To meet ethical obligations, attorneys are urged to follow tech developments

Cloud storage as backup

By Geri L. Dreiling, Esq.

To use cloud storage or not to use cloud storage, that is the question many lawyers are still debating. In late October, the Illinois State Bar Association held its Solo and Small Firm Conference and cloud-based storage was on the schedule.

To store data in the cloud generally means backing up electronic files on the Web and storing them in remote data centers. Some law firms are turning to cloud storage as a cost-effective and convenient way to back up their data or as a back up to a hard drive back up. What concerns lawyers the most is turning over confidential client information to a third party.

Although I was unable to attend, the ISBA CLE Center sent along a thumb drive with the materials from the 3-day conference. Presenters at the conference provided information on the cloud ranging from ethical duties to practical information on providers.

Objections to the cloud

Although cloud storage offers economic advantages for solo and small firm lawyers, some attorneys remain worried about security.

Joshua Poje, a research specialist with the American Bar Association’s Legal Technology Resource Center, in his conference materials titled “To The Cloud: Using Cloud-Based Storage,” notes:

“Realistically, though, attorneys and firms have trusted their confidential client files to third parties for years. Many lawyers used, and continue to use, outside storage facilities to hold boxes upon boxes of closed client files. Cleaning staff, security, and temporary workers are routinely given access to physical files on site. And even in terms of data, computer consultants and technicians are often given access to the firm’s computers without a second thought.”

It is clear that lawyers have a duty to safeguard client confidentiality from third parties whether it is written on a piece of paper or stored in a remote data center.

A lawyer’s responsibilities

Synthesizing advisory opinions from across the country, Poje outlined three responsibilities for lawyers.

First, lawyers need to develop a competent understanding of the technology and its security.

Second, lawyers have a duty to exercise reasonable care to ensure the vendor acts consistent with the client confidentiality mandate.

Third, lawyers must keep up to date on changes and challenges to online security. To underscore the importance of the third point, Poje cited the example of Dropbox.

As we noted in “Dropbox in the Hot Seat,” the cloud-based storage service initially asserted that it offered military-grade encryption services and that its employees could not access users’ files. However, in a complaint filed with the Federal Trade Commission, a leading privacy advocate asserted that employees do have access to users’ data.

Encryption used in cloud environments

Dropbox amended its policies. In a blog post, the company stated, among other things, that it does have the encryption keys.

Encrypting on the cloud

The revelations concerning Dropbox did not automatically remove it as a tool for lawyers. For some, it meant becoming more selective about the types of information stored in Dropbox. For others, it meant adding another layer of security by using an encryption tool like TrueCrypt. TrueCrypt is free, open source software that will encrypt data that cannot be unlocked by Dropbox employees. (For more information on using TrueCrypt with Dropbox, see this wiki.)

Uploading encrypted files to the cloud

Dropbox isn’t the only cloud-based storage service. The conference materials highlighted some of the alternatives we have mentioned in previous articles and added some of their own.

When selecting a cloud-based storage, lawyers are urged to read the privacy policies and terms of service. It is also a good idea to ask:

  • Where are the servers physically located? Some have worried that the country where the server is located could impact whether the information was subject to a subpoena.
  • Who has the keys to unlock encrypted data?

Continuing Cloud Education

It is often noted that the law, with its reliance on tradition and precedent, changes slowly. With technology, the opposite is true. When bar associations offer technology-related CLEs packed with practical information and presented in plain language, they provide their members with an invaluable service.

If you want to follow technology, gadget and software news aimed at lawyers, subscribe to Lawyer Tech Review.