When a law firm discovers a possible breach, the technical emergency is only part of the problem. There are also professional responsibility questions: what must the firm do to stop the intrusion, investigate it, and tell clients? The ABA addressed these in Formal Opinion 483, issued in 2018, titled in substance as lawyers' obligations after an electronic data breach or cyberattack.
This post summarizes the opinion in general terms and suggests how to prepare. It is not legal advice. State rules, statutes and contractual obligations may impose additional or different requirements, so involve counsel and confirm with your state bar.
What the opinion addresses
Formal Opinion 483 discusses how existing Model Rules apply when a breach occurs. The principal themes are:
Duty to monitor
The opinion discusses the idea that competent representation includes reasonable efforts to monitor for breaches of client data. The practical point: a firm that has no way to detect an intrusion cannot respond to one.
Duty to stop and restore
Once a breach is detected, the lawyer is expected to act reasonably and promptly to stop it and mitigate damage. That includes steps to restore systems and protect information.
Duty to investigate
The firm should make a reasonable effort to determine what happened, what data was affected, and whether it involved client information. The opinion contemplates that this may require forensic help.
Duty to communicate with clients
Rule 1.4 deals with client communication. The opinion discusses when lawyers should notify current clients whose confidential information was, or reasonably may have been, compromised, and the content of an adequate notice. It also distinguishes the situation of former clients, which generally falls under other legal requirements rather than the same ethics analysis; consult counsel about those.
The opinion also relates to Rule 1.6(c), on reasonable efforts to prevent unauthorized access, and Rules 5.1 and 5.3, on supervision.
Why this matters before an incident
The opinion's message is that the time for decisions is before the breach, not during it. Firms that discover a problem on a Friday evening with no plan lose hours that can matter. Preparation involves several concrete pieces.
Build the capability to detect
- Centralized logging and monitoring. Make sure someone is watching sign-in anomalies, mailbox rule changes and endpoint alerts, with coverage outside business hours.
- Alerting for key events. New forwarding rules, impossible-travel sign-ins and mass file downloads should generate alerts.
- Employee reporting channel. Staff should know how to report something odd and trust that they will not be blamed.
Write an incident response plan
A useful plan for a small firm fits in a few pages and includes:
- Roles. Who is the incident lead, who speaks to clients, who contacts the insurer, and who has authority to take systems offline.
- Contact list. Your IT provider, cyber insurance hotline, outside counsel experienced in breach response, forensic firm, bank and key clients. Keep printed copies.
- First-hour steps. Isolate affected devices, preserve evidence, change credentials from a clean device and avoid wiping systems before forensic collection.
- Decision points. How the firm decides whether client data was affected, and how it decides on notification.
- Documentation. Keep a running log of actions and times.
Know your insurance requirements
Many cyber policies require prompt notice and use of designated vendors. Calling the wrong forensic firm first can complicate coverage. Put the policy's notification instructions in your plan.
Understand notification layers
Client notification under the ethics rules is one layer. Others may include:
- State data breach notification statutes, which vary across Texas, Arkansas, Louisiana, Oklahoma and Kansas and elsewhere.
- Contractual obligations in client engagement letters or outside counsel guidelines, which may require notice within a short window.
- Regulatory requirements, such as those affecting health or financial information held for particular clients.
Have outside counsel review this map in advance, and add the result to your plan.
Practice the plan
A tabletop exercise takes about ninety minutes. Present a scenario, for example a compromised partner mailbox with suspicious forwarding rules, and walk through who does what. Note the gaps, update the plan and repeat annually.
Preserve privilege
When a breach investigation involves counsel and outside experts, how engagements are structured can affect privilege over the findings. This is a legal question; ask your counsel before an incident how to engage forensic help.
Next steps
Counsel Cyber helps law firms design detection, draft incident response plans and run tabletop exercises. If you do not have a written plan, or have one that has never been tested, we can help you build a practical version your partners can follow under pressure.