The Ethics of Technology By David W. Thomas, Esq. MichieHamlett PLLC Charlottesville, VA

The First Rule of Ethics: A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation. David W. Thomas, Esq. MichieHamlett PLLC

Comment No. 6 to Rule 1.1 “To maintain the requisite knowledge and skill, a lawyer should engage in continuing study and education in the areas of practice in which the lawyer is engaged. Attention should be paid to the benefits and risks associated with relevant technology… If a system of peer review has been established, the lawyer should consider making use of it in appropriate circumstances.” David W. Thomas, Esq. MichieHamlett PLLC

Rule 1.6(d) “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information protected under this Rule.” David W. Thomas, Esq. MichieHamlett PLLC

Rule 1.6(d) explained Comment 19 – “The unauthorized access to, or the inadvertent or unauthorized disclosure of, confidential information does not constitute a violation of this Rule if the lawyer has made reasonable efforts to prevent the access or disclosure.” Comment 20 – “Perfect online security and data protection is not attainable. Even large businesses and government organizations with sophisticated data security systems have suffered data breaches. Nevertheless, security and data breaches have become so prevalent that some security measures must be reasonably expected of all businesses, including lawyers and law firms… What is “reasonable” will be determined in part by the size of the firm…. To comply with this Rule, a lawyer does not need to have all the required technology competencies. The lawyer can and more likely must turn to the expertise of staff or an outside technology professional.” David W. Thomas, Esq. MichieHamlett PLLC

Why the change? According to the ABA’s 2016 Legal Technology Survey, 26% of law firms with 500 or more attorneys admitted to experiencing some type of data breach. While only 2% of these breaches resulted in the loss of client data, 37% caused business downtime and a loss of billable hours, and 28% resulted in significant costs for correcting/remediating the breach. David W. Thomas, Esq. MichieHamlett PLLC

e-Discovery and ESI Attorneys handling e-discovery should be able to perform (either by themselves or in association with competent co-counsel or expert consultants) the following: implement/cause to implement appropriate ESI preservation procedures (sometimes called a “litigation hold”) analyze and understand a client’s ESI systems and storage; advise the client on available options for collection and preservation of ESI; identify custodians of potentially relevant ESI; engage in competent and meaningful meet and confer with opposing counsel concerning an e-discovery plan; perform data searches; collect responsive ESI in a manner that preserves the integrity of that ESI; and produce responsive non-privileged ESI in a recognized and appropriate manner. David W. Thomas, Esq. MichieHamlett PLLC

Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Sec Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Sec., LLC, 685 F. Supp. 2d 456, 464-65 (S.D.N.Y. 2010) “A failure to preserve evidence resulting in the loss or destruction of relevant information is surely negligent, and, depending on the circumstances, may be grossly negligent or willful. For example… the failure to issue a written litigation hold constitutes gross negligence because that failure is likely to result in the destruction of relevant information.” David W. Thomas, Esq. MichieHamlett PLLC

Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Sec Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Sec., LLC, 685 F. Supp. 2d 456, 464-65 (S.D.N.Y. 2010) “The next step in the discovery process is collection and review. Once again, depending on the extent of the failure to collect evidence, or the sloppiness of the review, the resulting loss or destruction of evidence is surely negligent, and, depending on the circumstances may be grossly negligent or willful. For example, the failure to collect records -- either paper or electronic -- from key players constitutes gross negligence or willfulness as does the destruction of email or certain backup tapes after the duty to preserve has attached. By contrast, the failure to obtain records from all employees (some of whom may have had only a passing encounter with the issues in the litigation), as opposed to key players, likely constitutes negligence as opposed to a higher degree of culpability.” David W. Thomas, Esq. MichieHamlett PLLC

Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Sec Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Sec., LLC, 685 F. Supp. 2d 456, 464-65 (S.D.N.Y. 2010) “Similarly, the failure to take all appropriate measures to preserve ESI likely falls in the negligence category… Recent cases have also addressed the failure to collect information from the files of former employees that remain in a party's possession, custody, or control after the duty to preserve has attached (gross negligence) or the failure to assess the accuracy and validity of selected search terms (negligence).” David W. Thomas, Esq. MichieHamlett PLLC

Cloud Computing Web-based email, like Gmail, Hotmail, and Outlook online Online file storage, such as Dropbox, Google Docs, or Microsoft OneDrive Online software (technically software-as-a-service, or SaaS), such as Microsoft Office 365 David W. Thomas, Esq. MichieHamlett PLLC

The Bar’s take on Cloud Computing (LEO 1872) “When a lawyer is using cloud computing or any other technology that involves the use of a third party for the storage or transmission of data, the lawyer must follow Rule 1.6(b)(6) and exercise care in the selection of the vendor, have a reasonable expectation that the vendor will keep the data confidential and inaccessible by others, and instruct the vendor to preserve the confidentiality of the information. The lawyer will have to examine the third party provider’s use of technology and terms of service in order to know whether it adequately safeguards client information, and if the lawyer is not able to make this assessment on her own, she will have to consult with someone qualified to make that determination.” David W. Thomas, Esq. MichieHamlett PLLC

Data Security Two-factor Authentication Staff Training “a partner or other managing lawyer in a firm always has the same responsibility to take reasonable steps to supervise subordinate lawyers and nonlawyer assistants, but the meaning of “reasonable” steps may vary depending upon the structure of the law firm and its practice. Additional measures may be necessary to supervise staff who are not physically present where the lawyer works.” LEO 1872 Email Encryption David W. Thomas, Esq. MichieHamlett PLLC

Social Media We touch our phones 2,617 times per day Facebook LinkedIn And actively check them 157 times per day Facebook 1.31 billion monthly users Averages 30 hours per week of “use” LinkedIn 106 million monthly active users Twitter 313 million monthly active users ~6,000 tweets per second David W. Thomas, Esq. MichieHamlett PLLC

Social Media is NOT Private David W. Thomas, Esq. MichieHamlett PLLC

Social Media Womack v. Yeoman, 2011 WL 9330606 (Va. Cir. Ct. 2011) No privacy protection for social media Attorneys may freely access publicly-available Facebook page James v. Edwards Post-crash shenanigans on Facebook Defendant was permitted to access Plaintiff’s Facebook account under the supervision of Plaintiff’s counsel Lester v. Allied Concrete, 736 S.E.2d 699 (2013) David W. Thomas, Esq. MichieHamlett PLLC

Social Media – How to Get It Screen Shots Low quality, no metadata Self-archive feature Not a forensic tool Easily modified Not searchable Collection tools David W. Thomas, Esq. MichieHamlett PLLC

Social Media – Collection tools Obtain everything Data Metadata Forensically-defensible MD5 hash values Read-only Searchable Ongoing monitoring David W. Thomas, Esq. MichieHamlett PLLC