AegisAI Perspectives · 034
ABA Formal Opinion 477R does not require law firms to encrypt all client email; it requires reasonable efforts, with encryption for high risk information.
No. ABA Formal Opinion 477R does not require encryption for every client email. It applies the reasonable efforts duty of Model Rule 1.6(c)11, and it keeps unencrypted routine email acceptable8. Encryption is warranted in some higher risk situations10. AegisAI investigates every inbound email for what it is trying to do2, because encryption does not stop someone who holds the attorney's password14.
The opinion is one control among several in what email security for law firms needs to cover.
Classify the information, agree the channel with the client, secure all mail, encrypt the sensitive tier, then check inbound mail and record it. Eight steps cover the email part of the opinion.
Classify client information by sensitivity. Comment [18] to Rule 1.6 lists the factors: sensitivity, likelihood of disclosure without added safeguards, cost of safeguards, difficulty of implementing them, and the effect on the lawyer's ability to represent clients6.
Ask each client about security at intake. A client may require special security measures, or give informed consent to a channel the rule would otherwise prohibit7. Put the answer in the engagement letter.
Keep basic measures on all mail. Unencrypted email is acceptable only where the firm has basic and reasonably available security measures in place9. A US Court of International Trade guide names a firewall and password protection of devices and accounts13.
Encrypt the sensitive tier. Particularly strong measures, like encryption, are warranted in some higher risk situations. LawPay's summary of the opinion lists encryption among the safeguards for client information12.
Publish SPF, DKIM and DMARC for the firm's domain. NIST SP 800-177 Rev. 1 recommends all three to authenticate a sending domain16. DMARC lets the receiving side apply your policy and send reports back17.
Check every inbound message for what it asks. A third party with the attorney's username and password reads the inbox whatever the encryption level. Business email compromise aims at a transfer of funds19.
Train staff on the signs. The UK National Cyber Security Centre points to a short deadline to respond and threats of fines or other negative consequences22.
Review the technology each year. Comment [8] to Rule 1.1 asks lawyers to keep abreast of the benefits and risks of relevant technology5. Write the review date in the file.
AegisAI reads mail through the Microsoft 365 or Google Workspace API after delivery, as its inbound email security page describes1. It investigates every email for what it is trying to do and removes the ones that fail from every mailbox they reached. One bad email is pulled from every inbox it reached, forwards included4. Every verdict comes with its reason in plain language, so the firm's team can check it and share it3.
The tier sets the safeguard. The table maps each tier to the measure and the text that supports it.
| Tier of client email | Safeguard | Basis |
|---|---|---|
| Routine messages (scheduling, status updates) | Unencrypted email with basic, reasonably available measures | Opinion 477R on routine email |
| Higher risk information | Particularly strong measures, like encryption | Factors in Rule 1.6 comment [18] |
| Client asked for special measures | The measure the client set, in writing | Rule 1.6 comment, quoted in the opinion |
| Every inbound message | SPF, DKIM and DMARC checks, plus a read of what the message asks | NIST SP 800-177 Rev. 1 |
| Every lawyer and staff member | A dated, written review of the firm's technology | Rule 1.1 comment [8] |
A matter passes when its tier and the client's instruction sit on file next to the safeguard.
Illustrative example, figures are fictional. A 30 lawyer firm takes on a merger client. Intake records the client's instruction: deal documents travel encrypted, scheduling email does not. Six weeks in, a paralegal's mailbox login is phished. The attacker reads the inbox and sends the client a request to wire $85,000 to a new account. Encryption on outbound documents did nothing here, since the attacker held the password. An inbound check flagged the request because it changed payment instructions from a mailbox that had never sent one. The firm's file holds four records for the matter: tier, client instruction, settings, review date.
It says unencrypted routine email generally remains acceptable. It then adds a condition: the firm must have basic, reasonably available security measures in place. Where the risk is higher, strong measures such as encryption are warranted. The duty underneath is Rule 1.6(c): reasonable efforts to prevent unauthorized disclosure of client information.
Routine email is acceptable when basic, reasonably available measures are in place. A US Court of International Trade guide says routine client communications do not require message encryption. Encryption becomes the expected measure when the factors point to high risk, and it is required when the client demands it.
Five factors from Rule 1.6 comment [18] decide it. Weigh the sensitivity of the information and the likelihood of disclosure without added safeguards. Then weigh the cost of the safeguard, the difficulty of putting it in place, and its effect on the lawyer's ability to represent the client. Write each factor's answer down per matter.
Rule 1.6 comment [18] judges a safeguard by five factors, and none of them names a mail architecture. The test is the same for any tool: does it meet those factors for the information at stake? An API-based tool connects through the Microsoft 365 or Google Workspace API after delivery. Judge any option by what it checks on each inbound message and what record it leaves.
Check what each message asks, because encryption does not stop a person who holds the account password. Business email compromise needs no attachment: it asks for a transfer of funds. In 2025 the FBI's IC3 received 24,768 business email compromise complaints20, with $3,046,598,558 in reported losses21. The steps to stop a payment change are in how to prevent business email compromise.
Track three numbers.
No. It applies the reasonable efforts standard of Rule 1.6(c). Unencrypted routine email stays acceptable where basic security measures are in place. Encryption is warranted for higher risk information.
Not by itself. The opinion says unencrypted routine email generally remains acceptable. The violation risk comes from sending sensitive information without the safeguards the factors call for.
Yes. A client may require special security measures that the rule does not require. Record the instruction in the engagement letter and apply it to every message on that matter.
No. If a third party has the attorney's username and password, encryption will not stop them reading the inbox. Inbound checks and account controls cover that risk.
Rule 1.1 comment [8]. It asks lawyers to keep abreast of the benefits and risks of relevant technology. A yearly written review of email settings is one way to show it.
