MTC: 📱 Protecting Client Confidentiality NOW in Anticipation of Holiday Travel - Essential Digital Security Guide for Lawyers!

Lawyers know your rights and responsibilities when crossing an international boarder.

As legal professionals prepare for the busy holiday travel season from November through early January, an alarming trend demands immediate attention. U.S. Customs and Border Protection (CBP) conducted a record-breaking 14,899 electronic device searches between April and June 2025—a 16.7% increase over the previous quarterly high. With nearly 15,000 devices examined in just three months, lawyers carrying client data face unprecedented risks to attorney-client privilege.

The timing coincides with significant TSA rule changes that fundamentally alter airport security protocols. Secretary Kristi Noem announced the elimination of shoe removal requirements at checkpoints, while implementing advanced facial recognition technology through TSA PreCheck Touchless ID at select airports. These changes represent the most substantial security overhaul since 9/11, creating new vulnerabilities for legal professionals.

Understanding the Current Threat Landscape

Border searches have escalated dramatically over the past decade. From 8,503 searches in 2015, the numbers jumped to 46,362 in fiscal year 2024. The latest data shows CBP conducting 13,824 basic searches and 1,075 advanced searches during the recent quarter. Basic searches involve manual inspection of device contents, while advanced searches employ forensic tools to extract comprehensive data repositories.

Legal professionals face particular vulnerability because electronic devices commonly contain materials protected by attorney-client privilege. The New York City Bar Association addressed this concern with its Formal Opinion 2017-5 directly, noting that attorneys carry confidential client communications, work product, and sensitive case materials on personal devices. When border agents request device access, lawyers must balance professional obligations with potential entry denial or device confiscation.

Professional Ethical Obligations

The American Bar Association has urged the Department of Homeland Security to establish policies protecting attorney-client privilege during border searches. However, current CBP policies permit extensive searching authority under the border search exception, which allows warrantless inspections within 100 miles of international borders. This doctrine significantly reduces Fourth Amendment protections for travelers, including U.S. citizens.

New York lawyers operating under Rule 1.6 must take reasonable steps to prevent unauthorized disclosure of confidential information. The reasonableness standard requires evaluating potential harm against disclosure likelihood. For attorneys whose practice involves government agencies as opposing parties, heightened precautions become necessary.

Practical Protection Strategies

Modern legal practice demands strategic preparation for international travel. Attorneys should evaluate necessity before carrying confidential information across borders. Essential data should remain minimal—only materials professionally required for specific travel purposes. Cloud-based storage offers significant protection since CBP cannot access remotely stored information during searches.

Encryption provides another critical layer of defense. Strong passwords and disabled biometric authentication prevent immediate access. Restarting your device before reaching the border forces manual password entry rather than biometric unlocking, effectively blocking access for those without proper credentials. For maximum protection, consider using alphanumeric passwords of at least 12 characters combining uppercase letters, numbers, and special symbols. Some firms implement clean device policies, providing employees with minimal-data devices for international travel. Virtual private networks (VPN) and secure remote access solutions allow attorneys to retrieve necessary information without local storage. Additional protective measures include enabling two-factor authentication on cloud accounts, using encrypted messaging applications like Signal for client communications, and implementing remote wipe capabilities for lost or confiscated devices.

Don’t get caught not protecting your client’s pii when traveling!

Technology considerations extend beyond individual devices. The implementation of CT scanners at major airports enables enhanced screening capabilities, while new facial recognition systems create biometric templates for identity verification. These advances improve security efficiency but raise additional privacy concerns for legal professionals handling sensitive cases involving government oversight, immigration matters, or politically sensitive litigation where client anonymity becomes paramount.

Legal authorities have issued specific guidance regarding these new biometric screening protocols. The Privacy and Civil Liberties Oversight Board recommends that TSA's facial recognition program remain voluntary for all passengers, while twelve bipartisan U.S. Senators have called for comprehensive oversight of the technology's expansion. Privacy and digital rights experts advise attorneys to exercise their right to opt out of facial recognition screening by politely requesting alternative identity verification procedures, especially when handling sensitive or high-risk matters. According to the TSA's own policies, travelers can decline biometric scanning without penalty or additional scrutiny. However, studies show that 99% of travelers are not verbally informed of this option by TSA agents, making proactive assertion of opt-out rights essential. The American Bar Association and bar associations recommend attorneys stay informed about biometric screening procedures and safeguard client confidentiality during travel. For attorneys handling cases where government surveillance poses particular risks, consistently opting out of facial recognition becomes a professional obligation to protect client interests and maintain confidentiality.

Preparing for Holiday Travel Season

The holiday travel period presents unique challenges. TSA expects record-breaking passenger volumes during Thanksgiving week, with peak travel days including November 26-27 and December 1. Christmas travel intensifies December 20-22 and December 26. New Year's travel typically peaks December 29 and January 2-3. These high-volume periods increase security scrutiny and delay risks.

Attorneys should develop comprehensive travel protocols before departure. Essential preparations include identifying devices containing client data, securing informed consent for potential disclosure, and establishing communication protocols with firm leadership. Bar identification cards help verify professional status during searches. Legal counsel should remain accessible for consultation during border encounters.

Response Protocols During Searches

When facing device searches, attorneys should immediately identify themselves as legal professionals and notify agents about privileged content. CBP policies require consultation with agency counsel before searching devices containing claimed privileged materials. (See 5.2.1.2) However, this protection offers limited practical value since determination processes remain unclear.

Professional obligations continue during border encounters. Attorneys must object to searches on privilege grounds while understanding that resistance may result in device confiscation or entry complications. U.S. citizens cannot be denied entry, but devices may face extended detention for forensic examination. Non-citizens risk entry denial entirely.

Post-Search Obligations

Following any disclosure of confidential information, attorneys must promptly notify affected clients pursuant to professional responsibility rules. Documentation requirements include recording disclosed materials, identifying involved personnel, and implementing remedial measures. Firms should establish incident response protocols addressing client notification, privilege assertions, and regulatory compliance.

Final Thoughts: Looking Forward

you have certain rights when dealing with boarder patrol.

The legal profession must adapt to evolving security landscapes while maintaining ethical obligations. Holiday travel season presents heightened risks due to increased passenger volumes and enhanced scrutiny. Legal professionals should prioritize preparation, implement robust data protection protocols, and maintain clear communication with clients about potential disclosure risks.

As border search authority continues expanding and technology enables more intrusive examinations, the legal profession must advocate for meaningful protections while developing practical compliance strategies. The intersection of national security concerns and professional obligations requires ongoing attention from bar associations, legal practitioners, and policymakers.

The stakes are clear: protecting client confidentiality while navigating modern travel security demands requires preparation, awareness, and strategic planning. As lawyers prepare for holiday travel, implementing comprehensive digital security protocols becomes not just prudent practice, but professional obligation.

MTC

MTC: AI Governance Crisis - What Every Law Firm Must Learn from 1Password's Eye-Opening Security Research

The legal profession stands at a crossroads. Recent research commissioned by 1Password reveals four critical security challenges that should serve as a wake-up call for every law firm embracing artificial intelligence. With 79% of legal professionals now using AI tools in some capacity while only 10% of law firms have formal AI governance policies, the disconnect between adoption and oversight has created unprecedented vulnerabilities that could compromise client confidentiality and professional liability.

The Invisible AI Problem in Law Firms

The 1Password study's most alarming finding mirrors what law firms are experiencing daily: only 21% of security leaders have full visibility into AI tools used in their organizations. This visibility gap is particularly dangerous for law firms, where attorneys and staff may be uploading sensitive client information to unauthorized AI platforms without proper oversight.

Dave Lewis, Global Advisory CISO at 1Password, captured the essence of this challenge perfectly: "We have closed the door to AI tools and projects, but they keep coming through the window!" This sentiment resonates strongly with legal technology experts who observe attorneys gravitating toward consumer AI tools like ChatGPT for legal research and document drafting, often without understanding the data security implications.

The parallel to law firm experiences is striking. Recent Stanford HAI research revealed that even professional legal AI tools produce concerning hallucination rates—Westlaw AI-Assisted Research showed a 34% error rate, while Lexis+ AI exceeded 17%. (Remember my editorial/bolo MTC/🚨BOLO🚨: Lexis+ AI™️ Falls Short for Legal Research!) These aren't consumer chatbots but professional tools marketed to law firms as reliable research platforms.

Four Critical Lessons for Legal Professionals

First, establish comprehensive visibility protocols. The 1Password research shows that 54% of security leaders admit their AI governance enforcement is weak, with 32% believing up to half of employees continue using unauthorized AI applications. Law firms must implement SaaS governance tools to identify AI usage across their organization and document how employees are actually using AI in their workflows.

Second, recognize that good intentions create dangerous exposures. The study found that 63% of security leaders believe the biggest internal threat is employees unknowingly giving AI access to sensitive data. For law firms handling privileged attorney-client communications, this risk is exponentially greater. Staff may innocently paste confidential case details into AI tools, potentially violating client confidentiality rules and creating malpractice liability.

Third, address the unmanaged AI crisis immediately. More than half of security leaders estimate that 26-50% of their AI tools and agents are unmanaged. In legal practice, this could mean AI agents are interacting with case management systems, client databases, or billing platforms without proper access controls or audit trails—a compliance nightmare waiting to happen.

Fourth, understand that traditional security models are inadequate. The research emphasizes that conventional identity and access management systems weren't designed for AI agents. Law firms must evolve their access governance strategies to include AI tools and create clear guidelines for how these systems should be provisioned, tracked, and audited.

Beyond Compliance: Strategic Imperatives

The American Bar Association's Formal Opinion 512 established clear ethical frameworks for AI use, but compliance requires more than policy documents. Law firms need proactive strategies that enable AI benefits while protecting client interests.

Effective AI governance starts with education. Most legal professionals aren't thinking about AI security risks in these terms. Firms should conduct workshops and tabletop exercises to walk through potential scenarios and develop incident response protocols before problems arise.

The path forward doesn't require abandoning AI innovation. Instead, it demands extending trust-based security frameworks to cover both human and machine identities. Law firms must implement guardrails that protect confidential information without slowing productivity—user-friendly systems that attorneys will actually follow.

Final Thoughts: The Competitive Advantage of Responsible AI Adoption

Firms that proactively address these challenges will gain significant competitive advantages. Clients increasingly expect their legal counsel to use technology responsibly while maintaining the highest security standards. Demonstrating comprehensive AI governance builds trust and differentiates firms in a crowded marketplace.

The research makes clear that security leaders are aware of AI risks but under-equipped to address them. For law firms, this awareness gap represents both a challenge and an opportunity. Practices that invest in proper AI governance now will be positioned to leverage these powerful tools confidently while their competitors struggle with ad hoc approaches.

The legal profession's relationship with AI has fundamentally shifted from experimental adoption to enterprise-wide transformation. The 1Password research provides a roadmap for navigating this transition securely. Law firms that heed these lessons will thrive in the AI-augmented future of legal practice.

MTC

🚨 BOLO: Zoom Remote Access Attacks – Critical Security Alert for Legal Professionals 🚨

Zoom Attack Exposes Lawyers to Major Cyber Risk: Why Vigilance Is Now an Ethical Imperative!

Lawyers need to be able to Spot fake Zoom invites—protect your client data now!

A sophisticated cyberattack targeting Zoom users has recently emerged, with direct implications for lawyers and legal professionals. The attack, detailed by Malwarebytes, involves a crime group dubbed ELUSIVE COMET that lures victims into Zoom meetings and tricks them into granting remote access. This enables the installation of malware and theft of sensitive data, including financial assets and confidential client information, e.g., PII.

How the Attack Works

• Attackers pose as reputable contacts (e.g., media invitations) and set up Zoom calls.

• During the meeting, the attacker often sends a remote control request with their camera off, disguising their screen name as “Zoom” to appear legitimate.

• If the victim approves, the attacker gains full control of the victim’s system, installs malware, and can access files, emails, and even financial accounts.

Why Lawyers Must Be Extra Cautious

Ethical Duties Under ABA Model Rules

You need to be careful who you let into your zoom conferences!

• Competence (Rule 1.1): Lawyers must provide competent representation, which now explicitly includes technological competence. Comment 8 to Rule 1.1 states:
  To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject.

• Confidentiality (Rule 1.6): Attorneys are ethically obligated to protect client information from unauthorized disclosure. Allowing remote access to your device can expose privileged communications, work product, and sensitive client data to malicious actors.

• Failing to maintain technological competence or safeguard client data can result in ethical violations, malpractice claims, and reputational harm.

Best Practices to Prevent Zoom-Based Attacks

• Never accept remote control requests from unknown or unverified participants.

• Use Zoom via your web browser when possible, as the browser version does not support remote control, reducing risk.

• Enable meeting passwords and waiting rooms to control access.

• Restrict screen sharing and disable remote control features unless absolutely necessary.

• Verify all meeting invitations-scrutinize the sender’s identity, and be wary of unsolicited requests, especially those involving media opportunities or unfamiliar contacts.

• Keep Zoom and all security software updated to address known vulnerabilities.

• Educate staff and colleagues about the risks and proper protocols for virtual meetings.

What to Do If You Suspect a Breach

You control access—deny hackers, defend your practice.

• Disconnect from the internet immediately to limit further access.

• Contact your IT or cybersecurity team and initiate your incident response plan.

• Notify affected clients and relevant authorities as required by law and ethical rules.

• Document the incident and steps taken for compliance and potential reporting obligations.

• Review and update your security protocols to prevent future incidents.

Let’s be careful out there - it could cost you your job or, worse yet, your bar license if you don’t!

Happy Lawyering!!!

MTC: Legal Cybersecurity Crisis - How the CVE System's Defunding Compromises Digital Safety for Law Firms 🚨

In the chaos, Lawyers need to defend client data as CVE shield may be in jeopardy!

CVE Program’s Last-Minute Rescue: What Lawyers Must Learn from the Cybersecurity Near-Crisis 🚨

The legal world narrowly avoided a digital disaster last week week. The Common Vulnerabilities and Exposures (CVE) program—the backbone of global cybersecurity—came within hours of losing its federal funding, sending shockwaves through the legal and cybersecurity communities. In an eleventh-hour move, the Cybersecurity and Infrastructure Security Agency (CISA) extended funding for MITRE to continue operating the CVE program, averting a shutdown that could have left law firms and their clients exposed to unprecedented cyber risk. The episode is a wake-up call for every legal professional: Our reliance on a single, government-funded system for vulnerability intelligence is a vulnerability in itself.

The Alarm: How Close We Came to Losing the CVE Program ⚠️

On April 16, 2025, MITRE, the non-profit that manages the CVE database, announced its contract with the Department of Homeland Security would expire at midnight. The news triggered widespread alarm across the cybersecurity sector, as the CVE program is essential for tracking, cataloging, and sharing information about software vulnerabilities. Legal technology vendors, law firm IT teams, and risk managers all depend on CVE data to prioritize security updates and defend against cyber threats.

The potential consequences were immediate and severe. Experts warned that a lapse in CVE services would delay vulnerability disclosures, disrupt incident response, and create a dangerous window for attackers to exploit unpatched systems. Law firms, which handle highly sensitive client information, would have faced heightened risks of data breaches, malpractice claims, and regulatory penalties.

The Save: CISA Steps In—But Only for Now ⏳

CISA’s rescue: Legal cybersecurity lifeline survives—uncertainty remains.

In response to the outcry, CISA executed a last-minute contract extension, ensuring there would be no interruption in CVE services for at least the next 11 months. MITRE confirmed that the funding would keep the program running, and the global cybersecurity community breathed a collective sigh of relief.

Yet, this solution is temporary. The extension lasts less than a year, and the long-term sustainability of the CVE program remains uncertain. The episode has already spurred the formation of a new nonprofit, the CVE Foundation, aimed at ensuring the program’s independence and stability beyond government sponsorship.

Why This Matters for Lawyers and Law Firms ⚖️

The CVE program is more than a technical tool—it is a legal lifeline. The American Bar Association’s Model Rules require lawyers to safeguard client confidentiality, maintain technological competence, and supervise staff and vendors on cybersecurity practices. See MRPC 1.1[8] & 1.6. Without reliable, up-to-date vulnerability intelligence, law firms cannot meet these obligations.

If the CVE program had gone dark, lawyers would have faced:

• Increased risk of data breaches: Without a unified system for tracking vulnerabilities, attackers would have more time and opportunity to exploit unpatched systems, putting client data at risk.

• Malpractice exposure: Failing to implement timely security updates could be seen as a breach of the duty of competence and confidentiality, opening the door to claims of negligence or breach of fiduciary duty.

• Compliance headaches: With regulatory requirements around breach notification and data protection tightening, law firms would struggle to demonstrate they had taken “reasonable efforts” to protect client information.

• Vendor management chaos: Many legal technology providers rely on CVE identifiers to communicate security patches. Without them, law firms would face confusion and delays in applying critical updates.

Lessons Learned: What Lawyers Should Do Next 🛡️

The CVE funding scare revealed that even the most established cybersecurity programs can be vulnerable. For the legal profession, this is a clear signal to take proactive steps:

Lawyers have a duty to protect their clients’ PII from cyberattacks!

• Diversify threat intelligence sources: Don’t rely solely on the CVE program. Lawyers and IT teams should monitor additional resources such as the National Vulnerability Database (NVD), CISA Alerts & Advisories, and vendor-specific feeds.

• Review and update incident response plans: Ensure your breach response protocols account for the possibility of disruptions in vulnerability intelligence. Document your reliance on CVE and alternative sources for compliance purposes.

• Strengthen vendor contracts: Require legal technology providers to maintain robust vulnerability management practices, even if the CVE system is disrupted.

• Stay engaged and advocate: Support efforts to make the CVE program sustainable and independent. The legal community should join calls for diverse funding and governance to avoid future crises.

• Educate staff and clients: Communicate the importance of cybersecurity vigilance and the evolving landscape. Make sure everyone understands their role in protecting client data.

Final Thoughts: A Fragile Peace and a Call for Vigilance 🔍

The CVE program’s last-minute rescue is a relief, but not a resolution. The legal sector must recognize that the stability of our cybersecurity infrastructure is not guaranteed. With only 11 months of assured funding, the risk of another crisis looms. The new CVE Foundation may provide a path forward, but it will require broad support from both public and private sectors.

Lawyers must remain vigilant, proactive, and informed. The next funding scare could come with less warning—and with even higher stakes for client confidentiality, professional responsibility, and the very trust that underpins the legal profession.

MTC

🚨 BOLO: Apple's Latest Update Activates AI - Lawyers, Protect Your Clients' Data! 🚨

Attention tech-savvy lawyers! 📱💼 Apple's recent iOS and macOS updates have automatically enabled Apple Intelligence, raising significant concerns about client confidentiality and data privacy. As legal professionals, we must remain vigilant in protecting our clients' sensitive information. Here's what you need to know:

The Stealth Activation 🕵️‍♂️

In the last 24 hours, Apple released iOS 18.3, iPadOS 18.3, and macOS Sequoia 15.3, which automatically activate Apple Intelligence on compatible devices. This AI-powered suite offers various features, including rewriting text, generating images, and summarizing emails. While these capabilities may seem enticing, they pose potential risks to client confidentiality. 🚨

Privacy Concerns 🔒

Apple claims that Apple Intelligence uses on-device processing to enhance privacy. However, the system still requires 7GB of local storage and may analyze user interactions to refine its functionality. This level of data access and analysis raises red flags for lawyers bound by ethical obligations to protect client information.

Ethical Obligations ⚖️

Check your apple setting if you want to turn off “Apple Intelligence”!

The ABA Model Rules of Professional Conduct, particularly Rule 1.6, emphasize the duty of confidentiality. This rule extends to all forms of client data, including information stored on devices or accessed remotely. As tech-savvy lawyers, we must exercise reasonable care to prevent unauthorized disclosure of client information.

Potential Risks 🚫

Using AI-powered features without fully understanding their implications could lead to inadvertent breaches of client confidentiality. As we've discussed in our previous blog post, "My Two Cents: With AI Creeping Into Our Computers, Tablets, and Smartphones, Lawyers Need to Be Diligent About The Software They Use," lawyers must be cautious about adopting new technologies without proper vetting.

Lawyers MUST maintain reasonable competency in the use of technology! 🚨 ABA MRPC 1.1 [8] 🚨

Lawyers MUST maintain reasonable competency in the use of technology! 🚨 ABA MRPC 1.1 [8] 🚨

Steps to Take 🛡️

1. Disable Apple Intelligence: Navigate to Settings > Apple Intelligence & Siri to turn off specific features or disable the entire suite.

2. Educate Your Team: Ensure all staff members are aware of the potential risks associated with AI-powered features.

3. Review Privacy Policies: Carefully examine Apple's privacy policies and terms of service related to Apple Intelligence.

4. Implement Additional Safeguards: Consider using encrypted communication tools and secure cloud storage solutions for client data.

Final Thoughts 🧐

As we navigate this rapidly evolving technological landscape, it's essential to balance innovation with ethical obligations. Lawyers can thrive as tech-savvy professionals by embracing technology to enhance their practice while safeguarding client trust. Remember, maintaining reasonable competency in the use of technology is not just advisable—it’s an ethical duty. See Comment, #8, to ABA Model Rule, #1.1.

Subscribe to The Tech-Savvy Lawyer.Page for updates on this developing situation, news on the evolving impact of AI on the practice of law. Together, we can navigate the complexities of legal technology while upholding our professional responsibilities.

Stay safe, stay informed, and stay tech-savvy! 🚀📚💻

Happy Lawyering!