable keyboard patterns such as qwerty or 1qaz@wsx.

Don’t Change So Often.  For some of us, frequent change is required by the IT department. If you have a choice, though, it is generally a better policy to create a strong password and keep it for a longer period of time. While this may seem counterintuitive, frequently changing a password makes it tougher for the user to remember, which makes the user more likely to create easily recalled passwords or to simply incrementally increase the number at the end each time a change is required.

Use a Password Manager. If you have a unique password for each site you visit, you have far too many passwords to remember which password is connected to which site. You probably are also frequently locked out of accounts or having to reset your passwords. Good news – there’s an app for that! Password managers create and store credentials for each site you use and log you in automatically. Your database of passwords is encrypted with a master password. The benefit of a password manager is that you will have unique and strong passwords for all of your online accounts. The downside is that you absolutely must remember your master password. There are numerous excellent password managers. Dashlane, KeePassX, Password Boss, and LastPass are just a few of the many options and most have both free and paid versions.

Use Two-Factor Authentication. While these password tips provide a good start to better online security, you should also enable two-factor authentication for any account that offers that option. Two-factor authentication will require that you enter a temporary code sent to your phone along with your regular password. This additional layer can help protect you from attack if your passwords are compromised. This is a particularly good idea for online banking and eCommerce accounts. You can often designate your own personal computer and phone as trusted once it is set up and can avoid the bother of having to enter a code each time you access your account from those devices.

Whether you are technologically savvy or not, these tips provide easily achievable steps to better secure your online presence. Resolve to make your 2017 more secure by putting these password systems into practice.

Endnote

 1 Cindy Neagle is Law Practice Management Attorney for The Missouri Bar.

The advent of health-surveillance tools and mobile fitness applications has ushered in a new era of consumer health care that holds enormous promise. Individuals are more empowered than ever to take control of their health, and it is possible to provide real-time tracking and reporting of critical information about fitness to physicians, swiftly and across vast distances.

Yet all this potential poses a challenge in terms of health data privacy and security that rivals – if not surpasses – the threats associated with financial data. For more than a decade, consumers have battled the prying eyes of data brokers and hackers to protect their financial information. Now, the battlefront has shifted to include health and lifestyle information that could prove even more sensitive and consequential if hacked.

“Health data is more vulnerable in general as a data set than financial data because you can’t replace it like you can a credit card,” says Michelle De Mooy, deputy director of the Consumer Privacy Project at the Center for Democracy & Technology, a Washington, D.C.-based nonprofit that advocates for civil liberties and human rights on the Internet. “When you have a diagnosis, it’s something that’s a part of your medical history for life. When people are victims of medical identity theft or their medical records have been hacked, there are very few good remedies for those situations. They are unprotected, and sometimes their whole families are unprotected.”

That matters, De Mooy says, because wearables such as fitness wristbands and monitors have become so sophisticated, designed to track user activity and share their data with a multitude of applications and devices, with few if any restrictions. These tools are capable of measuring brain activity, calorie intake, miles walked and run, swimming strokes, blood oxygen and blood sugar levels, and heart rates. They are both fitness coach and a proverbial “black box” for a consumer’s health. They also are a gateway to the lives of their users.

Up to now, informed consumers have been willing to sacrifice a little privacy to gain the benefits associated with fitness trackers and smartwatches: improved wellness, vanquishing unhealthy eating habits, and feeling more liberated to manage their health care. No question these are worthy goals, but legal experts believe Americans may be reaching a critical juncture on health and fitness data because now it is under more threat than ever. Where it was once both taboo and illegal for hackers and corporations to poke around in certain types of health records, this data is being viewed by some as the missing piece in consumer profiles.

A Federal Trade Commission (FTC) study released in May 2014 revealed that 12 mobile health applications and devices transmitted information to 76 different third parties, and some of the data could be linked back to specific users. In addition, 18 third parties received device-specific identifiers, 14 received consumer-specific identifiers, and 22 received other key health information.

“What we have is this vast amount of information that is being created, and, as the Federal Trade Commission has found, not a lot of attention yet being paid by consumers to how it’s being used and shared,” says Kristi Wolff, special counsel at Kelley Drye & Warren, LLP. “A lot of companies are coming out with innovative products, but they’re new and not taking some of the necessary precautions that more established companies would take in terms of data privacy and security.”

With so much at stake, privacy advocates are debating how best to protect consumer wellness and fitness information. Medical or health data generated by doctors, hospitals, and other clinicians is covered by the Health Insurance Portability and Accountability Act (HIPAA), which limits access to patient health records and punishes those who violate the protections. But the information generated through fitness trackers, smartphones, and mobile applications is generally not covered by HIPAA regulations.

Industry officials argue that additional government regulation, if it comes, would be slow and stifling to an enterprise that relies on innovation at the speed of light. Likely, rules would be outdated the moment they are adopted, and they would be solving yesterday’s problems rather than forecasting the privacy concerns of tomorrow’s devices.

Many believe the best way forward is to encourage companies to adopt a best-practice model on data privacy for fitness trackers and applications. Best practices in privacy policies might focus on keeping health data on the device rather than in the cloud, letting the user choose with which applications to share their information, and prohibiting the stats from being sold to data aggregators for behavioral advertising.

What is indisputable is that there is a great deal of flux and uncertainty in how consumers and technology companies operate within the new digital economy and digital ecology, suggests Jennifer S. Geetter, a partner at McDermott Will & Emery, LLP. Businesses, consumers, lawyers, regulators, policymakers, and investors are not only operating under a different set of rules, but also a different set of possibilities.

“We are in the midst of an important dialogue about our digital world, and one vitally important piece of that is our digital health world,” Geetter says. “I expect we’re going to continue to see volatility and flexibility because the technologies are changing. People always talk about innovation on the technology side, but we’re going to have to be legal innovators as well.”

Small Devices, Big Business

Most consumers are familiar with wearable devices, if they’re not wearing one now. Many look like space-age watches and have the functionality of desktop computers. They are a part of the Zeitgeist where people compare the number of steps they’ve taken or flights of stairs climbed around the “water cooler” or on Facebook. Many predict that one day these devices will be as ubiquitous as cell phones.

Among wearable devices, Fitbit captured the public’s imagination first and to the greatest extent with its trim, multi-colored plastic wristbands that resembled the Livestrong yellow bracelets, but without the controversy. What began as a homely, hyped-up pedometer in 2007 has turned into a handsome tracking device, monitoring sleep habits, blood glucose levels, calories, heart rate, distances traveled, and routes used.

But Fitbit isn’t alone in the vast frontier of health-tracking tools. Today there is a long list of competitors producing nearly identical lollipop-colored wristbands and mind-boggling applications. Its rivals range from Garmin to Jawbone, Under Armour to Google, and Xiaomi to Misfit. Even jewelry company Swarovski has entered the fray with its bejeweled Shine. Of course, casting a long shadow over the entire category is the Apple Watch, part designer adornment, part lifestyle computer. The Apple Watch, like most Apple products, became a wearable industry leader even before it was shipped to stores in April 2015.

Sales of wearable gadgets – smartwatches, smart eyewear, and fitness-tracking devices – have exploded in popularity in recent years, and they are expected to register some 30.9 million units in sales in 2015, according to the U.S. Consumer Electronics Sales and Forecasts, the semiannual industry report of the Consumer Electronics Association (CEA). The forecast, which was released in January 2015 and updated in July, estimated that health and fitness trackers would lead sales among wearable devices with projected sales of 20 million units, and revenues reaching $1.8 billion in 2015, an 18 percent increase over [2014].

International Data Corporation (IDC), a global marketing research firm, reported that consumer spending on wearable devices tripled in 2014 compared to 2013. IDC predicts that production of health trackers will jump from 20 million units in 2014 to more than 120 million units in 2019. Meanwhile, the NPD Group, a sales tracking company, reported that more than 25 percent of U.S. consumers already use fitness apps.

Observers believe wearable tech sales will remain robust as long as the applications market follows suit. The availability of applications from third-party developers will ensure the long-term growth of the tracker and smartwatch markets, but it also creates a tsunami of new health information and privacy concerns.

Applications such as Runkeeper, Fit-Star Personal Trainer, Nike+ Training Club, and Fitnet allow consumers to use their smartphones to set their physical regimen and monitor their fitness goals. (Fitnet even uses a smartphone’s camera to evaluate whether users are exercising the right way.) A 2014 report released by ACT: The App Association, an industry group for application makers, shows that the number of health and medical apps doubled between 2012 and 2014, and analysts are expecting revenues to reach $26 billion by 2017.

“It’s one of those odd confluences in that everyone is interested in the same thing, which is improved patient outcomes,” says Morgan Reed, executive director of ACT. “What we’re really trying to do is have healthier and more able people to be in charge of their own lives and be able to connect to a doctor when they want.”

Connecting to doctors presents another series of opportunities and hurdles. Nearly 100 million wearable remote patient monitoring (RPM) devices – such as pulse oximeters, blood pressure cuffs, ECG monitors, and continuous glucose monitoring tools – are expected to be produced over the next four years, according to ABI Research, which follows global connectivity and emerging tech trends. Already, Apple, Google, and Samsung have signaled that they plan to produce RPM devices.

RPM devices, most often recommended by physicians and covered under HIPAA, are transitioning some health care activities away from the doctor’s office into people’s homes. By collecting data from a variety of devices and applications, and sharing it securely over the Internet, patients and physicians can be more closely connected in designing treatments, experts say. They also can provide even broader community benefits.

One such device is Propeller Health’s inhaler, which has built-in sensors, connects through Bluetooth to smartphones, and lets individuals respond to asthma attacks while also tracking where those attacks occur. Working with Propeller Health, the city of Louisville, Kentucky, is moving beyond the individual to the community to find asthma hotspots. Launched back in 2012, Louisville deployed a network of air sensors, along with giving away 500 inhalers, to map out areas that coincided with individual asthma attacks. The data was used to monitor air pollution and then devise treatment plans for local asthma sufferers.

The whiz-bang qualities of these devices are many, but they still suffer the fair-weather nature of consumers. Much like other once-popular tech gadgets, 3D glasses and PDAs among them, fitness trackers are plagued by the same problems as other smart devices: the short attention span of consumers. The NPD Group reports that 40 percent of activity-tracker owners stop using the devices within six months of purchasing them. That may account for forecasts that smartwatch sales could eventually overtake fitness tracker sales, as it is easier to remain loyal to a watch than to a monitor, the sole purpose of which is to remind consumers to keep their New Year’s resolutions.

The Internet of Things

Fitness-tracking devices live in a much larger world of technology than health care, one that technologists have described as The Internet of Things (IoT). The IoT is a place where devices are linked and communicate with each other, an amalgam of sensors, programs, and connectivity. It is a universe where physical objects, from coffee pots to furnaces to automobiles, come to life at their owners’ bidding. The FTC estimates that some 25 billion connected objects and devices will be online in 2015.

Last January, FTC Chair Edith Ramirez expressed concerns about the privacy risks posed by the IoT, and she encouraged the tech industry to address those concerns or risk losing the confidence of consumers and the full adoption of IoT’s promise. “IoT has the potential to provide enormous benefits for consumers, but it also has significant privacy and security implications,” warned Ramirez in her remarks at the 2015 Consumer Electronics Show, which has become an annual pilgrimage for tech geeks.

“Connected devices that provide increased convenience and improve health services are also collecting, transmitting, storing, and often sharing vast amounts of consumer data, some of it highly personal, thereby creating a number of privacy risks,” Ramirez added.

Attorneys believe that the three primary privacy challenges for the IoT, which includes health tracking devices, are the ubiquitous data collection that exposes a deep well of personal information; the potential for unexpected uses of consumer data by everyone, from employers to insurance companies, and the adverse consequences that could arise from those uses; and heightened security risks from hackers who may be tempted to commit larceny by the sheer volume of data.

“It’s inevitable that we move to an Internet of Things approach,” says Elliot Golding, counsel at Crowell & Moring LLP. “It’s hard to see how a washer talking to a refrigerator becomes an application that excites us, but there is a place where integrated and automated devices will improve the quality of life. But when you have all these devices talking to each other, the least secure device becomes the security level for all your devices.”

Given that reality, FTC’s Ramirez encourages companies to “bake” privacy into their devices or applications from the start. The strategy would be to push companies to build devices with privacy elements such as additional sets of passwords and encryption; to reduce the amount of data that devices collect and store; to make data as anonymous as possible; and to increase company transparency with additional consumer notices on devices – particularly if companies plan to share the data with third parties – and the ability to consent or not to data collection.

“In my mind, the question is not whether consumers should be given a say over unexpected uses of their data; rather, the question is how to provide simplified notice and choice,” Ramirez said.

Privacy of What?

Observers say that what constitutes health data these days changes as quickly as the technology that creates it, which makes it hard to figure out what to do with that data and whether it needs to be protected. After all, the number of steps a person takes daily isn’t the same data as one’s white blood cell count, or is it?

The answer to that question will be an important factor in deciding where to draw the line on privacy with newly generated information from fitness trackers, mobile apps, and smartwatches. It’s a question government regulators are already trying to answer. Industry is also wrestling with its desire to avoid tough privacy regulations while touting the health benefits of their applications.

Most people can agree that information collected about patients by health care providers – doctors, hospitals, or health clinics, to name a few – to guide medical treatment decisions and care qualifies as health data. And that information is and should be protected under HIPAA and HITECH, the Health Information Technology for Economic and Clinical Health Act, which was enacted to promote the adoption and use of health-information technologies. But can consumers really expect privacy when their tracker sends off their GPS coordinates at the same time as it shares their steps in the cloud?

The jury’s out on whether a person’s stair or step count could be included under HIPAA or state regulations governing health privacy or security breaches. Part of the problem for government and industry has been balancing the benefits of these gadgets with the myriad of ways user information is being collected and shared with third parties, such as advertising firms and app developers.

“In most cases, HIPAA is not going to apply to the devices or the information,” Crowell’s Golding says. “What rules are going to govern how we handle very sensitive information is an issue that we’ll need to carefully think about. How do you protect privacy and security in a smart way, both at the outset of creating a device and on an ongoing basis?”

Because privacy and security policies tend to be reactive, their use will likely depend on the evolution of how the public defines health information over the next few years. An individual’s heart rate or blood glucose levels certainly seem to qualify as health data, but are they exempt from health privacy regulations because people create that data on their smartphones? It is a muddle.

“There’s a huge debate right now about what to do with all this health care information that’s being gathered outside of the existing HIPAA regulatory structure,” says Kirk Nahra, a partner at Wiley Rein LLP. “There’s an increasing consensus that we do something and no consensus on what we do.

“Information we would normally think of as health information is getting collected and analyzed outside the normal hospital and doctor’s office settings,” Nahra adds. “It doesn’t necessarily mean the companies in this business are doing bad things with the data, but they could.”

At the moment, however, the majority of consumers seems largely disconnected from and unfazed by health privacy concerns. No horrendous breach of consumer-generated health data has captured the public’s attention. In fact, consumers are more likely to marvel at the cool devices or the space-age apps than be creeped out by the thought of some unseen data broker collecting their information and selling it.

Legal experts say the disconnect reflects a common pattern in public discussions about privacy over the last few decades, and especially during the Internet era. It is always an evolving process as society comes to better understand what are reasonable expectations of privacy for consumers, and how those match with the public’s interest in accessing these devices.

"I think people really do care about privacy, but they don’t really know what to do about it,” says De Mooy of the Center for Democracy &Technology. “The data sharing that’s happening isn’t visible to them. There’s a lot of backend to these technologies that people don’t know about. Companies need to be educated on how to be transparent, and people need to be educated on who they can and should trust.”

Expectations of privacy tend to evolve over time, and they are definitely being transformed with these new technologies, likely faster than the public knows. There are innumerable societal factors at play here because the devices serve multiple roles for many different people, and their expectations about the applications are countless.

Partly there is a generational divide, where Millennials may feel perfectly comfortable sharing health data while the stodgy Baby Boomers fear the specter of Big Brother over their shoulder. There’s also the reasoning of some that people who don’t have anything to hide can ignore the potential of privacy breaches. After all, they’re healthy, active, and trim, so what would it matter if an insurance company or their employer acquired their fitness records?

Partly the situation may be the result of ignorance. It is unclear whether people understand how their data is used and how it moves between fitness trackers to the Internet and beyond. For example, few consumers know that hidden deep within most privacy policies is a clause that allows companies to turn over data to the government for valid law enforcement queries and other legal requests.

Most consumers also feel somewhat protected by the privacy policy check-off boxes on registration pages, mobile apps, or desktop interfaces, even though those sign-offs are so breezily automatic these days it would be nearly impossible to find anyone who has scrolled down and read the entire policy before checking the agreement box.

Attorneys say privacy policies are useless in the face of nefarious hackers, which is why there is so much emphasis on building stronger hardware and software security functions into devices and the systems that govern them. Privacy policies only come into force when dealing with a company’s choices about collecting and sharing consumer data.

The marketplace for data is a fierce one, and data brokers buy information as quickly as it is created. They in turn sell it to any number of companies, from insurers looking to determine premiums or sell policies to employers doing background checks on new hires. Consumer expectations of privacy cannot keep pace with this kind of technology, experts say, and that could pose some real problems for health and fitness data generated by and about them.

“This is an area that is simultaneously extremely exciting and kind of scary,” Golding says. “In my view, wearables have the potential to be a truly disruptive technology that can help society and help people. Yet, there’s so much danger with them in dealing with the potentially sensitive information they create.”

Corporate Best Practices

Industry officials acknowledge the dangers of unrestricted disclosures of fitness and well-being information, but they fear that an aggressive approach by government to limit the collection and sharing of data could prove a wet blanket on innovation. It could thwart industry and consumers from realizing the benefits of the IoT, especially the potential of health-monitoring devices.

“One reason that we’re where we are with these new technologies is they’ve grown out of an open environment,” says Anna L. Spencer, a partner at Sidley Austin LLP. “I’m very hesitant to say and impose requirements on a technology that is nascent and that could really transform health care, which desperately needs transforming.”

While the FTC’s Ramirez appreciates the importance of keeping the door open for innovation to advance technology and the U.S. economy, she seems particularly unwilling to give the industry a fully open field in which to operate. “I question the notion that we must put sensitive consumer data at risk on the off chance a company might someday discover a valuable use for the information,” she noted.

Industry has responded in the past year by pressing for a corporate best-practices model in addressing privacy concerns, hoping to avoid the heavy hand of federal and state regulation. Corporations already have adopted policies that better communicate privacy information to consumers, that focus on more thoughtful approaches to the security architecture and data discipline, and that vow not to sell or share data with third parties. And app makers have begun to offer free and paid versions of apps where consumers can get more privacy restrictions if they want to pay for them.

The best-practices approach received its heartiest endorsement in September 2014, when Apple Chief Executive Officer Tim Cook wrote an open letter to consumers that effectively set the standard for corporate transparency on privacy, data collection, and data sharing. Cook’s letter – and Apple’s accompanying consumer privacy Web site – was a response to the hacking of iCloud accounts and complaints that Apple hadn’t done enough to protect customer data.

“Our business model is very straightforward: We sell great products,” Cook wrote. “We don’t build a profile based on your email content or web browsing habits to sell to advertisers. We don’t ‘monetize’ the information you store on your iPhone or in iCloud. And we don’t read your email or your messages to get information to market to you.”

Legal experts believe that corporations such as Apple, Microsoft, and dozens of other top-line technology companies are defining best practices with their very public privacy policies, and they believe it is the best way forward to guard consumer privacy while balancing the desire to pursue innovation.

“The leaders in the industry are going to look to the importance of their brand,” Kelley Drye’s Wolff says. “Consumers have impressions of brands, and they ask themselves whether they can trust a company. They recognize there are always going to be risks, but I think there is value in the consumer mind and the company mind in terms of offering a good product with robust consumer protections.”

Adopting a regulatory scheme that relies on industry best practices also has the advantage of timeliness. “Nobody wants technology at the speed of government,” ACT’s Reed says. “That is especially true here in the personal health information space. I think that industry best practices are going to be the first step for highlighting and clarifying for consumers what’s going on.”

While the FTC has provided some guidance for companies, outside groups are also stepping in to offer up sample privacy foundations. In August 2015, the Online Trust Alliance (OTA), a nonprofit think tank, issued a privacy and security framework that companies could adopt for IoT devices, although it initially focused on home automation and health-wearable technologies. The principles underlying the recommendations are transparency and data security, which are based on the Fair Information Practice Principles (FIPPs), the FTC’s widely accepted guidelines for privacy-focused data collection practices.

“Security and privacy by design must be a priority from the onset of product development and be addressed holistically,” the OTA noted in releasing the framework, which covers everything from consumer access to privacy policies to breach response and consumer notification plans. “It must be a forethought versus an afterthought, focusing on end-to-end security and privacy.”

A Role for Government

The push for a best-practices approach to privacy protections has won wide support within the industry, and even some privacy advocates say there are good reasons to give companies a chance to solve the most egregious problems with tighter internal controls over information. There is a general fear that an aggressive regulatory scheme is the last thing these technologies need to grow.

Yet, technological innovation is always going to force a conversation about what is reasonable expectation of privacy for consumers, especially in a fast-changing technological age, and that may be a question that is best resolved by government, some say. While personal-generated health information may not rise to the level of HIPAA, it is closely watched by government agencies, from the FTC to the U.S. Food and Drug Administration (FDA) to the U.S. Department of Health and Human Services (HHS) and its agencies to state regulatory bodies.

For some attorneys, the fuss about adding new privacy restrictions on device usage and information sharing is little more than window dressing. They believe there are enough statutes and regulations on the books today to successfully enforce privacy rights and protections in the United States.

“It’s not that there is a complete absence of law,” says Sidley’s Spencer. “Just because HIPAA doesn’t apply, that doesn’t mean it is a free-for-all. It’s not. There are restrictions such as enforcement of the FTC Act, which prohibits unfair and deceptive trade practices. The FTC has, through its enforcement, focused on privacy and ensuring companies comply with their privacy notices. There are a myriad of unfair and deceptive practice statutes that state attorneys general use all the time to fight businesses engaging in practices that harm consumers.”

Still, for some, the best solution is a government one. “If companies of fitness devices have the ability to sell personal health data to insurers, employers, and others, users should be alerted and given the opportunity to decline. The FTC should require fitness devices and app companies to adopt new privacy measures that will help conceal the identity of individuals and develop policies to protect consumer information in the event of a security breach,” said U.S. Senator Charles Schumer (D–N.Y.) in a written statement in August 2014.

Many observers believe the FTC does a pretty good job of using the tools at hand to monitor and enforce consumer privacy protections guarded by the FTC Act. It regularly brings legal actions against companies that violate privacy rights or fail to maintain security. And it frequently applies section 5 of the Act to ensure companies are not employing unfair and deceptive practices in their dealings. Even friends of the FTC say that its approach to regulation could be strengthened, as could its penalties, to send a more forceful message to tech companies about the importance of privacy.

In January 2015 the FDA issued a draft guidance paper, titled “General Wellness: Policy for Low Risk Devices,” noting that it doesn’t plan to regulate “low risk general wellness products” that are being described by retailers and manufacturers as “medical devices” under the Federal Food, Drug, and Cosmetic Act. Many expect the FDA, however, to keep an eye on the growth of these devices and their health claims.

Some have suggested that the privacy of new data being created could be addressed by expanding HIPAA to cover consumer-generated health and fitness information. It would have the benefit of not creating an entirely new statute, and it would stake out clearly the parameters of what “health data” means today.

“When we wrote the HIPAA rules, we defined the health care industry by law in a certain way that most accurately reflected it at the time. It has become less accurate over time,” Wiley Rein’s Nahra says. “You could change HIPAA to have it cover all health information regardless of where it’s coming from. Right now, it has to come from the right place for it to be health information and protected.”

HHS has already proven that it is open to changing what constitutes a covered entity under HIPAA. In January 2013 it issued new rules under HIPAA and HITECH that included “business associates,” or contractors or subcontractors for covered companies, to capture the increasing use of third-party cloud companies for storage of protected medical information. The same could be done for consumer-generated devices and their corporate developers.

Regulating the devices and applications more broadly would likely prove complex, however. Small changes in functionalities or how the product is offered can shift the regulatory location from the FTC to the FDA, and that can add to consumer confusion as to expectations of privacy. It can also be difficult for innovators who are trying to invent new devices but aren’t sure where to look for guidance on how best to protect consumers in the process.

“I think the FTC will have to decide for itself what it feels is the best way to convey to the commercial community what its regulatory expectations are and a way to communicate to consumers what their reasonable expectations of privacy can be,” McDermott’s Geetter says.

Meanwhile, there has been interest at the state level to adopt new regulations for health-tracking devices. Already, 47 states have separate data breach notification statutes, and California, Florida, and Texas have expanded their laws recently to widen the scope of information that qualifies as personal, such as medical history, treatment, or condition. In Texas, the Texas Medical Records Privacy Act covers any person who comes into possession of personal health data, and it bans the sale of that information without authorization.

Not surprisingly, industry leaders are loathe to face a medley of new state regulations governing the privacy of wearable devices and imposing new limits on how consumer-generated information can be shared. “The problem is when you end up with a patchwork of state regulation . . . you end up with harm to smaller, innovative companies that are trying to do something innovative in the market,” ACT’s Reed says.

The FTC dipped back into the public debate at its November 2015 workshop examining the privacy issues that arise with advertising and marketing, and the tracking of consumer activities across different devices. Some of the trouble stems from consumers who end up interacting with various platforms, applications, and software when using their smartphones and wearable devices.

“More consumers are connecting with the Internet in different ways, and industry has responded by coming up with additional tools to track their behavior,” said Jessica Rich, director of the FTC’s Bureau of Consumer Protection, in a statement. “With the advent of new tracking methods, though, it’s important to ensure that consumers’ privacy remains protected as businesses seek to target them across multiple devices.”

Privacy as Collateral Damage

Talk to most attorneys about the IoT or wearable devices, and there is a sense of inevitability that these remarkable technological devices will eventually fail in protecting consumer privacy and all this newly generated information. This brave, new world of technology is unforgiving when it comes to data because data is its currency.

“A few years ago, users of Internet services began to realize that when an online service is free, you’re not the customer,” wrote Cook in his famous letter last year. “You’re the product.”

Certainly, attorneys, privacy advocates, and government officials believe that best practices can go a long way toward protecting data. They all are reluctant to engage the full force of government on the problem because it will always come at a cost. Most likely the price will be paid in innovation, as privacy requirements limit the choices of designers and developers looking to create that next generation of application or device.

“Privacy protections are about choices; as you add privacy protections you, by definition, restrict how data is used and disclosed,” Geetter says. “Finding the right balance between what we want to do, who we want to share the data with, and how to protect it is the exciting challenge.

“We don’t know what we’re going to invent tomorrow,” Geetter adds. “We know we’re going to invent something. The challenge for our privacy regulation landscape is to try to accept that we need a model that can spring into action as innovation occurs. We cannot afford to develop a privacy and security framework that works only for today and is out of date tomorrow.”

All this effort by tech companies and government is designed to protect consumers, in part, from themselves. Everyone loves these new technological devices and the free tools found in applications. The public has grown accustomed to tools like Gmail and Yahoo arriving on their virtual doorstep for free. In fact, some would argue that it has made individual consumers particularly lazy in being advocates for their own privacy, and it has made it very easy to discard those hard-won protections.

Last year a Canadian court became one of the first courts worldwide to accept data from a Fitbit as evidence in a personal injury case. The plaintiff was injured five years ago, and once the case goes to trial, her lawyer plans to analyze the data from the Fitbit to prove her daily activity levels were below those of someone her age and profession. She was a personal trainer.

While it is certain fitness trackers will end up as part of litigation below the border, it is not clear whether they will help or hurt a case. A lack of standardization, users’ failure to wear, charge, or sync their devices, and the unreliability of logged activity, which could be generated with a wave of the hand, make wearable devices unreliable witnesses.

What’s important here, observers say, is not the reliability of the device to be used in court as much as consumers’ decisions to give up their privacy protections for convenience. Many individuals are more than willing to open up their lives for expediency in court, or in their workplace when offered bonuses or discounts from employers for wearing health trackers, or with life insurance companies that reduce premiums for customers who wear smart watches.

“Our longing for convenience means we’ve created a matrix that can and will be used against us,” wrote software analyst R. “Ray” Wang in his Harvard Business Review article, “Beware Trading Privacy for Convenience,” in June 2013. “Most of us just don’t know it yet.”

This article appeared in the December 2015 issue of Washington Lawyer, the official publication of the District of Columbia Bar, and is reprinted with permission.