Bressler Risk Blog

We noted updates on this fight last summer. Here’s the latest: “Flint water judge rejects Napoli Shkolnik’s call to DQ rival lawyer” —

• “The federal judge in charge of litigation over the Flint water scandal refused law firm Napoli Shkolnik’s request to disqualify a rival lawyer for simultaneously representing clients who approved of a $600 million settlement and those who wanted it to fail, saying the lawyer probably violated ethics rules but it wasn’t worth removing him from the case.”
• “New York-based Napoli Shkolnik filed a motion to disqualify Philadelphia lawyer Mark Cuker, who made headlines in the case after falling asleep during a Zoom hearing, after he filed objections to the settlement on behalf of 12 clients while his remaining 968 clients approved it.”
• “In 2020, the Napoli firm and Levy Konigsberg defeated efforts by rival attorneys to have them removed as co-liaison counsel over allegations including they were trying to garner more money for their clients by requiring expensive ‘bone scans’ to provide evidence of lead exposure.”
• “Napoli argued Cuker violated the Michigan Rules of Professional Conduct by simultaneously representing clients who objected to the settlement and those who wanted it to proceed. Judge Levy largely agreed, saying ‘these positions are irreconcilable.'”
• “The ethics rules allow lawyers to represent clients who have competing opinions about a settlement, the judge said, but only after ‘consultations’ in which they are informed about the conflict and the participation of other clients.”
• “The judge rejected Cuker’s argument the rival law firm didn’t have standing, saying a motion to disqualify counsel is the proper mechanism for informing the court about alleged ethical violations.”

“Morgan Lewis Can’t Escape Suit Alleging Conflict in Deal Work Led to Client Bankruptcy” —

• “A California federal bankruptcy judge on Wednesday advanced claims from the Chapter 7 trustee for a former Morgan, Lewis & Bockius client, which alleged the firm’s dual representation of the agency and its owners in a stock sale created a conflict of interest that led to a 2019 bankruptcy filing.”
• “Court records indicate Morgan Lewis was paid $517,688 in legal fees for shepherding the deal. But Stadtmueller asserted in court the firm and Hector represented the owners in the stock sales as well, allegedly creating a conflict of interest that was never disclosed to the parties.”
• “As for the second cause for action, which alleges breach of duty of loyalty, Latham found that they represented the owners, ‘whose interests were materially adverse to debtor’s.’ As a result, the judge found the agency was allegedly damaged by the loss of its legitimate expectation of loyalty and paying $277,848.92 in legal fees for counseling on the second stock sale.”
• “‘Principally, debtor sought the lowest possible purchase price and the owners’ desired the highest. Yet despite the conflict, defendants failed to disclose the dual representation or obtain either debtor’s or the owners’ informed consent,’ Latham said. ‘So defendants breached their duty.'”

“Working for both opioid maker and FDA wasn’t conflict, McKinsey tells committee” —

• “McKinsey & Co managing partner Bob Sternfels told a congressional committee Wednesday that his consulting firm did not have a conflict of interest when it gave advice both to Oxycontin manufacturer Purdue Pharma LP and the government agency charged with regulating opioid sales.”
• “McKinsey gave consulting advice to both Purdue and the Food and Drug Administration from 2008 to 2019, and 22 of its consultants worked for both clients, according to a report published by the House Oversight Committee, which hosted the hearing. During that period, McKinsey offered to ‘turbocharge’ Purdue’s opioid sales while also working with the FDA division overseeing the development and marketing of drugs.”
• “That work did not create a conflict because McKinsey advised the FDA on topics such as technology upgrades and organizational efficiency, Sternfels said.”
• “That answer did not satisfy lawmakers, who said McKinsey failed to inform the FDA that its consultants continued to give advice to Purdue.”
• “Democratic Representative Katie Porter of California pointed out the omission allowed McKinsey to avoid a government review of potential conflicts of interest.”
• “‘Your scheme worked really well,’ Porter said. ‘McKinsey got contracts, Purdue got rich, and America got addicted.'”
• “An FDA official said Monday in a separate congressional hearing that it did not seek McKinsey’s advice about drug safety, and the agency did not know about McKinsey’s work with Purdue until 2021.”

“FDA Not Issuing Contracts to McKinsey Amid Investigation Into Conflict of Interest in Opioid Consulting” —

• “The Food and Drug Administration (FDA) will not be issuing new contracts to the consulting firm McKinsey and Co. amid an investigation into potential conflicts of interest, a top official has confirmed.”
• “‘The Center for Drugs currently does not have a contract with McKinsey and across FDA,’ said Patrizia Cavazzoni, director of the Center for Drug Evaluation and Research for the FDA. ‘We anticipate that further contracts will not be issued pending the outcome of the investigations.'”
• “In an April 13 report (pdf), committee members alleged that McKinsey had ‘failed to disclose its serious, longstanding conflicts of interest to FDA, potentially violating contract requirements and federal law.'”
• “In one case detailed in the report, at least four McKinsey consultants were allegedly working for the FDA on improving drug safety while also working for the privately held U.S. pharmaceutical company and opioid manufacturer, Purdue Pharma.”
• “The committee said that Purdue Pharma, ‘explicitly tasked McKinsey with providing advice on how to influence the regulatory decisions of the U.S. Food and Drug Administration (FDA), another McKinsey client,’ according to the report.”
• “‘As I indicated earlier, we follow contracting regulations that apply across the entire U.S. government, including other agencies. And we rely on contractors to follow those rules and to inform us of any conflicts of interest,’ Cavazzoni responded while dismissing suggestions that the FDA should change its rules regarding conflicts of interest.”

“Oversight Committee Grills McKinsey & Company on Its Role in Nation’s Opioid Epidemic” —

• “When asked by Chairwoman Maloney whether her office’s investigation of McKinsey found the firm had advised Purdue to undermine federal drug safety measures, Attorney General Healey responded: ‘Absolutely. … McKinsey was actively coaching Purdue on how to band together with other opioid companies on how to fight FDA safety requirements while also working at the agency.'”
• “Rep. Porter questioned Mr. Sternfels on McKinsey’s failure to disclose conflicts of interest to the FDA, asking, ‘who made you the conflict-of-interest czar for the federal government?’ After Mr. Sternfels asserted that McKinsey ‘made clear in multiple instances that the individuals involved had experience in both pharmaceuticals and opioids,’ Rep. Porter responded: ‘They didn’t have experience, they were the identical humans working for both [FDA and Purdue] at the same time. Did you tell the FDA, did you make these disclosures, and then allow the government to decide whether there was a conflict of interest?’ Sternfels was unable to say whether McKinsey had made any specific disclosures.”
• “Asked by Congresswoman Norton whether staffing the same individuals on contracts at both FDA and opioid manufacturers was concerning from a conflicts of interest perspective, Dean Tillipman [Jessica Tillipman, Assistant Dean for Government Procurement Law Studies at the George Washington University Law School.] agreed that ‘given the nature of the work, when there is the potential for overlap, the work could raise significant red flags’ about the presence of an organizational conflict of interest.”

In a statement, McKinsy noted: “Since we stopped advising clients on opioid-related business in 2019, we have continued to improve our policies around governance and client selection. That year, we implemented a new client selection policy governing which clients we serve and on what topics.” For more see: “McKinsey Client Selection Policy” —

• “In recent years, we have strengthened our governance and compliance processes as part of our ambition to lead our industry.”
• “Among other enhancements, we implemented a new Client Service Policy and increased the influence and authority of the global committee that reviews high-risk engagements. We have spent more than $300 million over the past several years on strengthening our risk-management teams and capabilities, and we have implemented new trainings and accountability mechanisms to ensure that our colleagues understand and adhere to our policies. Each of these enhancements applies globally.”
• “Our Client Service Policy requires partners to systematically assess client projects across five interrelated dimensions: Country, Institution, Topic, Individual, and Operational considerations. Referred to as “CITIO,” this framework is embedded in the way we assess risk for all our client work.”
• “Among other criteria, the policy requires us to consider the unintended consequences of any proposed work, including potential negative impact on vulnerable populations. If a client or proposed project falls short of our standards, we will not do the work. This policy applies globally, across all sectors, whether work is paid or unpaid.”
• “Our policies forbid an employee who has acquired confidential information about a client from serving a competitor in a competitively sensitive engagement. That restriction lasts as long as the information has significant competitive value.”
• “We follow additional conflict-management protocols in our work with the public sector. In addition to managing any potential staffing conflicts, we are subject to our government clients’ conflict of interest requirements and review potential conflicts—both actual and potential—accordingly.”

“Dentons Stuck With $32M Malpractice Verdict Over Verein DQ” —

• “Denton’s bid to shed a $32 million malpractice verdict triggered by a disqualification and conflict between branches of the firm’s ‘verein’ structure failed Thursday at an Ohio appeals court.”
• “Finding no error in the trial verdict for RevoLaze LLC, a former Dentons client, the three-judge panel said there was ‘overwhelming evidence’ suggesting that Dentons operated “as a single firm” despite its verien structure.”
• “A Dentons partner who had worked for RevoLaze in a patent case at the U.S. International Trade Commission involving The Gap Inc. had also foreseen a possible conflict via the firm’s Canadian arm, which had represented Gap, the court said.”
• “‘Here, we find Dentons US’ membership in a verein, with a common conflicts base, that shares client confidential information throughout the organization, is irreconcilable with Dentons US’ contention that it was separate from Dentons Canada,’ the court said.”
• “‘Critically, Dentons US by initially identifying Gap as a conflict, even though it had done no work for Gap, strongly indicates that Dentons US did not think it was sufficiently separate from Dentons Canada, to be allowed to represent RevoLaze against Gap,’ the court added.”
• “The decision represents a major blow for Dentons, a mega-firm that has long argued that, because its various verein entities are legally distinct and don’t share clients or information, they are effectively distinct firms for the purpose of imputed conflicts.”

More background and detail via Bloomberg: “Big Law Model Tested in $32 Million Dentons Malpractice Case” —

• “At least six major U.S. firms affiliate with other law operations under the Swiss verein model to market services globally as if they were a single entity.”
• “‘I’m sure there’s a high level of distress over what happened in this case,’ said law firm consultant Peter Zeughauser, noting that conflicts checks can be expensive and time consuming. ‘Firms worry a lot about their reputations for trustworthiness and integrity—and because of that, they worry about conflicts.'”
• “Swiss verien firms risk losing business if they’re required to disclose conflicts related to affiliates’ work. Existing clients may balk at other representations. Potential clients could decide to go elsewhere when they learn who else the firm is representing.”
• “Conflict checks that turn up nothing can still take time and limit the ability of partners to bill clients on new matters until the checks are done, said Zeughauser, whose group has worked for Dentons, Baker McKenzie and other Swiss verein firms.”
• “Jim Jones, senior fellow at Georgetown Law’s Center on Ethics and the Legal Profession, said the case could prove to be a cautionary tale for Swiss verein firms’ ability and willingness to fully disclose potential conflicts to clients, especially given that from country to country, ‘conflicts rules are all over the place… I’ve always been extremely dubious that Swiss vereins could protect you against ethical obligations,’ Jones said.

“Weaponizing Attorney Sanctions? Miami Law Firm Partner Defeats $190,000 Penalty” —

• “A South Florida attorney will be reimbursed for a six-figure sanction as early as Wednesday, after the Miami-Dade Circuit Court and the Third District Court of Appeal vacated orders that imposed punishment based on evidence that a trial judge suggested had likely been forged.”
• “Jared Lopez, a co-managing partner at Black Srebnick Kornspan & Stumpf in Miami, was the subject of the original sanction order in May 2019. But two courts have suggested Lopez and his law firm were incorrectly disqualified from the litigation.”
• “The dispute, in the sanctions case, involved ‘an inherent conflict of interest,’ leading Accetta to file a 21-day safe-harbor notice. Under Florida Statutes Section 57.105, an attorney has 21 days to withdraw a filed pleading, motion or other document that is not supported by facts, law or is otherwise frivolous—or the lawyer could face potential sanctions.”
• “Accetta claimed that when Lopez filed a lawsuit on behalf of Iacono, it was an ‘illegal’ action because, as manager, Cavagnuolo was the only person with authority to file that lawsuit, citing an operating agreement in which Cavagnuolo was identified as the ‘sole’ manager of the company, L24M.”
• “Accetta sent multiple notices to Lopez that he should dismiss the lawsuit filed in the name of the company, because only Cavagnuolo was authorized to initiate it in the company’s name, according to court filing.”
• “As a result, when evidence suggested a forgery, Miami-Dade Circuit Judge Michael Hanzman, who inherited the case, denied that Lopez should be allowed to intervene due to the settlement, noting his motion “is without legal merit.””
• “‘Having said that, the court understands Lopez’s frustration, as the evidence presented strongly suggests that the 2013 operating agreement relied upon by Cavagnuolo in pursuing his motions for disqualification and sanctions was a forgery,’ Hanzman ruled in February. ‘But Lopez’s claim that Cavagnuolo secured the disqualification and sanction orders through the submission of fraudulent evidence will have to be adjudicated elsewhere.'”

“BREAKING: Endo Wins Reversal Of Opioid Default, Judge DQ’d” —

• “A Tennessee appeals court on Wednesday erased a trial judge’s stunning decision finding Endo Pharmaceuticals liable for opioid abuse because of discovery misconduct, calling the sanction faulty because of pending efforts to disqualify the judge for bias against the drugmaker.”
• “In a seven-page opinion, the Tennessee Court of Appeals vacated the default judgment against Endo after finding that Circuit Court Judge Jonathan Lee Young appeared ‘antagonistic to the interests of those in the pharmaceutical industry’ when — in Facebook posts and an interview with Law360 — he discussed opioid litigation.”
• “In the interview, Judge Young called Endo’s failure to produce important documents during opioid litigation ‘the worst case of document hiding that I’ve ever seen,’ adding that ‘it was like a plot out of a John Grisham movie.'”
• “‘To promote confidence in our judiciary, we conclude that the trial judge erred in refusing to recuse himself from the case,’ the court wrote.”
  “Because Judge Young should have bowed out, his Feb. 28 order granting sanctions, including default liability, must be nullified, the court said.”

“Federal judge finds no improper influence on case from colleague’s financial conflict” —

• “A federal judge has found his colleague’s undisclosed financial conflict of interest had no influence over the ruling in a debt collection lawsuit against Wells Fargo.”
• “U.S. District Court Senior Judge John L. Kane, without prompting from any party to the lawsuit, issued a decision on Friday following his independent review of Dennis Obduskey’s 2015 complaint against Wells Fargo and the McCarthy Holthus law firm. Obduskey alleged the defendants violated the the Fair Debt Collection Practices Act while carrying out foreclosure proceedings on his home.”
• “Although Obduskey’s lawsuit reached the U.S. Court of Appeals for the 10th Circuit and also the U.S. Supreme Court, Kane took the extraordinary step of initiating his own audit in response to revelations last fall that the original judge in the case, R. Brooke Jackson, was one of 131 federal judges nationwide who handled civil lawsuits despite owning a financial stake in one of the corporate parties to a case.”
• “The Wall Street Journal initially broke the news of the conflicts of interest, noting at least 36 instances in which Jackson failed to recuse himself as the law requires. Jackson, a 2011 appointee of the Obama administration, undertook his own review of his cases and discovered additional conflicts, which Colorado Politics in turn examined this year.”
• “Federal law governing recusal indicates that judges must disqualify themselves if they or their spouses have a financial stake in a case. Judges also have a duty under the law to reasonably inform themselves about their financial interests. While apologetic for his failure to conduct himself accordingly, Jackson also explained that he remained in the dark about his finances and that his wife prepared the financial disclosure reports.”

“After $166M Verdict Reversed, Job-Switching Mediator Isn’t Cause for Firm’s Disqualification” —

• “A New Jersey appeals court has rejected a motion to disqualify Wilentz, Goldman & Spitzer from representing the defendant in a high-stakes legal malpractice suit, where an arbitrator in the case joined the Wilentz firm.”
• “Mazie Slater was initially represented in the suit by Margolis Edelstein, but in January 2021 it retained the Wilentz firm. A month later, Keefe was part of a team of six attorneys and seven legal professionals who moved from the Keefe Law Firm to Wilentz.”
• “The firm of Nagel Rice, which represents Escobar in the malpractice suit, moved to disqualify Mazie Slater, claiming that the firm’s representation by Wilentz constituted a violation of New Jersey’s RPC 1.12. That rule says a lawyer shall not represent anyone in connection with a matter in which the lawyer participated personally as a judge, arbitrator, mediator or other neutral party, unless all parties to the proceeding have given written consent to the representation.”
• “The appeals court found that former Superior Court Judge John Keefe’s decision to join Wilentz after mediating in the malpractice case does not warrant disqualification of another Wilentz lawyer, Brian Molloy.”
• “The appeals court agreed with Lynott’s finding that disqualification of Molloy from representing Mazie Slater would be warranted, if not for the measures taken to screen Keefe from participating as a lawyer in the matter or receiving any cut of the fee from the case.”
• “‘Having reviewed this record, we agree with Judge Lynott that plaintiff failed to carry her burden to prove that disqualification of the Wilentz firm is justified,’ the appeals court said in an unsigned ruling.”
• “Escobar provided no basis ‘to second-guess the judge’s ruling that the procedures the firm has put in place are sufficient to ensure the mediator will not participate in defendants’ representation, or share in any fees earned by the firm for its services to defendants,’ the panel said.”

“Florida Law Firm Closer to Disqualification in Trademark Fight” —

• “A law firm based in Florida shouldn’t be able to represent an online educational services agency in its trademark suit accusing a private company of using confusingly similar marks, a magistrate judge has recommended.”
• “Independent public agency Florida Virtual School sued foreign for-profit company K12 Inc. in 2020, saying K12 used its marks to promote its materials and breached a settlement agreement stemming from a 2011 lawsuit with similar allegations.”
• “K12 moved to dismiss GrayRobinson PA as plaintiff’s counsel, claiming that one of its attorneys previously represented K12 in the earlier suit. Stephanie Carman was privy to privileged information from when she worked for Hogan Lovells LLP, prior to joining GrayRobinson, the defendant alleged.”
• “U.S. Magistrate Judge Embry J. Kidd of the U.S. District Court for the Middle District of Florida recommended approving that motion April 20, rejecting the argument that the matters aren’t substantially related.”
• “The court noted that ‘perhaps the most revealing of the substantial relatedness of the matters’ is that the current complaint relates the instant action to the settlement agreement and prior litigation.”

“Premier League accused of ‘unacceptable conflict of interest’ over use of law firm run by interim chairman” —

• “The Premier League has been accused by the former sports minister Tracey Crouch of an ‘unacceptable conflict of interest’ for using a law firm run by its interim chairman to carry out checks on club takeovers.”
• “Peter McCormick, who was appointed the interim chairman of the Premier League in January, is the senior partner of McCormicks Solicitors in Harrogate, Yorkshire, and is also the long-serving chairman of the Premier League’s Legal Advisory Group and Football Board and an FA board member.”
• “McCormick’s firm has carried out the owners’ and directors’ test checks for the league when clubs are being taken over or new directors appointed, and has previously been paid hundreds of thousands of pounds in legal fees.”
• “Crouch, who headed last year’s fan-led review of football, said the arrangement was another argument for the English game to have an independent regulator, which would carry out such checks on club takeovers.”
• ‘”Sources have told The Times that McCormicks Solicitors was involved in the owners’ and directors’ test checks for the most recent top-flight takeover — the purchase of Newcastle United in October by a consortium led by Saudi Arabia’s Public Investment Fund (PIF). It is understood that the firm could also be used in the process for the new Chelsea owners.”
• “Crouch told The Times: ‘This strikes me as an unacceptable conflict of interest. Any firm or organisation that carries out any checks for the owners’ and directors’ test should not be connected to any senior figure within the Premier League. This is exactly the kind of situation that would be avoided under an independent regulator.'”
• “Other senior figures in football have privately expressed surprise about the arrangement but McCormick defended his and his firm’s roles. He told The Times: ‘Tracey Crouch has commented without checking the facts. I, along with my firm, have been an adviser on the OADT [owners’ and directors’ test] for 12 years. It was agreed before I took the interim chair that the board wished that service to continue and it was agreed that I would not participate in the decision-making process on any club takeover while interim chair. Clubs were informed of this at the shareholders’ meeting which appointed me — at which I was not present, in accordance with good practice.'”
• “The Premier League added that McCormicks had been used to advise on the owners’ and directors’ test for more than a decade, along with other firms, and that McCormick himself would not take part in any vote by the league’s board on a takeover.”

“State Supreme Court considers attorney’s ‘conflicts’ in APS test-cheating appeal” —

• “A public defender representing six former educators convicted in the Atlanta Public Schools test-cheating scandal argued Tuesday he should not be required to represent all six clients in their appeals because to do so would raise conflicts of interest.”
• “If forced to represent them on his own, the educators ‘would proceed with motions for a new trial with counsel divided in his loyalty, his attention, his orientation of the defense,’ Fulton County public defender Stephen Scarborough told the Georgia Supreme Court.”
• “The appeal is occurring almost seven years after the conclusion of the trial, believed to be the longest in state history. Scarborough was appointed to represent six of the defendants on appeal, beginning with their motions for a new trial before trial judge Jerry Baxter.”
• “At least two years after taking the case, Scarborough told Baxter he realized he should not be representing all six because they had competing interests. But Baxter, expressing frustration by the lengthy passage of time, denied Scarborough’s motion to allow his clients to have separate, conflict-free counsel.”
• “Criminal charges were brought against Atlanta educators after The Atlanta Journal-Constitution, in both 2008 and 2009, revealed some schools were posting statistically unbelievable scores on state tests. Of the 35 educators indicted for racketeering and other offenses, 21 pleaded guilty and two died before trial. Of the 12 who stood trial, which lasted almost eight months, 11 were convicted.”
• “During arguments, some justices expressed concern that a ruling in Scarborough’s favor would open a Pandora’s Box that would allow countless future defendants to file appeals asserting their attorneys have conflicts of interest. They also noted that even if Scarborough has an alleged conflict and is required to proceed, his clients could later file appeals seeking to correct the problem.”
• “Even though justices worried about the precedent they might set in Scarborough’s appeal, some expressed concern about requiring Scarborough to proceed if he has divided loyalties to his six clients.”
• “‘If my counsel is representing both of us and in order to best represent my co-defendant is required to implicate me and does so, have I received conflict-free counsel?’ Justice Charles Bethel asked. ‘No.'”

“Baker Donelson Achieves ISO 27001 Certification for Information Security Management” —

• “Baker Donelson has achieved ISO 27001 certification, an internationally recognized certification for information security management.”
• “Earning the ISO 27001 certification shows that Baker Donelson is in compliance with rigorous international standards regarding utilization of best practices, ongoing governance, and management of information systems to ensure the security of client and firm data. Baker Donelson was awarded this certification by BSI, a leading provider of business improvement solutions.”
• “‘As a law firm, it is critically important that we safeguard the security of our clients’ information. Protecting the interests of our clients has always been paramount for us, and earning the ISO 27001 certification demonstrates that Baker Donelson has the necessary controls in place to ensure that all client data is secure and protected,’ said the Firm’s Chief Information Officer Lance N. Rea.”

“Stark & Stark Achieves ISO 27001 IT Certification” —

• “The law firm of Stark & Stark [100+ lawyers] announced its achievement of ISO 27001 certification, one of the most widely recognized and internationally accepted information security standards that defines how an organization should manage and treat information. Lawrenceville’s Stark & Stark is among a select group of law firms to achieve this certification.”
• “‘Providing our clients with great service is the core of what we do at Stark & Stark, and the security of our clients’ information is at the foundation of great service,’ Thomas Kline, Stark & Stark’s Director of Information Technology, stated. ‘Achieving the ISO 27001 certification illustrates our commitment to continuously improve our information security management, and it tests that commitment through annual audits that adhere to an internationally recognized standard.'”
• “The certification means Stark & Stark has adopted a best practices approach to information security management and has established policies and procedures to ensure the security of the firm’s client information will be continuously improving and evolving.”
  “Stark & Stark Managing Shareholder Michael Donahue stated, ‘Our drive to achieve this level of security is client satisfaction. We are committed to continuous improvement to information security. Obtaining this certification for our Firm was truly a team effort.'”

“How Law Firms Can Avoid Data Breaches Using the Cloud” —

• “Reports of increased cyberattacks significantly impacted the legal industry during the pandemic, with widely publicized ransomware attacks striking several prominent firms, resulting in serious reputational damage and significant liability. There’s little doubt that other attacks occurred but did not become public.”
• “Although firms may think they have appropriate protocols for cyberattack prevention and breach-response plans in place, data has shown that less than half of law firms participating in the ABA survey use even basic security tools like encryption, two-factor authentication, intrusion detection and prevention, or remote-device management protocols.”
• “As the ethical and practical imperatives for data security become clearer, some firms have adopted a stop-gap approach—purchasing insurance to mitigate financial exposure—while others are taking a wait-and-see approach, and the ABA survey reports only about a third of firms hold cyber liability insurance policies.”
• “Although it’s wise to purchase insurance policies, they don’t prevent data breaches, nor do they protect a company from contractual or regulatory consequences.”
• “Compounding poorly mitigated data-breach risk, many Big Law lawyers remain in the dark regarding security incidents at their firms. Whereas about three-quarters of survey respondents from firms with 50 lawyers or fewer report they are in the loop, nearly two-thirds of lawyers working in firms with 100 lawyers or more say they have no visibility into their firms’ data breaches.”
• “Firms rightfully worry about cybersecurity in the cloud generally and client contractual obligations specifically. Because outside counsel guidelines usually stipulate that client data must be stored in a specific fashion—which often entails keeping sensitive information in a firm-managed environment—firms are obligated to audit and update these contracts transparently before migrating client records to the cloud. For a large firm staring down thousands of contracts, it’s an onerous and expensive exercise”
• “Although advanced cloud models for risk and compliance incorporate key elements of secure computing by meeting or exceeding common regulatory requirements—and often provide a higher level of safety than on-premises deployment—the EU General Data Protection Regulation (GDPR) has generated renewed concerns about cloud storage for the legal industry.”
• “Because cloud service providers’ reputations and business models rely on state-of-the-art data security, these vendors invest heavily in robust security teams and rapid platform updates. It’s a simple matter of scale: It’s impossible for a single firm to develop and execute the same breadth and depth of security and innovation protocols as a cloud service provider.”
• “Most cloud service providers have a wide range of clients. As a result, they may be subject to stringent regulatory requirements; many voluntarily adhere to industry best practices and guidelines, such as ISO27001, which entail strict standards for building and maintaining data centers, as well as regular independent audit cycles to ensure compliance.”
• “In the past, law-firm data breaches often went unreported—and possibly undetected. Now, all 50 states plus the District of Columbia, Guam, Puerto Rico, and the Virgin Islands have enacted security breach notification laws requiring businesses to inform affected parties when their personal information is breached.”
• “Today, lawmakers continue to expand existing laws; 22 states strengthened security breach regulations in 2021, including shortening the window for firms to report breaches and requiring private sector entities to report breaches to the attorney general or other state entity.”
• “Survey data shows that cybersecurity remains a key challenge for law firms, and the sector finds itself increasingly targeted due to its wealth of sensitive data—and deep pockets. With representatives of nearly two-thirds of the 100 leading Big Law firms identifying cybersecurity threats as a key concern, it’s eye-opening that less than one-quarter of these firms employ a cybersecurity committee that reports into the party charged with governance.”
• “Although many persist in the belief that in-house servers are more reliable and secure than cloud-based solutions, cloud storage offers strategic redundancies that both protect data durability and availability and prevent file loss due to equipment error, damage, or data breach. As threats become increasingly relentless and sophisticated, firms focused on long-term data security are embracing the protections afforded by the cloud.”

“Kennedys-led consortium receives £783k from Innovate UK to develop reputational risk software” —

• “A consortium led by UK top 50 law firm Kennedys has been awarded £783,000 in funding from Innovate UK to develop software that is able to identify and assess reputational risk, as part of a £1.2m project. The difference will be covered by Kennedys and four fellow consortium members: The University of Manchester and University College London; public relations group Cicero/amo; and risk management company RiskCovered Limited.”
• “Reputation Advisor will be developed to analyse content – from corporate documents to publicly available information – to create a reputational index of risk relating to an organisation’s corporate citizenship via ESG (environmental, social and governance) practices that impact on a company’s bottom line.”
• “Reputation risk is considered as an intangible asset that is rising in company value. Karim Derrick, product and innovation director for Kennedys’ tech arm Kennedys IQ said: ‘In a world where companies are often accused of greenwashing, Reputation Advisor will also provide robust and transparent evidence of a firm’s genuine green credentials. From an insurance perspective, the product will help insurers in their conversations with their own clients to quantify ESG related risk.'”

Just “Smartphones”? Or are cloud/server/desktop-enacted LinkedIn/Outlook/Microsoft Teams integrations also in scope (among other data flows)?: “New York Bar Issues Ethics Opinion on Protecting ‘Confidential’ Client Identity Information on Smartphones” —

• “On April 8, 2022, the New York Bar issued an opinion to protect “confidential” client identity information stored on an attorney’s smartphone. In particular, the opinion prohibits an attorney who stores ‘confidential’ (as defined under Rule 1.6 of the New York Rules of Professional Conduct) client identity information in the attorney’s “contacts” folder on the attorney’s smartphone from consenting to share their “contacts’ with a smartphone app, unless certain criteria are met.”
• “The opinion is based on Rule 1.6(c), which provides that an attorney is required to ‘make reasonable efforts’ to prevent the disclosure of “confidential’ client information. The opinion explains that, before an attorney grants access to his or her smartphone’s contacts folder, the attorney must first determine whether any contact information is ‘confidential’ client information within the meaning of Rule 1.6. If clients’ names constitute ‘confidential’ information, the opinion states that an attorney must ‘make reasonable efforts to prevent the unauthorized access of others to those names, whether stored as a paper copy in a filing cabinet, on a smartphone, or in any other electronic or paper form.'”
• “If the attorney’s smartphone ‘contacts’ folder contains ‘confidential’ client information, the attorney may not consent to share the contacts folder with a smartphone app, unless the attorney determines that (1) no person will view the information and (2) the information will not be sold or transferred to additional third parties, without the client’s consent.”

“Former Alberta justice minister, ex-law partner accused of conflict of interest in Kamikaze campaign probe” —

• “Former Alberta justice minister Jonathan Denis and his ex-law partner Dale Fedorchuk have been accused of conflict of interest in connection with the Kamikaze campaign investigation — and of making one client ‘the scapegoat’ for another: United Conservative Party heavyweight Jeff Callaway.”
• “The allegation came out in an interview Cameron Davies, Callaway’s former communications director, gave to the Office of the Election Commissioners (OEC) as part of its probe into Callaway’s 2017 UCP leadership campaign. He also accused the two lawyers of breaching solicitor-client privilege, details of which are contained in the OEC investigator’s interview transcript and summary obtained by CBC News.”
• “Davies was Callaway’s co-campaign manager and ran communications. He told investigators he’d convinced a number of people to go along with putting their names on donations they didn’t make — and received two $7,500 fines in February 2019 for obstructing the investigation into the campaign by Alberta’s election commissioner. Davies was also fined $12,000 for facilitating irregular donations for the Callaway campaign.”
• “But the transcripts from the first in-person interview Davies gave to election commissioner investigators in March 2019 — a month after his obstruction fine — include allegations that his lawyer, Fedorchuk, wasn’t acting in his best interest.”
• “Instead, he alleges that the lawyer gave privileged information to his law partner, Denis, in order to help another client under investigation by the OEC: Callaway”
• “When contacted by CBC News, Fedorchuk and Denis said through Guardian Law that solicitor-client privilege prevents them from responding to these allegations — or even confirm their involvement in the case. Davies subsequently sent Guardian Law an email waiving his privilege for this story, but Guardian Law and Fedorchuk reiterated they’d be violating privilege were they to answer any of the inquiries.”
• “The interview and investigator’s summary include specific claims made by Davies, which would violate Law Society of Alberta rules if proven accurate.”
• “Running a dark horse campaign like Callaway’s isn’t against electoral law in itself. But much of its funding was, according to a months-long investigation by the election commissioner’s office.”
• “In the OEC interview, Davies said when he learned he could be targeted by the commission’s investigation, he was initially referred to Denis, who served as Alberta’s attorney general and justice minister from 2012 to 2015. But Davies said the former Progressive Conservative cabinet minister assigned the case to Fedorchuk, his then-partner at Guardian Law Group.”
• “What he didn’t know then, he said, is that Denis was representing Callaway. If a law firm is representing two clients who may have different interests, it’s essential to at least build an ethical wall between the two, University of Calgary assistant professor of law Gideon Christian says.”
• “‘You cannot be a slave to two masters,’ he said. ‘The law firm should have put in place a structure to prevent confidential information to be exchanged between the two lawyers acting on behalf of different individuals in this case.'”
• “Davies told investigators that no such wall existed. In fact, he said Denis was often present on privileged phone calls between himself and Fedorchuk.”