Bressler Risk Blog

Steven W. Teppler is a partner and chair of the privacy and cybersecurity practice group and chief cybersecurity legal officer at Mandelbaum Barrett writes: “The Expanding Universe of Attorney Cyber Liability” —

• “Law firms face unprecedented cybersecurity threats, increasing in number and severity, which can result in significant liabilities. The legal profession, especially in New Jersey, is grappling with growing responsibilities to protect client data, third-party data, and employee information, all while complying with complex regulations. Breaches in cybersecurity not only expose firms to legal and financial repercussions but can also result in violations of professional responsibility.”
• “Law firms have become attractive targets for cybercriminals due to the highly sensitive information they manage, including trade secrets, financial data, health care and other personal information. The American Bar Association’s 2023 annual Cybersecurity Tech Report consistently highlights law firms’ vulnerabilities, noting that many are ill-prepared to defend against sophisticated cyberattacks. These attacks typically include phishing schemes, ransomware, and data breaches, all of which can expose a firm to liability.”
• “The duty of confidentiality is fundamental to the lawyer-client relationship. Rule 1.6 of the New Jersey Rules of Professional Conduct (RPC) requires lawyers to protect client information. If a lawyer’s failure to implement adequate cybersecurity measures results in a data breach, this could lead to a breach of confidentiality and potential malpractice claims.”
• “Liability becomes even more complex when a breach affects third-party data belonging to a client’s clients. For example, a law firm representing a corporation may have access to sensitive customer data or intellectual property. If this information is exposed during a breach, both the client and its customers or business partners could file lawsuits, expanding the firm’s liability.”
• “For instance, a firm representing a health care provider may have access to patient data subject to HIPAA protections (See 45 C.F.R. Section 160.101 et seq.). A breach involving personal health information (PHI) could trigger regulatory investigations, civil penalties, and lawsuits from affected individuals. The concept of ‘downstream liability’ is gaining traction, with courts increasingly willing to entertain claims from third parties whose data was compromised due to a firm’s cybersecurity failures.”
• “To protect against such risks, law firms should take these steps:
  • “Adopt comprehensive cybersecurity measures, such as encryption, secure communications, and regular employee training on data protection protocols.”
  • “Negotiate indemnification clauses in engagement letters, particularly when handling third-party data.”
  • “Encourage clients to adopt their own strong cybersecurity practices to reduce the firm’s overall risk profile.”
• “Provide clear communication with clients about cybersecurity practices to help limit liability in the event of a breach. For example:”
• “Cybersecurity Policies in Engagement Letters: Include a section in the engagement letter that outlines the firm’s cybersecurity policies and procedures. Informing clients upfront about how their data is handled sets clear expectations and may help limit liability if a breach occurs.”
• “Example: ‘Our firm uses industry-standard encryption protocols to secure client data in transit and at rest. We also employ two-factor authentication and regularly update our systems to protect against potential threats.'”
• “Cybersecurity Protocol Discussions During Client Meetings: During initial client meetings, lawyers should discuss the specific data security measures relevant to the client’s case, especially if sensitive or regulated data (such as health care information or financial records) is involved. This can include informing clients about the secure platforms the firm uses for document sharing and case management.”
• “Example: ‘For this matter, we will be using a secure cloud-based platform for document sharing, which complies with HIPAA standards due to the sensitive nature of the information. We will also assign limited access to specific team members to further protect your data.'”
• “Breach Notification Procedures: Clients should be informed about how they will be notified in the event of a cybersecurity breach. This ensures transparency and helps maintain client trust in a worst-case scenario. It also shows the firm’s preparedness to address any potential issues swiftly.”
• “Example: ‘In the unlikely event of a data breach, we have a rapid response plan in place. We will notify you within 24 hours of detecting a breach, provide an assessment of the potential impact, and outline the steps we are taking to address the situation.'”
• “Law firm employees, whether through negligence or malicious intent, can be a major source of cybersecurity risk. The rise of hybrid work arrangements has increased the chances that insider threats will compromise a firm’s data security. For example, an employee might inadvertently leak sensitive client information through unsecured email, or a malicious insider could steal confidential data for personal gain.”
• “To address these risks, law firms should implement strict policies on data access, secure device use, and data transmission. These policies typically include data access controls, multi-factor authentication and encrypted data transmission.”
• “Law firms must navigate an increasingly complex landscape of cybersecurity and data privacy regulations. New Jersey’s Data Breach Notification Law requires prompt disclosure of any breaches involving personally identifiable information (PII) N.J. Stat. Ann. Section 56:8-163—66 (2005); as amended (2019), and firms serving clients across multiple jurisdictions must comply with various state and federal laws, such as HIPAA and the Gramm-Leach-Bliley Act. (Pub. L. No. 106-102 (1999).”
• “Failure to comply with these laws can result in significant financial penalties and reputational damage. Law firms must conduct regular compliance audits and work closely with cybersecurity experts to ensure their policies meet the latest regulatory requirements.”
• “Violations of the New Jersey RPC related to cybersecurity breaches or exposure can lead to disciplinary actions by the New Jersey Supreme Court’s Office of Attorney Ethics. Depending on the severity of the violation, sanctions can range from a formal reprimand to suspension or even disbarment. Specifically, a lawyer who negligently fails to safeguard client data may receive a public reprimand, but a pattern of negligence or intentional disregard for cybersecurity obligations could result in more severe penalties, including suspension or disbarment.”

“Shipman & Goodwin Atty Dodges DQ In Waste Permit Case” —

• “A Connecticut Superior Court judge has refused to disqualify Shipman & Goodwin LLP attorney Joseph P. Williams from a lawsuit that started as a dispute over a $3 million transfer station performance bond, finding he is not a necessary witness to the remaining issues in the case.”
• “Judge Sheila A. Ozalis on Thursday [11/21] turned away Country Holding Co. LLC’s Sept. 23 motion to remove Williams as trial counsel for defendants Covanta Projects of Wallingford LLC and Covanta Energy LLC in litigation first brought in August 2021 arising from the sale of a waste-to-energy facility in Wallingford. Country Holding argued that Williams was involved in a ploy to force it to settle, leading to the facility’s closure in February amid the litigation.”
• “Country Holding alleged that the transfer station closed because of an agreement between the Covanta parties and an entity called Country Disposal Services LLC, which held the permit to operate the facility from the state Department of Energy and Environmental Protection, or DEEP. Country Disposal allegedly agreed not to turn over the permit to Country Holding without Covanta’s approval, and Covanta demanded a settlement, the disqualification motion said.”
• “‘A necessary witness is not just someone with relevant information; a necessary witness is someone who has material information no one else can provide,’ the ruling said. ‘It is clear to this court that attorney Williams is not a necessary witness on this subject matter, as the representatives or Country, Covanta and Country Disposal that participated in such discussions could easily provide such testimony.'”
• “In its Oct. 7 objection to disqualifying Williams, Covanta said, ‘Country’s grievance is with the substance of the settlement proposal, not attorney Williams’ transmission of that proposal in his capacity as counsel, who had no personal knowledge beyond conveying his client’s proposal.'”
• “During a Nov. 7 oral argument, Williams’ co-counsel Alison P. Baker, also of Shipman & Goodwin, said that removing him from trial would discourage other litigants from trying to settle claims and argued that his testimony would be protected by the litigation and attorney-client privileges.”
• “‘The court notes that at no time during the course of this case, prior to the entry of new counsel for Country, while the firm of Cummings and Lockwood was representing Country, did it raise the issue that attorney Williams was a necessary witness for trial and should be disqualified,’ the ruling said. ‘There is no reasonable basis that this court can find for Country to have waited until the eve of trial to have made this motion to disqualify and finds that the disqualification of attorney Williams would render a substantial hardship on Covanta.'”
• “The judge pointed out that Williams has served as counsel for Covanta since before the litigation started, and represents the entities on Country Holding’s appeal of her summary judgment decision. He also negotiated a settlement between Covanta, as guarantor, and the five municipalities to ‘compensate them for Country’s breaches of disposal agreements,’ according to the ruling.”

New York: “Judicial Ethics Opinion 24-62” —

• “Digest: Where a judge’s association with his/her former law firm ended less than two years ago, the judge must disqualify in a matter involving a current client of the judge’s former law firm, even if the party has not appeared in the matter. This disqualification is subject to remittal.”
• “Opinion: The inquiring judge’s connection with his/her former law firm ended less than two years ago. The judge has recently learned that one of the defendants in a case assigned to the judge is a current client of the judge’s former law firm. [1] After disclosure, plaintiff’s counsel requested that the judge recuse him/herself. The judge’s former law firm has no apparent involvement in the matter before the judge, as the law firm’s client, one of several defendants in the case, was served well over a year ago but has not appeared or filed a notice of appearance. Nor has any motion been made for default judgment against that defendant. The judge believes he/she can be fair and impartial, and asks whether disqualification is ethically required.”
• “A judge must always avoid even the appearance of impropriety (see 22 NYCRR 100.2) and act to promote public confidence in the judiciary’s integrity and impartiality (see 22 NYCRR 100.2[A]). A judge must disqualify him/herself in a proceeding in which the judge’s impartiality ‘might reasonably be questioned’ (22 NYCRR 100.3[E][1]).”
• “For two years from the date that the relationship between a judge and their former law firm completely ends, the judge is disqualified from all matters ‘involving a party the judge recognizes as a current or former client of the law firm, even though a different law firm is representing the client’ (Opinion 16-36; see also Opinion 17-100 [disqualification required for two years after representation of client ends or final payment to judge, whichever is later]).”
• “This defendant is a party to the action before the judge, notwithstanding its failure to appear, and is also a client of the judge’s former law firm in another case. As the judge is still within the two-year disqualification period for current and former clients of the judge’s former law firm, the judge is therefore obligated to disqualify him/herself, subject to remittal. [2]”
• “Remittal is a multi-step process which requires full disclosure on the record and the voluntary, affirmative consent of the appearing parties and (if represented) their counsel. First, the judge must fully disclose the basis for disqualification on the record (see 22 NYCRR 100.3[F]). Second, without participation by the judge, all the parties who have appeared and not defaulted, and their lawyers, must agree that the judge should not be disqualified (id.). Then, if the judge believes he/she will be impartial and is willing to participate, the judge may accept remittal of disqualification and preside in the matter. The agreement must ‘be incorporated in the record of the proceeding’ (id.).”
• “Although the inquiring judge here has made a disclosure, the parties that have appeared in the case do not ‘all agree’ that the judge should not be disqualified (22 NYCRR 100.3[F]). The judge is therefore disqualified.”

“Solar Co. Ex-CEO Attys Say DQ Request ‘Untethered To Facts‘” —

• “Lawyers representing the former CEO of a now-defunct solar energy company against fraud and racketeering claims have told a Michigan federal judge that their previous in-house work for the company is not grounds to disqualify them from the suit, calling the plaintiffs’ attempt to have them removed ‘untethered to facts’ and improperly delayed.”
• “In a response filed Wednesday, DarrowEverett LLP told U.S. District Judge F. Kay Behm of the Eastern District of Michigan that there was no conflict of interest and no precedent for removing it from representing William Jayson Waller against claims that he and the company, Power Home Solar LLC, now called Pink Energy, took part in a scam to sell vastly overpriced solar energy systems to Michigan residents.”
• “The suit names the solar company, Waller and Florida-based private equity firm Trivest Partners LP and its investment company, TGIF Power Home Investor, as defendants. The company filed for bankruptcy in October 2022, weeks before the proposed class action was filed.”
• “The plaintiffs’ arguments for having New York-based DarrowEverett removed hinge on ‘a nonexistent legal theory based on equally nonexistent facts,’ the firm argued. Though the firm provided ‘successive representation,’ first to the company and then to Waller, no conflict has arisen, it told the court.”
• “‘Moreover, even if the facts asserted by [the] plaintiffs could for some reason support disqualification of opposing counsel, [the] plaintiffs sat on that knowledge for over a year before acting,’ the firm added, ‘and their failure to raise the issue until now waives any arguable claim they could possibly have had.'”
• “DarrowEverett’s response follows a motion filed by the proposed class of Michigan residents claiming that they fell victim to the alleged fraud conspiracy, led by named plaintiffs Aaron Hall, Katherine Glod and Jeffrey Binder, who asked Judge Behm to remove the firm in a Nov. 6 motion citing ‘multiple conflicts of interest.'”
• “The plaintiffs accused DarrowEverett of ‘stonewalling’ discovery, a move they said could be attributed to numerous conflicts, including that firm chair Zachary Darrow, with assistance from other firm lawyers, worked as a C-suite officer and chief counsel for the solar panel company.”
• “The firm’s inside involvement means its attorneys are witnesses in the action, the motion claimed, with Darrow potentially an ‘unnamed member of the RICO organization.'”
• “Plaintiffs further argued that since the firm has a fiduciary obligation to Power Home Solar’s bankruptcy trustee, its representation of Waller, whose ‘interests in this case are materially adverse to those of PHS,’ represents a conflict.”
• “But DarrowEverett told Judge Behm that Power Home Solar is not a party to the suit, and that ‘no entity with which DarrowEverett has or has had an attorney-client relationship is seeking the firm’s disqualification.'”

“Ga. Law Firm Faces DQ Bid Over ‘Hopeless’ FCA Case Conflict” —

• “The former employee of a tool company has called on a Georgia federal court to disqualify Smith Gilliam Williams & Miles PA and one of its attorneys from representing the company in his False Claims Act case because another firm attorney represented him in a domestic matter.”
• “In a motion to disqualify filed Monday, plaintiff Jim Southard asked that Smith Gilliam and its attorney Matthew Tyler Smith be barred from representing defendant Kipper Tool Co. They have a ‘hopeless’ conflict of interest because Southard used the firm in a ‘domestic relations’ case that ended just last week, Southard argued.”
• “‘Here, the conflict is clear, and the prejudice is unmistakable. To represent plaintiff in the domestic relations matter, SGWM obtained detailed and intimate information about plaintiff’s personal life as well as information about his financials, personal assets, and properties. These details could be advantageous to SGWM in zealously representing Kipper Tool against Plaintiff in the FCA matter,’ Monday’s motion states.”
• “Southard is involved in a yearslong dispute with his former employer. He began working at Kipper Tool in 2003 in its warehouse and worked his way up to a sales representative position, ultimately earning the title of strategic business unit leader before he resigned in 2014, according to court documents.”
• “During his time with the company, Southard became aware that Kipper Tool was routinely failing to provide the government with better prices than nongovernment customers, as is required under a multiple award schedule, or MAS, contract. Southard said he brought the issue up to the company’s vice president of sales.”
• “In August 2015, Southard filed his False Claims Act complaint on behalf of the United States. After eight years of investigation, the government declined to intervene in the case, unsealing it to move forward in May 2023, according to court documents.”
• “Southard’s issue with Smith Gilliam began in July when he retained another attorney at the firm for his domestic matter. The firm is made up of 12 attorneys and is headquartered in Gainesville, Georgia.”
• “He didn’t realize that his attorney in the domestic matter, Kelly Anne Miles, was also a named partner at Smith Gilliam until he visited the firm’s office to attend a mediation on Oct. 23 for his domestic case.”
• “While there, he noticed that Smith opened the door for him, according to the motion.”
• “On Oct. 24, Southard’s attorneys in the FCA matter, including Sarah Chu, learned from Southard that he had retained Miles. Chu responded by sending an email to Smith to inform him of the conflict of interest and ask for his position on the conflict of interest.”
• “‘While there are some circumstances when it would be permissible for the client to provide its informed consent to waive a conflict, here there are conflicts that run so deep they cannot be waived,’ Southard’s motion states.”

“New term, same ethics problems: Gorsuch’s ties to oil billionaire reignite calls for court oversight” —

• “As a new Supreme Court term dawned this week, so did new questions about the justices’ ethical standards, this time focusing on Justice Neil Gorsuch’s ties to an oil billionaire.”
• “The Donald Trump appointee is being called to recuse from an environmental case on the high court’s docket, Seven County Infrastructure Coalition v. Eagle County, Colorado, because of his cozy relationship with Philip Anschutz. The owner of Anschutz Exploration Corporation stands to benefit heavily if the court greenlights an 88-mile oil and gas rail line in Utah. “
• “‘The cozy relationship between Philip F. Anschultz and Justice Gorsuch far surpasses the standard of ‘reasonably questioned impartiality’ for the federal recusal statute,’ watchdog group Accountable.US and others wrote in a letter to Chief Justice John Roberts on Thursday. ‘This relationship that creates a conflict of interest is just the latest example of countless violations in the yearslong Supreme Court ethics crisis.'”
• “The letter signed by just over a dozen advocacy groups highlighted the consequences of the court’s stagnation on this issue. After years of ethical scandals surrounding the justices, there are still many open questions over when the justices need to recuse and how that decision is made.”
• “‘It certainly seems emblematic of the broader problem of there not being a specific and descriptive code of conduct that the justices need to follow that’s enforceable in any way,’ Sarah Turberville, the director of The Constitution Project, said in an interview. ‘Perhaps in this case, it’s illustrative of the need for an ethics council who’s available to really provide specific guidance to the justices.'”
• “Gorsuch served as counsel to Anschutz and his companies in the early 2000s. The Trump appointee has detailed annual hunting retreats on Anschutz’s estates and even bought an investment property with Anschutz business associates.”
• “Accountable.US says rolling back the law would lower Anschutz’s regulatory costs and drive up its profits. The watchdog argued that Gorsuch’s relationship with Anschutz creates questions around the justice’s impartiality — the standard for recusal under the federal statute. “
• “While the advocacy groups claim Gorsuch’s recusal is warranted, the justice himself will be the one to decide whether he hears the case.”
• “Gabe Roth, executive director at Fix the Court said recusal calls on Justices Clarence Thomas and Samuel Alito presented much clearer conflicts. The same can’t be said here.”
• “‘It’s a little bit more attenuated, and it would be worth having someone file a complaint to a neutral body that could then look into this, that would have the resources to call up, or that would have the authority to call up Gorsuch,’ Roth said.”
• “It’s been almost two decades since Gorsuch worked as outside counsel for Anschutz’s company, and currently there’s no public accounting of their relationship after 2017.”