Publications

Illinois Bar Journal

The Magazine of Illinois Lawyers

April 2012Volume 100Number 4Page 188

April 2012 Illinois Bar Journal Cover Image

Legal Technology

Taking Your Practice to the Cloud

By
Maria Kantzavelos

Wouldn't it be great to access case files from your laptop while tagging along on your spouse's business trip? Or store essential documents where no fire, flood, or tornado can reach them? Guess what? You can, and here's how.

Naperville attorney Bryan M. Sims doesn't necessarily mind putting in long hours, so long as he's not confined to the office.

He may take off on an occasional afternoon to catch his son's basketball game and return to his work later that night from home. Or, Sims said, "If my wife travels on business and I want to go with her - when she's working I'm working."

That's because Sims of Sims Law Firm, Ltd., who focuses his practice on commercial litigation and civil appeals, can work from anywhere, as long as he has an Internet connection.

Find out more, earn CLE credit

To view and listen to a complete cloud-computing presentation, take advantage of ISBA's FastCLE capability by visiting http://isba.fastcle.com and following the 2011 Solo and Small Firm Conference link (the program is "To the Cloud: Using Cloud-Based Storage"). With just a couple of mouseclicks, you can not only learn more about cloud computing but also get approved CLE credit.

Sims, a former chairman and current member of the Illinois State Bar Association's Standing Committee on Legal Technology, said he already had all his case files digitized and stored on his primary computer - a laptop - when he decided a year and a half ago to take the next step toward running "as paperless of an office you can run in the legal world."

That's when Sims gave those files another home in the so-called cloud, storing them amid the vast network of web servers and data centers that power today's World Wide Web.

"I don't want to sit at my desk 60 hours a week," Sims said. "I may work 60 hours a week, but I don't want to be at my office."

"I moved to the cloud mainly for accessibility reasons, so that I could access my documents even if I didn't have my computers on me," Sims said. "If I'm in court and I have to pull up a document, I can literally access it on the cloud through my smartpad or iPhone.…If I need to look at a prior court order or a pleading, I can pull out my smartphone, pull up my case file, and retrieve the document I want to look at."

"[T]his is where technology is moving"

Sims is not alone. The emergence of an increasing number of cloud-based - or online - data storage offerings such as Dropbox, Mozy, SpiderOak, and iCloud is providing the accessibility to work product that many attorneys want: the ability to retrieve a case file, a brief, a memo or any other data anytime and anywhere.

With the cloud option, instead of - or, along with - storing information to a computer's hard drive or other local storage device like thumbdrives or compact discs, the user saves it to a remote database leased by companies like Amazon, which owns huge server space. The cloud service provider then leases server space to people to do with as they want. The Internet provides the connection between the user's computer and the database.

In a profession that has become more mobile, many lawyers are turning to cloud tools in their day-to-day practice, said attorney Nerino J. Petro, Jr., the practice management advisor for the Law Office Management Assistance program of the State Bar of Wisconsin and a member of the ISBA's Standing Committee on Legal Technology.

"More lawyers are using it," Petro said. "The idea is that, as we become more and more mobile, accessibility to our documents becomes even more important."

And most of the new vendors featured nowadays at tech shows for lawyers are showcasing cloud products that cater to the mobile attorney, said Joshua J. Poje, attorney and research specialist with the American Bar Association's Legal Technology Resource Center.

"Firms have to do what's right for their practice, and every practice is different. It won't necessarily be the best solution for every firm," Poje said. "But they have to face the fact that it seems this is where technology is moving. It seems everything is cloud. It's something that can't be avoided."

Making collaboration easier

With a cloud system, Poje said, users can back up electronic files, including email and Word documents, in remote secure data centers accessed via the Web, as compared to the traditional mode of backing up files on an external hard drive attached to the computer or a backup server attached to a firm's local network.

Some online storage tools include document management services that allow a user to organize, tag, search, and create versions of individual documents. And many cloud products also give the user the ability to allow other people to access certain stored data, making it convenient for an attorney working with co-counsel on a case, or with fellow colleagues on drafting and revising the same document.

"Imagine the nightmare that we go through when we are bouncing a document back and forth through email," Poje said in a presentation entitled "To the Cloud: Using Cloud-Based Storage," which he delivered last October during the 7th Annual ISBA Solo and Small Firm Conference in Springfield. "We've got track changes turned on, and by the fourth or fifth time the file's bounced between us it's completely illegible. You open it up and it's 10 different colors, everything's underlined and struck out, and it's completely useless.

"A collaboration tool is going to help you avoid that. [Instead of putting the document] in your inbox, it's going to put it online in a single location. You make changes and it's saved right there so that the other user can access the document, so that instead of a dozen versions of the document bouncing around an inbox, you have a single version."

While lawyers who've embraced cloud storage point to accessibility as one of the benefits of such a move, these online offerings are also considered a cheaper alternative to the traditional mode of backing up data, making it an attractive option for solo practitioners and small-firm lawyers, legal technology experts say.

Data is more, not less, secure

Importantly, online storage systems can serve as an extra layer of security for data already backed up on hard drives.

"I'm big on backups," Sims said. "I think you have to have a system: two local backups, and one cloud-based, or internet backup, in case your city is wiped off the face of the earth ala Katrina."

Sims said he still runs into attorneys who vow to never put their information in the cloud for fear that someone else will get to it.

"They think, 'Oh no - it's the Internet, so that's not secure,'" Sims said. "But they never think twice about sending that same information to the copy center to be copied, or leaving it in their file room that's unlocked and the janitorial staff, if they wanted to, could rifle through their file.

"The reality is that in all likelihood the information [stored in the cloud] is more secure on somebody else's server than it is on either your own server in your office, or in paper files in your office," Sims said. "These data centers, they're generally undisclosed, unmarked stations. They have armed guards, [employees] have ID badges with RFIDs [tracking systems] on them. They're designed to keep all the information safe and secure. I've never seen an attorney's office like that, and I probably wouldn't want to go to an attorney who had armed guards. These data centers are built to be secure."

Still, Sims said, one of the reasons he chose SpiderOak as his cloud product is that the service allows all of his information to be encrypted before it leaves his laptop, and encrypted on the provider's servers.

"There are other services where they have the ability to access your data," Sims said. "I like this better, where they would literally have to break my password in order to access my data. I get more comfort from that as an extra layer of security."

Making back-up better

Indeed, Dennis A. Rendleman of the ABA's Center for Professional Responsibility said, there are risks no matter how much caution you exercise and no matter where you decide to store your records. (See sidebar for more on the ethical implications of cloud computing.)

"The Pony Express rider could get held up, too," Rendleman said. "That's why you have to take steps to preserve or to minimize as much risk as possible.

"That's why we back up computers, and that's why we try and probably have greater security with our electronic data than we do with physical data. If a building burns down and all you've got is the paper file, people used to be totally out of luck. Now, if a building burns down and the information is backed up on the cloud, too, the information is even more protected."

Poje agrees.

"There's recognition lately that disaster preparedness is a reality," Poje said in an interview. "You can worry about the ethics of putting your data in the hands of a third party, but at the same time you have to worry about the concerns of not taking sufficient steps to safeguard your data.

"If you have your data sitting on a computer and it's not backed up and your office floods, it could be just as disastrous as having your data mishandled by a third party."

He cited findings from the ABA's 2011 Legal Technology Survey Report revealing that the percentage of lawyers who experience a hard drive failure is relatively high.

According to the report, Poje said, 43 percent of attorneys surveyed overall said they had a hard drive failure. Of the solo practitioners surveyed, 49 percent answered yes to that question, and 51 percent of attorneys at small firms of two to nine attorneys reported a hard drive failure.

In response to a question about backup strategy, Poje said, the percentage of attorneys surveyed who said they don't back up is fairly low.

"Three percent of solos say they don't back up," Poje said. "But then at the breakdown, 13 percent are only backing up monthly, and 3 percent are only backing up quarterly," Poje said. "Think about the amount of work you produce in a month. Monthly [backup] is insufficient. There are some representations that don't last a month - you could lose everything for a client."

Poje recommends that firms back up their electronic data daily, in more than one way, with geographic redundancy.

"There's always a chance that the external hard drive fails," Poje said. "You don't do yourself any benefit if the laptop that sits at your desk at work is with the external hard drive sitting next to it. You should have your data 50 to 100 miles away in a perfect world, and the cloud makes that very easy to do."

Hard-drive = house, cloud = condo

To describe how the cloud works, Poje told those gathered for his presentation during the ISBA conference last fall that he likes to use the analogy of thinking of the cloud versus traditional software as the difference between buying a house and buying a condo or renting an apartment.

"The house serves in the role of a traditional software," Poje said. "When you buy a house…it's really yours and you have control over it. You may have some regulations about exactly what you can do. But for the most part you can paint it, you can put out Halloween decorations if you want, you can landscape it however you want. You have a lot of control, and you have control over what happens on the inside as well, about how you configure it, what kind of appliances you install - all that sort of good stuff."

Traditional software is similar in that regard, in terms of the control, Poje said.

"You go to the store, you buy yourself a piece of traditional software, you take it to your office or to your home and you can install it on your computer and you have control over it," he said. "You could configure it however you want, you can install it and uninstall it at will. It's yours - you can do what you want with it. You have a license to use it, but you have a pretty broad spectrum of what you're able to do."

Compare this, on the other hand, with the cloud or with, in Poje's analogy, an apartment or condo.

"When you buy a condo you get a lot of benefits, there's a lot of good things that go along with it," Poje said. "You get a shared architecture, so if there's a leak in your roof you call the condo maintenance association and they take care of it. You don't have to worry about mowing the lawn or plowing the walk.

"You still have a fair amount of control - you can paint your walls however you like, you probably have some control over how the interior of your condo is configured. But you're not going to be able to add square footage, and there are going to be lots of restrictions on what you can do."

Like a house, which in terms of architecture is singular and separate, traditional software is installed on your computer. The cloud, on the other hand, works like a condo, a large building with lots of little units inside of it.

"It's a big server somewhere, a set of servers, in a data center," Poje said. "Within that big server, and that big singular application, there's lots of little user accounts. That's your account, and that's the [account for] the person sitting next to you, and you're all inside of there together."

When talking about cloud storage and specifically putting data online, perhaps the better analogy is a basement in your home where stuff tends to accumulate, Poje said.

That cluttered basement can be likened to a hard drive that you keep plugged into your computer, Poje said, "Where you maybe don't organize it as well as you should; you just kind of throw things in there whenever you feel like you need to back up. Or, maybe you started with really good intentions, and you were organized. You put in some shelves and then everything fell apart, and you're just dumping it all in."

The cloud, however, is more like the standard public storage facility, Poje said.

"It's a big building that people have sort of shared use of. Within the building you get your own storage unit, which is yours to do with mostly what you please within a set of rules," he said. "With a basement, you can go in and in theory expand your basement. … You can't do that much with the storage facility; you take what you're given.

"Cloud is sort of the same way. When you get a cloud service for data storage, you take what you're given. You don't have that much control over whether or not to make updates or changes to the way it works."

Poje acknowledged that his analogy is imperfect in four distinct ways: Traditional storage units, he said, are not terribly secure ("anybody with a set of bolt cutters and time on their hand can sneak in and make off with your stuff"); they're vulnerable to disasters like major floods, fires or tornados; they're not terribly convenient when you have to drive across town during the facility's hours of operation and remember the code to access your unit "in order to lay your hands on something quickly." And, at a time when people are moving into a digital world, Poje said, "Keeping big storage lockers are outdated."

But those four elements can be flipped around to become advantages when talking about the cloud, Poje said.

No more "I'm technologically illiterate" excuse

It's the idea of putting your client data in someone else's hands and not having control over that provider's terms of service that leaves some attorneys reluctant to take the leap to the cloud - "not having the technological expertise to know if you're using a secure service," Poje said.

As such, Poje said, some self-education is important in keeping in compliance with another of an attorney's professional responsibilities: the duty under Rule 1.1 of the ABA Model Rules of Professional Conduct to provide competent representation, which requires the legal "knowledge, skill, thoroughness and preparation reasonably necessary for the representation." Under the competence rule, an attorney's obligation to have the requisite knowledge and skill applies to keeping on top of changes in the law and in changes in the practice, which includes the integration of technology into the practice, Poje said.

"It's just a reality that technology is part of the practice of law now. The days when you could say, 'I'm technologically illiterate' - those days are faded," Poje said. "Lawyers have to take some time to learn about technology. It's doesn't require you to be an expert, you just need to ask the right questions.

"You don't need to be able to build your own online backup system. If you did you wouldn't be looking at a third party to do it," Poje said. "But you do need to be able to understand the basic concepts, and you do need to have some of the basic vocabulary so you can make an informed decision about what's a good service and what's a bad service."

As should be the case with any technology tool, some due diligence should come into play before making a move to the cloud, Petro said.

"You can't just pick out a company out of thin air, you need to do a little research," Petro said. "You need to take a look at and consider things such as who has access to the data, who owns the data once you put your documents up."

By choosing a service provider that allows the user alone to set and hold an encryption key to those documents stored in the cloud, Petro said, "it doesn't make any difference if that service provider gets served with a subpoena or not. Without the encryption password, nobody is going to get access to those documents."

The New York ethics opinion discussed in the sidebar goes on to say that "technology and the security of stored data are changing rapidly. Even after taking some or all of these steps (or similar steps), therefore, the lawyer should periodically reconfirm that the provider's security measures remain effective in light of advances in technology."

If you're thinking of turning to the cloud, whether it's for the extra layer of security in safekeeping your files, or for the convenience factor of having access to your work anywhere and anytime, Poje said, "You have to understand the technology that you're shopping for and going to use in your practice; you need to make a serious evaluation of the provider of that technology; you should definitely have some sort of confidentiality agreement in place, whether it's a negotiated agreement between you and the vendor or if it's a good policy that the vendor has in general and you should take steps to preserve confidentiality; and, finally, you need to reevaluate periodically.

"It's not a static decision," Poje said. "Technology evolves; ethics opinions evolve. Take a clean look at this every now and then and see if you're still doing everything you should be doing to use cloud storage effectively and ethically."

It doesn't only take a natural disaster, like the devastating Hurricane Katrina in 2005 or the EF-4 tornado that swept through Harrisburg a few weeks ago, to wipe out a lawyer's important work product, as well as sensitive documents and client information needed for the practice.

For Naperville's Sims, who made the move to an all-electronic practice long ago, the incremental step he took to the cloud means he now worries less about the nightmare that could come with a hard drive crash, "simply because I know my stuff is being backed up constantly - in real time."

 

Maria Kantzavelos <mkantz@comcast.net> is a Chicago-based freelance writer focusing on legal topics.

Cloud computing and client confidentiality

Whether sensitive information is stored online or in a file cabinet behind your desk, you have a duty to safeguard a client's confidentiality.

The notion of having access to your work product and case files even if your own computer's hard drive - and the records you had stored there - were destroyed by a fire or flood, or disappeared in a burglary, or even if you threw your computer out the window of your high-rise law office, may seem like a good enough reason for attorneys to take cover in the cloud.

But storing data on a remote, internet-accessible server requires turning over confidential client information and sensitive documents to a third-party and its employees. That requirement alone leaves some attorneys understandably hesitant to embrace cloud tools, given that one of an attorney's fundamental duties, spelled out in Rule 1.6 of the ABA Model Rules of Professional Conduct, is to safeguard a client's confidentiality, said Joshua J. Poje of the ABA's Legal Technology Resource Center.

"Obviously whenever you're talking about storing your data, whether it's locally or up in the web - especially in the web, because it's going into the hands of a third-party - you have to think about confidentiality issues," Poje said during the conference. "Who has that data? Who has access to that data? How secure is it?"

"There's always the question of: Sure it sounds great, it sounds convenient, but is it ethical to put my data online?"

Many ethics opinions issued by committees of bar associations around the country in recent years have addressed that question, including the Oregon State Bar's Formal Opinion No. 2011-188 (December 2011); Professional Ethics Committee of the Florida Bar Opinion No. 10-2 (2011); New York State Bar Association's Committee on Professional Ethics Opinion No. 842 (2010); Pennsylvania Bar Association Ethics Opinion No. 2010-060 (2010); North Carolina Bar Proposed 2011 Formal Ethics Opinion No. 6 (2011); and Iowa Committee on Practice Ethics and Guidelines Ethics Opinion No. 11-01 (2011).

While no such opinion has yet been issued in Illinois, Poje noted that the opinions from other states are generally consistent and provide guidance for attorneys here who may be concerned about the potential ethical ramifications associated with cloud storage.

 

The duty of reasonable care

A common requirement among the existing ethics opinions on the use of online data storage systems is that attorneys take reasonable care to ensure that confidentiality will be maintained in a manner consistent with the lawyer's obligations under Rule 1.6.

The ABA Commission on Ethics 20/20 last year looked into whether online storage of client information was an issue or not, and whether there needed to be any changes based on this newer method of storage of material, said Dennis A. Rendleman of Springfield and Chicago, who serves as ethics counsel in the Center for Professional Responsibility at the ABA.

"Frankly, the only thing that's really different is that it's a different technology," Rendleman said. "Certainly, from my perspective, the technology part of it doesn't change any of the fundamental obligations that an attorney has to protect client information."

The cloud, Rendleman said, "is a warehouse in the ether."

"Whether Anonymous tries to break into it or Anonymous tries to break into the storage shed really isn't that much different," Rendleman said. "Calling it the cloud instead of the box behind your desk doesn't change your obligation to protect the information that you've learned from your client, or to make sure that everyone else, whether they're lawyers or non-lawyers, in your firm understands the obligation to protect the client's information, and the obligation to make sure whomever you may contract with to store material understands that obligation, and the obligation to make sure that it's properly destroyed when it's time to purge the file.

"That means different things in different formats, but it really is the prime directive of preserving protected client information."

 

"Reasonable care" defined

So what does it mean to take reasonable care to ensure the security of confidential client information in the cloud?

According to the New York ethics opinion,

"Reasonable care" to protect a client's confidential information against unauthorized disclosure may include consideration of the following steps:

  • Ensuring that the online data storage provider has an enforceable obligation to preserve confidentiality and security, and that the provider will notify the lawyer if served with process requiring the production of client information;
  • Investigating the online data storage provider's security measures, policies, recoverability methods, and other procedures to determine if they are adequate under the circumstances; and
  • Employing available technology to guard against reasonably foreseeable attempts to infiltrate the data that is stored.

That last statement about guarding against attempts to infiltrate stored data, Poje said, could be a way of "dodging around the fact that you need encryption."

"Really, they're saying that you need some way of protecting, even if there is an infiltration," Poje said. "A lot of vendors will offer encryption on the data that's sitting on their servers. If they don't, you need to think about how you could provide that through a third-party tool."

- Maria Kantzavelos

Practicetech - ISBA's one-stop shop for practice technology

Visit www.isba.org/practicetech for links to software and other tech tools that can transform your practice.

When lawyer and accountant John G. Locallo took the helm of the ISBA last summer, a main goal for his term was to "assist Illinois attorneys in ramping up the use of technology to compete, become more efficient, and provide better legal service to the public," he told the Illinois Bar Journal in its July 2011 cover story.

Toward that end, Locallo and the ISBA recently unveiled a "one-stop shop" for legal technology products and services at www.isba.org/practicetech. There, attorney visitors can find links to downloadable tech tools - available to ISBA members either as a benefit included with membership or at a discount - that Locallo says can help them transform their practice and keep in synch with the rest of the digitized world.

The ISBA has been working on forming partnerships with a host of legal tech vendors as a means of helping members to "make wise choices and, in many cases, provide discounted services that can help you serve and reach clients more effectively," Locallo said.

Among the latest of the tools offered to ISBA members at a discounted price is Clio, a cloud-based practice management system designed to help solo practitioners and small-firm lawyers with such tasks as tracking time and billing, managing documents, avoiding conflicts, and meeting important deadlines.

Another of the ISBA's newly unveiled tech offering is CoreVault, a product that provides cloud-based, or online, backup and storage systems - meaning accessibility to electronic files from anywhere, at any time, and via virtually any device.

"We like it because it's been used by a lot of other lawyers nationwide, and several other bar associations have worked with them, too," Locallo said.

The ISBA's recent deal with Clio follows the examples of New York, Michigan and other state bars, which have similar partnerships with the same practice management service in the cloud.

CoreVault, too, has affinity agreements with the State Bar of Wisconsin, the Oklahoma Bar Association and others, Locallo said.

"The beauty of the cloud is, not only are you able to back up to a secure site, but clients expect information ASAP nowadays," Locallo said. "Whether you're at your client, or on the road, or in the courthouse, you have to be able to provide that, and the cloud does that through various services."

Another feature at the "one-stop shop" is LawPay, a credit card processing tool for attorneys that is said to safeguard and separate client funds into trust and operating accounts, preventing the commingling of funds. "More and more clients want to pay that way," Locallo said. "Whether it's convenient or it enables them to pay on credit, it's an easy way for all lawyers to collect their fees."

The ISBA also has found a vendor, ESQSites123.com, to help solo and small firm attorneys to develop or improve their websites at a reasonable cost. And plans are underway to develop guides to help lawyers tailor popular accounting programs like QuickBooks so they segregate IOLTA funds according to supreme court requirements.

In another step toward promoting the use of tech tools to help attorneys run a more efficient practice and free-up more time for them to counsel clients, Locallo said a project is underway to offer legal forms on a document assembly platform as a means of automating and systematizing document creation.

"We're in the process of starting to determine what committees to form in the various areas of law, to find out and agree on which would be the best forms we can offer, and which would be best to craft," Locallo said.

- Maria Kantzavelos


Login to read and post comments