Free scan
Book a call

Law Firm Cybersecurity: What Your Ethics Rules Already Require

Law Firm Cybersecurity: What ABA Opinions 477R & 512 Require (Dark Edge Consulting)

Written by

admin

in

Most small and midsize law firms treat cybersecurity as an IT purchase. The ethics rules treat it as a professional duty. That difference matters the day a partner’s mailbox is compromised, a wire is redirected, or a paralegal pastes a client’s deposition into a public AI tool.

You do not need a new regulation to be on the hook. The ABA Model Rules and four formal ethics opinions already describe what “reasonable” looks like. Here is what they say, what they mean for a firm without a full-time security team, and where firms usually fall short.

The two rules that make security your problem

Rule 1.1, competence. Comment 8 says a lawyer should keep abreast of changes in the law and its practice, “including the benefits and risks associated with relevant technology.” Most states have adopted some version of this. Not understanding how your firm stores and sends client information is no longer a defense. It is the gap.

Rule 1.6(c), confidentiality. A lawyer “shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” Comment 18 lists the factors for what is reasonable: the sensitivity of the information, the likelihood of disclosure without more safeguards, the cost of those safeguards, how hard they are to implement, and whether they make your software unworkably hard to use.

Notice what is missing. There is no checklist. The standard is risk-based, which means you have to actually assess your risk to show you met it.

Opinion 477R: securing client communications

ABA Formal Opinion 477R (May 2017) says lawyers generally may use the internet to communicate with clients, as long as they make reasonable efforts to prevent unauthorized access. It also says some matters demand more: special precautions may be required by client agreement, by law, or because the information is highly sensitive.

The opinion lays out a practical process:

  • Understand the nature of the threat.
  • Understand how client information is transmitted and where it is stored.
  • Understand and use reasonable electronic security measures.
  • Decide how each type of communication should be protected.
  • Label confidential client information.
  • Train lawyers and staff.
  • Do due diligence on the vendors that hold your data.

In practice, that list reads like a security program. If your firm cannot show where client files live, who can reach them, and which vendors hold copies, you have not done the first two steps.

Opinion 483: when something goes wrong

ABA Formal Opinion 483 (October 2018) covers obligations after a data breach or cyberattack. Its core points:

  • Lawyers should make reasonable efforts to monitor for breaches. You cannot respond to what you never see.
  • When a breach happens, lawyers must act reasonably and promptly to stop it and limit the damage.
  • Lawyers should determine what happened, including what information was accessed.
  • Lawyers have a duty to inform current clients when a breach involves, or has a substantial likelihood of involving, material client information.

The opinion also points out that having an incident response plan in place before a breach is the best way to meet these duties. State breach notification laws and client contracts may add their own deadlines on top.

Here is the uncomfortable part. Many small firms have no logging that would tell them which files an attacker opened. Without it, “determine what happened” becomes “assume everything was taken,” and that turns a contained incident into a notice to every client.

Opinion 512: generative AI

ABA Formal Opinion 512 (July 2024) addresses generative AI tools. On confidentiality, it says lawyers must evaluate the risk that client information entered into an AI tool will be disclosed to or accessed by others, inside or outside the firm.

It singles out self-learning tools, the ones that may use your inputs to improve future answers. The opinion says that before entering information relating to a representation into a self-learning tool, a lawyer needs the client’s informed consent, and boilerplate in an engagement letter is not enough.

Opinion 512 also reaches supervision. Managing lawyers must set clear policies on permitted AI use, and train lawyers and staff on them. Which means the question is not whether your associates use AI. It is whether you know which tools, under which settings, with which client data.

Where small firms usually fall short

The opinions are reasonable. The gaps we see are not exotic:

  1. No current risk assessment. Without one, it is hard to argue your safeguards were reasonable, because you never measured the risk they answer.
  2. Email without strong sign-in protection. Compromised mailboxes are a common starting point for wire fraud against closing and settlement funds.
  3. Shared or lingering accounts. Departed staff who still have access to the document system or cloud storage.
  4. No monitoring or useful logs. The firm learns about the breach from the bank or the client.
  5. Unknown vendors. Practice management, e-discovery, cloud storage, and AI tools nobody reviewed.
  6. No AI policy. Staff use whatever tool is open in the browser.
  7. No incident response plan. Nobody knows who calls the carrier, who calls the clients, and who preserves the evidence.

None of these require a large budget to fix. They require someone who owns the problem.

What a reasonable program looks like for a small firm

A defensible program for a firm of five to fifty people usually includes:

  • A written risk assessment, updated at least yearly and after major changes.
  • Phishing-resistant multifactor authentication on email, the document system, and remote access.
  • Access reviews, so departed staff and unused accounts are cut off.
  • Patching that starts with vulnerabilities attackers are actively exploiting.
  • Continuous monitoring and alerting, with logs kept long enough to reconstruct an incident.
  • Vendor reviews for anything that stores client information.
  • An AI use policy, with approved tools configured so client data is not used for training.
  • A tested incident response plan that covers Opinion 483 duties and your state’s breach notice law.
  • Short, recurring training for lawyers and staff.

That is the standard a client, a malpractice carrier, or a disciplinary counsel will compare you to after an incident. It is better to meet it beforehand.

How Dark Edge helps law firms

Dark Edge Consulting runs managed security with compliance built in: help desk and ticket resolution, continuous monitoring and alerting, exploit-first patching, zero-trust access, and AI configuration that keeps client data out of training. The evidence your carrier, clients, or auditors ask for is produced as part of the work, not assembled in a panic.

If a firm wants an outside view first, we can assess environments we do not manage. We never audit systems we run. When a firm needs an independent review of a Dark Edge managed environment, an independent auditor performs it, and we make that auditor’s job easier.

Dark Edge is led by Andrew Trainum, CISSP and CCSP, with more than 20 years in security. We do not promise that breaches cannot happen. We do build the program that lets you show you made reasonable efforts, and respond well if something goes wrong.

Book a strategy call

If you are not sure your firm could answer the Opinion 483 questions tomorrow, talk to us. We will tell you plainly where you stand and what to fix first.

Book a strategy call

Sources

More posts