Industry sign banking minnesota confidentiality agreement mobile
[Music] hello everybody good afternoon and welcome to another free Florida Bar CLE brought to you by rocket matter and legal fuel so we are really excited about today's CLE it's a very hot topic the ethics of communicating with clients via text messages and we have the pleasure to have host David budding with us today he's actually at HQ he is the founder of encrypted information exchange LLC which is a company that provides encrypted solutions for legal communications so he is definitely the expert in this particular field he is also a former practicing attorney at an M loft 100 firm and he developed encrypted information exchanged LLC based on his years of legal experience so let's give it up for David budding David thank you so much for being with us today thank you Lisa I really appreciate that introduction good afternoon everybody my name is David Bonnie I'm your presenter today a little bit about myself I used to be a litigator at an AM 100 firm in Chicago I specialized in real estate litigation so eviction title insurance defense all that good stuff so based on that experience I developed encrypted information exchange EIU legal as our product today I want to talk to you about three things the threats that small law firms face these days your ethical obligations when it comes to communicating with your client by a text or frankly any means and how best to protect yourself yourself your firm and your clients when you're communicating this way and then we'll have a little bit of time at the end for some question and answer so here we go so basically we all know that we're living in the age of hacking Equifax Yahoo these are all massive hacks that have occurred in the last few years at a perceived massive massive coverage in the media so this is something that that's half nearly every day but hackers have expanded the scope of their attacks to include smaller companies between January of 2015 and December of 2016 there was a 2,000 percent increase in identified exposed losses and email scans that were reported in 50 states in 131 countries it affected tens of thousands of businesses and there was 1.5 billion in losses those are just the breaches that we know about there are laws changing to address that where if you're familiar with the changes in the privacy law in California and some other states the rapidly evolving topic that's you know companies are going to have to be reporting more and more when these things happen they aren't going to be able to bear it and unfortunately law firms are being targeted as well this is just for law firms over 500 lawyers but in 2016 approximately 40% of largest law firms were attacked 25 percent were counted hefty fees to correct the problems and one in six also reported loss of important files or information that's that's just a staggering amount and that's just larger law firm says we getting further into this I'll talk about how hackers are targeting smaller law firms as well and the reasons why firms are being targeted basically it's it's two reasons one lawyers handle sensitive data of their clients its intellectual property its financial information its legal strategies its timing of wires in a real estate deal these are all juicy targets for for hackers for malicious third parties and there was a report that Verizon did back in 2015 that indicated that corporate lawyers are the easiest people to fish so of all of their clients corporate lawyers were the worst and you know all firms are attacked pretty much on a daily basis we're all had the opportunity to circulate this material around to you so if you want to check out the links I really encourage you to check out this 2017 top law firms attacked it's it's very very interesting but as well firms are being targeted and attacked the the obligations of lawyers have are changing late last year the ABA released a FX opinion opinion 484 that said that in the event of a breach at a law firm lawyers are ethically obligated to inform their clients at the preach that is just staggering so those numbers we saw earlier about the 40% law firms I imagine that numbers a lot higher and we're gonna learn more about that as these as people start adhering to these new rules now let's let's talk about threats here for a second and you'll notice that a lot of these threats dovetail together one leads into another one is components of another so this is just intended to give you sort of a 10,000 foot view of some of those challenges that are facing law firms that exist that are out there so a big one that we see a lot of is so-called ransomware where hackers will install malicious software on other firms network and then seize control of it once they've seized control that they'll reach out and they'll ask the last for ransom you know so you know they'll give you the keys to your network if you pay X and you know it's Bitcoin or something like that and that really obviously puts lawyers in a really tough position because you know when when you're you're you can access your intellectual property you know your work product the things that you do you can't function as a firm unless you can keep it all on your head which I haven't met a lawyer it can the next one is is so-called phishing it's where hackers will install malicious software on an email link and then they'll send it to someone in your organization and try to convince them to open it you know I'm not sure everyone's received emails from Microsoft allegedly from Microsoft or something like that that says we need your password whatever this is this is sort of that that sort of attack there they're basically fishing for information they're fishing for you to enter the link they're fishing for you to give up your password your username some other sensitive material that they can you then use to attack your network a threat that we've already sort of touched down is malware where they will use a email link or they'll find some way if it's a if it's a hard drive or something like that install it to your network in order to bring put this virus in it that will no compromise your network there are a variety of ways they can it can do this by email link by hard drive by hacking into your Wi-Fi something like that they're looking to install something on your network to compromise what you want to do another big one and probably the most important one that we're going to be spending a lot of time talking about today is individuals or so-called social engineering hacking where hackers are using email or it can also be over the phone or whatever will will try to attack your organization by targeting employees by getting them to give up their information and what we're going to discover as we go through this presentation today that people are the weakest link in your network that if you have all the most sophisticated encryption or firewalls in the world it simply isn't enough when when an individual breaches their training violates protocol does something they're not supposed to and it doesn't have to be malicious they can just make a mistake people do it all the time I see the final is spoofing that we're gonna touch on a little bit today spoofing is just total impersonation there was this case I read about recently in Hong Kong where some Taiwanese hackers assumed the identity of contacts in there what's a tin contacts in their whatsapp so basically the hackers in Taiwan took inactive whatsapp accounts and then started you know messaging with with with the contacts and saying hey it's been a while but you know I have a I need money for an investment I need money for a medical procedure whatever and so by doing that by impersonating someone else they were able to get some of these these these well-meaning folks to send them money you know they the Packers were eventually you know discovered and arrested but it was a cost lot it hurt a lot of folks you know there was another case a few years in New York where hackers in China actually spoofed the lawyers email address where they they made one change in in the address the lawyer I think was using may well account and they made some modification and so they actually texted or emailed with with the clients of the lawyer about a real estate deal posing as the lawyer and they were able to redirect some wires and things like that is pretty pre horrific and also you know from from these threats it's not just things that are immediately apparent like they're stealing money they're taking over your network they're they're doing something like that sometimes it could be something as simple as trading on your on the information that they clean if they get our earnings report or something like that hackers will just sit and look at the information that you have and then make trades on the stock market based on the information so you know they're they're defrauding the public they're at large and they're doing it in a very sneaky way that that's not you know easily that that's not a parent and another one that we're we want to talk a little bit about today that's my technology partner Mike Bansky who's uh basically does our encryption and everything else it's you know said that we don't need to include this I just want to talk real quick guys when people think of hacking they think of this just brute-force attacks where a hacker will will just attack your your encryption or whatever using a computer and just over and over throw permanent permeations of an encryption key at a-- until they eventually break it we'll talk about that a lot more later than when we get to the portion on encryption so real quick i want to talk about a case study that i think is relevant to most attorneys I'm an Illinois attorney and just about every every lawyer up there one way or another has done a real estate transaction I assume it's probably similar here you know either they're personally involved or they're handling it themselves so hackers found that real estate transactions were kind of easy pickings for this they would use email scams to basically target everyone in the transaction and try to get people to give up wire instructions try to redirect wires try to basically you know pinch whatever cash is being used to pay off the mortgage or whatever other lien was on the property at the time and you know there was uh there was a four hundred eighty percent increase of this in 2016 of scammers hackers trying to do this and they targeted 5.3 billion in assets trying to trying to get it you know this is for folks who've been involved in real estate transactions you know it can be kind of a kind of an odd situation in fact my wife yesterday our downstairs neighbors in the first floor of our condo unit are selling their property and you know so they're there they have to put together title and things like that my wife is the president of our condo board where she rules with a with a velvet glove but she gets an email asking for title it was it was from the lender the lender had sent her an email asking for title and it was some person over there who didn't know who was who who had a list of contacts who just sent it out the seller was not included on the email the sellers attorney was not included on the email so it was not going to the right person at all but when you're involved in these real estate transactions you get these emails from from odd folks and you need to confirm who they are because it could be hackers trying to penetrate this trying to find out what's going on trying to be in a position where they can intercept the wire you know my wife just forwarded the email to the sellers attorney and lets the lender the lender know that she was not the correct person she didn't say who the seller was and forward that information she turned it over the seller so they could go ahead and handle it because she didn't know the person was which I think was probably probably the right move you know I find in my own practice when when it came to getting wiring instructions from clients and things like that I would never use email I would ask them to take photos of their wiring instructions and text it to me and encrypted text messaging app actually using the one that we've developed so I knew it was secure and then I would actually hand my handwritten wire instructions over to the to the the closer at closing so there was no no risk of intersection all right now on to texting so basically you know texting is incredibly popular we see you know Americans are texting 81% are texting on a regular basis that's every day this is becoming our primary form of communication we text more than we call now we and you know folks younger than 50 this is truly their primary mode of communication we're talking your friends or trying to do something or catching up they're not doing it on the phone they're messaging back and forth now this trend the wall out the wall industry is not immune to it and lawyers and clients are turning more and more to texting now there there are reasons for that and ease it's easy to do your phone's right there with you all the time efficiency you can keep your clients up to date without having to get on the phone without having to interrupt their days or interrupt yours and let them know what's going on there's a certainty of receipt it's very effective it's an ability to create a running dialogue without directly interacting that also creates a record now obviously there are concerns about texting as well these are the primary ones that I've seen lawyers are worried about their ethical obligations to their clients obviously there are confidentiality concerns when it comes to texting you know you don't know what the technology is whether or not you know it's it's appropriately encrypted there's also the concern of being overly accessible you know a lot of a lot of attorneys don't want to give up their cellphone number and I think and sometimes for very good reason the next issue is record keeping record preservation you know it's it's very difficult to keep records of text messaging because you know after a period of time the texts just start disappearing like if you use an Apple as I do you can go back many months and all the text will be there but eventually you go further back it's not recoverable unless you go through take some extraordinary steps additionally lawyers look at texting as being a little overly simplistic it doesn't feel really you know you're suddenly emojis or popping up in your client correspondence which is a troubling thing at times but that's that that's sort of that that's why lawyers are getting worried about texting now when it comes to your your ethical obligations to your duties in text messaging there are a couple of rules you need to keep in mind and they basically go hand-in-hand in this one is the duty of competence the other is rules is the duty of confidentiality so we're gonna go back over this and then and talk about sort of how we arrived at where the ABA in Florida feels right now about about secure communications so the duty of competence is sort of the basic one its rule 1.1 on the model explorer shall provide competent representation to a client competent representation requires legal knowledge skill thoroughness and preparation reasonably necessary for the preparation for the representation very very straightforward and feel like we all know but the next comes the duty of confidentiality the rules of confidentiality you know a lawyer shall make reasonable efforts to prevent the inadvertent or on an unauthorized disclosure or unauthorized access to information relating to a client's representation Florida's law is basically a rule is very similar with with some exceptions of regarding client consent so going back when when email first came on the scene back in the 90s the ABA and in his opinion 99 - 4 1 3 he said lawyers have a reasonable expectation of privacy and communications made by all forms of email included unencrypted email sends on the Internet despite some risk of interception and disclosure so that was a state of the rule at the time basically you didn't have to worry about securing your communications back in 1999 well that that changed in in 2012 the ABA said a lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosu
e of or unauthorized access to client information relating to the represent representation of the clients that was basically the same thing but in the comments they said and they linked it to the duty of competence competency which is where we're at again where the the confidentiality and competency are coming together they said in in comments eight in that twenty twelve opinion to maintain the requisite knowledge and skill a lawyer should should keep abreast of changes in the law and its practice including the benefits and risks associated with relevant technology they need to engage in continuing study and education and comply with all continuing legal education requirements to which is to which a lawyer is subject so that's that's starting to take us in a new direction it's no longer assuming that your email is secure it's a longer assuming that your text messaging is secure it's saying you need to start paying attention to this you need to start understanding what is happening and what what you're doing with with your clients data so in in 2017 or yes the ABA came out with formal opinion 477 which basically codified what a lawyer needs to do to stay competent when it comes to protecting their clients confidentiality this is the finals for a melding of the competency and the confidentiality rules it said that lawyers are now required you know excuse me this is up yeah lawyers are required to act competently you safeguard information relating to the representation of a client against unauthorized access by third parties and against inadvertent or unauthorized disclosure so they have to there's a competency component in how you are exchanging information with your client and using technology so it's it's suddenly on you to have an understanding ethically above what you're using and and at how best to communicate with your client alright so in the ABA formal opinion four seven seven they they set out a bunch of criteria that lawyers need to consider when they're protecting their clients communications the first is understanding the nature of the threat which is what we talked about earlier is understanding that there are folks out there with malicious intent that are going to use deceptive means to try to to to breach your network to break in and steal information or use information from it to use that sensitive material what's also important that lawyers start to understand is how your information is stored and transmitted so suddenly that's that that's a whole new ballgame it's talking about how your firm keeps its information how your firm transmits information you know what servers are you using what's what's your technology how are you protecting and it's putting a burden on you to to start to understand that stuff which is you know obviously sometimes not lawyers Forte's because most of us didn't didn't become lawyers to cook to be engineers or technologists we became lawyers because to persuade and argue and an advocate for it's it's a different skill set but it's the ABA is saying that this is something that you need that you're obligated to understand third is understanding and using reasonable electronic security measures which are you know what are the things that are out there and available to you to protect your client information and that's something that we're going to get into later in this in this presentation so we'll talk more about it you also needed to determine how electronic communication about your clients should be protected and this is this is interesting it's it's not your AI dee' IT department that needs to make this decision the ABA here is saying that it's it's you that needs to make this decision you the lawyer who's ethically obligated to protect your clients information needs to to choose a matter how I have to do it and what best serves your interests and the clients the v that they talk about is labeled client information which is basically the labeling that a lot of us do you already you know that that paragraph at the bottom of an email that says if you receive this email and err blah blah blah please please return and know by us immediately all that but it's also you know when it's when it's confidential and privileged information you should do the best you can to label it some more on the contentious consideration front is training your lawyers and non-lawyers in and basically how this how this works that that goes back to the social engineering hacking method we discussed earlier so it's it's trained your folks that work for you the other lawyers in your firm your partner's your your minute your admins your your paralegals on on this stuff on on these types of threats and in how to how to avoid it how not to not not to succumb to to the roots so it's it's giving putting an obligation on you to train your folks to to not fall for the fall for the hacking attempts and the final component of the rule that the ABA put forth and may be a be a formal opinion 477 is basically to conduct due diligence on third-party vendors going back to what I was talking about before how most of us aren't engineers and technologists we don't know about this stuff we need to rely on on third parties to help us security companies things like that and they ABA actually laid out some some different items you want to consider one is you know check the references and credentials your vendor of course makes a lot of sense another is vendor security policies and protocols now this is this is something that's a little different you need to understand how your vendor processes the material how processes the data how do they handle it what do they do with it whether or not it's it can it complies with with your ethical obligation so we'll get into some more of that later but it's it's understanding what they do and how they do business another point that the ABA identified was the use of confidentiality agreements so when you sign a contract with with the third party vendor to do your security or build your network you're you you talk about what's going to happen with the information you talk about where it's gonna be stored you talk about what if it's gonna be cloud-based server base where those servers going to be located things like that another issue that the ABA identified was vendors conflict check so you know just the ability for the for the vendor to screen for adversity if that's if that's a concern and finally and probably most importantly the availability and accessibility of a legal forum for legal relief if there are any breaches the contract a lot of security companies are going to have their servers overseas somewhere I mean you know are you gonna be nobility they would assert jurisdiction over that data over where it's will actually locate it which is a concern you know most of the time if you're if you're using a company that's based in the US you should be fine but it is if they use third parties to actually store it how do you get your jurisdiction over them it's it's there there are ways to do it but it's probably best to spell it out and whatever agreement you have or women the use of those third parties that are overseas now in in the ABA formal thing for 7-7 they talk about different types of data they talk about when it needs to be protected and when it doesn't and this this is how they determine the reasonably standard that they laid out so the sensitivity of the information is an important consideration the ABA says that if it's just normal information like oh you have an appointment at this day at this time that probably doesn't need to be encrypted that's you know versus you know attorney-client privilege stuff where where you're talking you know about strategy or information or you know just just there just just something involved in the case that that's privileged that that should be protected I would argue that you know you don't want to have your people make a determination as to what's the sensitive information and what isn't it's easier to just have everyone on the same page but that that's what they suggest and further in the any reasonable effort standards about the likelihood of disclosure if additional safeguards are not used what they're talking about here is the threat the likelihood of hackers compromising the network and as we saw in one of the earlier slides 40% of lawyers or law firms over 500 attorneys have had suffered some sort of breach so the likelihood seems pretty high and I think as we learn more and more about the struggles of small and medium sized firms we're gonna discover that that breaches are a lot more common than than we think just because people aren't purporting it it's embarrassing why why would you want to why do you have to unless of course your other obligations here another factor that they consider is the cost of employing these additional safeguards how expensive is it to put in these systems that will protect your communications that's something we're also going to get into a little later about encryption the final is the difficulty of another is the difficulty of implementing the safeguards you know it's how hard is it well you know what are the steps you have to go through to put encryption on your communications on your text messages or your emails with your clients and as as we're gonna find out later in this presentation it's not difficult at all in fact it's it's it's common and the final is the extent at which the safeguards adversely affect the lawyers ability to represent the client which means you know make doing it in a way where your clients not able to do it where they can't handle the encrypted text message or an email I think will find that people are really capable these days we all we all have our phones on us all the time we know how to use them but it's it's another consideration when it comes to employing additional safeguards so the ABA talks about doing a fact-based analysis when it comes to evaluating whether or not attorneys are appropriately adhering to the reasonable effort standard and you know again it's my contention that you know you don't want to be making decisions on what substantive and what's routine you'd rather protect everything because sometimes you don't know what's going to be relevant until after case is wrapped up and of course there's always special that special circumstances that the ABA identified where the type of information that is being conveyed it is protected by a confidentiality agreement or by some law like an SEC a while or something like that where where where the communications need to be protected by statute so that's just something to be aware of so sort of a summation on the ABA formal opinion 477 they make a distinction between routine and substantive again you know I don't think it's best practice asking your clients or the administrators to make a judgment on what's routine and what's what's substantive you know I take this from my own experience I was representing a extended hotel in outside of Chicago in an eviction case it was very very strange but we did a lot of corporate work for this company so I got brought in on it I was working with the area manager on it and I had her appear at several hearings you know to give testimony and so you know she had my cell phone number it's a good clients and we would text about you know meet me here at this time whatever but as the case went on and as it sort of drug on because of the uniqueness of it and she started texting me like Friday Saturday nights about the attendant just did this or that or something else you know something I needed to get you know that that she thought I needed and she wasn't looking for me to you know get back back to her immediately she was just doing because it was top of mind it just happened she wanted to let me know and I got into a discussion with her and because we hadn't talked about this previously like don't just how about don't text me anymore and she's like why and I said look you know I don't have a great way to capture this I would get the text messages and when I got to my office on Monday or sometimes I do it on Sunday I would I would just drive something real quick and note for the file say what she said what she said you know with timestamps who said well when they said in the text message and try to preserve it that way I saying you know that that's probably not the best way to handle this and so she got it uh-huh and she would just you know send me emails from there on but she would she would text me and say Dave go check your email so even though I told her not so she still did we we had created an expectation of text and basically because of earlier in the process and then when she sent something substantive until we had addressed it yeah I would have to find ways to to record it and preserve it you know so basically at the start of any representation I would recommend that you talk to your client about text messaging if it's something they want to do and discuss just security generally with them and how you want to handle it and then what what you want to do but sincerely I think once people get in the habit of doing something they're going to keep on doing it and as as I pointed out earlier the the opinion notes that attorneys need to keep abreast of the knowledge and the benefits of the the relevant technology which is what we're doing here today it's it's knowing what's what's happening in the industry something I wanted to just mention real quick before we go on this is something that is unique to some jurisdictions and this is something that I saw is exists in Florida there there are certain data storage requirements that are specific for you for you folks so when you have these text messages when you have these emails when you have these communications what you need to do with it so it's the you need to identify the potential threat to the confidentiality that that's associated with with the with the storage of the data so it's on your servers or in the cloud or whatever but it's it's how do you continue to protect the confidentiality of material you need to inventory the devices that contain hard drives and other storage media so anything that you might have that might contain confidential information and that could be a printer that might be a copier you just need to have an idea of what which of your devices out there might be storing some of this information you need to supervise your non-lawyers and obtain the adequate assurances from third parties that confidentiality will be contained that's that's those clauses to the contract that we talked about earlier when when you when you contract with those third party vendors you want to make sure that there are confidentiality clauses and then to protect your clients data as well as you know that this yours and also you oh when when when you need to decommission a device you need to ensure that that the device is wiped again you're probably using a third-party vendor for that but you need to make sure that they're not retaining any of the information and that the devices are wiped effectively all right so it's texting as ethical yes there's no prohibition that exists on texting there's not one in Florida that I can find and there's not one that the ABA cites you know but you are responsible to ensure that your communications are secure before we get on to further talk about mmm-hmm securing your communications and how best to do that there there's another wrinkle that in Florida I wanted to mention it's a solicitation of new clients via text messaging now text message solicitations in Florida is permissible but you need there are a couple of different things you need to do the first line of the test text must say that it's an advertisement so you know it's it's it's having that this is an advertisement this is this is illegal advertisement that tends to be the first component of it you need to keep trying to prove who receives the text and what exactly was in the content so if you send it out and then a client or potential client responds to it you need to hold on with that material and preserve it the lawyers must ensure that the prospective client is not responsible for the data costs by working with cell phone service providers which yeah I I think that that's tha
's an arrangement you can come to and you must have a method for perspective clients opt-out which is you see it a lot in email where where you get an email from from whomever that that's asking you to buy something from them there's always an opt-out provision any any sort of advertisement email you can always opt out but as well as that do not count lists and things like that the reason why this is so critical in Florida and did some research on this but when businesses said in text messages out this is just general businesses not law firms specific 82% of them are opened this is from a flow route survey that I found but in when businesses send out solicitations to consumers by email only one in four are are received and there there's something like three out of four this is a zip web survey did this the 2019 state of texting survey that said that three out of four consumers want to text with the business so when they get that that solicitation they want to be able to respond to it like you know for instance you're sending you know an email a text message out to your former clients or whatever database you have about you know will say estate planning because it says hey is there been a change in your life you know contact us about estate planning the clients gonna want to try to set something up you'll potentially set up or at least interact with you on so that that's just that one that's just interesting information it sounds like an effective marketing device so we talked about law firms at risk earlier about how your your communications with your clients are being targeted because of the value of them because of you know the financial information the IP information legal strategy information just earnings information that they can trade on it's it's critical and using an on secured communication communication channel can be a breach of your ethical responsibility so that's a significant risk indeed so what are the steps that you as a law firm can take to protect yourself when you're communicating mobile communications one is password protection which is priests for you should use something that is sophisticated you should it should be password or 1 2 3 4 5 or something like that you should try to come up with something unique and that's that's difficult to do because it's hard to remember so you know I was just using the password manager to help you with that uh the next is multi-factor authentication now what multi-factor authentication is is a security system that requires one or more method of authentication from from from the person who's trying to access it so for instance go to a you go to an ATM or cash machine and you want to take your money out you put your card in you enter her pin that's multi-factor authentication when you want to log into your iPhone you might have you know for instance a passcode or a fingerprint or something like that or sometimes when you're logging in on the websites you're trying to use do something you're there's there's a security question as well as your password so it's it's a couple of steps in the protection it's not simply one thing I'll see the next is hardware firewalls which is pretty straightforward there's encryption protocols for data sharing that's basically that that goes back to your social engineering that's that that's having rules and procedures at your firm that governs how people interact with with this information how they communicate with their clients the next is training it's it's training those people that's also component of the social engineering but it's keeping them keeping them trained and and updated on any changes that you do and it's probably doing it on a regular basis so what everyone stays up on how they're supposed to be handling things and the final is testing to ensure compliance once you install a system once you have you're using something you need to test to make sure that people are doing what they're supposed to be doing I was actually talking to a security company here in South Florida yesterday about this and they they were telling me about a case that they were called in on where clients have been hacked and they've been hacked through a a basically a link they had with a western state government like about whatever and they basically had all the the protocols and stuff in place they had logs logging all the the exchanges of data packets and information going back and forth but no one was looking at the logs no one saw that the actual breach had occurred months before it was ever discovered so that that kind of goes into the Train it's it's having these systems in place but then making sure that there's someone actually monitoring it and keeping an eye on things and looking out for for red flags so you can you can act appropriately and step in to protect your clients information so the the weakness in regular text messaging is abundant there's a vulnerability due to handoff to me near intermediaries which basically means how texting works is you send it a text on your phone it's irregular SMS and it bounces from server and server and goes through the network until it lands on your intended recipients phone so in those those different servers in between can have different levels of security and if it's a plain text it's not encrypted it can be read at different spots if it's so if there's a lack of encryption it can be right at or intercepted earlier there there's issues with spoofing Mike Manske our partner in this one so I was sitting at a table with them because he has the appropriate tools called me from his phone using a spoofed number I have a cell phone number but he was able to change it while we were sitting there like two minutes so he was able to make that change another issue on data on device is that data that resides on the device which we'll get more into later along with network connection exposure which we'll get more into and you know individually are people making mistakes I was I was on a guy's trip a few weeks ago and we were a friend of ours was you know just research into cell phone number so and someone else had gotten his cell phone his old cell phone number so we're basically texting this person out there all of our plans of what we were doing without knowing that he wasn't included okay mm-hmm so reasonable efforts in the current environment there's the increased encryption industry standards a IES 256-bit AES stands for basic well it is it's an advanced encryption standard and it is a symmetric key algorithm meaning that the same key is used for both encrypting and decrypting the data and the other reasonable effort is end end encryption sorry I'm speeding a little bit it looks like we're on time so what is 256 bit encryption basically it's a standard that the US government requires that all sensitive and important data be encrypted using this 192 or 256 bit encryption methods it's what your bank's use it's it's basically it creates a 78 digit number that that is the encryption key now that's that's one in basically to have a shot at breaking it it's it's a one in over 115 quarter version Tilian which is a number which is an incredibly big number which makes these these transactions incredibly secure on the commercial market it's it's it's not unbeatable because you know well first of all anyone who tells you that an encryption is unbeatable you should walk away from immediately and not - it's hard to learn more about it because everything can eventually be broken from what we know right now in order to bring something to like 256 bit you'd probably need to be basically have a supercomputer at the Pentagon or something very serious be a government act or be one of those top research institutes that that has access to the supercomputing power in order to break it you know it will eventually be available one day down the line - to regular hackers think it's a possibility but no promises and so that leads us to end to end encryption which is which is common in something that you should insist on intend encryption basically means passing that bag of saying well night when I a bag of sand so you run your data into this encryption program that encrypts the information it passes information the texting from server to server like we talked about secure or not if anyone intercepts it they're just seeing a bag of sand they did sound decipherable they can't figure out what it says and then when it arrives at its destination when that recipient has the decryption code it pulls it down and and you can read it so it protects that that transit something I want to touch on real quick before we move on is encryption on your cell phone 95% of lawyers and that's that that's the number use iPhones when you're texting within the Apple you get those blue bubbles so blue bubble means that you're texting someone else's an Apple and the Apple messaging has 128-bit encryption so that means it's it's encrypted but if you're texting to someone who's outside of Apple who uses an Android who uses some other some other type of device you're gonna give a green bubble or when you send a green a straight text message to an Apple user you get that green bubble that means it's unencrypted it's just plain text so it can be deciphered it can be intercepted so here's how basically encryption works and you start with information you run it through a bunch of times it's I am NOT the encryption person but if you have any questions about how this works I'm happy to give it to you I'll refer to it to my partner and we'll get you the answer just if there are if there are ten rounds of this process with the shifting rows and mixing of columns ten rounds is under 28 bit twelve rounds is 192 fourteen rounds is the 256 bit that's that's where you get the logarithmic power to the 256 that we're talking about earlier the 78 digit number data on your device is something that you need to be concerned about when you when your text messaging or you're using like whatsapp or something like that the data actually resides on your device so that becomes a problem because when it's on your device its unencrypted unless it's unless you're using an application or messaging through it that is encrypted you missions available you'll find that you know we have our Bluetooth on all the time people who because we use our headphones or for our car whatever reason you can obtain tools pretty easily to be able to hack in a person's Bluetooth network because it's not encrypted and be able to read the data that's on their phone you know it's it's fairly easy to do I mean it's also an issue if you're connected to public Wi-Fi so it's it's something to be concerned about and it's it's relatively easily an issue that we talk about a lot is storing this data on the cloud as opposed to physical servers that you can access that are nearby so basically what this is what the cloud is it's endless data centers and then endless network there's redundancy it's fast because of the increase in capacity and it costs a lot lower than than having your own set up May it gives you world light wide access more storage you need to obviously go to a cloud provider to do it which would be Amazon Google Apple's someone like that and it's it's relatively easy to set up it's autumn updates automatically there's a reduced cost or like free applications on it like Dropbox and things like that there's there's drawbacks to it though you're contracting with a third party to handle all your data which we spoke about earlier then you need to bet those folks there there's a privacy consideration but you know more than likely if you use one of these cloud providers they're going to assist on password protection and they'll have their own level of encryption oh there's of course the loss of control with the information and you're relying on the internet in order to access the cloud and your firm's information if you decide to store it on the cloud you have to be able to connect anyone there into the internet you can't use it when you're on an airplane or something like that but but this when you use a cloud-based messaging app here's here's what it does for you for instance go on your phone and you put it in airplane mode and you try to access your text messages we've done that in the past we did it with whatsapp you can everything because it resides on your phone we did that with the with the Apple and it resides on your phone there - what we did where our applications cloud-based so none of the information expert sits on your phone it's it draws it comes down from whatever device you're on so if you lose your cell phone or something like that like if you lose your your phone and so women is able to open it they they can read your text messages because it's it's there even it's not connected to a network but if you've used cloud-based applications you know you have that extra layer of security where if a phone is lost as long as they don't have the credentials they're not going to be able to access that information so if they steal your phone it's it's it's it's not worth much that now when we're talking about cloud-based solutions for stuff there there's an ethical component to it and in Florida fortunately is one of those states that's permissible provided you and you adhere to certain rules so you need to ensure that the online data storage provider has enforceable obligation to preserve confidentiality that that's having that agreement in place I need to investigate how they store the information look at other security measures policies things like that they're asking you to be familiar with what your clients data is going to go which is you know pretty reasonable and then you know employing the available technology to guard against reasonable or foreseeable attempts to infiltrate the data that is stored now it's the available technology that goes back to the 256 bit encryption that is widely available all most of your west messaging apps are gonna have some encryption on there it's it's making sure that that you're utilizing encryption in your communications in your text with your clients so that you know that you're protected a question that that we we struggle with is the use of ephemeral platforms for texting solutions rather than then then something like what's that for what we do the problem with that is you're basically destroying information there there was a basically an opinion that came out by the Justice Department their Foreign Corrupt Practices unit where they had businesses that were required to self-report documents for whatever reason we're overseas in non favourable jurisdictions like China or Russia and they would use these these these platforms in order to communicate back and forth so the the information would go away so when when they had someone who is over in China or Russia for whatever reason they they can communicate back home easily and and worry less about an interception the problem is is there was no record of the transaction so if they were just talking about routine things not a big deal but of course if they get into the habit of texting and suddenly they're talking about a deal or something like that something that they need to report on that information is gone the Justice Department suggested to them that they draft memos to the file in the event of you know whenever these exchanges occur but unfortunately um you know when you're on the road when you're in the field it becomes very hard to do that and sometimes it doesn't happen so that that's really the problem with ephemeral platforms I'm just going to move forward a little bit and this material will be available to you so when we're we as lawyers are not really in the business of destroying client communication so that's why the ephemeral platforms are not particularly suitable for what we try to do you know when I was in the corporate side I would follow up or when I practiced I would follow up client you know client phone calls over sensitive information you know settlement authority things like that with with an email to what folks in the organization know that I've been authorized in client organization though they've been authorized to do this that's just the best practice and you know we want to preserve as much as we can just as a way to miti
ate our risk and liability in case there's a misunderstanding later on and truly finding something that gives you an unalterable record is really the best practice where something that can't be can't be spoofed it can't be altered something that everyone gets the copy and it's a cannot be changed that's that that's critical because then you know that's that that's something you can rely on as evidence and really to to protect your organization yourself and your and and your interactions with your client okay so we're gonna touch again on the third party talking about those folks you bring in to help you again and we went on this earlier about these things that you need to be considering when you decide to hire a third party it's looking at their hiring practices it's using those confidentiality agreements it's having those policies and protocols in place and understanding that they exist to protect you in your client now in Florida there is a specific standard and here it is it's it's the lawyers duty to investigate the online doing data storage provider security measures their policies their their methods for recovery and any other procedure that might be in place that that is adequate on the circumstances so that that those are the things when you practice here in Florida that you must keep in mind so really you know what is it that you're looking for you're looking for something that's transparent you're looking for something when you're communicating with text messaging you're something that's transparent navigation is transparent something that's instant something that's secure something that's unalterable and that's that's what my company does that's what EIU legal does we've we've developed this in order to put what we call if the transparency in the palm of your hands it's designed with law firms in mind so they can communicate with their clients in secure fashion while creating that unalterable record to basically protect the lawyer from from liability and that's that's all about all I have for you today if you have any questions that we can deal with those now otherwise my contact information is right here for you so Lisa do we have any questions let's see so there was a question you did explain the how encryption works because you I remember that you said it bounces around there's 256-bit this question was can you describe how encryption works and how much it costs so it was there a cost associated with the encryption yeah so it's it's it's gonna be you know going through whatever secure messaging app you're not you're not paying for the for like the development of the encryption or things like that this is all stuff that's that's a lot of it is is publicly available the 256 bit is publicly available so you should be able to talk to a security provider and they'll they'll be able to acquire that for you how they install it there'll be different costs associated with that but it is readily available what makes us different is that we use a 256 bit plus some proprietary stuff that we just got our patent on so it's it's better than the 256 bit but it's really from from doing an evaluation if it's reasonable to install it it's it's very very inexpensive our app is available on the App Store right now at $4.99 per month subscription you can get apps like signal for free so it's it's something that that's easy to use let's see I'm also a mediator can you give us some guidelines on communicating with parties after the in-person sessions eg settlements that often result after the parties go home so you're talking about confirming with with I mean it's whatever your your obligations are as a mediator you know I think you know the whole point of mediation is that you can talk with them confidential confidentially I I would imagine and not happy though those discussions reveal so you know as a best practice I think you want to use something like that to be able to create that record so you can protect yourself that there's a any sort of organization of impropriety later on I I think you want to have a record of it here's another one if you use encrypted text does the client need to have some special capability to unencrypted the message no so like what I was talking about what our company developed you would both have to have the app and I would encourage you to check out our website and learn more about it but if it's if you're gonna have an encrypted environment aside from from like your iPhone encryption where you only goes to other in iPhones that that's encrypted and then but it does reside on the device so you can intercept it but if it's if you're talking your client securely you'd want to have that into end encryption where it doesn't reside on their phone so you want to use those cloud-based security application and they what they would have to have it as well it couldn't just be one person it needs to be both to maintain the encrypted environment okay here's here's a two-for-one is the e ie legal mobile app available for Android as well as I had phone users and if not do you know with any non Apple devices that have similar encrypting to the Apple products like Samsung I don't know the second part I don't know the first part Apple it's the EIU legal app is available on both the App Store and Google Play and we can do buy labeled versions so if you're you're interested you don't come to check us out we can build a free organization part of the things that we didn't discuss because we're running out of time is basically setting up the world of communication you know the human error if you can limit the database of people who can be involved the better it is and so we know absolutely applications like e illegal allows you to do that whereas whatsapp you know there are there millions of people on it it's it's easy to screw up so it's like in the time one case so it's we're on both those stores please check us out awesome and I am sorry that I did not show it on the screen however this Scioli just so you guys are aware I will also type this number in the chat on the right side of your GoToWebinar control panel the CLE course number for this is 3 5 9 6 again that is course number 3 5 9 6 and I'm going to send that to the entire audience in the chat this silly course has been approved for one hour of general credit including one hour of Technology and one hour or end one hour of ethics in case you missed anything about the presentation today you will receive the recording and the slides tomorrow afternoon via email so if you missed any of it you can recap using the recording and you could still get credit for the CLE with the course number David thank you so much for being with us today we are very appreciative and there was a very informative CoA there was a lot of information to cover and thanks for doing a great job we enjoyed having you here today well thank you so much I really appreciated it and when you when you folks get the slides all the links on them will go to the various rules that they you should take a look at okay awesome all right thank you everybody we hope you have a fantastic afternoon and have a great week [Music]
