Minnesota Ethics - Opinion 22 adopted

At the meeting of the Minnesota Lawyers Professional Responsibility Board at the end of last month Opinion No 22 was adopted.

This Opinion, originally drafted in January this year, addresses lawyers' ethical obligations regarding document metadata.

Minnesota joins many other Professional responsibility committees at several bar associations in other states in the US in adopting such an opinion. A summary table of most of the Ethics Opinions in place can be found at the ABA Technology Legal Resource Centre. Taking the ABA's table headings, the summary of the Minnesota Ethics opinion is:


What is the Sender's Duty When Transmitting Metadata?
"...a lawyer is ethically required to act competently to avoid improper disclosure of confidential and privileged information in metadata in electronic documents."
May the Recipient Review or "Mine" Metadata?
"Opinion 22 is not meant to suggest there is an ethical obligation on a receiving lawyer to look or not to look for metadata in an electronic document. Whether and when a lawyer may be advised to look or not to look for such metadata is a fact specific question beyond the scope of this Opinion."
Must the Recipient Notify Sender is Metadata is Found?
Yes - "If a lawyer receives a document which the lawyer knows or reasonably should know inadvertently contains confidential or privileged metadata, the lawyer shall promptly notify the document’s sender as required by Rule 4.4(b), MRPC."

The full Minnesota opinion can be found at www.mncourts.gov/lprb/Opinion22.pdf

Opinions on document metadata in 2009

Finishing off a presentation for a screen-cast next week and wanted to check I had a date right (well it is Friday) and found the post below in draft. So, despite it being the end of the second month of 2010, a couple of ethics opinions released in 2009 and some links to resources on other ethics opinions:

In June 2009 West Virginia Lawyer Disciplinary Board released its ethics opinion on document metadata finding that there is a burden on an attorney to take reasonable steps to protect metadata in transmitted documents.

As reported in October 2009, this was followed by the Vermont Bar Association issuing an opinion on metadata.

The ABA has a table of the opinions that it maintains (last updated Sept 2009 at the time of writing). The LegalEthics website is another good source.

Peer-to-Peer articles: access to documents from iPhone

There was a great response to the survey we ran in October with 236 legal professionals providing us with information on what mobile devices they and their firms use and the functions/applications they use the mobile device for, with particular focus on documents and email.

What with my analysis of these responses, writing the report on the results of the survey, in parallel writing an article on the ‘The Often Overlooked Mobile Security Gap’ for ILTA’s December edition of Peer-to-Peer (it is the lead article – see page 8 or download a copy), followed by a white paper ‘Document Metadata: The Mobile Security Gap’ that comments more in depth on the results of the survey pulling in results of other surveys around mobile usage that were undertaken in the latter part of 2009, not to mention a week's vacation with the family, the Christmas holidays, a week in Chicago followed by a week in New York for LegalTech, it's been a while since I last posted a blog entry!

There are numerous numbers of items worthy of comment from the intervening months. The reprint by TechnoLawyer this week of one of the other articles in December’s Peer-to-Peer magazine provides me with a good start point. The article is by Christopher Lewis of Sonnenschein Nath & Rosenthal LLP and looks at the iPhone as a business tool and how it enhances the productivity of the attorneys at Sonnenschein when they are mobile.

One of the items that caught my eye when I re-read the article in TechnoLawyer was the success story quoted where a Sonnenschein attorney was onsite with a client who didn’t have the documents needed. The attorney accessed the Sonnenschein content and collaboration portal using his iPhone, downloaded the documents and forwarded them to the client.

56% of the respondents to the 3BView survey said that they had access to centrally stored documents from their mobile device, ie they have the same capability as the Sonnenschein attorneys.

I hope (and suspect) that this figure will increase within 2010. Why? Take a couple of other statistics from the 3BView survey alone:

• 39% of respondents store business documents on their mobile device. With my past experience in document management and also in DLP systems this makes alarm bells ring. I am sure the same bells are ringing for risk/security managers within law firms or for those with responsibility for corporate legal departments;

• The majority of those who have access to centrally stored documents reported that they attach a document to an email they send from their mobile device at least once a month. A quarter of all respondents attach do so at least weekly.

The last thing on the attorneys mind in a situation such as the one that the Sonnenschein attorney found themself in will be the fact that they are bypassing any desktop based tools including any that scrub document metadata.

As I’ve been stating in articles/papers to date, and will keep on saying throughout this year and beyond, increasing productivity of the legal professional even when they are mobile makes sound business sense. However, the management, control and security measures in place for in office equipment must be extended to mobile devices. This includes document security aspects such as scrubbing metadata.

SWISS red-faced over metadata information left in press release

Whatever your view on where we are on the economic road to recovery (or not) no business can afford any tarnish to its external image. As reported in the Guardian this week Swiss International Air Lines Ltd has a red face and a tarnish to its image in Canada at least due to an inadvertent link of metadata.

SWISS, as they refer to themselves in the press release, included review comments in the document that they sent out. Although the press release might be 'boring,' as reported by the Guardian, it provides a salutary lesson on how features that are useful in the review stage of a document can be a danger if they are not managed correctly when completing the final version that will be sent out.

The file, comments and all, can be found on the Guardian website.

Companies need to remember that converting a document to PDF alone does not protect them from leakage of confidential or embarrassing information via metadata. Although I was not personally sent the press release, and it is not obvious from the posting on the Guardian site, I would say that the release was sent in PDF. Take a look at the other metadata in the PDF file and see what you think (PDF Producer: produced on a Mac, author: initials in this instance, and so on).

This is the perfect example of why it is so important to ensure you have a system in place to automatically remove the metadata information within a document. While the data contained in this file wasn’t damaging to the company, it was definitely embarrassing. Had the data been company private, this could have been a very different situation for them. Make sure your company and your data is protected.

Only a week left for the Survey on Mobile Device Usage

We are delighted with the number of participants who have already completed the 3BView Survey on Mobile Device Usage and Document Security over the last two weeks. The results are already looking very interesting.

With just one week left until this survey closes (end of day EDT 23rd October), if you have not yet contributed then your participation would be very welcome. Please access at http://www.zoomerang.com/Survey/?p=WEB229PNSVQD9C

The survey focuses on access to, and usage of, business applications from mobile devices, with particular focus on the risks associated with information contained within document metadata when using these applications.

We will be publishing summary results on our website, with full results available to survey participants, who will also will be entered into a draw to win an upgraded phone of their choice – either a Blackberry Storm 9530 or an iPhone 3GS 32GB.

3BView Surveys the Legal Market on Mobile Device Usage and Document Security

Following on from my post last week, we at 3BView are conducting a survey on the usage of mobile devices in the day-to-day practice by legal practictioners around the world. The survey focuses on access to, and usage of, business applications from mobile devices in particular access to documents and risks associated with information contained within document metadata via such applications.

We will be publishing summary results on our website, with full results available to survey partcipants. Survey participants also will be entered into a drawing to win an upgraded phone of their choice – either a Blackberry Storm 9530 or an iPhone 3GS 32GB.

Access the survey at http://www.zoomerang.com/Survey/?p=WEB229PNSVQD9C from now until Otober 23, 2009.

More details can be found here.

The Risks and Benefits of Mobile Computing

More and more solo and small firm practitioners are making the most of the advancement in technology to practice law using mobile devices and remote applications. The launch over the last few months of the latest iPhone and Blackberry Storm has been another leap forward in enabling technology.

Not only does mobile technology assist attorneys in managing their client base, it also helps in lowering their business overhead. Mobile devices enable attorneys to work from anywhere. The term ‘Mobile Attorney,’ while meaning a specialization in the past, now relates to the practice of using mobile technology to conduct business.

One of the key aspects of the Mobile Attorney is that they no longer just have a laptop running Microsoft Windows. They are now accessing their email, documents and other business applications via webmail, mobile enabled Document Management Systems (DMS) and a broad array of devices such as Blackberry, iPhone, PDAs, NetBooks and Apple Macs.

But, this brings up an interesting fact. While being a Mobile Attorney has many significant benefits, it does introduce new security risks, especially where the firm's security tools, such as their metadata removal application, is limited to a desktop tool. The Mobile Attorney using the web, DMS or mobile device does not have access to these tools and so fall foul of what I refer to as 'the mobile security gap'. If you are a Mobile Attorney – are you aware of these risks and are you doing anything to make sure you and your data is protected?