Ethics Archives | Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco

Ethics Opinions Covering Lawyers’ Use of Generative AI (Artificial Intelligence)

Mark Rosch — Sat, 25 Jul 2026 19:51:57 +0000

Several state bar associations and regulatory bodies have issued formal ethics opinions, task force reports, or practical guidance regarding the use of generative AI (Artificial Intelligence) in the practice of law. While not an exhaustive list, we have attempted to list the most relevant documents here. We will attempt to keep this list up to date as we become aware of additional resources.

The opinions, etc. focus on the use of generative AI to review and draft documents. Common themes across these jurisdictions include the duty of competence (understanding the technology), confidentiality (not entering client secrets into public AI models), and supervision/verification (lawyers must verify all AI outputs for accuracy).

To keep up with the latest in Artificial Intelligence (AI) use and trends in law firms, see our CLE webinars. CLE credit is available in numerous jurisdictions.

_{Originally Published: January 2, 2026 Last updated: July 25, 2026}

Here is the list of state bar associations that have issued specific guidance:

Alaska

Issuing Body: Alaska Bar Association
Document: Ethics Opinion 2025-1 (April 2025)
Summary: Affirms that it is ethically permissible for lawyers to use generative AI to assist clients, provided the lawyer understands to a reasonable degree how the technology works, verifies the outputs to prevent hallucinations, and maintains client confidentiality.
Link: A laska Bar Association Ethics Opinion 2025-1

California

Issuing Body: The State Bar of California
Document: Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law
Summary: Initially issued in late 2023, this comprehensive guide addresses duties of confidentiality, competence, and candor. It specifically warns against inputting confidential client information into non-secure AI tools and requires lawyers to review all AI-generated work product. The Bar suggests that, "this Practical Guidance should be read as guiding principles rather than as 'best practices.'" It was unpdated in May 2026 to specifically address "agentic AI" (AI models capable of planning steps and executing tasks autonomously). The update emphasizes that even with autonomous AI, lawyers cannot delegate legal judgment and must manually review any AI-generated filings or decisions.
Link: California State Bar Practical Guidance (May 2026); California State Bar Practical Guidance (2023 superceded)

District of Columbia

Issuing Body: D.C. Bar Legal Ethics Committee
Document: Ethics Opinion 388: Ethics Issues in the Use of Generative Artificial Intelligence
Summary: Released in April 2024, this opinion emphasizes that lawyers must have a "reasonable understanding" of the technology's capabilities and limitations (specifically hallucinations) and must protect client confidences when using generative AI tools. The opinion make sthe important distinction that, "Lawyers should understand that GAI [generative AI] products are not search engines that accurately report hits on existing data in a constantly updated database. The information available to a GAI product is confined to the dataset on which the GAI has been trained."
Link: D.C. Bar Ethics Opinion 388

Florida

Issuing Body: The Florida Bar Board of Governors
Document: Advisory Opinion 24-1
Summary: Approved in January 2024, this opinion permits the use of generative AI but mandates that lawyers verify the accuracy of the work product, ensure confidentiality (recommending client consent for third-party AI use involving confidential data), and avoid improper billing practices (e.g., double-billing). The opinion also addresses the use of AI chatbots on attorney websites, advising that, "generative AI chatbots that communicate with clients or third parties must comply with restrictions on lawyer advertising..."
Link: Florida Bar Advisory Opinion 24-1

Illinois

Issuing Body: Attorney Registration and Disciplinary Commission (ARDC) of the Supreme Court of Illinois
Document: The Illinois Attorney’s Guide to Implementing AI
Summary: Released in late 2025, this guide serves as a practical resource for implementing AI in alignment with ethical duties, including flowcharts and checklists for vetting AI tools.
Link: ARDC Illinois Attorney's Guide

Kentucky

Issuing Body: Kentucky Bar Association
Document: Ethics Opinion KBA E-457
Summary: Issued in March 2024, this opinion provides a FAQ-style guide on competence, confidentiality, and billing. It reinforces the lawyer's duty to review the AI output for accuracy and clarifies that lawyers cannot bill for the time spent learning how to use AI, only for the actual benefit provided to the client.
Link: Kentucky Bar Association Ethics Opinions

Michigan

Issuing Body: State Bar of Michigan Standing Committee on Judicial Ethics
Document: Ethics Opinion JI-155
Summary: While primarily focused on judicial officers, this opinion (October 2023) establishes that judges and lawyers must maintain competence with advancing technology, including AI, to ensure fair and accurate legal proceedings.
Link: State Bar of Michigan Opinion JI-155

Mississippi

Issuing Body: Mississippi Bar
Document: Ethics Opinion 267 (November 2024)
Summary: Outlines how attorneys can use AI tools ethically, placing a specific focus on navigating confidentiality risks, managing honest billing practices (billing for actual time spent rather than time saved), and client disclosure.
Link: Mississippi Bar Ethics Opinion No. 267

New Jersey

Issuing Body: New Jersey Courts / Supreme Court of New Jersey
Document: Notice to the Bar: Preliminary Guidelines on the Use of Artificial Intelligence by New Jersey Lawyers
Summary: Released in January 2024, this notice clarifies that the Rules of Professional Conduct apply to AI. It specifically highlights the duty to verify citations (citing the Mata v. Avianca case) and the prohibition against generating false evidence.
Link: NJ Courts Preliminary Guidelines (PDF)

New Mexico

Issuing Body: State Bar of New Mexico
Document: Formal Ethics Opinion 2024-004 (September 2024)
Summary: Addresses the ethical duties mapped to AI use, focusing on competence, safeguarding data against third-party self-learning models, and the prohibition against submitting unverified AI output to tribunals.
Link: State Bar of New Mexico Formal Opinion 2024-004

New York

Issuing Body: New York State Bar Association (NYSBA)
Document: Report and Recommendations of the NYSBA Task Force on Artificial Intelligence
Summary: An extensive report (April 2024) detailing the impact of AI on the legal profession, offering regulatory guidelines, and suggesting that while no new ethics rules are immediately needed, existing rules (competence, supervision) must be strictly applied.
Link: Formerly at NYSBA Task Force Report; not currently available online
Issuing Body: New York City Bar Association (NYCBA)
Document 1: Formal Opinion 2024-5 (August 2024)
- Summary: General guidance on the ethical use of generative AI, noting that routine embedded AI tools (like those in standard legal research software) may not require client disclosure.
- Link: Formal Opinion 2024-5: Generative AI in the Practice of Law
Document 2: Formal Opinion 2025-6 (December 2025)
- Summary: Focuses specifically on the use of AI to record, transcribe, and summarize conversations with clients. It stresses that attorneys should obtain informed consent before using AI meeting assistants (like Copilot or Zoom AI), evaluate the privilege/confidentiality risks of the vendor's data retention policies, and independently review AI-generated transcripts for accuracy.
- Link: Formal Opinion 2025-6: Ethical Issues Affecting Use of AI to Record, Transcribe, and Summarize Conversations with Clients

North Carolina

Issuing Body: North Carolina State Bar Council
Document: Formal Ethics Opinion 2024-1
Summary: Adopted in late 2024, this opinion focuses on the "competency" requirement, stating that a lawyer must understand the risks of "hallucinations" and data privacy before utilizing AI tools in practice, stating plainly, "A lawyer may not abrogate her responsibilities under the Rules of Professional Conduct by relying upon AI."
Link: NC State Bar 2024 FEO 1

Oregon

Issuing Body: Oregon State Bar
Document: Formal Opinion No. 2025-205 (February 2025)
Summary: Concludes that Oregon lawyers may use generative AI tools if they take reasonable steps to become competent in the technology. It imposes ongoing obligations to supervise the technology (treating it similarly to a non-lawyer assistant), securely store information to prevent privilege waivers, and consult with clients before using AI if the representation requires it.
Link: Oregon State Bar Formal Opinion No. 2025-205

Pennsylvania

Issuing Body: Pennsylvania Bar Association & Philadelphia Bar Association
Document: Joint Formal Opinion 2024-200
Summary: This joint opinion outlines best practices, emphasizing that lawyers "must verify all citations and legal analysis" generated by AI and must be transparent with clients about the use of AI if it significantly impacts the representation. It advises lawyers that, "[i]n particular, the use of AI applies to the lawyer’s duties of (1) confidentiality, (2) competence, (3)
candor, (4) truthfulness, (5) supervision, (6) communication, (7) conflicts of interest, and (8) the unauthorized practice of law..."
Link: PBA Joint Formal Opinion 2024-200

Texas

Issuing Body: State Bar of Texas Professional Ethics Committee
Document: Opinion 705
Summary: (Addressed in early 2025) This opinion confirms that while attorneys may use AI, they are ultimately responsible for the work product. It specifically warns against "unthinking reliance" on AI outputs and mandates rigorous verification of case law. In conclusion, it advises that, "lawyers should acquire basic technological competence before using any generative AI tool, should always ensure that the tool does not imperil confidential client information, should always verify the accuracy of any responses received from a generative AI tool, and should not charge clients for the time “saved” by using a generative AI program."
Link: Texas Opinion 705

Virginia

Issuing Body: Supreme Court of Virginia / Virginia State Bar
Document: Legal Ethics Opinion 1901 (November 2025)
Summary: Clarifies the rules around reasonable fees and generative AI. It states that lawyers are not ethically obligated to reduce a flat fee simply because they completed the work more efficiently using AI. It reinforces a value-based billing approach, so long as the overall fee remains reasonable under the factors of Rule 1.5.
Link: Virginia State Bar Legal Ethics Opinion 1901

West Virginia

Issuing Body: Lawyer Disciplinary Board of West Virginia
Document: Legal Ethics Opinion 24-01 (June 2024)
Summary: Emphasizes that AI must "supplement, not replace" legal reasoning. Notably, it takes a strict stance on communication, advising that lawyers should consult with clients prior to using artificial intelligence tools during representation and obtain the client's consent for use in writing.
Link: Lawyer Disciplinary Board of West Virginia Legal Ethics Opinion 24-01

American Bar Association (ABA)

While not a state bar, the ABA's guidance is cited by many states as a baseline.

Document: ABA Formal Opinion 512 (July 2024)
Summary: "Lawyers using GAI tools have a duty of competence, including maintaining relevant technological competence, which requires an understanding of the evolving nature of GAI. In using GAI tools, lawyers also have other relevant ethical duties, such as those relating to confidentiality, communication with a client, meritorious claims and contentions, candor toward the tribunal, supervisory responsibilities regarding others in the law office using the technology and those outside the law office providing GAI services, and charging reasonable fees. With the ever-evolving use of technology by lawyers and courts, lawyers must be vigilant in complying with the Rules of Professional Conduct to ensure that lawyers are adhering to their ethical responsibilities and that clients are protected.
Link: ABA Formal Opinion 512

The post Ethics Opinions Covering Lawyers’ Use of Generative AI (Artificial Intelligence) appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Ethics Opinions Covering Lawyers’ Use of Generative AI (Artificial Intelligence)

Mark Rosch — Fri, 02 Jan 2026 19:51:57 +0000

Here is the list of state bar associations that have issued specific guidance:

California

Issuing Body: The State Bar of California
Document: Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law
Summary: Issued in late 2023, this comprehensive guide addresses duties of confidentiality, competence, and candor. It specifically warns against inputting confidential client information into non-secure AI tools and requires lawyers to review all AI-generated work product. The Bar suggests that, "this Practical Guidance should be read as guiding principles rather than as 'best practices.'"
Link: California State Bar Practical Guidance

District of Columbia

Issuing Body: D.C. Bar Legal Ethics Committee
Document: Ethics Opinion 388: Ethics Issues in the Use of Generative Artificial Intelligence
Summary: Released in April 2024, this opinion emphasizes that lawyers must have a "reasonable understanding" of the technology's capabilities and limitations (specifically hallucinations) and must protect client confidences when using generative AI tools. The opinion make sthe important distinction that, "Lawyers should understand that GAI [generative AI] products are not search engines that accurately report hits on existing data in a constantly updated database. The information available to a GAI product is confined to the dataset on which the GAI has been trained."
Link: D.C. Bar Ethics Opinion 388

Florida

Issuing Body: The Florida Bar Board of Governors
Document: Advisory Opinion 24-1
Summary: Approved in January 2024, this opinion permits the use of generative AI but mandates that lawyers verify the accuracy of the work product, ensure confidentiality (recommending client consent for third-party AI use involving confidential data), and avoid improper billing practices (e.g., double-billing). The opinion also addresses the use of AI chatbots on attorney websites, advising that, "generative AI chatbots that communicate with clients or third parties must comply with restrictions on lawyer advertising..."
Link: Florida Bar Advisory Opinion 24-1

Illinois

Issuing Body: Attorney Registration and Disciplinary Commission (ARDC) of the Supreme Court of Illinois
Document: The Illinois Attorney’s Guide to Implementing AI
Summary: Released in late 2025, this guide serves as a practical resource for implementing AI in alignment with ethical duties, including flowcharts and checklists for vetting AI tools.
Link: ARDC Illinois Attorney's Guide

Kentucky

Issuing Body: Kentucky Bar Association
Document: Ethics Opinion KBA E-457
Summary: Issued in March 2024, this opinion provides a FAQ-style guide on competence, confidentiality, and billing. It reinforces the lawyer's duty to review the AI output for accuracy and clarifies that lawyers cannot bill for the time spent learning how to use AI, only for the actual benefit provided to the client.
Link: Kentucky Bar Association Ethics Opinions

Michigan

Issuing Body: State Bar of Michigan Standing Committee on Judicial Ethics
Document: Ethics Opinion JI-155
Summary: While primarily focused on judicial officers, this opinion (October 2023) establishes that judges and lawyers must maintain competence with advancing technology, including AI, to ensure fair and accurate legal proceedings.
Link: State Bar of Michigan Opinion JI-155

New Jersey

Issuing Body: New Jersey Courts / Supreme Court of New Jersey
Document: Notice to the Bar: Preliminary Guidelines on the Use of Artificial Intelligence by New Jersey Lawyers
Summary: Released in January 2024, this notice clarifies that the Rules of Professional Conduct apply to AI. It specifically highlights the duty to verify citations (citing the Mata v. Avianca case) and the prohibition against generating false evidence.
Link: NJ Courts Preliminary Guidelines (PDF)

New York

Issuing Body: New York State Bar Association (NYSBA)
Document: Report and Recommendations of the NYSBA Task Force on Artificial Intelligence
Summary: An extensive report (April 2024) detailing the impact of AI on the legal profession, offering regulatory guidelines, and suggesting that while no new ethics rules are immediately needed, existing rules (competence, supervision) must be strictly applied.
Link: Formerly at NYSBA Task Force Report; not currently available online

North Carolina

Issuing Body: North Carolina State Bar Council
Document: Formal Ethics Opinion 2024-1
Summary: Adopted in late 2024, this opinion focuses on the "competency" requirement, stating that a lawyer must understand the risks of "hallucinations" and data privacy before utilizing AI tools in practice, stating plainly, "A lawyer may not abrogate her responsibilities under the Rules of Professional Conduct by relying upon AI."
Link: NC State Bar 2024 FEO 1

Pennsylvania

Issuing Body: Pennsylvania Bar Association & Philadelphia Bar Association
Document: Joint Formal Opinion 2024-200
Summary: This joint opinion outlines best practices, emphasizing that lawyers "must verify all citations and legal analysis" generated by AI and must be transparent with clients about the use of AI if it significantly impacts the representation. It advises lawyers that, "[i]n particular, the use of AI applies to the lawyer’s duties of (1) confidentiality, (2) competence, (3)
candor, (4) truthfulness, (5) supervision, (6) communication, (7) conflicts of interest, and (8) the unauthorized practice of law..."
Link: PBA Joint Formal Opinion 2024-200

Texas

Issuing Body: State Bar of Texas Professional Ethics Committee
Document: Opinion 705
Summary: (Addressed in early 2025) This opinion confirms that while attorneys may use AI, they are ultimately responsible for the work product. It specifically warns against "unthinking reliance" on AI outputs and mandates rigorous verification of case law. In conclusion, it advises that, "lawyers should acquire basic technological competence before using any generative AI tool, should always ensure that the tool does not imperil confidential client information, should always verify the accuracy of any responses received from a generative AI tool, and should not charge clients for the time “saved” by using a generative AI program."
Link: Texas Opinion 705

American Bar Association (ABA)

While not a state bar, the ABA's guidance is cited by many states as a baseline.

Document: ABA Formal Opinion 512 (July 2024)
Summary: "Lawyers using GAI tools have a duty of competence, including maintaining relevant technological competence, which requires an understanding of the evolving nature of GAI. In using GAI tools, lawyers also have other relevant ethical duties, such as those relating to confidentiality, communication with a client, meritorious claims and contentions, candor toward the tribunal, supervisory responsibilities regarding others in the law office using the technology and those outside the law office providing GAI services, and charging reasonable fees. With the ever-evolving use of technology by lawyers and courts, lawyers must be vigilant in complying with the Rules of Professional Conduct to ensure that lawyers are adhering to their ethical responsibilities and that clients are protected.
Link: ABA Formal Opinion 512

CLE Webinar Covers Ethics of Social Media Research

Mark Rosch — Sat, 13 Jun 2020 00:42:36 +0000

Join us for "The Ethics of Social Media Research" webinar on June 28th.

CLEwebinars.com is hosting "The Ethics of Social Media Research" webinar on June 28th at 1:00-2:30 pm ET, presented by Carole Levitt, Esq. & Mark Rosch. (This webinar qualifies for 1.5 hours of Ethics credits.)

In this webinar, you will learn how to avoid potential ethical traps when you research social media profiles to uncover investigative/background information about parties, witnesses, experts, jurors, etc., and, in some cases, to use this information as evidence. This program reviews pertinent Ethics opinions issued by the ABA and bar associations in many jurisdictions; discusses relevant caselaw; reviews detailed Guidelines for social media research issued by the New York State Bar’s Commercial and Federal Litigation Section; and ties them into the ABA Model Rules of Professional Conduct.

The program will also explore:

Who's your friend?
Could "friending" violate the deception or ex parte communication ethical rules?
Whether it is ethical to research the social media profiles of parties and witnesses during discovery or trial?
Is it ethical to research the social media profiles of potential jurors before trial or seated jurors during trial?
Could advising clients to delete, deactivate, or adjust privacy settings on their social networking accounts lead to an ethical violation or spoliation charge against you?
How to configure security/privacy settings in your own profile to avoid ethical breaches.

The seminar is partially based on the speakers' fifty-five page Social Media chapter from their book, "The Cybersleuth's Guide to the Internet."

The post CLE Webinar Covers Ethics of Social Media Research appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Legal Ethics Considerations for Lawyers’ Use of Cloud Computing Services

Mark Rosch — Thu, 14 Apr 2016 16:49:20 +0000

We often get questions about the security of "cloud computing" services like Google Apps and whether that security is tight enough for lawyers to use them.

Google Apps, for example, meets the security standards put in place for the online storage of government agencies' information set out in the Federal Information Security Management Act of 2000 (FISMA 44 U.S.C. § 3541, et seq.).

Cloud computing and "Software as a Service" (SaaS) are two terms used to describe similar services. They allow you to access software, or store files, on computers that are not at your physical location or even in your physical control. Dictionary.com defines cloud computing as:

Internet-based computing in which large groups of remote servers are networked so as to allow sharing of data-processing tasks, centralized data storage, and online access to computer services or resources.

Wikipedia defines SaaS as:

"Software as a service (SaaS, typically pronounced [sæs]), sometimes referred to as 'on-demand software,' is a software delivery model in which software and its associated data are hosted centrally (typically in the (Internet) cloud) and are typically accessed by users using a thin client, normally using a web browser over the Internet."

Gmail and Flickr are examples of cloud computing or SaaS products because they give you access to e-mail software and message storage, and photo storage (respectively) on computers at a remote location.

In August 2012, the ABA House of Delegates adopted changes to the Model Rules of Professional Conduct dealing with the question of whether and how lawyers might deal with "confidentiality issues arising from technology." The changes were suggested by the ABA Commission on Ethics 20/20 and were, "designed to give lawyers more guidance regarding their confidentiality- related obligations when using technology."

Share this artice:

The compilation below provides an overview of the existing Ethics Opinions produced, to date, by Bar Associations around the country.

So far, only a few State Bar Associations have issued formal ethics opinions on the questions. In reverse chronological order, those states include:

In 2012 Opinion 2012-184, the Committee took its second look at technology and client confidentiality. Unlike its earlier opinion (Opinion 2010-179; see below) this time they actually used the term "cloud computing" . However, it added a new twist by focusing on a virtual law office practice ("VLO") and whether an attorney can "maintain a virtual law office practice ("VLO") and still comply with her ethical obligations if the communications with the client, and storage of and access to all information about the client’s matter, are all conducted solely through the internet using the secure computer servers of a third-party vendor (i.e., "cloud computing")?"

The opinion explained that, "As it pertains to the use of technology, the Business and Professions Code and the Rules of Professional Conduct do not impose greater or different duties upon a VLO practitioner operating in the cloud than they do upon an attorney practicing in a traditional law office. While an attorney may maintain a VLO in the cloud where communications with the client, and storage of and access to all information about the client’s matter, are conducted solely via the internet using a third-party’s secure servers, Attorney may be required to take additional steps to confirm that she is fulfilling her ethical obligations due to distinct issues raised by the hypothetical VLO and its operation. Failure of Attorney to comply with all ethical obligations relevant to these issues will preclude the operation of a VLO in the cloud as described herein." The opinion refers attorneys back to Opinion 2010-179 for a fuller discussion on the analysis that the Committee believes attorneys should undertake when considering the use of a particular form of technology (see the quote below from Opinion 2010-179 for a synopsis of the analysis attorneys should undertake).

Massachusetts specifically addressed the question of “whether it [the use of cloud computing] would violate Lawyer’s obligations under the Massachusetts Rules of Professional Conduct to store confidential client information using “Google docs” or some other Internet based storage solution, and to synchronize his computers and other devices that contain or access such information over the Internet.”

In finding the use of cloud services permissible, the Massachusetts Opinion analogizes cloud services to “lawyer's use of unencrypted Internet e-mail to engage in confidential communications with his or her client” and third-party vendors accessing law firm networks in order to maintain the firm’s hardware or software that the Bar had found permissible in previous Opinions.

Like the earlier Opinions discussed below, Massachusetts instructs lawyers to undertake “reasonable efforts to ensure that the provider's terms of use and data privacy policies, practices and procedures are compatible with the lawyer's professional obligations, including the obligation to protect confidential client information reflected in Rule 1.6(a).” Unlike some other Opinions, the Massachusetts Opinion states that lawyers should get their clients’ prior consent before, “storing or transmitting particularly sensitive client information by means of the Internet.”

Specifically, the committee addressed the question, “May an attorney ethically store confidential client material in ‘the cloud’?” The committee’s conclusion is a qualified “yes.” Like some of the other opinions on this topic, Pennsylvania Opinion 2011-200 instructs attorneys that they “may ethically allow client confidential material to be stored in ‘the cloud’ provided the attorney takes reasonable care to assure that (1) all such materials remain confidential, and (2) reasonable safeguards are employed to ensure that the data is [sic] protected from breaches, data loss, and other risks.”

This opinion includes a bullet point list describing what “the standard of reasonable care for ‘cloud computing’ may include.” In addition to addressing the whole category of cloud computing services that lawyers might use, the Pennsylvania opinion also points to the use of web-based e-mail (naming Gmail among others) as “ordinarily permissible” for lawyers in most circumstances but, “may not be acceptable in the context of a particularly heightened degree of concern or in a particular set of facts.”

The full opinion is ordinarily available online to Pennsylvania Bar members only. However, some other organizations have posted it online.

In this Opinion, the Bar offered a "Yes, qualified" answer to the question of whether lawyers may contract "with third-party vendor to store client files and documents online on remote server so that Lawyer and/or Client could access the documents over the Internet from any remote location." In offering this guidance, the Opinion points to Oregon RPC 1.6 which cover the attorney's duty to "not reveal information relating to the representation of a client."

The opinion stated that, "[a] Lawyer may store client materials on a third-party server so long as Lawyer complies with the duties of competence and confidentiality to reasonably keep the client’s information secure within a given situation.² To do so, the lawyer must take reasonable steps to ensure that the storage company will reliably secure client data and keep information confidential. Under certain circumstances, this may be satisfied though a third-party vendor’s compliance with industry standards relating to confidentiality and security, provided that those industry standards meet the minimum requirements imposed on the Lawyer by the Oregon RPCs. This may include, among other things, ensuring the service agreement requires the vendor to preserve the confidentiality and security of the materials. It may also require that vendor notify Lawyer of any nonauthorized third-party access to the materials. Lawyer should also investigate how the vendor backs up and stores its data and metadata to ensure compliance with the Lawyer’s duties.³" (Note that the footnote material is not included here. To access the footnotes in this Ethics Opinion use the link above to the full text of the Opinion.)

Like New York Opinion #842 (below), this Opinion answers two separate questions regarding lawyers' subscribing to software as a service (SaaS) rather than purchasing and installing software from disks.

First, the Opinion tackles whether lawyers should even be using SaaS products for "for case or practice management, document management, and billing/financial management," or "the storage of a law firm’s data, including client files, billing information, and work product, on remote servers rather than on the law firm’s own computer and, therefore, outside the direct control of the firm’s lawyers." The Opinion answered this question by stating, "Yes, provided steps are taken to minimize the risk of inadvertent or unauthorized disclosure of confidential client information and to protect client property, including the information in a client’s file, from risk of loss." The Opinion point to Comments 17 and 18 of North Carolina's Rule of Professional Conduct 1.6 - "Comment [17] explains, 'A lawyer must act competently to safeguard information relating to the representation of a client against inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client or who are subject to the lawyer’s supervision.' Comment [18] adds that, when transmitting confidential client information, a lawyer must take “reasonable precautions to prevent the information from coming into the hands of unintended recipients.'"

Second, the Opinion tackles what measures lawyers should take to assess SaaS vendors to minimize potential security risks. Recognizing that criteria for assessing the security of these SaaS services would change with technology, the Opinion outlines a list of points lawyers should consider rather than spell out a specific set of guidelines lawyers must follow. The Opinion introduces this list thusly, "This opinion does not set forth specific security requirements because mandatory security measures would create a false sense of security in an environment where the risks are continually changing. Instead, due diligence and frequent and regular education are required." Some of the security measures the Opinions suggest to be considered are:

a specific agreement covering "how the vendor will handle confidential client information in keeping with the lawyer’s professional responsibilities"

the ability to retrieve the lawyer's data if "the SaaS vendor goes out of business, or the service otherwise has a break in continuity"

careful review of the SaaS license agreement and security policy

evaluation of security measures, "including, but not limited to, firewalls, encryption techniques, socket security features, and intrusion-detection systems⁴

evaluation of the SaaS vendors backup policies for the lawyer's data

The Iowa State Bar Ethics Opinion (Number 11-01) pointed to Comment 17 to Iowa's Rule 32:1.6 as establishing a "reasonable and flexible approach to guide a lawyer’s use of ever-changing technology. It recognizes that the degree of protection to be afforded client information varies with the client, matter and information involved. But it places on the lawyer the obligation to perform due diligence to assess the degree of protection that will be needed and to act accordingly."

Comment 17 to Iowa's Rule 32:1.6 reads:

"[17] When transmitting a communication that includes information relating to the representation of a client, the lawyer must take reasonable precautions to prevent the information from coming into the hands of unintended recipients. This duty, however, does not require that the lawyer use special security measures if the method of communication affords a reasonable expectation of privacy. Special circumstances, however, may warrant special precautions. Factors to be considered in determining the reasonableness of the lawyer's expectation of confidentiality include the sensitivity of the information and the extent to which the privacy of the communication is protected by law or by a confidentiality agreement. A client may require the lawyer to implement special security measures not required by this rule or may give informed consent to the use of a means of communication that would otherwise be prohibited by this rule."

Also, recognizing the changing nature of cloud computing services, the Iowa State Bar Association Committee on Ethics and Practice Guidelines chose to offer "basic guidance regarding the implementation of the standard described in Comment 17," in the form of a list of considerations lawyers should take into account when performing their due diligence in reviewing cloud services for their firms.

Opinion, 2010-179 does not use the term "cloud computing," but the opinion can still be used to guide attorneys on their use of cloud computing because it deals with "using technology to transmit or store confidential client information when the technology may be susceptible to unauthorized access by third parties." The 2010-179 opinion explains that, "An attorney’s duties of confidentiality and competence require the attorney to take appropriate steps to ensure that his or her use of technology in conjunction with a client’s representation does not subject confidential client information to an undue risk of unauthorized disclosure. Because of the evolving nature of technology and differences in security features that are available, the attorney must ensure the steps are sufficient for each form of technology being used and must continue to monitor the efficacy of such steps." The opinion further states:

"Whether an attorney violates his or her duties of confidentiality and competence when using technology to transmit or store confidential client information will depend on the particular technology being used and the circumstances surrounding such use. Before using a particular technology in the course of representing a client, an attorney must take appropriate steps to evaluate: 1) the level of security attendant to the use of that technology, including whether reasonable precautions may be taken when using the technology to increase the level of security; 2) the legal ramifications to a third party who intercepts, accesses or exceeds authorized use of the electronic information; 3) the degree of sensitivity of the information; 4) the possible impact on the client of an inadvertent disclosure of privileged or confidential information or work product; 5) the urgency of the situation; and 6) the client’s instructions and circumstances, such as access by others to the client’s devices and communications."

The opinion explains that if client information is highly sensitive and a particular technology presents a risk of disclosure, then the attorney needs to consider other alternatives unless the client provides informed consent.

This Opinion tackled two questions:

May a lawyer use an online system to store a client's confidential information without violating the duty of confidentiality or any other duty?

If so, what steps should the lawyer take to ensure that the information is sufficiently secure?

The Opinion cited Rule 1.6 of the New York Rules of Professional Conduct that covers confidentiality, as well as Rule 1.0(j) that covers informed consent from clients in reaching the following conclusion:

"A lawyer may use an online data storage system to store and back up client confidential information provided that the lawyer takes reasonable care to ensure that confidentiality is maintained in a manner consistent with the lawyer’s obligations under Rule 1.6. A lawyer using an online storage provider should take reasonable care to protect confidential information, and should exercise reasonable care to prevent others whose services are utilized by the lawyer from disclosing or using confidential information of a client. In addition, the lawyer should stay abreast of technological advances to ensure that the storage system remains sufficiently advanced to protect the client’s information, and the lawyer should monitor the changing law of privilege to ensure that storing information in the 'cloud' will not waive or jeopardize any privilege protecting the information."

In this 2009 Ethics Opinion, the State Bar of Arizona addressed a question similar to the one addressed by Maine the previous year. In it, Arizona cited back to its 2005 Opinion and New Jersey’s 2006 Opinion to validate attorneys’ use of remote, electronic file storage systems, and stated that the “lawyer’s duty to take reasonable precautions does not require a guarantee that the system will be invulnerable to unauthorized access.”

The Bar went on to state that “the Committee also recognizes that technology advances may make certain protective measures obsolete over time. Therefore, the Committee does not suggest that the protective measures at issue in Ethics Op. 05-04 or in this opinion necessarily satisfy ER 1.6’s requirements indefinitely. Instead, whether a particular system provides reasonable protective measures must be ‘informed by the technology reasonably available at the time to secure data against unintentional disclosure.’ N.J. Ethics Op. 701. As technology advances occur, lawyers should periodically review security measures in place to ensure that they still reasonably protect the security and confidentiality of the clients’ documents and information.”

This New York State Bar Association’s Committee on Professional Ethics Opinion concluded that “A lawyer may use an e-mail service provider that conducts computer scans of e-mails to generate computer advertising, where the e-mails are not reviewed by or provided to other individuals.” While not named in the opinion, the question’s description of an “e-mail service provider that scans e-mails for advertising purposes” clearly describes Gmail.

The Maine Commission concluded that, “with appropriate safeguards, an attorney may utilize transcription and computer server backup services remote from both the lawyer's physical office and the lawyer's direct control or supervision without violating the attorney's ethical obligation to maintain client confidentiality.”

In this Opinion, the New Jersey Committee stated, “The critical requirement under RPC 1.6, therefore, is that the attorney ‘exercise reasonable care’ against the possibility of unauthorized access to client information. A lawyer is required to exercise sound professional judgment on the steps necessary to secure client confidences against foreseeable attempts at unauthorized access. ‘Reasonable care,’ however, does not mean that the lawyer absolutely and strictly guarantees that the information will be utterly invulnerable against all unauthorized access. Such a guarantee is impossible, and a lawyer can no more guarantee against unauthorized access to electronic information than he can guarantee that a burglar will not break into his file room, or that someone will not illegally intercept his mail or steal a fax.”

Most of the opinions already mentioned in this article point to a lawyer's duty to exercise "reasonable steps" to insure the confidentiality of their client's information. Many of them also refer back to Arizona Opinion 05-04 which states that lawyers should:

"take competent and reasonable steps to assure that the client’s confidences are not disclosed to third parties through theft or inadvertence. In addition, an attorney or law firm is obligated to take reasonable and competent steps to assure that the client's electronic information is not lost or destroyed. In order to do that, an attorney must be competent to evaluate the nature of the potential threat to client electronic files and to evaluate and deploy appropriate computer hardware and software to accomplish that end. An attorney who lacks or cannot reasonably obtain that competence is ethically required to retain an expert consultant who does have such competence."

Conclusion

The reality of computer security requires machines connected to the Internet to be maintained and patched on a regular basis. It’s important for lawyers to know what security measures are practiced by whatever cloud service provider they are considering, as well as where and how often vendors back-up the information stored with their services, among other concerns. Regardless of whether lawyers are storing files "in the cloud" or on their office’s local network, they must make a “reasonable effort” to keep that information secure to insure that those computers are as protected as they can be.

Originally posted 10/30/2011. ~~Last updated 11/8/15.~~ Last updated 2/4/19.

The post Legal Ethics Considerations for Lawyers’ Use of Cloud Computing Services appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Summary of the Colorado Bar Association Ethics Committee Formal Opinion 127: “Use of Social Media for Investigative Purposes”

Carole Levitt — Tue, 22 Dec 2015 23:51:41 +0000

In September 2015, the Colorado Bar Association Ethics Committee (Committee) issued Formal Opinion 127—“Use of Social Media for Investigative Purposes” to address the conflicting ethical opinions from various jurisdictions about how to apply the established ethical principles to the use of social media and social networks as investigative tools. The Committee stated, “In many respects, the ethical issues involved in conducting investigations through social media are neither novel nor unique.” The committee concluded that:

A lawyer may always view the public portion of a person’s social media profile and any public posts made by a person through social media.
A lawyer may always view the public portion of a person’s social media profile and any public posts made by a person through social media.
A lawyer acting on behalf of a client may not request permission to view a restricted portion of a social media profile or website of a person the lawyer knows to be represented by counsel in that same matter, without obtaining consent from that counsel.

[Note, the Committee stated, “Similarly, a lawyer may view or utilize information to which the lawyer already has access through the lawyer’s social media connections.” This might mean that if the lawyer was already Facebook friends with the represented party before litigation ensued, viewing the restricted portion would not be unethical because the lawyer already had access to it.]

When requesting or obtaining information from a third person who has access to restricted portions of a social media profile or website of a party or witness, a lawyer is subject to the same standards as when requesting any other information in the hands of a third person.
A lawyer may not request permission to view a restricted portion of a social media profile or website of a judge while the judge is presiding over a case in which the lawyer is involved as counsel or as a party, nor may a lawyer seek to communicate ex parte with a judge through social media concerning a matter or issue pending before the judge.
A lawyer may not request permission to view a restricted portion of a social media profile or website of a prospective or sitting juror.

[Note, the Committee stated that if the social media service has a technical feature whereby the social media service automatically communicates to the juror that you viewed their public profile, this would not be considered an impermissible communication by you to the juror. Various jurisdictions disagree with this, but the ABA agrees. However, the Committee stated that this could potentially violate Colo. RPC 4.4(a) if the lawyer knew about the automatic notification, engaged in repetitive viewing of the profile with no legitimate, and it rose to the level of harassment or intimidation.

A lawyer must never use any form of deception to gain access to a restricted portion of a social media profile or website.

The Committee, explained, “As stated in an article in the Colorado Supreme Court Attorney Regulation Counsel Newsletter, "donning an alias and ‘friending’ someone on Facebook to gain access to restricted information is prohibited."]

Finally, a lawyer may not avoid prohibitions relating to the use of social media for investigative purposes by delegating investigative tasks to others.

[Note: The Committee recognizes that, “A lawyer may advise a client concerning the client’s legal rights to access a restricted portion of a social media profile or website. Also, consistent with Colo. RPC 4.2, a lawyer may advise a client concerning direct communications through social media that the client is legally entitled to engage in with another party the lawyer knows to be represented by counsel. See Colo. RPC 4.2, cmt. [4]. However, a lawyer may not simply use the client as a means of communicating directly with a represented party in circumvention of Rule 4.2. See also Colo. RPC 8.4(a).”]

To read the full opinion, see: http://linkon.in/cobarsminvest127.

The post Summary of the Colorado Bar Association Ethics Committee Formal Opinion 127: “Use of Social Media for Investigative Purposes” appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Legal Ethics Opinions Related to Attorneys’ Use of Social Media Profiles for Investigative and Background Research

Mark Rosch — Wed, 27 Jun 2012 13:46:10 +0000

As more and more attorneys find useful background and investigative research information in the social networking profiles of opposing parties, potential witnesses, experts, etc. more and more State Bar associations are issuing Legal Ethics Opinions discussing whether or not (or under what circumstances they can) view these profiles to collect information about these types of people.

Follow us:

Share this article:

The following is a list of the currently available legal ethics opinions and guidelines:

For a more detailed discussion of Philadelphia Bar Association Ethics Opinion 2009-02 see our article, "Social Networking Sites are Valuable Tools For Lawyers: But Beware the Ethical Pitfalls."

For a comparison of New York State Bar Association Formal Ethics Opinion 2010-02 and Philadelphia Bar Association Ethics Opinion 2009-02, see our article, "New York State and Philadelphia Bar Association Legal Ethics Opinions Address Lawyers' Use of Social Media Sites for Investigative and Background Research."

Also see our collection of cases related to attorneys' use of social media for investigative and background research in various court jurisdictions.

The post Legal Ethics Opinions Related to Attorneys’ Use of Social Media Profiles for Investigative and Background Research appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

American Bar Association Formal Opinion 10-457 | California Legal Ethics MCLE

Mark Rosch — Sat, 31 Dec 2011 00:51:45 +0000

As early as 1996, many state bar associations began issuing opinions on Internet ethics, often focusing on law firm Web sites. Most of the rules and opinions relating to online communications apply the advertising rules that already exist for print advertising. In August 2010, the American Bar Association's Standing Committee on Ethics and Professional Responsibility released its Formal Opinion 10-457. The ABA addressed many of these same concerns, including: misleading information on web sites, creating undue expectations via the web site, and taking care not to create an inadvertent client-lawyer relationship via the web site in Formal Opinion 10-457.

Share this artice:

California Attorneys and Paralegals can earn one hour of Self-Study Legal Ethics MCLE credit by submitting this quiz after reading the ABA's Formal Opinion 10-457.

Continue reading →

The post American Bar Association Formal Opinion 10-457 | California Legal Ethics MCLE appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Social Networking Sites are Valuable Tools for Lawyers: But Beware the Potential Ethical Pitfalls

Mark Rosch — Mon, 10 May 2010 22:19:04 +0000

Social networking and ethics: what do these two concepts have in common? Plenty, if you're a lawyer. Using social networking can ensnare attorneys in ethical traps in two different ways — when accessing information in someone else's profile, or when an attorney's own profile information might be used against them. These are real world issues many practicing attorneys face every day. Let's focus on the American Bar Association's Model Rules of Professional Conduct.

WHAT'S PRIVATE?
An attorney recently pondered how she could access a witness' private (open only to "friends") profile on a social networking site. The Philadelphia Bar Association's Professional Guidance Committee Opinion 2009-02 (March 2009) addresses a similar question from a lawyer who wished to gain access to an unrepresented witness' private profile to use the profile information against the witness during litigation.

The inquiring attorney asked if he would be in breach of professional conduct rules if he asked a non-lawyer assistant to "friend" the witness, without the assistant explaining the reason for the request or disclosing that the assistant worked for the attorney.

The opinion concluded that this conduct would violate several rules of professional conduct.

First, the "proposed course of conduct contemplated by the inquirer [the lawyer] would violate ABA Rule 8.4(c) because the planned communication by the third party [the assistant] with the witness is deceptive. It omits a highly material fact — namely that the third party who asks to be allowed access to the witness's pages is doing so only because he or she is intent on obtaining information and sharing it with a lawyer for use in a lawsuit to impeach the testimony of the witness."

Second, even though the attorney is not making the actual "friend" request, because of Rule 5.3 (Responsibilities Regarding Nonlawyer Assistants), the attorney is in violation of Rule 8.4(c) because he is responsible for the "violative conduct" of the person he supervises.

Third, the proposed conduct violates Rule 4.1 because it, "constitutes the making of a false statement of material fact to the witness."

Fourth, because "the violative conduct would be done through the acts of another third party, this would also be a violation of Rule 8.4a."

Would any of the above ethical dilemmas arise if this were a public profile? Probably not. After all, if the profile is open to the public, there would be no actual contact or exchange with the profile's owner.

ETHICAL TRAPS
How can information posted by an attorney to his own social networking profile create ethical traps? For the most part, the attorneys simply trap themselves with their own words.
Here are a few examples:

Texas: Judge Susan Criss caught an attorney lying about the reasons he needed a continuance, by viewing the attorney's Facebook profile where she learned that he was on vacation and not attending a relative's funeral. This is just the type of situation that could invoke a Rule 3.3(a)(1) "Candor Toward the Tribunal" charge. ("A lawyer shall not knowingly make a false statement of fact or law to a tribunal...")

Nevada: A lawyer, sitting as a temporary pro tem judge in Clark County, Nevada, was removed from the bench after his MySpace page caught the attention of the local district attorney, who believed that the profile exhibited hostility to prosecutors and could result in bias against the D.A.'s office.

In addition to losing his pro tem position, this conduct could have been considered a breach of Rule 8.4(d). ("It is professional misconduct for a lawyer to engage in conduct that is prejudicial to the administration of justice.")

Minnesota: A Somali man convicted of murder in Minneapolis filed an appeal based on derogatory remarks against Somalis — allegedly posted by the prosecutor in her Facebook profile during trial.

In addition to a potentially successful appeal, an 8.4(d) misconduct charge could be on the horizon for this prosecutor based on Comment 3, which states that it is professional misconduct for a lawyer, in representing a client, to knowingly manifest by words or conduct, bias or prejudice based upon race, sex, religion, national origin … when the actions are prejudicial to the administration of justice.

North Carolina: The state's Judicial Standard Commission reprimanded Judge B. Carlton Terry Jr. for using Facebook to talk to a defense attorney about a child custody case, including indications of when the verdict would be delivered.

While there was no report of what the attorney said to the judge, be careful about friending a judge (or a juror) for fear of invoking a Rule 3.5 "Impartiality and Decorum of the Tribunal" ethics charge ("A lawyer shall not knowingly: (a) seek to influence a judge, juror, prospective juror, or other official by means prohibited by law or (b) communicate ex parte with such a person during the proceeding...").

LinkedIn: In a recommendation on an attorney's profile, a client stated, "In every case Mark was equal to or significantly better than the opposing lawyer." While these words were not written by the attorney, the attorney does have control over posting this recommendation.

Thus, the posting might violate Rule 7.1 if it were considered misleading under the comment to Rule 7.1. (An "unsubstantiated comparison of the lawyer's services … with the services … of other lawyers may be misleading if presented with such specificity as would lead a reasonable person to conclude that the comparison can be substantiated.")

DON'T GET TRAPPED
To avoid any ethical traps concerning accessing a private profile, read the Philadelphia opinion. It's the only ethics opinion on point.

To avoid having your own profile ensnare you into an ethical trap, configure your profile with the site's most restrictive security/privacy settings.

This assumes you are using your social networking profile for personal reasons only. But if you are using your social networking profile for professional/marketing purposes, using the most restrictive settings would run counter to your purpose, so choose your words (and your friends) carefully.

The post Social Networking Sites are Valuable Tools for Lawyers: But Beware the Potential Ethical Pitfalls appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.