This document discusses the ethics of cloud lawyering. It begins with an overview of cloud computing and the different types of cloud services. It then discusses the main ethical concerns related to using cloud services for legal work, including maintaining competence and protecting client confidentiality according to rules of professional conduct. It provides examples of relevant rules. The document then discusses how lawyers can evaluate cloud vendors to ensure they are properly protecting client data and privacy. It provides questions lawyers should ask vendors about security, access controls, encryption, data location, and responses to legal demands for data. Finally, it discusses factors lawyers should consider when choosing between free/low-cost versus paid/enterprise cloud services.

1. The Ethics of Cloud Lawyering
Yaacov Silberman, Rimon, P.C.
Date: August 10, 2011

2. Yaacov Silberman
•Director of Operations at Rimon
•Debt Finance Group at Ropes &
Gray, LLP
•Assistant Director (Web Content)
at TheLaw.com
•University of Pennsylvania Law
School (J.D.)
•Yeshiva University (B.A.)
•Casual Geek

3. What is “Cloud
Computing”?
What are the ethical
concerns?
✤Rules of Professional
Conduct
✤State Bar Opinions
How do I evaluate a
vendor?

4. e Cl oud?
hat is th
1.W

5. Cloud Computing Pyramid

6. Infrastructure
Cloud Computing Pyramid

7. Platform
Cloud Computing Pyramid

8. Application
Cloud Computing Pyramid

9. 2. Ethical Concerns

10. COMPETENCE

11. COMPETENCE
MRPC 1.1: A lawyer shall provide
competent representation to a client.
Competent representation requires the
legal knowledge, skill, thoroughness
and preparation reasonably necessary
for the representation.

12. COMPETENCE
MRPC 1.1: A lawyer shall provide
competent representation to a client.
Competent representation requires the
legal knowledge, skill, thoroughness
and preparation reasonably necessary
for the representation.
CA Rule 3-110. Failing to
Act Competently.
(A) A member shall not
intentionally, recklessly, or
repeatedly fail to perform
legal services with
competence.

13. Confidentiality

14. Confidentiality
MRPC 1.6 (a): A lawyer shall
not reveal information relating to
the representation of a client unless
the client gives informed consent,
[or] the disclosure is impliedly
authorized in order to carry out the
representation . . . .

15. Confidentiality
MRPC 1.6 (a): A lawyer shall
not reveal information relating to
the representation of a client unless
the client gives informed consent,
[or] the disclosure is impliedly
authorized in order to carry out the
representation . . . .
CA Rule 3-100.
Confidential Information of
a Client.
(A) A member shall not
reveal information protected
from disclosure by Business
and Professions Code section
6068, subdivision (e)(1)
without the informed
consent of the client . . . .

17. THE STATE BAR OF CALIFORNIA
STANDING COMMITTEE ON
PROFESSIONAL RESPONSIBILITY AND
CONDUCT
FORMAL OPINION NO. 2010-179
Does an attorney violate the duties of
confidentiality and competence he or she owes to
a client by using technology to transmit or store
confidential client information when the
technology may be susceptible to unauthorized
access by third parties?

18. THE STATE BAR OF CALIFORNIA
STANDING COMMITTEE ON
s
PROFESSIONAL RESPONSIBILITY AND
d
CONDUCT
n
FORMAL OPINION NO. 2010-179
e p e
Does an attorney violate the duties of
D
confidentiality and competence he or she owes to
I t
a client by using technology to transmit or store
confidential client information when the
technology may be susceptible to unauthorized
access by third parties?

19. Exercise Caution

20. Credit: Mike Johnson -
TheBusyBrain.com

21. Credit: Mike Johnson -
TheBusyBrain.com

22. Credit: Mike Johnson -
TheBusyBrain.com

23. What
precautions
can I take?
Who can
access my
data?

24. Credit: BFIShadow

25. Ask for Help

27. Date

29. An Urgent Situation

30. 3. Evaluating Cloud
Vendors

31. VENDOR

32. VENDOR
Security

33. VENDOR
Security
Privacy

34. VENDOR
Security
Privacy
Physical Application
Security Security

36. VENDOR
Security
Privacy
Physical Application
Security Security

37. https://

38. VENDOR
Security
Privacy
Physical Application
Security Security
https://

39. VENDOR
Security
Privacy
Physical Application
Security Security
https://

41. I n t he e v e n t T h e mis Solution s In c.
goes t h r ou g h a bus in es s tr a n s ition ,
s uc h as a me r ge r , acq uisition b y
an ot h e r c omp an y, or sa le of a ll or a
po r t io n o f it s as s e ts , y our p e r s on a lly
id ent i fi ab l e in f o r mation will like ly
be am o n g t h e a s s e ts tra nsferred. You
w il l be n ot if i e d v i a e mail a n d a
no t ie ia ma il
pr o mi ne n t n o t ic e on our We b s ite for
30 da ys o f an y s uc h ch a n ge in
ow n er s hi p o r c o n t rol of y our
pe r s o n al in f o r mat ion .
- Cl io P ra ctice M an a gemen t

42. Free/Low Cost Paid/Enterprise
Storage
/Sharing
Backup

43. Free/Low Cost Paid/Enterprise
Storage
/Sharing
“Dropbox cooperates with government and law enforcement
officials and private parties to enforce and comply with the
law. We will disclose any information about you to
Backup government or law enforcement officials or private parties as
we, in our sole discretion, believe necessary or appropriate to
respond to claims and legal process (including but not limited
to subpoenas)”

44. Free/Low Cost Paid/Enterprise
“Decho does not disclose Personal Data,
Storage including the data you back up with the Service,
unless disclosure is necessary to comply with an
/Sharing enforceable government request such as a
warrant.”
Backup

45. Free/Low Cost Paid/Enterprise
Storage
/Sharing
“. . . the receiving party will (a) use such Confidential Information
solely for the purposes for which it is provided; (b) not disclose such
Confidential Information to any third party; . . . The foregoing will
Backup not apply to any use or disclosure that is (i) required by applicable
law, legal process or governmental authority, provided that the
receiving party uses reasonable efforts to notify the disclosing party
of the required disclosure and cooperates in obtaining a protective
order to limit such disclosure . . . .

46. Free/Low Cost Paid/Enterprise
Storage “SOS cannot access data stored with UltraSafe
even under a Court order; the data is encrypted
/Sharing and the correct password must be supplied to
access the data.”
Backup

47. Free/Low Cost Paid/Enterprise

48. Free/Low Cost Paid/Enterprise
If you have a Free Account, Mozy may terminate your
account and these Terms immediately and without
notice if your computer fails to access the Services to
perform a backup for more than thirty (30) days or
you fail to comply with these Terms.

49. Free/Low Cost Paid/Enterprise
The Licensor may cancel the Subscriber’s Service with
or without cause upon thirty (30) day’s prior written
notice given by the Licensor by at least two emails sent
to the Subscriber at the Subscriber’s address as shown
in the Subscriber’s account details.

50. Let’s Recap

51. Let’s Recap
=

52. Let’s Recap
=

53. Let’s Recap
=

54. Let’s Recap
=

55. Let’s Recap
=

56. Yaacov Silberman, Rimon Law Group Www.rimonlaw.com Info@rimonlaw.com