May a Nebraska public defender store client information on a server shared with the county attorney, sheriff, and other county offices?

Plain-English summary

A public defender's office used a server shared with the county attorney, sheriff, and other county offices. Its client database included names, addresses, and case information, and county information-technology personnel had access to the database.

Rule 1.6 prohibited disclosure of information relating to representation unless an exception applied. The committee compared the shared server to office-sharing arrangements in which separate lawyers used common staff, storage, computers, and other resources.

Earlier Nebraska opinions required no common access to paper or computerized case data, secure systems limited to the lawyer and staff, warnings to common employees, and other precautions. The committee also noted that access by an adverse government office could raise conflict and constitutional right-to-counsel concerns in criminal representation.

The public defender's primary responsibility was to ensure that only office personnel could access client information. Any linked or shared component required reasonable and necessary precautions preventing access by other county offices.

If the public defender could not be satisfied that confidentiality was secure, the opinion identified two alternatives: maintain a computer system separate from the other county offices or stop storing client information on the shared system.

In practice

The opinion focuses on effective access control, not merely ownership of the hardware. A shared server is permissible only when the public defender can prevent other offices and personnel from reaching client data.

Common questions

Q: Must a public defender always operate a physically separate server?

A: No. The opinion permits a shared system if effective safeguards restrict client information to public-defender personnel.

Q: May county IT staff have access to the client database?

A: The conclusion says public-defender employees must be the only individuals with access to client information.

Q: What if confidentiality cannot be secured on the shared system?

A: The office must use a separate system or discontinue storing client information there.

Q: Why did the opinion discuss conflicts as well as confidentiality?

A: Access by the county attorney's office could expose defense information and affect conflict-free criminal representation.

Background and rules framework

Rule 1.6 governed confidentiality. The committee relied on earlier Nebraska office-sharing opinions that required separate access to case files and computer data and treated shared-resource safeguards as necessary to protect client information.

Citations and references

Nebraska Rules of Professional Conduct:

• Neb. R. Prof. C. § 3-501.6

Cases:

• Wood v. Georgia, 450 U.S. 261, 271 (1981)

Other opinions cited:

• Nebraska Formal Opinions 89-2 and 02-2
• Montana Ethics Opinion 960924 (1996)
• Colorado Ethics Opinion 89
• Indiana Ethics Opinion 8 of 1985

See also

• Nebraska Ethics Op. 19-01: Cloud storage of client information
• Nebraska Ethics Op. 17-01: Electronic closed-client files

Source

• Landing page: Nebraska lawyer ethics opinions archive
• Original PDF: Nebraska Ethics Advisory Opinion 06-05

Original opinion text

Reproduced from the official source for research purposes. The linked source is authoritative.

Nebraska Ethics Advisory Opinion for Lawyers No. 06-5

ETHICAL ISSUES

I. WHETHER THERE ARE ANY ETHICAL ISSUES INVOLVED IN SHARING A COMPUTER SERVER WITH VARIOUS COUNTY OFFICES.

II. WHETHER A PUBLIC DEFENDER IS REQUIRED TO USE ITS OWN COMPUTER SERVER.

STATEMENT OF FACTS

A public defender’s office shares a computer server with other county offices, such as the county sheriff’s office and the county attorney, among others. The public defender maintains a database for clients which database is stored in a program within the server. The database contains information regarding the names of clients, addresses, and some case information. The county employs an IT director and various employees who have access to the client database maintained by the public defender.

NEBRASKA RULES OF PROFESSIONAL CONDUCT

RULE 1.6 CONFIDENTIALITY OF INFORMATION
(a) A lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation or the disclosure is permitted by paragraph (b). (b) A lawyer may reveal information relating to the representation of a client to the extent the lawyer reasonably believes necessary: (1) to prevent the client from committing a crime or to prevent reasonably certain death or substantial bodily harm; (2) to secure legal advice about the lawyer's compliance with these Rules; (3) to establish a claim or defense on behalf of the lawyer in a controversy between the lawyer and the client, to establish a defense to a criminal charge or civil claim against the lawyer based upon conduct in which the client was involved or to respond to allegations in any proceeding concerning the lawyer's representation of the client; or (4) to comply with other law or a court order.

OTHER SOURCES

There are no Nebraska Advisory Opinions that the Committee could locate which were directly on point. However, the Advisory Committee believes that the present situation can be analogized to opinions in which ethical considerations were considered in “office sharing” arrangements. The Advisory Committee has dealt with office sharing arrangements in past opinions. Though the opinions were issued based on the Nebraska Code of Professional Responsibility instead of the recently enacted Nebraska Rules of Professional Conduct, and involved true office sharing arrangements, they are still useful in evaluating the present situation.

The past opinions have addressed the issue of individual attorneys sharing office space and resources, such as staff, conference rooms, reception areas, copiers, telephones, and computer systems. Past opinions have noted the potential ethical issues of confidentiality, conflicts of interest, and the appearance of impropriety in such situations. It is apparent that on occasion the imputation of conflicts can occur even when attorneys have no intention of being associated with each other, but merely share resources and are not officially affiliated with each other. It is not known whether the county attorney’s office has access to the public defender’s client files saved on the server, but this opinion includes a brief discussion of conflicts of interest and imputation of conflicts in the event the county attorney does have access to those same client files which are stored on a common server.

DISCUSSION

This discussion should be prefaced with the consideration that criminal defendants are guaranteed the right to counsel under the Sixth Amendment of the United States Constitution. See Montana Ethics Opinion 960924 (1996). This right to counsel for criminal defendants includes the right to be represented by an attorney who is free of any possible conflicts of interest. Id. (citing Wood v. Georgia, 450 U.S. 261, 271 (1981)). While a high level of vigilance is required in the representation of any client, there are these additional constitutional issues to consider in the representation of criminal clients.

The first issue is that of the potential for confidential information from criminal files being viewed by individuals outside the public defender’s office. In one 1989 Nebraska Advisory Opinion, individual attorneys maintained private offices, but shared a receptionist, secretaries, a library, a computer system, and conference rooms. The computer system was designed, to the extent possible, to ensure that each attorney would have access only to his own material. As the Advisory Committee noted at the time, the issue was whether the sharing of various resources constituted a sharing of offices by the attorneys, thus precluding one attorney from accepting a case which the other cannot ethically accept. While this opinion is not entirely on point with the instant situation, it is instructive. The opinion specifically sets forth requirements for a situation in which two separate attorneys share office space and resources, without invoking the possibility for conflicts. The opinion states that the attorneys may represent adverse parties so long as the following precautions were met:

(1) There shall be no common access to any case files;
(2) There shall be no common access to any computerized data relating to the case; (3) No secretary shall be allowed to work on the case for both parties; (4) All common employees shall be informed of the adverse representation and the extreme sensitivity to the maintenance of confidentiality; and (5) Each client shall give his consent to the adverse representation after full disclosure of all facts relating to the common practice areas.

Formal Opinion 89-2 (March 31, 1989). The Advisory Committee based these precautions upon DR 4-101(D) under the Nebraska Code of Professional Responsibility, which provided that a lawyer shall exercise reasonable care to prevent the disclosure of confidences or secrets of the clients.

A 2002 Advisory Opinion addressed this same issue, with the Committee noting that the precautions set forth in Formal Opinion 89-2 were still valid. The Committee concluded that while there was no conflict of interest under the facts of that situation, any sharing of computer files or paper files puts client confidences at risk. The Committee cited to an article in the ABA/BNA Lawyer’s Manual on Professional Conduct, emphasizing the necessity of physically organizing an office so as to avoid putting client confidences at risk. Specifically:

Access to Files: The office-sharing lawyers cannot have access to each other’s files.

Computers: The lawyers must avoid sharing computers and any sensitive information often located in the computer system.

Formal Opinion 02-2 (citing the ABA/BNA Lawyer’s Manual on Professional Conduct 91:605). The Advisory Committee also clarified its position on shared file and computer systems. It stated that: 1. The attorney shall keep a secure file system, only accessible to the attorney and the attorney’s staff.

2. The attorney shall keep a secure computer system, only accessible to the attorney and the
   attorney’s staff.

Formal Opinion 02-2.

Other states have recognized similar principles in maintaining client confidentiality in situations in which attorneys do not maintain sole access to their computer systems. In a Colorado opinion, the Colorado Ethics Committee noted that:

[o]ffice sharing lawyers should be particularly attentive when lawyers or their employees have access to each other’s file storage and/or have shared…computer and telephone equipment…. The more shared equipment…the greater potential for inadvertent disclosure of client confidences and secrets and…such disclosure will be harmful to the client.

Colorado Ethics Opinion 89 (Adopted September 21, 1991; amended April 18, 1992). The opinion further states:

[t]o ensure confidentiality, the office sharing lawyer may need to take certain measures in addition to restricting access to files, such as restricting access between the telephone systems of the separate practices[,]… using security devices to restrict access to computers[,]… and informing clients of the space sharing arrangement and of measures undertaken to avoid any compromise of confidentiality.

Id. (citing Indiana Ethics Opinion 8 of 1985 (undated)).

The issue of potential conflicts in similar situations is far from being uniformly settled from state to state. While all of the various state ethics opinions have recognized that there are potential confidentiality issues, the state opinions have ranged from “flatly prohibitive” to “generally permissive.” Nebraska Advisory Opinion 89-2. In Formal Opinion 89-2, this Committee noted that discussions generally referred to two Canons under the Code of Professional Responsibility, Canon 4, the preservation of confidences and secrets of clients, and Canon 9, the avoidance of the appearance of professional impropriety. Canon 4 is now codified in newly adopted Rule 1.6 relating to the confidentiality of client information.

CONCLUSION

The Nebraska Advisory Committee offers the following guidance in response to the stated ethical concerns:

The employees of the public defender's office must be the only individuals who have access to client information, including that which is stored on the computer system. If any component of the computer system is linked or somehow shared by other county offices, the public defender must take whatever reasonable and necessary precautions there are to ensure that this information cannot be accessed by the other offices. This is the public defender’s primary responsibility in this scenario. If the public defender is not satisfied that client confidentiality can be secured, then the ethical alternative is to either maintain a separate computer system from the other county offices or discontinue storing client information on the shared system. Nebraska Ethics Advisory Opinion for Lawyers No. 06-5