BY CONSTANCE A. ANASTOPOULO
All lawyers use some form of document storage nowadays, but what happens if the software company is hit with malware? Or raises its fees to an amount the attorney can no longer afford? Or provides such bad service the attorney is forced to choose another provider? Or goes out of business? What is the attorney's recourse? Who owns the data? How does the attorney get it back? In what form is it returned? These are questions every lawyer should consider.
Once upon a time, there were filing cabinets where attorneys kept their paper files. Those files included sensitive information about the clients, including names, telephone numbers, addresses, social security numbers, bank accounts, etc., as well as attorney work-product such as motions, complaints, settlement documents, notes and other materials. All this information is known as "data."[1] When a case was concluded, the files were stored in boxes, and then kept in a storage facility or storeroom. If the client or the attorney needed something from the file during the representation, access was easy — one just went to the file cabinet and pulled the file. If the client or attorney needed something from the file after it was sent to storage, it was as easy as asking for the file from the storeroom or storage facility.[2]
Then came computers, and attorneys' files were stored on computer drives in addition to the paper-files. But as technology progressed, and courts moved to electronic filings, paper files became obsolete, lawyers needed a place and a system to store them electronic files...enter the "cloud."
The term cloud in the context of computing refers to a network of remote servers hosted on the internet that store, manage and process data, rather than a local server or a personal computer. Cloud computing allows users to access and use computing resources (such as servers, storage, databases, software, analytics and intelligence) over the internet, typically on a pay as-you go basis.[3]
There are various deployment models, including:
1. Public Cloud: Services are provided over the internet and are available to anyone who wants to purchase them. Examples include Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform.[4]
2. Private Cloud: Services are used exclusively by a single organization. The infrastructure can be managed by the organization or a tim'd party.[5]
3. Hybrid Cloud: Combines elements of both public and private clouds. It allows data and applications to be shared between them.[6]
Additionally, many attorneys utilize cloud-based service products to manage and organize caseloads called Software as a Service (SaaS) that deliver software applications over the internet, eliminating the need for users to install, maintain and run the applications on their devices.[7] Examples include Litify, Filevine, TrialWorks, GloudLex and others. As attorneys upload data to their Software as a Service (SaaS) provider, that information is held by a cloud service such as AWS or Google Cloud platform. The SaaS serves as the middleman between the customer (attorney) and the cloud service provider where the data is held. These services generate an internal number to link separate data pieces, and when information is needed, the customer generally accesses the information via the cloud service provider's proprietary user interface and the software compiles the data from the links, displaying it to the user. Access to the proprietary interface is granted to the customer through the sub scription agreement. This is important to understand if problems arise because the cloud service stores data in the general subject area such as notes, messages, filings and photographs, and when the attorney requests files after a problem, the only obligation of the cloud service provider is to produce the data list by internal number and by general subject area. What an attorney may receive is pages of spreadsheets with information listed by cloud service number without any identifying information to match with the actual client's name or case. Without the SaaS provider's proprietary user interface and software to "put Humpty Dumpty back together again"[8], the lawyer can be left with useless pieces of data.
It is important for attorneys to understand the issues and the responsibilities when utilizing these products. In South Carolina, attorneys have an ethical duty to ensure the confidentiality of client information when using cloud services. This duty is rooted in the attorney-client privilege, which encourages clients to make full and frank disclosures to their attorneys, who are then better able to provide candid advice and effective representation.[9] The obligation to preserve client confidential information extends beyond merely prohibiting an attorney from revealing confidential information without client consent. A lawyer must also take reasonable care to affirmatively protect a client's confidential information.[10] This obligation includes all data held in the cloud. This duty extends to supervising the technical operations of the cloud service provider and obtaining the informed consent of the client.[11]
Unfortunately, most, if not all, SaaS agreements explicitly state that their customers are responsible for their (and their clients') data and for backing up all the data that is uploaded.[12] If a disagreement arises with the cloud service provider or the provider is hacked, client data can be held for ransom. Additionally, companies like Filevine may have provisions in their contracts with lawyers that the provider can use the data indefinitely.[13] It is the responsibilities of the lawyer to ensure access and confidentiality of client data.
Another issue may arise with accessing the client file stored in the cloud. With no physical backup at the attorney's location, data, including confidential client information may be gone or produced in such a maimer that the attorney does not know what data belongs to which client. Attorneys can be left explaining the loss of data to their clients and the state Bar. What is the duty of the software company or Amazon Web Services or Microsoft Azure when this happens? What are they required to provide? Will they assist the attorney at a disciplinary hearing? Will they indemnify the attorney if clients sue? Therefore, attorneys should have information regarding the use of the cloud for file storage in the engagement agreement with the client and obtain the informed consent of the client before uploading information to and utilizing cloud storage services.
Some attorneys may be backing up their documents internally or firms may have a policy that data is backed up on other providers such as Dropbox (which is another cloud provider rather than internal or local), believing this may solve these concerns about accessibility and confidentiality through a backup system. However, it is important for attorneys to closely read the agreements with Dropbox or other similar back up systems as they may be violating ethical rules regarding confidentiality. For example, Dropbox's service agreement, and potentially others, states that Drop-box will have the right to access and anonymize all data and "tills data is owned by Dropbox."[14] Furthermore, attorneys should address all ethical issues pertaining to outsourcing in the "terms of service" agreement with the cloud computing vendor.[15] In the context of cloud computing, a preliminary issue arises as to whether the third-party vendor providing the cloud service or the party using the service actually owns and controls the documents.[16] Allowing a back-up service such as Dropbox or similar provider to "own this data" in any form may violate an attorney's ethical duty of confidentiality.
Also, there is a great deal of data that resides in tire attorney's SaaS system that must be preserved in addition to documents. All the data entered in the system is not only relevant and important information regarding a client's case, but also, should a fee dispute arise, is evidence of work performed by the attorney and the law firm staff and can be considered part of the preservable file. Tins data may include tilings film digital correspondence, notes, messages. case contacts, in addition to pleadings, legal documents, evidence, discovery, legal research, transcripts, correspondence, drafts and notes.[17]
Additionally, attorneys must ensure that the cloud service providers they use are competent and must oversee the execution of the agreement adequately and appropriately. This is part of an attorney's duty of supervision. Depending on the sensitivity of the information being provided, attorneys should consider investigating the security of the provider's premises, computer network and even recycling and disposal procedures.[18] Lastly, the responsibility of the attorney to protect the client data can be more challenging due to the refiance of cloud computing on the internet and interconnected computer systems which are themselves vulnerable to hacking.[19]
Recognizing the issues and evolving technology related to cloud storage of client information by attorneys, the New Yort State Bar Association promulgated specific guidelines to assist attorneys in understanding their ethical duty in this area. These guidelines required lawyers to proactively tala* measures regarding the duty of confidentiality and cloud storage by taking the following steps:
1. Ensuring that the online data storage provider has an enforceable obligation to preserve confidentiality and security, and that the provider will notify the lawyer if served with process requiring the production of client information.
2. Investigating the online data storage provider's security measures...
