Protecting Client Information on Mobile Tech Devices
Personal digital assistants, cellular phones, laptop computers, and USB storage devices have provided lawyers with the ability to take their work anywhere. But there are risks involved with this freedom of mobility. Not only can these devices pick up viruses or spyware, they — along with all the client information they contain — are also easily lost or stolen.
This calls into play two issues, says Richard Ferguson of Lynass, Ferguson & Shoctor in Edmonton and past chair of the CBA’s Law Practice Management and Technology Section. First, lawyers are professionally obligated to protect the confidentiality of client information. Second, the law firm may incur increased operational costs if it has to spend time and resources restoring and protecting its computer systems.
The first line of defence against having confidential information fall into the wrong hands is simple: like a child in a grocery cart, don’t leave a portable device unattended. Ferguson advises lawyers on the road never to put these devices down on restaurant tables or leave them on hotel room desks. Instead, store BlackBerries or cellphones in the hotel safe when not using them.
But there’s more. “If lawyers are going to take data with them, they need to be aware that they are under an obligation to protect it,” says Ferguson. This is where detailed firm policy and procedures on the use of electronic equipment come in. The firm must decide what practices and procedures it’s willing to accept. Here are three possible stipulations:
1. Portable devices must be equipped with firewall protection and anti-virus and anti-spyware software, which will ensure they don’t acquire and transfer corrupt files or data back to the firm network.
2. The data stored on portable devices must be encrypted and password-protected. “Most of these portable devices now [make it] possible for you to encrypt or password-protect them in such a way that if someone takes them, they are not necessarily able to access the confidential information,” says Ferguson.
3. The IT department must check all devices before they connect to the firm’s system, to ensure their wireless connectivity has not been breached. “There has to be someone within the organization who has enough knowledge about network security to be able to set these devices up so that they are not acting as a gateway to someone from the outside,” Ferguson says.
If these measures don’t seem enough to protect client information, firms can decide that the information stays on the firm server and portable devices can access it only on a temporary basis.
— Alison Arnot
Adapted from National magazine, September 2006.
Printer Friendly