May an Arizona lawyer give clients online access to encrypted electronic files?

Plain-English summary

The proposed system gives clients online access to files through an SSL server, randomly generated folder names and passwords, and separately password-protected PDFs. Opinion 09-04 concludes that these layers appear to be reasonable precautions against unauthorized access under ER 1.6 on the facts presented.

The committee applies its earlier Opinion 05-04: lawyers must take competent and reasonable steps to safeguard electronic client information. It says the lawyer must have online-security competence or consult someone who does before assessing the safeguards.

The opinion also cautions that a system found reasonable in 2009 may become outdated. It calls for periodic review as technology progresses and expressly does not say every measure used in the proposed system is necessary under ER 1.6.

In practice

The opinion evaluates the stated system as a whole under the confidentiality rule. It does not establish SSL, a specific file format, or a particular number of passwords as permanent requirements for every portal.

Common questions

Q: Does the committee approve the proposed online file portal?

A: It says the described encryption and multiple unique passwords appear to meet ER 1.6's reasonable-precaution requirement at the time of the opinion.

Q: Must every portal use all three layers described?

A: No. The committee expressly declines to say all of the proposed measures are necessary.

Q: Does a lawyer need security expertise to assess the portal?

A: Under the opinion's reading of ER 1.1, the lawyer must have competence in online security or consult someone who does.

Background and rules framework

The opinion applies Arizona ER 1.6's confidentiality duty and ER 1.1's competence requirement. It relies on Opinion 05-04's analysis of electronic client files and notes Opinion 07-02 on paperless storage.

Citations and references

Rules of Professional Conduct:

• AZ ER 1.1: competence
• AZ ER 1.6: confidentiality of client information

Other opinions cited:

• Arizona Opinion 05-04: electronic storage and reasonable safeguards
• Arizona Opinion 07-02: electronic storage of client files
• New Jersey Ethics Opinion 701: security assessed against available technology

See also

• AZ Ethics Op. 05-04: Electronic Client File Storage

Source

• Landing page: https://www.azbar.org/for-legal-professionals/ethics/ethics-opinions/?V=Opinions&OpinionId=704
• Official opinion API: https://api.azbar.org/EthicsRules/Opinion/?Id=704

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

FACTS

The inquiring lawyer wants to offer a service to clients that would allow clients online access to view and retrieve client files.  The lawyer designed a multi-level security system in an effort to maintain the confidentiality and security of the files.  First, the client files would be accessible only through a Secure Socket Layer (SSL) server, which encodes documents, making it difficult for third parties to intercept or read them.  Second, the lawyer would assign unique randomly generated alpha-numeric names and passwords to each online client folder.  The folder names contain no information that could identify the client to which it belongs.  The password would not be the same as the client folder name.  Third, all online client files would be converted to Adobe PDF (Portable Document Format) files and protected with another randomly generated unique alpha-numeric password.

QUESTION PRESENTED

May the inquiring lawyer maintain an encrypted online file storage and retrieval system for clients in which all documents are converted to password-protected PDF format and stored in online folders with unique, randomly-generated alpha-numeric names and passwords?
 
APPLICABLE ARIZONA RULES OF PROFESSIONAL CONDUCT (“ER __”)

ER 1.1  Competence

A lawyer shall provide competent representation to a client.  Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.

ER 1.6  Confidentiality of Information

(a)  A lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation or the disclosure is permitted or required by paragraphs (b), (c) or (d) or ER 3.3(a)(3).

. . . .

RELEVANT ARIZONA ETHICS OPINIONS

Ariz. Ethics Ops. 05-04, 07-02

OPINION

This Committee has already determined that electronic storage of client files is permissible as long as lawyers and law firms “take competent and reasonable steps to assure that the client’s confidences are not disclosed to third parties through theft or inadvertence.”  Ethics Op. 05-04.  In that opinion, the Committee analyzed the ethical implications of storing client information electronically on systems accessible through the Internet.  Then, as today, the primarily applicable rule is ER 1.6.  Comment 19 to ER 1.6 states:

A lawyer must act competently to safeguard information relating to the representation of a client against inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client or who are subject to the lawyer’s supervision.

Thus, it is clear “that a lawyer must act in a competent and reasonable manner to assure that the information in the firm’s computer system is not disclosed through inadvertence or unauthorized action.”  Ethics Op. 05-04.  After analyzing the precautions required by courts to safeguard lawyer-client privileged information, we concluded that similar precautions were required for compliance with ER 1.6.  Id.

The “panoply of electronic and other measures … available to assist an attorney in maintaining client confidences” remains similar to those discussed in Ethics Op. 05-04.  In satisfying the duty to take reasonable security precautions, lawyers should consider firewalls, password protection schemes, encryption, anti-virus measures, etc.  Id.  Indeed, these considerations have become more relevant as more law offices and departments convert to “paperless” file storage.  See, e.g., Ethics Op. 07-02.

Other bar associations have recognized that the duty to take reasonable precautions does not require a guarantee that the system will be invulnerable to unauthorized access.  See, e.g., N.J. Ethics Op. 701 (Apr. 10, 2006).  Instead, the lawyer “is required to exercise sound professional judgment on the steps necessary to secure client confidences against foreseeable attempts at unauthorized access.”  Id.  See also 2008 N.C. Formal Ethics Op. 5 (“law firm must enact appropriate measures to ensure that each client only has access to his or her own file [and] that third parties cannot gain access [to] any client file”).

It is also important that lawyers recognize their own competence limitations regarding computer security measures and take the necessary time and energy to become competent or alternatively consult available experts in the field.  The competence requirements of ER 1.1 apply not only to a lawyer’s legal skills, but also generally to “those matters reasonably necessary for the representation.”  Therefore, as a necessary prerequisite to making a determination regarding the reasonableness of online file security precautions, the lawyer must have, or consult someone with, competence in the field of online computer security.

Based on the facts supplied by the inquiring lawyer, the proposed online client file system appears to meet the requirements set forth by ER 1.6 and interpreted in Ethics Op. 05-04. [1] The lawyer has taken the preliminary step of having the files protected by a Secure Socket Layer (SSL) server, which encrypts the files, and also applied several layers of password protection.  The fact that the system also utilizes unique and randomly generated folder names and passwords appears to satisfy the requirement of taking reasonable measures to protect client confidentiality and prevent unauthorized access.  The further measure of converting each document to PDF format and requiring another unique alpha-numeric password to review its contents enhances the security of the proposed system.

However, the Committee also recognizes that technology advances may make certain protective measures obsolete over time.  Therefore, the Committee does not suggest that the protective measures at issue in Ethics Op. 05-04 or in this opinion necessarily satisfy ER 1.6’s requirements indefinitely.  Instead, whether a particular system provides reasonable protective measures must be “informed by the technology reasonably available at the time to secure data against unintentional disclosure.” N.J. Ethics Op. 701.  As technology advances occur, lawyers should periodically review security measures in place to ensure that they still reasonably protect the security and confidentiality of the clients’ documents and information.

CONCLUSION

The inquiring lawyer appears to have satisfied the obligation to take reasonable precautions to protect the security and confidentiality of client documents and information.  The proposed system uses encryption and three layers of unique randomly generated alpha-numeric folder names and passwords.  Although the proposed system appears to constitute a reasonable precaution at this time, competent personnel should conduct periodic reviews to ensure that security precautions in place remain reasonable as technology progresses.

Formal opinions of the Committee on the Rules of Professional Conduct are advisory in nature only and are not binding in any disciplinary or other legal proceedings. This opinion is based on the Ethical Rules in effect on the date the opinion was published. If the rule changes, a different conclusion may be appropriate. © State Bar of Arizona 2009

_______

[1] In so concluding, the Committee does not intend to suggest that all of the measures employed by the inquiring lawyer are necessary to comply with ER 1.6.