I predict that within approximately 2-3 years, lawyers in most jurisdictions will communicate and collaborate with their clients using some type of an encrypted network.

This will occur as a result of the enactment of laws to protect consumer data, and because of the inherent flexibility of emerging legal technologies.

New laws and regulations

A number of states, including Massachusetts and Nevada, have passed laws or regulations which require that certain types of confidential data be sent electronically only via encrypted communications. More laws of this nature will most certainly follow both at the state and federal level.

I predict that these laws, most of which currently apply primarily to financial institutions, will ultimately incorporate some of the types of client information contained in attorney-client communications, in large part because of rising concerns due to recent large-scale data disclosures.

In fact, this type of data breach is one of the primary reservations expressed by lawyers regarding cloud computing.

However, attorneys are reluctant to embrace emerging technologies and will only use encrypted communications if required to or if the incorporation of this type of communication into existing systems is easily accomplished.

New laws coupled with the inherent flexibility of cloud computing will result in the use of encrypted communications as the norm in the legal profession.

Emerging legal technologies

As aptly noted by Seth Godin in his recent blog post, desktop software is an antiquated concept, and its developers are anything but innovative. Cloud computing is the wave of the future, and all types of software, including legal platforms, will eventually be offered as an online service.

Developers for online legal platforms start from the ground up when developing their products. They have a flexibility that is unavailable to the desktop developers, who are more concerned with tweaking an existing product in a cost effective manner rather than truly innovating.

Online platforms developers have the ability to respond to the current needs and concerns of their clients in a way that desktop developers simply cannot. Online platforms can be quickly and easily modified to incorporate new features, such as encrypted communication, into the online platforms as the need arises. In fact, a number of platforms have already begun to do so.

For example, VLOTech, Clio, and NetDocuments allow for varying types of encrypted communication with clients. Another online legal platform, NKrypt, is devoted to providing a secure, encrypted email network.

Encrypted communications with clients is the wave of the future and web-based legal technology providers, many of whom already provide some form of encrypted client communication, will lead the way.

(photo: Anonymous Account)

Encrypted Client Communication May Be the Wave of the Future is a post from: Lawyerist

About a year ago, I started blocking off Friday on my calendar, calling it a “writing day.” Apart from the odd court date I have no control over, that block of time is inviolable. I use my Fridays to work from home (where I am right now), catch up on reading material, write briefs or blog posts, or catch up on administrative tasks.

It took a little bit of ingenuity to make sure I could get everything done from anywhere, but here is what I use to keep my office functioning on the move.

Remote access to files

In order to get things done outside the office, you must be able to get to your files. I use Dropbox to sync files between my office computer and home (and to my law clerk’s computer, for that matter).

All mobile files—any that leave the office, really—whether on a laptop or flash drive, must be encrypted. This is a rigid policy at my firm.

Fortunately, encryption is easy to do. I use the built-in Windows BitLocker Drive Encryption on my laptop. My law clerk uses Apple’s built-in FileVault on his Macbook Air. You could also use TrueCrypt, if you do not have one of those programs built into your operating system. (You need Windows Vista Enterprise or Ultimate for BitLocker, and same will be true for Windows 7.)

Getting phone calls from anywhere

Some Fridays, I want to be able to answer the phone. I use Skype at the office, so it is easy enough to use it at home, too. I have a Philips VOIP 080 handset that I enjoy using, but you can find Bluetooth headsets, wired headsets, and many other options.

Call quality varies, but I get excellent call quality nearly everywhere, including the occasional coffee shop crowded with other web workers.

If you are not using Skype at work, you could just as easily forward your work phone to your Skype account or mobile phone on Fridays—or just wait until Monday to check your messages.

Wireless printing

Working from home is no fun if you are tied to the printer. I use a Netgear wireless print server so that if I need to print a letter or brief draft, I can hit the print button from the backyard.

Setting it up is a piece of cake. I finally got around to reconnecting it this morning, so I just did it again. Netgear includes an easy-to-follow walkthrough that mostly involves plugging in your printer, the print server, and your computer to one another so they can all say hello.

Total cost of all this technology, not counting the laptop: about $200 to set up, and about $100 per year, if you get all the premium features of Skype and Dropbox.

So next Friday, get thee out of thy office and onto thy porch!

Edit: my home-office assistant just reminded me how important it is to have a home-office assistant:

A home-office assistant is critical to your home-office productivity and Friday happiness.

(photo: Plutor)

Work From Home (or Anywhere Else) on Fridays is a post from: Lawyerist

Even if you have read our previous posts on data security and encryption, your computer data is probably still at risk. Scientific American recently reported on a variety of “side-channel” data vulnerabilities–threats of data theft through passive or mechanical means that bypass your software and operating system altogether.

Below are five frightening new ways to steal the data on your computer:

1. Reading data from the reflection on your eyeball

New techniques involving telescopes and cameras are now able to capture computer data from monitor reflections on eyeballs, glasses, and office picture frames.

2. Stealing data from your monitor’s radio emissions

Computer monitors radiate low-voltage signals from their power cords which allow people with sophisticated monitoring equipment to capture and reassemble the images on your monitor.

3. Capturing network data from the flashes on a router

The constantly-flashing LED lights on network routers can be recorded to capture the data bits traveling through them. These patterns can be reassembled to decipher communications going through the router.

4. Copying printer data from the sound of the printer head

Some printers — especially the old dot matrix variety — make small noises as they move across your paper. These sound frequencies are slightly unique depending on what movement the printer head is making. By recording the sound waves of a printer, special algorithms can decipher the text being printed.

5. Learning your passwords from the radio frequency of your keyboard

Similar to capturing the electronic frequencies emitted by monitors, keyboards emit unique low-voltage radio frequencies with each keystroke. Basic radio-frequency monitors can be combined with capture software to copy anything typed. Check out this video of keystroke theft in action:

Thankfully, at this point these data invasion methods are seldom-used. However, for that reason, there also are few countermeasures or security products on the market to prevent espionage through these side-channel methods. While it is unlikely most attorneys need to worry much about these vulnerabilities, anyone with especially-secure client or corporate data should at least spend a few minutes thinking about whether they could present real threats.

How Hackers Can Steal Secrets from Reflections | Scientific American

(photo: annieominous)

Five shocking ways your computer is at risk is a post from: Lawyerist

The Department of Homeland Security just disclosed its official policy on laptop seizures. It says it can and will take laptops of foreigners and U.S. Citizens for as long as it wants, for whatever it wants.

How can they get away with this? Because an out-of-touch judiciary says so. Border agents can search laptops without any suspicion of wrongdoing, according to the 9th Circuit, the most recent court to rule on the issue. And so the DHS policy, which they have been following for years.

If you don’t encrypt, you might as well just hand over your clients’ information. If you represent defendants in criminal matters, you might just create more business for yourself, when DHS stumbles across your notes on a file.

If you want to keep your information secure, encrypt it, and when you travel—or in other cases when you know there is a likelihood your computer will be searched—shut it down completely to protect against a cold-boot attack.

Travelers’ Laptops May Be Detained At Border | /.
DHS border policy: we can steal anything from you, read all your data, and disclose it to anyone we want | BoingBoing

Encryption: do it when you travel is a post from: Lawyerist

TrueCrypt 6.0 was released on the 4th, and includes some great new features, including the ability to encrypt and hide the entire operating system for Windows users. It is also optimized for multiple-core processors.

TrueCrypt 6.0 is available for Windows, Apple OSX, and Linux. Get it here.

For first-time encrypters, last year I posted a tutorial on creating encrypted file containers with TrueCrypt. It is a bit old, since I was using TrueCrypt 4 for Windows, but it appears it is still accurate for the new version.

TrueCrypt 6.0 Released | TrueCrypt.org (via Lifehacker)

TrueCrypt 6.0 out and looking even better than ever is a post from: Lawyerist

In the newest Lawyerist video, I describe four reasons to create a paperless law office:

Three (four, really) good reasons to go paperless is a post from: Lawyerist

Imagine any of the following scenarios:

• You returned to your office this morning to find it had burned to the ground overnight. You cannot salvage anything but a few crispy bits of your pencil sharpener.
• Someone swiped your laptop on the train this morning while you were on your way to work. Nobody seems to have seen the person who did it.
• While working on a brief, you are just putting on the finishing touches when your computer’s hard drive stutters a few times, then dies completely.
• Last night, someone broke into your office and, realizing your clients’ personal information would sell for far more than your computer hardware, rifled through your files, making off with your client information sheets.

Now, ask yourself a few questions.

• Will you ever be able to recover your physical data? Unless it was protected in a fire-proof safe, few attorneys keep spare client files.
• How long will it take to recover your electronic data, and what will you have lost? In other words, how solid is your backup system, and do you have off-site backup?
• How much will it cost to purchase credit-monitoring for all of your past and present clients? If your laptop is stolen and your data is not encrypted, or a thief makes off with part of your paper files it seems only fair.
• How will you (a) prevent, or (b) mitigate the effects of each of these scenarios?

Physical security

First and foremost, how secure are your files physically. Is your office locked? Who has the key? Does your three-year-old have access to your work computer? Is your backup on site?

If you keep paper files, does the filing cabinet lock? Is it fireproof? If not, how would you recover from a fire or building collapse? Sure, these are rare occurrences, but they are also catastrophic—and the damage to your files, at least, is preventable.

As for electronic data, if your backup is on site (say, on an external hard drive in the office), you will likely lose it at the same time you lose your computer(s).

Consider your passwords, as well. Do you have them on all your computers? Are they good, long, passwords with some numbers and punctuation mixed in?

Redundancy

How often do you backup your electronic data? Weekly? Daily? Hourly? Are you comfortable recreating a week of work? Where is your backed-up data? Backup can be just for catastrophic losses like a fire or hurricane, in which case you want your data backed up off site and in another state.

Or, backup can be like a really powerful “undo” button, allowing you to dip into an hour-old backup and get part of your brief back, at least.

I am not suggesting anyone should make doubles of their paper file; rather, that all attorneys should consider the benefits of a paperless law office.

Encryption

Every week, it seems, we hear of another laptop lost with hundreds or thousands of individuals’ personal information on it. The worst part is that this is so easily prevented. All operating systems come with at least basic encryption.

The same goes for flash USB drives (or “thumb drives,” if you prefer). Even more-easily lost, these are a potential gold mine for identity thieves.

And what about old hardware? Do you nuke your data before disposing or selling old equipment, or do you pass it on for anyone to discover?

Recommendations

This article is meant to get you thinking about your own office security. As an attorney, you have an enormous amount of valuable and sensitive information to care for. While most ethics rules require attorneys to use “reasonable care” to protect that information, I think we owe our clients a bit more.

So think about security. Here are a few things I would recommend:

• Obviously, make sure your office has a lock on the door and that you know who has copies of the key(s).
• Use good passwords. Not your kid’s birthday or your mother’s maiden name. Good passwords contain letters, numbers, and symbols. Heck, just pick a sentence you like and use that.
• Go paperless so that you can backup all your client files.
• Backup your data at least daily to two places, one of which is off-site (even if that is just a second external hard drive you take home every night). Even better, back it up hourly using something like Time Machine in OS X or Flyback in Linux (Windows is behind the curve in backup options, I am afraid).
• Encrypt at least the files on your portable drives and computers (this includes that external backup drive if you take it home with you. There are a lot of easy options built in to all the major operating systems.
• Finally, brag about it. Tell your clients how well you will protect their information so that they feel at ease.

An ounce of prevention . . .

FIRE DRILL! How secure are your files? is a post from: Lawyerist

My favorite encryption software, TrueCrypt, released a major update today. There are two major new features:

• TrueCrypt now allows encryption of the entire system partition in Windows. TrueCrypt has enabled encryption of non-system partitions before, but this features allows you to encrypt your entire drive.
• The long-awaited graphical interface for GNU/Linux!

TrueCrypt is a free and open-source software for encrypting files and disks. For a tutorial on getting started with TrueCrypt, see this post from last April. If and when I experiment with full-system encryption, I will post a new tutorial and review.

[via Slashdot]

Edit: I had to see the GNU/Linux graphical interface. Click the thumbnail to see the larger version. It works so well I could cry for joy. No more command line! It is missing some of the nice features of Windows interface. For example, it will not automatically mount your encrypted volumes on startup, and will not automatically dismount them on shutdown. But it does automatically detect and enable NTFS, which is a great feature. Thanks you, TrueCrypt team! Definitely a project worth supporting.

TrueCrypt 5.0 released with major new features, Linux GUI is a post from: Lawyerist

According to the Star Tribune, detailed personal information for 257 people, including social security numbers, was on a laptop stolen about three weeks ago. The laptop belonged to a vendor, Promissor Corp., who apparently does not observe the basic security precaution of encrypting information on portable computers and drives. I bet that would have been cheaper than paying for credit monitoring for 257 people, especially since excellent encryption software like TrueCrypt is free.

Another reason why data encryption is a must for laptops and all portable information is a post from: Lawyerist

My office was burglarized over the weekend, a valuable reminder of the need to backup and secure your files, both paper and digital.

All the jerks stole was a few rolls of stamps and my video camera. Expensive for me, to be sure, but nothing particularly disturbing. They didn’t touch my external hard drive that I use for backup (and to store movies for lazy Friday afternoons). Apparently stamps are hot items. The building management may have been negligent, and I hope they will buy me a shiny new video camera before my next depositions.

I was irritated, but largely unfazed due to the fact that my files are well-protected and I have multiple backups. I back up my files daily to my external drive, and my laptop comes with me every night. I backup weekly (or so) to a second, portable external hard drive, so I had a backup just a few days old. All my backups are encrypted, so I wasn’t worried about losing client information.

The only paper files in my office are public information like original pleadings. So although I am quite irritated at having to blow a few hundred dollars on a new video camera when the one I had was perfectly good, it wasn’t nearly as bad as it could have been.

But it is a reminder to back up diligently and make sure your client files are protected, whether paper or digital. You don’t want to have to send a letter to your clients notifying them to look out for identity theft, since you never encrypted your files.

A valuable reminder—keep your files secure is a post from: Lawyerist