1. The Ethics of Technology
By David W. Thomas, Esq.
MichieHamlett PLLC
Charlottesville, VA

2. The First Rule of Ethics:
A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.
David W. Thomas, Esq.
MichieHamlett PLLC

3. Comment No. 6 to Rule 1.1
“To maintain the requisite knowledge and skill, a lawyer should engage in continuing study and education in the areas of practice in which the lawyer is engaged. Attention should be paid to the benefits and risks associated with relevant technology… If a system of peer review has been established, the lawyer should consider making use of it in appropriate circumstances.”
David W. Thomas, Esq.
MichieHamlett PLLC

4. Rule 1.6(d)
“A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information protected under this Rule.”
David W. Thomas, Esq.
MichieHamlett PLLC

5. Rule 1.6(d) explained
Comment 19 – “The unauthorized access to, or the inadvertent or unauthorized disclosure of, confidential information does not constitute a violation of this Rule if the lawyer has made reasonable efforts to prevent the access or disclosure.”
Comment 20 – “Perfect online security and data protection is not attainable. Even large businesses and government organizations with sophisticated data security systems have suffered data breaches. Nevertheless, security and data breaches have become so prevalent that some security measures must be reasonably expected of all businesses, including lawyers and law firms… What is “reasonable” will be determined in part by the size of the firm….
To comply with this Rule, a lawyer does not need to have all the required technology competencies. The lawyer can and more likely must turn to the expertise of staff or an outside technology professional.”
David W. Thomas, Esq.
MichieHamlett PLLC

6. Why the change?
According to the ABA’s 2016 Legal Technology Survey, 26% of law firms with 500 or more attorneys admitted to experiencing some type of data breach. While only 2% of these breaches resulted in the loss of client data, 37% caused business downtime and a loss of billable hours, and 28% resulted in significant costs for correcting/remediating the breach.
David W. Thomas, Esq.
MichieHamlett PLLC

7. e-Discovery and ESI
Attorneys handling e-discovery should be able to perform (either by themselves or in association with competent co-counsel or expert consultants) the following:
implement/cause to implement appropriate ESI preservation procedures (sometimes called a “litigation hold”)
analyze and understand a client’s ESI systems and storage;
advise the client on available options for collection and preservation of ESI;
identify custodians of potentially relevant ESI;
engage in competent and meaningful meet and confer with opposing counsel concerning an e-discovery plan;
perform data searches;
collect responsive ESI in a manner that preserves the integrity of that ESI; and
produce responsive non-privileged ESI in a recognized and appropriate manner.
David W. Thomas, Esq.
MichieHamlett PLLC

8. Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Sec
Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Sec., LLC, 685 F. Supp. 2d 456, (S.D.N.Y. 2010)
“A failure to preserve evidence resulting in the loss or destruction of relevant information is surely negligent, and, depending on the circumstances, may be grossly negligent or willful. For example… the failure to issue a written litigation hold constitutes gross negligence because that failure is likely to result in the destruction of relevant information.”
David W. Thomas, Esq.
MichieHamlett PLLC

9. Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Sec
Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Sec., LLC, 685 F. Supp. 2d 456, (S.D.N.Y. 2010)
“The next step in the discovery process is collection and review. Once again, depending on the extent of the failure to collect evidence, or the sloppiness of the review, the resulting loss or destruction of evidence is surely negligent, and, depending on the circumstances may be grossly negligent or willful. For example, the failure to collect records -- either paper or electronic -- from key players constitutes gross negligence or willfulness as does the destruction of or certain backup tapes after the duty to preserve has attached. By contrast, the failure to obtain records from all employees (some of whom may have had only a passing encounter with the issues in the litigation), as opposed to key players, likely constitutes negligence as opposed to a higher degree of culpability.”
David W. Thomas, Esq.
MichieHamlett PLLC

10. Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Sec
Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of Am. Sec., LLC, 685 F. Supp. 2d 456, (S.D.N.Y. 2010)
“Similarly, the failure to take all appropriate measures to preserve ESI likely falls in the negligence category… Recent cases have also addressed the failure to collect information from the files of former employees that remain in a party's possession, custody, or control after the duty to preserve has attached (gross negligence) or the failure to assess the accuracy and validity of selected search terms (negligence).”
David W. Thomas, Esq.
MichieHamlett PLLC

11. Cloud Computing
Web-based , like Gmail, Hotmail, and Outlook online
Online file storage, such as Dropbox, Google Docs, or Microsoft OneDrive
Online software (technically software-as-a-service, or SaaS), such as Microsoft Office 365
David W. Thomas, Esq.
MichieHamlett PLLC

12. The Bar’s take on Cloud Computing (LEO 1872)
“When a lawyer is using cloud computing or any other technology that involves the use of a third party for the storage or transmission of data, the lawyer must follow Rule 1.6(b)(6) and exercise care in the selection of the vendor, have a reasonable expectation that the vendor will keep the data confidential and inaccessible by others, and instruct the vendor to preserve the confidentiality of the information. The lawyer will have to examine the third party provider’s use of technology and terms of service in order to know whether it adequately safeguards client information, and if the lawyer is not able to make this assessment on her own, she will have to consult with someone qualified to make that determination.”
David W. Thomas, Esq.
MichieHamlett PLLC

13. Data Security Two-factor Authentication Staff Training
“a partner or other managing lawyer in a firm always has the same responsibility to take reasonable steps to supervise subordinate lawyers and nonlawyer assistants, but the meaning of “reasonable” steps may vary depending upon the structure of the law firm and its practice. Additional measures may be necessary to supervise staff who are not physically present where the lawyer works.” LEO 1872
Encryption
David W. Thomas, Esq.
MichieHamlett PLLC

14. Social Media We touch our phones 2,617 times per day Facebook LinkedIn
And actively check them 157 times per day
Facebook
1.31 billion monthly users
Averages 30 hours per week of “use”
LinkedIn
106 million monthly active users
Twitter
313 million monthly active users
~6,000 tweets per second
David W. Thomas, Esq.
MichieHamlett PLLC

15. Social Media is NOT Private
David W. Thomas, Esq.
MichieHamlett PLLC

16. Social Media Womack v. Yeoman, 2011 WL 9330606 (Va. Cir. Ct. 2011)
No privacy protection for social media
Attorneys may freely access publicly-available Facebook page
James v. Edwards
Post-crash shenanigans on Facebook
Defendant was permitted to access Plaintiff’s Facebook account under the supervision of Plaintiff’s counsel
Lester v. Allied Concrete, 736 S.E.2d 699 (2013)
David W. Thomas, Esq.
MichieHamlett PLLC

17. Social Media – How to Get It
Screen Shots
Low quality, no metadata
Self-archive feature
Not a forensic tool
Easily modified
Not searchable
Collection tools
David W. Thomas, Esq.
MichieHamlett PLLC

18. Social Media – Collection tools
Obtain everything
Data
Metadata
Forensically-defensible
MD5 hash values
Read-only
Searchable
Ongoing monitoring
David W. Thomas, Esq.
MichieHamlett PLLC