Cybersecurity, data protection, and a lawyer’s duty of competence.

Given some of the looks and comments that I receive when broaching this topic at CLEs, I’m not certain that it’s an appropriate subject for a day typically reserved for “wellness” posts.  However, as I emerge from a summer blogging hiatus fueled by a disinterest in blogging, I’m less worried about sticking to the traditional schedule than I am in finding something – anything – to write about.  And today, “cybersecurity” not only presents itself as a topic, it does so in a manner that reinforces a notion that lies near and dear to this blog’s heart: competence includes tech competence.

Cybersecurity White Images – Browse 16,974 Stock Photos, Vectors, and Video  | Adobe Stock

To recap, V.R.Pr.C. 1.1 requires a lawyer to provide clients with competent representation. Under the heading “Maintaining Competence,” Comment [8] states:

  • “To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education, and comply with all continuing legal education requirements to which the lawyer is subject.” (emphasis added).

The bolded language refers to “tech competence” and was added in 2018.  At the time, and as reported by LawSites, its addition made Vermont the 32nd state to adopt a duty of technology competence. The italicized language has existed since the rule was first promulgated in 1999.  I emphasized it to make clear that continuing legal education is a critical component of maintaining competence.

Which brings me to today’s point.

As reported by LawSites and the ABA Journal, New York recently became the first state to mandate CLE in cybersecurity and data privacy & protection.  From the LawSites post:

  • “Under the new requirement, all attorneys must complete one hour of training every two years in either the ethical obligations surrounding cybersecurity, privacy and data protection, or in the technological and practice-related aspects of protecting data and client communications. Only two other U.S. states mandate technology training as part of a lawyer’s continuing education requirement, Florida and North Carolina. While those states’ CLE requirements allow for training in a range of technology topics, which can include cybersecurity, New York’s is the first to focus its requirement on these topics.”

New York’s new rule is here. The ABA Journal notes that the rule allows lawyers to count up to 3 hours of cybersecurity CLE towards their required 4 hours of ethics CLE.  The ABA post goes on to state:

  • “The New York State Supreme Court’s Appellate Division adopted the cybersecurity CLE requirement based on a recommendation from the New York State Bar Association’s Committee on Technology and the Legal Profession. The NYSBA approved the committee reportin June 2020, according to the bar’s news center.”

This is important. The impetus for the new CLE requirement was not my counterpart in New York.  It was the bar association.  In other words, this isn’t bar counsel crying wolf over competence, tech competence, and the duty to take reasonable precautions to safeguard client data.

Am I saying that a breach is an ethics violation?

NO.

I, AM. NOT.

Again, a lawyer’s duty is to take reasonable precautions to safeguard client data. As I’ve always recognized, the fact that a lawyer or firm is breached or hacked does not necessarily mean that the precautions in place weren’t reasonable. Indeed, in yesteryear, the fact that a client’s paper documents ended up in unauthorized hands didn’t necessarily mean that the lawyer or firm charged with safeguarding those documents failed to take reasonable precautions.  For instance, it likely wouldn’t have been an ethics violation for a firm to fall victim to enterprising criminals who employed thermite to breach a secure cabinet within a secure room within a secure office within a secure building [i]

What I’m saying is this.

A lawyer’s professional obligations include providing clients with competent representation.  CLE is a way to maintain competence.  There’s now a jurisdiction that requires 1 hour of CLE in cybersecurity, privacy, and data protection.  That same jurisdiction allows lawyers to count up to 3 hours of cybersecurity CLE toward their required 4 hours of ethics CLE. In sum, no more eye-rolling at CLEs when I discuss cybersecurity and data protection.  The topic clearly goes to the duty of competence.

As always, let’s be careful out there.

******

[i] I’m obsessed with Better Call Saul.  This week’s series finale has left me thinking of ways to pay homage to the show.  My thermite analogy reminded me not of Better Call Saul, but of its predecessor, Breaking Bad. Specifically, the scenes in the Season 1 finale when Walt uses the innards of an old Etch-A-Sketch to make thermite that he and Jesse use to break into a warehouse to steal methylamine. In fact, the scenes themselves probably subconsciously caused me to use “thermite” in the analogy.

Five for Friday #251

Welcome to a glorious Friday morning and the 251st legal ethics quiz!

I botched it this week.  This would’ve been the perfect intro to write about the iconic 251 Club of Vermont.  Alas, it wasn’t until about 8:30 this morning that I realized I should’ve made this post about a member of Vermont’s legal community who’d visited all 251 cities and towns.  In other words, I completely failed to comply with my duty of diligence.  So, for now, if you or someone you know is a verified 251er, let me know and I’ll interview you for a Wellness Wednesday post.

Instead, today, I’ll leave you with this.

A few days ago, I bumped into two of Papa’s daughters, Mary and Helen-Anne.  We attended an event at which my mom won an award. (Yay Mom!)  Helen-Anne is my mom’s youngest sister and an avid fan of this blog.  What can I say? Good taste runs in the family.

Anyhow, when we saw each other, I was wearing this tie:

IMG_6783

Aunt Mary commented on it first.  Then, AHAB (their maiden name is “Bonneau’ so my brother and I call Aunt Helen-Anne “AHAB”) grabbed my tie and asked how many diamonds are on it.  At first, I was baffled and thought it was yet another example of behavior by his children that my brother and I believe must’ve left Papa perpetually shaking his head in exasperation.  AHAB continued with something like “maybe the total is a number that you could TIE to the quiz number! Get it??? Tie to the quiz number??”

I confess. I must give credit where credit is due.

But first, and backing up a bit, when I was 6 and my brother 4, our parents took us to Virginia Beach for vacation.  I don’t remember whether AHAB was a high school senior or in her first year at UVM, but she tagged along.  One day, while tasked with babysitting us in the hotel, AHAB lost my brother. Yes, lost him.  She let him get on an elevator and then literally stood watching as the doors shut and it went wherever it went.  For all I know, the kid we found and brought back to Vermont isn’t really Patrick.

Many years later, AHAB lived just outside Boston during the 3 semesters that I attended Boston College.  I often stopped by to visit, serving as a much more responsible babysitter for my cousins than their mother had been for Patrick.  My thanks?  One night, AHAB tried to poison me with Bailey’s Irish Cream!

Now, returning to the tie: I’ve not counted the diamonds. Maybe there are about 251, or maybe there are 51 or 551.  Who knows? And, indeed, the total might be the perfect tie” to a future quiz number.  In fact, I’ve used far looser “ties.”

Therefore, AHAB, thank you!  Your clever and witty remark has earned you full and final forgiveness for the aforementioned (and all your other) transgressions!

Onto the quiz!

Rules

  •  Open book, open search engine, text-a-friend.
  • Exception:  Question 5.  We try to play that one honest.
  • Unless stated otherwise, the Vermont Rules of Professional Conduct apply
  • Team entries welcome, creative team names even more welcome.
  • E-mail answers to michael.kennedy@vermont.gov
  • I’ll post the answers & Honor Roll on Monday
  • Please consider sharing the quiz with friends & colleagues
  • Share on social media.  Hashtag it – #fiveforfriday

Question 1

Hint:  The 7 Cs of Legal Ethics.

Lawyer called me with an inquiry.  I listened, then responded: “Maybe.  Does it arise from your relationship with a current or former client? Or does it arise from a personal interest of yours?

In my response, what is “it?”

 Question 2

 By rule, a lawyer who has direct supervisory authority over a nonlawyer ___________:

  • A.  will be sanctioned if the nonlawyer does something that would violate the rules if done by the lawyer.
  • B.  cannot be held professionally liable for the nonlawyer’s misconduct.
  • C.  shall make reasonable efforts to ensure that the person’s conduct is compatible with the lawyer’s professional obligations.
  • D.  None of the above.  While there is a rule that applies to a lawyer’s supervision of other lawyers, there is no rule that applies to a lawyer’s supervision of nonlawyers.

Question 3

There’s a rule that prohibits a lawyer from making false or misleading communications about the lawyer or the lawyer’s services.

Does the rule prohibit truthful statements that are misleading?

Question 4

What do the Rules of Professional Conduct define as “the agreement by a person to a proposed course of conduct after the lawyer has communicated adequate information and explanation about the material risks of and reasonably available alternatives to the proposed course of conduct.”

Question 5

Season 6 of Better Call Saul debuts on Monday. I can’t wait. It’s one of my favorite shows of all-time and I am so looking forward to the final season.

For those who don’t know, the lead character, “Saul Goodman,” is an attorney who often finds himself on the wrong side of the Rules of Professional Conduct. In addition, in both Better Call Saul and Breaking Bad, Saul often mentions (complains of) his bad knees.

According to the show’s writers, Saul’s needs are so bad because of antics he engaged in well before changing his name to Saul Goodman.  Indeed, those antics resulted in a nickname associated with his real name.  (He didn’t become “Saul Goodman” until the last episode of Season 4).

What’s Saul Goodman’s real name?

And, bonus, what’s the antic-driven nickname that explains his bad knees?

the-quiz

Guidance to Avoid Assisting Clients to Commit Crimes.

Rule 1.2(d) of the Vermont Rules of Professional Conduct states:

  • “A lawyer shall not counsel a client to engage, or assist a client, in conduct that the lawyer knows is criminal or fraudulent, but a lawyer may discuss the legal consequences of any proposed course of conduct with a client and may counsel or assist a client to make a good faith effort to determine the validity, scope, meaning or application of the law.”

Vermont’s 1.2(d) mirrors ABA Model Rule 1.2(d).  Yesterday, and as reported by the ABA Journal, the ABA’s Standing Committee on Ethics and Professional Responsibility (the Committee) issued Formal Opinion 491 (the Opinion). The opinion provides guidance on complying with Rule 1.2(d).

At first glance, one might conclude that the opinion is of little value here. After all, the introduction’s opening sentence refers to “international counter-terrorism enforcement and efforts to combat money-laundering,” phrases more likely to evoke the plotlines of the pandemic’s most-streamed shows than images of a Vermont practitioner.  Still, over the years, I’ve had a decent number of inquiries on the rule. Further, to the extent it interprets the rule, the opinion provides valuable guidance to any lawyer whose client might break bad. So, I thought I’d call your attention to the opinion. After all, Vermont has chemistry teachers too.

Here’s a very brief outline.  Essentially, the nutshell’s nutshell.  This post is not a substitute for reading the full opinion.  But likely more fun.

First, it’s okay to believe that your client’s goals, objectives, and transactions are legit. Still, the law is clear: there will be situations in which Rule 1.2(d) requires a lawyer to inquire further.  That is, while the rule prohibits a lawyer from assisting a client in conduct that the lawyer “knows is criminal or fraudulent,” don’t hang your hat on “but I didn’t know for sure!”

Ostrich with Head in Sand Photographic Print at AllPosters.com

(we should allow pictures in legal briefs.  maybe we do. if not, we should.)

Anyhow, as the opinion indicates, facts known to the lawyer might be “so strong” as to require the lawyer to stop, consult with the client about the lawyer’s professional duties, and inquire further.

For one, Rule 1.4(a)(5) requires a lawyer “to consult with a client about any relevant limitation on the lawyer’s conduct when the lawyer knows that the client expects assistance not permitted by the Rules of Professional Conduct.”  For another, Rule 1.16(a)(1) requires withdrawal when continued representation will result in a violation of the rules.

Further, the opinion reminds us that “if facts before the lawyer indicate a high probability that the client seeks to use the lawyer’s services for criminal or fraudulent activity, a lawyer’s conscious, deliberate failure to inquire amounts to knowing assistance of criminal or fraudulent conduct.”

For more, check out the opinion or get in touch. Those of you who represent organizational clients, there are good tips on Page 8 as to your duties when you know that an officer, employee or someone associated with the organization acts, intends to act, or refuses to act in such a way as to violate the law.

Oh, and I’d be remiss not to ask a question that I’ve used at several pub quizzes:

  • Rule 1.2(d) prohibits a lawyer from assisting a client to engage in conduct that the lawyer knows is criminal.  The rule is particularly relevant to Vermont lawyers who advise clients on issues related to a particular industry/product.  What industry/product?

Hint: Rule 1.2(d) draws no distinction between state and federal crimes, and no distinction between crimes that are enforced more vigorously than others.

Answer: the cannabis/marijuana industry.

Schedule I of the Controlled Substances Act continues to make marijuana illegal under federal law.  However, in 2016, the Vermont Supreme Court approved a proposal to add Comment [14] to Rule 1.2(d).  The “new” comment authorizes a lawyer to advise and assist a client on matters that the lawyer reasonably believes are permitted under Vermont’s marijuana statutes, rules, and regulations.  Of course, the lawyer must also advise the client of the potential consequences of the client’s actions under federal law.

In the end, the ABA Opinion includes an important reminder.

  • “A lawyer’s reasonable judgment under the circumstances presented, especially the information known and reasonably available to the lawyer at the time, does not violate the rules. Nor should a lawyer be subject to discipline because a course of action, objectively reasonable at the time chosen, turned out to wrong with hindsight.”

Finally, I don’t know what the rules are in New Mexico. So, I’m not sure whether this qualifies as reasonable judgment under the circumstances:

 

 

Five for Friday #178

Welcome to Friday.

WordPress saves drafts.  I just deleted two that I’d authored, but not posted.

I awoke very early this morning.  Sadly, it wasn’t long after waking that I realized I’d forgotten to buy coffee last night.  Thus, I was stuck with brewing the decaf that I keep on hand for when my dad visits.  I drank it while I drafted the blog posts.  Unlike my coffee, each seemed good in the moment.

The first worked “178” into a blog that referenced Luke Bryan, tonight’s Flynn Theatre performance of a musical that parodies The Office, Major Jon Andre, El Camino (the Breaking Bad movie that dropped today), tomorrow’s Dartmouth v. Yale football game, hot dogs, my mom, a half marathon in Concord, and a high school basketball game that I coached in 2009.

Whoa!  That must be an awesome blog post!

Maybe. But it also included at least one paragraph that was too witty for its own good and another that a psychoanalyst might tell you reflected a passive-aggressive effort to get fired.

The second tied “178” to a description of how it sometimes troubles me that I don’t have the courage to leave this job and try something new.  A thing at which – at least in the comfortable courage of my imagination over a beer in my garage – I courageously excel.

Whoa! What an uplifting post Mike!

With the two posts drafted, I left to shower and contemplate which to publicize.

For the entire shower – which, with my hairline, wasn’t long – something didn’t feel right.  My brain kept saying “don’t post either.” The nagging inner voice reminded me of advice I’ve given to attorneys.

At CLEs, I often urge lawyers to trust their guts.  If it feels like a conflict, it probably is.  If your inner voice is telling you that you should withdraw, you probably should.  Countless ethics inquiries end with a lawyer telling me “I thought that was the answer but needed to hear it from someone else.” Hey lawyers – trust yourselves! You’re usually right!

So, I decided to take my own advice and trust my inner voice.  Back at the kitchen counter, I deleted each of the drafts.

They say some things are better left unsaid.  They’re right.

But enough of this Irish melancholy!

The sun is shining, the foliage is peaking, and it’s not freezing.  That’s a recipe for a fantastic weekend.  I hope you get out to enjoy it!

I plan to.  I’m on the fence about The Office musical.  However, I intend to watch El Camino, get a hot dog with my mom at tomorrow’s Dartmouth-Yale game, and run a half marathon in Concord on Sunday.

And, without a doubt, come next week, I’ll be here.

Thanks for listening.

Onto the quiz.

Rules

  • None.  Open book, open search engine, text/phone/email-a-friend.
  • Exception – but one that is loosely enforced – #5 (“loosely” = “aspirational”)
  • Unless stated otherwise, the Vermont Rules of Professional Conduct apply
  • Team entries welcome, creative team names even more welcome.
  • E-mail answers to michael.kennedy@vermont.gov
  • I’ll post the answers & Honor Roll on Monday
  • Please don’t use the “comment” feature to post your answers
  • Please consider sharing the quiz with friends & colleagues
  • Please consider sharing the quiz on social media.  Hashtag it – #fiveforfriday

Question 1

Which is most accurate?   A lawyer:

  • A.  may have sexual relations with a client.
  • B.  may have sexual relations with a client, but only if the relationship doesn’t cause the lawyer to violate the rules (for instance, by creating a conflict of interest).
  • C.  shall not have sexual relations with a client.
  • D.  shall not have sexual relations with a client unless a consensual sexual relationship existed between them when the client-lawyer relationship commenced.

Question 2

One of the Rules of Professional Conduct requires a lawyer to maintain a system that includes “records documenting timely notice” to clients of receipts and disbursements from trust.  The same rule requires a lawyer to do something else in a “timely” fashion.  What?

  • A.   reconcile a trust account.
  • B.   self-report a trust account overdraft to disciplinary counsel.
  • C.   pay into court funds in which a client & third person claim interests
  • D.  All of the above.

Question 3

Lawyer called with an inquiry.  My response:

  • “Basically, don’t state or imply that you’re disinterested.  Correct any misunderstanding she has about your role.  And if her interests are likely to conflict with your client’s, don’t give her any advice other than the advice to secure counsel.”

Most likely, who is the “she/her” in my response?

  • A.   Another of Lawyer’s clients
  • B.   Lawyer’s former client
  • C.   An unrepresented person with whom Lawyer is dealing on behalf of a client
  • D.  a prospective juror

Question 4

Fill in the blank.

Per Comment [1] to a particular rule:

“_________________   partially true but misleading statements or omissions that are the equivalent of affirmative false statements.”

  • A.    A lawyer does not violate this rule by making . . .
  • B.    Misrepresentations can also occur by . . . .
  • C.    Negotiations necessarily include . . .
  • D.    According to my dad, Lawyers excel at making  . . .

Question 5

In honor of Breaking Bad and the release of El Camino:

Breaking Bad aired for 5 seasons.  The first episode of each season included a “flash forward” scene set in a restaurant.  The restaurant is where Saul Goodman/Jimmy MGill ends up working under an assumed identity after fleeing drug-dealing Neo-Nazi assassins, his law firm, and (presumably) New Mexico’s disciplinary authorities.

In real-life, the restaurant is a massive chain often found in malls and airports.  It specializes in sugary rolls, coffee, and frozen drinks.  My favorite is in the Charlotte (NC) airport.

Name the restaurant.

Image result for el camino movie

Monday Morning Answers

So, in last week’s Five for Friday, I mentioned my friend  Daren, his Catch the Mania an Top Hat trivia events, and his Viva Saloon in Key West.  Daren and I went to high school together.

When I posted on Friday, little did I know that yesterday was Daren’s birthday!  (thank you Facebook).  Yesterday afternoon, my brother and I ran into Daren at The Pour House, official pub of Five for Friday, and were able to celebrate the occasion with him.  Happy Birthday Daren, godfather of this column and my trivia-style ethics seminars.

Now, on to the answers.

Honor Roll

One perfect score this week: Matt Anderson, Pratt Vreeland

Others on the  Honor Roll:

  • Bob Gensburg, Gensburg, Atwell, & Greaves
  • Robert Grundstein
  • Keith Kasper, McCormick, Fitzpatrick, Kasper & Burchard
  • Cassandra LaRae-Perez, Primmer (*special bonus for Question 5)
  • Team Liberty (ACLE of Connecticut)
  • Hal Miller, First American

The Answers

Question 1

Which doesn’t belong?

  • A.  Social Media
  • B.  Safekeeping Property
  • C.  Competence
  • D.  Advertising

Choices B, C, and D are the titles of Rules 1.15, 1.1, and 7.2 of the Rules of Professional Conduct. There is no rule entitled (or that specifically deals with) “social media.”  My outline on legal ethics of social media is HERE.

Question 2

Lawyer represents Landlord.  Lawyer mails notice of eviction to Tenant.

A few days later, Lawyer listens to his voice mail.  After the beep, a voice says:

“Hi. I’m Tenant. My friend told me you handle evictions. I just got an eviction notice and would like some legal advice. Please call me at 802-xxx-xxx.”

Which is most likely under Vermont’s Rules of Professional Conduct?

  • A.  Lawyer must withdraw from representing Landlord.
  • B.   Lawyer must call Tenant back.
  • C.  If Tenant denies receiving the notice of eviction, Lawyer may use the voice mail message.
  • D.  If Tenant denies receiving the notice of eviction, Lawyer may have a conflict.

Maybe the question was poorly phrased.  However, in this instance, Tenant attempted to consult with Lawyer.  Thus, the information conveyed by Tenant is confidential. The best answer here is “D.”  I’m not aware of any scenario, absent informed consent to disclose, in which a lawyer may use against someone information that the person conveyed in a good-faith attempt to secure legal advice.  Here, Tenant is most likely a “prospective client” for the purposes of the Rules of Professional Conduct.  See, Rule 1.18.  Lawyer may represent Landlord, provided that Lawyer did not receive from Tenant information that could be significantly harmful to Tenant. If Tenant claims not to have received the notice, Lawyer cannot disclose the voice mail and, as a result, has a conflict under Rule 1.7 in that Lawyer’s duties to Tenant conflict with Lawyer’s duties to Landlord.

Question 3

Attorney called me with an inquiry.  I listened.  Then, I asked: “did you confirm it in writing and provide your client with a written explanation of what you’d do for her?”

Attorney answered “no.”  To which I replied “Houston, we have a problem.”

What did Attorney call to discuss? (please be specific)

A non-refundable fee.  See, (new) Rule 1.5(f).  Most of you were in the ballpark, indeed with very good seats.  Only Matt, however, was on home plate.

Question 4

Attorney represents Mork.  Mork intends to sue Mindy.

Attorney is married to Lawyer.  Attorney and Lawyer do not work in the same firm.

Mindy hires Lawyer.

Which is most accurate under Vermont’s Rules of Professional Conduct?

  • A.  Attorney and Lawyer do not have conflicts of interest.
  • B.  At a minimum, Mork & Mindy are entitled to be informed that Attorney & Lawyer are married.  See, Rule 1.7, Comment 11.
  • C.  If Attorney withdraws due to the conflict presented by being married to Lawyer, the conflict is imputed to all others in Attorney’s firm.
  • D.  The rules specifically prohibit a lawyer from representing someone in a matter in which an adverse party is represented by a lawyer who is “closely related by blood, marriage, or civil union.”

Question 5

Jimmy received his law degree from the University of American Samoa. His natural instincts as a con artist led him to cross several ethical boundaries while practicing law in  New Mexico.  From filing fraudulent insurance claims, to advertising violations, to assisting drug clients in money laundering schemes.

You might know Jimmy better by another name he uses.  A name he concocted from the phrase “It’s all good, man.”

Name one of the two TV shows on which you might have seen Jimmy.

Jimmy McGill practiced under the name “Saul Goodman” in Breaking Bad and Better Call Saul.  Kudos to Cassandra for knowing that Jimmy’s nickname is “Slippin’ Jimmy,” a name that harkens back to the days where he’d intentionally “slip” and fall in order to make fraudulent claims.