Showing posts with label processes. Show all posts
Showing posts with label processes. Show all posts

Tuesday, November 26, 2013

Effective Security Starts at the Top: The S.C. Supreme Court Mandates Strong Passwords

Earlier this month the South Carolina Supreme Court ordered all members of the South Carolina Bar and all foreign legal consultants to log-in to the Attorney Information System (AIS) and 1) adopt a stronger password; 2) choose and answer updated security questions; and 3) update and verify their contact information in AIS.  Pursuant to the terms of the Order, those who fail to do so by December 15, 2013 may face suspension.

The Court's Order offers good lessons for all attorneys (and others) attempting to secure their firms and businesses.

Security is a Process, Not A Product

The Court recognizes that the security of the AIS relies in no small part on strong passwords created by attorneys, and mandates a process to attain that end.  As discussed here, human mistakes (as opposed to software or hardware inadequacies) account for most security breaches.  Using a  "weak" password (one that a computer can guess by means of generating many characters) or a "common" password (one that a person can guess or read) is like leaving a door open or a safe unlocked.

Although various technology products offer essential parts of an effective security program, (as discussed here and in  Locked Down: Information Security for Lawyers) no product will save you from yourself if you decide to use "password" as your password, use the same password on multiple sites, click on bad links, or voluntarily share your bank account number in response to an email message.

Consider how to make security a priority in your firm, through the use of policies, training, and/or other methods.  And understand that the combination of people, processes, and technology is necessary for appropriate security.  

Any Effective Security Process Has Support From The Top and Appropriate Teeth


A Supreme Court mandate with Chief Justice Toal's signature and the threat of losing the ability to practice law is an effective way to get an attorney's attention and ensure compliance.  Moreover, the fact that attorneys will not be allowed to pay their license fees until they have complied with the Order all but ensures 100% participation.

By contrast, how many attorneys would have updated their information in response to an email memo from a systems administrator for the AIS suggesting the use of stronger passwords?  How many of you consider the recommendations of your IT staff, implement same, and follow through to make sure they are followed?

Protecting the client file as required by Rule 1.6 (“Confidentiality of Information”) and Rule 1.15 (“Safekeeping Property”) of the South Carolina Rules of Professional Conduct ("RPC") includes securing electronic information.  A security breach caused by a weak password or indiscriminate browsing may cause the same unauthorized disclosure of a client's confidential information as the theft of a paper file.

Conclusion  


Although strong passwords may be a hassle and create yet another thing for attorneys to remember (and for some assistance with "password fatigue" click here), clearly their use is one part of an effective information security program.  Just as incentives and discipline are used in connection with other corporate purposes and obligations (e.g. to "encourage" lawyers to get their time in), so too should lawyers consider how to best encourage and enforce the development of a culture of security in their firms.     

Sunday, March 24, 2013

Every Lawyer is A Technologist: Take a Step Back to Take the First Step Forward

Quit Pointing Out What I Don't Know, and Tell Me Where to Start Learning 

The legal community is all atwitter (pun intended) about the effect of computer technologies (and other forces) on the way law is practiced.  You hear the use of terms like "revolution," "sea change," and "paradigm shift."  Some observers suggest that emerging technologies are throwing out not only the bathwater of the legal practice, but also the baby, the bathtub, and the plumbing.

For those attorneys not riding this wave, all the discussion of algorithms, ESI, Big Data, and the "urgent" need for change is disconcerting at best, and downright terrifying at worst.  Fear may be an effective motivator, but only if you know where you are going and what you are going to do.  Fear that creates only doubt (including the Fear of Missing Out or FOMO) results in paralysis (head in the sand), denial (it doesn't affect what I do), anonymous Internet comments (no explanation necessary), and/or substance abuse (likewise).

And lawyers often respond to fear in that quintessential American way:  by reflexively buying something (smartphone, tablet, software) in the hope it will address our anxieties and solve our problems.We buy without a thought to how the product or service will become a part of our existing practice, (or part of an existing network).  As a result, when we don't know what we want (or how we intend to use it), we end up with a lot we don't want (and don't use).

Let me suggest a different approach.  Forget computers for the time being.  They are a distraction (and not for the usual reasons).  Technology is not just computers and computer systems.  Technology is the application of knowledge for practical purposes (look it up).  Technology is the collection of tools we use now to solve problems for our clients. Lawyers use technology every day even if they never turn on a computer.

And no decision to buy shiny new tools (especially expensive ones) can take place without evaluating your current technology- nothing more than what you do and how you do it- and then considering if there are other ways to do it better.  In other words, 1) take stock of what you know, have and do; 2) consider how you might do those things more effectively, and then (and only then) 3) adopt the tools that will accomplish your goals.

We are talking about how to evolve and adapt by building on our current approaches to problem-solving, not by letting HAL ("File the motion, HAL"; "I'm sorry, Jack.  I can't do that.") take over our practices.  

What Do Lawyers Do?

Lawyers solve problems.  The reason clients hire attorneys is because they need assistance getting something or somewhere.  That "destination" may be the consummation of a business deal, creation of an entity, a favorable resolution to litigation, an estate plan, or a variety of other outcomes.

What Do Lawyers Use to Solve Problems?

Lawyers Solve Problems Using What They Know: Information and Legal Knowledge.  In tackling our client's problems, in the most fundamental sense we use and apply what we know.

One part of what attorneys know is the information we learn over the course of a particular matter.  We process, store, and present information in service of our clients.  We identify, seek, and exchange information in discovery. We take the facts we learn, discern how best to use them, and present them in an appropriate forum or context.    

Lawyers also combine information with legal knowledge.  We receive facts in one form and repackage them in the context of their legal significance. We cite and argue relevant law gleaned from cases, treatises, and other sources.  Pleadings, motions, and briefs are nothing but collections of information and legal knowledge. We present information and legal knowledge to a jury, judge, or appellate court.  Information and legal knowledge shape transactions, wills, trusts, and tax returns. We also store our legal knowledge somewhere (hopefully not just in our heads).

Lawyers Use Knowledge (Both Legal and Practical) To Manage Information.  In our representation and advocacy, lawyers already utilize various tools (all of which are forms of technology) to organize and and present information and convey legal knowledge: 

Processes/Procedures.  How we practice law is in large part a collection of processes.  A process is just a series of steps involved in preparing and presenting what we know.  The creation and preparation of any document is merely a process that applies knowledge to information.  Pleadings are drafted, reviewed, edited, filed, and served according to the requirements of various rules, standards, and practices.  Likewise, each attorney or firm performs many processes in the course of a day:  calendaring, conflict checks, file creation and maintenance, etc.  Getting a document into evidence is just a process, as is qualifying an expert.  Processes are accumulated knowledge  performed over and over again.

Policies.  Policies are (hopefully) written documents expressing your purposes and goals, and containing guidance about the means of implementing same.  Policies may protect the confidentiality of information as required by the Rules of Professional Responsibility, or ensure other applicable standards of conduct.  Effective policies include specific procedures and consider how the people in your organization will comply with (and ensure compliance with) same.    

People.  Clearly the creation, adoption, and implementation of procedures and policies require people.  A policy or procedure that is not communicated, understood, and implemented where appropriate throughout an organization is more commonly known as a "problem" or a "missed opportunity."

How Do You Currently Solve Problems and Manage Information and Knowledge?

In order to determine whether you need "new" tools to manage what you know (information and knowledge), you have to identify what information and knowledge you have, and how you currently manage these resources (processes, procedures, people). A great deal of this evaluation doesn't involve your computer system at all, but instead a review of work flow and office practices.  Put it this way, (and borrowing from Dennis Kennedy), you only need a sheet of paper to map out how you communicate and collaborate with your staff and other attorneys.  I guarantee that even such a seemingly basic analysis will show you ways to improve upon the way you share information and perform tasks.  Try it. 

What Can You Do Better, and What Tools Can Help You Do That?

Then, once you know what you have and how you currently use it, you can consider how you might collect, store, organize, search, share, and protect that information and knowledge (and perhaps other information and knowledge) more effectively.  The storage and search capabilities of computer systems undoubtedly offer advantages to lawyers.  However, only after analyzing your current information and knowledge processes and policies can you determine what you want and how you will use it.  Knowing your processes, policies, and people will put you in a better position to integrate computer technology into them. 

Computer technology is not the most useful information or knowledge solution (i.e. the best tool) in every situation. If taking notes on a legal pad continues to be the only way you will gather information, then that tool should not be removed from the toolbox.  But consider whether information gathered electronically might benefit you. Likewise, a practitioner is not well-served using a computer presentation at trial unless she has evaluated its effectiveness in communicating information to a judge and/or a jury.  And surely a review of the way you use email might spark some discussion about whether other methods of collaboration (and appropriate communication) exist and ought to be employed.  The point is to be aware of how you do it and how you might do it better. 

Conclusion- Build On What You Already Know and What You Currently Are Doing

Competence as a lawyer requires using the tools available to you.  You are already using many of those tools.  Identifying and understanding the way you use information and knowledge to solve problems will help show the way toward effective computer technology use.

The algorithms can wait.