Tony Ng
November 17, 2021
•
5
min read
Instant messengers have become very popular in the workplace. They are no longer just for chatting with friends. People now use them to conduct business and connect with colleagues.
- High Usage: A recent study estimated that nearly 70% of employees use instant messaging apps on their phones for official duties.
- Security Gaps: While some mainstream apps provide end-to-end encryption, many other popular platforms do not.
From the perspective of law, professional ethics, and security, this popularity brings major challenges. Lawyers and law firms cannot afford to ignore these risks.
Confidentiality risk
Confidentiality is a fundamental rule that all lawyers must follow. However, instant messaging makes it easy to disclose confidential or legally privileged information to third parties inadvertently.
- Contact List Access: During installation, an app may request access to your contact list. It then uploads the entire list to its server.
- Data Sharing: Lawyers may share clients’ personal data with third parties without realizing it.
- Firm Devices: The risk is even higher if the phone is provided by the law firm and contains a list of clients and individual lawyers.
Legal privilege risk
In this fast-paced digital age, clients expect to reach lawyers whenever and wherever they want. They often prefer their own chosen communication channels.
- Mainland China Example: Clients often want to use popular apps from the Mainland. Lawyers should note that these applications may not provide end-to-end encryption.
- Evidence in Court: In the Mainland, conversations and posts on social media can be used as evidence in court.
- Waiving Privilege: If a client insists on negotiating litigation matters through these apps, they may be giving up their legal privilege.
To protect confidentiality and legal privilege, law firms should consider strict agreements. For instance, firms could prohibit lawyers from discussing cases with clients through unauthorized instant messaging programs. This ensures strategies remain confidential and protected.
Data retention risk (for records)
Law firms must review internal policies regarding lawyers leaving their jobs. You should pay close attention to mobile devices and data management.
- Resignation Issues: When a lawyer resigns, conversations and working documents on their mobile device may be taken away.
- Need for Backups: Firms should establish backup systems to archive official information stored on personal devices. This includes chat histories.
- Loss of Data: Without backups, important dialogues may be lost when a lawyer leaves.
- Competition: The problem is more serious if the lawyer moves to a business competitor.
Document disclosure risk
Lawyers are responsible for informing clients about what information must be provided during litigation disclosure.
- Metadata vs. Content: Some popular apps do not store user information on their servers. Service providers can only provide metadata to the court or police.
- Cloud Backups: However, customers often choose to back up their information in the cloud.
- Tracking Difficulty: It is almost impossible to determine the exact location of cloud servers. It is also difficult to confirm the level of protection these backups receive.
Risk reduction
Supervising business communications on third-party apps is a major challenge, especially for smaller firms.
Instant Messaging Management Technology
This technology allows management to monitor usage. It provides several key benefits:
- Content Blocking: Management can block content that does not comply with policy.
- Retention: It allows for the storage and archiving of messages.
- Security: It includes virus detection functions.
- Balance: It allows employees to communicate with the outside world while the firm monitors safety.
Internal IT Policy Review
Firms should update their policies if they do not clearly specify the risks of instant messaging. Suggested measures include:
- Restrict Documents: Limit or prohibit the types of documents employees can send via instant messenger.
- Define Usage: Set clear rules for using messaging in the workplace and with customers.
- Location Tracking: Install tracking devices on all technical equipment.
- Remote Erasure: Configure devices to remotely erase data if they are lost or stolen.
- Monitor Scope: Confirm the specific type of application monitoring the firm will adopt.
Corporate-Level Applications
Depending on their size, law firms should consider setting up professional-grade communication apps. The benefits include:
- Independent Encryption: Using independent keys to protect data during transmission.
- Secure Storage: Setting up secure cloud storage.
- Total Control: Giving the firm complete management of all data permissions so no outsider can access the information.
Law firms must educate all practitioners on the best communication modes for the digital world. All employees must comply with basic rules regarding use, content, and record-keeping. If employees and lawyers understand these risks, they will use communication apps more wisely.
