{"id":108,"date":"2016-04-06T19:40:40","date_gmt":"2016-04-06T19:40:40","guid":{"rendered":"https:\/\/www.sherin.com\/professional-liability\/?p=108"},"modified":"2019-06-03T15:37:28","modified_gmt":"2019-06-03T15:37:28","slug":"lawyers-in-the-united-states-should-pay-attention-to-the-panama-papers","status":"publish","type":"post","link":"https:\/\/www.sherin.com\/law-firm-defense\/2016\/04\/06\/lawyers-in-the-united-states-should-pay-attention-to-the-panama-papers\/","title":{"rendered":"Lawyers in the United States Should Pay Attention to the Panama Papers"},"content":{"rendered":"

\"19830412_s\"<\/p>\n

The Panamanian law firm that was the source of the \u201cPanama Papers<\/a>\u201d says it was hacked<\/a>, exposing its clients\u2019 personal and financial data to the world.<\/p>\n

For American lawyers subject to the Rules of Professional Conduct, the problems facing the Panamanian firm Mossack Fonseca<\/a> should serve as a reminder to take extra care to secure electronic data.\u00a0 Lawyers have an obligation under Model of Rule Professional Conduct 1.6(c)<\/a> to \u201cmake reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.\u201d \u00a0This data security obligation was added to Massachusetts Rule of Professional Conduct 1.6(c)<\/a> last year.<\/p>\n

In the Panama Papers case, Mossack Fonseca blamed the hack on an \u201cunauthorized breach of our email server<\/a>.\u201d\u00a0 That should give American lawyers pause, even if they do not count the prime minister of Iceland<\/a>, cronies of Vladimir Putin<\/a>, or members of the Chinese Politburo<\/a> among their clients.\u00a0 Massachusetts lawyers should pay attention, and consider what would happen if their clients\u2019 confidential information became publicly available.\u00a0 Although exposure of such information might not make headlines, it could devastate clients if it fell into wrong hands.<\/p>\n

What Constitutes \u201cReasonable Efforts?\u201d<\/strong><\/p>\n

Rule 1.6(c) does not say what constitutes \u201creasonable efforts.\u201d\u00a0 But Comment 18<\/a> to the rule says:<\/p>\n

[f]actors to be considered in determining the reasonableness of the lawyer\u2019s efforts include, but are not limited to, the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer\u2019s ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use).<\/p>\n

Comment 18 also states that a lawyer does not violate Rule 1.6(c) if someone gains unauthorized access to information, notwithstanding reasonable efforts to prevent the access.<\/p>\n

Still, it would be embarrassing, or worse, for any lawyer to explain to his or her client \u2013 and, possibly, the Board of Bar Overseers \u2013 that confidential documents were exposed because they were held in the lawyer\u2019s Hotmail account, for which the password was \u201cpassword.\u201d\u00a0 Even if the password were stronger, lawyers must remember that someone who knows the answers to a security question might be able to gain access to web-based email<\/a>.\u00a0 If the question is something like: \u201cWhere did you go to high school?\u201d sensitive client information might be at risk to anyone who knows anything about you \u2013 or is willing to invest in a little internet sleuthing<\/p>\n

The need to protect client information is not lessened if a lawyer\u2019s clients are not public figures.\u00a0 Adversaries, business competitors and jealous ex-spouses, among others, may be highly interested in a client\u2019s confidential electronic files, to say nothing of identity thieves and fraudsters.<\/p>\n

Lawyers and firms should tailor their data security to their clients and their practices.\u00a0 There are numerous actions<\/a> lawyers can take to protect their data, but some of the simplest and most non-burdensome steps include the following:<\/p>\n