Oklahoma Bar Journal
The Ethics of Using Cloud-Based Services and Products
By Darla Jackson and Kenton Brice
In 2012, the ABA’s House of Delegates voted to amend Comment 8 to Model Rule 1.1 regarding competence to provide that to “… maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology …”1 Since the amendment, 36 states, including Oklahoma,2 have adopted some form of Comment 8 or an equivalent3 and a great deal has been written and blogged about what technology competence really means.4
In writing about the adoption of the comment, OBA General Counsel Gina Hendryx has warned, “Maintaining competence may very well require knowledge of e-discovery, online filing, electronic document retention policies, etc.”5 Another article opines that because of “… the recentness in most states’ adoption of the duty of technological competence to Rule 1.1, few courts have had an opportunity to address this unique issue.”6 While this may be true, advice provided by Ms. Hendryx suggests that businesses “today run on technology-based tools and most now depend on the communication provided by the internet … The best advice is to pay attention to cyber ethics issues and try to behave reasonably. If you don’t know about best practices, attend CLEs and read …”7
Oklahoma is one of the few states that has had a technology-related case. In State v. Oliver,8 the Oklahoma Supreme Court publicly censured an attorney who failed to properly notify clients and the Oklahoma Supreme Court that he had been suspended from practicing before the United States Bankruptcy Court for the Western District of Oklahoma. The respondent’s suspension from practicing in the bankruptcy court resulted from his failure to gain competence in preparing and e-filing bankruptcy documents. The majority opinion characterized his conduct less harshly and encouraged him to “continue to improve his computer skills” or to hire an “adept administrative assistant” to perform tasks such as preparing pleadings.9 In contrast, the dissent noted that the evidence did not suggest that “… Respondent will represent future clients with any more competence than he displayed in his bankruptcy practice, and find his lack of candor and blatant disregard for the Bankruptcy Court’s orders disturbing.” As a result, the dissenting justices would have suspended the attorney for two years and one day.10
While Oliver may be an extreme case and the proceedings were based on the attorney’s failure to report his suspension and not a failure to maintain technology competency, it does provide an example of the potential for disciplinary proceedings resulting from failure to maintain technology competence. 11 Mr. Oliver’s initial disciplinary woes, however, were not the result of a failure to appreciate the risks of using a web-based technology e-filing system but were based, in part, on his failure to appreciate the benefits of e-filing and to then acquire the skill necessary to take advantage of the web-based system.
Since the ABA adopted the now infamous Comment 8 to Model Rule 1.1, most writers and commentators have been sounding the warning: attorneys must understand the risks associated with the relevant use of technology to stay competent. While understanding the risk of utilizing technology (or not using technology) is a keystone to an attorney’s competence, little has been written about an attorney’s competence in understanding the benefits of relevant technology. The hope is that this article will encourage attorneys to view their ethical duty of technology competency in a more positive way by helping lay a framework for how understanding various cloud-based services and products can benefit an attorney’s practice, and hopefully, their capabilities in representing their clients.
HOW TO UNDERSTAND THE RISK OF EMPLOYING CLOUD-BASED TECHNOLOGIES
LEVERAGING THE CLOUD FOR SENDING AND RECEIVING DOCUMENTS
After understanding and assessing the risk of SaaS providers and their offerings, the benefits of taking advantage of these services can be incredible. Attorneys can do more now than ever to communicate with clients, draft and share documents and even automate their work, all in a more secure and arguably ethical environment. Online file-sharing and client portals are probably the most valuable SaaS services available to attorneys. Sending and receiving documents have always been part of a lawyer’s routine. From carrier pigeons15 to telegraphs and from fax machines to email,16innovative technologies have always persisted in providing faster, more efficient and more confidential means of sending documents. Client portals and online file sharing are continuing this trend and should begin replacing fax machines and email as the preferred method of sending documents to third parties. The reasons are clear: these services provide secure, traceable, fast and authenticated document transmission.
Much has been written about the security of online storage and requisite encryption and LCCA Standards 3 and 5 specifically address these security issues. For the purposes of this article, just know that most commercially available file-sharing and client portal services provide robust security and encryption protocols. For instance, Citrix ShareFile provides from 128-bit to AES 256-bit encryption for documents in transit (depending on the web browser being used) and protects stored documents for U.S. clients using AES 256-bit encryption at SSAE 16 Type II (SOC 1) audited datacenters hosted by Amazon Web Services.17 In other words, documents are stored in well-protected physical and digital locations that no one can access unless they have the correct credentials, i.e., a password or encryption keys.18 Furthermore, most hacks of cloud-based services due to human error and not necessarily some nefarious coders sitting in a dimly lit basement.19
Human behavior can cause security breaches with any technology – have you ever sent a confidential fax to the wrong fax number? In fact, the structure and features of cloud-based services can actually alleviate most security breaches caused by human behavior, providing greater control over documents, audit capabilities and real-time collaborative abilities. Cloud-based services transform document sending to document sharing, with documents rarely being actually “transmitted” to another party. Instead, the owner of the document provides access to the document for viewing, copying or printing and the document never actually leaves the control of the originating party.
To accomplish this, documents must first be stored in a cloud-based system. Then, the owner of the document sends a hyperlink to the stored document (or folder containing the document) instead of the actual document itself, providing enhanced access control and audit capabilities. When faxing, emailing or even mailing a document the sender loses control over that document once it has been sent. However, when using a cloud-based service and sending links to documents stored in the cloud, the sender retains complete control over the document. The recipient must access the document through the provided hyperlink and the document owner has the ability to receive notifications each and every time the document is accessed. Additionally, access to the document is recorded and the owner has an effective audit trail of who, when, where and how the document was accessed, including IP addresses, geo-locations and time-stamps of when the document was accessed.
The owner can also set a variety of access parameters and permissions for the document or the documents contained in a folder. For instance, Egnyte20 provides multiple options for sharing links with external individuals: expiration of the link on a certain date or after a certain number of clicks, whether the individual can access the most recent version of the file or the original version of the document at the time the link was created, the various access levels (open, password protected, only those in the organization or a specific user), whether the document can be downloaded or printed and whether to receive notifications each time the link is clicked. 21 These types of settings provide attorneys with more assurance their documents are not being accessed, copied or further shared with unauthorized persons. Try that with email or a fax machine!
Finally, client portals move cloud-based document sharing to another level. Client portals, whether part of a case or practice management system or a standalone system, provide valuable features for constant contacts, such as clients or expert witnesses. First, they provide outside users with a dedicated portal they can access at any time. Documents can be uploaded into the portal, alleviating the need to create and email hyperlinks whenever a document is shared. Most systems allow for the outside user to receive an automatic email notification that a new document was uploaded, removing the need for the attorney to notify the client to check the portal. For clients, these portals can also provide other useful information, such as calendar events for their matter, billing records and contact information for assigned attorneys and staff.
Additionally, portals can provide outside users the ability to share documents with the attorney or firm in a secure environment. Instead of clients using email or fax, they can easily upload their sensitive documents to the portal. The attorney and any staff assigned to that matter would then receive an email notification and an alert in the system itself. Finally, client portals provide a quick and seamless method for attorneys to eliminate access to any documents that have been shared outside of the firm by removing a person’s access to the portal.
As noted in a previous article on technology competence, “[s]ome courts have authored scathing reprimands of attorneys who have defended discovery misconduct with claims of computer illiteracy.”22 California’s Standing Committee on Professional Responsibility and Conduct issued an often-cited opinion in 2015 stating that an attorney’s “… obligations under the ethical duty of competence evolve as new technologies develop and become integrated with the practice of law. Attorney competence related to litigation generally requires, among other things, and at a minimum, a basic understanding of, and facility with, issues relating to e-discovery, including the discovery of electronically stored information (‘ESI’).”23
An attorney who is competent in investigating a case should also be concerned with collecting data in such a way that it can be used as evidence in subsequent litigation. One of the key barriers to admission of potential social media evidence has been authentication. However, with the December 2017 implementation of Federal Rule of Evidence 902(14), there is a distinct advantage in using web-based technologies to not only discover social media evidence but to capture it through means that will facilitate authentication.
FRE 902(14) provides:
The following items of evidence are self-authenticating; they require no extrinsic evidence of authenticity in order to be admitted.
(14) Certified Data Copied from an Electronic Device, Storage Medium, or File. Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification…
Printing a social media post would not qualify as “a process of digital identification,” but tools such as X1 Social Discovery,24 SMI25 and Page Vault26 can not only assist with the discovery of potential social media evidence but also provide a process for digital identification (by the collection of metadata)27 which would permit self-authentication with an affidavit from qualified individuals.
Another area where the benefits of web-based services may be implemented is legal research. Westlaw and Lexis have provided web-based services for so long that they are often not even considered “cloud computing” services. However, as the use of folders on both systems has continued to expand along with the development of folder analysis on Westlaw Edge,29 more attorneys are storing work product via these research platforms and sharing research with co-counsel and clients via system features. Further, use of web-based research tools has the benefit of ensuring that research materials are updated and provide citator services allowing attorneys to check the status of cases and statutory authority. Westlaw Edge integrates artificial intelligence (AI) technology to provide additional information regarding the status of laws and cases with a new KeyCite warning which suggests when “law that has been indirectly overturned.”30
The Fastcase legal research system has been a member benefit of the Oklahoma Bar Association since January 2007. The advantages of using the web-based Fastcase legal research platform, as noted by Ed Walters, CEO of Fastcase, include:
citation analysis, data visualization, mobile apps, and big data analysis to help lawyers identify the seminal cases in their area – to find them fast and with confidence. Forecite uses patent-pending citation analysis to find cases that keyword searches miss. Fastcase 7 includes new analytical tools, such as an enhanced Bad Law Bot, the world’s first big data tool to identify negative case history, and a tag cloud that identifies legal concepts hidden in search results.31
Another benefit of using web-based legal research tools is the availability of legal analytics. Some go so far as to conclude that “legal decisions in the future will be made with data. Not all at once, but starting now, and increasing every year from here forward. This is not controversial – it is malpractice to think otherwise.”32 Others take a more positive approach and emphasize the benefits of legal analytics for litigation (and negotiation) planning and strategy, as well as pricing and budgeting.33
For example, Picture It Settled is a web-based tool that has “aggregated negotiation statistics and built a predictive platform.”34 Lexis Advance Context is a feature that launched in November 2018 and is based on Ravel Law, which was acquired by Lexis in 2015. It provides an analysis of the language of opinions authored by judges to identify cases and arguments the judge finds persuasive.35 Context does this for not only federal judges, but also some state court judges, including select Oklahoma judges. Westlaw Edge added Precedent Analytics in 201936 that performs a similar function. Bloomberg Law also provides docket-based litigation analytics that are useful in litigation planning and addressing client expectations, Context provides the additional opinion language analysis. Use of cloud-based practice management software to collect data to make effective pricing determinations for alternative billing arrangements can also provide a competitive advantage to small firms.
Certain types of legal services are becoming more commoditized. Does commodity pricing mean that the price of legal services has to trend to zero? No, but it does mean that lawyers will have to differentiate their services … In a competitive market, clients will insist on fixed-fee engagements, and lawyers who offer them (and who price them correctly) will be the most competitive in this environment ... The key to pricing fixed-fee engagements lies with data … More experienced lawyers and firms may be able to access some of the most important information from their practice management or billing software …37
AI IS A CLOUD-BASED SERVICE: LEGAL RESEARCH AND BEYOND
AI is a revolutionary, cloud-based service that can reshape and augment how attorneys do their work. In fact, the recent development of networked computation (aka, the cloud), is part of what has led to the recent boom and realization of AI technology. Today’s AI is nothing like its predecessors. It is also nothing like the AI of science fiction. Instead of a machine overlord, AI instead plays an augmenting role for attorneys to automate their services. AI is fueling advances in legal research, as well as other areas of legal work, including litigation document drafting and due diligence reviews.
ROSS Intelligence and Casetext are two AI-fueled legal research services that provide different options for AI to assist attorneys. Leveraging AI, ROSS allows for question and answer style legal research. An attorney simply asks ROSS a question and then ROSS goes through what is essentially a three-step process – understanding, retrieval and ranking38 – to provide the attorney with a variety of relevant passages from cases. The ranking element is actually the most important part of the process, where the AI system 1) leverages its training (through machine-learning) to actually read passages of cases to 2) find meaning in the grammatical structure of the passages it is reading and then 3) creates word-based relationships to create syntax and word patterns that would help answer the question. Finally, through the ranking process, ROSS then attempts to match the facts and procedural posture of the attorney’s case with the research results, creating contextual results depending on the needs of the attorney.39
Casetext announced the newest iteration of their AI-assisted legal research service, CARA.AI, in May 2018. Similar to a service from ROSS called EVA,40 CARA.AI creates context-aware legal research based on legal briefs and work-product uploaded by the attorney into the system. After uploading the brief, CARA.AI then provides brief-specific, context-aware legal research that customizes your legal search and results based on the facts and legal issues actually discussed in the brief. With this kind of tool, attorneys can perform research faster, more efficiently and with better results.41
AI can actually do more than just augment legal research. LaxGeex recently identified 11 areas of law practice, including legal research, where AI tools currently exist to augment attorneys’ work.42 Of these categories, most AI tools are assisting attorneys in recognizing patterns in data and with decision-making. There is one service, launched in 2018, that takes AI in law practice to the next level. LegalMation43 is a first of its kind AI system that can actually draft legal documents for you with its Complaint or Discovery Analyzer solutions. Leveraging IBM’s Watson, LegalMation’s Complaint Analyzer will actually draft an answer to a complaint, together with all potential affirmative defenses, based on the causes of action and facts pleaded in the complaint.44 Likewise, the Discovery Analyzer, which is currently in beta, will read through discovery requests, such as requests for production and interrogatories, and then draft shell discovery responses, including objections using its SmartObject feature.45 LegalMation’s services are only available in limited jurisdictions at the moment, including California, New Jersey and Texas, but LegalMation has shown that AI can actually start drafting documents, which can be an incredible help for over-worked, deadline-driven attorneys. Casetext has also hinted that AI-assisted drafting is part of its “roadmap” for future services.46
While there are certainly risks associated with employing web-based technologies, it is equally important to understand the benefits that can be reaped from the use of these technologies as part of maintaining competence and delivering the best legal services to clients. In the current environment, clients are demanding that all businesses, including their lawyers, take advantage of developing web-based technologies. It is impossible to be an expert on every new technology, but to comply with their ethical duty of technology competence lawyers should develop at least a familiarity with web-based technology tools and act reasonably when gathering information about adopting tools that could benefit their practice.
ABOUT THE AUTHORS
Darla Jackson is a research librarian at the OU College of Law. She previously served as a practice management advisor for the OBA and as a judge advocate in the U.S. Air Force. She is an ABA TECHSHOW speaker and a graduate of the OU College of Law and School of Library and Information Studies.
Kenton Brice is the director of Technology Innovation at the OU College of Law. A 2009 graduate of the OU College of Law, he teaches courses and workshops on legal research, technology in practice and legal innovation at the college and multiple conferences, including the OBA Solo & Small Firm Conference.
1. Model Rules of Prof’l Conduct r. 1.1 (Am. Bar Ass’n 2012), //www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/comment_on_rule_1_1/.
2. In Re Oklahoma Rules of Professional Conduct, 2016 OK 91, //www.oscn.net/applications/oscn/DeliverDocument.asp?citeid=479331.
3. Robert J. Ambrogi, “35 States Have Adopted the Duty of Technology Competence,” LawSites (n.d.), //www.lawsitesblog.com/tech-competence/.
4. See, e.g. Tad Simons, “For a Lawyer, What Does ‘Technology Competence’ Really Mean?,” Legal Executive Institute (April 20, 2018), www.//legalexecutiveinstitute.com/lawyers-technological-competence/; Tyler Roberts, “What Is A Lawyer’s Duty Of Technology Competence?,” SmartLawyer (Fri, 02/02/2018 - 11:29am), //www.nationaljurist.com/smartlawyer/what-lawyers-duty-technology-competence; Steven M. Puiszis, “A Lawyer’s Duty of Technological Competence,” //www.americanbar.org/content/dam/aba/events/professional_responsibility/2017%20Meetings/Conference/conference_materials/session4_information_governance/puiszis_lawyers_duty_technological_competence.authcheckdam.pdf.
5. Gina Hendryx, “Recently Adopted Changes to the ORPC,” 88 Okla. B. J. 1747 (2017).
6. Alexandra G. Ah Loy, “The Attorney’s Ethical Duty to Maintain Technological Competence,” Okla. B. J. December 2018, at 15,16.
7. Gina Hendryx and Jim Calloway, “Cyber Ethics in the Digital Age” at the 2018 OBA Solo & Small Firm Conference (June 23, 2019) (Session materials on file with authors).
8. State ex rel. Oklahoma Bar Ass’n. v. Oliver, 2016 OK 37, 369 P.3d 1074 (Subsequent proceedings at 2018 OK 95), //www.oscn.net/applications/oscn/DeliverDocument.asp?CiteID=483376.
9. State ex rel. Oklahoma Bar Ass’n. v. Oliver, supra note 8, at ¶15.
10. In December 2018, Mr. Oliver resigned pending disciplinary proceedings regarding complaints unrelated to his technological competence. State ex rel. Oklahoma Bar Ass’n. v. Oliver, 2018 OK 95.
11. State ex rel. Oklahoma Bar Ass’n. v. Oliver, 2018 OK 95.
12. Legal Cloud Computing Ass’n, //www.legalcloudcomputingassociation.org/about/ (last visited Jan. 25, 2019).
13. SaaS is shorthand for “Software as a Service.” This is an alternative name for a cloud-based service.
15. Among many uses of carrier pigeons, Paul Julius Reuter (of Thomson Reuters fame) at one time used carrier pigeons to transmit stock prices. “CHRONOLOGY: Reuters, from pigeons to multimedia merger,” Reuters (Feb. 19, 2008), www.reuters.com/article/us-reuters-thomson-chronology/chronology-reuters-from-pigeons-to-multimedia-merger-idUSL184910062008021916. Most modern email is cloud-based too. If you are using Gmail, Yahoo.com or other “hosted” service, you are using the cloud.
17. ShareFile Security and Compliance Frequently Asked Questions, Citrix, //www.sharefile.com/resources/citrix-sharefile-security-and-compliance-frequently-asked-questions (last visited Jan. 25, 2019).
18. For more information about using cloud-based storage safely, check the LCCA standards.
19. Carmen Reinicke, “The Biggest Cybersecurity Risk to US Businesses Is Employee Negligence, Study Says,” CNBC (June 21, 2018), www.cnbc.com/2018/06/21/the-biggest-cybersecurity-risk-to-us-businesses-is-employee-negligence-study-says.html20. Egnyte, //www.egnyte.com/ (last visited Jan. 25, 2019).
21. “Sharing with File/Folder Links in Egnyte,” Egnyte Community, //helpdesk.egnyte.com/hc/en-us/articles/201637104-Sharing-Files-in-Egnyte#settings (last visited Jan. 25, 2019).
22. Alexandra Ah Loy, supra note 6, at 16.
23. State Bar of Cal. Standing Comm. on Prof’l Responsibility & Conduct, Formal Op. 2015-193 (2015), available at www.calbar.ca.gov/Portals/0/documents/ethics/Opinions/CAL%202015-193%20%5B11-0004%5D%20(06-30-15)%20-%20FINAL.pdf.
24. X1SocialDiscovery, //www.x1.com/products/x1-social-discovery/ (last visited Jan. 25, 2019).
25. SMI, //smiaware.com/ (last visited Jan. 25, 2019).
26. Page Vault, //www.page-vault.com/ (last visited Jan. 25, 2019).
27. U.S. Library of Congress, Sustainability of Digital Formats, www.loc.gov/preservation/digital/formats/fdd/fdd000236.shtml (last visited Jan. 25, 2019).
28. A distinction between legal research and legal analytics has been discussed. See, e.g. Owen Byrd, “Legal Analytics vs. Legal Research: What is Difference?,” Law Technology Today (June 12, 2017), //www.lawtechnologytoday.org/2017/06/legal-analytics-vs-legal-research/. However, for purposes of this short piece, the topics will be discussed with limited treatment of the distinction.
29. “Westlaw Enhancements,” Thomson Reuters, store.legal.thomsonreuters.com/law-products/westlaw-legal-research/enhancements#folder-enhancements.
30. Jean O’Grady, “Thomson Reuters Launches Precedent Analytics to Challenge Lexis Context (formerly Ravel Law),” Dewey B Strategic Blog (Jan. 28, 2019), //www.deweybstrategic.com/2019/01/thomson-reuters-launches-precedent-analytics-challenge-lexis-context-formerly-ravel-law.html. Also see, Jason Tashea, “Thomson Reuters Announces Westlaw Edge, increasing role of AI and analytics,” ABA Journal (July 12, 2018), //www.abajournal.com/news/article/thomson_reuters_announces_westlaw_edge_increasing_role_of_ai_and_analytics/.
31. Ed Walters, “The Tyranny of Hunches: Using Analytics to Give Your Firm a Strategic Advantage,” Florida Bar Journal, January 2016, at 46, 47, //www.floridabar.org/the-florida-bar-journal/the-tyranny-of-hunches-using-analytics-to-give-
32. Ed Walters, supra note 28, at 46.
33. David Curle, “Take Your Small Law Firm to The Next Level by Leveraging Legal Data Analytics,” Above the Law (Aug. 9, 2018), //abovethelaw.com/small-firm-center/2018/08/take-your-small-law-firm-to-the-next-level-by-leveraging-legal-data-analytics/.
34. R. Amani Smathers, “The 21st-Century T-Shaped Lawyer,” Law Practice, July/August 2014, at 32,35.
35. Bob Ambrogi, “‘Context,’ Launching Today from LexisNexis, Applies Unique Analytics to Judges and Expert Witnesses,” LawSites, (Nov. 29, 2018), //www.lawsitesblog.com/2018/11/context-launching-today-lexisnexis-applies-unique-analytics-judges-expert-witnesses.html.
36. Thomson Reuters announced the release of Precedent Analytics that includes information about which cases judges cite to most often by topic. Jason Tashea, “Westlaw Edge Adds Judicial Citation Analytics,” ABA Journal (Jan. 28, 2019), //www.abajournal.com/news/article/westlaw-edge-adds-judge-analytics/.
37. Ed Walters and Morgan Morrisette Wright, “The Decision Advantage - Making Small Data Work for Your Firm,” Okla. B. J., May 2018, at 32, 34, www.//okbar.org/barjournal/may2018/obj8913walterswright.
38. A Visual Guide to AI, Ross, (last visited Jan. 25, 2019).
40. Meet Eva, Ross, 41. Jean O’Grady, “CARA AI: Did Casetext Just ‘Drop Kick’ Keywords Out of the Legal Research Process?” Dewey B. Strategic Blog (May 1, 2018), //www.deweybstrategic.com/2018/05/cara-ai-casetext-just-drop-kick-keywords-legal-research-process.html.
42. “3 charts that show the unstoppable growth of Legal Tech,” LawGeex Blog (May 22, 2018), 43. Legalmation, //www.legalmation.com/ (last visited Jan. 25, 2019).
44. Alison Arden Besunder, “Not Your Parents’ Robot,” N.Y St.B.A.J., Mar/Apr 2018, at 20, //www.nysba.org/Journal/2018/Apr/Not_Your_Parents’_Robot/.
45. Gabrielle Orum Hernández, “New Beta LegalMation Module Can Draft Discovery Response Documents,” LegalTechNews (July 16, 2018), //www.law.com/legaltechnews/2018/07/16/new-beta-legalmation-module-can-draft-discovery-response-documents/ (with subscription).
46. O’Grady, supra note 40.