Are you a lawyer that is using popular cloud services for business-related email, document storage or collaboration? Have you read the terms of service? Do you have enough knowledge about the cloud services provider (CSP) and the cloud services to use them competently and assess associated risks? Do you know whether you have a reasonable expectation of privacy to your data in the cloud? If your answer to any of these questions was “no,” you may be missing important business, security and ethical issues related to your use of cloud services.

Ethical duties

One of the most fundamental duties that lawyers have to their clients is the duty to protect confidential client information. The practice of law today often requires client documents and other information to be created, converted, transmitted, stored or reproduced electronically. Lawyers must ensure that electronic information is secure and reasonable measures are in place to protect the integrity and security of the electronic information. Increasingly, lawyers have been turning to cloud-based services in managing client information, and there are resulting confidentiality, security and data integrity issues associated with such cloud services.

Recent reports of data security breaches at both large and small CSPs illustrate the difficulties in maintaining security of electronic information and that no data stored in the cloud is likely to be 100 percent secure. Some commentators have questioned whether storage of information in the cloud is consistent with lawyers' ethical duties. How can lawyers reconcile their ethical duties with the practical realities of the cloud?

Ethics opinions

According to the American Bar Association, more than 12 state bar regulatory bodies have issued opinions addressing the use of cloud and similar technology, adopting a rationale that lawyers can use such services provided that the lawyer uses reasonable efforts to ensure that the CSP's terms of use and data privacy policies, practices and procedures are compatible with the lawyer's professional obligations, including the obligation to protect the client's data. Not all cloud services will qualify, and lawyers have an obligation to evaluate whether a particular cloud service can be reasonably expected to protect client information.

The state bar and disciplinary bodies addressing the topic of cloud and information security recognize that, just as with traditional document storage, a lawyer cannot guarantee client confidentiality will never be breached. Instead, these states allow lawyers to use cloud services provided that the lawyers use reasonable care in doing so. What is reasonable depends on circumstances, including the relative importance of the communication (the more sensitive the communication, the greater the necessary protective measures). Whether a particular cloud service provides reasonable protective measures is influenced by what technology is reasonably available at the time.

Reasonable care

The duty of reasonable care requires the lawyer to be knowledgeable about how the provider will handle the information and related security, and reasonably ensure that the CSP is obligated to protect the information pursuant to a confidentiality agreement. Keeping client information safe is not the only concern for lawyers seeking to fulfill their ethical duties. Lawyers must also take adequate reasonable measures to remove client information from the cloud once the cloud service is terminated. This is an important consideration and may be difficult to implement depending on the cloud service used. Lawyers need to ask about the return/removal of information in cloud based services before placing client information into the cloud.

Competence

Because technology is continually evolving, lawyers have a continuing duty to stay informed about technology and to be aware of limitations in their competence regarding technology and related security. While lawyers are not necessarily expected to develop a mastery of the technical aspects of cloud security and functionality, lawyers do need to have a basic understanding of the technology and appropriate safeguards. Lawyers need to either educate themselves about cloud technology or consult with appropriate experts before deploying client information in the cloud.

Stay alert to changing technology

Despite the ethical duties of confidentiality and competence, a surprising number of lawyers who are using cloud services for business purposes have not undertaken the most basic measures to ensure information security and confidentiality, such as reading the terms of service before subscribing for the services. The culture of convenience in consumer cloud services has influenced, negatively, the level of scrutiny and attention given to the legal and business terms associated with cloud services.

Thus, lawyers may be surprised to learn that a well-known and widely used CSP for email and other popular cloud apps recently indicated in a court filing that users of its services have no reasonable expectation of privacy since the CSP's terms of service advises users of the CSP's right to review any or all user-provided content on the CSP's services. Similarly, lawyers who use a popular cloud storage site might be surprised that the propensity of the attacks on the site has led some within the security and technology industry to list this popular site as potentially unsuitable for corporate use due to security concerns. Also concerning is the recent sudden collapse of a large CSP that left more than 1,000 enterprise customers, including major corporations, with only a brief time to migrate their data to another cloud provider before the CSP ceased operating, highlighting the need to ensure availability of client information deployed in the cloud.

Conclusion

Information security is a prime concern in the cloud. Lawyers using cloud services need to ensure the confidentiality, integrity and availability of client information they place into the cloud. Lawyers must ensure that the data is secure as well as retrievable in a format acceptable to the client. When dealing with particularly sensitive client information, lawyers should consider seeking the express consent of the client before using cloud services.

Are you a lawyer that is using popular cloud services for business-related email, document storage or collaboration? Have you read the terms of service? Do you have enough knowledge about the cloud services provider (CSP) and the cloud services to use them competently and assess associated risks? Do you know whether you have a reasonable expectation of privacy to your data in the cloud? If your answer to any of these questions was “no,” you may be missing important business, security and ethical issues related to your use of cloud services.

Ethical duties

One of the most fundamental duties that lawyers have to their clients is the duty to protect confidential client information. The practice of law today often requires client documents and other information to be created, converted, transmitted, stored or reproduced electronically. Lawyers must ensure that electronic information is secure and reasonable measures are in place to protect the integrity and security of the electronic information. Increasingly, lawyers have been turning to cloud-based services in managing client information, and there are resulting confidentiality, security and data integrity issues associated with such cloud services.

Recent reports of data security breaches at both large and small CSPs illustrate the difficulties in maintaining security of electronic information and that no data stored in the cloud is likely to be 100 percent secure. Some commentators have questioned whether storage of information in the cloud is consistent with lawyers' ethical duties. How can lawyers reconcile their ethical duties with the practical realities of the cloud?

Ethics opinions

According to the American Bar Association, more than 12 state bar regulatory bodies have issued opinions addressing the use of cloud and similar technology, adopting a rationale that lawyers can use such services provided that the lawyer uses reasonable efforts to ensure that the CSP's terms of use and data privacy policies, practices and procedures are compatible with the lawyer's professional obligations, including the obligation to protect the client's data. Not all cloud services will qualify, and lawyers have an obligation to evaluate whether a particular cloud service can be reasonably expected to protect client information.

The state bar and disciplinary bodies addressing the topic of cloud and information security recognize that, just as with traditional document storage, a lawyer cannot guarantee client confidentiality will never be breached. Instead, these states allow lawyers to use cloud services provided that the lawyers use reasonable care in doing so. What is reasonable depends on circumstances, including the relative importance of the communication (the more sensitive the communication, the greater the necessary protective measures). Whether a particular cloud service provides reasonable protective measures is influenced by what technology is reasonably available at the time.

Reasonable care

The duty of reasonable care requires the lawyer to be knowledgeable about how the provider will handle the information and related security, and reasonably ensure that the CSP is obligated to protect the information pursuant to a confidentiality agreement. Keeping client information safe is not the only concern for lawyers seeking to fulfill their ethical duties. Lawyers must also take adequate reasonable measures to remove client information from the cloud once the cloud service is terminated. This is an important consideration and may be difficult to implement depending on the cloud service used. Lawyers need to ask about the return/removal of information in cloud based services before placing client information into the cloud.

Competence

Because technology is continually evolving, lawyers have a continuing duty to stay informed about technology and to be aware of limitations in their competence regarding technology and related security. While lawyers are not necessarily expected to develop a mastery of the technical aspects of cloud security and functionality, lawyers do need to have a basic understanding of the technology and appropriate safeguards. Lawyers need to either educate themselves about cloud technology or consult with appropriate experts before deploying client information in the cloud.

Stay alert to changing technology

Despite the ethical duties of confidentiality and competence, a surprising number of lawyers who are using cloud services for business purposes have not undertaken the most basic measures to ensure information security and confidentiality, such as reading the terms of service before subscribing for the services. The culture of convenience in consumer cloud services has influenced, negatively, the level of scrutiny and attention given to the legal and business terms associated with cloud services.

Thus, lawyers may be surprised to learn that a well-known and widely used CSP for email and other popular cloud apps recently indicated in a court filing that users of its services have no reasonable expectation of privacy since the CSP's terms of service advises users of the CSP's right to review any or all user-provided content on the CSP's services. Similarly, lawyers who use a popular cloud storage site might be surprised that the propensity of the attacks on the site has led some within the security and technology industry to list this popular site as potentially unsuitable for corporate use due to security concerns. Also concerning is the recent sudden collapse of a large CSP that left more than 1,000 enterprise customers, including major corporations, with only a brief time to migrate their data to another cloud provider before the CSP ceased operating, highlighting the need to ensure availability of client information deployed in the cloud.

Conclusion

Information security is a prime concern in the cloud. Lawyers using cloud services need to ensure the confidentiality, integrity and availability of client information they place into the cloud. Lawyers must ensure that the data is secure as well as retrievable in a format acceptable to the client. When dealing with particularly sensitive client information, lawyers should consider seeking the express consent of the client before using cloud services.