I previously posted about how I don’t use or recommend the use of Dropbox for confidential attorney work product type stuff over here, but just came across this great write up about the issue from attorney, and self proclaimed HyTechLawyer, Bill Latham.
In Use of DropBox By Lawyers is Risky Business – Ethical Issue, he concludes:
Dropbox has two main functions: (1) the transfer of data/files between device and computers and (2) the storage of data. If Dropbox is used only to transfer files between devices, and the file once transferred is promptly deleted from Dropbox, the risk to client confidentiality would appear to be small, but nonetheless present. However, if Dropbox is used as a storage location for client files, then unless the files are separately encrypted, the Terms of Service and related policies of Dropbox do not provide adequate assurances of confidentially to give this lawyer confidence that they pass ethical muster.
I have never been someone to jump on the bandwagon. Hop on a soapbox on occasion – even rant … sure – but I am definitely not one who does something just because everyone else is doing it.
That’s why when I saw Dropbox popping up ALL OVER the legal world, I didn’t know what to think. So many of those in the industry that I respected were using and recommending this application, I began to think perhaps I was just over my head geek-wise. That perhaps the precautions in place by Dropbox WERE sufficient for attorney work product. NOT!
As was reported in Dropbox Lied to Users About Data Security, Complaint to FTC Alleges:
Dropbox, the wildly popular online storage system, deceived users about the security and encryption of its services, putting it at a competitive advantage, according to an FTC complaint filed Thursday by a prominent security researcher.
and here’s a link to the FTC complaint (.pdf file on the wired site).
When Dropbox first hit the scene, I turned to one of my favorite legal IT guys, Ben Schorr and asked him his thoughts. Ben’s response was to remove any question and encrypt the information and files before placing them into Dropbox. Seems, once again, Ben was absolutely correct to be so cautious. Ben states: “While you’re installing TrueCrypt how about using it to encrypt the entire drive on your laptop, netbook or other portable? It’s free, not difficult, and gives you a LOT of protection in case your device is lost/stolen.” and here’s his How To Article at Office for Lawyers with step by step instructions.
Another colleague, Carolyn Elefant, Esq. recently spoke of technology and an attorneys’ ethical duties at IgniteLaw 2011: Is Technology the Kryptonite of Client Confidentiality. It’s worth 6 minutes of your time.
Moral of the story – if a tech is too good to be true… chances are…