Good morning and welcome to Law Firm Cyber Risk and Ethics. I'm Jeff Cunningham from Goldberg Segalla. Thank you for joining me. Um, I'd be sorry, ethics guy, if I didn't start out by saying that this is for educational purposes only and no attorney client relationship is formed, and this presentation does not constitute and should not be considered legal advice. It's a little bit about me. I defend lawyers and law firms sued for legal malpractice facing ethics grievances, and I also serve as outside general counsel to solo and small law firms. A couple of mid-sized firms. My whole approach is to use simple systems to try to protect law firms before disaster strikes. So really trying to get ahead of the game instead of waiting back for a legal mal claim to come in or an ethics issue to develop, really taking what we know about law firm risk and sort of building that in proactively in an attempt to mitigate or transfer as much risk to law firms as we can. I'm an attorney, admitted in New York, in Connecticut, and I work with law firms around the country. As I said, I'm a partner at Goldberg Segalla in White Plains, New York, and this is for educational purposes only. So got a lot to cover today. I'm going to sort of intro risk generally and take a real holistic approach. And this presentation is great because it sort of is the three. We'll discuss the three big areas of risk that law firms face. Law firms of any size, any practice area, but really looking at risk sort of generally then diving into the three areas ethics and looking at. We'll look at the model rules today, the rules that apply and impact law firm risk. Law firm risk. So legal malpractice but other claims as well that law firms really face and should be aware of. And then cyber risk obviously we're talking about cyber today. And we'll talk about this in more detail. But cyber is becoming more and more of a meaningless word. It's sort of growing and expanding into all aspects of practice and life. And I think that's something that law firms need to accept and kind of work with. Um, throughout the presentation, I'll discuss my method, my method. As I said, my approach is really simple and trying to to I find that a decent method, a decent system dealing with risk that's easy enough to actually get used is way better than the perfect risk management system that's too complicated for your people to actually use. So I strive for simplicity and ease and really like a high return on investment approach. So the method is is again very basic education. Just understanding your risk systems, figuring out how you can mitigate transfer, reduce that risk plans, just working through the scenarios for when things go wrong because inevitably things are going to go wrong. And then teams sort of developing what people you need and who you have available, using your resources and looking at it in the broadest possible sense, some action steps, things you can do today to make your practice better and safer. Then we'll discuss the resources available, and then we'll wrap things up. And of course, if there's any questions, feel free to drop those in at any time. Um, before we start, you know, I mentioned that cyber is sort of becoming this amorphous, um, boogeyman. And I think it's only going to get worse. It really is sort of taking over every aspect of the practice of law. And, you know, I think there's a lot of pros and a lot of cons to that. It just sort of our reality. I imagine it's probably what lawyers felt like when the typewriter came around or when Westlaw and Lexis developed, or maybe even way back when, like the printing press became a thing. You know, it really is a game changer. And just just taking any portion of of the cyber impact on law such as AI. Or we'll talk about cloud based storage or the impact on e-discovery and predictive coding and things like that. It really is changing the way we practice law. And unfortunately, a lot of lawyers have sort of a head in the sand approach, which even if they don't, I guess they have for a different metaphor. You know, they're wearing blinders like a horse. They're kind of looking at cyber and how it impacts their day to day practice, not so much how it's going to impact their practice in five years, and not so much how it's impacting the greater practice of law all around them. So, you know, I think before you start thinking about cyber risk and our ethical duties and how it's going to impact your firm, you've got to keep in mind that it's sort of a long game. The door is only cracked open right now. It's going to get bigger and bigger and bigger and cyber. Risk and the obligations that come with it are going to be all encompassing. If they're not already. So just bearing that in mind as we discuss sort of all the various nuances here. All right. So stepping back right, closing the door a little bit. I always like to talk about ethics and malpractice ethics and risk to law firms to sort of frame the conversation. And I think the the Dart board is, is a great way to think about the two huge sources of risk to law firms. If you're not, you know, a darts fan. I like darts, but if you're not a darts fan, the we have the black and white here and assume you know the black represents malpractice risk and the white represents our ethical obligations. The inner and outer ring, not the bull's eye, but the other two rings are the double and triple point areas. The green and red and those those are think of those as the overlap, the kind of danger zones where you're catching both a legal malpractice risk and an ethical obligations, like a conflict of interest. You know, those are sort of the most dangerous issues that law firms face. And those are really where I like to try to focus application of the method. And and I find that's where lawyers can get the most return on investment. I really like the Dart board, because it sort of focuses in on the idea that your clients are are your enemy, at least from my standpoint as a lawyer for lawyers, clients can be great people. They can be your best friend, they can be your neighbor, they can be wonderful. And obviously we need clients in order to practice law, but it has to always be in the back of your mind that the major source of your risk. I mean, if I had to throw a percentage out there, it'd be 99% of your risk really does stem from your clients. In very, very rare instances, non clients can sue you for legal malpractice or assert other claims against you. And obviously we owe ethical obligations not only to our clients but to the courts, to the public, to our adversaries. But the bulk of our risk and obligations are directed at our clients, and it's always important to keep that in mind. So here the lawyer is sitting at the bull's eye and the darts are the clients. Um, I also like to talk about there's this fable. It's a Persian fable, but I think every culture on the planet has some variant of it. Um, the turtle and the scorpion. And so the quickly the fable goes, the turtle and the scorpion are friends. As turtles and scorpions are, I guess. And the scorpion needs to get to the other side of a river, so yeah, but he can't swim, so he has to. Turtle. Hey, can you help me get to the other side of the river? Turtle says, sure thing. Hop on my back. They swim out into the river, and when they're about halfway through, the scorpion tries to sting the turtle. The turtle shell saves him, of course, but the turtle gets the other side. What's scorpion off? And he's he's bewildered and he's like, you know, why would you do that? I was helping you. And if you stung me, I would die. But you would die too, because you can't swim. And the scorpion says, it's just in my nature to sting. And I think that's a great way to keep in mind that your clients are risk. It's in their nature to sting. Great clients, great friends, are wonderful, have many great clients. I have many not so great clients, but I have many great clients. At some point things go wrong and problems develop. According to the ABA, lawyers have an 80% chance of being sued for legal malpractice over the course of their career. That statistic is staggering. I have never found the methodology behind it. I can't believe that that's actually true, although it's it's the number of the ABA has put out and presumably they have actually conducted the study. But I think that shocking number is good because your chances of being sued for legal malpractice are way higher than than you think. We all sort of underestimate, I think, greatly underestimate the risk that we're facing. And so going back to our our scorpion and turtle, it's in the scorpion's nature to sting. The client is your source of risk. And it is in their nature to sting in that when $1 million is lost, for some reason, they're going to look around and point the finger at someone. Not every client you know a risk, but even a good client, even a good friend. When there are problems, legal malpractice, and correspondingly ethics claims tend to follow. And it's just the nature of the practice. And it's it's a reality that you need to accept. There aren't hard statistics on ethics claims. And I think the primary reason is the ABA uses insurance companies to get the legal statistics, and ethics statistics would require the state bar to sort of assist the ABA in gathering that. So but it's generally assumed that the stats sort of track whether they're higher or lower. Again, if you have an 80% chance of catching a legal malpractice claim over the course of your career, even assuming that's on the high end, it's safe to assume that you're going to have a similar chance of an ethics complaint of some kind at some point. So. Um, once we fold cyber into the idea of risk, legal risk, legal malpractice risk, and ethical risk, things tend to get blurred. Cyber is becoming more and more prevalent, as I said, and our dartboard becomes all fuzzy and the overlaps are not nearly as clear. So the growth of technology. In the practice of art has just dynamically changed. Pretty much everything we do. I mean, just think back ten years ago, think about pre-COVID and, you know, remote practice and remote court and the way deals are done today versus before Covid. Now try to remember back a decade ago or so. Things are very, very different. And the technology curve is is really exponential. It's getting bigger and bigger and bigger. You know, the fact that we're enjoying a cloud remotely is really telling. It's just not something that really happened, you know, ten, 20 years ago. So again, getting back to our risk and sort of folding cyber into it, the Venn diagram here shows again black, you know, with the the gavel is sort of our legal risk. White with the scales is our ethics risk. And then red with the shield and World Wide Web sign or whatever that is. That's that's our cyber risk. And they're all independent but overlapping. And where the target is, the bullseye here, you know, is that point where all three sources of risk overlap. And I think that's a really valuable space for law firms to consider when thinking about their risk management systems and how you can comply with our ethical obligations, avoid legal risk, and effectively use technology while while mitigating cyber risk as much as you can. You can score the most points in that center area of overlap. That's not to say you know, you still want to address all your risk you can, right? You want to you want to look at the whole circle of ethics risk. But those areas where it overlaps with other areas of risk, you can score the most points. So I'm going to kind of dive into our ethics risk, and then we'll talk about our legal risk and then our cyber risks. And then we'll sort of tie it all together, discuss the method and then some action steps. The our ethics. Sources are. And today we'll be talking about the ABA model Rules of Professional Conduct. And specifically we're going to talk about some ABA formal opinion. So these are all pretty recent formal opinion 477 are talks about securing communications of protected client info. So really confidentiality and technology it is sort of the. Um most recent attempt by the ABA, and many local bar associations have sort of built off of 477 R to understand how rule 1.6 um exists today, and what our obligations are when using technology, specifically email. Um ABA Formal Opinion 483 discusses data breaches and attorney obligations for notification. Notifying the client. Notifying authorities. Notifying other affected parties. Um, again, given our. Rules of professional conduct. You know what obligations we have in notification, in response and in security in general. So for 83 really does discuss kind of the it's the best opinion so far discussing the nuts and bolts of a cyber breach a data breach. And you know what. Responses. The lawyers. Must or can take, and then opinion 498 discusses the virtual practice of law. Very broadly, it defines virtual practice as not from a traditional brick and mortar office. And so it's pretty comprehensive in that it really goes through almost every rule and discusses how the rules are different and how the rules are the same, whether you're practicing from the beach or from your office on Court Street. Those opinions are all available online, but they're also in the handout material today, so you can check those out in more detail. But it's it's important to note that if you track the ABA ethics opinions or most state ethics opinions, at this point, they are becoming more and more cyber focused. And as the Cyber Door sort of opens more and cyber becomes just a part of our practice, they're actually becoming less cyber focused. And cyber issues are just pervading all of the ethics issues that are coming up these days. So while the bar associations, which I think tend to naturally chase the developments in the law, they're usually a little bit behind what's happening today in the legal profession. You know, we can already see that they had started with opinions about, you know, like 477 are how can we use email now? This was from 2019, I believe 2018. You know, a little bit again behind the curve. We'd been using email for 20 or 30 years at that point. But. The shift is really growing. As you can see, we're now in the five hundreds for formal opinions, and almost every formal opinion that the ABA is putting out has some cyber component, regardless of the subject matter, because it's becoming so pervasive. In addition to the model rules, which don't actually control anywhere, they just provide insight and allow us to talk about our obligations across all 50 states. Your jurisdictional rules, of course, are a source of ethics and control, and that can be one jurisdiction or several jurisdictions, depending on where you're admitted, where you're working in the new normal, it can get even more complicated because you may be sitting in one jurisdiction you're not admitted in, you may be working in another jurisdiction. You may have clients in yet another jurisdiction. So it can get very complicated and often requires lawyers to look at multiple and sometimes conflicting sets of rules. And that's where the ABA model rules can also be very helpful in that if you're comparing multiple jurisdictions, the ABA, while not controlling, can be sort of a persuasive framework. Then the ethics opinions. And you know, we talked about the ABA formula begins. But of course every state bar puts out their own ethics opinions. Many municipal, county and affinity bar associations put out ethics opinions as well. And to complicate things, you know, each state has adopted the model rules in some capacity, but has every single state has tweaked the model rules a bit, some more than others. Some have adopted the comments, some have changed the comments. Some. And some ethics opinions for for each state are going to be dealing with that state's version of the rule. So it can be challenging to sort out what rule applies and then to interpret that rule, of course, your jurisdiction's rules are going to control. And if you have an ethics opinion on point from your state bar especially, but any bar association in your jurisdiction, that's going to be the most helpful interpreting your state's rule. But you know, if you're dealing with a question on rule 1.5 and your state doesn't have an opinion on 1.5, that's when you will need to look to the ABA and to other states. And you want to look for states that have a similar rule to your rule 1.5 to use those ethics opinions. Then on top of all of that, each state court is going to be interpreting the rules. And ultimately, in almost every jurisdiction, attorney discipline ends in the courts system. So you need to look at court decisions that are discussing the rules you're looking into and see how that impacts your your ethics issues. So those are our sources of risk. And then of course, the last bullet point is you. And aside from our personal morality and our personal ethics, we have professional ethics. And I never want to undersell that, that we have the rules, the rules in the preamble in scope explain that they are guidelines that you can't capture professional ethics in a statute. They try to be as detailed as possible. They try to to grapple with. All of the major issues that attorneys will face in the practice of law, but no set of rules could actually do that. So at the end of the day, in addition to our morality, you know, our our our internal conscience, we have a professional set of ethics and embrace that. It's important. And it is, I think, the best way to tell if something's wrong, if your gut just makes you question it, if you start looking at an issue and checking the the rules and your state's ethics opinions, and you start reading ethics opinions from a neighboring state, that's a great indicator that you're on to something and that your personal professional ethics has has caught that there's an issue here, and I think that's the point where you want to elevate it to someone in your firm. You want to discuss it with a mentor or a colleague. You want to retain ethics counsel, or you want to step away from whatever the issue is and really think whether it's worth it and try to address the risk. So so don't don't underappreciate your own personal internal professional ethics. So again talking about the ABA model rules, these are kind of the key rules when it comes to cyber risk and our ethics rules. But all of the ABA rules I mean they encompass the entire or they're supposed to encompass the entire practice of law. So all of the rules sort of touch on risk to lawyers and on. The. The obligations we have. So rule 1.1 and competence in the cyber world. You know, this rule is growing and it really has become kind of a litmus test. You know, whether an attorney is competent to use technology has come up in several prominent opinions. And the basic idea is that if you're not competent to ensure and this is in 477 R, if you're not competent enough to ensure that your technology is secure to protect client communications, then you need to retain an expert who is. So you need an I.T OT vendor. You need a cyber vendor. You need someone that is capable of making sure you're protecting your client information and communications. Rule 1.4 again, you know, communication generally the world has changed from the days of meeting clients and talking on the phone to email and zoom and other other video platforms. I'm seeing more and more instances of lawyers asking for my opinion on transcribing and recording video and telephone communications with clients, and using that really as a client service less than a CIA. But by transcribing the recordings of client communications and then feeding that into proprietary AI platforms, I've got several clients that are doing really amazing things with their client communications. You know, it's it's all very new, but at the same time, it's the same issues that, you know, the lawyers had to deal with when the telephone became prevalent, when email first came into being. It's it's the technology is new, but the risks and the obligations are are the same. And so it's sort of an exciting time to be practicing law. It's also sort of a scary time to be practicing law. But it was when, you know, when some lawyer got the first phone call from a client, I'm sure they were in the same position that, you know, the world was changing around them. Rule 1.6 and confidentiality is, of course, paramount, and it's the major concern that you'll see ethics opinions grapple with pretty much anytime cyber risk is discussed. Confidentiality is the big concern, whether it's using AI and feeding confidential information into some AI platform, whether it's a cyber breach, you know, whether it's using even eDiscovery platforms. Confidentiality is always a concern. And sort of expanding rule 1.6 to cover the use of technology has been challenging. It's it's definitely the most developed, I think, the most developed rule when it comes to cyber risk. But there's still a whole lot of gray area. And it reminds us that you have to have a client focused approach to your use of tech, while using any particular technology to benefit your clients and your firm is great. Make sure that it's a client first policy you have. Rule 1.15 safeguarding property ties right into 1.6, and confidentiality in the same way that you need to have a client focused approach to maintaining confidentiality, you have to protect client property in a way that we just didn't have to before the old days of a client bringing in, you know, some valuable jewels or something to keep in your safe in the office. That could still happen. And certainly in the trust and estates context, client documents are often. Safeguarded by lawyers. But really today the the the property most attorneys are responsible for safeguarding is client data and sometimes extremely valuable data, whether it's just HIPAA protected personal information, social security numbers, things like that, or IP or financial information, proprietary information, you know, there's there's so much valuable data out there and there are bad actors trying to obtain that data, that rule 1.15 has really been stretched beyond its original intent. I mean, the original intent was to was dealing with with physical property and client files. And, you know, that's been sort of expanded into us maintaining client data and our obligations around there. And I think that's my guess, is this before the year is out, we'll see an ABA ethics opinion on rule 1.15 in the in the in the modern era, we're really trying to build on sort of the momentum of the past half dozen opinions to explain our obligations under 1.15, but we'll see. I mean, it's still, as I said, it's still the old rule trying to fit into the the new normal 3.2 and expediting litigation. This ties back into 1.1 incompetence and I think. I like to use the example of a lawyer who doesn't use email. I used to know some lawyers who didn't use email. I, I used to work with a lawyer, and about ten years ago I worked with a different lawyer who used email but had their assistant print out the emails. They would read the emails on paper, they would write their responses on the paper and then give it back to their assistant, who would then type it up and send the emails back on their behalf. Um, the second guy I knew who did this retired two years ago, so I don't actually know of any other lawyers who are doing that, but I'm sure they are out there. But, you know, is a lawyer competent who doesn't use email? Is a lawyer meeting their obligations to expedite litigation or even by extension of 3.2, expediting transactional work if they if they aren't using email, I would say no. I mean, I think at this at this point, we all have to be competent enough to use email and and use e-filing in the litigation context. You know, 3.2 really sort of pushes our duties of diligence and competence in the litigation context at least. And you can sort of expand off of it to assume that same level of obligation in the non litigation context. Um, to be efficient. And it's completely inefficient if you're not doing simple things like email now. Broadening that idea. You know, if you're not using an eDiscovery platform to expedite litigation, is that acceptable? You know, obviously it's case by case. And I think the lawyer who's printing out their emails probably still has some time to get on board with e-discovery. But I think that time is running out. And I think, you know, in 3 to 5 years, we'll be talking about whether not using some sort of AI assisted platform to practice law is going to be competent and is going to be expediting and diligent. And, you know, whether whether it's going to be as silly as someone who has their emails printed out to not use legal AI in whatever it looks like in a few years, we'll see. And then the supervisory rules really come into play in the cyber world, especially in the new normal practice where almost everyone is working in some capacity remotely. But even if you're all in the office and this is where cyber becomes so pervasive, even if you're all sitting in the office, even if you're all in one room with like, cubicles or something, you know, you are all sort of practicing remotely, right? Because we're all on a network. Everybody's at their own workstation. It really doesn't matter from the cyber risk standpoint, whether you're in a room divided by cubicles, whether you're in a traditional office with different office space, or whether you have people all over the globe all working on your system. So 5.1, 5.2 and 5.3 are really important from the cyber standpoint in that. It all ties back to rule 1.1. In that competence and ethics opinion 477 are if you're not competent to ensure that you're protecting your client data and by extension, by protecting your practice. Then you have to. You have an obligation to bring in an expert that can ensure that level of protection. And the reality is, most lawyers are quite behind the curve when it comes to technology. Myself included, and even a very tech savvy lawyer is probably not going to be as tech savvy as someone who specializes in I.T. performance or cybersecurity. One of the biggest problems I see small firms solo firms have is that they do have an IT guy, and they end up, in many ways, treating the IT guy like they do the lock on their front door of their office. You know, there's a reasonableness idea behind it. And do you really have to vet your IT guy to know that he is good enough to, to meet with your obligations? Or can you rely on the fact that he's a professional in that space and he says he's good enough? Do you vet your deadbolt to make sure it's not one of the deadbolts that that's easier to pick? No. Right. No. No lawyer I know of is actually selecting their deadbolt on their front door and saying, oh, these. You know, these locks are too easy to pick. We need to get this kind of lock. That's just not happening. I think in the cyber world, though, it's a little more complicated in that small firms tend to use a fractional IT person because they don't need 24/7 I.T. support. But even big firms that use, you know, my firm has a dedicated IT staff. I don't even know how many people, but it's got to be more than a dozen people. And we do have 24 over seven support, but we also have cyber security. So using the same person to run your operations, your IT and OT and to defend your operations, your cyber is risky. There are plenty of vendors out there who do both jobs and do both jobs well. There are more vendors out there who do both jobs and do one or the other poorly. And then, of course, there's plenty of vendors out there who do both poorly. So, you know, the supervisory rules really do require you to use outside support. And especially 5.3, you can't dump your obligations when it comes to cyber risk onto a non-lawyer. Either an outside vendor or if you're just using a paralegal. Or as I see with many small firms, the youngest person in the group, whoever they happen to be. There's just an assumption that they're, you know, more tech savvy than everyone else. You can't do that without doing your due diligence. And so 5.1 and 5.2 and 5.3 really capture this sort of ongoing duty. We have to ensure that we're meeting the the standards of the other rules in the cyber context, the pervasive cyber context. All right, so putting ethics aside, jumping into another bubble of the Venn diagram is our risk. And I love this picture of this guy, you know, with the bear traps or whatever those are. So risk and risk to attorneys really is legal malpractice risk. But there are lots of other claims you could see. Breach of fiduciary duty is quite common and and can be distinct. Most other claims against lawyers for the practice of law are duplicative of a legal malpractice claim, and are easy to get rid of. Typically, breach of fiduciary duty is sort of the one on the outside. It sort of encompasses the other duties we have to clients. I see a lot of breach of contract claims. In some states. You can have a distinct breach of contract claim, rather than that falls outside of the legal practice world. But those are rare. And really where there is in fact an independent, explicit contract with the attorney and client beyond providing legal services, other claims we see are just straight negligence. Plaintiff's attorneys like to get creative with negligence per se and malpractice per se. Gross malpractice, things like that. All of those tend to fall under legal malpractice, a growing, small risk but growing area of risk I'm seeing is negligent referrals, where a lawyer sends a client either to another lawyer or other professional, and then things go south and there's some problem. And the client, you know, sues that professional, but then turns around and sues the lawyer and says, I relied on you as my attorney to recommend a good CPA, and you recommended a bad CPA. And so you've caused me damage. So something to think about again, it's still a very small set of cases, but it is growing. And anytime you're providing referrals, you know, it's important to communicate those with a disclaimer that you're not being engaged to vet these people. You just happen to know this CPA or these CPAs. Giving more than one referral is always a good idea. And that, you know, if if the client wants you to do the due diligence, then you're available to do that. Um. Oh, and before we get to cyber framing risk, whether whatever the claim is called, but framing the the risk in the elements of legal malpractice, I think is instructive. Most states have four elements. Some combine the third and fourth element, but the first element is privity. And aside from from extreme exceptions, mostly in the trust and estates context, only your client can sue you for legal malpractice. There is instances of near privity. West coast states tend to have a broader sense of this than the rest of the country, but near privity exists, especially in the trust and estates context, where anywhere the attorney is aware of a known beneficiary, someone related to the client that is benefiting from the work being provided to the client that the beneficiary is relying on the lawyer's work. Um, then sometimes that can push the relationship into a near privity situation where legal mal could be pursued from a non client, but typically absolute privity is required. Only the client can sue the lawyer for malpractice. The second element is the breach element. The act or omission of the attorney fell below the applicable standard of care, and the standard of care is generally a reasonable attorney in a similarly situated circumstance. So typically that would be the reasonable lawyer in your community. If your jurisdiction allows specialization, many do not. But if your jurisdiction allows you to be a tax specialist, you'll typically be held to the standard of the reasonable tax specialist. Um, I like to use the example of a Manhattan real estate attorney handling a multi-million dollar real estate transaction versus a general practitioner up in Plattsburgh, New York, handling a first time homebuyers purchase. If you're not familiar with Plattsburgh, New York, it's a lovely small town up on the Canadian border. I don't know, six, eight hours north of New York City. Um, a very small community compared to Manhattan. And those two lawyers, although both dealing with the real estate transaction, are going to be held to different standards, they're going to be held to the standard of the reasonable attorney in their community. And and that's going to be taken into account. So there's not a hard and fast standard that usually requires expert testimony, competing expert testimony from both sides to establish the third element is proximate cause. So an attorney could be 100% negligent, breach every single standard of care, every step of the way. But if those mistakes didn't cause damage, then there's no legal malpractice. And I think this is really, um, illustrated well by the innocence requirement in the criminal context of legal malpractice. So if a criminal defendant wants to sue their lawyer for legal malpractice in most states, they have to establish innocence. And it can either be actual innocence, innocence or factual innocence or both. And meaning they typically either need to have a conviction vacated. Um, and or prove that they did not commit the crime. It's a very high burden. The fact that a criminal defendant is convicted, or even worse, for the criminal defendant, if they accept a plea deal and allocute to the crimes, will act to bar a legal malpractice claim. The idea being no mistake of the lawyer could have proximately caused the conviction. The criminal defendant was convicted or took the plea deal because they were guilty and they committed the crime. So even if the lawyer was 100% negligent, it didn't cause the criminal conviction. And then finally, the last element which is sometimes combined in with proximate cause is damage. And it has to be actual dollar damages. It can't be speculative. And in almost all states it has got to be pecuniary loss, dollar damages. There are some instances, some states that do allow emotional damage, loss of liberty damage, things like that. But typically most states require it to be pecuniary loss, which again is is sometimes challenging for plaintiff clients to establish. All right. So keeping the four elements in mind as we move into the third bubble in our Venn diagram, cyber risk. The ABA has a cybersecurity handbook. It's pretty cool cover as ABA handbooks go. So I throw a picture of it in here. And ABA notes that cybersecurity is the art of protecting networks, devices, and data from unauthorized access or criminal use, and the practice of ensuring confidentiality, integrity and availability of information. And so the ABA Cybersecurity Handbook is a rough read. It is a valuable resource in that if you Google, you know, various issues you're dealing with, you'll probably catch articles that are discussing sections of the handbook. Unless you're really into cybersecurity and cybersecurity impact on law firms, I don't recommend reading this one cover to cover, but but it is a resource that is really helpful. And as I said, you can really find some valuable insight into discrete issues through articles that are referencing and using the Cybersecurity Handbook. So cyber again. It's pervasive. It's everywhere. The risk is growing every day. And and I'm often asked why law firms are at seemingly greater risk. And I think the the simple answer is law firms are really low hanging fruit to bad actors. And bad actors can be, you know, a sophisticated hacker. They can be state entities like North Korean, Chinese, Iranian, Russian criminal that are supported by their governments. It can also be, you know, a less impressive, just scam artist, con artist. And the reality is most hackers aren't, you know, sitting in a dark room with a hoodie with a hundred monitors around them, like a scene out of The Matrix. I mean, that's, you know, what we kind of think about when we think about a hacker. But the reality is, most of them are really just petty criminals. And we see a host of different scams that they use to obtain data. And, you know, it can be classic hacking where the bad actor is using vulnerabilities in your actual operating system. And it can also be the more conventional scams of like social engineering, where a fake email is sent purporting to be a big client or a partner at the firm, and getting someone to to provide information they wouldn't generally provide, or click on a link that they might not typically click on in other circumstances. So I think law firms, you know, they're low hanging fruit because our clients are sort of the the valuable, I guess, high hanging fruit, you know, hospitals or other clients with medical information, financial information, personal information like social security numbers, tax information and then also propriety. Three just sort of business information from business clients, you know, that are valuable but more challenging, typically more challenging for bad actors to obtain. Many of our clients are heavily regulated in the health sector, the financial sector regulated by industry in a way that the legal industry is not. And, you know, while we have standards of of reasonableness and, you know, opinion 477 R that says if you're not competent to protect your data, you have to hire someone who is competent to protect your data. Regulated industries tend to have really robust requirements, and law firms don't always meet the standards that their clients have to adhere to. And as I said, typically lawyers are a bit behind the curve when it comes to technology. That's not true for every law firm, but I think there's sort of an idea that law firms are easier targets when it comes to actually breaking through the systems. So we operate essentially as a piggy bank of valuable data and not a particularly well guarded piggy bank at best, whereas as well-guarded as the client. But in reality, we're generally much easier of a target than than the clients we service. And we tend to just hold the valuable data and sort of cull out all the other information, say the hospital client would have on their system because we don't need it. And so whatever we're dealing with for the hospital client, that that data would be held on our system and sort of, you know. Easy to take. So it's sort of invites bad actors to focus on law firms and law firms are a growing target. And, you know, read the news any day and you'll see there are more and more cyber. Issues developing with law firms. Covid, of course, changed everything, and it really changed the practice of law in a way that I think traditional technology just didn't. Pre-covid, 80% of attorneys were practicing in a traditional office. Only 6% were at home, and of that 6%, 1 in 5 of them, 22% were solo attorneys. So before Covid, you know, working remotely, working from home was really something that was was much more of a solo practitioner. Small firm. Um, um, normal. After Covid, you know, now, in the new normal. 43% of solos are using a home office. The the shift from, you know, 6% of all lawyers to almost half of solo practitioners working remotely really illustrates the the great shift. And looking at the continuing numbers, small firms from 2 to 9 lawyers, 19% are working remotely from home, 10 to 50 lawyer firms, about a third are working remotely from home, and then 100 plus lawyers firms, you know, large firms with over 100 lawyers, such as my firm, we have about 400 lawyers. Almost half of the attorneys are working remotely, and that's up from pre-COVID. It was 3% of of large law firm practice was remotely. So you know, things have definitely changed as as we all know. But looking at the statistics, it really is impressive to see how embraced, whether by choice or by reality remote work has become. And and I think, you know, safe to say at this point remote work is here to stay. And we will probably see more and more of it, whether it's a hybrid arrangement or completely remote, it doesn't really matter whether you're in office at 100%. You know, as I said, if everybody is sitting in the same room divided by cubicles versus working from all over the globe, you're all working on a system. And we'll talk about the specific what the ABA suggests for that system. But, you know, the vulnerabilities, the cyber vulnerabilities are still there. And with that, the risk and ethical issues are still there, regardless of how remote, how hybrid your setup actually is. So cyber incidents are growing. The statistics are, I think, extremely underreported. And my experience and this is just anecdotal, but in my experience, law firms are extremely. Hesitant to report cyber incidents. So the ABA has conducted a survey, and 1 in 4 law firms in the US has experienced a cyber incident. 1 in 4 law firms in the US doesn't know if they've experienced a cyber incident, and that means half the firms have said that they have not experienced a cyber incident. Now, how you would possibly know if you fell into the I have not had a cyber incident or the I don't know if I had a cyber incident is impossible. If you if you don't know you had a cyber incident, you can't safely say nope, I haven't had one. It seems from my my viewing of the statistics is that if you don't think you've had a cyber incident yet, that means you probably just don't know you've had a cyber incident. Law firms are, as I said, the low hanging fruit and are a constant target of bad actors because of that, because of the valuable information available. But even taking these these statistics at face value, 1 in 4 law firms have experienced a cyber incident and that number is only growing. So the risk is sort of morphing and as cyber becomes more and more pervasive, as cyber encapsulates more of the practice of law and our lives in general, that number is just going to go up and it's going to go up dramatically. So my method, the method, as I said, is based on education, understanding your risk systems. Picking the areas of risk where you can get the biggest return on investment. Keeping the system simple so they're actually used is absolutely key. Plans really focusing on okay, we've identified this area of risk say conflicts of interest. We've come up with a conflict system. We've come up with redundancy. So there's a second level of conflict checks. What do we do. What's our plan if and when things go wrong and coming up with scenarios they don't have to be you know, you don't have to write a book about your response, but having a response to anticipated risks. Now, I'll admit, I didn't have a plan for a global pandemic. Didn't see that one coming. And I don't think really any law firm did. Some law firms probably had more natural disaster plans, especially those that operate in areas where natural disasters are very common and that might have been more easily adapted to Covid coming along. But, you know, now everyone should have a plan for what happens if we have another lockdown, if there is another global pandemic. So, you know, obviously you can't envision every horror scenario happening. But going back to the education point, you're really trying to identify your key areas of risk and the key areas of risk. You can do something about the practice of law is fraught with risk for for solo and small firms especially, you're dealing with all of these small business risks that are out there. And the reality is that most small businesses and most small law firms fail. Large law firms are dealing with the same risks that large business enterprises have to deal with, and those are ever increasing risk. So you can't plan for everything, but you really want to use your education step to come up with. Your major areas of risk. Your systems to figure out how you can score the most points and mitigating, transferring, reducing that risk. And then your plans for saying okay, so if X risk happens who do we call. What do we do. What's step one. And we'll talk about that a bit more. But you know planning out what you're going to do. Going back to your plans, practicing your plans and updating your plans is absolutely key. And then finally, teams utilizing your people top to bottom, front office to back office and incorporating them into your system is absolutely essential. I think law firms tend to take a narrow view of teams, and I like to look at teams from the broadest possible perspective. So, you know, incorporate your clients where you can incorporate vendors, any vendor you have a relationship with, regardless of whether they're providing your cyber, whether they're a litigation support vendor, whether it's your custodial staff, if you have vendors, if you have a contract with someone to provide service to support your law firm in any way, you should really think about, how can I use this person to to reduce or this company to reduce the risk to my law firm? What do they do for us? What do we give them, and how can we make this a better and safer relationship? And then also, I think a really underutilized resource for law firms is their insurers. And whether it's your professional liability insurer or your cyber insurer or your commercial insurer, whatever insurance you have, again, it should be the same approach as with the vendors thinking, you know, how can my lawyers, professional liability insurer, help us be provide better and safer practice? And the reality is your insurer is going to understand your risks better than you, better than me. I mean, I do this stuff for a living, but. I don't see the volume. Of claims that your legal malpractice insurer sees. That's all they do. And so they're going to have experience and understanding that's invaluable. So you want to bring them into the conversation. They're also again regardless of what kind of insurance they're providing, they have a vested interest in reducing your risk. So they are extremely willing partners. Whereas your vendors may not want to be so involved in your risk management plan because they may see it as expanding their risk. And in many ways, it will. Where your clients may be hesitant because your clients are paying you essentially to to eat their risk. Your insurers will likely be willing participants in your team and will embrace the opportunity to work with you on on making your law firm safer. So diving in, we're not going to go too deep into the into the method. But I think the important thing to remember with my method is that it is not rocket science. It's not proprietary in any way. It's extremely simple. And I think it's important to keep it simple and to adjust it to your practice, to your firm, to your risk appetite. So education as the first step, I mean, you know, using clays in a in a thoughtful manner and rather than cramming in clays to meet the jurisdictional requirements, as so many lawyers do, as I have done in the past, really planning out, you know, from your next reporting period, making the most of your clays. And I think and this is just one example of how you can use education to sort of set the table to dealing with this risk, but using clays for your people. So requiring your lawyers to come up with a plan requiring clays for non-lawyer staff and not only requiring them, but providing them, really getting that training in for non-lawyer staff is invaluable. But, you know, take whatever your jurisdiction requires and sort of split it up and say, all right, and I'm just throwing out percentages here, but say half the credits should be substantive subject matter. So if you do real estate, half the credits that your people are taking should be real estate based clays to make them better at that practice, many jurisdictions require a certain number of credits of ethics. You know, bump that up. Whatever your jurisdiction requires is probably not enough. I like to say a quarter of your credits should be ethics, and then the remaining quarter you can say, you know, go with subject matter adjacent stuff. So if you're a real estate firm, then, you know, maybe bankruptcy comes up a lot. Maybe landlord tenant issues come up a lot, things like that. Those would be adjacent to your practice. You could also have some fun ones. I give a class on my Cousin Vinny teaching legal ethics. And, you know, we go through the movie My Cousin Vinny and we talk about the ABA model rules. You know, fun in the context is, you know, different than maybe fun outside of the context. But I think it's good to have a few courses that aren't, you know, so dry and so subject matter based, but having a purposeful approach to class for your entire firm and building it into your team, offering it to clients, um, you know, they might not need CLE credit, but they still might be interested in a webinar about the real estate changes in your jurisdiction or something like that. So that's one approach using education. It helps you sort of come up with a game plan. It folds into supporting your team. And really anytime you're going through the education step, you're just trying to get a handle on your risk, whatever it is, and and really exploring where you can get the biggest return on your investment, your systems. Really keeping it simple is the approach. And that's why I think using the example, it addresses the risk of your people not being certified and the complications that come with missing the clear requirements. The system there is so simple. It's half your class are X, a quarter are Y, and a quarter are z. And and then having some lawyer at your firm designated to keep everybody on task. Your plans again in the scenario, just what happens if someone misses the deadline? How are we going to respond? Who do we call first and then your teams? As I said, kind of bringing your clients in, inviting them to the webinars, your non-lawyer staff. Ask your insurers to to provide a CLE or to do a CLE jointly with you. All right. Action. So what's a lawyer supposed to do? The ABA Tech Report 2002 provides three steps for protecting your firm. Step one draft an acceptable use policy to adopt cloud based technology and three develop an incident response plan. I think these are three great steps. We'll talk about some other ideas too, but I think these are three great steps to employ. Um, and, you know, as you consider these steps, work through the method education systems, plans and teams and think about how you can customize these three steps to your practice and your firm. Step one the acceptable use policy. This is in the handouts. My sort of outline. It doesn't have to be extremely robust, but the ABA does suggest an acceptable use policy. It's it's good for all of your tech, not just your cyber risk, but really outlining. Even if you're a small solo firm, putting pen to paper and outlining what what is allowed and what isn't allowed is going to be absolutely key. The rules. Here are the supervisory rules 5.1, 5.2, 5.3. And having the acceptable use policy in writing is going to protect your law firm. Quick scenario. There was recently in New York, a paralegal that posted a big win on Facebook and did not have the firm's approval to do so. She had worked on the case. They had a great result for the client. The Facebook post ended up being problematic. There was a confidentiality issue and the law firm tried to blame this rogue paralegal, which okay, the paralegal was rogue, but that doesn't help the law firm at all. All of the ethical obligations, all of the risk, all of the problems that stemmed from this person's post came back on the law firm. And while an acceptable use policy may not have stopped the person from posting on on Facebook, although it may have, it certainly would have helped the law firm in explaining that this person did outside of of what was allowed. So work through the method and think about how you can customize an acceptable use policy for your firm. I recommend that something you start on today if you don't have and if you do have one update it updated maybe to include artificial artificial intelligence or some other development that's happened since the last time you put your acceptable use policy into play. The ABA recommends cloud based technology. The use of cloud based technology is up 20% since before Covid, which is great. There are pros and cons, and it's something you want to really work with your vendor, your cybersecurity vendor to analyze. And, you know, again, talk to your insurer about it as well. There are real advantages to recovering a data that's lost security. There's also cons in the security department. You know there's no perfect system. The big thing I think that's really valuable for using cloud based technology for law firms is the scalability of it. It can grow with your firm. And whether you're a solo, whether you're a small firm, whether you're a huge firm, it really does allow you to grow in a way that traditional technology just can't. The rules here. Rule 1.6 and 1.15, as we talked about guarding client data, is is the cyber risk that the rules come into play. And cloud based technology really is excellent for meeting those obligations and protecting your client data. It also is really valuable in expediting litigation. Again, maintaining access to your systems even if there's an incident. And the other applications that can be used using the cloud really, really can be helpful with 3.2 and by extension, not just in the litigation context but in the in the transactional non litigation context as well. A quick scenario. I had a law firm client that had a cyber issue. Here's our generic hacker with dollar signs in his eyes always wearing a hoodie. You know there was a cyber incident. The firm was hacked. There was a ransom demanded. And while they had a good plan and they had good insurance and they were working through the ransom, but it took about a week and a half. And during that time it was a traditional system. It was not cloud based, and the firm was unable to access their information at all. Had they been in a cloud system, they would have been able to more or less seamlessly continue operations while they resolved this ransom issue. So the cloud based technology really does have some advantages that should be explored. And again, you want to walk through the method with your vendors, with your partners, your whole team to figure out if that's right for your firm and at what level it's right for your firm. And then finally, an incident response plan. I have one and there's a picture of it. You reach out if you'd like to discuss or you'd like a copy of the incident response plan. But the Cybersecurity and Infrastructure Security Agency, which is a federal government agency, provides a cyber response playbook. It's pretty easy to extend that into using use for law firms, and I recommend you check that out. The rules 1.1, 1.4 and 1.15 really come in the incident response plan. But one quarter of firms have already experienced a cyber incident. That number is probably low. If you haven't experienced one yet, you will and you will soon. So come up with a plan. Today the scenario. There was a law firm client of mine who had a cyber incident. It took them two days to contact me. Then we contacted their cyber carrier and their LTL carrier. Then we were able to get their IT people on the on the line and sort of try to figure out what happened. It cost them several days they went to me first. I probably shouldn't be the first call, but it's better than nothing. You know, knowing what your steps are going to be beforehand can save you precious hours and days. And in the cyber response world, that's absolutely key. And again, you need to customize your plan. You can't just take the CSA plan or even my plan and slap it on your law firm. You need to customize it by using the method and walking through what makes sense for you and your practice. Some other considerations in the cyber risk world insurance. If you don't have cyber insurance, explore it. It can be extremely expensive. Look into to cyber insurance that may attach from your legal malpractice insurer. Vendors seek indemnification from your vendors, not just your IT and cyber vendors, but all your vendors. If they're using your system in any way, you should try to obtain indemnification your clients counsel, outside counsel and pen testing and really seeing seeing if your systems and your defenses actually can hold up to a dedicated bad actor. All right, quickly. Some resources. The lawyers professional liability hotline. It's not actually a hotline. And it's not actually a hotline anymore at all. It wasn't particularly hot before. It was a phone number. You left a message. Now it's actually email based. But, you know, it's a good, easy, free resource. The ABA Legal Technology Resource Center provides some some really great articles and advice for state and local bar associations. Will all have cyber based resources. Your law firm, your IT people, your firm's general counsel, and your insurers definitely should be used. Reach out to your attorney, friends, judges, law professors, mentors, and of course, me. My contact information will be on the next slide. But I love talking about this stuff and represent lawyers and law firms in the cyber world and beyond, so please feel free to reach out at any point. Thank you so much for joining me. Here's all my contact info. I'm real big on LinkedIn, so check me out on LinkedIn and connect there. But you know, I'm also on Twitter, Instagram and threads and one last time prior results do not guarantee a future or similar outcome. No attorney client relationship is formed and this material does not constitute and should not be considered legal advice. Thank you so much for joining me.