By Corey Stephenson
The Daily Record Newswire
A proposed Florida ethics opinion suggests that lawyers have an ethical duty to sanitize their storage devices, including iPhones, Blackberrys, flash drives, laptops and copiers, in order to prevent inadvertent disclosure of confidential client information.
Proposed Advisory Opinion 10-2 would require attorneys who choose to use devices that store media to take reasonable steps to ensure that client confidentiality is maintained and that the device is sanitized before it is disposed of.
Further, lawyers would need to get “adequate assurances” from vendors that discarded or leased machinery has been wiped clean of sensitive records, supervise non-lawyer personnel who use computers and computerized equipment to protect confidential matters, and take care when using such devices in public settings, such as a hotel business center.
While a duty to maintain client confidences is implicit in the Rules of Professional Responsibility, the proposed opinion would create an explicit requirement with the potential for liability, explained Michael Downey, a partner at Hinshaw & Culbertson in St. Louis, Miss. who blogs about ethics at The Ethical Quandary.
“Lawyers need to understand where they are putting information, assess what the risks are of that location, and consider whether or not it is appropriate to put the information there,” Downey said.
For example, putting a presentation given in a public forum on an unencrypted flash drive is probably acceptable, he said. But putting client information such as medical records, intellectual property or trade secrets on a similar device would be bad idea.
“Using a copier to make a copy of a publicly available pleading is different than making copies of personal financial information of my clients or the opposing party,” he said.
Sharon Nelson, president of Sensei Enterprises, Inc., a computer forensics and legal tech company based in Fairfax, Va., said the Florida opinion could serve as an educational tool for attorneys unaware of the need to sanitize their storage devices.
“It makes sense to make [the requirement] explicit, because scads of lawyers just don’t get it,” she said. “Lawyers need to be more careful of the security risks of public places and not cleaning their own devices.”
The advisory opinion is premised on two existing duties: the obligation to provide competent representation, and the requirement to protect client confidences.
The opinion defines storage media as “any media that stores digital representations of documents,” including computers, printers, copiers, scanners, cellular phones, PDA’s, flash drives, memory sticks, fax machines and other electronic or digital devices.
“Because many lawyers use these devices to assist in the practice of law and in doing so intentionally and unintentionally store their clients’ information on these devices, it is important for lawyers to recognize that the ability of the devices to store information may present potential ethical problems,” according to the opinion.
As drafted, it would require attorneys to affirmatively ascertain that devices like a leased copier have been stripped of all confidential information, “whether by some type of meaningful confirmation, by having the sanitization occur at the lawyer’s office, or by other similar means.”
Further, lawyers who use devices in public places – including offices of opposing counsel, cyber cafés or hotel business centers — should “inquire and determine whether use of such devices would preserve confidentiality.”
But the proposed opinion may be setting some unrealistic requirements, Downey noted.
For example, most solos and small firms lease their photocopiers, and “destroying the memory will probably violate the terms of the lease,” he said. And seeking a certification from the vendor that the memory has been wiped seems like an unlikely proposition, he added.
Getting assurances from a public vendor, like a hotel business center, would be next to impossible, Nelson noted.
“No business center or cyber café is going to give you anything in writing,” she said. “There is really no way lawyers can meet that requirement.”
The proposed opinion was made available for public comment and will now be reviewed before a final opinion is issued.
Downey predicted the burdens imposed by the opinion will be somewhat alleviated before it is issued in final form, because the Florida Bar won’t want to “set a standard where lawyers are destined to fail.”
But regardless of the outcome, all practitioners need to be aware of the importance of sanitizing their storage devices and taking the proper precautions, “like making sure a smartphone is password protected,’ Downey said.
Nelson suggested taking advantage of free products like Derrick’s DBAN (“Boot and Nuke”), which will completely wipe a hard drive.
“Even us forensic folks can’t get to the data when it is used, and lawyers love the price,” she said.
