Ruminations on the Ethics of Law Firm Information Security

http://ow.ly/7AeRC

An article on the website SLAW written by Sharon D. Nelson and John W. Simek.

This article focuses on requirements imposed on law firms to keep client data secure and confidential.

The article discusses ABA rules, and focuses on Model Rule 1.6, quoting the terms set forth by this rule.  The article then states, "Are lawyers abiding by their ethical duty to preserve client confidences? Our opinion is that they are not. Here are a few reasons why we have that opinion:

• Security expert Rob Lee, a noted lecturer from the security firm Mandiant has reported to us that Mandiant spent approximately 10% of its time in 2010 investigating data breaches at law firms.
• Security expert Matt Kesner, who is in charge of information security at a major law firm, reports that his firm has been breached twice – and that he is aware that other law firms have suffered security breaches – and failed to report them to clients.
• Our own company, Sensei Enterprises, Inc., has never performed a security assessment at a law firm (or for that matter, at any kind of business) without finding severe vulnerabilities that needed to be addressed.

P.S.  As law firms continue attempting to handle issues pertaining to client data in-house, such as processing of ESI for eDiscovery, this issue of client confidentiality will continue to be one to closely watch.