Today Blawgletter again has the Great Honor of presenting Thoughtful Comments by an Eminent Lawyer on a Topic of High Interest. Ron Woessner — Senior Vice President and General Counsel of Zix Corporation — writes about what he sees as the incongruity between the American Bar Association’s approval of entrusting confidential communications to regular email as a matter of professional ethics and the legal, reputational, and other risks of that practice. Here you have his thoughts in their entirety:
Zeroes and ones again — more joy!On May 6, 2008, I guest-posted on Blawgletter a discussion of the 1999 opinion of the ABA’s Ethics and Professional Responsibility Committee. The opinion holds that an attorney may transmit confidential client information over the Internet via unencrypted email without violating the rules of professional responsibility. The basis for the ABA’s decision was that unencrypted email has a reasonable expectation ofp rivacy from a technological and legal standpoint — similar to the expectation of privacy for mail, phone, and facsimile communications.
The previous post asserts that the basis for the ABA opinion is no longer valid, given what we know today about the inherent privacy and security vulnerabilities of unencrypted email. Recent hacker attacks and legal developments further undermine the ABA Committee’s rationale and underscore that unencrypted email messages are potentially as vulnerable as a postcard to a third party’s prying eyes.
In July 2008, a description was published on the web of a technical flaw in domain name servers (DNSs) — the Internet computers that translate human-readable addresses (such as www.zixcorp.com) into machine-readable addresses (like the corresponding 63.71.15.25). The flaw opens DNSs to hacker attack. One of the many web articles on the subject (this one from Wikipedia) appears here.
The DNS flaw can be exploited, via a "cache poisoning attack," by hackers in either of two ways. First, hackers misdirect an Internet user’s browser to a rogue website that looks and feels like the legitimate website. For example, an Internet user may be attempting to navigate a bank website to use the personal banking feature; but, while the user believes she is visiting her bank’s website, the hacker is secretly capturing her user name and password information at the rogue site.
The second way hackers can exploit the DNS flaw involves email. DNSs translate the domain name of email addresses — the part following the @ — into computer-readable form. In this scenario,the hacker’s atack miscdirects email messages directed toward, say, xyzlawfirm.com to a rogue email computer server. The rogue then secretly copies the email messages before forwarding them to the intended recipient. Neither the email sender nor the addressee realizes that anything untoward has happened.
Unencrypted email messages are also vulnerable to other well-documnted hacker attacks. A discussion of these additional dangers are beyond the scope of this blawg post.
Not only is unencrypted email inherently vulnerable to diversion by hackers, but it may not even enjoy legal protection against attack. As The Washington Post reported on August 6, the Ninth Circuit Court of Appeals is reviewing a California district court decision in the case of Bunnell v. Motion Picture Ass’n of Am., 2:06-cv-03206-FMCJCx (C.D. Cal. Aug. 22, 2007).
Bunell involves claim that a hacker broke into third party firm’s email server and secretly copied unencrypted company emails. The alleged hacker then provided the emails to the Motion Picture Association of America, which allegedly paid $15,000 for them.
The district court ruled that an intrusion into a third party’s email server and surreptitious copying of the unencrypted emails did not violate the 1968 Wiretap Act, which protects against the "interception" of certain electronic communications. The court determined that the emails were copied while being "stored" on an email server for a few milliseconds during transmission. The court reasoned that, since the emails were being stored at the time of their copying, they were not in transit and therefore there was no "intercept" and, hence, no violation of the Act.
If the Ninth Circuit affirms in Bunnell, a serious question would arise as to the continuing validity of the ABA’s premise that email has the same expectation of privacy from a legal perspective as traditional forms of communication. Moreover, regardless of what the appeals court decides, the Bunnell case illiustrates that the legal protections affored unencrypted emails are not ironclad. See, e.g., Scott v. Beth Israel Medical Center, Inc., 847 N.Y.S.2d 436 (N.Y. Sup. Ct. Oct. 17, 2007) (refusing to bar discovery of unencrypted emails that client sent to attorney using employer’s computer and email system).
Bunnell also illuminates that emails often contain valuable information that is worth stealing. Statistics show that typically between two percent and four percent of emails originating from banking institutions contain personal financial information. The credit card information, ba account iformation, and Social Security numbers have a tangible and calculable black market value. According to a Symantec Global Internet Security Threat Report in April 2008, the black market will pay $0.40 to $20 per credit card, $10 to $1,000 per bank account, and $1 to $15 for identity information (such as Social Security numbers).
What valuable information might a law firm’s emails include? Consider the value of a message from a deal lawyer who specializes in mergers and acquisitions:
Joe — to confirm our conversation, the Board of Directors voted today to approve XYZ Company’s acquisition offer. XYZ will exchange 10 shares of its publicly-traded stock for every three shares of the target’s stock. The public announcement will occur immediately after the signing of the definitive acquisition agreement. Please call me to discuss the timetable.
How much would this attorney-client email exchange be worth to unscrupulous investors? To quote the MasterCard commercial — "priceless".
Encryption keeps email safe from prying eyes, regardless of whether the eyes belong to a hacker or to internal personnel. Email encryption services today are inexpensive and readily installed. They provide "send to anyone" capabilities. Encrypted emails can even be sent and received via BlackBerry or other handheld device.
In short, there are no material costs, technology problems, or work flow barriers that prevent the legal community from encrypting emails. Given this, if interception of a sensitive attorney-client communication harms a client, a claim of legal malpractice could readily be envisaged using the legal framework of the traditional cost/benefit balancing analysis.
The logical defense by an attorney caught in this situation would be to argue that the standard of care was not breached since encrypted email is not (currently) the prevailing practice in the legal community. This defense might not prevail. See Helling v. Carey, 519 P.2d 981 (Wash. 1974) (holding that failure to use medical technology that exceeded "prevailing standard of practice" supported malpractice claim because it so obviously helped prevent serious injury).
In addition to risking potential negligence (malpractice) claims, failing to encrypt emails may expose the sender to possible fines and penalties. Federal regulators are now assertively enforcing existing regulations and assessing fines and penalties against senders of email that contain personal health information, which is protected from disclosure by the Health Insurance Portability and Accountability Act of 1996, or personal financial information, which the Gramm-Leach-Bliley Financial Modernization Act of 1999 protects from disclosure.
Given the foregoing, attorneys who use unencrypted email for sensitive email communications risk public embarrassment, reputational injury, and financial liability, regardless of the ABA’s view that it is legally ethical to do so.
Ronald A. Woessner
We don’t necessarily agree with Ron’s assessment but appreciate his views on this Hot Topic and hope they Spur Debate.
