By Mark Rosch

The Breach: A Timeline of Events

In December 2022, the Cl0p ransomware gang claimed responsibility for a cyberattack on the teh New York City Bar Association. The gang boasted that their breach gave them access to 1.8 terabytes of stolen data about the Association's 27,000 members. Despite the early warning, the NYC Bar Association remained silent until November 2023, notifying affected individuals only after filing mandatory data breach reports with various state authorities.

The investigation, completed in October 2023, confirmed that hackers infiltrated the association's systems between December 2nd and December 24th, 2022. While the official notification redacted details regarding compromised data, information file with Maine Attorney General's Office (by one of  the affected Association members) revealed the exposure of sensitive information such as names, financial account numbers, credit cards, and even security codes.

Impact and Implications

Beyond the immediate concern of potential financial losses due to identity theft and fraud, the breach raises serious ethical and legal questions. Lawyers are entrusted with sensitive client information, and the exposure of such data can have devastating consequences, including reputational damage, loss of clients, and legal repercussions.

This incident also highlights the vulnerability of the legal industry to cyberattacks. Law firms often hold vast amounts of confidential information, making them a lucrative target for hackers. Additionally, the decentralized nature of the industry, with numerous small and mid-sized firms lacking adequate resources for robust cybersecurity, further exacerbates the risk.

Moving Forward: Lessons Learned and Recommendations

The NYC Bar Association breach serves as a reminder that no organization is immune to cyberattacks. To effectively mitigate risks and protect sensitive information, legal professionals and organizations need to implement proactive measures, including:

• Comprehensive cybersecurity training: Educating lawyers and staff on cybersecurity best practices, including phishing awareness and password hygiene, is crucial in preventing initial breaches.
• Data security assessments and audits: Regularly evaluating security vulnerabilities and implementing appropriate controls is essential to identify and address weaknesses before they can be exploited.
• Robust data encryption: Encrypting sensitive information at rest and in transit significantly reduces the risk of data exposure in case of a breach.
• Multi-factor authentication (MFA): Implementing MFA adds an extra layer of security, making unauthorized access significantly more difficult.
• Cybersecurity incident response plans: Establishing a well-defined plan for identifying, containing, and remediating cyber incidents is critical for minimizing damage and ensuring a timely response.
• Cyber insurance: Consider investing in cyber insurance to mitigate financial losses and assist with recovery efforts in the event of a breach.

Beyond Cybersecurity: A Call for Collective Action

The legal industry needs to come together and collaborate on comprehensive cybersecurity solutions. This includes sharing best practices, fostering knowledge exchange, and advocating for stronger data privacy regulations. Additionally, legal professionals need to hold themselves accountable for safeguarding client information and actively participate in industry-wide efforts to improve cybersecurity standards.

The NYC Bar Association breach should serve as a wake-up call for the entire legal community. By acknowledging the evolving threat landscape, prioritizing cybersecurity investments, and working together, the legal industry can build a more resilient and secure future for itself and its clients.

The post New York City Bar Association Reports Data Breach appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

In that order, counsel in the Northern District of California Oracle v. Google case agreed to Judge William Alsup’s proposed March 25, 2016 order that banned them from researching jurors’ internet presence. Oracle v. Google, No. C-10-03561, Document 1573 (N.D.Cal March 25, 2016), http://linkon.in/jurorgoogleoracle. If counsel had failed to agree with the proposed order, the judge stated that he would inform the jurors they were being researched by counsel.

The judge acknowledged that it is not unethical for counsel to conduct Internet searches on prospective jurors and to also view their public social media profiles. However, he then went on to say,  “That such searches are not unethical does not translate into an inalienable right to conduct them.”

He also discussed ABA Formal Opinion No. 466, where the ABA considered the extent to which an attorney may conduct Internet searches of jurors and prospective jurors without running afoul of ABA Model Rule 3.5(b) (which prohibits ex parte communication with jurors). In that Formal Opinion, the ABA said that judges may limit the scope of the searches that counsel could perform regarding the juror’s social media “[i]f a judge believes it to be necessary, under the circumstances of a particular matter . . . .” 

The judge based his juror research ban on three reasons:

• First, if they knew lawyers were researching them, Judge Alsup feared that jurors would stray from the court’s admonition to refrain from conducting internet searches on the lawyers and the case.
• Second, if the lawyers’ research uncovered certain juror preferences, they might shape their trial arguments and witness examinations to make improper personal appeals to the jurors based on those preferences.
• Third, the judge wanted to protect the privacy of the venire.

In the order, Judge Alsup discussed several ethics opinions related to lawyers conducting juror research, including:  “Formal opinion. No. 2013-189, issued by the Oregon state bar provides, unlike the ABA or the ABCNY, that a lawyer may affirmatively request access to private aspects of a juror’s social media profiles [emphasis added], provided the lawyer accurately represents his or her role in a case when asked by the juror.”

We think he misstated Oregon’s Formal opinion. No. 2013-189.

In footnote two, on page 578-579, the Oregon opinion actually said:

Although a lawyer may review a juror’s publicly available information on social networking websites, communication with jurors before, during, and after a proceeding is generally prohibited. Accordingly, a lawyer may not [emphasis added] send a request to a juror to access non-public personal information on a social networking website, nor may a lawyer ask an agent do to do so [emphasis added]. See Oregon RPC 3.5(b) (prohibiting ex parte communications with a juror during the proceeding unless authorized to do so by law or court order); Oregon RPC 3.5(c) (prohibiting communication with a juror after discharge if (1) the communication is prohibited by law or court order; (2) the juror has made known to the lawyer a desire not to communicate; or (3) the communication involves misrepresentation, coercion, duress, or harassment); Oregon RPC 8.4(a)(4) (prohibiting conduct prejudicial to the administration of justice). See, generally, §61:808, ABA/BNA Lawyers’ Manual on Professional Conduct and cases cited therein.

Read the Oregon Formal Opinion for yourself and see if you agree that Judge Alsup misinterpreted the Oregon Formal Opinion. You can find the Oregon Formal Opinion at: https://www.osbar.org/_docs/ethics/2013-189.pdf.

The post Oracle v. Google: The Social Media Research Ban appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

Recently, the New York City Bar Association added access to Casemaker's premium services as a free benefit for their members.

The Casemaker Federal Library contains items such as the United States Supreme, Circuit, District and Bankruptcy court opinions; Federal Court Rules; United States Code; Code of Federal Regulations; Federal Rules Decisions, and Constitution. Its State material libraries (for all 50 states and the District of Columbia) include, at a minimum, Case law, Statutes, Court Rules, and State Constitution. The New York library on Casemaker includes:

• Appellate and Trial Court Opinions
• New York Statutes
• New York Administrative Code
• New York Court Rules
• New York Attorney General Opinions
• New York Legislative Acts
• New York Constitution
• New York City Administrative Code
• New York City Charter
• New York City Local Laws

And as a bonus, the New York City Bar is providing ALL of Casemaker’s premium services to its members for free, such as:

• CaseCheck+ – A negative citator system that informs you if the case you're reading is still good law.
• CasemakerDigest – daily e-mail summaries of state and federal appellate decisions (within 12-24 hours of publication), listed by practice area.
• CiteCheck – Upload a brief and in minutes Casemaker will automatically check your citations to be sure they are still good law.

Internet Legal Research on a Budget’s Chapter 8 provides detailed instructions on how to use Casemaker and also explains some of the features and limitations of CaseCheck+ and CiteCheck…and provides you with a work-around.

To purchase Internet Legal Research on a Budget, see https://www.netforlawyers.com/page/internet-legal-research-budget-free-low-cost-resources.

The post New York City Bar Association Adds Access to Casemaker Legal Research Resources as a Member Benefit appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.

More and more attorneys and judges are using social media. Some use it for its intended purpose of social networking (and, for the lesser intended purpose of marketing). Others take advantage of the information contained in these sites for an unintended purpose - investigative research.

Legal pundits have argued (online and in print) about the ethical issues for attorneys utilizing this information in the matters they handle. Few Bar Associations have opined on the topic. One exception is the Association of the Bar of the City of New York. They addressed the following specific question:

Is it ethical for an attorney to send a "friend" request to an unrepresented person if the attorney uses her real name and profile without also disclosing the reasons for making the request?

The Association of the Bar of the City Of New York Committee on Professional and Judicial Ethics - Opinion 2010-2 (Sept. 2010) available at http://www.abcny.org/Ethics/eth2010.htm, concluded that there would be no violation of the rules of professional conduct if an attorney or her agent uses her real name and profile to send a "friend request" to obtain information from an unrepresented person's social networking website without also disclosing the reasons for making the request. However, the Committee noted that a, "lawyer may not attempt to gain access to a social networking website under false pretenses, either directly or through an agent." The Committee said:

Rather than engage in "trickery," lawyers can -- and should -- seek information maintained on social networking sites, such as Facebook, by availing themselves of informal discovery, such as the truthful "friending" of unrepresented parties, or by using formal discovery devices such as subpoenas directed to non-parties in possession of information maintained on an individual's social networking page. Given the availability of these legitimate discovery methods, there is and can be no justification for permitting the use of deception to obtain the information from a witness on-line.

Accordingly, a lawyer may not use deception to access information from a social networking webpage. Rather, a lawyer should rely on the informal and formal discovery procedures sanctioned by the ethical rules and case law to obtain relevant evidence.

It's important to note that this opinion is specific to the New York City Bar. Furthermore, not all Bar Associations are in agreement. Read this article for information on the Philadelphia and New York State Bar Association's position on similar questions. Finally, consider that while the New York City Bar's opinion is more permissive, the New York State Bar controls an attorney's license in that jurisdiction.

Lawyers can earn one hour of MCLE credit for reading this article and the related Legal Ethics opinion by completing this quiz.

The post New York City Bar Association Ethics Opinion Addresses Use of Social Network Sites for Investigative or Background Research appeared first on Continuing Legal Education (MCLE) in California, MCLE Los Angeles, CLE Orange County, Irvine & San Francisco.