business of law

The Connecticut Law Tribune published my piece this week about the risk law firms, including small ones, face from data breaches:

In recent months, corporate America has been shaken by several headline-grabbing data breaches.

Retailer Target's first quarter profits were down 16 percent after credit card and personal information of millions of its customers was stolen. Daily-deal website LivingSocial was hacked with more than 50 million users impacted. Last week, hackers gained access to the personal data of 145 million of online eBay's customers.

Lawyers are among the specialists called in to help with these security crises. But data breach risk doesn't belong to clients alone. Law firms of all sizes risk having client data and other sensitive materials exposed, legal and technical experts say.

In Massachusetts, state officials felt so strongly about the threat to law firms that they've planned a seminar for May 29. In an email pitching the program to the state's lawyers says: "Hackers are now targeting small law firms because of the wealth of info in client files that can be used for identity theft – in family law, estate planning, real estate, elder law and other matters. And Mass. law requires you to notify clients of a data breach – do you really want to have to do that?"

Anthony Minchella says Connecticut lawyers shouldn't feel any more comfortable.

The owner of Minchella & Associates in Middlebury and the vice-chair of the Connecticut Bar Association's small firm practice management section, said in an email that "small firms or solos sometimes feel safe from cybersecurity threats, but that is completely false. No business is safe. Practices that obtain sensitive information, such as credit card numbers, often have the entire package of information a cyber-thief would need to steal an identity."

Monique Ferraro, a general practitioner in Waterbury who also runs a forensic technology business and lectures on IT security, said data breaches can be as simple as the loss of a lawyer's laptop or smartphone that isn't protected by a password. "I see a lot of lawyers who are not securing their data appropriately," Ferraro said.

Connecticut has put businesses of all types on notice that they have to take safeguards to prevent data breaches. Unfair trade practice charges can be brought against companies and organizations if they expose personal information like social security numbers, credit card numbers and driver's license numbers. And lawyers must provide notice to their clients and the Office of the Attorney General if they've suffered a data security breach.

There are at least three other ways that data breaches can occur, says Ellen Giblin, lead privacy and data security counsel with the Ashcroft Law Firm in Boston and manager of the data breach response teams for clients.

Hackers can keep pinging away at a law firm's information security apparatus until they break in. They can use an insider to provide them with sensitive information. Or they can "socially engineer" their way past IT security protocols by using phishing scams that entice lawyers to respond to fraudulent e-mails which, in turn, provide entree to their firms' electronic data.

Under the law, law firms are considered to be vendors, and vendors are required to have the appropriate "administrative, physical and technological safeguards in place" to ensure data security, Giblin said.

"It's important for law firms to always safeguard and keep confidential their client information, whether it's to protect attorney-client privilege" or to follow federal, state or other laws enacted to protect privacy and confidential information.

Not even the experts agree on how to best protect client data.

Lawyers Dan Siegel and Molly Gilligan, whose company, Integrated Technology Services, advises small and mid-sized law firms, said the best practice is to store client data with a cloud vendor on the web and on a hard drive in one's legal office.

It's the practice they use in their own businesses. Siegel, who is based in the Philadelphia suburbs, and Gilligan, a Quinnipiac University School of Law graduate now based in Maine, are using a remote case management system so they can work together in a law practice as well as in their technology business.

Cloud vendors can provide better security than a smaller law firm typically can come up with on its own, Siegel said.

But lawyers must do their due diligence and ensure that the vendor's terms of service acknowledges that the data belongs to the client, and not the vendor or the law firm, Siegel said. Lawyers should only use vendors that store the data in the U.S., he said.

The agreement with a cloud vendor also should cover what happens if the vendor goes out of business, Siegel said. If a vendor does go out of business, Siegel's firm has the encrypted data backed up on a hard drive, he said.

Connecticut bar officials have not issued an ethics opinion on whether its appropriate for lawyers to entrust client data to a cloud computing service where the data is accessed over the Internet via a web browser, according to a tally by the American Bar Association. New York and Massachusetts have released ethics opinions on the topic; both jurisdictions require that lawyers exercise reasonable care in putting client data on the cloud.

Ferraro, however, does not recommend using cloud vendors, saying that law firms should be leery about trusting an outside company with such sensitive client information. "If you have control of your data," she said, "you have control over your data."

If lawyers choose to go the cloud route, Ferraro says they should get client consent before storing their data remotely. She prefers that lawyers stores their own files, making sure they are encrypted. She recommends that attorneys install a self-encrypting hard-drive on their computers.

Heidi Alexander, a law practice advisor with the Massachusetts Law Office Management Assistance Program, said that Dropbox, one of the most popular cloud providers, may not be the safest and most secure vendor to use because it has experienced some data breaches of its own. She, too, said that encryption is the best way to protect documents. She added that attorneys should make sure that passwords are strong and unique.

Both Ferraro and Giblin recommend a number of other data security policies. They said law firms should have policies that forbid the use of computers for personal purpose. Along the same lines, Ferraro said lawyers should have separate business and personal smartphones. Those phones should be password-controlled and include features that allow their digital contents to be erased from a remote location in case they are lost or stolen.

A law firm is going to be experience a data breach and get into hot water, Ferraro and Giblin predicted.

Even though lawyers are supposed to notify their clients of data breaches under Connecticut law, "they don't do it and it's just a matter of time before this implodes upon itself," Ferraro said. There will be a class action lawsuits or criminal investigations, she said.

Giblin predicts federal action at some point against a law firm. The Federal Trade Commission has prosecuted data security breaches as an unfair trade practice, she said. "If they haven't gone after a law firm, they will," Giblin said.

Gilligan said that there is a balance to be struck between security and efficiency with technology. Lawyers need to take reasonable steps to use technology to protect their clients' data, Gilligan said, but technology also is about "making your office more efficient and better able to serve your clients. There is a trade-off."

Here's the story I wrote for the Connecticut Law Tribune regarding a civil-rights attorney who alleges her own civil rights were violated by the city of Bridgeport in its hiring of outside counsel to represent city employees: 

osephine Miller is no stranger to litigation involving the city of Bridgeport and its school district.

In the highest profile case, which went to the state Supreme Court, the Danbury-based civil rights litigator represented parents who objected to the state's decision in 2011 to replace members of the elected school board with its own appointees.

Now Miller also has her own legal complaint pending. She is alleging in federal court that her civil rights were violated by the Bridgeport City Attorney, who is responsible for hiring outside counsel for school district employees entitled to city-paid legal representation. Specifically, Miller alleges that City Attorney Mark Anastasi paid a white attorney who formerly provided representation for a certain client, but that he has refused to pay Miller, who is an African American, for her work for the same client.

Miller's client, Andrew Cimmino, is a former Bridgeport elementary school teacher who was fired following sexual abuse allegations. Cimmino claims the allegations were fabricated by two school employees, and he has pursued civil claims against the employees and the school district. Miller defended Cimmino in a sexual harassment and constitutional-rights lawsuit the two school employees brought against the Bridgeport Board of Education, the city of Bridgeport and Cimmino.

Most recently, U.S. District Judge Vanessa Bryant has ruled that Miller's claims of racial discrimination regarding payment for her representation of Cimmino could survive a motion to dismiss. But the judge seemed to express some skepticism about the complaint, writing Miller "faintly alleged" her conspiracy claim.

Miller's new counsel in the civil rights action, Richard C. Gordon, of Bloomfield, said in an interview that it is "not unusual" to see skeptical language from judges at an early stage of court proceedings. Discovery is not complete, Gordon pointed out, and he expressed confidence that they will fully prove the allegations of racial discrimination.

Miller's complaint does not provide any information about how much she thinks she is owed. The complaint does says she has not been paid since January 2010 and that Cimmino's prior attorney was not required to first incur legal fees and expenses before he received reimbursement.

Bridgeport Associate City Attorney Betsy Edwards said the allegations of racial discrimination in the city attorney's hiring of outside counsel "are demonstrably untrue." She said Miller has personal knowledge that the City Attorney's Office has African-American attorneys on its staff and also hires them for outside counsel.

The bottom line, according to the city, is that Anastasi is the only one authorized by the city charter to decide if city employees can hire outside counsel paid for by public tax dollars, and that authorization has not been granted to Miller in the Cimmino case. Edwards said Miller is trying to "force and coerce the City Attorney's Office" into hiring her to represent city employees entitled to legal representation, Edwards said.

But Gordon said the choice of outside counsel should not belong to the city attorney. "Any plaintiff in any matter has the right to select his or her attorney," said Gordon. "It would patently unfair to essentially require a plaintiff to use an attorney that he or she does not want."

In her ruling, Bryant noted that Miller often represents non-school employee clients who are suing the city of Bridgeport. For that reason, the judge said, the city may be reluctant to hire Miller to represent its own employees.

"While the record does not indicate the nature of the various representations, it is not inconceivable, for example, that an attorney who represented the city would be privy to information which would be adverse to its interests in a subsequent action against the city," Bryant said.

The federal judge rejected Miller's request to amend her complaint to add new claims of tortious interference with her contracts with her clients, conspiracy between two or more individuals to unlawfully deprive Miller of the right to make and enforce contracts due to her race, and other claims.

According to the judge's opinion, Miller also wanted to add allegations that she was told by an assistant city attorney that the city would not settle lawsuits brought by Miller because she has so many cases pending against Bridgeport. Miller also wanted to add a second allegation that another assistant city attorney told Cimmino, the fired principal, that "he should not employ Miller, that she was often reversed on [court] decisions entered in her favor, and that the client should employ a different attorney."

Miller also wanted to add a third allegation she has not been paid for representing another Bridgeport city employee.

Bryant ruled that those allegations don't share a nucleus of common fact with what Miller has already alleged regarding Cimmino, the judge said.

"While Miller alleges that various Bridgeport city attorneys were involved in the alleged conspiracy, she has utterly failed to connect either the attorneys or the incidents she alleges to be involved," Bryant said. "Moreover, although she alleges that this conspiracy's goal was to deprive her of her right to make or enforce contracts based on her race, Miller has failed to allege any inference of discrimination in the new incidents she seeks to add to the action."

Gordon said he will file a new complaint on Miller's behalf with the allegations that the judge did not permit to be added to the Cimmino case as well as the conspiracy claim regarding the Cimmino situation.

Read more: http://www.ctlawtribune.com/id=1202649823476/Attorney-Claims-City-Refuse...

Here's an excerpt of a piece I wrote for the Connecticut Law Tribune about how clerical and administrative jobs in law firms are changing due to technology as well as being reduced in number:

Technology has allowed people to work together in different offices around the country on labor-intensive cases like class actions.

There's no typing pool anymore.

The clerical and administrative work on legal cases has changed to tasks like legal work by paralegals, basic document review, and creating the formatting on legal documents.

The result is that some law firms have reduced the number of people they employ in clerical roles or the administrative work has changed from taking dictation and filing hard copies in accordion folders to specialized roles like paralegals who can bill for the legal work they do, and jobs in quality control, client satisfaction and retention, practicing attorneys and legal consultants say.

Another trend, they also say, is that administrative professionals are becoming much more efficient in how they spend their time.

Part of Boston-based legal consultant Jeff Coburn's work is interviewing the legal clients of his law firms' clients to find out their satisfaction levels. One thing he has learned is that larger firms are under more pressure from their Fortune 1,000 clients to cut costs, said Coburn, managing director of Coburn Consulting.

"The last five years or so there's been a huge pressure on in-house legal counsel to get accountability for the legal department, which you never used to have 25 years ago," Coburn said. "It was like a black hole. They spent what they spent."

According to a survey conducted in March and April 2013 by legal consultancy Altman Weil, 89.7 percent of managing partners or chairs from U.S. law firms with 50 or more lawyers said that the legal market trend of having fewer support staff is permanent (238 firms answered the survey).

The vast majority of respondents also identified price competition, improved efficiencies in legal practice, more commoditized legal work and more contract lawyers as permanent trends.

The survey also reported that 38.6 percent thought they would have fewer support staff in five years, 41.6 percent thought they would have about the same, and 18.9 percent thought they would have more.

Eric A. Seeger, a principal with Altman Weil out of suburban Philadelphia, said the industry standard has changed to have one secretary for every three lawyers or even one secretary for every four or five lawyers.

Clerical jobs that were cut in the five years or so since the Great Recession also won't be restored, he said.

Twenty years ago, overtime for secretaries would be put on the bills for intensive matters like mergers and acquisitions or litigation, Seeger said. "You would be hard-pressed to get away with that today," he said. "I think that corporations that examine their legal fees and have billing guidelines pretty much uniformly say that we expect the law firm overhead to be included in the rates that are charged."

"Clients want templates," Coburn said for his part. "They want systems [that] ... get to the heart of it, which is a document, a jury trial, an opinion or the cost of a merger situation."

The biggest costs for law firms are the people they employ and the spaces they use for their offices, Seeger said. Reducing staff means not only that law firms save on labor costs but also potentially space costs if they can move into smaller spaces, he said.

"Some of it is driven by clients applying pressure and the fear that more clients will apply pressure," Seeger said.

The types of clerical services that are being automated include data processing, word graphics and document management, Coburn said.