April 12, 2012
As I’ve been looking into the issues around lawyers putting client data in the cloud, I’ve run into a fair amount of (quasi?) scholarly work on the issue. There are several organizations that have published advice on the subject, including ILTSO, ILTA and ISACA. The primary source materials come from the ABA and various state bar Ethics Committees. So far, case law is very limited, dealing more with maintaining the attorney-client privilege with email and the discoverability of client data that someone else put in the cloud. Your malpractice insurance provider may have something to say about it. And then law practice management vendors publish “White Papers” that describe why their product is a great solution for your practice.
It’s a lot of fairly complex data and it doesn’t all agree. I’ve written a couple of articles for local Colorado legal publications on how the Ethics Committees are approaching the issue. But, so far their advice has been vague and unrealistic. Clearly the users of the many law practice management systems out there (not to mention gmail, Dropbox or Docs to Go users) haven’t been paying attention to them. And until one of them has a big security breach and clients start grieving, no one will – which doesn’t mean lawyers shouldn’t care what the Ethics Committees think. It’s just that the committees aren’t very helpful for lawyers trying to make an educated decision, or use “reasonable precautions” as the opinions require.
I’ve found that some of the organizations give more practical advice. But, the reader still needs to appreciate who is involved in giving that advice. ILTA, the International Legal Technology Association, has some informative publications. It’s important to know, however, that they are provided or sponsored by the vendors of the services they are evaluating. It’s a trade organization, or as it describes itself, a ‘networking organization’.
In contrast, ILTSO, the International Legal Technical Standards Organization, has some of the same membership as the ILTA, but is focused on providing lawyers with standards that they can use to self assess their security compliance. Their standards for client data security are specific and clear, if perhaps beyond what most lawyers are doing today.
ISACA, the Information Systems Audit and Control Association, has a broader audience than just the legal profession. And think about it, other types of businesses, including health care and financial services, have many more technical security requirements to follow than lawyers. It is an independent organization that provides certification in auditing and security. ISACA has issued guidelines on adopting cloud use that lawyers can apply to the business of practicing law which shed light on the risks and rewards of this advanced technology.
Finally, a few words about white papers. The purpose of a white paper is to help you make a decision, so the author is important. They are rarely impartial. A commercial white paper is written to persuade you to choose that vendor’s product. They aren’t false, or they would be prohibited by the FTC rules on false advertising. But they are marketing materials. Think of it like a brief. It may cite cases and ethics opinions. It may also conveniently ignore various issues. Trade associations and standards organizations also have agendas. To the extent their white papers help prod vendors and users towards better practices, I trust them more. If ethics committees considered the advice of the standards organizations when they issue their opinions (and maybe they did, but it’s not apparent), they would be more practical and helpful.