📰 How to Ensure a Public Wi-Fi Network Is Legitimate (and Why Legal Professionals Must Always Use a VPN)!

Working remotely has become essential for legal professionals; however, public Wi-Fi networks pose significant security risks that can compromise client confidentiality and violate ethical obligations. Before connecting to any public network, lawyers must take specific steps to verify legitimacy and protect sensitive information.

Verify the Network Name with Staff

The first step in ensuring Wi-Fi legitimacy is confirmation. Ask an employee at the establishment for the exact network name and spelling. Cybercriminals frequently create "evil twin" networks with names nearly identical to legitimate ones, such as "LAX Free Public WiFi" instead of the official "_LAX Free WiFi". These spoofed networks are designed to capture your data the moment you connect.

Recognize Red Flags in Network Names

Be suspicious of generic network names like "Free WiFi," "Public Network," or "Guest WiFi”. Legitimate businesses typically use branded network names. Additionally, watch for small variations in spelling, extra spaces, underscores, or additional characters in familiar network names. These subtle differences often indicate malicious networks designed to deceive users.

Check for Proper Security Protocols

Once connected to a verified network, ensure websites load with HTTPS encryption. Look for the lock icon in your browser's address bar and confirm URLs begin with "https://" rather than "http://". If legitimate websites suddenly appear as HTTP instead of HTTPS, disconnect immediately, as this may indicate a man-in-the-middle attack.

Disable Automatic Connections

Turn off automatic Wi-Fi connections on all devices. This prevents your device from automatically connecting to potentially malicious networks with names similar to previously trusted ones. Always manually select the verified network name and choose "Public" when your device prompts you to select a network type.

Essential VPN Usage for Legal Professionals

Legal professionals must always use a VPN when connecting to public Wi-Fi. This is not merely a recommendation but an ethical necessity. The American Bar Association Model Rules of Professional Conduct require lawyers to make reasonable efforts to protect client information from unauthorized disclosure. Using public Wi-Fi without VPN protection violates this duty of confidentiality.

A VPN encrypts all internet traffic, making it unreadable to potential eavesdroppers even on compromised networks. This encryption is crucial for maintaining attorney-client privilege and protecting sensitive case information during remote work.

Additional Security Measures

Enable two-factor authentication on all important accounts before traveling. Turn on your device's firewall and disable file sharing when using public networks. Keep your operating system and browser updated to patch security vulnerabilities. Never conduct sensitive activities like online banking (like accessing your Trust Account) or accessing confidential case management systems without VPN protection.

Ethical Obligations and Professional Competence

The duty of competence under professional conduct rules requires lawyers to understand relevant technology risks. Working from public locations without proper security measures can result in data breaches that damage client relationships and potentially violate professional ethics rules. Law firms must establish policies to ensure that all staff understand these requirements when working remotely. Editor’s note: I realize that as I’m delving into this subtopic, I could write a whole separate blog post on this - so stay tuned!

Emergency Alternatives

When in doubt about Wi-Fi legitimacy, use your mobile device's cellular hotspot instead of connecting to questionable public networks. This provides a more secure connection for accessing sensitive information. Many legal professionals keep backup mobile data plans specifically for situations where public Wi-Fi security cannot be verified. (You may find your mobile hotspot to be more, secure, reliable and even faster than public wifi networks [even your hotel’s wifi]. You may want to consider having devices on two different networks in case one network is having issues.)

Remember: Client confidentiality is paramount in legal practice. Taking these verification steps and always using VPN protection ensures you meet your ethical obligations while maintaining the flexibility to work from any location securely.

🚨 BOLO CYBERSECURITY ALERT: LunaSpy Android Spyware Threatens All Users—Protect Your Law Practice Now!

Android users must be aware of potential threats to their data!

CRITICAL THREAT ALERT 🚨 A sophisticated new Android spyware campaign dubbed LunaSpy has been active since February 2025, broadly targeting Android users via messaging apps—anyone installing its fake “antivirus” could be compromised, including legal professionals. LunaSpy spreads through Telegram, WhatsApp, Signal, and other platforms by sending messages like “Hi, install this program here,” tricking victims into granting extensive device permissions after fake security scans report fabricated threats.

Once installed, LunaSpy’s capabilities pose severe risks: it steals passwords from browsers and messaging apps, intercepts text messages (including two-factor codes), records audio and video via microphones and cameras, captures screen contents (e.g., client documents, case notes), and tracks real-time location (e.g., revealing meetings and court visits). Kaspersky researchers have linked over 150 command-and-control servers to LunaSpy’s global network, enabling continuous data exfiltration and remote command execution.

While any Android user is at risk, lawyers face heightened consequences if infected. A breach of attorney-client communications or privileged documents can trigger:

• Malpractice liability for failing to safeguard confidential client information

• ABA ethics violations under Model Rules 1.1 (Competence), 1.1(8) (Maintaining Competence) and 1.6 (Confidentiality)

• State bar disciplinary action for professional misconduct

• Regulatory compliance fines under privacy laws like California Consumer Privacy Act (CCPA)/General Data Protection Regulation (GDPR) – Legal Text

• Reputational damage that can permanently erode client trust

Immediate Action Steps for all Android-using legal professionals and their staff:

users are the first line of defense when it comes to preventing computer viruses on their tech!

1. Audit and remove any unverified security or banking apps; restrict installations to Google Play only.

2. Deploy Mobile Device Management (MDM): enforce app blacklists, remote wipe, and automated patching.

3. Enable full-disk encryption and secure lock screens with complex passcodes or biometrics.

4. Train staff on social engineering tactics—recognize unsolicited install prompts or links in messages.

5. Use end-to-end encrypted desktop-based messaging for privileged communications, limiting mobile use.

6. Establish an incident response plan: include immediate device quarantine, forensic analysis, and regulatory notification procedures.

LunaSpy is not a hypothetical risk—it’s actively compromising Android devices around the globe. Although the campaign targets the general public, legal professionals handling sensitive client data are particularly vulnerable to cascading professional, legal, and ethical consequences if infected. With over 150 active command servers and ongoing code enhancements, the threat will only escalate. Every day without these safeguards increases your exposure—act now to secure mobile devices, train teams, and reinforce your firm’s cybersecurity posture.

MTC: AI Governance Crisis - What Every Law Firm Must Learn from 1Password's Eye-Opening Security Research

The legal profession stands at a crossroads. Recent research commissioned by 1Password reveals four critical security challenges that should serve as a wake-up call for every law firm embracing artificial intelligence. With 79% of legal professionals now using AI tools in some capacity while only 10% of law firms have formal AI governance policies, the disconnect between adoption and oversight has created unprecedented vulnerabilities that could compromise client confidentiality and professional liability.

The Invisible AI Problem in Law Firms

The 1Password study's most alarming finding mirrors what law firms are experiencing daily: only 21% of security leaders have full visibility into AI tools used in their organizations. This visibility gap is particularly dangerous for law firms, where attorneys and staff may be uploading sensitive client information to unauthorized AI platforms without proper oversight.

Dave Lewis, Global Advisory CISO at 1Password, captured the essence of this challenge perfectly: "We have closed the door to AI tools and projects, but they keep coming through the window!" This sentiment resonates strongly with legal technology experts who observe attorneys gravitating toward consumer AI tools like ChatGPT for legal research and document drafting, often without understanding the data security implications.

The parallel to law firm experiences is striking. Recent Stanford HAI research revealed that even professional legal AI tools produce concerning hallucination rates—Westlaw AI-Assisted Research showed a 34% error rate, while Lexis+ AI exceeded 17%. (Remember my editorial/bolo MTC/🚨BOLO🚨: Lexis+ AI™️ Falls Short for Legal Research!) These aren't consumer chatbots but professional tools marketed to law firms as reliable research platforms.

Four Critical Lessons for Legal Professionals

First, establish comprehensive visibility protocols. The 1Password research shows that 54% of security leaders admit their AI governance enforcement is weak, with 32% believing up to half of employees continue using unauthorized AI applications. Law firms must implement SaaS governance tools to identify AI usage across their organization and document how employees are actually using AI in their workflows.

Second, recognize that good intentions create dangerous exposures. The study found that 63% of security leaders believe the biggest internal threat is employees unknowingly giving AI access to sensitive data. For law firms handling privileged attorney-client communications, this risk is exponentially greater. Staff may innocently paste confidential case details into AI tools, potentially violating client confidentiality rules and creating malpractice liability.

Third, address the unmanaged AI crisis immediately. More than half of security leaders estimate that 26-50% of their AI tools and agents are unmanaged. In legal practice, this could mean AI agents are interacting with case management systems, client databases, or billing platforms without proper access controls or audit trails—a compliance nightmare waiting to happen.

Fourth, understand that traditional security models are inadequate. The research emphasizes that conventional identity and access management systems weren't designed for AI agents. Law firms must evolve their access governance strategies to include AI tools and create clear guidelines for how these systems should be provisioned, tracked, and audited.

Beyond Compliance: Strategic Imperatives

The American Bar Association's Formal Opinion 512 established clear ethical frameworks for AI use, but compliance requires more than policy documents. Law firms need proactive strategies that enable AI benefits while protecting client interests.

Effective AI governance starts with education. Most legal professionals aren't thinking about AI security risks in these terms. Firms should conduct workshops and tabletop exercises to walk through potential scenarios and develop incident response protocols before problems arise.

The path forward doesn't require abandoning AI innovation. Instead, it demands extending trust-based security frameworks to cover both human and machine identities. Law firms must implement guardrails that protect confidential information without slowing productivity—user-friendly systems that attorneys will actually follow.

Final Thoughts: The Competitive Advantage of Responsible AI Adoption

Firms that proactively address these challenges will gain significant competitive advantages. Clients increasingly expect their legal counsel to use technology responsibly while maintaining the highest security standards. Demonstrating comprehensive AI governance builds trust and differentiates firms in a crowded marketplace.

The research makes clear that security leaders are aware of AI risks but under-equipped to address them. For law firms, this awareness gap represents both a challenge and an opportunity. Practices that invest in proper AI governance now will be positioned to leverage these powerful tools confidently while their competitors struggle with ad hoc approaches.

The legal profession's relationship with AI has fundamentally shifted from experimental adoption to enterprise-wide transformation. The 1Password research provides a roadmap for navigating this transition securely. Law firms that heed these lessons will thrive in the AI-augmented future of legal practice.

MTC