Lawyers hope some COVID-19 changes remain permanently
In mid-March, the COVID-19 pandemic swept the globe and health authorities quickly recommended social distancing. This new society norm effectively mandated an unprecedented transition from office to remote work for lawyers and law firms.
“I don't think we've ever engaged in an exercise like this where so many businesses and so many organizations are working remotely,” says Lisa Lifshitz, a partner in Torkin Manes LLP's business law group, who specializes in technology and privacy law.
Working from home raised two urgent questions: Technologically, were firms and lawyers ready to transition without disrupting workflow while protecting cybersecurity and client confidentiality? And what toll would these near-house-arrest-like conditions have on the well-being of lawyers and staff? But these uncertainties aside, some lawyers saw the sudden reliance on technology and the sense of freedom remote work provided as a long-overdue innovation.
With nearly all Canada’s white-collar workforce suddenly operating off home Wi-Fi networks, there were concerns about whether the internet could even handle the tectonic shift, says Lifshitz. Netflix even pitched in to ease Canadian bandwidth by lowering its streaming quality. The new normal put lawyers and their home-work arrangements on the menu for hackers, says Lifshitz. Licking their lips, cybercriminals see employees working at home like a hyena sees a baby gazelle who’s been detached from the herd.
“People aren't stupid. The hackers are definitely going to see this as an opportunity to engage in further nefarious activity,” says Lifshitz. “There'll definitely be more spoofing and phishing. . . . So that's definitely going to be a concern.”
And the transition was imposed in short order. Although companies were supposed to be training their staff to work cyber-safely at home, the reality was many hadn’t and were forced to perform unrehearsed, she says.
Aside from the added vulnerability of working from home, in general, lawyers and law firms are uniquely vulnerable to cybercriminals, says Fazila Nurani.
“[Law firms] have a lot of sensitive information. They are, I think, a prime target for a lot of identity thieves and hackers,” says Nurani, a lawyer, consultant and trainer in privacy, information-management and cybersecurity, as well as founder of PRIVATECH.
The sophistication of cybercriminals is such that they’ve graduated from the level of “kid in the basement” to “big business,” says Monica Goyal, a lawyer who advises clients in tech and engineering and adjunct professor at Osgoode Hall Law School, where her focus is law and technology. Also growing in sophistication, clients are increasingly requesting cybersecurity accountability, she adds, and many have cybersecurity audits in their contracts. Now the question is how they will maintain that security after sending the lawyers home, says Goyal.
One way law firms operate remotely is through the cloud. Karim Jinnah is a lawyer and president and co-founder of LexCloud.ca, a cloud IT service for law firms. He spoke with Canadian Lawyer about the main cybersecurity considerations for remote working.
“For confidential information such as lawyers’ client data, we recommend strict security including saving only a central server instead of across multiple computers and devices,” Jinnah says. “A well-managed virtual desktop is ideal for this, as data is never saved locally and is always encrypted in transit.”
“And, of course, two-factor authentication, which ensures hackers can’t access your account even if they obtain your user name and password, is a must.”
Larger firms typically have VPN connections, so lawyers work off the firm’s network from anywhere and they usually have controls that prevent users from downloading content onto their personal device, says Goyal. Small firms and sole practitioners without the same infrastructure need to have policies around passwords, information backup and the downloading of sensitive information on private devices, she says. Goyal adds that employees need to be trained to spot phishing emails and bad cheque scams.
“All lawyers should be aware of these issues. Sometimes, lawyers take the approach: ‘Oh, the IT department will do it.’ . . . But I think, in this day and age . . . you have to have some of those IT skills yourself so that you can not be taken advantage of,” she says.
Steven Cooper, a partner at Cooper Regel, which has offices in Yellowknife and Sherwood Park, Alta, says that in transitioning to remote-work for a small-to-medium-sized firm without an inhouse IT department, it’s important to contract out to a company that specializes in law.
“There's lots of very competent IT people out there on their own or even in large companies who do not have a sufficient appreciation for the practice of law,” Cooper says. “The notion of jack of all trades is very dangerous. And for cybersecurity, you have to be working with a firm or a person, at least, that has a particular expertise in the practice of law.”
Cooper Regel is a member of Masuch Law and focuses on Indigenous law, corporate and commercial litigation, administrative and tribunal law, residential school and abuse claims. The firm is active in Northern Canada, and Cooper notes that in serving remote communities, the transition away from face-to-face was less relevant north of 60.
“Our practice in the North has always been 80-per cent-remote,” he says. “We do almost all of our applications by telephone in Nunavut and almost the same amount in the Northwest Territories. We're used to dealing with staff and clients remotely.
“Our client base for particularly Edmonton, Sherwood Park and Yellowknife office is mostly people far away often who we rarely lay eyes on other than on Skype or Zoom and FaceTime,” he says.
When COVID-19 hit and Canada went home, Cooper says, his firm was around six months away from full remote capability, using a cloud service. The firm’s corporate minute books are available through a secure platform it is integrating with its cloud system along with its real estate files. Cooper and his colleagues are “waiting with bated breath” for the registries to accept electronic signatures. Within the pandemic, he says, there is an opportunity to modernize the profession.
“If necessity is truly the mother of invention, I think what I'm hearing through the practice and through our firm and otherwise is that the practice of law will never be the same,” Cooper says. “We are finally updating systems that just didn't seem to have had the desire or the initiative to modernize.
“It's modernizing a profession [that] takes far too much pride in doing things like their grandmothers and grandfathers did. And that's true not just at big firms but also small firms,” he says.
Tara Vasdani’s passion for remote work was conceived when she watched an Economist documentary about “digital nomads,” people who travel around the world while working remotely. She became fascinated by the legal implications of the novel workplace relationship and has been a remote-work advocate ever since, helping organizations around the world understand and transition to remote work. She says that, while the big four banks, for example, have adopted remote infrastructure, law firms seem less enthusiastic.
“Lawyers are a little bit different, where the industry is used to client-facing products and services. And it's very, very archaic in that face time and physical mentorship and things like that are still extremely entrenched in the practice,” she says.
This is a problem, Vasdani says, because consumers are more focused on efficiency than detail. Raised on the instant gratification of modern technology, they want answers now, she says.
Slow adaptation of the remote-work capability that’s being more quickly adopted in other industries also has cybersecurity implications, says Vasdani. Going remote reactively rather than proactively means lawyers and staff don’t have a ready-made infrastructure and are using their personal devices.
“But setting up remote-work infrastructure should be the last thing that needs to be on the radar right now. That should have been done a long time ago and I'm pretty disappointed in the law firms that were unable to take advantage of that,” she says.
Being forced to work from home raised the issue of maintaining focus among new distractions —including children who were on the same social-distancing regime — and the mental health toll from physical isolation. It is important for law firms to build and reinforce those systems that keep people connected and engaged socially, says Ryan Baker, director of recruitment and professional development at Bereskin & Parr LLP.
“Seeing another person's face is something that you sort of take for granted when you work in an office,” says Baker.
Though seemingly a hassle, there is a hidden benefit in a commute. It often involves a lot of physical activity and mental preparation time, Baker says.
“When you are going from bed to couch or bed to a little home office, it's very different,” he says.
The pandemic has highlighted the utility of law firm mental health initiatives, says Bereskin & Parr partner Isi Caulder. March’s introduction of social distancing happened to arrive directly after Bereskin & Parr’s mental health week. It has continued to do weekly group mindful meditations and other social gatherings over WebEx, says Caulder, who’s a member of the electrical and computer technology practice group, co-leader of the AI practice group and the leader of the Cleantech practice group.
Moving to work-from-home has also highlighted the utility of firm programs such as diversity and inclusion committees and mentoring, says Caulder. The sense of belonging fostered in these efforts has acted as a cohesive force during the transition, she says. Baker adds that the social separation gives impetus to proactively “go the extra mile” in reaching out to colleagues to check in and see how they are doing.
“What’s going on right now really just does remind you that your people are the most important thing that you have and our priority — other than making sure that technology systems are in place and that client work isn't impacted — is making sure that our people are safe, engaged, happy and productive,” says Baker.
