environmental law seminar

Ethics: Technology Security Issues for Attorneys

3:30 p.m. - 4:30 p.m.

Presented byBrian McCormac

Brown Winick PLC666 Grand Ave

Suite 200Des Moines, IA 50309

Environmental Law Seminar

Friday, February 17, 2017

1

Ethical Issues and Data SecurityPrepared by James Pray

Presented by Brian McCormac

BrownWinick Law Firm666 Grand Avenue, Suite 2000Des Moines, IA 50309-2510

www.brownwinick.com

What You Will Learn

Why it matters

Ethical Rules requiring the safeguarding of confidential data

Rule 1.6 requiring prevention of client information.

Duty to maintain client confidences

2

What You Will Learn

What Rules Govern the Use of Personal Information and Data

What Information is Protected other than just client information.

What Happens if There is a Breach

How to Start Protecting you and your firm.

Why This Matters?

Major penetrations of large law firms by Government-sponsored hackers

High Profile Breaches (Cravath, Swaine & Moore, Weil, Gotshal & Manges,Cleary Gottlieb, Mayer Brown, Latham & Watkins, Covington & Burling, and Davis Polk & Wardell).

http://dailycaller.com/2016/12/07/china-allegedly-behind-major-security-breach-at-big-time-us-law-firms/#ixzz4XTpq3LWD)

3

Why This Matters?

Some estimate that 1 in 4 law firms have already been breached.

Up to 3 in 4 of major law firms have been breached by some estimates.

Bottom Line Impacts (fines, reputation, PR costs)

Why This Matters?

On December 27, 2016 the Manhattan U.S. Attorney announced the arrest of one foreign national and charges against three others for hacking seven law firms to make more than $4 million from insider trading.

4

Why This Matters?

Litigation threatened against penetrated law firms.

Corporate Clients are asking for proof that law firms are taking steps to protect communications and data.

5

What Rules Apply to Lawyers?

Iowa Ethics Rules

State Privacy Laws (Iowa Code Chapter 715C – Personal Information Security Breach Protection)

Health Insurance Portability and Accountability Act of 1996 (HIPAA)• Business Associate Agreements

Engagement Agreements

Iowa Rules of Professional Conduct

Rule 32:1.6 Confidentiality of Information• (a) A lawyer shall not reveal information

relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation, or the disclosure is permitted by paragraph (b) or required by paragraph (c).

6


Rule 32:1.6 Confidentiality of Information• Guess what? Paragraphs (b) through (c )

won’t help (preventing death, crimes, etc.)

Comments 16 and 17 provide guidance.


Rule 32:1.6 Comment 16:• A lawyer must act competently to safeguard

information relating to the representation of a client against inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client or who are subject to the lawyer’s supervision. See rules 32:1.1, 32:5.1, and 32:5.3.

7


Rule 32:1.1 (mentioned at 32.1.6, com. 16:• Rule 32:1.1: COMPETENCE A lawyer shall

provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness, and preparation reasonably necessary for the representation.


Rule 32:1.5(a) (mentioned at 32.1.6, com. 16:• A partner in a law firm, and a lawyer who

individually or together with other lawyers possesses comparable managerial authority in a law firm, shall make reasonable efforts to ensure that the firm has in effect measures giving reasonable assurance that all lawyers in the firm conform to the Iowa Rules of Professional Conduct.

8


Rule 32:1.5(a) Comment 2:• Paragraph (a) requires lawyers with managerial

authority within a firm to make reasonable efforts to establish internal policies and proceduresdesigned to provide reasonable assurance that all lawyers in the firm will conform to the Iowa Rules of Professional Conduct. . . .

Iowa Ethics Opinion 11-01

Question was whether lawyers could ethically use “software as a service” (SaaS)

We commonly refer to SaaS now as “cloud services.”

The Committee turned to Rule 32:1.6 and comment 17.

9

•Opinion begins with Rule 32:1.6 Comment 17:

•When transmitting a communication that includes information relating to the representation of a client, the lawyer must take reasonable precautions to prevent the information from coming into the hands of unintended recipients.

•Rule 32:1.6 Comment 17: •This duty, however, does not require that the lawyer use special security measures if the method of communication affords a reasonable expectation of privacy. Special circumstances, however, may warrant special precautions.

10

•Rule 32:1.6 Comment 17: •Factors to be considered in determining the reasonableness of the lawyer's expectation of confidentiality include the sensitivity of the information and the extent to which the privacy of the communication is protected by law or by a confidentiality agreement.

•Rule 32:1.6 Comment 17: •A client may require the lawyer to implement special security measures not required by this rule or may give informed consent to the use of a means of communication that would otherwise be prohibited by this rule.

11

Iowa Ethics Opinion 11-01

Committee suggested: • Preserve access to data if access to SaaS

(Cloud) is lost.

• Due diligence regarding the vendor.

• Know the cost and how to terminate (and erase) after termination of service.

• Password protection and if there is potential public access to data.

• Consider data encryption to protect data.

Iowa Ethics Rules

Opinion and rules, though not updated for current data use, are surprisingly applicable to today’s environment. • Know the risks.

• Avoid loss of data to third parties.

• Install adequate management systems to protect data.

12

Ethics vs. State Law

Lawyers’ obligations to protect client data are also covered by state laws governing the obligation to inform not just clients but third parties whose data may be on your firm server.

Ethics vs. State Law

As an example, social security numbers of both buyers and sellers may be in your real estate and business closing files.

If a hacker has access to your server due to a breach, your firm may have to contact the other side of the deal under applicable state law.

13

State Data Breach Notification Laws

Each state has slightly different laws.

If you or your firm suffer a breach you will need to comply with the laws of EVERY state that your clients or third parties reside in if their information has been breached.

Firm Objectives

Minimize risk to the Clients and Firm.

Decide on reporting to State and Federal agencies.

Coordinate reporting breaches to customers and agencies.

14

Get the facts:

What do we know?

How was it discovered? • Customers

• FBI

• Secret Service

• IT Vendor

• IT Department

Get the facts:

Have specialists been brought in?

What sort of information may have been exposed?

Is the breach over?

Can we trust the firm’s IT department?

15

Confidences

Attorney can conduct a confidential investigation

IT specialists, investigators, and law enforcement are not subject to the attorney-client privilege.

Steps need to be taken to make sure that the attorney-client privilege is maintained.

The Breach:

Internal breach?• Internal: HR issues are

triggered.

• Access lockdown protocols.

• Logging: Your firm has installed logging of activity, right?

16

The Breach:

Loss of a smartphone?

Loss of a tablet or laptop?

Loss of CDs, backup tapes?

Forget to wipe hard drives on printers after the lease is up?

The Breach:

External breach?• Random?

• Targeted? What were they looking for?

• Is it some Ukraniankid or a foreign state?

• What did they get access to?

17

Right team?

Do we have the right IT people? • Can IT be trusted?

• Are they competent?

• Who needs to be hired if not?

After the breach, Lock it down

Restrict Access.

Change passwords.

Copy log files.

Prevent overwriting of backups.

Stop deletion of backups.

Keep track of all steps during lock down.

Preserve all data.

18

Determine what was Accessed/Attacked?

What was accessed? • Private customer files?

• Client assets? (patents, R&D)

• Was it encrypted?

What was attacked? • DOS?

• Defacement?

• Ransomware?

Get the dates:

Dates breaches took place?

Date of breach first suspected? • Note that this is an important date

• May trigger notice deadlines.

Date breach confirmed?

Date private information was confirmed to have been stolen/accessed?

19

Determine if it is private information under state law

Client Confidence may not equal Private Information.

A client confidence could be typed-up notes from the client interview or e-mails from the client: “I may have poured 2,000 gallons of TCE on the back forty”

Private Information could be the client’s SS#.

20

What is private information?• Government Issued Identifier (SSN, Driver’s

License, Pilot License, Inmate Number, Etc…);

• Financial Account Number (credit card / debit card) in combination with any information to grant access to account (Exp., Security Code);

• Username and Password to Financial Account; or• Biometric Data Representation (fingerprint, retina,

or iris);• Health Information.

Next: Notifications.

Is there a crime?

Duty to report?

Will the breach be reported to agencies? • Local Police (good luck)

• FBI (cross-jurisdictional, federal laws)

• Secret Service (banking)

• Regulatory (Defense Department, Treasury, FDIC, State/Federal banking, SEC, and FTC)

21

Notification of Law Enf.

• Criminal Notification. • Law enforcement must determine if notification to

consumers/users of data will reveal sensitive sources and methods or impede the ability of the agency to conduct its investigation.

• Make sure you are prepared. • Backup copies.

• Logs.

Next: Notifications.

22

This is a real law firm notification.

Notification Requirements

Contract Notifications• IT Vendor contracts may require notification of

any breach, regardless of whether information can be identified.

• Client agreements may require notification of breaches.

• Poorly drafted contracts may inadvertently trigger unnecessary notifications.

23

Notification Requirements

Insurance Notifications• Must be timely under the terms of the policy.

• Read the policy.

• Should not be subject to a Criminal Investigation hold. Report.

• Do not assume that you will get this handled and that an unnecessary report will drive up premiums.

• Report it to the carrier.

Iowa Code Chapter 715C Keep in mind that if you have 50 clients in

50 different states then you will have to follow all of the laws of all 50 states.

24

Iowa Code Chapter 715C 715C.1(11) defines a “breach of security” in

relevant part as follows: • “Unauthorized acquisition of personal information

maintained in computerized form by a person that compromises the security, confidentiality, or integrity of the personal information.”

• Iowa is an “acquisition” state. You or your investigatory consultant would need to determine if the breach resulted in a “acquisition.”

• Some states (very few) are “access” states.

Iowa Code Chapter 715C It is possible for a rogue program to

“access” a system without actually acquiring any data. • Difficult but not impossible to prove with sufficient

security logs and monitoring software.

• One example could be a malicious e-mail that launches ransomware. The ransomware will potentially destroy data without transmitting the data to third parties.

25

Iowa Code Chapter 715C 715C.1 defines a “personal information” as”

• SS#

• Government ID (driver’s license)

• Financial Account numbers

• Unique ID that in combination with passwords or codes allows access to a financial account

• Biometric data.

Iowa Code Chapter 715C Requires notification to consumers if

“Personal Information” is accessed

If more than 500 Iowan’s affected, then also notify Attorney General’s office

26

Iowa Code Chapter 715C Data that law firms can have that would

constitute 715C personal information:• Tax Returns (account data, SS#s)

• Payment Systems (credit card numbers)

• Bank Payment information

Note that the firm may have lost very valuable information that constitutes a “client confidence” that does not constitute 715C personal information.

Iowa Code Chapter 715C If personal information is lost then Iowa law

triggers consumer notifications.

Most expeditious manner without unreasonable delay.

Law Enforcement may request a delay.

27

Iowa Code Chapter 715C Iowa is one of the states that has a safe

harbor exception: • Notification is not required if, after an appropriate

investigation or after consultation with the relevant federal, state, or local agencies responsible for law enforcement, the person determined that no reasonable likelihood of financial harm to the consumers whose personal information has been acquired has resulted or will result from the breach.

Other States are very different.

There are excellent “large firm” databases that provide reasonably up to date charts with the laws of each state: https://www.mintz.com/newsletter/2007/PrivSec-DataBreachLaws-02-07/state_data_breach_matrix.pdf

https://www.bakerlaw.com/files/uploads/documents/data%20breach%20documents/data_breach_charts.pdf

You need to do your own due diligence, however.

28


Massachusetts:

• Do not include description of the breach in the letter.

• Do not specify the number of individuals affected.

Most other states:

• DO include a description of the breach.


Texas, Arkansas, Minnesota (as an example):

• If an account number or debit card number is stolen, only a notification requirement is required if a security code, access code, or password was also stolen.

Massachusetts, North Carolina, Maryland (as an example):

• Have different notification of consumer rights.

29

State Data Breach Notification

Generally requires notice to people if there is a breach of personal information that is not encrypted.• Indiana, Wyoming, – no.

• New York City, D.C., - no.

Encryption exception may not last much longer. • Was key also stolen? Not encrypted.

State Data Breach Notificationfor Consumers

Many states have many different triggers for state office notifications – some 2015 examples:

Alaska: 1,000

California, Florida and Iowa: 500

Georgia: 10,000

Maryland: First must notify A.G.

Montana, Indiana: 1

30

State Data Breach Deadlines for Notification to Consumers

States have many different triggers – some

examples:

Connecticut: 90 days after discovery.

Florida: no more than 30 days.

Ohio: 45 days after discovery.

State Data Breach Agencies for Notification of Consumers

States list different agencies that require notifications:

New Jersey: State Police

Puerto Rico: Dept. of Consumer Affairs.

Maine: Dept. of Professional & Fin. Reg.

Mass: Office of Consumer Affairs & Reg.

31

“Regular email is not a secure method for sending sensitive data. The better practice is to encrypt any transmission that contains information that could be used by fraudsters or identity thieves.”

Federal Trade Commission’s November 2011 Guide to Business.

32

First Steps Develop & Review Policies and Procedures

Train Employees

Long, Unique Passwords

Multiple Usernames and Passwords (2-Step)

Secure Connections

Encryption

Indemnification of Third-Party Agreements

Add/Review Insurance Coverage

Second Steps Train all staff and attorneys on how to spot bad e-

mails and how to avoid clicking on potentially bad links.

Conduct phishing tests of your attorneys and employees.

Install mobile device management on all tablets, laptops, and smart phones that have access to your system.

33

BrownWinick tests its attorneys and staff every month

Different e-mails are sent out to everyone in the firm to train them not to click on links from unknown or suspicious sources.

Second Steps

Install advanced (new generation) firewalls that can actively monitor information on your system for malicious behavior and not just examine data when it arrives at the firewall.

Install logging software for forensic use.

Consider hiring a security firm to conduct penetration audits of your firm

Consider hiring a security firm to monitor your server and firewall logs

34

Website: www.brownwinick.comToll Free Phone Number: 1-888-282-3515

OFFICE LOCATIONS:

666 Grand Avenue, Suite 2000Des Moines, Iowa 50309-2510

Telephone: (515) 242-2400Facsimile: (515) 283-0231

DISCLAIMER: No oral or written statement made by BrownWinick attorneys shouldbe interpreted by the recipient as suggesting a need to obtain legal counsel fromBrownWinick or any other firm, nor as suggesting a need to take legal action. Do notattempt to solve individual problems upon the basis of general information providedby any BrownWinick attorney, as slight changes in fact situations may cause amaterial change in legal result.

environmental law seminar

Documents