MTC: When Your Staff Leaves, Does Their Access Leave Too? 🔐 A SaaS Access Governance Checklist for Lawyers and Law Firms ⚖️

Law firms should Approve access deliberately and revoke risky permissions to protect client confidentiality.

Every law firm has a departure story. A paralegal moves on. A contract attorney finishes a document review. An associate shifts from litigation to transactional work. 👋 The farewell lunch happens. The laptop comes back. The email account gets shut off. Most firms call that "offboarding" and move on.

A recent 1Password* article, "SaaS access governance: Does access end when employees leave?," explains why that confidence is often misplaced. The piece is written for corporate IT teams. Its lessons apply with even greater force to lawyers. Our clients' confidential information lives in dozens of cloud tools, and our ethics rules do not accept "we thought IT handled it" as a defense.

The Problem: Access Outlives the Role 🚪

lawyers should Close the door on lingering SaaS access to protect every law-firm client.

The 1Password article makes a simple point. Disabling a person's main account does not remove every path back to your data. Many firms use a central login, often called single sign-on (SSO). Not every application connects to it. A former employee may still hold a working account in your e-signature platform, your file-sharing service, your project tracker, or an AI tool someone signed up for on a free trial.

Then there are the less visible doors. Shared credentials, personal accounts used for work, and OAuth connections can all survive a departure. OAuth is the "Sign in with Google" or "Allow this app to access your files" permission we click without much thought. Those permissions can persist until someone actively revokes them. 🔑

The article cites 1Password's 2025 Access-Trust Gap Report, which found that 38% of employees have successfully accessed a former employer's account. Read that number again. If it holds anywhere near true for law firms, client files may be one forgotten login away from exposure. 😬

Role changes create a quieter version of the same risk. The associate who moves practice groups keeps permissions from the old one. The contract lawyer keeps access to the shared workspace long after the engagement ends. Nobody acted improperly. Nobody looked at the full picture, either.

Why This Is an Ethics Issue, Not Just an IT Issue ⚖️

Track SaaS access activity to support law-firm audits and client-data protection.

The ABA Model Rules turn this operational gap into a professional responsibility question.

Rule 1.1 (Competence) and its Comment 8 require lawyers to keep abreast of the benefits and risks of relevant technology. Understanding who can reach your client data is part of that duty. 🧠

Rule 1.6(c) (Confidentiality) requires reasonable efforts to prevent unauthorized access to, or disclosure of, client information. A former staff member's live account in your document platform is precisely the kind of unauthorized access the rule contemplates. ABA Formal Opinion 477R reinforces that lawyers must understand how client information is transmitted and stored and must apply reasonable safeguards.

Rules 5.1 and 5.3 (Supervision) require firm managers to have measures in place that give reasonable assurance that lawyers and nonlawyers comply with professional obligations. An offboarding process that relies on memory is not a "measure." It is a hope. 📋

These supervisory duties now extend to AI tools. I discussed this in "My Two Cents: Lessons from ABA's Formal Opinion 512 - A Follow-Up!." If a staff member connected an AI application to your matter files, you need to know it exists. You also need to know when that connection ends.

The Five-Step Checklist, Translated for Law Firms ✅

The 1Password article offers five best practices. Here is how each one translates to a solo or small-to-midsize practice.

law firms should have A clear offboarding workflow to revoke SaaS access and protect law-firm clients.

1. Discover what your people actually use. 🔍 Build a simple inventory. List every application, shared login, and connected integration your firm relies on. Include tools adopted without formal approval. Ask your team directly. You will likely be surprised.

2. Tie access to lifecycle events. 🔄 Hiring, role changes, contract end dates, and departures should each trigger a written checklist. Assign an owner to every step. In a small firm, that owner may be you. Write it down anyway.

3. Apply least privilege when roles change. 🎯 Access should reflect current duties, not history. When someone moves from one practice area to another, remove the old permissions. I covered this principle in "📖 WORD OF THE WEEK (WoW): Zero Trust Architecture ⚖️🔐." The motto still applies: never trust, always verify.

4. Govern new SaaS and AI tools. 🤖 Create a clear way for staff to request new tools. Review what data each tool can reach before approving it. Assign an owner to every approved application. The 1Password article makes a point I strongly endorse: AI tools belong inside your broader software governance, not in a separate silo.

5. Verify removal and keep proof. 🧾 Offboarding is complete only when you can show access is gone from every relevant system. That means outside-SSO apps, OAuth connections, shared passwords, file ownership, and paid seats. Keep a short record of who closed each item and when. Use a second reviewer for departures involving privileged access. Then test the process periodically before a real departure tests it for you.

Practical Steps You Can Take This Week 🛠️

SaaS access governance helps law firms securely offboard users and protect client confidentiality.

You do not need an enterprise platform to start. A password manager with shared vaults lets you rotate credentials quickly when someone leaves. Most cloud platforms, including Microsoft 365 and Google Workspace, let administrators review and revoke third-party app connections. A one-page offboarding checklist, saved in your firm's policy folder, is a meaningful first step.

Larger firms may benefit from dedicated tools. 1Password promotes its SaaS Manager for discovery, automated provisioning, and OAuth revocation. As with any vendor, evaluate it under Rule 5.3 and your own risk profile. My earlier post, "My Two Cents: Essential Security and Privacy Reminder for Lawyers Using Cloud Software," offers a foundation for that review. 💡

My Two Cents 💭

MTC
* Product used by this blogger! This is not an endorsement per se, nor is this a guarantee of any kind. You still have an independent duty to review software before implementing it into your practice.

🚨 BREAKING NEWS! Microsoft Outlook Outage: What Lawyers Need to Do When Microsoft 365 Email Fails ⚠️

lawyers are you prepared if your e-mail server goes down?!

The Microsoft Outlook and Exchange Online outage reported on August 31 is a timely warning for every law practice that relies on Microsoft 365 for email, calendars, document access, and client communication. This was not simply an inconvenience. For lawyers, a cloud-service disruption can become a deadline, confidentiality, supervision, and client-service problem within hours. ⚖️

Thousands of users reported Outlook problems beginning shortly before noon Eastern Time on August 31. Reports peaked at nearly 6,000 shortly after 12:24 p.m. ET. The most common complaint involved receiving email. Users also reported login and app-access problems. Microsoft initially confirmed degraded functionality in Exchange Online, its cloud-hosted email platform.

The situation later appeared broader than Outlook alone. Reporting on Microsoft’s service updates indicated that the incident affected Exchange Online and could affect Microsoft 365 services including OneDrive for Business, SharePoint Online, Teams, Purview, and Defender XDR. Microsoft attributed the incident to a core authentication-configuration issue. By early September 1, mailbox connectivity had reportedly been restored, although Microsoft was still addressing search functionality and the clearing of backlogged mail queues.

For a law firm, that combination matters. An outage can interrupt email. A related Microsoft 365 disruption can also interfere with matter files, calendar access, Teams meetings, e-discovery workflows, secure sharing, retention tools, and even the ability to authenticate into the firm’s normal systems.

The lesson is not that lawyers should abandon cloud technology. Microsoft 365 remains an important platform for many legal organizations. The lesson is that every firm needs a practical, tested continuity plan for the days when a trusted vendor’s systems are unavailable. 🔐

Why This Is a Legal-Practice Issue

Lawyers often treat email as an everyday administrative tool. Clients do not. To a client, email is often the firm’s front door, the place where urgent instructions arrive, and the record of whether counsel responded when it mattered.

When Outlook or Exchange Online stops working, several risks arise at once:

• A client may send time-sensitive instructions that do not reach the firm promptly.

• Opposing counsel may serve a filing, discovery response, settlement demand, or meet-and-confer request by email.

• A court may issue a notice, hearing link, electronic filing notice, or order through a system that the lawyer normally monitors through Outlook.

• Firm staff may be unable to locate calendar invitations or Teams links for hearings, mediations, depositions, and client meetings.

• Messages sent during the outage may be delayed. They may arrive later in a batch, which can create confusion about when the message was actually sent or received.

• Lawyers may resort to personal email, text messages, or improvised file-sharing tools without considering confidentiality, security, and retention obligations.

That is why a service outage is not merely an IT ticket. It is a business-continuity event. A solo lawyer can face the same core risk as a large firm, although a solo lawyer may have fewer people available to spot the problem and activate a fallback process.

The ABA Model Rules provide the framework. ABA Model Rule 1.1 requires competent representation. Comment 8 explains that competence includes keeping abreast of the benefits and risks associated with relevant technology. A lawyer who depends on cloud email does not need to become a Microsoft systems engineer. The lawyer does need to understand the operational risks of that dependency and make reasonable preparations for an outage.

That obligation is especially practical in 2026. Technology competence includes knowing where the firm will look for alerts, who decides that an outage is material, how the firm will communicate with clients, and how the firm will protect confidential information when normal workflows fail.

🚨The Ethics During an Outage ⚖️

lawyers need a firm-wide policy whnen their e-mail server goes down.

An outage does not suspend professional duties. It changes the way a lawyer must satisfy them.

Competence: ABA Model Rule 1.1

Model Rule 1.1 calls for the legal knowledge, skill, thoroughness, and preparation reasonably necessary for the representation. Comment 8 adds the technology dimension. A firm should have a basic plan for interrupted email and cloud access. That is preparation, not overengineering.

A reasonable plan may include:

• A designated person to monitor the Microsoft 365 Service Health Dashboard and vendor-status notices.

• A current list of urgent matters, upcoming deadlines, hearings, and client contacts.

• An alternative communication channel approved by the firm.

• Instructions for capturing and documenting communications received through a fallback channel.

• A process for reconciling delayed or queued email after service is restored.

• A clear escalation path for lawyers and staff when an outage affects a deadline-sensitive matter.

The plan should match the firm’s size, practice areas, client base, and risk profile. A litigation practice with frequent electronic filing deadlines has different needs from a transactional practice, although neither can assume that email will always work.

Confidentiality: ABA Model Rule 1.6

Model Rule 1.6 requires lawyers to "make reasonable efforts" to protect information relating to client representation. Paragraph (c) specifically requires reasonable efforts to prevent inadvertent or unauthorized disclosure of, or unauthorized access to, that information.

That duty is particularly important when normal systems are down. An Outlook outage creates pressure. Pressure can lead someone to forward client documents to a personal Gmail account, upload a file to an unsanctioned consumer platform, or conduct substantive client business by unprotected text message.

Those choices may create more risk than the outage itself.

The better approach is to decide now which alternatives the firm permits. For example, the firm might maintain an approved secondary secure email platform, a secure client portal, or an encrypted communication tool. It should also decide how those communications will be preserved in the client file once Microsoft 365 services return.

Do not let individual lawyers invent their own workaround in the middle of a disruption. That is not a criticism of ingenuity. It is a recognition that confidentiality, security, and recordkeeping require a coordinated response. 🔒

Diligence and Communication: ABA Model Rules 1.3 and 1.4

Model Rule 1.3 requires diligence. Model Rule 1.4 requires reasonable communication with clients. An outage can affect both.

If a client’s matter has a filing deadline, hearing, closing, or urgent negotiation, the firm should actively determine whether a disruption is affecting communications or access to essential documents. A lawyer should not assume that the absence of incoming email means that no message has been sent.

Likewise, if an outage materially affects the firm’s ability to receive or send client communications, a short client notice can be appropriate:

“We are experiencing a temporary interruption affecting our primary email service. If your matter is urgent or deadline-sensitive, please contact our office by telephone at [number] or use our secure client portal at [link]. We will respond as soon as possible.”

— Potential Message for Your Law Firm When E-mail is Down...

That message is concise, useful, and professional. It informs the client without disclosing unnecessary details about the firm’s systems or creating undue alarm.

Supervision: ABA Model Rules 5.1 and 5.3

Partners and lawyers with managerial authority must make reasonable efforts to ensure that the firm has measures giving reasonable assurance that all lawyers conform to professional obligations. Lawyers who supervise nonlawyer staff have a related duty. An email-outage protocol is one of those measures.  See generally Rules 5.1 and 5.3.

Staff members need to know:

• Which matters require immediate escalation.

• Which phone numbers, portals, or backup channels are authorized.

• Whether they may use personal devices or personal accounts for firm communications.

• How to record calls, messages, and documents received outside normal systems.

• Who is authorized to communicate externally about the incident.

A simple one-page playbook can prevent a great deal of uncertainty. 📋

What To Do Today

don’t be caught unprepared if your e-mail server goes down!

The August 31 Microsoft 365 incident should prompt a short, focused review. You do not need a 75-page disaster-recovery manual before taking useful action.

1. Confirm the Scope Before You Improvise

When Outlook appears to fail, first determine whether the problem is local or broader:

• Check Microsoft 365 Service Health through the Microsoft 365 admin center.

• Check whether Outlook on the web works if the desktop application does not.

• Test access from a different network or device.

• Confirm whether the problem is limited to one user, one office, the firm’s domain, or a larger Microsoft service event.

• Check reputable outage reporting only as a supplemental source. Crowdsourced reports can signal a problem, but they do not replace the vendor’s tenant-specific status information.

During the August 31 disruption, Microsoft identified effects that included email delays or failures, mailbox-search issues, authentication errors, and trouble with Exchange administration and mailbox operations.

That distinction matters. A lawyer may be able to open Outlook but still experience delayed mail flow or incomplete search results. “It seems to be working again” is not the same as “all messages and matter records are available and current.”

2. Protect Deadlines First

Create a brief list of matters with time-sensitive events in the next 24 to 72 hours:

• Court filing deadlines.

• Administrative filing deadlines.

• Statutes of limitation or notice deadlines.

• Depositions, mediations, arbitrations, and hearings.

• Closings and settlement deadlines.

• Client commitments requiring same-day action.

Then verify communications through an approved backup method. If electronic filing is involved, review the court’s rules, emergency procedures, and clerk’s office notices. A Microsoft outage does not automatically extend a filing deadline. The relevant court rule, filing system status, and the particular judge’s procedures control.

Document what happened. Note the date, time, service involved, affected matter, communications attempted, and action taken. That contemporaneous record can be essential if a deadline issue later needs explanation.

3. Use Approved Backup Channels

A good backup channel is secure, accessible, documented, and familiar to the client and the firm. It might include:

• A secure client portal.

• A firm-approved encrypted email solution.

• The firm’s phone system and a documented telephone-call protocol.

• A secure collaboration system that remains available.

• A secondary, firm-controlled domain or mailbox that has been vetted in advance.

The right answer is not necessarily “use text messages.” Texting may be useful for a limited logistical notice, such as asking a client to call the office. It may be unsuitable for substantive communications or transmission of client documents unless the firm has assessed the platform, the client’s consent, security controls, retention, and applicable state ethics guidance.

4. Reconcile Email After Recovery

Once Microsoft reports recovery, do not assume the episode is over. Microsoft warned that mail queues might take time to clear and that search could remain affected.

The firm should:

• Review incoming and outgoing email around the outage window.

• Confirm receipt of all time-sensitive communications.

• Check Sent Items, drafts, outbox folders, and message-tracking tools where available.

• Re-run critical mailbox searches when search functionality is confirmed restored.

• Ask clients or opposing counsel to resend urgent communications if delivery status remains uncertain.

• Save an internal incident note for affected matters.

This is particularly important for e-filing notices, service emails, and client instructions. A delayed message can cause a lawyer to act on incomplete information.

5. Preserve the Lesson

After the immediate problem ends, conduct a short post-incident review. Keep it practical:

• What did not work?

• Which staff members knew how to respond?

• Were clients able to reach the firm?

• Did the firm have access to critical contact information?

• Did anyone use an unapproved tool because no approved alternative was clear?

• How long would the firm have remained operational if the outage had lasted another day?

The goal is not to assign blame. The goal is to reduce the risk of disruption next time. 💡

AI Tools Need Continuity Too

lawyers, meet your ethical compliance, be prepared for the unexpected, and come out the superstar to your clients!

The August 31 event also included reported disruption to ChatGPT. USA TODAY reported that ChatGPT functionality was restored while Outlook issues remained ongoing. For AI-curious lawyers, that overlap underscores a broader point: no cloud-based tool should become a single point of failure in a legal workflow.

Generative AI can assist with drafting, issue-spotting, summarization, and internal knowledge work. It should not be the only route to a critical work product. Keep source documents accessible. Preserve the lawyer’s independent judgment. Maintain a non-AI process for urgent drafting and legal research.

That approach aligns with the central lesson from our profession’s ongoing technology-competence discussion: the appropriate question is not whether a tool is innovative. The better question is whether the firm understands its benefits, limitations, confidentiality implications, and continuity risks. Rule 1.1 Comment 8 expressly frames technological competence in terms of both benefits and risks.

A practical rule of thumb: if the platform is unavailable for four hours, can your firm still identify the deadline, reach the client, access the critical document, and make a defensible decision? If the answer is no, that workflow needs attention.

The Bottom Line

Microsoft’s Outlook and Microsoft 365 disruption is a useful reminder that professional responsibility does not depend on whether a vendor’s status page is green. Lawyers need reliable systems, but they also need workable alternatives when reliable systems fail.

The best response is not panic. It is preparation. Maintain approved backup channels. Train staff. Protect confidential information. Monitor time-sensitive matters. Reconcile communications after recovery. Document what occurred.

For solo and small-firm lawyers, this can be accomplished without enterprise-level complexity. A current contact list, a secure fallback channel, a deadline triage checklist, and a 15-minute staff drill can materially improve the firm’s ability to serve clients when technology takes an unexpected day off. 📧⚖️

TSL.P EP# 132 (Special Episode): AI, Deepfakes, and Metadata: Guest-Hosting Capital University Law School’s First Law Library Podcast Club with Professor Jennifer Wondracek 🎙️⚖️

🎙️ This week, we have something special for you. Your The Tech-Savvy Lawyer.Page blogger and podcaster, Michael D.J. Eisenberg, was invited back to his alma mater, Capital University Law School, to guest host their very first Podcast Club — a live, recorded podcast conversation featuring real law students, real questions, and real talk. Moderated alongside Professor Wondracek, this is an unscripted, in-the-moment discussion — not a produced studio episode, not a rehearsed explainer — just an honest, practitioner-led conversation about the issues shaping the legal profession today. 🎓 We think that's exactly what makes it worth your time. 🛡️⚖️

In our conversation, we cover the following:

• [00:00] 🎬 Welcome & Introductions — Professor Raik introduces Michael D.J. Eisenberg; Michael shares his background representing veterans before the VA and his work at The Tech-Savvy Lawyer.Page, including his Amazon #1 bestselling book The Lawyer's Guide to Podcasting

• [01:00] 🕵️ What Is a Deepfake? — Defining deepfakes and the real-world Bethesda incident where a fabricated video triggered a police raid and wasted critical law enforcement resources

• [02:30] ⚖️ Deepfakes in Legal Practice — The serious professional responsibility consequences when attorneys introduce fake or AI-generated evidence into a trial or negotiation — and why "I didn't know" won't always protect you

• [03:00] 📋 ABA Model Rule 1.1 — Competence & Comment 8 — Why technology competence is an ethical obligation, not optional — and what "competent use of technology" actually means for your daily practice

• [05:00] 📶 Public Wi-Fi & VPN Security — The real dangers of using public Wi-Fi at airports, coffee shops, and on planes without a VPN, especially when accessing client portals, trust accounts, or confidential client communications

• [05:45] 🔐 VPN Recommendations — NordVPN vs. ExpressVPN; why the right VPN matters for protecting your clients and your license

• [07:00] 🔍 How to Detect Deepfakes in Evidence — Reviewing file metadata, spotting visual anomalies, and the Mendones v. Cushman & Wakefield case (Cal. Super. Ct. 2025) where Judge Victoria Kolakowski spotted deepfake videos — and imposed terminating sanctions

• [08:30] 📜 ABA Model Rule 3.3 — Candor to the Tribunal — Your duty of honesty to the court and the compounding risks of unknowingly submitting falsified AI-generated evidence

• [09:30] 🧑‍⚖️ ABA Model Rule 8.4 — Dishonesty, Fraud, Deceit & Misrepresentation — How these rules can stack with Rule 3.3 to multiply your ethical exposure

• [10:30] 🖼️ Live Demo: Accessing File Metadata — A real-time screen share showing how to right-click and access image properties, including GPS coordinates, camera settings, file timestamps, and modification history — using a photo taken right at Capital University Law School

• [14:00] 🗂️ Metadata Scrubbing — Why some law firms strip metadata from outgoing emails and documents, and why "scrubbed" evidence should raise red flags during discovery

• [17:30] 🛡️ Five Basic Safeguards for Legal Professionals in the AI Era:

• Invest in ongoing education — CLEs, podcasts, blogs

• Know and follow your office's technology protocols

• Be transparent with clients about your use of AI — in your engagement letters and contracts

• Update your engagement letters and retainer agreements now

• Stay alert to the rapidly changing AI landscape — ignoring it is not an option

• [20:00] 💬 Student Q&A — George's question: Does the ethical obligation to review metadata create a resource gap between large firms and solo practitioners? What AI tools can help level the playing field?

• [22:00] ⚠️ United States v. Heppner (S.D.N.Y. 2026) — The landmark federal ruling that AI-generated documents used with consumer AI tools are NOT protected by attorney-client privilege or work product doctrine — and why your choice of AI platform is now an ethics decision

• [23:30] 🔒 Consumer AI vs. Secure Legal AI Platforms — The critical difference between free and low-cost consumer AI accounts and enterprise-grade legal AI tools with zero-data-retention contracts

• [25:30] 📚 LexisNexis Protégé & Secure AI — How LexisNexis's zero-retention, end-to-end encrypted AI platform — including access to ChatGPT and Claude — lets attorneys use AI ethically without jeopardizing client data

• [27:00] 💾 Prompt Discoverability — Why your AI prompts may be subpoenaed in malpractice claims or bar investigations, and why documenting and downloading your AI usage history matters

• [28:30] 📁 Cassia's Question — Documenting AI research and adopting a random sampling strategy for metadata review: practical approaches to demonstrating "reasonable" due diligence

• [30:00] 🗃️ eDiscovery Tools for Metadata at Scale — Relativity, Disco, and how these platforms help even resource-limited firms surface metadata anomalies across large document sets

• [33:00] 📰 Current Awareness Resources — Where to stay current on legal tech: law.com, bar association newsletters, The Tech-Savvy Lawyer.Page blog and podcast, CLEs, and legal listservs

• [33:30] 🚨 Hallucinated AI Citations & Real Consequences — Mata v. Avianca, Wadsworth v. Walmart (Morgan & Morgan pro hac vice revoked), the Chicago firm dissolution case — and why citation-checking is now a non-negotiable litigation skill

• [37:00] 🎲 Book Giveaway — Rolling the virtual dice; congratulations to the winner of Michael's book, The Lawyer's Guide to Podcasting!

• [38:00] 🗓️ Upcoming Events — Michael joins the Capital Law Spring Summit/Bootcamp in April; dinner with students at The Red Door Tavern

Resources

Connect with Professor Jennifer Wondracek:

• E-Mail: jwondracek@law.capital.edu 

• LinkedIn: https://www.linkedin.com/in/jennifer-wondracek

📌 Mentioned in the Episode

🏛️ ABA Model Rules

• ABA Model Rule 1.1 (Competence), Comment 8 (Technology Competence): https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_1_competence/

• ABA Model Rule 3.3 — Candor to the Tribunal: https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_3_3_candor_toward_the_tribunal/

• ABA Model Rule 8.4 — Misconduct (Dishonesty, Fraud, Deceit, Misrepresentation): https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_8_4_misconduct/

⚖️ Case Law

• Mata v. Avianca, Inc. — The landmark hallucinated AI citation case (S.D.N.Y. 2023): https://www.courtlistener.com/docket/17271435/mata-v-avianca-inc/

• Mendones v. Cushman & Wakefield, Inc., No. 23CV028772 (Cal. Super. Ct. Alameda Cnty., Sept. 9, 2025) — Deepfake terminating sanctions: https://ediscoverytoday.com/2025/09/25/deepfake-videos-and-images-lead-to-terminating-sanctions-ediscovery-case-law/

• United States v. Heppner, 25-cr-00503-JSR (S.D.N.Y. Feb. 10, 2026) — AI documents not protected by privilege: https://www.insideprivacy.com/artificial-intelligence/ai-and-legal-privilege-key-takeaways-from-us-v-heppner/

• Wadsworth v. Walmart — Morgan & Morgan pro hac vice revocation over AI citations: (search Westlaw/Lexis for current citation)

🤔 Other

• 🎓 Capital University Law School — Law Library Podcast Club: https://law-capital.libguides.com/c.php?g=1168974&p=11364939

• 📰 Law.com — Legal news and current awareness: https://www.law.com

• 🏛️ Ohio State Bar Association — Ethics Hotline: https://www.ohiobar.org

💻 Hardware Mentioned in the Conversation

• 📱 Google Pixel 3 (used to demonstrate photo metadata and GPS geotagging in the live demo): https://store.google.com/us/category/phones

☁️ Software & Cloud Services Mentioned in the Conversation

• 🤖 ChatGPT (OpenAI) — Consumer & Teams AI platforms: https://openai.com/chatgpt

• 🤖 ChatGPT Teams — Enhanced security tier: https://openai.com/chatgpt/team

• 🤖 Claude (Anthropic) — AI assistant: https://claude.ai

• 📊 CNET — VPN rankings: https://www.cnet.com/tech/services-and-software/best-vpn/

• 🗃️ CS Disco — AI-powered eDiscovery platform: https://www.csdisco.com

• 🔐 ExpressVPN — VPN service (#1 on CNET): https://www.expressvpn.com

• ⚖️ LexisNexis Protégé — Legal AI platform with zero-retention, encrypted access to ChatGPT and Claude: https://www.lexisnexis.com/en-us/products/lexis-plus-ai.page 

• 🖥️ macOS Get Info & File Tags — Native macOS metadata tool: https://support.apple.com/guide/mac-help 

• 🖥️ Microsoft Windows File Properties (right-click → Properties → Details) — Native OS metadata viewer: https://support.microsoft.com/en-us/windows

• 🔐 NordVPN — VPN service (#1 on Tom's Guide): https://nordvpn.com

• 🤖 Perplexity AI — AI research assistant: https://www.perplexity.ai

• 🗃️ Relativity — eDiscovery platform with metadata analysis: https://www.relativity.com

• 📊 Tom's Guide — VPN rankings: https://www.tomsguide.com/best-picks/best-vpn

• ⚖️ Westlaw — Legal AI research vault: https://legal.thomsonreuters.com/en/products/westlaw

🔒 Word (Phrase) of the Week: “Zero Data Retention” Agreements: Why Every Lawyer Must Pay Attention Now!

Understanding Zero Data Retention in Legal Practice

🚨 Lawyers Must Know Zero Data Retention Now!

Zero Data Retention (ZDR) agreements represent a fundamental shift in how law firms protect client confidentiality when using third-party technology services. These agreements ensure that sensitive client information is processed but never stored by vendors after immediate use. For attorneys navigating an increasingly digital practice environment, understanding ZDR agreements has become essential to maintaining ethical compliance.

ZDR works through a simple but powerful principle: access, process, and discard. When lawyers use services with ZDR agreements, the vendor connects to data only when needed, performs the requested task, and immediately discards all information without creating persistent copies. This architectural approach dramatically reduces the risk of data breaches and unauthorized access.

The Legal Ethics Crisis Hidden in Your Vendor Contracts

Recent court orders have exposed a critical vulnerability in how lawyers use technology. A federal court ordered OpenAI to preserve all ChatGPT conversation logs indefinitely, including deleted content—even for paying subscribers. This ruling affects millions of users and demonstrates how quickly data retention policies can change through litigation.

The implications for legal practice are severe. Attorneys using consumer-grade AI tools, standard cloud storage, or free collaboration platforms may unknowingly expose client confidences to indefinite retention. This creates potential violations of fundamental ethical obligations, regardless of the lawyer's intent or the vendor's original promises.

ABA Model Rules Create Mandatory Obligations

Three interconnected ABA Model Rules establish clear ethical requirements for lawyers using technology vendors.

Rule 1.1 and its Comment [8] requires technological competence. Attorneys must understand "the benefits and risks associated with relevant technology". This means lawyers cannot simply trust vendor marketing claims about data security. They must conduct meaningful due diligence before entrusting client information to any third party.

Rule 1.6 mandates confidentiality protection. Lawyers must "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client". This obligation extends to all digital communications and cloud-based storage. When vendors retain data beyond the immediate need, attorneys face heightened risks of unauthorized disclosure.

Rule 5.3 governs supervision of nonlawyer assistants. This rule applies equally to technology vendors who handle client information. Lawyers with managerial authority must ensure their firms implement measures that provide reasonable assurance that vendors comply with the attorney's professional obligations.

Practical Steps for Ethical Compliance

Attorneys must implement specific practices to satisfy their ethical obligations when selecting technology vendors.

1. Demand written confirmation of zero data retention policies from all vendors handling client information. Ask whether the vendor uses client data for training AI models. Determine how long any data remains accessible after processing. These questions must be answered clearly before using any service.

Lawyers Need Zero Data Retention Agreements!

Review vendor agreements carefully. Standard terms of service often fail to provide adequate confidentiality protections. Attorneys should negotiate explicit contractual provisions that prohibit data retention beyond immediate processing needs. These agreements must specify encryption standards, access controls, and breach notification procedures.

Obtain client consent when using third-party services that may access confidential information. While not always legally required, informed consent demonstrates respect for client autonomy and provides an additional layer of protection.

Conduct ongoing monitoring of vendor practices. Initial due diligence is insufficient. Technology changes rapidly, and vendors may alter their data handling practices. Regular reviews ensure continued compliance with ethical obligations.

Restrict employee use of unauthorized tools. Many data breaches stem from "shadow IT"—employees using personal accounts or unapproved services for work purposes. Clear policies and training can prevent inadvertent ethical violations.

The Distinction Between Consumer and Enterprise Services

Not all AI and cloud services create equal ethical risks. Consumer versions of popular tools often lack the security features required for legal practice. Enterprise subscriptions typically provide enhanced protections, including zero data retention options.

For example, OpenAI offers different service tiers with dramatically different data handling practices. ChatGPT Free, Plus, Pro, and Team subscriptions now face indefinite data retention due to court orders. However, ChatGPT Enterprise and API customers with ZDR agreements remain unaffected. This distinction matters enormously for attorney compliance.

Industry-Specific Legal AI Offers Additional Safeguards

Legal-specific AI platforms build confidentiality protections into their core architecture. These tools understand attorney-client privilege requirements and design their systems accordingly. They typically offer encryption, access controls, SOC 2 compliance, and explicit commitments not to use client data for training.

When evaluating legal technology vendors, attorneys should prioritize those offering private AI environments, end-to-end encryption, and contractual guarantees about data retention. These features align with the ethical obligations imposed by the Model Rules.

Zero Data Retention as Competitive Advantage

Beyond ethical compliance, ZDR agreements offer practical benefits. They reduce storage costs, simplify regulatory compliance, and minimize the attack surface for cybersecurity threats. In an era of increasing data breaches, the ability to tell clients that their information is never stored by third parties provides meaningful competitive differentiation.

Final Thoughts: Action Required Now

Lawyers must Protect Client Data with ZDR!

The landscape of legal technology changes constantly. Court orders can suddenly transform data retention policies. Vendors can modify their terms of service. New ethical opinions can shift compliance expectations.

Attorneys cannot afford passive approaches to vendor management. They must actively investigate, negotiate, and monitor the data handling practices of every technology provider accessing client information. Zero data retention agreements represent one powerful tool for maintaining ethical compliance in an increasingly complex technological environment.

The duty of confidentiality remains absolute, regardless of the tools lawyers choose. By demanding ZDR agreements and implementing comprehensive vendor management practices, attorneys can embrace technological innovation while protecting the fundamental trust that defines the attorney-client relationship.

MTC: Judicial Warnings - Courts Intensify AI Verification Standards for Legal Practice ⚖️

Lawyers always need to check their work - AI is not infalable!

The legal profession faces an unprecedented challenge as federal courts nationwide impose increasingly harsh sanctions on attorneys who submit AI-generated hallucinated case law without proper verification. Recent court decisions demonstrate that judicial patience for unchecked artificial intelligence use has reached a breaking point, with sanctions extending far beyond monetary penalties to include professional disbarment recommendations and public censure. The August 2025 Mavy v. Commissioner of SSA case exemplifies this trend, where an Arizona federal judge imposed comprehensive sanctions including revocation of pro hac vice status and mandatory notification to state bar authorities for fabricated case citations.

The Growing Pattern of AI-Related Sanctions

Courts across the United States have documented a troubling pattern of attorneys submitting briefs containing non-existent case citations generated by artificial intelligence tools. The landmark Mata v. Avianca case established the foundation with a $5,000 fine, but subsequent decisions reveal escalating consequences. Recent sanctions include a Wyoming federal court's revocation of an attorney's pro hac vice admission after discovering eight of nine cited cases were AI hallucinations, and an Alabama federal court's decision to disqualify three Butler Snow attorneys from representation while referring them to state bar disciplinary proceedings.

The Mavy case demonstrates how systematic citation failures can trigger comprehensive judicial response. Judge Alison S. Bachus found that of 19 case citations in attorney Maren Bam's opening brief, only 5 to 7 cases existed and supported their stated propositions. The court identified three completely fabricated cases attributed to actual Arizona federal judges, including Hobbs v. Comm'r of Soc. Sec. Admin., Brown v. Colvin, and Wofford v. Berryhill—none of which existed in legal databases.

Essential Verification Protocols

Lawyers if you fail to check your work when using AI, your professional career could be in jeopardy!

Legal professionals must recognize that Federal Rule of Civil Procedure 11 requires attorneys to certify the accuracy of all court filings, regardless of their preparation method. This obligation extends to AI-assisted research and document preparation. Courts consistently emphasize that while AI use is acceptable, verification remains mandatory and non-negotiable.

The professional responsibility framework requires lawyers to independently verify every AI-suggested citation using official legal databases before submission. This includes cross-referencing case numbers, reviewing actual case holdings, and confirming that quoted material appears in the referenced decisions. The Alaska Bar Association's recent Ethics Opinion 2025-1 reinforces that confidentiality concerns also arise when specific prompts to AI tools reveal client information.

Best Practices for Technology Integration 📱

Technology-enabled practice enhancement requires structured verification protocols. Successful integration involves implementing retrieval-based legal AI systems that cite original sources alongside their outputs, maintaining human oversight for all AI-generated content, and establishing peer review processes for critical filings. Legal professionals should favor platforms that provide transparent citation practices and security compliance standards.

The North Carolina State Bar's 2024 Formal Ethics Opinion emphasizes that lawyers employing AI tools must educate themselves on associated benefits and risks while ensuring client information security. This competency standard requires ongoing education about AI capabilities, limitations, and proper implementation within ethical guidelines.

Consequences of Non-Compliance ⚠️

Recent sanctions demonstrate that monetary penalties represent only the beginning of potential consequences. Courts now impose comprehensive remedial measures including striking deficient briefs, removing attorneys from cases, requiring individual apology letters to falsely attributed judges, and forwarding sanction orders to state bar associations for disciplinary review. The Arizona court's requirement that attorney Bam notify every judge presiding over her active cases illustrates how sanctions can impact entire legal practices.

Professional discipline referrals create lasting reputational consequences that extend beyond individual cases. The Second Circuit's decision in Park v. Kim established that Rule 11 duties require attorneys to "read, and thereby confirm the existence and validity of, the legal authorities on which they rely". Failure to meet this standard reveals inadequate legal reasoning and can justify severe sanctions.

Final Thoughts - The Path Forward 🚀

Be a smart lawyer. USe AI wisely. Always check your work!

The ABA Journal's coverage of cases showing "justifiable kindness" for attorneys facing personal tragedies while committing AI errors highlights judicial recognition of human circumstances, but courts consistently maintain that personal difficulties do not excuse professional obligations. The trend toward harsher sanctions reflects judicial concern that lenient approaches have proven ineffective as deterrents.

Legal professionals must embrace transparent verification practices while acknowledging mistakes promptly when they occur. Courts consistently show greater leniency toward attorneys who immediately admit errors rather than attempting to defend indefensible positions. This approach maintains client trust while demonstrating professional integrity.

The evolving landscape requires legal professionals to balance technological innovation with fundamental ethical obligations. As Stanford research indicates that legal AI models hallucinate in approximately one out of six benchmarking queries, the imperative for rigorous verification becomes even more critical. Success in this environment demands both technological literacy and unwavering commitment to professional standards that have governed legal practice for generations.

MTC