News, Developments and Practical Advice on eDiscovery in the trenches of Litigation

Discovery Advocate

Home | Discovery Advocate

Last month, Edward Snowden provided the press a document describing “<a href="http://www.nytimes.com/2014/02/16/us/document-describes-eavesdropping-on-american-law-firm.html?action=click&amp;contentCollection=U.S.&amp;module=RelatedCoverage&amp;region=Marginalia&amp;pgtype=article">how Australian intelligence conducted surveillance of trade talks between Indonesia and the United States and, in the process, monitored communications between Indonesian officials and an American law firm retained by Indonesia for help with the trade dispute</a>.”

Web-based email service providers may <a href="https://support.google.com/mail/answer/6603?hl=en">use automated processes</a> to review email you send and receive.  This may be done to look for spelling errors and spam.  But it also may be done to target advertising based on the content of the email.

The terms of service of some cloud providers give the provider the right to access the content of material you create or store for purposes ranging from technical support to refining the cloud services they provide.

In this new digital world, is it reasonable to expect that a communication between client and lawyer for the purpose of obtaining legal advice is confidential (and, therefore, privileged)?  The attorney-client privilege faces new tests with the advent of “the cloud” and other digital innovations.  This was one of the topics covered in the <a href="http://www.aceds.org/the-impact-of-digital-age-innovations-on-the-attorney-client-privilege">Association of Certified E-Discovery Specialists</a>’ program, “<a href="http://www.aceds.org/the-impact-of-digital-age-innovations-on-the-attorney-client-privilege">Inviting Scrutiny:  The Impact of Digital Age Innovations on the Attorney-Client Privilege</a>,” in which I participated with U.S. Magistrate <a href="http://law.fordham.edu/adjunct/2440.htm">Judge James Francis</a> (SDNY) and <a href="http://blog.recommind.com/philip-favro">Phil Favro</a> of Recommind.

Is it reasonable to expect that communications made through, or stored with, third-party service providers are confidential for purposes of attorney-client privilege?  The bad news is, “it depends.”  Even worse, to answer the question, you -- or someone smarter than you in the ways of technology -- may have to actually read and understand those pesky third-party “terms of service.”

All lawyers are subject to a duty to maintain the confidentiality of information “relating to the representation of a client” (<a href="http://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information.html">ABA Model Rule 1.6</a>).  Yes – I know – attorney-client privilege is an evidentiary privilege and is not a creature of the rules governing the conduct of lawyers.  But stick with me for a moment, because a number of <a href="http://www.americanbar.org/groups/departments_offices/legal_technology_resources/resources/charts_fyis/cloud-ethics-chart.html">state ethics opinions</a> discuss the ethical duty to “take reasonable precautions to protect the security and confidentiality of client documents and information” where information is stored with a third party, including a third-party cloud provider.  It is likely that a court wrestling with the question of whether a confidentiality expectation was reasonable for an attorney-client communication made through or stored in “the cloud” will look to these decisions for guidance.

That said, the roadmap provided by these opinions suggests that one placing confidential client information in the cloud must understand the security used by the cloud provider or rely on someone with that understanding.  As the <a href="http://ethics.calbar.ca.gov/LinkClick.aspx?fileticket=wmqECiHp7h4%3D&amp;tabid=837">State Bar of California observed</a>:
<blockquote>Many attorneys, as with a large contingent of the general public, do not possess much, if any, technological savvy. Although the Committee does not believe that attorneys must develop a mastery of the security features and deficiencies of each technology available, the duties of confidentiality and competence that attorneys owe to their clients do require a basic understanding of the electronic protections afforded by the technology they use in their practice. If the attorney lacks the necessary competence to assess the security of the technology, he or she must seek additional information or consult with someone who possesses the necessary knowledge, such as an information technology consultant.</blockquote>
Courts might look to the following factors in analyzing whether an expectation of confidentiality was reasonable:
<ul>
	<li>Does the provider acknowledge that you own the information?</li>
	<li>Does the provider’s Terms of Service include the provider’s commitment to confidential handling of the data?</li>
	<li>Can the provider review the content of information stored with the provider?  If so, for what reasons?  It may be one thing for a provider to look at information for the purpose of providing the storage or communication service.  A court may look at it differently if the provider is mining your confidential information for other purposes.</li>
	<li>Is the information so sensitive that it should not be stored with a third party at all (or without additional security steps like encryption)?</li>
	<li>Where is the information stored?  If outside the U.S., is it a country whose laws concerning data ownership and privacy are at least as protective as the U.S.?</li>
	<li>What are the legal ramifications of third-party interception of the information?  Actions are more likely to be considered reasonable when interception or disclosure is illegal.</li>
	<li>Does the provider have effective protocols to guard against and provide notification of a data breach?</li>
</ul>
If you’ve finished reading all the relevant ethics decisions and are ready for a deeper dive into the exciting privilege questions raised by current and emerging technologies, you should try to get out more. No?  Then do what I did and take a look at Phil Favro’s excellent article in the Richmond Journal of Law and Technology, “<a href="http://jolt.richmond.edu/index.php/inviting-scrutiny-how-technologies-are-eroding-the-attorney-client-privilege">Inviting Scrutiny: How Technologies are Eroding the Attorney Client Privilege</a>.”

Dear Mr. Snowden: Is it reasonable to expect my attorney-client communications are confidential?