Transcript Caught in the Net

Caught in the Net
Let’s start with a
story…
Once upon a time
there was a
Facebooker
Ethics, trends and technology
•
•
•
•
•
•
•
•
Security/Passwords
Email & Instant Communication
Metadata
Twitter/Facebook/Social media
Cloud
Outsourcing
Mobility – laptops, phones, iPads etc
Virtual Practice (VLO)
Remembering Passwords
Talk Rubbish!
Gibberish is hard to crack.
eg. First line of a song/poem/quote
AaLuRfWaYaF*1788
WiFmiToTMmCtM>8570
LiTtItBoAbF#42
METADATA
Metadata: Hidden Horrors
Electronic documents contain much more information than is
visible in the final product. Two types of “metadata”:
Operating System Metadata:
• When file was created
• Location on a network where created
• When file was last accessed or modified
Application metadata
• Author & Recipients
• When printed
• Comments and changes
• Info purged from various drafts.
Metadata: Scenario 1
Lawyer A prepares a settlement proposal on a word processor
and circulates the document to colleagues in her firm who insert
comments.
The feedback includes details that shed light on the strengths
and weaknesses of the client's position. Lawyer A doesn’t
consider metadata before sending the document to Lawyer B,
who represents the opposing party.
Lawyer B receives the document and uses standard word
processing procedures to view the changes made to the
document and the comments inserted into it.
Issues?
Metadata: Scenario 2 & 3
Same facts as above except that shortly after opening the
document, Lawyer B receives an urgent message from Lawyer A
notifying him that the metadata had been inadvertently
disclosed and asking him to delete the document without
reading it.
Same facts as above except that Lawyer A made a reasonable
effort to “scrub” the document before transmitting it. However,
Lawyer B has a sophisticated forensic software program that is
designed to circumvent metadata removal tools. Lawyer B is
considering using this tool to extract the metadata that Lawyer
A believed had been expunged.
Metadata: Scrub or not?
 Confidentiality/Privilege implications?
 Should we purge/scrub documents before submitting them?
 Several products available. Or convert to pdf.
 Should we search for metadata from received documents?
(Would any useful data be inadvertent disclosure?)
 Could scrubbing ever be wrongful? Destruction of evidence?
SOCIAL MEDIA
Twitter, Facebook & Social
Media
We now spend 22% of our online time on social media (Neilsen).
Facebook reached a deal in 2011 with Fed Trade Commission (US) over allegations it
deceived users by telling them they kept info private and then repeatedly allowing it
to be shared and made public. Facebook’s security measures will be audited for 20
years.
Lesson: Never trust confidential information to a social media site. Ever!
• Main issues: Confidentiality, Courtesy, Cyberattacks
• Again – beware the ease of communication
• Beware the off-duty blowback
Conflicts
• To friend or not to friend?
Twitter, Facebook & Social Media
Confidentiality / Privilege
• Social media is all about sharing snippets of your day. Much of a lawyers
day isn’t a topic for open conversation.
• What you may think is deidentified may be identifiable to someone
• Note that each post is permanently stored on a server somewhere.
Security
Malware, cyberattacks, virus threats: An increasing number of malware and
other cyberattacks have been gaining access to secure systems via social
media utilising smartphones and mobile devices.
Policy
• Make sure you have a company policy and that your staff know it
• Should staff usage of Social Media be banned?
• As I recently tweeted – “Don’t drink and Tweet!”
Twitter, Facebook & Social Media
“Here’s the problem: The distinction between our “real worlds”
and our online worlds is fast dissolving. Cyberbullying is an
excellent example. It may be an option for someone of my
generation to simply opt out of any social media services in
which we are subjected to objectionable material or personal
attack. But this is not a realistic option for young people. Social
networks are the primary, not supplementary, form of
socialisation. And socialisation is not something a young person
can “opt” out of, if for no other reason than that it is an essential
part of human development.”
Bathurst CJ “Social Media: The End of Civilisation” Speech 21 Nov 2012
Virtual worlds are very real worlds!
What if…
• A client ‘friends ‘ you?
• Someone from the other side ‘friends’ you?
• One of your Facebook ‘friends’ becomes involved in a
matter you are involved in?
• A client communicates directly with you through a
post/chatroom?
• You communicate with the other side’s client via a
chat?
Social media in court
• UK’s most senior judge, Lord Judge (I kid you not), has handed down
practice directions supporting the use of Twitter in court by reporters
wanting to report on the relevant case, as long as they are using it to
report the case fairly. His Honour said that it was an important element of
open justice to allow these forms of social media to be used in court.
• Australian Courts have allowed for service of documents via social media.
• Some Australian courts are also allowing for reporting of proceedings via
social media.
• Danger lies in publication involving fewer checks and balances.
• Bear in mind duties to the Court – and pause before you hit send!
So…
• You’re involved in a dispute. Your client advises that there is
information on his opponent’s Facebook page that would be
helpful to his case.
• The opponent’s Facebook page is set to “Friends Only”.
• Can you obtain the information by
“Friending” them?
• Would it make any difference if the
Facebook info was open?
Facebook with Fangs
Mary is 12 years old and has received serious
injuries due to a dog attack. She sues the owners.
Lawyers acting for the dog owners employ a
private investigator and instruct him to access
Mary’s “Friends Only” Facebook page.
Somehow he obtains, without permission, the login & password details of Mary’s friend, David, and
posing as him he gains access to Mary’s page and
downloads files and pictures.
Are there any ethical issues?
Is it discoverable?
•
(not ethics, but legally interesting & worth cautioning your clients)
• McMillen v. Hummingbird Speedway (US)
• The court ordered disclosure of the Facebook password of
one of the parties so that access could be gained by the
other side to the relevant Facebook account.
Rule of Thumb: If you don’t want it seen by the
whole world – don’t put it on social media!
What if…
A client has made Twitter posts that constitute
admissions of uncharged criminal activity. Can
a lawyer who represents the defendant on an
unrelated matter advise that client to delete
their Twitter account?
Since last time we spoke…
http://ethics.qls.com.au/sites/all/files/Dirty%20laun
dry%20online%20by%20Stafford%20Shepherd_%20
Proctor%20March%202012.pdf
Legal Profession Reg 2005 s177 (NSW)
(1) An Australian legal practitioner must not give advice to a client to the effect that a
document should be destroyed, or should be moved from the place at which it is kept
or from the person who has possession or control of it, if the practitioner is aware
that:
(a) it is likely that legal proceedings will be commenced in relation to which the
document may be required, and
(b) following the advice will result in the document being unavailable or
unusable for the purposes of those proceedings.
(2) An Australian legal practitioner must not destroy a document or move it from the
place at which it is kept or from the person who has possession or control of it, or aid
or abet a person in the destruction of a document or in moving it from the place at
which it is kept or from the person who has possession or control of it, if legal
practitioner is aware that:
(a) it is likely that legal proceedings will be commenced in relation to which the
document may be required, and
(b) the destruction or moving of the document will result in the document
being unavailable or unusable for the purposes of those proceedings.
(3) Subclauses (1) and (2) apply even if there has been no indication that a specific
person intends to commence proceedings in relation to which the document
concerned may be required.
A warning to lawyers….and our clients
Here’s what happens
when you
accept Facebook friend
requests
from people
you don’t know…
Updated: Thu., May. 31, 2012, 6:45 AM
Cop tracked Brooklyn gang Brower Boys by 'friending' them online
By JOSE MARTINEZ
Last Updated: 6:45 AM, May 31, 2012
Posted: 3:05 AM, May 31, 2012
Status update: Busted!
Fourteen members of a Brooklyn gang ended up in handcuffs after idiots in their ranks accepted Facebook
“friend” requests from a cop who was tipped off to their year-long Crown Heights burglary wave, authorities
said yesterday.
“They signed off on their messages with LOL — laughing out loud,” Police Commissioner Ray Kelly said. “Well,
there was a person who was laughing out loud. That was Police Officer Michael Rodrigues of the 77th Precinct.”
The anti-crime officer friended several alleged members of the Brower Boys gang through the socialnetworking site, then quietly kept an eye on posts where they recklessly crowed that it was “break-in day on
the avenue.”
“He was able to track their next moves,” Kelly said.
The Facebook posts, Rodrigues said, “were basically about going out to make money.”
“They were members of the Brower gang, sometimes just saying how the gang was more than a gang — it was
family,” Rodrigues said of the usual Facebook chatter among gang members.
Police wouldn’t divulge what handle Rodrigues used as his Facebook name.
Breaking through the gang’s coded online chatter, cops were then able to set up surveillance of the thieves
stepping out onto fire escapes and up to rooftops to make their escape. “The Brower Boys became brazen with
their criminal activity,” said Brooklyn District Attorney Charles Hynes.
Read more: http://www.nypost.com/p/news/local/brooklyn/facebook_em_gang_busted_5ZTTJeeMG2U5BJVztT4CjN#ixzz1wsusO0gl
Social Network Policies
• Is an employee permitted to use personal social media during
working hours?
• Is an employee permitted to use employer property to access
social media sites?
• Is an employee required to comply with employer policies
when creating personal social media content?
• Is an employee prohibited from posting items that could
reflect negatively on the employer or otherwise embarrass
the organization?
• Is the employee prohibited from mentioning the name of any
of the employer’s personnel without prior approval?
Doug MacLeod of MacLeod Law Firm.
Social Network Policies
There is no need to reinvent the wheel. Examples of social media policies can
be found at:
• Dept of Justice (Vic):
http://www.justice.vic.gov.au/home/about+us/our+values+and+behaviour
s/social+media+policy/
• Dept of Education & Training (NSW):
https://www.det.nsw.edu.au/policies/technology/communication/PD2011
0418.shtml
• Australian digital marketing company Net 101: http://www.digitalmarketing-course.com.au/other_pages.php?NET-101-Social-Media-Policy10
It is good practice in the legal sector to include within your policy a statement
advising employees what they can or cannot say about your practice and
work-related matters on their personal social media sites.
A confused relationship
• Lawyer/Client Relationship: Social networking sites like Facebook or blogs
may lead users to perceive a lawyer-client relationship on the basis merely
of their status as online ‘friends’ or the advice received via a legal
practice’s blog.
• Legal advice? Legal Bloggers or social media users should be mindful about
providing information that could be construed as legal advice. It is
essential to make it clear to the reader that any information provided is
not legal advice and cannot be relied upon for that purpose.
• Disclaimers: It is advisable that legal blog pages in particular carry a
disclaimer designed to limit a lawyer’s obligations to a reader or external
contributor to the blog page. As a minimum the warning should ensure
the reader is aware that
– No lawyer/client relationship is created;
– Communications are not confidential;
– Any information provided is not legal advice
CLOUD
COMPUTING
Cloud Computing
What is it?
• Refers to the use of 3rd Party servers to store your data/files/software (SaaS)
• If you use email you already use “the Cloud”
• Provides benefits to solicitors struggling with storage of archived files
• Will often take better care of client data than many current methods.
• Sometimes the provider‘s servers are onshore and often offshore
Confidentiality / Privilege.
• Is offshore hosting an issue? (Patriot Act?)
• Are there questions over who owns digitised documents?
Duty to Clients
• If you are outsourcing file storage is informed consent required? (regardless of how it is stored?)
• Do you need a backup plan if your provider goes down – or goes bust!?
Providers
• What guarantees do you want from providers?
• Are they any different from other outsourcing guarantees you seek?
Cloud Computing
Minimum Requirements (Locked Down p 127)
• Ensure the provider has an enforceable obligation
to preserve confidentiality & security.
• Ensure you will be notified if the cloud provider is
requested to produce client info to a third party.
• Ensure the provider employs technology to guard
against attempts to infiltrate data.
• Investigate the providers’ security measures,
policies, backup and recoverability measures.
Offshoring/
Outsourcing
Offshoring/Outsourcing
36 % of Australian businesses surveyed were
already sending work offshore
21 % in the process of moving some activities
overseas.
12% are discussing it.
Macquarie Univ, The State of Offshoring in Australia: Preparing for Take Off
Offshoring/Outsourcing
• Respected US economist and former presidential adviser Alan
Blinder says we have "barely seen the tip of the offshoring
iceberg, the eventual dimension of which may be staggering".
• No longer just low skilled manufacturing. Anything that can be
digitised can be offshored.
• According to Blinder, it is now architects, accountants,
lawyers, web designers, analysts, geologists, engineers and
computer programmers - the knowledge workers - whose jobs
are at risk.
Sydney Morning Herald 27/02/12
Offshoring/Outsourcing
Most commonly to India & China
Critical issues for lawyers?
• Outsourcing is not new but
• You will be responsible for ethical breaches offshore.
• Should informed consent be obtained?
Mobility
Mobility
•
•
•
•
What’s the problem? Mobile data is data at risk!
Mobile phones, Laptops, iPads, Memory sticks
Trend is towards mobile practice.
What if you lose it? Issues? Who do you advise? Can you
remotely wipe it? Do you have a policy?
• What if it is seized?
See “The Risks of Taking Your Electronic Devices Abroad” (Law .com 13.Feb 12)
• http://www.law.com/jsp/article.jsp?id=1202542075808&The_Risks_of_Taking_You
r_Electronic_Devices_Abroad&slreturn=1
• What if it’s hacked? (Smartphone malware is up 400% and
most of us don’t have security software on our phone).
Mobility
October 10, 2011: Baxter, Baker, Sidle, Conn & Jones
lost the medical data of 161 clients in a medical
negligence suit.
How?: One of the firm’s staff took home a hard drive
containing backup data to ensure offsite backup.
But she left it on the train!
And it was unencrypted!!
And the local Press received a copy
of the files!!!
Fortress Smartphone
1. Enable Encryption. Blackberrys have it
built-in. Just Enable Content Protection. If
on BES you have enforced encryption.
Setting a PIN on iPhones enables
encryption.
2. Lock Code – preferably longer than the
usual PIN (iPhone users need to turn off
Simple Passcode in Settings to do this). Set
to engage after 2 mins inactivity max.
Fortress Smartphone
3. Enable Location Service: So you can find
your lost phone. iPhone has it built in.
Android users can download a free Lookout
app.
4. Remote Wipe: Built in with Blackberry
and Find My iPhone – and the Android
Lookout App.
Fortress Smartphone
5. CAUTION! URL & QR Codes: Basically
don’t click on any URL or email
attachment if you don’t know where it
will take you. (Be wary of bitly and
TinyURL).
6. Free Wi-Fi, often provided by cafes and
hotels, is generally not secure and your
transmissions can be monitored. WPA2
encrypted wireless is the standard to look for.
Fortress Smartphone
7. Apply updates! Keep your devices
current.
8. Apps: Stories abound of malware
entering phones via apps. iTunes is
relatively safe but Google has had
problems. Check what others have to say
before installing.
Fortress Smartphone
9. App Terms of Service: Check what
you’re agreeing to!! Some apps want
access to your contacts or other data.
10. Backup Often!: ITunes (not iCloud) should be used for
the backup of iPhones because iTunes provides a local backup and
because the iCloud’s terms of service are not security-friendly.
BlackBerrys can be backed up using the BlackBerry Desktop Manager.
If possible, you should also encrypt the backup. There are also thirdparty applications that can be used for backup.
Based on: “Security Tips for Smartphones”. Law Practice Journal Volume 39 Number 2. March 2013
By Sharon D. Nelson & John W. Simek
VIRTUAL LEGAL
PRACTICE
Virtual Practice
• Refers to the provision of legal services over the internet
utilising a secure portal through which the lawyer and client
communicate.
• Can take many forms, from an entirely stand-alone web-based
law practice through to online services provided by a
traditional bricks-and-mortar legal practice.
• The capacity now exists to manage the lawyer client
transaction from beginning to end - the establishment of the
retainer, delivery of the required legal services, billing and
payment - all remotely or online.
Virtual Practice
• The term “virtual” should not confuse the fact that
the legal services offered are “actual” and subject to
the regulations covering the provision of all legal
services in Australia.
• Applicable Rules & Regulations: Legal services
offered across Australian jurisdictional boundaries
will be subject to the regulations and disciplinary
standards applicable in the practitioner’s home
jurisdiction as well as those in the place where the
legal service is ultimately delivered.
Virtual Practice
Confidentiality and data security are two primary concerns for all lawyers.
The suggested minimum requirements for protection of client confidences
online include:
– Encryption of all data transferred online between the law firm’s
website and the server;
– Ensuring third party hosting providers have policies and procedures for
security breaches, data theft, and privacy;
– Ensuring the provider can guarantee data security, provide for
redundant backups and have a procedure for exporting the data at the
client’s request;
– Ensuring the contract with the hosting provider makes clear when the
provider’s staff may access client files. Procedures should include the
prior alerting of the Virtual Practice.
Virtual Practice
• Nature of lawyer/client relationship: The virtual anonymity of the
lawyer/client relationship in this environment requires particular vigilance.
In particular the practitioner must ensure:
– Conflict checks: These must be carried out prior to the
commencement of a retainer just as in any legal matter.
– Identification checks: It may be prudent due to the anonymity of
online transactions, for the practitioner to obtain proof of the client’s
identity.
– Commencement of retainer: It is essential that the systems adopted
make it clear at which point the retainer commences. Typically this will
involve the client signing or otherwise (eg via a clickwrap agreement)
accepting an agreement outlining the nature of the services to be
provided and the costs to be incurred.
– Nature of retainer: Online practices typically provide limited and
specific (sometimes termed ‘unbundled’) legal services. It is essential
that the practitioner makes it clear to the client the limited nature of
the retainer should this be the case.
Virtual Practice
Suitability of practice area: Typically virtual lawyers
work in those areas of law focussed on routine
document preparation such as routine business
contracts, IP work, some estate planning, and even
some uncontested family law matters.
Not all areas of law are suited to virtual lawyering and
practitioners considering this mode of service delivery
should carefully consider their practice’s suitability for
this mode of service delivery.
But what about…
Getting documents signed?
• Check that ink is not required (as in some real property
transactions).
Checking the capacity of a client?
VLO – But what about…
Getting documents signed?
• Check if Electronic Transactions Act applies: Cth s10
•
10—Signatures
(1) If, under a law of this jurisdiction, the signature of a person is required, that requirement is taken to have been met in relation
to an electronic communication if—
•
(a) a method is used to identify the person and to indicate the person's intention in respect of the information
communicated; and
•
(b) the method used was either—
•
–
(i) as reliable as appropriate for the purpose for which the electronic communication was generated or
communicated, in the light of all the circumstances, including any relevant agreement; or
–
(ii) proven in fact to have fulfilled the functions described in paragraph (a), by itself or together with further evidence; and
(c) the person to whom the signature is required to be given consents to that requirement being met by way of the use of
the method mentioned in paragraph (a).
What do you do when…
Your firm is selling/pensioning off/handing back
to the lease company…..
One of these…
But what about one of these?
Your average modern photocopier
has a hard drive that stores around
20,000 copies.
And always remember these…