Risk Update

Emerging Risk Grab Bag — Deepfake Evidence Risk, PR Crisis Management Privilege Risk, Lawyer Email Encryption Opinions

To Share or Not to Share: Avoiding Privilege Waiver When Working with PR Consultants” —

  • “In today’s environment, clients are increasingly interested in retaining public relations (PR) firms, crisis managers or media consultants—especially when a potential scandal is about to break or an investigation is underway or on the horizon.”
  • “Indeed, sometimes those responsible for internal or external PR are the first to get wind of a brewing crisis. The fast-paced news cycle and social media pressure often create a need for ‘instant’ responses, and shareholders, boards of directors and news outlets expect an immediate reaction to the possibility of a negative story.”
  • “So, what is a practitioner to do in the face of this fluid state of the law? Although there is no one-size-fits-all approach, here are a few tips to mitigate the risk of waiver when engaging with a PR consultant:
    • “Ideally, outside counsel, rather than the client, should retain the PR consultant. And the engagement letter with the consultant should specify the purpose of the engagement and explain why that consultant’s services are necessary to enable counsel to provide legal advice to the client. Courts tend to disfavor a simple ‘to assist with media coverage’ or ‘to help rehabilitate [client’s] reputation.'”
    • “Exercise caution when considering the retention of a consultant who has previously worked with the client in a business capacity. Although such engagements have received more attention in the context of work product challenges, courts may scrutinize whether the new work is really just an extension of prior activity to which the privilege does not extend. See, e.g., In re Premera Blue Cross Customer Data Sec. Breach Litig., 296 F. Supp. 3d 1230 (D. Or. 2017).”
    • “Even with an engagement whose scope would satisfy the most rigorous application of Kovel, not all actions by or communications with the PR consultant will be in aid of legal advice. To that end, the lawyers, consultants and client should clearly mark as ‘confidential’ and ‘attorney-client privileged’ all communications that convey or facilitate legal advice. But merely affixing such a label to a communication with a consultant does not make it so. Counsel and clients should avoid reflexively copying the PR consultant on privileged communications without thinking through the potential privilege waiver consequences.”
    • “A PR firm retained by counsel should understand the importance of protecting privileged information and the risks of waiver, and should be instructed not to share protected information with anyone outside the scope of the privilege.”

Professor Alberto Bernabe opines: “Do Attorneys Need to Implement Email Encryption?” —

  • “Most states have adopted the view that the duty of competence includes a duty to keep up with modern technology. Also, most states have adopted the view that the duty of confidentiality includes a duty to take reasonable measures to protect confidential information from unauthorized or negligent disclosure (which can happen if a lawyer is not familiar with certain aspects of modern technology).”
  • “So, given those two facts, do lawyers need to implement e-mail encryption? I have not seen any specific decision or opinion that answers that question with an unequivocal “yes” but I have seen articles suggesting that it would be the logical answer.”
  • And here is the latest, published in Law Technology Today.

Lawyers and AI: How Lawyers’ Use of Artificial Intelligence Could Implicate the Rules of Professional Conduct” —

  • “From chatbots to image generators, news outlets have been inundated with stories discussing the implications of artificial intelligence or ‘AI’ programs.”
  • “Rather than relying on an AI program for a final product, it may be best to limit use to first drafts or a potential framework.[7] Even as these technologies improve, a lawyer ‘must review and be responsible for the work product of’ an AI program just as a lawyer must do for the work of any nonlawyer staff.[8]”
  • “Rule 4-3.3 prohibits a lawyer from knowingly ‘making a false statement of fact or law to a tribunal or fail[ing] to correct a false statement of material fact or law previously made to the tribunal[.]’ Similarly, when representing a client, ‘a lawyer shall not knowingly… make a false statement of material fact or law to a third person[.]'[9]”
  • “AI programs do not always cite to their sources, and some AI programs have been caught making ‘’surprising mistakes’ with basic math'[10] or even creating facts (or polling data) that doesn’t exist.[11]”
  • “Lawyers are prohibited from voluntarily disclosing any information relating to the representation of a client absent the client’s informed consent or an applicable exception in the confidentiality rule.[14] While a lawyer is ‘impliedly authorized to make disclosures about a client when appropriate in carrying out the representation,’ that authorization is still subject to the ‘client’s instructions or special circumstances [which] limit that authority.'[15]”
  • “Consistent with these obligations, The Florida Bar’s Professional Ethics Committee advised that a lawyer may utilize cloud computing services provided that the lawyer ‘take[s] reasonable precautions to ensure that confidentiality of client information is maintained, that the service provider maintains adequate security, and that the lawyer has adequate access to the information stored remotely.'[16] The lawyer must also research the cloud computing service prior to use[17] and assure that files stored electronically are ‘readily reproducible and protected from inadvertent modification, degradation or destruction.'[18]”
  • “Given that many AI programs frequently rely on user input and proprietary methods to generate responses, it may be difficult or impossible to determine whether client information is kept confidential when shared with an AI program. Further, it is unclear whether sharing information with an AI program would be discoverable and would waive claims of attorney-client privilege. Absent answers to these questions, lawyers should exercise extreme caution when sharing client information with AI programs and should carefully explain the implications of these disclosures when seeking a client’s informed consent.”
  • “Many questions regarding a lawyer’s use of A.I. programs are currently unanswered and may remain unanswered for the indefinite future. For this reason, lawyers are advised to maintain a healthy dose of skepticism regarding AI programs and to proceed with caution. While these programs may someday revolutionize the practice of law, a lawyer’s ethical obligations have not changed. Duties of candor, competence, and confidentiality have remained steadfast in the face of prior technological innovations and should be expected to guide the practice of law indefinitely into the future.”

Kyle Roche Hidden Video May Be Deepfaked, Expert Says” —

  • “Freedman Normand Friedland LLP told a California federal judge overseeing allegations Dfinity sold unregistered securities that the crypto company cannot rely on secretly recorded comments from ex-firm partner Kyle Roche to bolster its attempt to disqualify the plaintiffs’ firm, saying Wednesday an expert report shows the video clips might be deepfaked.”
  • “Dfinity in October asked U.S. District Judge James Donato to disqualify Freedman Normand from representing a proposed class of investors, saying Roche boasted in video clips posted online in August that the firm uses litigation to advance the commercial interests of Dfinity’s rival Ava Labs, including to get confidential information about competitors through discovery.”
  • “The video on the website CryptoLeaks purportedly shows Roche claiming that his firm — Roche Freedman, at the time — was acting on behalf of Ava Labs in filing the class action against Dfinity, the company said at a hearing last month. The attorney has denied forming a ‘secret pact’ with Ava Labs to sue competitors.”
  • “Freedman Normand hit back in its opposition, arguing that the video clips were secretly recorded during a dinner meeting set up under false pretenses and published on a website controlled by Dfinity. Now, Freedman Normand said it has an expert report explaining ‘that many of the videos on which defendants rely are the product of manipulation, are inauthentic, and contain indicators consistent with the use of deepfake technology.'”
  • “According to the report prepared by David Kalat, a director at Berkeley Research Group LLC with a film degree and experience in forensic computer examinations, the video segments that appear to show Roche talking about the instant case show signs of ‘repeated compression, tampering, and extensive manipulation.'”
  • “The term ‘deepfake’ refers to technology that uses machine learning or artificial intelligence to create realistic looking but fake images, videos and audio, according to the report. Users of such software can edit the transcript of the video to delete words, rearrange existing words or add new words, Kalat said, while the AI makes the subject of the video appear to say the new transcript.”