I Spy: Client Confidentiality, Computer Security, and Counter Surveillance Wednesday, March 7, 2018 Noon–1 p.m. .5 Practical Skills credit and .5 Ethics credit I SPY: CLIENT CONFIDENTIALITY, COMPUTER SECURITY, AND COUNTER SURVEILLANCE The materials and forms in this manual are published by the Oregon State Bar exclusively for the use of attorneys. Neither the Oregon State Bar nor the contributors make either express or implied warranties in regard to the use of the materials and/or forms. Each attorney must depend on his or her own knowledge of the law and expertise in the use or modification of these materials. Copyright © 2018 OREGON STATE BAR 16037 SW Upper Boones Ferry Road P.O. Box 231935 Tigard, OR 97281-1935 I Spy: Client Confidentiality, Computer Security, and Counter Surveillance ii TABLE OF CONTENTS Schedule . v Faculty . v Presentation Slides. 1 Protecting Your Windows Computer . .43 Standard Disclaimer . .44 BIOS Password . .45 Encrypt Hard Disk Drives—Internal/External . .58 Windows BitLocker Supported Windows Version . 59 Drive Encryption for Windows 10 Home Edition Users. .77 Additional Backup and Encryption Tools to Protect Data on Your Computer . 126 Protecting Mac Computers . 133 Backup MAC OS X. .134 Mac Encryption . 174 Turn Off Encryption . 204 I Spy: Client Confidentiality, Computer Security, and Counter Surveillance iii I Spy: Client Confidentiality, Computer Security, and Counter Surveillance iv SCHEDULE Presented by Tom Howe, Howe & Associates, Portland 11:30 Registration Noon I Spy: Client Confidentiality, Computer Security, and Counter Surveillance F Protecting client confidential information F Securing client data, encryption, and effective passwords F Breach of attorney-client privilege through electronic surveillance and spyware F Backups to prevent data loss 1:00 Adjourn FACULTY Tom Howe, Howe & Associates, Portland. Mr. Howe is one of the leading e-discovery lawyers in the country, providing legal/technology consulting and expert witness services to the United States government, Fortune 500 corporations, law firms, and e-discovery service providers. He has also written major software systems for e-discovery vendors, law firms, and corporate clients. The Legal Operation Tracking System is a comprehensive program that tracks all legal matters within a corporate legal department, including its collection of documents and electronically stored information, enabling faster and more defensible discovery. Mr. Howe is a regular CLE presenter across the United States and internationally and has authored five books on law and technology. He is licensed to practice in Oregon and Washington and is certified in Computer Forensics and Electronic Counter Surveillance. I Spy: Client Confidentiality, Computer Security, and Counter Surveillance v I Spy: Client Confidentiality, Computer Security, and Counter Surveillance vi I Spy - Client Confidentiality, Computer Security, and Counter Surveillance Download Session Materials x Everything you see on these slides is contained in a PDF file. x You have it all! Please download a zip file with all the PowerPoint slides and sample documents for this session. Download Link: http://howelawfirm.com/events x Questions: Tom Howe 503-227-6660 [email protected] I Spy: Client Confidentiality, Computer Security, and Counter Surveillance 1 Links to Vendors x Web links to vendors, products, and services are provided as examples. x Do your own research to find the best vendors, products, and services to meet the specific needs of your law firm. Standard Disclaimer x This material is provided for informational purposes only and does not establish, report, or create the standard of care for attorneys, nor does it represent a complete analysis of the topics presented. Attendees should conduct their own appropriate legal research. The information presented does not represent legal advice. x All technical information covered in this presentation should be confirmed with your IT staff or technical consultant to make sure it is applicable and correct for your IT system. I Spy: Client Confidentiality, Computer Security, and Counter Surveillance 2 Electronic Discovery Lawyer/Expert What to Talk About? x Competency o You must understand and use electronic evidence (phones, computers, and social media) for your cases. o 99% of data is electronic! x Confidentiality o The focus of this presentation. One of the most fundamental concepts in ethics, more important today than ever, and high risk of discipline and licensing issues. I Spy: Client Confidentiality, Computer Security, and Counter Surveillance 3 RULE 4-1.6: CONFIDENTIALITY OF INFORMATION (a) A lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent... A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. Agenda x Computer Security of Client Data o Laptop Stolen o Passwords o Encryption o Backups x Breach of Attorney-Client Privilege through Electronic Surveillance and Spyware x Computer Files: Metadata x Smartphones: Protecting Confidential Client Data x Closed Files: Destruction of Electronic Evidence I Spy: Client Confidentiality, Computer Security, and Counter Surveillance 4 Protecting Client Data and Encryption Stolen Laptops Statistics x 3.5 million laptops are stolen each year x 10% of all laptops are stolen in the first year x $1.8 billion cost for lost stolen laptops each year I Spy: Client Confidentiality, Computer Security, and Counter Surveillance 5 Stolen Laptop - Consequences x Ethical problem because of loss of client data. x Cost to replace the laptop x Cost and time to recreate the data (if that is even possible). x According to the National Archives & Records Administration, 93% of companies that lost their data center for 10 days or more due to a disaster filed for bankruptcy within one year of the disaster. Of those companies, 50% filed for bankruptcy immediately. x Identity theft Does Malpractice Coverage Exclude Data Breach? Example: Confidential or Private Data Exclusion. This Plan does not apply to any CLAIM arising out of or related to the loss, compromise or breach of or access to confidential or private information or data. If the insurer agrees to defend a SUIT that includes a CLAIM that falls within this exclusion, the PLF will not pay any CLAIMS EXPENSE relating to such CLAIM. I Spy: Client Confidentiality, Computer Security, and Counter Surveillance 6 Stolen Laptop – Set a Bios Password x Set a password to prevent the computer from starting (before the operating system starts) x PC: Set a BIOS/UEFI Password x Mac: Set a firmware password: https://support.apple.com/en- us/HT204455 Protecting Your Windows Computers (132 Page) I Spy: Client Confidentiality, Computer Security, and Counter Surveillance 7 Protecting Your Mac Computers (81 Page) Use Strong Passwords x Combination of letters (upper and lower), numbers, and special characters (#@*&+!). x Use a unique password for your computer and phone. x Do not put our password on post its on your monitor: I Spy: Client Confidentiality, Computer Security, and Counter Surveillance 8 LoJack for Laptops x Remotely locate a stolen laptop. x Remotely wipe (delete) the data on the laptop. x http://www.lojack.com/Laptops x Cost: About $60 for 2 years or $80 for 3 years. Encryption x Encrypted data is highly secure (not human readable). x Demo: Access hard drive with another computer. I Spy: Client Confidentiality, Computer Security, and Counter Surveillance 9 Windows 10 Home vs. Windows 10 Pro x Windows 10 Home edition does not include the BitLocker encryption software. x If you use Windows 10 Home, either upgrade to Windows 10 Pro or use other encryption software. See "Protecting Your Windows Computer." Encrypt All Devices x Computers x Phones x Hard Drives and Thumb Drive I Spy: Client Confidentiality, Computer Security, and Counter Surveillance 10 Computer Backups (Disaster Recovery) x “Because backing up is hard to do” x Daily, weekly, and remote offsite backups. x Human error is the cause of 32% of all data loss. x Backup work throughout the day. Online Backups x www.crashplan.com x www.dropbox.com x www.carbonite.com x www.mozy.com I Spy: Client Confidentiality, Computer Security, and Counter Surveillance 11 Surveillance: Protecting Client Data/Communications Protecting Attorney-Client Privileged Communications x “My spouse/partner is spying on me.” x Protecting Attorney-Client communications. I Spy: Client Confidentiality, Computer Security, and Counter Surveillance 12 Counter Surveillance Overview x I don’t do surveillance; I stop it. x Certified at the largest private counter surveillance training center. x No marketing but more counter surveillance requests each year. x Example: Refog software x Example: Hospital Name Badge Hackers Target Law Firms for Confidential Data x Robert Mueller, former Director of the FBI: "I am convinced that there are only two types of companies: Those that have been hacked and those that will be." x Wall Street Journal: “Hackers Breach Law Firms …” I Spy: Client Confidentiality, Computer Security, and Counter Surveillance 13 Modern Times x There is no reason for a private investigator to sit in a car all night, drinking bad coffee and stale donuts, when you can buy a phone app for $1.99 Take it Serious – Ask Questions x Take it seriously and ask questions? o Who is spying on you? o Why? Motive? o How long? o Suspect knows things they could