Virtual Law Practice

Category: Ethics

  • LSBC Cloud Computing Working Group Recommendations

    Last week The Law Society of British Columbia’s Cloud Computing Working Group published online a report with recommendations regarding the use of cloud computing by legal professionals.

    Recommendations included in the report include:

    1)      Guidelines to help lawyers conduct due diligence in researching a technology providers and cloud-based solution.  (The report refers to “third party service providers” which includes cloud computing but is much broader in scope.)

    2)       Review of potential changes in the Law Society Rules to ensure that its regulatory functions are kept up to date with the changes in technology.  (Canadian legal professionals are subject to audits of law office records by their governing body whereas most state bars in the United States do not have this investigatory function.)

    3)      Methods that lawyers and law students might be educated to improve understanding of their responsibilities when using technology.

    The report advocates that clear guidelines are needed to assist lawyers in making the decision about what type of technology to use and which providers to trust.  Here is a brief overview of what the Report recommends. Even if you are not practicing law in Canada, these are good recommendations to consider as you conduct your “due diligence” in researching any tech-related practice management decision. (more…)

  • Online “Daily Deals” on Legal Services

    South Carolina has published a new Formal Ethics Opinion 11-05 about attorney’s using services, such as Groupon, to offer discounts and deals on their legal services.

    To my knowledge, the ethics opinion is the first from a state bar that is specifically related to this topic. The question posed in the opinion is:

    Does a lawyer violate the Rules of Professional Conduct by contracting with a website to offer vouchers that can be purchased from the website and then subsequently redeemed for discounted legal services such as the preparation of wills?

    The opinion says a lawyer does not violate the Rules as long as the method used complies with attorney ethics rules for advertising (7.1 – 7.2) and the rule on sharing of legal fees (Rule 5.4(a)).  There are other potential risks to avoid that include clearly defining the scope of representation that is covered in the “deal”, making sure payments are routed to the trust account if required, and the duty to prospective clients. The opinion concludes that whether this online client development strategy violates the Rules or not depends on the way that the attorney has set up the procedure within the online service and manages it in accordance with the other Rules.

    The question posed the SC Ethics Committee specifically mentions using the service for estate planning. In fact, it’s difficult to think of what other practice areas it might be possible to do this in. It would work best with an unbundled or limited scope representation service.  More often when people are seeking legal services online it’s because there is a pressing legal need.  The motivating factor to retain an attorney is not the discount on services.  But you never know these days. I’ve heard tales from family law attorneys claiming that the recession has prospective clients delaying major legal needs, including divorce, until they can afford it.  So maybe if your firm was the one offering a “daily deal” on that service, you might be selected above another firm.

    A virtual lawyer providing unbundled services online could connect the daily deal service to their virtual law office to potentially send prospective online clients straight from the deal into the registration process to purchase the requested unbundled legal service online.

    Are any other state bars addressing the use this service in online client development by lawyers?  Anyone know of a law firm using Groupon or another service for this purpose?

  • Proposed NC Ethics Opinion on Cloud Computing Returned to Subcommittee

    The Ethics Committee at the North Carolina State Bar voted to send the proposed formal ethics opinion 6 (FEO 6), entitled “Subscribing to Software as a Service While Fulfilling the Duties of Confidentiality and Preservation of Client Property” back to the subcommittee to reconsider responses they received to inquiries #1 and #2.

    Both of these inquiries contained worrisome minimum requirements for the use of cloud computing that many of the technology providers and attorneys using cloud computing are not certain can be practically implemented without resulting in severe restrictions on the use of a wide number of cloud-based applications.

    The Ethics Committee received responses from groups such as ILTSO and the LCCA as well as from individual attorneys both licensed in NC and across the country.  You may read the LCCA’s detailed response on their website. Some of the responses from individuals included:

    – Nicole Black, author of the soon-to-be published by the ABA/LPM Cloud Computing for Lawyers, provided this response;

    – Erik Mazzone, Director of the Center for Practice Management at the North Carolina Bar Association, wrote about the opinion on his Law Practice Matters blog;

    – Richard Granat, co-chair of the ABA eLawyering Task Force, wrote critically of the proposed opinion on his elawyering blog; and

    – I posted the comments that I submitted to the Committee on this blog a few months ago.

    We should have some idea by the end of October about the revisions, if any, that will be made to the proposed opinion by the subcommittee.

     

  • No New Restrictions On Use of Tech & Client Development

    The ABA Commission on Ethics 20/20 has published for comment its draft proposals on Lawyer’s Use of Technology and Client Development.   Proposed changes relate to Model Rules 1.18 (duty to prospective clients), 7.2 (advertising) and 7.3 (direct contact with prospective clients).

    Overall, the Commission concludes that no new restrictions need to be added to a lawyer’s use of technology for client development.  The proposed changes adequately reflect two major impacts of the Internet on our profession: 1) public accessibility to lawyers online, and 2) the immediacy of communication with prospective and future clients over the Internet.  Below is a brief look at each rule’s proposed changes.

    “Communicating” with Prospective Clients Online

    Proposed changes to this rule include switching out the word “discusses” with “communicates.”  “Communicate” is a much broader term and is probably something we do online with prospective clients far more than actually “discussing” a potential attorney/client relationship.  Communicating could be anything from having them fill out a “contact us” form to sending you a tweet asking if your firm handles their specific legal need.  Something as simple as “Liking” your law firm’s Facebook page is a bit of a stretch because it’s not specifically “about the possibility of forming a client-lawyer relationship.”

    This would be a dangerous rewording if not for other new lines added to clarify the definition of a prospective client: “A person who discusses communicates with a lawyer about the possibility of forming a client-lawyer relationship and has a reasonable expectation that the lawyer is willing to consider forming a client-lawyer relationship with respect to a matter is a prospective client.” [proposed additions in italics] (more…)

  • Top Ten Basic Security Practices for a Virtual Law Office

    I love SaaS.  I depend on SaaS to operate my virtual law office.  I support an attorney’s right to choose their own practice management tools and make their own business decisions whether it’s in the cloud or in a filing cabinet.  But there are responsibilities that come along with choosing any practice management system and that means sticking to your own security policies and best practices.

    I’m a solo virtual lawyer, so the burden is on me alone.  Larger practices can designate an associate or hire an IT consultant to keep them up to date and to make any necessary security policies and safeguards.  Regardless of where you are engaging in virtual law practice, it’s always good be reminded of some basic security practices for delivering legal services online.  Here is my list of the top ten basic security practices for a virtual law office:

    1) Keep up to date on the security issues. Read Lifehacker, Slashdot, TechCrunch, etc.

    2)  If you use wireless networking, ensure that all wireless traffic is encrypted with WPA2.

    3)  Keep antivirus software and all software patches updated and turn on the software firewall for the computer.

    4) Use a safer browser, such as Mozilla with the NoScript add-on installed.  Or use another pop-up blocker. Do not use free Wi-Fi hotspots when using any cloud computing application remotely.  Use a cellular phone modem adapter instead.  I just got the 4G wireless hotspot which I highly recommend.  This also serves as backup internet access in my home office as well.

    5)  Never write down usernames and passwords.  Create strong passwords and change them regularly.  Use Keepass or other password management tool and generator.

    6) Go straight to privacy/account settings in any cloud-based application immediately after you register for and change the defaults for better protection.  Then check back occasionally to make sure they haven’t changed their privacy setting options again.

    7) Watch your back when you work in a public place to make sure the person behind you isn’t able to watch your screen as you enter your username and password or your client’s social security number.

    8) Encrypt your hard drive with Truecrypt, free open source encryption software.  Easy to use, free, protects you if your laptop is stolen.  Backup daily with an external hard drive with Truecrypt on it in addition to regular cloud-based backups.

    9) Make sure that the applications you are using to store and transmit confidential law office data are encrypted.  Look for HTTPS in the URL before proceeding.  Don’t enter data unless you know it will be encrypted.

    10) This isn’t going to be a popular one, but be wary of doing a lot of confidential work on your iPad with just any app.  With my virtual law office, I can open the browser and work in https, but other apps, especially iPad and other mobile device apps, do not have this level of security.  Unencrypted email is permitted by the state bars as exercising reasonable care, but most of us know better.  Text messaging your client is not a wise idea for a lot of reasons.

     

  • Feedback on SaaS Ethics Opinion

    Below is the text from my letter to the NC Bar Ethics Committee regarding their proposed ethics opinion on the use of Software as a Service (SaaS) in law practice management.  The Committee has received only two comments so far.  This is an important issue that will have a big impact on attorneys in NC and potentially elsewhere if other state bars follow this example.

    If you are an attorney or IT consultant in NC or even outside the state who uses cloud-based applications, please consider providing the committee with your comments and feedback on the way this opinion should be worded. (more…)

  • Should a SaaS Vendor’s Data Center be an Agent of the Virtual Law Firm?

    Below is a short and to-the-point article that I drafted for the NC Bar Association’s Technical Advisory Committee after our last meeting discussing the proposed NC Ethics Opinion on SaaS.  I wasn’t critical of the opinion at first, until I spoke with a few SaaS vendors and others who explained their positions in greater detail to me.

    If you are licensed in NC and operate a virtual law office, you might want to read the below and consider providing your comments and feedback.  More than one legal SaaS vendor has already indicated that if the ethics opinion is published in its current version, that they will simply pull out of serving the NC legal marketplace.

    Harsh consequences for attorneys practicing here, but also potentially harmful for the public who receive assistance delivered online or from attorneys who use the cost benefits of cloud-computing to make their prices for legal services more affordable.

    _____________________________________________

    The North Carolina State Bar published the revised version of its proposed ethics opinion on the use of SaaS in law practice management on April 21st, entitled, “Formal Ethics Opinion 6: Subscribing to Software as a Service While Fulfilling the Duties of Confidentiality and Preservation of Client Property”.

    Your firm will be in violation of this ethics opinion if it is published as written and your firm uses any of the following products:

    Google (any of their applications or services)

    Yahoo/Hotmail or any other email service attached to a internet service provider, such as Earthlink, Bellsouth, Roadrunner, etc

    Verizon, AT&T, Sprint, T-Mobile

    Lexis or Westlaw for online research and almost all of their other services

    Mozy

    DropBox

    Clio

    Total Attorneys

    Rocket Lawyer

    DirectLaw

    Any other practice management system with a cloud-based component

    Or if your firm engages in the following tasks:

    Email

    Voicemail (Per Erik Mazzone, Director for the Center for Practice Management at the NCBA, “Voicemail on a mobile phone is data hosted on servers owned or contracted by the mobile carrier. The software that enables us to call a number and listen to voicemail is SaaS.”)

    Digital phone’s voicemail services as well as original phone services many of which use voicemail accessible via SaaS.

    Text messaging or SMS

    Online backup or storage

    Online communication with other professionals or clients

    There are two requirements in proposed opinion which may result in the restriction of use by law firms of a majority of the technology software and services that they currently rely on. These provisions are:

    1) “An agreement on how confidential client information will be handled in keeping with the lawyer’s professional responsibilities must be included in the SaaS vendor’s Terms of Service or Service Level Agreement, or in a separate agreement that states that the employees at the vendor’s data center are agents of the law firm and have a fiduciary responsibility to protect confidential client information and client property.” [Emphasis added] ; and

    2) “The agreement with the vendor must specify that firm’s data will be hosted only within a specified geographic area. If by agreement the data is hosted outside of the United States, the law firm must determine that the hosting jurisdiction has privacy laws, data security laws, and protections against unlawful search and seizure that are as rigorous as those of the United States and the state of North Carolina.” [Emphasis added]

    Most software vendors will not sign an agreement assuming this level of liability and agency for client property. Most software vendors will also not restrict their server locations, many of which are georedundant to begin with, to hosting data centers located only in locations with laws as strict as the US and the state of North Carolina. The Legal Cloud Computing Association (LCCA), a group of vendors who provide services to lawyers, and the International Legal Technology Standards Organization (ILTSO) are in the process of writing comments to the NC Bar regarding the negative impact that this opinion will have on legal technology innovation as well as the negative impact that it will have on their customers who practice law in the state.

    There are more practical and realistic ways to address the confidentiality concerns raised in the use of software as a services. It is not practical to expect hundreds of NC practitioners to stop using cloud computing. It is not realistic to expect a technology provider or vendor to assume liability for client property. Minimum requirements should not be imposed on legal practitioners. Instead, this opinion should contain suggestions and guidance for performing due diligence in researching and implementing cloud-based solutions to comply with the rules of professional responsibility.

    There are hundreds of attorneys and law firms in North Carolina that rely on software as a service on a daily basis. If you are one of these firms, please consider writing to the NC Ethics Committee.

  • Revised Proposed Ethics Opinion on SaaS

    UPDATE: CHECK OUT THIS POST by Erik Mazzone, Director of the Center of Practice Management at the NC Bar Association, on his Law Practice Matters blog.  Erik is concerned that the proposed opinion will limit the cloud-based vendors that attorneys in NC can use based on the location of their servers.  While most legal SaaS vendors will probably be in compliance by housing the data on servers located in the States, other non-legal SaaS companies, such as Dropbox, Google, etc., may not be in compliance with the proposed opinion because their servers are located overseas.  Will this proposed ethics opinion have a broader reach than expected? Are these other services really safe to be using with law office data in the first place?  See this post by Information Law Group discussing a recent Ponemon Study about cloud providers and security.

    The North Carolina State Bar published the revised version of its proposed ethics opinion on the use of SaaS in law practice management on April 21st, entitled, “Formal Ethics Opinion 6: Subscribing to Software as a Service While Fulfilling the Duties of Confidentiality and Preservation of Client Property”.

    The direction that this opinion takes provides guidance to the practitioner, rather than attempting to write technology standards into an ethics opinion, which is not the safest place for it.  Instead, the opinion requires that the attorney do a thorough job investigating the technology provider and any agreements with that providers to ensure confidentiality of the client data.  They also include a reference the ILTSO standards in the footnotes of the opinion (www.iltso.org) along with links to other resources for attorneys to accomplish this process. (more…)

  • NYSBA Report Reviews Virtual Law Firms

    The New York State Bar Association published its Report on the Task Force on the Future of the Legal Profession on April 2, 2011. Written for the practitioner rather than the IT consultant, the report provides suggested guidelines for the adoption of technology solutions as well as a discussion of current trends.

    The report devotes an entire section to virtual law firms and does an excellent job of defining the online delivery of legal services and distinguishes it from extranets and other forms of mobile lawyering, which have their own sections.  Describing changes in firm structure, virtual law offices are included as a significant and growing trend both for connecting lawyers with each other for collaboration purposes and for delivering services online to clients.

    The report also discusses new legal products and services that are being created through the use of technology-enabled law firms. This section does not specifically mention that the primary delivery of these new services is online or through a secure virtual law offices, but they acknowledge the use of newer knowledge management systems and document assembly and automation tools used in unbundling legal services.  The report also recognizes that the use of this technology can create greater opportunity for unique legal service delivery systems to develop as well as facilitate multijurisdictional practice.

    From the report:

    “Mass customization,” for example—broadly defined as the use of flexible computer-aided systems to produce custom output—can serve the objective of combining the low unit costs of mass production processes with the flexibility of individually tailored services to increase variety and customization without a corresponding increase in costs. While the technology for creating such applications—such as form agreements for repetitive transactions, or “macros” that assist in the development of first forms—has existed for some time, changing dynamics in lawyer/client relationships may make the investment in developing and maintaining such proprietary applications more attractive. Another example of the opportunity for this kind of investment in automation is the development of integrated systems for specialty and multijurisdictional legal projects.

    I choose to read that as a call for innovation.

    The report concludes with the recommendation that “NYSBA’s Committee on Standards of Attorney Conduct should study and make recommendations concerning the ethical and risk management considerations associated with new technologies such as social networking, third party hosted solutions, and virtual law firms.”

    We will see if this recommendation results in a set of separate guidelines or best practices for New York-licensed attorneys wanting to engage in virtual law practice.

  • Why I Read Hacker Mags

    If you are using technology to deliver legal services online then it’s part of your responsibility to keep up to date on the technology that you are using. Different security risks pop up every day and if you aren’t aware of the them then you can’t protect your law practice and your clients.

    For example, just this week the WSJ reported that Apple and Google collect location information from their users’ mobile devices.  How many virtual lawyers are transmitting confidential client information via mobile devices without any idea of what information is being collected?  Maybe location isn’t a major problem but what about sending photos taken by you or your client on mobile devices across unencypted email and those photos store the locations of where they were taken.  There are situations where this information could put your client (or their children, friends or family members) at risk.

    There are so many benefits to using cloud based technology to deliver legal services online, but we also have a responsibility to protect the confidentiality of our client’s data.  This means understanding how the technology works and how to use it responsibly on a daily basis.

    Several times at the ABA TECHSHOW in Chicago last week after giving presentations I was asked how I keep up with technology.  There are a lot of great law and tech bloggers, but frankly, if you really want to keep up to date on technology and security risks then you need to step outside of the legal profession.  Go into the world that programmers live in or look at the way that the banking or medical industries are handling the transfer of sensitive information using cloud-based systems.

    Yes, I enjoy reading hacker magazines. I understand about 3/4 of what’s in them because I don’t know how to read a lot of code, but it gives me good insight into the risks that are out there and how hackers are able to get ahold of data and manipulate it. I don’t condone the actions of the authors because a lot of it is illegal.  But why not learn from the pros and turn it around to protect my own practice and my clients by making sure my own system is not vulnerable to attack?

    For example, this last spring issue of 2600 had a great article about passwords from a hacker who had downloaded several databases of usernames and passwords and then compiled statistics that showed what is most popular and the vulnerabilities.  That teaches me what I need to do to be more secure online and how to educate my clients when they create usernames and passwords for themselves.

    Here are my two favorite hacker mags:

    2600 (a classic, written by anonymous and well-respected hackers who break systems mostly for the purpose of revealing vulnerabilities; starting to put some issues online)

    phrack (sometimes a little hard to plow through to find gems, but worth the time; posts issues online)

    If you don’t enjoy keeping up with the technology, which includes understanding the security risks, or don’t find this at all interesting, then you should find someone in your firm who does and can keep you updated.  Or you could always retain an IT consultant who will charge you for that education. Or maybe operating a virtual law firm is not something you should be jumping into at all.  You might decide to trust your legal SaaS provider to keep your system updated and maintained to protect your data from vulnerabilities, but they can’t be responsible for your own use of the hardware. Keeping up has to be part of your daily regime because of how quickly it moves.

     

MENU