Sharing Files With Clients: Security and File Management

Episode Notes

Transcript

Sharon D. Nelson: Before we begin, we would like to thank our sponsor, Nota.

[Music]

Intro: Welcome to The Digital Edge with Sharon Nelson and Jim Calloway. Your hosts, both legal technologists, authors and lecturers, invite industry professionals to discuss a new topic related to lawyers and technology. You’re listening to Legal Talk Network.

Sharon D. Nelson: Welcome to the 186th Edition of The Digital Edge, lawyers and technology. We’re glad to have you with us. I’m Sharon Nelson, President of Sensei Enterprises, an information technology, cyber security and digital forensics firm in Fairfax, Virginia.

Jim Calloway: And I’m Jim Calloway, Director of the Oklahoma Bar Associations Management Assistance Program. Today our topic is Sharing Files with Clients: Security and File Management. Our guest today is Roberta Tepper, the chief member services officer at the State Bar of Arizona. She and her team are responsible for Practice 2.0, the Bars Practice Management Advice Program, CLE and numerous other bar programs focusing on lawyer competence, professional growth and development, and enhancing their practice. Roberta is active in the ABA Law Practice Division, serves on the division counsel, is featured editors for the Law Practice magazine. And also, Sharon and I’d like to know she is a former pasture of ABA Tech Show. Thanks for joining us today, Roberta.

Roberta Tepper: Thank you and thank you for remembering the Tech Show part.

Sharon D. Nelson: Well, Roberta, lawyers are often very confused about whether they should use a standalone file sharing tool or a tool that serves multiple purposes including file sharing. So, what would your advice be, Roberta?

Roberta Tepper: Although I have a personal preference and opinion which I am sure to share with you momentarily. I think the answer is use the tool that you are most comfortable with because if you’re not comfortable with it or you don’t understand how it works or you haven’t been trained on it, either you’re not going to use it or you’ll use it inconsistently or you’ll use it incorrectly and you won’t be able to supervise your staff on it. So, you know, there’s no perfect tool. It’s like the android, iPhone, Thompson’s choice. Neither one is per se better than the other but make sure you have a tool that you like that you’ll use.

Jim Calloway: Roberta, this is a topic we’ve discussed several times before. More and more lawyers are using client portals for file sharing. Why do you believe that is?

Roberta Tepper: Jim Calloway is the ambassador of client portal. So really, it’s interesting to talk with him and to talk with you about it. So, you know, client portals are typically integrated with practice management solutions and, as a general background, they have high levels of security, but the built-in part is really the thing that makes them easy and I think preferable. I have been well schooled and my client portals are great and I agree. It’s easy to make sure that what you send and receive through the portal goes to the right case. Portals could be branded to your firm. They minimize the drag and drop opportunity for failure.

So, just the other day, I was talking to a lawyer who had digital files and was closing their practice and wanted to return files to clients but had to first audit every single digital file because they knew that, over the years, they had inadvertently dragged and dropped stuff from a different client file into another client’s file, and they really didn’t have any confidence in the integrity of each individual client file.  So, you know that’s a number one for me. The other thing about client portals is it’s easier to limit access to appropriate people. Now, of course, you still have to be careful not to give permissions to, let’s say, opposing counsel or opposing client. To me at least, using an integrated client portal just makes more sense and, for most lawyers, especially solo and small firm lawyers who don’t have staff dedicated to assist them, it’s just easier.

Sharon D. Nelson: I’m always horrified that I see so many lawyers still using email to file share. Why don’t you tell us why that’s such a terrible idea?

Roberta Tepper: Well, sadly, it’s not only lawyers and, in defense of lawyers, I will say that I have had to school my doctor’s office not to send me personal health records through, via email attachments. So, it’s not just lawyers, but email is inherently insecure —

(00:05:03)

— unless, of course, you are using high-level uniform encryption of every email, which I guarantee most lawyers are not. In fact, I would go so far as to say the vast majority of lawyers are not. So, you know, and I would say too much as I had been well schooled by Jim Calloway on client portals, I had been well schooled by you, Sharon and John and Sensei about the insecurity of email. And so, if there’s anybody listening to this who wants to read articles that will shrivel up the hair on the back of their neck to go to your excellent articles and blogs, but email is inherently insecure and attachments even more so. So, attaching your confidential client information to an email is like an invitation to have some, let’s just call them evil doer. Go ahead and read that information and use it against you.

Sharon D. Nelson: I like the word evil doer. There’s got to be a great PowerPoint graphic for that.

Roberta Tepper: I think we can say —

Jim Calloway: How much more with bad guys?

Roberta Tepper: Yeah, nefarious.

Jim Calloway: Roberta, I’m well aware there are some great standalone file sharing products, but what are the potential downside from using those?

Roberta Tepper: You know, the question actually gives you part of the answer here which is standalone. There are, as you said, great standalone products that offer great security and it goes without saying that there are — if a lawyer is going to use a standalone product to not use a consumer-grade version of it that you need to use the business grade. But, you know, in terms of the great standalone products, I mean Citrix ShareFile jumps right into mind, but there are many others. The problem with standalones is it’s not integrated with the rest of your digital file. And so, you know, sort of back to my point about the inadvertent drag and drop or the inadvertent mistaken in folder structures or making sure that the permissions are set. And then, you know, if you have documents and files living in your standalone solution, you’ve created a situation that now you have a duplicate file sitting out there somewhere that may or may not be get updated when other things in your actual digital record are getting updated. So, you’re not going to go and continually update those files that are sitting there. Are you going to remember to delete them? You know, who knows? But there’s problems with that.

You know, one of the impetuses for Laura and I to write this column on this topic was that I got pulled into a lawyer regulation case, meaning discipline, where the lawyer and their paralegal had repeatedly shared information between clients that ought not have been shared, so from one case to the other and had violated client confidentiality, and it turns out that probably the reason for that was that they had not correctly assigned permissions for every subfolder in their individual independent standalone file sharing platform. And so, client A was getting client B’s paperwork and client B was getting client A and client C’s paperwork and they just couldn’t get it right. And once the problem started, of course, it was hard to unwind that. So, you can’t unring that bell. So, great file-sharing products are great if you have the support to do it, if you have the administrative support to do it and then just from a sort of like last note is from an e-discovery point if you ever had to deal with that figuring out where everything is related to your case can be made more complicated by a standalone file sharing product.

Jim Calloway: Before we move on to our next segment, let’s take a quick commercial break.

[Music]

Craig Williams: Today’s legal news is rarely as straightforward as the headlines that accompany them. On Lawyer 2 Lawyer, we provide legal perspective you need to better understand the current events that shape our society. Join me, Craig Williams, and a wide variety of industry experts as we break down the top stories. Follow Lawyer 2 Lawyer on the Legal Talk Network or wherever you subscribe to podcasts.

[Music]

Dave Scriven-Young: You like legal podcast because you’re curious and want to be the best attorney you can be. I’m Dave Scriven Young, host of Litigation Radio produced by ABA’s Litigation section with Legal Talk Network. Searching your favorite podcast player for Litigation Radio to join me and my guests as we examine hot topics and litigation and topics that will help you to develop your litigation skills and build your practice.

(00:10:00)

I hope you’ll check out Litigation Radio and join the ABA Litigation section for access to all the resources, relationships and referrals you need to thrive as a litigator.

[Music]

Sharon D. Nelson: Welcome back to the Digital Edge on the Legal Talk Network. Today, our subject is Sharing Files with Clients: Security and File Management. Our guest today is Roberta Tepper, the chief member services officer at the State Bar of Arizona. She and her team are responsible for Practice 2.0, The Bars Practice Management Advice program, CLE, and numerous other bar programs focusing on lawyer’s competence, professional growth and development and enhancing their practices. Roberta is active in the ABA Law Practice Division, serves on the division council and is the features editor for Law Practice magazine. So, Roberta, here’s a question. Does or should the sophistication of a firm’s clients impact the decision about which solution you choose?

Roberta Tepper: Does it? I would say sadly not always. Shouldn’t, absolutely. If you have sophisticated clients who are tech-savvy, then they can pretty much adapt to any platform that you choose or any of the security requirements that come with it. But if you have unsophisticated clients and by unsophisticated, I wouldn’t just lump in that unsophisticated people who have never touched a computer. I would lump into that unsophisticated people who just are a little bit challenged about navigating anything that they’re not completely familiar with because the one thing you’re not going to do is get your client to come into your office for a training session on how to retrieve documents you’re going to send them. So, security is one thing and, of course, we’re all pro excellent security. But the second thing is that if your clients can’t easily access whatever it is you’re going to send them whether it’s through a portal or a standalone system, you might as well just not use it. You might as well just go back to snail mail.

Jim Calloway: Is a part of the Allure of the Microsoft 365 ecosystem that you can move from one drive to SharePoint to Word and have them all work together in concert?

Roberta Tepper: Absolutely. I mean, isn’t it better to have something seamless that you don’t have to cobble together a bunch of different systems and wrangle how they each work and work together and separately. You know, Microsoft, of course, provides good basic security and most people are familiar with at least some of the products in the Microsoft universe. So, it’s much easier to develop processes and workflows if you don’t have to jump from system to system and navigate the differences among them in order to do that. It’s always better to have, you know. I guess, this is part of my preference for a client portal, right, is that it’s better to have one system that works together than to cobble together other systems, unless you are extraordinarily tech adapt.

Sharon D. Nelson: A lot of small firms use business versions of Google Drive, Google Workspace, Dropbox Business, Box and Citrix ShareFile. What are the upsides and downsides, Roberta, of using these?

Roberta Tepper: Well, the upside is that a lot of these can be relatively inexpensive, and the other upside is that many small firm lawyers and their staff are already using some of these in their personal lives. So, they’re not necessarily getting the robust features of a business version, but they’re at least familiar with them. The downside, of course, you know, I’ll revert to the earlier discussion about standalone products is that there are — the more times that there has to be a connection, the more programs that touch something, the more hands that touch something in a process, the more opportunity there is for error. The other downside is and this was what happened in that case I referred to earlier is that people think they know how to use it because they’ve used, let’s say, and I’m not picking on anybody, but let’s say they use Google Photos to store their photos or Google Drive to store something personal. And now, they think they know all the rules that should affect their use of it for business and they don’t get the training and spend the time to make sure that it’s really configured the way that it should be for business purposes.

Jim Calloway: What do you think about law firms using Document Management Systems?

Roberta Tepper: Well, Document Management Systems definitely have strong capabilities for both file management and security.

(00:15:03)

But in this cost-conscious world, we have to be aware that for some firms, Document Management System, may be cost prohibitive and that’s not just for solo and small firms. You know, I’ve talked to folks who are in — what we would call in Arizona, a mid-sized firm, so somewhere up to about 20 lawyers and just because of the volume of their documents or what they need the system to do, it can become financially prohibitive. So, with that in mind, Laura and I in our columns, we tend to focus on a little more frugal option but, I mean, certainly using a Document Management System that’s tied into your other systems is where in the Cadillac. And so, what we would recommend all things being equal.

Jim Calloway: Before we move on to our next segment, let’s take a quick commercial break.

[Music]

Jared Correia: They say the best things in life are free, which either means The Legal Toolkit podcast is pretty awesome or we’re totally committed to the wrong business model. You’ll just have to tune in to find out which it is. I’m Jared Correia and each episode I run the risk of making a total ass of myself so that you can have a laugh, learn something new, and why not, maybe even improve your law practice. Stop believing podcasts can’t be both fun and helpful. Subscribe now to The Legal Toolkit. Go ahead. I’ll wait.

[Music]

Jud Pierce: Workers Comp Matters is a podcast dedicated to exploring the laws, the landmark cases and the true stories that define our workers’ compensation system. I’m Jud Pierce and together with Alan Pierce, we host a different guest each month as we bring to life this diverse area of the law. Join us on Workers Comp Matters on the Legal Talk Network.

[Music]

Sharon D. Nelson: Welcome back to the Digital Edge on the Legal Talk Network. Today, our subject is Sharing Files with Clients: Security and File Management. Our guest is Roberta Tepper, the chief member services officer at the State Bar of Arizona. She and her team are responsible for Practice 2.0, The Bars Practice Management Advice program, CLE, and numerous other bar programs focusing on lawyer’s competence, professional growth and development and enhancing their practices. Roberta is active in the ABA Law Practice Division, serves on the division council and is the features editor for Law Practice magazine. So, Roberta, what’s the upside and the downside of using secure messaging solutions like Signal? Because as you can imagine, we around this office kind of like Signal. So, I’m interested in the downside.

Roberta Tepper: So, I can imagine. You know, there’s an ad that plays on TV here. I don’t know if it plays in your area of somebody going into one of these post office services and say they want to send mail and the guy ties it to a carrier pigeon, doesn’t even put it in an envelope and they say, “Well, that’s silly. Why you’re doing that?” and they said, “Well, you know that text message that you just sent, you might as well just tie it to a carrier pigeon because that’s the level of security your standard text messaging is going to carry.” So, to your point, that was a great — I think it was a great demonstration for folks who hasn’t really thought about that about how insecure generally speaking text messaging is. So, of course, the upside is great security and end to end encryption. You know, the downside is number one, you might ask your client who is not familiar with Signal to use it and they may be challenged and, number two, is that you might not be able to preserve your communications and I can’t tell you even now years into the discussion of text messaging with clients. How many lawyers just keep forgetting that substantive text messages between you and your client, our client communications that need to be preserved. So, the inability or the difficulty in preserving communications can make those kinds of solutions less useful.

Sharon D. Nelson: From an ethics point of view, I’ll give you that. But Signal is one of the great choices that people have for keeping communications confidential.

Roberta Tepper: Absolutely. I mean, I’m right on your side of the fence in terms of preserving that confidentiality.

Jim Calloway: Well, if you have a lawyer or firm who’s on a really shoestring budget, what are your best tips, Roberta?

Roberta Tepper: Well, if you’re already using the Microsoft 365 Universe and you’re going to use file sharing or, in fact, even if you’re not going to use file sharing but in general, turn on multi-factor authentication. People, even again, —

(00:20:00)

— even now get a bad attitude about multi-factor authentication because it’s one more thing they have to do to sign on, but it can make the difference. You know, all we can do is make our communications more difficult for evildoers to intercept. We can’t absolutely prevent it. I’ve heard some wise people, Sharon and Jim, say it’s not if but when. So, turn on multi-factor authentication. If the email you were using doesn’t give you an option to turn on encryption, explore whether or not there is an upgraded version of your email that will allow you to encrypt email and that can certainly be helpful. At the very minimum if you are sharing files, you should password protect them. That’s easy to do. It’s native to practically any application that you are using to create documents. So, you can password protect Word files. You can password protect Excel files. You can password protect PDF documents.

You know, in our column we said, before emailing them to clients, but we say that with the proviso that we are urging people to never email them to clients. But even if you’re using some kind of file sharing system, password protecting your files with a password that you’re going to separately communicate to your client is just such an easy thing to do and easy for the client to understand how to deal with but don’t email financial information, health information, dates of birth, banking information. I can’t help but to always repeat that. I sound like Cassandra and the voice of Doom, but lawyers are still doing it and we’re still urging them not to. That’s something else you can do. On a shoestring budget that you can do on your own is pay attention to how you’re using your file sharing solution and make sure that your file structure sufficiently segregates the client’s file from any other client’s file.

So, talking about that discipline case, I mean, that lawyer faced discipline because they were completely inadvertently and not deliberately sharing information but, at some point, negligence becomes less than inadvertent. So, use good naming conventions on your file structure. Make sure you understand what’s going in and what’s going out and trainings for yourself and your staff is either free or inexpensive and is never time bill spent. Anything you would have done and these are for folks, sort of middle range in practice as opposed to newer lawyers, if you would have done something to secure your paper file, make sure you do something to secure your digital file and don’t assume that because it’s in the Cloud. It’s safe. So, those are just a few tips. I’m sure there are probably a dozen more. We could probably do 60 tips in 60 minutes with some adequate planning, but those are some easy things about files sharing that you can do without adding on any additional platforms or apps.

Sharon D. Nelson: I think that’s a really good answer. I’ll add to that too that there are a lot of providers out there that would just assume you spend more money because they get more money. So, you want to make sure that you have somebody giving you advice, your IT and cybersecurity advice, who really is looking for the best possible security at the best price point. That’s not so easy to find, but the best way to find someone like that is just to ask your peers. Generally speaking, somebody will tell you, yeah, I have this great company that will help figure out how you can do all of these cybersecurity things on an Ebenezer Scrooge kind of budget because that’s really what they’re looking for and it’s hard. It’s very, very hard. So, they have to rely on their advisers, but you gave us just such a great series of tips here, Roberta, and, of course, we knew the minute we invited you that there would be a lot of laughter and there was, and we knew that the tips would be top-notch and they were. So, we thank you for saying yes and coming and joining us today.

Roberta Tepper: Well, thank you for having me. It’s always a pleasure.

Sharon D. Nelson: Well, that does it for this edition of The Digital Edge lawyers and technology and remember you can subscribe to all of the editions of this podcast at legaltalknetwork.com or an Apple podcast, and if you enjoyed our podcast, please write us at Apple podcast.

Jim Calloway: Thanks for joining us. Goodbye, Ms. Sharon.

[Music]

Sharon D. Nelson: Happy trails, cowboy.

Outro: Thanks for listening to The Digital Edge, produced by the broadcast professionals at Legal Talk Network. Join Sharon Nelson and Jim Calloway for their next podcast covering the latest topic related to lawyers and technology.