The Duty to Protect Client Information: Competence, Confidentiality and Supervision

Rule versions described: Idaho Rules of Professional Conduct (I.R.P.C.) 1.0, 1.1, 1.4, 1.6, 1.9, 1.15, 1.18, 4.4, 5.1, 5.3 and 5.7 with their comments, Idaho State Bar full text current as of March 9, 2026, read October 28, 2026; Idaho Bar Commission Rules Sections IV (continuing legal education), V (review of professional conduct), VI (Client Assistance Fund) and XIII (trust accounts), current as of March 9, 2026; ABA Model Rules of Professional Conduct and comments as posted on americanbar.org, read October 28, 2026; ABA Formal Opinions 95-398 (1995) through 515 (2025), each dated in the text; the AICPA Code of Professional Conduct (updated through December 2023), IDAPA 24.30.01 and Idaho Code 9-203A, read October 28, 2026. Rules and opinions change, and the Idaho Supreme Court can amend the Idaho rules at any time. Check the Idaho State Bar's current text before relying on any point.¹¹²

Every law office holds information that someone else would pay for, use against a client, or hold for ransom. Divorce files hold bank statements and children's school records. Personal injury files hold medical charts. Business files hold deal terms that move stock prices. Estate files hold Social Security numbers for whole families. Criminal defense files hold things a client has told no one else. For most of the history of the profession that information sat in paper files behind a locked door. Now it sits in email accounts, cloud practice management systems, document scanners, phones and laptops, and the people trying to get at it are often thousands of miles away.

The rules of professional conduct did not change their basic promise when files went digital: a lawyer keeps a client's information confidential and handles the matter competently. What changed is what that promise requires. This lesson walks through the specific rules that make cybersecurity a professional duty for Idaho lawyers, compares them with the American Bar Association's Model Rules that most states copy, explains the ABA ethics opinions that tell lawyers what "reasonable" looks like, describes who enforces the duty and how, and ends with what a small Idaho office can do in practice. It is written for lawyers, paralegals, legal assistants and office managers, for the IT providers who serve law firms, for clients who want to know what to expect, and for reporters and advocates.

This module builds on others. The management side (who owns cyber risk, how to set risk appetite, who decides what) is covered in Why Management Owns the Risk, and security frameworks such as the NIST Cybersecurity Framework and the CIS Controls are explained in Security Frameworks and Standards. The plain-language basics of updates, passwords and two-step sign-in for a home computer are in Securing Your Home Computer, Phone and Money, and for a small office in Accounts, Passwords and Two-Step Sign-In. This lesson does not repeat those. It explains why, for a lawyer, those basics stop being good advice and become part of a duty that a disciplinary board, a court or a regulator can enforce.

Where the duty comes from

The Idaho rules and the ABA Model Rules

The Idaho Rules of Professional Conduct "became effective on November 1, 1986, (with subsequent amendments) by order of the Idaho Supreme Court." They were revised and readopted by the Court effective July 1, 2004, and the Court "also specifically adopted the comments," which matters here because much of the technology guidance lives in the comments rather than in the rules themselves. The Idaho State Bar describes the rules as "based largely on the ABA Model Rules of Professional Conduct, with some Idaho variations." The Bar's full-text version states that it is current as of March 9, 2026.¹¹²

The ABA Model Rules are not law anywhere. They are a model drafted by the American Bar Association, a private professional group, which each state's highest court may adopt in whole, in part or not at all. Idaho adopted most of them, so when the ABA's ethics committee interprets a Model Rule in a formal opinion, Idaho lawyers and disciplinary authorities routinely look to that opinion. It is persuasive, not binding. Where Idaho's text differs from the ABA text, the Idaho text controls, and this lesson flags the differences that matter.

Rule 1.0: what "reasonable" means

The security rules turn on one word: reasonable. Rule 1.0 defines it. Under I.R.P.C. 1.0(h), "'Reasonable' or 'reasonably' when used in relation to conduct by a lawyer denotes the conduct of a reasonably prudent and competent lawyer." Under 1.0(j), "'Reasonably should know' when used in reference to a lawyer denotes that a lawyer of reasonable prudence and competence would ascertain the matter in question."¹

Two points follow. First, the standard is objective. A lawyer who honestly did not know that email accounts can be taken over with a stolen password is not excused if a reasonably prudent and competent lawyer would have known. Second, the standard moves with the times. What a prudent lawyer would know about phishing, two-step sign-in or ransomware in 2026 is very different from what one would have known in 2006, because the information is now everywhere, including in bar journals, in the ABA opinions discussed below and in the Idaho State Bar's own scam alerts.¹³

Rule 1.0 also defines two other terms that come up constantly. "Informed consent" is "the agreement by a person to a proposed course of conduct after the lawyer has communicated adequate information and explanation about the material risks of and reasonably available alternatives to the proposed course of conduct" (1.0(e)). And "writing" includes "electronic communications" (1.0(n)), so a client's consent "confirmed in writing" can be confirmed by email. The definitions match the ABA's lettering and text.¹

Competence: Rule 1.1 and Comment [8]

The rule and the technology comment

Rule 1.1 is short: "A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation."¹

Idaho Comment [8], headed "Maintaining Competence," reads in full: "To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject."¹

That is word for word the same as ABA Model Rule 1.1 Comment [8].¹⁴ The ABA added the technology phrase in August 2012 as part of its Commission on Ethics 20/20 package. ABA Formal Opinion 477R (2017) records that the ABA "adopted 'technology amendments' to the Model Rules, including updating the Comments to Rule 1.1 on lawyer technological competency and adding paragraph (c) and a new Comment to Rule 1.6." The opinion also quotes the Commission's own explanation: the old comment already implied a duty to keep up with technology, but spelling it out "would offer greater clarity." The Commission declined to list specific security measures because, in its words, "technology is changing too rapidly to offer such guidance."⁴

When did Idaho adopt it? The Idaho Supreme Court's adoption order could not be found on the Idaho State Bar or Idaho Supreme Court websites for this lesson. The LawSites tracker maintained by legal technology journalist Robert Ambrogi lists Idaho as approving the comment on March 17, 2014, effective July 1, 2014. Treat that date as a secondary report; what is certain is that the comment is in the Idaho text today.¹⁵

What technology competence asks for

Comment [8] does not make every lawyer an IT expert. It asks for enough understanding of "relevant technology" to make sound decisions about it. In practice that breaks into three pieces.

• Knowing the risks of the tools you use. A lawyer who uses email, a cloud document system, a phone with client texts, a video platform or an AI drafting tool should understand in plain terms how each can leak information: a stolen password, a misdirected message, a lost phone without encryption, a recorded meeting saved to a public link, or a prompt that sends client facts to a service that keeps them.
• Knowing the benefits you may be missing. The comment says "benefits and risks." A lawyer who refuses to turn on two-step sign-in, or who emails sensitive files as plain attachments when the firm already pays for a secure portal, is not using available technology to protect clients.
• Knowing when to get help. No rule expects a solo practitioner to configure a firewall. ABA Formal Opinion 512 (2024), on generative AI, says lawyers should read the terms of the tools they use or rely on someone who has, possibly "IT professionals or cyber security experts."¹⁶ The duty is the lawyer's; carrying it out can be delegated, but then Rule 5.3 applies (see below).

Competence also reaches what happens after something goes wrong. ABA Formal Opinion 483 (2018) says that when a breach is suspected or detected, "Rule 1.1 requires that the lawyer act reasonably and promptly to stop the breach and mitigate damage," and that lawyers "should consider proactively developing an incident response plan." Formal Opinion 482 (2018), on disasters, says Rule 1.1 "requires lawyers to develop sufficient competence in technology to meet their obligations under the Rules after a disaster," which in practice means backups and a plan to keep working if systems go down.⁵¹⁷ Response steps are covered in lesson 5.

Confidentiality: Rule 1.6(a) and 1.6(c)

The duty not to reveal

I.R.P.C. 1.6(a) says: "A lawyer shall not reveal information relating to representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation or the disclosure is permitted by paragraph (b)."¹

The key phrase is "information relating to representation of a client." It is much broader than attorney-client privilege, which is a rule of evidence that protects confidential communications from being forced into court. Rule 1.6 covers everything the lawyer learns in the course of the work, from any source: the client's address, the fact that a person is a client at all, documents from the other side, public records the lawyer gathered, and the lawyer's own notes. A data breach at a law firm almost always exposes Rule 1.6 information even when no privileged email is taken.

Idaho's exceptions in 1.6(b) differ from the ABA's in ways that are not about security but that writers and readers should not mix up. Idaho 1.6(b)(1) allows disclosure "to prevent the client from committing a crime, including disclosure of the intention to commit a crime," which Idaho Comment [6] says is broader than the ABA rule. Idaho's financial-injury exception refers to the client's "crime," where the ABA says "crime or fraud." And the ABA comment sentence about responding to negative online reviews does not appear in Idaho's Comment [10]. When Idaho text and ABA text differ, quote Idaho.¹¹⁸

The duty to make reasonable efforts

The security rule itself is I.R.P.C. 1.6(c): "A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." The Idaho text is identical to ABA Model Rule 1.6(c).¹¹⁸

Read it slowly. It covers three things: disclosure by mistake ("inadvertent," such as an email to the wrong "Mike"), disclosure without permission ("unauthorized," such as an employee taking files to a new job), and "unauthorized access," which is the hacker, the ransomware crew, or the stranger who finds a laptop in a parking lot. It applies to "information relating to the representation," the same broad category as 1.6(a). And it demands "reasonable efforts," not perfection.

The year Idaho added paragraph (c) is not confirmed in a primary source. It was probably part of the same 2014 package as Comment [8] to Rule 1.1, but no Idaho order was found. What matters for a lawyer practicing in 2026 is that it is in force.¹

Idaho Comment [19]: the factors for "reasonable efforts"

Idaho Comment [19], headed "Acting Competently to Preserve Confidentiality," explains the rule. It says paragraph (c) "requires a lawyer to act competently to safeguard information relating to the representation of a client against unauthorized access by third parties and against inadvertent or unauthorized disclosure by the lawyer or other persons who are participating in the representation of the client or who are subject to the lawyer's supervision."¹

It then sets the safe harbor that every firm should know: "The unauthorized access to, or the inadvertent or unauthorized disclosure of, information relating to the representation of a client does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure."¹ A firm that is breached despite sensible precautions has not, for that reason alone, violated the rule. A firm that is breached because it ignored obvious steps has a problem, and the breach is the evidence.

The comment lists the factors used to judge reasonableness: "the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer's ability to represent clients (e.g., by making a device or important piece of software excessively difficult to use)."¹²

Two things about these factors are often missed. First, cost and difficulty count, but they are weighed against sensitivity and likelihood. Turning on two-step sign-in for a firm's email costs little and blocks the common stolen-password route into an account, so "it was inconvenient" is a weak defense when a stolen password was the way in. A dedicated encrypted network for a one-lawyer traffic ticket practice is a different story. Second, the factors apply matter by matter and system by system. The same firm may reasonably send a scheduling email in plain text and be required to use an encrypted portal for a client's medical records in the next message.

What the client can change, and what the rule leaves to other law

Comment [19] adds: "A client may require the lawyer to implement special security measures not required by this Rule or may give informed consent to forgo security measures that would otherwise be required by this Rule." Corporate clients increasingly do the first, through outside counsel guidelines and security questionnaires. In the ABA's 2023 survey, 27 percent of responding lawyers said a client had asked for the firm's security requirements document, 22 percent had been asked to complete a security questionnaire, and 14 percent reported a client request for an audit or review.¹⁹ The second option, a client's informed consent to less security, has to be real informed consent under Rule 1.0(e): the client hears the material risks and the reasonable alternatives and agrees. A line buried in an engagement letter is not the same thing. Engagement letter language is covered in lesson 5.

The comment also says that data privacy laws and breach notification laws are "beyond the scope of these Rules." The ethics rule sets a floor for lawyers; it does not replace Idaho's breach notice statute, HIPAA for firms that handle patient records, or a contract with a client. A firm can satisfy Rule 1.6(c) and still owe statutory breach notices, or the reverse.¹

Idaho Comment [20]: sending information

Idaho Comment [20] deals with transmission: "When transmitting a communication that includes information relating to the representation of a client, the lawyer must take reasonable precautions to prevent the information from coming into the hands of unintended recipients. This duty, however, does not require that the lawyer use special security measures if the method of communication affords a reasonable expectation of privacy. Special circumstances, however, may warrant special precautions."¹

The comment continues: "Factors to be considered in determining the reasonableness of the lawyer's expectation of confidentiality include the sensitivity of the information and the extent to which the privacy of the communication is protected by law or by a confidentiality agreement." The practical reading, developed by the ABA opinions below, is that ordinary email is usually acceptable, while special circumstances (highly sensitive content, a known threat, a client using an employer's account, a client who asks for more) call for more.

Why the Idaho comment numbers are one higher

Anyone comparing Idaho and ABA materials will notice that the numbers do not line up. The comment the ABA numbers [18] is Idaho's [19]; the ABA's [19] is Idaho's [20]; the ABA's former-client comment [20] is Idaho's [21]. The reason is housekeeping: Idaho keeps a comment headed "Withdrawal" as its Comment [18], which the current ABA comment set does not have, and that pushes the later comments down by one. The text of the security comments is identical. When citing for an Idaho audience, use Idaho's numbers; when reading an ABA opinion that cites "Comment [18]," translate it to Idaho [19].¹²

Telling clients: Rule 1.4

The communication duty

Rule 1.4 is the duty to keep clients informed. Under I.R.P.C. 1.4(a), a lawyer must "(1) promptly inform the client of any decision or circumstance with respect to which the client's informed consent, as defined in Rule 1.0(e), is required by these Rules; (2) reasonably consult with the client about the means by which the client's objectives are to be accomplished; (3) keep the client reasonably informed about the status of the matter; (4) promptly comply with reasonable requests for information; including a request for an accounting as required by Rule 1.5(f)"; paragraph (a)(5) adds a duty to consult the client about any relevant limit on what the lawyer may do. Rule 1.4(b) adds: "A lawyer shall explain a matter to the extent reasonably necessary to permit the client to make informed decisions regarding the representation."¹

The only Idaho difference from the ABA text is the accounting clause in (a)(4). Otherwise the rules match.¹⁹

Three times Rule 1.4 touches security

Choosing how to communicate. Consulting "about the means" of the representation includes how the lawyer and client will exchange information. A client who wants to text from a shared family phone, use a work email account, or send medical records as unencrypted attachments should hear the risks and the alternatives. ABA Formal Opinion 11-459 (2011) says a lawyer "ordinarily must warn the client about the risk of sending or receiving electronic communications using a computer or other device, or e-mail account, where there is a significant risk that a third party may gain access," and gives the example of an employee using an employer's system to email a lawyer about a dispute with that employer.²⁰

Telling a client about a breach. ABA Formal Opinion 483 (2018) grounds the duty to notify clients of a data breach in Rule 1.4(a)(3) and 1.4(b). Its headnote states: "When a data breach occurs involving, or having a substantial likelihood of involving, material client information, lawyers have a duty to notify clients of the breach and to take other reasonable steps consistent with their obligations under these Model Rules." The minimum disclosure, according to the opinion, is that unauthorized access or disclosure happened or is reasonably suspected. The opinion separately notes that statutory breach notice laws may require more, on their own terms. How and when to notify is covered in lesson 5.⁵

Telling a client about a service that changes their risk. When a lawyer plans to send client files to an outside service in a way the client would not expect, the ABA opinions on outsourcing and generative AI call for disclosure and, in some cases, informed consent. ABA Formal Opinion 512 (2024) warns that "merely adding general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient" where informed consent is needed. Cloud and AI tools are the subject of lesson 2.¹⁶

Former and prospective clients: Rules 1.9(c), 1.15 and 1.18

Rule 1.9(c): old files are still protected

The duty of confidentiality does not end when the file is closed. I.R.P.C. 1.9(c) says a lawyer who formerly represented a client "shall not thereafter: (1) use information relating to the representation to the disadvantage of the former client except as these Rules would permit or require with respect to a client, or when the information has become generally known; or (2) reveal information relating to the representation except as these Rules would permit or require with respect to a client." Idaho Comment [21] to Rule 1.6 (ABA Comment [20]) says plainly: "The duty of confidentiality continues after the client-lawyer relationship has terminated."¹

For security purposes this means the archive is in scope. A firm that keeps twenty years of closed files on a file server, in an old email account or in a box of backup drives in a closet holds former-client information under the same duty as current files. ABA Formal Opinion 483 makes the point directly: files kept under record retention rules still hold former-client information, so a breach can reach former clients too. The opinion declines to require notice to former clients as a matter of legal ethics, because no rule text requires it, but warns that privacy laws, common law duties or contracts may, and it encourages firms to adopt retention schedules that reduce how much former-client information they keep.⁵

Rule 1.15: client files as property

Rule 1.15 is mostly about money in trust accounts, which is the subject of lesson 3. But its first paragraph reaches client files too. I.R.P.C. 1.15(a) says property of clients "shall be identified as such and appropriately safeguarded," and that complete trust account records "shall be preserved for a period of five years after termination of the representation." Comment [1] adds: "A lawyer should hold property of others with the care required of a professional fiduciary."¹ Electronic client documents the firm holds for the client are part of what has to be "appropriately safeguarded," and the five-year record rule is one reason firms keep data that can later be breached. A written retention schedule that says what is kept, for how long and how it is destroyed is both a records tool and a security control.

Rule 1.18: intake forms and prospective clients

People who contact a firm about possibly hiring it are protected even if they never become clients. Under I.R.P.C. 1.18(a), "A person who consults with a lawyer about the possibility of forming a client-lawyer relationship with respect to a matter is a prospective client." Under 1.18(b), "Even when no client-lawyer relationship ensues, a lawyer who has learned information from a prospective client shall not use or reveal that information learned in the consultation, except as Rule 1.9 would permit with respect to information of a former client." Rule 1.18(d)(2) also expects a lawyer to take "reasonable measures to avoid exposure to more disqualifying information than was reasonably necessary."¹

Website contact forms, chat widgets, after-hours answering services and intake emails all collect prospective-client information. A form that stores submissions in an unprotected spreadsheet, or a chat tool that keeps transcripts on a vendor's server with no confidentiality terms, is a Rule 1.18 problem waiting to happen. A practical step is to design intake to collect only what is needed to check conflicts and decide whether to proceed (names of parties and a short description), not the full story.

One limit matters for fraud. ABA Formal Opinion 515 (March 5, 2025) addresses scams in which a fake client hires a lawyer to collect a fake debt and pays with a counterfeit check. The opinion explains that because the scammer never intended to form a genuine client-lawyer relationship, the lawyer owed the scammer no duty at all, and that a lawyer who is the victim of a crime by a client or prospective client may disclose information to the authorities to seek an investigation. Scams aimed at trust accounts are covered in lesson 3 and lesson 6.²¹

Metadata and misdirected documents: Rule 4.4(b)

The notice rule

Rule 4.4(b) governs what happens when a lawyer receives something that was not meant for them. I.R.P.C. 4.4(b): "A lawyer who receives a document or electronically stored information relating to the representation of the lawyer's client and knows or reasonably should know that the document or electronically stored information was inadvertently sent shall promptly notify the sender." The text is identical to the ABA rule.¹²²

Idaho Comment [4] brings metadata in: "'document or electronically stored information' includes, in addition to paper documents, email and other forms of electronically stored information, including embedded data (commonly referred to as 'metadata'), that is subject to being read or put into readable form. Metadata in electronic documents creates an obligation under this Rule only if the receiving lawyer knows or reasonably should know that the metadata was inadvertently sent to the receiving lawyer." The comment leaves the rest, such as whether the item must be returned or deleted and whether privilege was waived, as "a matter of law beyond the scope of these Rules."¹

Metadata is data about a document that travels with it: the author's name, editing time, earlier versions, tracked changes, hidden comments, and sometimes the file path on the sender's server. A settlement draft sent with tracked changes turned off but still stored can show the other side what the client was willing to accept two drafts ago.

The sending side is the Rule 1.6(c) side

Rule 4.4(b) tells the receiver what to do. It does nothing to stop the leak. ABA Formal Opinion 06-442 (2006) concluded that the Model Rules do not specifically forbid a lawyer from reviewing and using metadata in documents received from the other side, and pointed to the sender's remedy: avoiding the problem by scrubbing metadata from documents or by sending a different version of the document that leaves out the embedded information.²³ States split on whether receivers may look, but no state disagrees that the sending lawyer is better off removing it. For an Idaho firm, the duty to scrub before sending is part of the Rule 1.6(c) duty to prevent inadvertent disclosure, and the practical tools are simple: send PDFs instead of word processing files when the other side does not need to edit, use the document inspection or metadata removal feature built into the word processor, and train staff to check before sending.

Two related ABA opinions round out the picture. Formal Opinion 11-460 (2011) addresses an employer's lawyer who finds an employee's private emails with the employee's lawyer on the employer's computer system. It concludes that "neither Rule 4.4(b) nor any other Rule requires the employer's lawyer to notify opposing counsel," though court decisions or other law may. Formal Opinion 503 (2022) warns about "reply all": a lawyer who copies their own client on an email to opposing counsel impliedly consents to the other lawyer replying to everyone, including the client, and the better practice is to forward the email to the client separately.²⁴²⁵

Supervising people and vendors: Rules 5.1, 5.3 and 5.7

Rule 5.1: partners and supervising lawyers

Most law firm breaches start with a person: someone clicks a link, reuses a password, sends a file to the wrong address, or approves a wire on a fake email. The rules put responsibility for preventing that on firm leadership. Under I.R.P.C. 5.1(a), a partner, or a lawyer with comparable managerial authority, "shall make reasonable efforts to ensure that the firm has in effect measures giving reasonable assurance that all lawyers in the firm conform to the Rules of Professional Conduct." Rule 5.1(b) applies the same idea to a lawyer who directly supervises another lawyer. The text matches the ABA rule.¹

The word "measures" is doing a lot of work. A firm that has never written down how client files may be stored, how email accounts are protected or what to do when a phishing email arrives has no "measures" to point to. In a three-lawyer office the "partners" may be everyone with an ownership share, so every owner carries this duty, not just the one who likes computers.

Rule 5.3: staff, contractors and cloud services

Rule 5.3 extends the same duty to people who are not lawyers. Idaho titles it "Responsibilities Regarding Nonlawyer Assistance," and its text matches the ABA rule. It opens: "With respect to a nonlawyer employed or retained by or associated with a lawyer: (a) a partner, and a lawyer who individually or together with other lawyers possesses comparable managerial authority in a law firm shall make reasonable efforts to ensure that the firm has in effect measures giving reasonable assurance that the person's conduct is compatible with the professional obligations of the lawyer." Paragraph (b) applies to a lawyer with direct supervisory authority, and paragraph (c) makes a lawyer responsible for the nonlawyer's conduct that would violate the rules if the lawyer ordered or ratified it, or knew in time to prevent it and did not act.¹²⁶

Idaho Comment [2] says lawyers must give assistants "appropriate instruction and supervision concerning the ethical aspects of their employment, particularly regarding the obligation not to disclose information relating to representation of the client." That is a training requirement in all but name.¹

Idaho Comment [3] reaches outside the firm. Its examples of nonlawyers outside the firm include "hiring a document management company to create and maintain a database for complex litigation, sending client documents to a third party for printing or scanning, and using an Internet-based service to store client information." The lawyer "must make reasonable efforts to ensure that the services are provided in a manner that is compatible with the lawyer's professional obligations." How much effort depends on the circumstances, including the vendor's education, experience and reputation, the nature of the services, "the terms of any arrangements concerning the protection of client information; and the legal and ethical environments of the jurisdictions in which the services will be performed, particularly with regard to confidentiality."¹

In plain terms, Rule 5.3 covers the managed IT company with remote access to every computer, the cloud practice management system, the online backup service, the e-discovery vendor, the court reporter's file-sharing site, the copy shop, the shredding company, the virtual receptionist, and the AI tool. For each, the firm should be able to show what it checked before handing over client data, what the contract says about confidentiality and security, and how it would know if something went wrong. Vendor review steps are in the mapping table later in this lesson, and contract terms are in lesson 5.

ABA Formal Opinion 506 (2023) adds a related point about intake: nonlawyer staff may handle defined intake tasks if properly trained and supervised, but may not give legal advice. Those staff members are often the first people to handle a new client's most sensitive facts, and the first targets of a fake "new client" email.²⁷

Rule 5.7: a lawyer-owned side business

Some lawyers own related businesses: a title company, an IT consulting firm, an e-discovery shop, a mediation service. Rule 5.7 says the Rules of Professional Conduct apply to law-related services provided "by a separate entity controlled by the lawyer" unless the lawyer takes "reasonable measures to assure that a person obtaining the law-related services knows that the services of the separate entity are not legal services and that the protections of the client-lawyer relationship do not exist." The Idaho text matches the ABA rule.¹ For security, the point is that a lawyer cannot sidestep Rule 1.6 by moving client data into a sister company. If the separation is not made clear, the side business is held to the lawyer's standard.

The ABA formal opinions in plain terms

The ABA Standing Committee on Ethics and Professional Responsibility issues formal opinions that interpret the Model Rules. They do not bind Idaho's Supreme Court or Bar Counsel, but because Idaho's rules and comments are mostly identical to the Model Rules, and because the Idaho State Bar has issued no technology opinion of its own, they are the most detailed guidance an Idaho lawyer has. The ABA keeps an index of all formal opinions by date.²⁸ The opinions are copyrighted, so this section summarizes them and quotes only short phrases; the full texts are linked in the notes.

Formal Opinion 95-398 (1995): the computer maintenance company

The first opinion on point came before most firms had email. A firm's network could be reached remotely by a maintenance company whose staff could view client files. The committee concluded that a lawyer who gives such a company access "must make reasonable efforts to ensure that the company has in place, or will establish, reasonable procedures to protect the confidentiality of client information." It added that "Should a significant breach of confidentiality occur, the lawyer may be obligated to disclose it to the client."²⁹ Thirty years later the same two ideas, vendor diligence and telling the client, sit at the center of Rules 5.3 and 1.4 as applied to managed IT providers.

Formal Opinion 99-413 (1999): unencrypted email is generally acceptable

In 1999 many lawyers worried that email was too insecure to use for client work. Opinion 99-413 said a lawyer may send client information by unencrypted email over the internet because that method "affords a reasonable expectation of privacy from a technological and legal standpoint," and compared it to mail, landline telephones and fax. It kept one caution: for highly sensitive information, the lawyer should talk with the client and follow the client's instructions about how to send it.³ That opinion was the rule of thumb for almost twenty years, and it is the source of the common belief that lawyers never need to encrypt email. That belief is out of date, as Opinion 477R explains.

Formal Opinion 06-442 (2006): reviewing metadata

Covered above under Rule 4.4(b). The short version: the Model Rules do not forbid a receiving lawyer from reviewing metadata, so the protection has to come from the sender, who should scrub documents or send a version without the embedded data.²³

Formal Opinion 08-451 (2008): outsourcing legal and support work

Opinion 08-451 says a lawyer may outsource legal or nonlegal support services, but the lawyer stays responsible for competent representation under Rule 1.1 and must comply with the supervision rules, Rules 5.1 and 5.3. It says client disclosure, and client consent, should be obtained when outside lawyers or nonlawyers will receive information protected by Rule 1.6. For due diligence, it suggests at a minimum reference checks and a background investigation of the provider and any intermediary. And it reminds lawyers that fees for outsourced work must still be reasonable under Rule 1.5.³⁰ The opinion was written with offshore document review in mind, but its checklist (who is this provider, what will they see, what does the client know) fits any vendor that touches client files.

Formal Opinions 11-459 and 11-460 (2011): employer email systems

These two opinions, issued the same day, deal with the same fact pattern from opposite sides. Opinion 11-459 is about the client's lawyer: when a client is likely to email the lawyer from a work computer or work account where the employer may read it, the lawyer ordinarily must warn the client about that risk.²⁰ Opinion 11-460 is about the employer's lawyer who finds those emails on the company system: no ethics rule requires notifying the employee's lawyer, though other law might, and the decision belongs to the employer-client after the lawyer explains the implications.²⁴ The lesson for both sides: tell clients at intake not to use an employer's devices or accounts, or any shared account, for communications with the firm.

Formal Opinion 477R (2017): when to encrypt

Opinion 477R, issued May 11, 2017 and revised May 22, 2017, is the central modern opinion. It updates 99-413 because "the role and risks of technology in the practice of law have evolved since 1999." Its holding has two halves. A lawyer generally may send client information over the internet "where the lawyer has undertaken reasonable efforts to prevent inadvertent or unauthorized access." But a lawyer "may be required to take special security precautions" when an agreement with the client or the law requires it, "or when the nature of the information requires a higher degree of security."⁴

The opinion rejects a single rule for all matters and calls instead for a fact-based analysis, organized under seven headings:

1. Understand the nature of the threat.
2. Understand how client confidential information is transmitted and where it is stored.
3. Understand and use reasonable electronic security measures.
4. Determine how electronic communications about client matters should be protected.
5. Label client confidential information.
6. Train lawyers and nonlawyer assistants in technology and information security.
7. Conduct due diligence on vendors providing communication technology.

It names matters that carry higher risk, such as those involving "industrial designs, mergers and acquisitions or trade secrets," and industries such as health care, banking, defense and education. It lists example measures, including secure Wi-Fi, a virtual private network or secure portal, unique complex passwords, firewalls, anti-malware software and "applying all necessary security patches and updates." For sensitive information it says a lawyer "should encrypt the transmission," or consider password-protecting attachments or using a well-vetted secure cloud file storage system.⁴

What changed between 1999 and 2017 was not email itself so much as the threat. In 1999 the realistic risk was a stranger intercepting a message in transit. By 2017 it was criminals and foreign intelligence services specifically targeting law firms, stealing passwords, and reading entire mailboxes. Opinion 477R is the ABA catching the guidance up to that reality.

Formal Opinion 483 (2018): after a breach

Opinion 483, issued October 17, 2018, tells lawyers what the rules require once something has gone wrong. It defines a data breach for its purposes as an event where material client confidential information is "misappropriated, destroyed or otherwise compromised," or where the lawyer's ability to perform the legal services "is significantly impaired by the episode." It says lawyers "must employ reasonable efforts to monitor the technology and office resources connected to the internet, external data sources, and external vendors providing services relating to data." It requires reasonable efforts to stop the breach, find out what happened, and notify affected clients. For ransomware, it says notice is not required if no client information was accessed and none was unavailable for a material amount of time, but notice is required if material client information was actually or reasonably suspected to have been accessed, disclosed or lost.⁵ The response steps belong to lesson 5.

Formal Opinion 498 (2021): virtual practice

Opinion 498, issued March 10, 2021, during the pandemic shift to home offices, opens: "The ABA Model Rules of Professional Conduct permit virtual practice." Lawyers working from home or on the road still must make reasonable efforts to prevent unauthorized disclosure and must supervise subordinates and assistants under clear virtual-practice policies. The opinion repeats 477R's measures and adds that "[o]ther available tools include encryption of data that is physically stored on a device and multi-factor authentication to access firm systems." It tells lawyers to read the terms of service of hardware and software, secure video meetings, handle mail and paper at home with care, and disable the listening function of smart speakers and similar devices while discussing client matters unless the device is assisting the practice.⁶ Those two controls, named directly, are the core of the baseline described later in this lesson for a small office.

Other opinions in brief

• Formal Opinion 482 (2018), disasters: Rules 1.1, 1.4 and 1.15 apply after a disaster; advance planning and technology reduce the risk of violating them. Read it as the backup and continuity opinion.¹⁷
• Formal Opinion 503 (2022), "reply all": discussed above under Rule 4.4.²⁵
• Formal Opinion 511R (2024), listservs: Rule 1.6 bars posting about a representation, "even in hypothetical or abstract form," without informed consent if readers could reasonably identify the client or situation. The same caution applies to asking colleagues for help in online forums and AI chat tools.³¹
• Formal Opinion 512 (2024), generative AI: competence, confidentiality, communication, supervision and fees all apply to AI tools; read the terms of use; get informed consent before putting client information into a tool that may expose it. See lesson 2.¹⁶
• Formal Opinion 515 (2025), crimes against the lawyer: discussed above under Rule 1.18; a lawyer victimized by a scammer posing as a client may report it. See lesson 3.²¹

The ABA's opinion list for 2025 and 2026 (through Opinion 525, September 2, 2026) contains no other opinion specifically on cybersecurity, phishing response or wire fraud.²⁸

How the opinions fit together

Read in order, the opinions tell one consistent story. The basic duty, reasonable care for client information including in the hands of vendors, was there in 1995. The guidance became more specific as the threat grew: first permission to use email (1999), then the outsourcing and metadata questions (2006 and 2008), then client and employer accounts (2011), then the 2012 rule amendments that wrote technology into the comments, then the shift from "email is fine" to "it depends on the matter" (2017), then what to do after a breach (2018), then concrete tools for remote work (2021), and finally AI and fraud (2024 and 2025). None of the later opinions withdrew the earlier principle. Each one applied it to a newer risk.

What Idaho adds, and does not add

No technology CLE requirement

Comment [8] tells lawyers to "comply with all continuing legal education requirements to which the lawyer is subject." In Idaho those requirements are in Section IV of the Idaho Bar Commission Rules. Rule 402(a)(1) requires "a minimum of thirty (30) credit hours of Accredited Activity in every three (3) year reporting period." Rule 402(a)(2) requires at least three of those credits to be "in courses on legal ethics or professional responsibility," which "may include discussion of the Idaho Rules of Professional Conduct, professionalism and civility, client trust account administration and legal malpractice prevention." Rule 402(a)(3) caps self-study at fifteen credits.⁷

Nothing in Section IV requires a technology or cybersecurity credit. A search of the current text, as of March 9, 2026, for "technolog" and "cyber" finds no match. An Idaho lawyer can satisfy every CLE requirement without a single hour on security. Florida, by contrast, requires that at least 3 of its 30 hours every three years be in approved technology courses. Whether Idaho should do something similar is one of the hard questions at the end of this lesson.⁷³²

No Idaho ethics opinion on technology

The Idaho State Bar's formal opinions page explains that its ethics committee "issued formal ethics opinions from 1944 until the Committee was suspended by the Board of Commissioners in 1994. The last formal ethics opinion issued by the Committee was in 1992." The Board issued one more opinion in 1999 (No. 136, an "Audit Opinion"), and a newer Formal Ethics Opinion 137, announced September 18, 2024, deals with the transition to the State Public Defender system. None addresses cloud computing, email encryption, metadata or data breaches; the only technology-adjacent entry on the list is No. 130 (1989), on recording telephone calls.⁸³³

So when an Idaho lawyer asks "is it ethical to keep client files in a cloud service?" there is no Idaho opinion to cite. The answer comes from Idaho Rule 1.6(c) and Comment [19], Rule 5.3 Comment [3] (which names "using an Internet-based service to store client information" as an ordinary outside service), and the ABA opinions. Bar Counsel's office accepts ethics questions from Idaho lawyers by phone and through an online "Submit an Ethics Question" form; that is guidance for the asking lawyer, not a published opinion.³⁴

The Idaho State Bar's scam alerts

Idaho lawyers are targets, and the Bar has said so in public. Its scam alert page has posted, among others: a December 2, 2025 phishing email impersonating the Bar's executive director and asking for personal information; a June 24, 2025 phishing message impersonating Bar staff and asking members to confirm "preferences for secure communications"; a May 14, 2025 email posing as a district bar officer asking for money; a July 8, 2024 message using the Bar president's name from an illegitimate address; an April 22, 2024 warning that "scammers are sending Dropbox links via email with the eventual goal of getting wire transfers for settlement funds"; and an April 7, 2023 message from someone posing as bar leadership asking for an expense to be paid through a payment app.¹³ Each of these is a reason a reasonably prudent Idaho lawyer "reasonably should know" that impersonation emails aimed at lawyers are routine, which is the Rule 1.0(j) standard.

What the 2023 ABA survey shows

The most recent dedicated ABA cybersecurity report is the "2023 Cybersecurity TechReport" by John Simek, published December 18, 2023 and based on the 2023 ABA Legal Technology Survey. A 2024 or 2025 cybersecurity edition could not be found as of October 28, 2026, so the figures below are from 2023 and should be read with that date in mind. The survey asks individual lawyers about their firms, and response rates and the mix of respondents vary by year, so year-to-year changes are rough signals rather than precise trends.⁹

• Breaches: 29 percent said their firm had ever experienced a security breach, up from 27 percent in 2022. Another 19 percent did not know. The question defined breach broadly, including a lost or stolen computer or phone, a hacker, a break-in or a website exploit.
• Incident response plans: only 34 percent said their firm had one, down from 42 percent the year before. The figure was 78 percent at firms of 500 or more lawyers and 19 percent at both firms of two to nine lawyers and solo practices.
• Cyber insurance: 40 percent reported cyber liability insurance, down from 46 percent in 2022.
• Tools: two-factor authentication was available to 54 percent; file encryption 48 percent; email encryption 42 percent (33.1 percent of solos, 68.8 percent at firms of 500 or more); password managers were used by 33 percent.
• Policies and assessments: 80 percent had at least one technology policy, but only 29 percent reported a full security assessment by an outside party.

For an Idaho reader in a solo practice or small firm, the firm-size breakdown is the number that matters: in those groups fewer than one in five respondents reported an incident response plan. Opinion 483 says lawyers "should consider proactively developing" one. A one-page plan with phone numbers, the insurer's hotline and the first five steps is far better than none, and lesson 5 walks through building it.⁹⁵

From rule to safeguard: what each rule asks for in practice

No Idaho rule and no ABA opinion lists required products. The table below translates each rule into the safeguards a reasonably prudent firm would consider and the evidence that shows the firm made reasonable efforts. It is a planning aid, not a checklist that guarantees compliance; the five Comment [19] factors decide what is reasonable for a given firm and matter. For how to set up the controls, see Identity, Access and Device Control and Accounts, Passwords and Two-Step Sign-In; to organize them under a recognized framework, see Security Frameworks and Standards.

The ABA opinions name most of these tools directly: Opinion 477R lists secure Wi-Fi, VPNs, strong passwords, firewalls, anti-malware, patching, encryption of sensitive transmissions, training and vendor due diligence, and Opinion 498 adds device encryption and multi-factor authentication.⁴⁶ The New York Attorney General's 2023 settlement with a law firm, described below, required encryption, logging and monitoring, patch management, penetration testing and data minimization.¹¹ When a regulator lists the same controls the ABA lists, a firm that has none of them will have a hard time calling its efforts reasonable.

Documented incidents that show why the rules exist

The cases below are drawn from public records and named reports. They are illustrations of how client information leaves law firms, not a full list, and none is an Idaho case. A search of the Idaho State Bar's public records for this lesson found no Idaho discipline or court decision about a law firm data breach; that is not proof none exists.

United States v. Iat Hong (2016): stealing merger secrets from law firm email

On December 27, 2016, the U.S. Attorney for the Southern District of New York announced the arrest of Iat Hong, 26, of Macau, and unsealed a 13-count indictment against him and two others, Bo Zheng, 30, and Chin Hung, 50, for securities fraud, wire fraud and computer intrusion. Prosecutors alleged that the group used "the unlawfully obtained credentials" of an employee at each of two firms to get into the firm's web server, installed malware, and took emails of partners who worked on mergers and acquisitions, then traded on the information before the deals were announced. At least seven firms were targeted, two were infiltrated, and attempts on the other five were made "on more than 100,000 occasions between March and September 2015." Profits were alleged to exceed $4 million. The firms were not named in the release. Then-U.S. Attorney Preet Bharara said law firms "are and will be targets of cyber hacking." The Securities and Exchange Commission filed a parallel civil case the same day.³⁵³⁶ These were charges; the final outcome of the criminal case against Hong was not confirmed for this lesson.

What it shows: the entry point was one employee's stolen login. Multi-factor authentication on remote-facing systems is the single control most likely to stop that pattern, and Opinion 477R specifically lists mergers and acquisitions as high-risk matters.⁴ ABA Opinion 483 cites press reports from the same year that named two large New York firms among those breached.⁵

The Panama Papers (2016): an entire firm's files

Beginning April 3, 2016, news organizations working with the International Consortium of Investigative Journalists published stories from about 11.5 million internal files of the Panamanian law firm Mossack Fonseca, about 2.6 terabytes of data covering more than 210,000 companies in 21 jurisdictions, with records from 1977 through the end of 2015. The firm announced its closure in March 2018. How the files left the firm has never been officially established, and this lesson does not guess.³⁷

What it shows: a firm's whole history can leave at once. Decades of closed files were exposed along with current ones, which is the Rule 1.9(c) point in its starkest form. Whatever one thinks of the public interest in what the files revealed, the leak destroyed the firm. Data minimization (not keeping what you no longer need) reduces what any single leak can expose.

New York Attorney General and Heidell, Pittoni, Murphy & Bach (2023): an unpatched email server

On March 27, 2023, New York Attorney General Letitia James announced that Heidell, Pittoni, Murphy & Bach LLP, a firm that represents hospitals in the New York City area, would pay $200,000 in penalties over a breach. According to the Attorney General, in November 2021 an attacker exploited a vulnerability in the firm's Microsoft Exchange email server for which "Patches for this vulnerability had been released by Microsoft several months earlier," and after malware was deployed in December 2021, the firm found that "tens of thousands of files had been potentially taken." About 114,979 people were affected, including 61,438 New Yorkers, and the data included Social Security numbers, health insurance information and medical information. Notices began in May 2022. The Attorney General found failures in risk assessment, encryption of stored data and data minimization, and cited HIPAA, because the firm handled patient information for hospital clients. The settlement required the firm to keep a written information security program, encrypt data, keep centralized logs accessible for at least 90 days and retained for at least one year, manage patches, conduct penetration testing, and minimize and delete data it no longer needed.¹¹

What it shows: the enforcer here was not a bar. A state regulator treated a law firm like any other business that held personal and health data. The failure was ordinary (patches available for months and not applied), and the fix list reads like the safeguards column of the table above. Firms that receive medical records from hospital clients are often HIPAA business associates; see Healthcare Cybersecurity and HIPAA.

Other reported incidents

• DLA Piper, June 27, 2017: the global firm's phones and computers went down in the NotPetya malware outbreak, and the firm worked with law enforcement and Microsoft over following days to restore systems, according to Law.com International. Cost figures were not confirmed.³⁸
• Grubman Shire Meiselas & Sacks, May 2020: the New York entertainment firm was hit by the REvil ransomware group, which claimed 756 gigabytes of data and raised its demand from $21 million to $42 million, according to Rolling Stone. The firm said it would not pay.³⁹
• MOVEit Transfer, May to June 2023: a criminal group exploited a previously unknown flaw in a widely used file transfer product, and several large U.S. law firms were reported among the victims. The lesson is vendor risk under Rule 5.3: the weakness was in a third party's software.⁴⁰
• Orrick, Herrington & Sutcliffe: after a 2023 breach, a federal judge gave final approval to an $8 million class settlement, reported November 12, 2024; more than 638,000 people received notices.⁴¹
• Bryan Cave Leighton Paisner and Mondelez: the firm and its client agreed to pay $750,000 to settle suits by about 53,000 current and former Mondelez employees whose data was exposed in a hack of the law firm's network, reported October 11, 2024. A client's employees, who were never the firm's clients, sued the firm.⁴²

Who enforces the duty

A security failure at a law firm can lead to three separate kinds of consequence, each with its own decision maker, standard and remedy. They can happen at the same time, and a win in one does not end the others.

Idaho Bar Counsel and the Professional Conduct Board

Lawyer discipline in Idaho runs under Section V of the Idaho Bar Commission Rules, "Rules for Review of Professional Conduct," current as of March 9, 2026. Rule 500(a) states that the Idaho Supreme Court "has the inherent power and the exclusive responsibility within the State to maintain appropriate standards of Professional Conduct." Misconduct under Rule 505(a) includes acts or omissions that violate the Idaho Rules of Professional Conduct.¹⁰

The main players are these:

• Bar Counsel, the Idaho State Bar's disciplinary counsel, appointed by the Bar's Board of Commissioners, who under Rule 504 evaluates, investigates and disposes of grievances and prosecutes cases.
• The Professional Conduct Board under Rule 502, at least thirty members appointed with the Supreme Court's approval, about two-thirds lawyers and one-third nonlawyer Idaho citizens.
• Hearing Committees under Rule 503, three members of the Board for each case: two lawyers and one nonlawyer, with the lawyer members from outside the respondent's judicial district.
• The Idaho Supreme Court, which alone can disbar, suspend or publicly censure.

The process in overview (Rules 509 and 511): anyone may file a grievance with Bar Counsel. Bar Counsel evaluates it and, if the facts alleged would be a violation, investigates. Bar Counsel can dismiss, issue an informal admonition or private reprimand, impose probation, restitution or costs, or, with a probable cause finding and approval from the Board of Commissioners, file formal charges. Either the person who filed the grievance or the lawyer can ask a Hearing Committee to review Bar Counsel's disposition within 14 days. Formal charges go to a Hearing Committee, which hears the case. A Hearing Committee, a committee of the Professional Conduct Board (which alone may issue a public reprimand under Rule 506(e)), can recommend a public reprimand that takes effect unless a party appeals; public censure, suspension and disbarment require a Supreme Court order. Under Rule 525, Bar Counsel bears the burden of proof and "Any issue of fact shall be proved by clear and convincing evidence." Under Rule 521, a matter is confidential within Bar Counsel's office until formal charges are filed and served, and public after that.¹⁰

Public sanctions are posted on the Idaho State Bar's website as they are issued, and public censures are also published in the Idaho Reports, the Bar's official publication and a newspaper in the lawyer's district (Rule 506(d)). Private reprimands and informal admonitions become part of the Bar's permanent files but are not published (Rules 506(g) and (h)).¹⁰⁴³

Two trust-account rules bring cyber fraud into Bar Counsel's view automatically. Under Idaho Bar Commission Rule 1307, banks that hold Idaho trust accounts agree to report to Bar Counsel whenever an instrument is presented against insufficient funds, "irrespective of whether the instrument is honored." Under Rule 1308, Bar Counsel then asks for a written explanation and six months of trust account statements, and an unsatisfactory explanation is investigated "as a disciplinary complaint." A wire fraud or counterfeit check that drains a trust account can therefore start a disciplinary inquiry even if no client complains. And the Client Assistance Fund in Section VI covers losses from a lawyer's own "Dishonest Conduct," capped at $25,000 per instance; a reasonable reading is that a loss caused by an outside criminal, with no dishonesty by the lawyer, does not fit that definition, though no ruling says so.⁴⁴⁴⁵ These rules are covered in lesson 3.

No published Idaho discipline decision about a law firm data breach or impostor wire fraud was found for this lesson. In other states, disciplinary authorities have dealt with wire fraud mostly through trust account rules. The North Carolina State Bar's 2015 Formal Ethics Opinion 6 is the clearest model: a lawyer who manages the trust account properly and is the victim of a counterfeit check or hacking need not personally replace stolen funds, but a lawyer who sent a wire on changed instructions without calling the seller "at the phone number listed in Lawyer's file" had skipped "reasonable security measures that, if implemented, could have prevented the theft" and "must replace the funds stolen by Hacker."⁴⁶ North Carolina opinions do not bind Idaho, but the reasoning tracks Rule 1.6(c)'s "reasonable efforts" test closely.

Malpractice and negligence suits

The Idaho rules themselves say they are not meant to be the basis of a lawsuit. The Scope section, paragraph [20], states: "Violation of a Rule should not itself give rise to a cause of action against a lawyer nor should it create any presumption in such a case that a legal duty has been breached," and that the rules "are not designed to be a basis for civil liability."¹ But a client harmed by a firm's security failure can still sue for negligence or breach of contract under ordinary law, and courts in such cases often look to the rules and opinions as evidence of what a careful lawyer does. Results vary with the facts:

• In Otto v. Catrow Law, PLLC (W. Va. 2020), buyers lost $266,069 after a scammer using an email address different from their real estate agent's sent fake wiring instructions; the state's high court affirmed judgment for the closing law firm because the buyers could not show the firm breached a duty.⁴⁷
• In McCabe v. Talero (N.Y. Sup. Ct. Queens County, March 31, 2025), the buyers' own lawyer's email was hacked and they wired about $171,000 to an impostor; the court found triable questions about whether the lawyer should have warned them sooner and about the buyers' own care, noting the firm's emails had told them to verify wiring instructions by phone.⁴⁸
• In a Connecticut case reported March 14, 2025, a trial judge found a former law firm negligent for failing to secure its email system and not following its own policies after an earlier similar incident, and awarded $90,586 plus interest, according to the plaintiff's law firm. The defendant firm's name and the docket were not confirmed for this lesson.⁴⁹
• Large firms have paid class settlements to people whose data was exposed, including Orrick's $8 million and Bryan Cave Leighton Paisner's $750,000 described above.⁴¹⁴²

Malpractice is decided by judges and juries under ordinary civil standards, and the remedy is money damages. Whether a malpractice policy covers a cyber loss depends on its terms, which is one reason some firms buy separate cyber coverage (40 percent of respondents in the 2023 ABA survey reported having it).⁹ Wire fraud cases and who bears the loss are covered in lesson 6.

Government regulators

Law firms are businesses, and the laws that apply to any business that holds personal information apply to them. In Idaho, a firm that conducts business in Idaho and owns or licenses computerized personal information about an Idaho resident must investigate a breach in good faith and notify affected residents "in the most expedient time possible and without unreasonable delay" when misuse has occurred or is reasonably likely. For a law firm, as for most private businesses, the regulator that enforces Idaho's breach notice statute is the Idaho Attorney General, and an intentional failure to notify can bring a fine of up to $25,000 per breach. The Idaho statute's definition of personal information is narrow (names combined with Social Security, driver's license or financial account numbers), and there is no fixed day deadline.⁵⁰⁵¹ Other regulators can apply depending on the data: the U.S. Department of Health and Human Services for firms that are HIPAA business associates of health care clients, other states' attorneys general for their residents' data (as New York's did against Heidell Pittoni), and contract terms imposed by clients. Breach notice rules are covered in lesson 5.¹¹

Accountants' parallel duties, in brief

CPA firms carry duties that run parallel to the lawyer's. Rule 1.700.001 of the AICPA Code of Professional Conduct, the Confidential Client Information Rule, says: "A member in public practice shall not disclose any confidential client information without the specific consent of the client." An interpretation on third-party service providers (ET 1.700.040) says that before disclosing confidential client information to an outside provider, the member should either have a contract requiring the provider to keep it confidential with reasonable assurance of appropriate procedures, or get the client's specific consent; a related interpretation (ET 1.150.040) calls for telling the client, preferably in writing, before using such a provider for professional services.⁵²

Idaho law adopts these standards for licensed accountants. IDAPA 24.30.01, the Idaho Accountancy Rules administered by the Division of Occupational and Professional Licenses, incorporates by reference "The AICPA Professional Standards as applicable under the circumstances and at the time of the services," and Rule 201.01 says: "A licensee is to protect and not disclose confidential client information obtained in the course of performing professional services, unless the licensee has obtained the specific consent of the client," or of others legally authorized to consent for the client, such as heirs or personal representatives. Idaho Code 9-203A adds an evidence privilege: a licensed public accountant or CPA "cannot, without the consent of his client, be examined as a witness as to any communication made by the client to him, or his advice given thereon in the course of professional employment," with exceptions for Board of Accountancy proceedings and quality review.⁵³⁵⁴

Two differences from the lawyer's rules stand out. The AICPA rule and IDAPA 24.30.01.201 are framed around disclosure and consent; neither has a separate "reasonable efforts" security paragraph like Rule 1.6(c). And for tax and financial work, federal law adds much more specific requirements, including the FTC Safeguards Rule's written information security program and IRS rules for tax preparers. Those are the subject of lesson 4.

What reasonable efforts look like for a three-lawyer Idaho office

Rules and opinions are abstract until you picture a real office. Take a made-up but typical example: a three-lawyer general practice in an Idaho county seat, with two paralegals and an office manager. It does family law, estate planning, small business work and some personal injury. It uses a cloud practice management system, Microsoft 365 or Google Workspace for email and documents, a local IT company on a monthly contract, a scanner-copier, an IOLTA trust account and an operating account at a local bank, and everyone has a smartphone with firm email on it. The firm has never had a breach that it knows of. What would "reasonable efforts" under Rule 1.6(c) look like here?

The steps below are an illustration built from the rule comments, ABA Opinions 477R, 483 and 498, and the controls regulators have required. They are not a safe harbor. The Comment [19] factors decide what is reasonable for any specific firm, and a firm that handles trade secrets or large real estate closings may need more.¹⁴⁶

1. Put one owner in charge, in writing. Rule 5.1 makes every partner responsible for having measures in place. Assign one lawyer to own the security program and report to the others each quarter, and make the office manager the day-to-day coordinator. Write down who decides what, using the roles described in Why Management Owns the Risk.
2. Make a list of where client information lives. Opinion 477R's second heading is "Understand How Client Confidential Information is Transmitted and Where It Is Stored." For this office that list is short: the practice management system, the email and document service, the scanner's memory and scan-to-email settings, the phones, any laptops taken home, the backup service, the bank portals, and the paper files. Include closed files and old devices in a closet.
3. Turn on multi-factor authentication everywhere it exists. Email, document storage, practice management, remote access, bank and payroll portals, the domain registrar and the IT company's remote tool. Prefer an authenticator app or security key over text messages for the accounts that matter most. Opinion 498 names MFA by name. Account takeovers commonly begin with a stolen or guessed password, which is exactly the pattern MFA is designed to stop.⁶
4. Encrypt every device and every backup. Turn on full-disk encryption on laptops and desktops (BitLocker on Windows, FileVault on Mac) and require a passcode and encryption on phones with firm email. Opinion 498 mentions "encryption of data that is physically stored on a device." A lost encrypted laptop is usually an inconvenience; a lost unencrypted one can be a reportable breach.⁶
5. Limit access to what each person needs. Give each person their own login (no shared accounts), separate administrator accounts from daily-use accounts, and use the practice management system's permissions so a matter with special sensitivity (a domestic violence case, a sealed adoption, a firm employee's own matter) is visible only to those working on it. Remove access the same day someone leaves.
6. Keep everything patched. Turn on automatic updates for operating systems, browsers and office software, and have the IT company report monthly on what is not current. The New York firm that paid $200,000 was breached through an email server vulnerability for which patches had been available for months.¹¹
7. Set a firm rule for sensitive transmissions. Decide which kinds of information always go through an encrypted portal or encrypted email (medical records, Social Security numbers, financial account statements, anything a client marks confidential, deal documents), and make it the default in the email system if it supports that. Everything else may go by ordinary email under Comment [20] and Opinion 477R, unless the client asks for more.⁴
8. Write a two-page policy and have everyone sign it. Cover passwords and MFA, acceptable use of firm and personal devices, where client files may and may not be stored (no personal Dropbox, no forwarding to personal Gmail), use of AI tools, working from home (Opinion 498's smart speaker point included), what to do with a suspicious email, and how to report a lost device. In the 2023 ABA survey 80 percent of respondents reported at least one technology policy; the policy is how a firm proves it has "measures" under Rules 5.1 and 5.3.⁹
9. Train everyone, lawyers included, at least once a year and at hire. Rule 5.3 Comment [2] requires instructing assistants about confidentiality; Opinion 477R's sixth heading is training. Cover phishing and fake "new client" emails, wire and trust account fraud, the Bar's own scam alerts, misdirected email and metadata. Keep a sign-in sheet.¹¹³
10. Review the vendors. For the practice management system, the email provider, the backup service, the IT company and any AI tool, keep a one-page record: what client data they hold, what the contract says about confidentiality, security, breach notice and data return at the end, where data is stored, and whether they provide an independent security report such as a SOC 2. Rule 5.3 Comment [3] and Opinions 08-451 and 477R all expect this diligence.¹³⁰
11. Back up so that ransomware cannot reach the copy. Keep at least one backup that is offline or immutable (cannot be changed or deleted for a set period), and test a restore at least twice a year. Opinion 482 ties continuity planning to Rule 1.1.¹⁷
12. Write a one-page incident response plan. Names and cell numbers for the responsible partner, the IT company, the cyber insurer's hotline and the bank's fraud line; the first steps (disconnect, preserve, call); and who decides on client notice under Rule 1.4 and Opinion 483 and statutory notice under Idaho Code 28-51-105. See lesson 5.⁵⁵⁰
13. Lock down money movement. Verify every new or changed wire instruction by calling a number already in the file, never one in the email; use dual approval on the trust account; wait for deposited checks to truly clear before disbursing. This is where small firms lose the most money; see lesson 3 and lesson 6.⁴⁶⁵⁵
14. Tell clients how the firm communicates. Add a paragraph to the engagement letter on communication methods, the risks of employer and shared accounts, and how the firm will never change payment instructions by email. Rule 1.4 and Opinion 11-459 support this.²⁰
15. Decide what to keep and destroy the rest. Adopt a retention schedule that meets the five-year trust record rule and any other legal holds, return or destroy closed files on schedule, and wipe or shred drives from old computers and the copier before they leave the office.¹
16. Review it once a year. Re-read the list of systems, check that MFA and encryption are still on, update the vendor list, and look at what changed in the threats. The Bar's scam alert page and the FBI's public service announcements are free and current.¹³⁵⁵

None of these steps requires a security team. Most are settings in software the office already pays for. Costs vary widely by vendor and region, so get current quotes rather than relying on any published price. The point of Comment [19]'s cost factor is not that small firms may skip security; it is that the measures must fit the firm. For a three-lawyer office, the measures above are what fit.

Common mistakes

• Leaving patches for later. Heidell, Pittoni, Murphy & Bach was breached in 2021 through a Microsoft Exchange flaw for which patches had been out for months, affecting about 114,979 people and leading to a $200,000 penalty in 2023.¹¹
• Relying on a password alone for remote access. In the Iat Hong case, prosecutors alleged the way in was a law firm employee's stolen credentials.³⁵
• Treating closed files as somebody else's problem. The Panama Papers exposed records going back to 1977. Every old file kept is one more file that can leak, and Rule 1.9(c) protects all of them.³⁷
• Assuming a vendor's breach is the vendor's problem. MOVEit was a flaw in a third party's file transfer product, and the law firms that used it had to deal with the consequences. Rule 5.3 makes vendor choice and oversight the lawyer's responsibility.⁴⁰¹
• Wiring money on an emailed change of instructions. North Carolina's 2015 Formal Ethics Opinion 6 held a lawyer responsible to replace funds stolen after the lawyer did not call the seller at the number in the file to confirm a change.⁴⁶
• Not following your own policy. In the Connecticut negligence case reported in March 2025, the court faulted a firm for not following its own policies after an earlier similar incident.⁴⁹ A policy that is written but not followed can be worse than none, because it shows the firm knew what reasonable care required.
• No incident response plan. In the ABA's 2023 survey only 19 percent of respondents at firms of two to nine lawyers and solo practices reported one.⁹
• Sending editable drafts with hidden history. Opinion 06-442 puts the burden on the sender to scrub metadata, and Idaho Rule 4.4 only requires the receiver to notify you if they know or should know it was a mistake.²³¹

Questions people ask

Must Idaho lawyers encrypt all email?

No rule requires it for every message. Idaho Comment [20] says special security measures are not required when a method "affords a reasonable expectation of privacy," and ABA Opinion 477R says lawyers generally may use the internet for client communications if they make reasonable efforts. But 477R also says a lawyer "should encrypt the transmission" of sensitive information and may be required to take special precautions because of the nature of the information, a client agreement or the law. In practice, a firm should have encrypted email or a secure portal available and a rule for when to use it.¹⁴

If our firm is hacked, have we violated the rules?

Not automatically. Idaho Comment [19] says a breach "does not constitute a violation of paragraph (c) if the lawyer has made reasonable efforts to prevent the access or disclosure." The question is whether the firm's efforts were reasonable under the five factors before the breach, and whether it then responded as Rules 1.1 and 1.4 require (stopping the breach, investigating, telling affected clients), as Opinion 483 describes.¹⁵

Can an Idaho firm keep client files in the cloud?

Yes, with diligence. There is no Idaho opinion on point, but Idaho Rule 5.3 Comment [3] names "using an Internet-based service to store client information" as an ordinary use of an outside service, subject to the lawyer's reasonable efforts to make sure the service is compatible with the lawyer's duties. ABA Opinion 477R treats a "well vetted and secure third-party cloud based file storage system" as one way to protect sensitive information. Read the contract, check the security, and know where the data is.¹⁴⁸

Is a lawyer responsible when a paralegal sends files to the wrong person?

The lawyer is not automatically disciplined for an assistant's mistake. Rule 5.3 asks whether the partners made reasonable efforts to have measures in place, and whether the supervising lawyer made reasonable efforts to ensure the assistant's conduct was compatible with the lawyer's duties. A lawyer can be responsible for the conduct itself if the lawyer ordered or ratified it, or knew in time to prevent or reduce the harm and did not act. Training, a written procedure and a prompt response are the evidence that matters. The firm will also owe the client notice under Rule 1.4 if material information was exposed.¹⁵

Can lawyers put client information into AI chat tools?

Only after understanding how the tool handles the data. ABA Opinion 512 (2024) says lawyers should read the terms of use and privacy policy of any generative AI tool, and that informed consent is required before inputting client information into a tool that may disclose it, with boilerplate engagement letter language not enough. Lesson 2 covers this in detail.¹⁶

Does the Idaho State Bar offer help?

Bar Counsel's office takes ethics questions from Idaho lawyers by phone (208-334-4500) and through an online "Submit an Ethics Question" form, and the Bar posts scam alerts on its website. The Bar has not issued a technology ethics opinion, and Idaho's CLE rules do not require technology credits, so most technology learning is up to the lawyer and the firm.³⁴¹³⁷

Can a client ask for more security, or agree to less?

Yes, both. Idaho Comment [19] lets a client require special measures beyond what the rule requires or give informed consent to forgo measures the rule would otherwise require. Informed consent means the client heard the material risks and reasonable alternatives (Rule 1.0(e)); it is best documented in writing, and email counts as writing under Rule 1.0(n).¹

Hard questions

Should Idaho require technology or cybersecurity CLE?

The case for: Comment [8] already says lawyers must keep up with technology risks, but nothing checks whether they do. Florida requires that at least 3 of its 30 hours every three years be in approved technology courses.³² The 2023 ABA survey shows small firms are the least prepared, with fewer than one in five solo and small-firm respondents reporting an incident response plan, and the Idaho State Bar's own scam alerts show Idaho lawyers are being targeted.⁹¹³ A small required number of hours would reach lawyers who would never choose the topic. The case against: CLE hours measure attendance, not skill; a lawyer can sit through an hour of slides and change nothing. Idaho already requires three ethics credits that may cover trust account administration and malpractice prevention, and adding a mandate raises costs for rural and part-time lawyers. Bars could put the same effort into free materials, checklists and practice management help. What the evidence shows: no study located for this lesson compares breach or fraud rates between states with and without technology CLE requirements, so the debate rests on judgment about whether mandated hours change behavior.⁷

Should the rules name specific controls such as multi-factor authentication?

The case for: "reasonable efforts" leaves small firms guessing, and a short list of required controls (MFA, device encryption, patching, backups) would be clear, cheap and enforceable. Regulators already do this: New York's settlement with Heidell Pittoni listed specific controls, and federal rules for tax preparers require a written security program (see lesson 4).¹¹ The case against: the ABA's Ethics 20/20 Commission deliberately declined to list measures because "technology is changing too rapidly to offer such guidance," and a rule written in 2026 could lock in tools that are obsolete by 2030.⁴ A flexible standard lets a one-lawyer estate practice and a firm handling merger work make different choices. What the evidence shows: the ABA opinions have converged on the same few controls for years (477R in 2017, 498 in 2021), and the major incidents in this lesson turned on basic failures such as stolen passwords and unpatched servers. That suggests a short list would capture the most common failures, but no rule of professional conduct in Idaho currently names one.

Should a lawyer whose firm is defrauded or hacked face discipline?

The case for: clients cannot see inside a firm's systems and depend on the bar to enforce minimum care; when a lawyer skips an obvious step, such as calling to verify changed wire instructions, the client bears a loss the lawyer could have prevented. North Carolina's 2015 opinion reflects this view.⁴⁶ The case against: the lawyer is also a crime victim, sophisticated criminals can defeat careful firms, and discipline after the fact risks punishing bad luck. Comment [19] itself says a breach is not a violation if efforts were reasonable, and ABA Opinion 515 recognizes lawyers as targets of crime by fake clients.¹²¹ What the evidence shows: no Idaho discipline decision on impostor fraud or a data breach was found, and outside Idaho the clearest guidance turns on whether a specific reasonable step was skipped, not on the loss itself. That matches the text of Rule 1.6(c).

Who should pay for security in small practices?

One view: security is a cost of practicing law like malpractice insurance and rent, and clients of small firms deserve the same protection as clients of large ones; Comment [19]'s factors already account for cost. Another view: rural and low-fee practices serve clients who cannot afford higher rates, and every added cost pushes some lawyers out of those practices; bars, vendors and insurers should provide more free tools and group pricing. What the evidence shows: most of the baseline controls in this lesson (MFA, device encryption, automatic updates) are included in software the typical small office already pays for, while the larger costs are outside assessments, monitoring and insurance. The 2023 survey found only 29 percent of respondents reported a full outside security assessment and 40 percent reported cyber insurance.⁹

Where to go next

• Idaho State Bar: Idaho Rules of Professional Conduct: The official current text of the Idaho rules and comments, free. Read Rules 1.1, 1.6 and 5.3 with their comments in the Idaho numbering before relying on any summary.
• Idaho State Bar: Bar Counsel: Free. Links to the Submit an Ethics Question form for Idaho lawyers, public discipline notices, trust account overdraft rules and the Client Assistance Fund.
• Idaho State Bar: Scam Alerts: Free. Current impersonation and payment scams aimed at Idaho lawyers; use the posts in staff training.
• ABA Formal Ethics Opinions index: Free list of all ABA formal opinions by date; most recent opinions are free to read, some older ones require ABA membership.
• ABA 2023 Cybersecurity TechReport: Free. Survey results on breaches, plans, insurance and tools by firm size; useful for benchmarking a small firm.
• FBI IC3 warning on counterfeit check scams targeting law firms: Free FBI public service announcement (October 8, 2024) describing the fake debt collection client scam and what to do; report incidents at ic3.gov.
• LawSites tech competence tracker: Free tracker of which states have adopted the technology competence comment and when; a secondary source, useful for comparing states.

Still being checked (11 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• The date Idaho adopted Comment [8] to Rule 1.1 (approved March 17, 2014, effective July 1, 2014) comes from the LawSites tracker; the Idaho Supreme Court order was not found.
• The date Idaho adopted Rule 1.6(c) was not found in a primary source; it was probably part of the same 2014 package.
• The exact day of the ABA House of Delegates vote on the 2012 Ethics 20/20 technology amendments (commonly given as August 6, 2012) was not read in a primary record.
• ABA Formal Opinion 11-459 was read in a copy posted by a law firm, because the ABA copy is members-only.
• The final outcome of the criminal case against Iat Hong was not confirmed.
• How the Panama Papers files left Mossack Fonseca has never been officially established; the April 3, 2016 publication date and March 2018 closure are from press reports.
• No Idaho discipline decision or court case about a law firm data breach or impostor wire fraud was found; that is not proof none exists.
• The view that the Idaho Client Assistance Fund does not cover losses caused by outside criminals is an interpretation of the rule's Dishonest Conduct definition, not a ruling.
• The Connecticut negligence case reported in March 2025 is described from the plaintiff's law firm's account; the defendant firm's name and docket were not confirmed.
• The DLA Piper, Grubman Shire, MOVEit, Orrick and Bryan Cave Leighton Paisner details come from press reports, not court records read for this lesson.
• The 2023 TechReport is the latest ABA cybersecurity survey report found; a 2024 or 2025 edition may exist but was not located.

Last verified October 28, 2026. General education, not legal, ethics, accounting or compliance advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. Idaho State Bar, Idaho Rules of Professional Conduct, Full Text (rules and comments as adopted by the Idaho Supreme Court; the Bar states the text is current as of March 9, 2026), Rules 1.0, 1.1 cmt. [8], 1.4, 1.6 and cmts. [6], [10], [18] to [21], 1.9(c), 1.15, 1.18, 4.4 and cmt. [4], 5.1, 5.3 and cmts. [2] and [3], 5.7, and Scope [20] (read Oct. 28, 2026). Read it online. ↩
2. American Bar Association, Model Rules of Professional Conduct, Rule 1.6, Comments [18] and [19] (text identical to Idaho Comments [19] and [20]) (read Oct. 28, 2026). Read it online. ↩
3. ABA Formal Opinion 99-413, "Protecting the Confidentiality of Unencrypted E-Mail" (March 10, 1999) (read Oct. 28, 2026). Read it online. ↩
4. ABA Formal Opinion 477R, "Securing Communication of Protected Client Information" (May 11, 2017, revised May 22, 2017), including its account of the August 2012 Ethics 20/20 technology amendments (Reports 105A and 105C) (read Oct. 28, 2026). Read it online. ↩
5. ABA Formal Opinion 483, "Lawyers' Obligations After an Electronic Data Breach or Cyberattack" (October 17, 2018), including its citation of 2016 press reports on breaches at New York firms (read Oct. 28, 2026). Read it online. ↩
6. ABA Formal Opinion 498, "Virtual Practice" (March 10, 2021) (read Oct. 28, 2026). Read it online. ↩
7. Idaho Bar Commission Rules, Section IV, Mandatory Continuing Legal Education, Rule 402(a)(1) to (3) (current as of March 9, 2026); text search for "technolog" and "cyber" found no match (read Oct. 28, 2026). Read it online. ↩
8. Idaho State Bar, Formal Ethics Opinions page (committee opinions 1944 to 1992; committee suspended 1994; Board Opinion No. 136, 1999; list searched for computer, electronic, email, technology and confidentiality topics) (read Oct. 28, 2026). Read it online. ↩
9. John Simek, "2023 Cybersecurity TechReport," ABA Law Practice Division (December 18, 2023), based on the 2023 ABA Legal Technology Survey Report; no 2024 or 2025 cybersecurity edition was found (read Oct. 28, 2026). Read it online. ↩
10. Idaho Bar Commission Rules, Section V, Rules for Review of Professional Conduct, Rules 500 to 525 (current as of March 9, 2026; PDF last modified March 9, 2026), especially Rules 500, 501, 502, 503, 504, 505, 506, 509, 511, 521 and 525(d) and (e) (read Oct. 28, 2026). Read it online. ↩
11. Office of the New York State Attorney General, press release on the $200,000 settlement with Heidell, Pittoni, Murphy & Bach LLP (March 27, 2023) (read Oct. 28, 2026). Read it online. ↩
12. Idaho State Bar, "Idaho Rules of Professional Conduct" page ("These rules are current as of March 9, 2026"; history of the 1986 adoption and 2004 revision) (read Oct. 28, 2026). Read it online. ↩
13. Idaho State Bar, Scam Alert posts (April 7, 2023; April 22, 2024; July 8, 2024; May 14, 2025; June 24, 2025; December 2, 2025) (read Oct. 28, 2026). Read it online. ↩
14. American Bar Association, Model Rules of Professional Conduct, Rule 1.1, Comment [8], Maintaining Competence (read Oct. 28, 2026). Read it online. ↩
15. Robert Ambrogi, LawSites, "Tech Competence" tracker of state adoptions of ABA Model Rule 1.1 Comment [8] (lists Idaho as approved March 17, 2014, effective July 1, 2014; secondary source, Idaho order not located) (read Oct. 28, 2026). Read it online. ↩
16. ABA Formal Opinion 512, "Generative Artificial Intelligence Tools" (July 29, 2024) (read Oct. 28, 2026). Read it online. ↩
17. ABA Formal Opinion 482, "Ethical Obligations Related to Disasters" (September 19, 2018) (read Oct. 28, 2026). Read it online. ↩
18. American Bar Association, Model Rules of Professional Conduct, Rule 1.6, Confidentiality of Information, including paragraph (c) (read Oct. 28, 2026). Read it online. ↩
19. American Bar Association, Model Rules of Professional Conduct, Rule 1.4, Communications (read Oct. 28, 2026). Read it online. ↩
20. ABA Formal Opinion 11-459, "Duty to Protect the Confidentiality of E-mail Communications with One's Client" (August 4, 2011); the ABA copy is members-only, and the headnote was read in a copy posted by Hinshaw & Culbertson LLP (read Oct. 28, 2026). Read it online. ↩
21. ABA Formal Opinion 515, "A Lawyer's Discretion to Report When a Client Commits a Crime Against the Lawyer or Against Someone Associated with, or Related to, the Lawyer" (March 5, 2025) (read Oct. 28, 2026). Read it online. ↩
22. American Bar Association, Model Rules of Professional Conduct, Rule 4.4, Respect for Rights of Third Persons (read Oct. 28, 2026). Read it online. ↩
23. ABA Formal Opinion 06-442, "Review and Use of Metadata" (August 5, 2006) (read Oct. 28, 2026). Read it online. ↩
24. ABA Formal Opinion 11-460, "Duty when Lawyer Receives Copies of a Third Party's E-mail Communications with Counsel" (August 4, 2011) (read Oct. 28, 2026). Read it online. ↩
25. ABA Formal Opinion 503, "'Reply All' in Electronic Communications" (November 2, 2022) (read Oct. 28, 2026). Read it online. ↩
26. American Bar Association, Model Rules of Professional Conduct, Rule 5.3, Responsibilities Regarding Nonlawyer Assistance (read Oct. 28, 2026). Read it online. ↩
27. ABA Formal Opinion 506, "Responsibilities Regarding Nonlawyer Assistants" (June 7, 2023) (read Oct. 28, 2026). Read it online. ↩
28. American Bar Association, Formal Ethics Opinions index by issue date (opinions through No. 525, September 2, 2026) (read Oct. 28, 2026). Read it online. ↩
29. ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 95-398, "Access of Nonlawyers to a Lawyer's Data Base" (October 27, 1995) (read Oct. 28, 2026). Read it online. ↩
30. ABA Formal Opinion 08-451, "Lawyer's Obligations When Outsourcing Legal and Nonlegal Support Services" (August 5, 2008) (read Oct. 28, 2026). Read it online. ↩
31. ABA Formal Opinion 511R, "Confidentiality Obligations of Lawyers Posting to Listservs" (May 8, 2024) (read Oct. 28, 2026). Read it online. ↩
32. The Florida Bar, "Continuing Legal Education Requirement" page (30 credit hours every 3 years, "At least 3 of the 30 hours must be in approved technology courses"; page modified September 24, 2026) (read Oct. 28, 2026). Read it online. ↩
33. Idaho State Bar, "Notice of Formal Ethics Opinion" (Formal Ethics Opinion 137, State Public Defender transition), September 18, 2024 (read Oct. 28, 2026). Read it online. ↩
34. Idaho State Bar, Bar Counsel page (ethics questions by phone at 208-334-4500 and the "Submit an Ethics Question" form; information request form for disciplinary records; public discipline notices) (read Oct. 28, 2026). Read it online. ↩
35. U.S. Attorney's Office, Southern District of New York, press release announcing the arrest of Iat Hong and the unsealing of charges against three defendants for trading on information hacked from law firms (December 27, 2016) (read Oct. 28, 2026). Read it online. ↩
36. U.S. Securities and Exchange Commission, Press Release 2016-280, parallel civil charges against three traders over information hacked from law firms (December 27, 2016) (read Oct. 28, 2026). Read it online. ↩
37. International Consortium of Investigative Journalists, "Explore the Panama Papers Key Figures" (11.5 million files, 2.6 terabytes, more than 210,000 companies in 21 jurisdictions, 1977 through 2015). Publication date (April 3, 2016) and the firm's March 2018 closure are from press reports (read Oct. 28, 2026). Read it online. ↩
38. Law.com International, report on the cyberattack that took down DLA Piper's phones and computers (June 27, 2017), and follow-up coverage (read Oct. 28, 2026). Read it online. ↩
39. Rolling Stone, report on the REvil ransomware attack on Grubman Shire Meiselas & Sacks (May 2020) (read Oct. 28, 2026). Read it online. ↩
40. MSSP Alert, report on the Cl0p group's MOVEit attacks on large U.S. law firms (2023, citing RollOnFriday; article undated) (read Oct. 28, 2026). Read it online. ↩
41. ABA Journal, report on a federal judge's final approval of the $8 million class settlement over Orrick, Herrington & Sutcliffe's 2023 data breach (November 12, 2024) (read Oct. 28, 2026). Read it online. ↩
42. ABA Journal, report on the $750,000 settlement by Bryan Cave Leighton Paisner and Mondelez Global of suits by Mondelez employees (October 11, 2024) (read Oct. 28, 2026). Read it online. ↩
43. Idaho State Bar, Notice of Public Discipline page ("Public discipline sanctions are posted to the Idaho State Bar's website as they are issued") (read Oct. 28, 2026). Read it online. ↩
44. Idaho Bar Commission Rules, Section XIII, Trust Accounts, Rules 1301 to 1309, including Rules 1307 and 1308 on overdraft reports to Bar Counsel (current as of March 9, 2026) (read Oct. 28, 2026). Read it online. ↩
45. Idaho Bar Commission Rules, Section VI, Client Assistance Fund, Rules 601(f), 601(j) and 606 ($25,000 maximum per instance or course of Dishonest Conduct) (current as of March 9, 2026). The view that losses caused by outside criminals are not covered is an interpretation of the definition, not a ruling (read Oct. 28, 2026). Read it online. ↩
46. North Carolina State Bar, 2015 Formal Ethics Opinion 6, "Lawyer's Professional Responsibility When Third Party Steals Funds from Trust Account" (adopted October 23, 2015), Inquiry #5 (read Oct. 28, 2026). Read it online. ↩
47. Otto v. Catrow Law, PLLC, No. 19-0361 (W. Va. 2020), summary and opinion at Justia (read Oct. 28, 2026). Read it online. ↩
48. McCabe v. Talero, 2025 NY Slip Op 50597(U) (Sup. Ct. Queens County, March 31, 2025) (read Oct. 28, 2026). Read it online. ↩
49. McCarter & English, "Client Who Sent Money to Fraudster Wins Negligence Suit Against Prior Firm" (March 14, 2025) (plaintiff's counsel's account of a Connecticut Superior Court bench ruling by Judge Juliett L. Crawford; firm name and docket not confirmed) (read Oct. 28, 2026). Read it online. ↩
50. Idaho Code 28-51-105 (notice of breach) and 28-51-107 (fine of not more than $25,000 per breach for intentional failure to notify), Idaho Legislature website (read Oct. 28, 2026). Read it online. ↩
51. Idaho Code 28-51-104 (definitions, including "personal information" and "primary regulator": for commercial entities not otherwise regulated, "the primary regulator is the attorney general") (read Oct. 28, 2026). Read it online. ↩
52. AICPA, Code of Professional Conduct (effective December 15, 2014, updated for official releases through December 2023), ET 1.700.001, 1.700.040 and 1.150.040, as posted by the Minnesota Society of CPAs (read Oct. 28, 2026). Read it online. ↩
53. IDAPA 24.30.01, Idaho Accountancy Rules, Rules 002 (incorporation by reference of AICPA Professional Standards) and 201 (confidential client information), current rules PDF (read Oct. 28, 2026). Read it online. ↩
54. Idaho Code 9-203A, Confidential communications with accountants (read Oct. 28, 2026). Read it online. ↩
55. FBI Internet Crime Complaint Center, Public Service Announcement I-100824-PSA, "Counterfeit Check Scam Targets Law Firms Via Debt Collection Scheme" (October 8, 2024) (read Oct. 28, 2026). Read it online. ↩