1. The Duty of Confidentiality Now Includes Digital Defense

Lawyers still imagine confidentiality as keeping quiet in elevators.
But digital confidentiality is a completely different beast.

It requires:

• Encryption
• Secure storage
• Access controls
• Reasonable security measures
• Regular updates
• Monitoring for suspicious activity

Confidentiality isn’t just about not telling secrets.
It’s about ensuring the systems holding those secrets don’t spill them out the side door.

The bad guys don’t need you to talk. They need you to click.

2. MFA: The Annoying Hero We Don’t Deserve but Definitely Need

Yes, multi-factor authentication (MFA) is annoying.
But so is explaining to a client why their merger documents are now publicly available on the dark web.

When lawyers resist MFA, it’s usually because:

• “It slows me down”
• “My phone isn’t nearby”
• “I’ve never been hacked before”
• “I’m sure IT has this covered”

MFA is not an inconvenience. It’s an ethical safeguard.

Remember: the attacker only needs to be right once.
You need to be right every day.

3. Remote Work: Great for Lawyers, Great for Hackers

The pandemic taught lawyers they could practice from anywhere.
Unfortunately, hackers learned the same thing about hacking.

Remote work introduces risks like:

• Public Wi-Fi
• Outdated home routers
• Family devices on the same network
• Unknown USB drives
• Personal laptops doubling as workstations

When your home office becomes a law office, your living room becomes a security perimeter.
Most living rooms were not built for that.

4. Ransomware: The Digital Hostage Situation No One Trains Lawyers For

Ransomware used to be something people heard about on the news.
Now it hits law firms of every size.

When ransomware strikes:

• Client notification decisions
• Ransom payment pressure
• Unclear data exposure
• Backup reliability
• Clear leadership

Firms without an incident response plan have one plan: panic.

5. Encryption: The Seatbelt of Digital Practice

Most firms treat encryption like flossing.
They know they should do it — they rarely do it consistently.

Encryption should be applied to:

• Devices
• Email
• File storage
• Backups
• Cloud systems

The Ethical Bottom Line

Cybersecurity is no longer a technical issue managed in a back room.
It’s an ethical obligation woven into competence and confidentiality.

Cybersecurity is part of the practice of law now.
If you’re practicing without it, you’re practicing with the lights off.