For details, see ATL’s Watch Out: There’s a Wanker in the Library! Isn’t it awfully early in the academic year for this? All joking aside, ATL’s David Lat reports that security at the Albany Law School Library is a serious…
Posts Tagged ‘security’
Privacy and Security, Not Privacy or Security: Solove on how to make progress in debating the issues
29
Jun
“Daniel Solove is one of America’s leading experts on privacy law. In this engaging book, he explains why privacy is everyone concern; it is a crucial social value that must be integrated into our national security policy rather than simply…
North Carolina Bar Regulates Legal Cloud Computing
02
Jun
A proposed Ethics Opinion of the North Carolina Bar that provides guidelines for attorneys using cloud computing services, commonly known as SaaS (Software as a Service), contains language that is troubling because of its potential impact on solos and small law firm practitioners who are creating virtual law practices. The Bar is soliciting comments prior to making the Opinion final. Here are some comments for consideration.
The Opinion states that to comply with the attorney’s duty to keep client data confidential there should be:
"a separate agreement that states that the employees at the vendor’s data center are agents of the law firm and have a fiduciary responsibility to protect confidential client information and client property."
DirectLaw is a SaaS vendor that hosts law firm data at a Tier IV Data Center that implements the security controls that a bank or major financial institution uses. The idea that our data center would enter into an agreement that would make its employees agents of a law firm is not realistic. There is not sufficient consideration to expose the Data Center to this kind of liability, and there is no way that they would modify their terms and conditions to meet the needs of a single SaaS vendor. I doubt that counsel for the Data Center would ever approve such language. The Data Center would just tell us to take our business elsewhere. Amending the contract terms just for SaaS vendors that service the legal industry is not likely to happen.
There are other approaches to providing assurance to law firms that client confidential data is secure and less burdensome.
I think a better guideline would be to suggest or require that SaaS vendors host their data at a data center that is a Tier IV Data Center. A Tier 4 Data Center is one which has the most stringent level requirements and one which is designed to host mission critical computer systems, with fully redundant subsystems and compartmentalized security zones controlled by biometric access controls methods. The Data Center should also be SAS 70 certified. The Data Center should also have PCI DSS certification if credit card data is stored within the Data Center. With these safeguards in place, a law firm should be considered to have undertaken reasonable due diligence to satisfy the obligation to insure that client data will remain confidential.
There are other problems with the North Carolina opinion. Another guideline:
"requires the attorney to undertake a financial investigation of the SaaS vendor: to determine its financial stability."
What does that mean? I am not about to divulge our private financial statements to just any lawyer who inquires. How is it relevant? If there are provisions for data capture and downloading data that is stored in the cloud, and the law firm has access to that data, what difference does it make if the SaaS actually goes out of business?
It would make more sense to simply require that a SaaS vendor carry Internet liability insurance for the benefit of its law firm clients. Law firms will have problems securing Internet Liability Insurance to cover data loss. Data loss as a result of a Data Center outage is not normally covered under a law firm’s malpractice policy. For solos and small law firm’s securing this kind of coverage would be a burden and cost prohibitive. It makes more sense to require the SaaS vendor to secure such coverage and make its law firm subscribers a beneficiary of the coverage.
Another guideline states that:
"The law firm, or a security professional, has reviewed copies of the SaaS vendor’s security audits and found them satisfactory."
How much does such an audit cost? Can solo practitioners afford such an audit? Who qualifies as a security professional? I think this requirement will act as deterrent to solos and small law firms who are seeking cloud-based solutions that they can use in their practice. I think that a less costly and more effective solution would be for an independent organization to issue a Certificate of Compliance to the SaaS vendor indicating that the SaaS vendors has satisfied or complied with well recognized standards. Like the Truste Certificate in the privacy area, this would give solos and small law firms this would provide stamp of approval that minimum standards have been satisfied. This would move the cost burden of undertaking due diligence to the SaaS vendor, rather than to the solo or small law firm practitioner.
Another guideline states:
"Clients with access to shared documents are aware of the confidentiality risks of showing the information to others. See 2008 FEO 5."
This guideline should be clarified because it is not clear what "shared documents" means. This kind of statement is likely to scare clients into thinking that a law firm that stores client data on the the Internet is putting the client’s data at more risk than storing the data in a file cabinet in the lawyer’s office.
As the American Bar American, through its Ethics 20/20 Commission, and state bar associations adapt ethical rules to deal with the delivery of legal services over the Internet, it is important to consider that the burden of compliance may have a different impact on solos and small law firms, than on large law firms. The rules should not act as a barrier to solos and small law firms exploring new ways of delivering legal services online which are cost effective for both the law firms and their clients.
For a similar point of view see Stephanie Kimbro’s blog post on the same topic.
Disclosure: DirectLaw is a SaaS vendor that provides a virtual law firm platform to solos and small law firms.
How safe and secure is your law practice environment?
18
Apr
A new nonprofit organization has emerged to help lawyers assess the safety and security of their law practice environment. The organization is the International Legal Technology Standards Organization and it recently released a set of standards that law firms can used to evaluate:
- the law firm’s internal security standards; and
- help law firm’s make informed decisions about "cloud computing" vendors and other hosting arrangements where confidential data is stored outside of the physical office of the law firm
The Standards are much more detailed and comprehensive than the ABA/LPM’s eLawyering Task Force publication of Cloud Computing Guidelines for Law Firms.
Disclosure: I am on the Advisory Board of ILTSO and provided some guidance to the development of the standards.
The standards are being circulated for comment before final publication.
The standards offer a sensible definition of "reasonable under the circumstances" by recognizing that different types of law firms have different security needs, although all lawyers are bound to prevent the disclosure of client data. Law firms are categorized into three types of situations:
- "Bronze – this standard is appropriate in every law practice, including solo practices."
- "Silver – this standard is typically appropriate for firms of more than one attorney, or where circumstances or resources dictate."
- "Gold – this standard is typically appropriate for larger firms or those with additional IT resources, or where circumstances or resources dictate."
The idea of categorizing law practice environments into these three categories is a new idea, as some of the standards only apply to the Gold and Silver category. The intent is to recognize that law firms have different IT capabilities and the size of the law firm usually determines how the law firm will approach the problem of securing client and other firm data.
At this point of development, the law firm is responsible for undertaking their own self-assessment. Law firms can apply to the standards to their own law practice environment and if in compliance display the ILTSO seal.
At some point, I can see where ILTSO might undertake an independent assessment of a law firm’s security arrangements and if it compliance with the standards, award a certificate like the Truste certification which assesses an organization’s privacy policies. A small fee could be charged for this assessment and it would vary depending on whether the type of law firm practice environment is Bronze, Silver, or Gold. This would give assurance to clients that all reasonable efforts have been taken to secure the confidentiality of their data.
It will be interesting to see how the organized bar responds to these standards, as their are entities both at the state level, and the American Bar Association that are analyzing these same subjects.
The ABA Ethics 20/20 Commission, for example, has been holding hearings on cloud computing and security of data and has released a working paper on this subject.
Just last week, the Commission released its recommendations on outsourcing, which is a process that has an impact on the confidentiality of client data. The recommendations have not yet been posted on the Commission’s web site, but the ABA Journal reports that:
"The commission proposes revisions to the Model Rules recognizing that electronically stored information, including metadata, is material subject to confidentiality rules. It also proposed revisions directing lawyers to make reasonable efforts to prevent inadvertent disclosure of information relating to representation of a client."
ILTSO’s new standards would give concrete meaning to the definition of "reasonable efforts" and provide a detailed framework that could guide attorney assessment of particular outsourcing and cloud computing arrangements.
A positive impact of having this evaluation framework in place might be the accelerated adoption of technologies, such as cloud computing. Compliance with the guidelines would support a law firm’s assertion that the firm has taken all reasonable steps to secure client data to reduce its liability in case of a security breach over which the firm had no control.
An unanticipated consequence might be a slow down in adoption, as the lack of clarity in this area might give many lawyers a reason not to become "early adopters." Many lawyers might choose to wait until standards like ILTSO’s are accepted by a broad base of legal organizations and law firms.
Of course, by then, the "real" early adopters will have acquired a first mover advantage over law firms that are still thinking about the subject, to the those firms competitive disadvantage.
Nursing Home Abuse – Legal Claims
06
Apr
Nursing home abuse can cause residents to fall victim to malnutrition and dehydration; bedsores; elopement and
wandering issues; inadequate security; broken bones or other injuries due to falls; injuries related to improper
restraints ; emotional abuse; physical abuse; and sexual abuse. Here’s what you need to know and watch out for.
