Protecting Client Data: Ethics, Security, and Practicality for Estate Planners
Total Page:16
File Type:pdf, Size:1020Kb
1/16/2019 Protecting Client Data: Ethics, Security, and Practicality for Estate Planners J. Michael Deege James D. Lamm Margaret Van Houten 1/16/2019 J. Michael Deege 2 • Estate planning attorney at Wilson Deege Despotovich Riemenschneider & Rittgers, PLC, in West Des Moines, Iowa • ACTEC Fellow Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 1 1/16/2019 James D. Lamm 3 • Estate planning attorney at Gray, Plant, Mooty, Mooty & Bennett, P.A., in Minneapolis, Minnesota • ACTEC Fellow Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Margaret Van Houten 4 • Estate planning attorney at Davis, Brown, Koehn, Shors & Roberts, P.C., in Des Moines, Iowa • ACTEC Fellow Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 2 1/16/2019 Introduction 5 • The practice of law is, at its core, all about receiving, processing, and transmitting information • Over the past 60 years or so, the practice of law has evolved with each major advance in information technology Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Introduction 6 • Major information technology advances: – Photocopiers – Fax machines – Personal computers – Cell phones – Internet – Email – Cloud storage and services Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 3 1/16/2019 Introduction 7 • In estate planning, we may acquire: – Social security numbers – Bank and brokerage account numbers – Net worth statements – Tax returns – Confidential family and business information • This is valuable information to cyber criminals Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Introduction 8 • We know how to protect that information when it’s on paper: – We take precautions transmitting valuable or significant paper (e.g., stock certificates, bonds, and original legal documents) – We lock the doors to our law firms and restrict who can enter – We train staff to respect client confidences Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 4 1/16/2019 Introduction 9 • Today, we need to protect confidential information in the digital world: – Take precautions transmitting confidential client data – Lock confidential data with passwords and encryption, and restrict who can access it – Train staff to practice safe computing and respect confidential client data Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Introduction 10 • Every day, about 7 million data records are lost or stolen • 72% of breach incidents are done by a malicious outsider • 18% of breach incidents are a result of accidental loss • 9% of breach incidents are done by a malicious insider Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 5 1/16/2019 Introduction 11 • In 2017, the FBI’s Internet Crime Complaint Center received reports of 301,850 malicious cyber incidents (reported losses: $1.4 billion) • The chance of arresting a cybercriminal was estimated to be 0.31% in 2016 • Malicious cyber incidents cost the U.S. economy $57 billion to $109 billion in 2016 • Other Statistics: Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Introduction 12 • Phishing is the leading cause of cyber attacks worldwide • “Amateurs hack systems, professionals hack people.”—Bruce Schneier Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 6 1/16/2019 Introduction 13 • More Bruce Schneier quotes: – “If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.” – “You can’t defend. You can’t prevent. The only thing you can do is detect and respond.” Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Introduction 14 • Today, we’ll discuss how to protect client data: – What are the rules? – What are the tools? Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 7 1/16/2019 Ethical Rules 15 • ABA Model Rule 1.1: “A lawyer shall provide competent representation to a client.” Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Ethical Rules 16 • ABA Model Rule 1.1, comment 8: “To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology.” Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 8 1/16/2019 Ethical Rules 17 • ABA Model Rule 1.6(c): “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Ethical Rules 18 • ABA Model Rule 1.6(c), comment 18: “Paragraph (c) requires a lawyer to act competently to safeguard information relating to the representation of a client against unauthorized access by third parties and against inadvertent or unauthorized disclosure.” Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 9 1/16/2019 Ethical Rules 19 • ABA Model Rule 1.6(c), comment 18: “The unauthorized access to, or the inadvertent or unauthorized disclosure of, information relating to the representation of a client does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure.” Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Ethical Rules 20 • “Reasonable efforts” factors: – Sensitivity of the information – Likelihood of disclosure if additional safeguards are not employed – Cost of employing additional safeguards Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 10 1/16/2019 Ethical Rules 21 • “Reasonable efforts” factors: – Difficulty of implementing the safeguards – Extent to which the safeguards adversely affect the lawyer’s ability to represent clients (e.g., difficult to use) Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Ethical Rules 22 • ABA Model Rule 1.6(c), comment 18: “A client may require the lawyer to implement special security measures not required by this Rule or may give informed consent to forgo security measures that would otherwise be required by this Rule.” Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 11 1/16/2019 Ethical Rules 23 • ABA Formal Opinion 99‐413: “A lawyer may transmit information relating to the representation of a client by unencrypted e‐mail sent over the Internet without violating the Model Rules of Professional Conduct.” Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Ethical Rules 24 • ABA Formal Opinion 11‐459: “A lawyer sending or receiving communications with a client via e‐mail … ordinarily must warn the client about the risk of sending or receiving electronic communications … where there is a significant risk that a third party may gain access.” Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 12 1/16/2019 Ethical Rules 25 • ABA Formal Opinion 11‐459: – Obligation to warn a client who uses an employer‐provided device or email account – Also consider other situations where a third party may have access to emails, including shared email accounts and shared devices Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Ethical Rules 26 • State ethics opinions on email: – Some states require advising a client that email is not absolutely secure – Some states require client consent to use unencrypted email – Some states require appropriate precautions when using public Wi‐Fi Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 13 1/16/2019 Ethical Rules 27 • ABA Formal Opinion 477R (May 22, 2017) (update to Formal Opinion 99-413): “A lawyer generally may transmit information relating to the representation of a client over the Internet … where the lawyer has undertaken reasonable efforts to prevent inadvertent or unauthorized access.” Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Ethical Rules 28 • ABA Formal Opinion 477R: “The use of unencrypted routine email generally remains an acceptable method of lawyer-client communication. However … it is not always reasonable to rely on the use of unencrypted email.” Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Protecting Client Data: Ethics, Security, and Practicality 14 1/16/2019 Ethical Rules 29 • ABA Formal Opinion 477R: “Therefore, lawyers must, on a case-by-case basis, constantly analyze how they communicate electronically about client matters, applying the Comment [18] factors to determine what effort is reasonable.” Protecting Client Data: Ethics, Security, and Practicality 1/16/2019 Ethical Rules 30 • ABA Formal Opinion 477R: 1. Understand the nature of the threat