ABA Confirms that Model Rule 1.15 Should Solve What Model Rule 4.4 Doesn’t

So, I am certain you have heard by now that a little under a week ago the ABA issued a new Formal Ethics Opinion to address the ethical obligations of lawyers in the aftermath of a cyber-attack or an electronic data breach.  ABA Opinion 483 makes for a good read and provides good guidance about how the ethics rules work on the subject.

There are lots of decent summaries out there already of this ethics opinion if you want to try the tl:dr approach and just read secondary sources.  I am not going to repeat those summaries here.  Instead, I want to focus on what is, to me and perhaps only me, the most important development that ought to come from this opinion — the recognition by the ABA that “property” in Model Rule 1.15 has to also include digital property.

In the latest ABA Opinion, this issue is addressed with an eye toward thinking about electronic copies of client files, specifically as follows:

An open question exists whether Model Rule 1.15’s reference to “property” includes information stored in electronic form.  Comment [1] uses as examples “securities” and “property” that should be kept separate from the lawyer’s “business and personal property.”  That language suggests Rule 1.15 is limited to tangible property which can be physically segregated.  On the other hand, many courts have moved to electronic filing and law firms routinely use email and electronic document formats to image or transfer information.  Reading Rule 1.15’s safeguarding obligation to apply to hard copy client files but not electronic client files is not a reasonable reading of the Rule.

Now, why is this such an important takeaway to me?  Well, myopia often flows from the egocentric nature of people and I am no exception.  This is an important takeaway to me because I’ve been trying to make this point in an entirely different context – and to little avail — since 2010 when I co-authored an article entitled: “Model Rule 1.15: The Elegant Solution to the Problem of Purloined Documents” published in the ABA/BNA Lawyers’ Manual on Professional Conduct.  Now that article – which you can still find here — was itself an excerpt of part of a chapter of a book I was also fortunate enough to co-author with Doug Richmond that came out in 2011.  The “Elegant Solution” article explained that the lack of guidance offered by Model Rule 4.4(b) on what a lawyer must do if they receive stolen documents (whether on paper or electronically) should be resolved by application of Model Rule 1.15 and the obligations lawyers have under subsections (d) and (e) of that rule.

There are likely lots of reasons why that article has been largely ignored – and when not ignored treated as offering a controversial view to be shunned — but the primary one is that Model Rule 4.4(b) becomes a bit unnecessary as a rule if such questions could have been resolved under Model Rule 1.15.

Model Rule 4.4(b) reads:

A lawyer who receives a document or electronically stored information relating to the representation of the lawyer’s client and knows or reasonably should know that the document or electronically stored information was inadvertently sent shall promptly notify the sender.

Model Rule 4.4(b) only addresses information that a lawyer receives that is known to have been inadvertently sent and only requires the receiving lawyer to give notice to the sending lawyer of what has happened.  It does not address information sent purposely but without authorization, and it punts on what comes next.

In the “Elegant Solution” article, we explained why Rule 1.15 provided answers to the questions Model Rule 4.4(b) won’t address and, particularly in light of this latest ethics opinion recognizing the need for Model Rule 1.15 to apply to digital information, I think our explanation is worth repeating to close out this post:

The Model Rules do, in fact, appear to offer an elegant answer for lawyers who question
their professional responsibilities when they receive documents that may have been purloined or otherwise improperly obtained from another. The answer lies in Model Rule 1.15 and its provisions establishing lawyers’ obligations with respect to ‘‘safekeeping property.’’ See Model Rules of Prof’l Conduct R. 1.15 (2010).  Although lawyers are generally familiar with Rule 1.15 in the trust account context, the scope of the rule is clearly not so limited, as amply evidenced by its repeated references not just to funds or fees or expenses, but also to ‘‘property.’’

Model Rule 1.15(a) declares that ‘‘[a] lawyer shall hold property of clients or third persons that is in the lawyer’s possession in connection with a representation separate from the lawyer’s own property.’’ Id. R. 1.15(a) (emphasis added). Model Rule 1.15(d) further requires that ‘‘[u]pon receiving funds or other property in which a client or third person has an interest, a lawyer shall promptly notify the client or third person.’’ Id. R. 1.15(d) (emphasis added). Finally, Model Rule 1.15(e) mandates that ‘‘[w]hen in the course of the representation
a lawyer is in possession of property in which two or more persons (one of whom may be the lawyer)
claim interests, the property shall be kept separate by the lawyer until the dispute is resolved.’’ Id. R. 1.15(e) (emphasis added).

Analysis of over-the-transom deliveries through the lens of Rule 1.15 establishes that a lawyer, upon receiving purloined documents (or if not clearly purloined at least clearly reflecting privileged or confidential information belonging to someone other than the person who delivered the documents), is obligated to hold those documents separate from the rest of the lawyer’s documents, promptly notify the person from whom the documents were taken, and, if the lawyer is going to refuse to return the documents to that person (and thereby claim either that the lawyer or the lawyer’s client has an interest in them), continue to keep those documents segregated from the rest of the lawyer’s property until the dispute over the documents is resolved,
presumably through a ruling by a tribunal. This approach places no meaningful burden on the receiving lawyer and respects the rights of the party to whom the materials belong.

Three short technology stories for a Tuesday

Throwback Thursday is definitely a thing all over the World Wide Web it seems, but maybe Tech Tuesday ought to be a thing?  Though, I guess, for lawyers focusing on technology has to be an every day affair.

Like multitudes of others, I wrote a little bit recently about the Panama Papers and the Mossack Fonseca data breach fiasco.  Fortune now has an article online about a Wired U.K. story that casts a harsh light on the electronic security measures that the Panamanian firm had in place.  Blurbs like these

Mosseck Fonseca’s client portal, according to Wired, runs on a version of Drupal last updated in 2013, and vulnerable to an array of attacks, including one that would allow attackers to execute commands on the site. Another weakness allows access to the site’s back end just by guessing the right web address.

Just as bad is the firm’s webmail portal, which runs Microsoft Outlook Web Access, and hasn’t been updated since 2009. The firm also did not encrypt its emails. As one expert speaking to Wired put it, “They seem to have been caught in a time warp.”

sound very bad when you are talking about a firm that trafficked almost exclusively in “highly sensitive financial information.”  I suspect though that there are lots of other lawyers out there that are hopeful that their technology arrangements will never be subjected to even half as much scrutiny.

One lawyer who is in the middle of a highly public examination of their choices in technology is the lawyer at the heart of this story yesterday.  The lawyer has been sued by her former clients over a theft from them of $1.9 million resulting from hacking of the lawyer’s email account.  The couple had hired the attorney to represent them in the purchase of a nearly $20 million co-op apartment.  Luckily, it appears that the clients figured out what was going on even before the lawyer did and were able to recover almost all of the $1.9 million that was to be the down payment but was wired to the fraudsters.  The lawyer — and you ought to brace yourself here (though I admittedly know lawyers who still use this service) — was using an AOL email account for her real estate law practice.

The lawsuit contends that AOL accounts are particularly vulnerable to hacking and that the hacking was what let the cybercriminals know when certain transactions were going to take place, but as the article makes clear there were other opportunities for the lawyer to realize something was amiss:

It accuses Doran of forwarding bogus emails from the hackers — who were impersonating the seller of the apartment’s attorney — about payments from the Millards without confirming their authenticity last December. The name of the seller’s attorney was misspelled in the email which should have been a tip off that something was amiss.

Finally, the usually on-point Karen Rubin has a well-done post over at The Law For Lawyers Today about a relatively fortunate Oklahoma lawyer who managed to avoid full reciprocal discipline over his inability to figure out how to e-file in bankruptcy court.

The Oklahoma lawyer was permanently suspended by the Western District of Oklahoma bankruptcy court from ever practicing before it again, but the Oklahoma Supreme Court hit him only with a public censure.  Given the current rhetoric surrounding the practice of law and the demands everyone appears to assume lawyers absolutely must satisfy when it comes to using technology, it is pretty startling to read a state supreme court, in that case Oklahoma’s, issue an opinion in a lawyer discipline case that can be read to seem to minimize the obligation to be technologically competent.  But, in fairness, unless the Oklahoma Supreme Court was going to be willing to disbar the lawyer in question — which would seem supremely harsh — then any discipline imposed through reciprocal channels was going to be less than that meted out by the federal bankruptcy court and a public censure sounds about right to me.