AegisAI Perspectives · 055
Five factors decide how much security a lawyer needs for client email: sensitivity, disclosure risk, cost, difficulty and effect on the representation.
Five factors decide it. Comment [18] to ABA Rule 1.6(c) names them: the information's sensitivity, the risk of disclosure without added safeguards, their cost, how hard they are to run, and how much they hinder the work1. On the inbound side, AegisAI investigates every inbound email for what it is trying to do and removes the ones that fail from every mailbox they reached23. An agreement with the client, a law, or the nature of the information can require more.
The factors are one part of what email security for law firms needs to cover. Score each matter on the five factors at intake. It states what the ABA and state bar opinions say and cites them. It is not legal advice, and state rules differ, so check your own state's text.
Start from the baseline and move up only where a factor pushes you.
Start from the baseline. Unencrypted email is sufficient for routine communications of normal or low sensitivity when basic security methods are in place4. The ABA lists four: secure Wi-Fi or a VPN; unique complex passwords changed periodically; firewalls and anti-malware; regular patches5.
Score sensitivity. Industrial designs, mergers and acquisitions, trade secrets, health care, banking, defense and education matters may present a higher risk of data theft14. The US Court of International Trade guide says social security and driver's license numbers cannot be sent electronically without encryption, and neither can financial account numbers17.
Score the likelihood of disclosure. Check the Texas Opinion 648 circumstances, from a shared account to a public computer9. The North Carolina Bar Association says that on a shared device or account, the email must stay encrypted until the recipient opens it with a username and password they created12.
Price the safeguard and test how hard it is to run. Cost and difficulty are factors in their own right. For other attachments with PII or NPI, password protection with at least 8 characters is the floor, and the password goes by phone or secure messaging13.
Check the effect on the work. A safeguard that makes a device or important software excessively difficult to use weighs against it.
Ask the client and check the law. Model Rule 1.4 may require the lawyer to discuss safeguards with the client15. Lawyer and client then decide whether high level encryption or personal delivery is warranted. A client may require special measures, or give informed consent to forgo ones the rule would require19.
Write the scores down and set a review date. Texas Opinion 648 says the evaluation of email technology and practices should be ongoing10.
AegisAI inbound email security reads mail through the Microsoft 365 or Google Workspace API after delivery, with no change to MX records24. Its AI agents investigate every inbound email for what it is trying to do. Messages that fail are removed from every mailbox they reached. Every verdict comes with its reason in plain language, so the firm's team can check it and share it25.
Each factor becomes one question at intake, with the answer that points to more security beside it.
| Factor | Question for the matter | Points toward more security | Source |
|---|---|---|---|
| Sensitivity | What kind of information will the email carry? | Trade secrets, health care or banking matters; account or social security numbers | ABA Journal on Opinion 477R; US Court of International Trade |
| Likelihood of disclosure | Who else can reach the client's inbox or device? | A shared account, a known password, a work account, a public computer | Texas Opinion 648 |
| Cost | What does the added safeguard cost, and who pays? | Low cost; the cost can pass to a client who asks, under N.H. Rule 1.5(a)20 | New Hampshire Bar Association |
| Difficulty | Can the client and the lawyer run it? | A method both can use, such as a password sent by phone | North Carolina Bar Association |
| Effect on the representation | Does it make the work excessively hard? | Little effect on devices or key software | ABA Formal Opinion 477 |
Illustrative example, figures are fictional. Marlow and Reyes, a fictional 9 lawyer family law firm, opens a divorce matter. The client reads email on a family laptop, and her spouse knows the password. Intake scores the factors. Sensitivity is high, because the financial disclosure carries account numbers. Likelihood of disclosure is high, because a third person knows the password. Cost is low and difficulty is medium. The effect on the representation is low. The partner and the client agree in writing that financial records go only as encrypted messages that open with a username and password the client creates. Two encrypted statements go out, each opened with the client's own credentials. In week 2, an email that appears to come from opposing counsel asks the paralegal to confirm a new account for settlement funds. She calls the number in the file, and the request is false. The matter file now holds the scores and the written instruction, with a review date 90 days out.
Because Rule 1.6(c) requires a lawyer to make reasonable efforts to prevent unauthorized disclosure of, or access to, client information, in the words of New Hampshire's version11. In 2017 the ABA issued Formal Opinion 477R, which updates Opinion 99-413 on unencrypted email from 19997. The duty covers efforts and does not require encrypting everything. Texas Opinion 648 says a lawyer may generally send confidential information by email8. How far those efforts go is set matter by matter, as reasonable efforts to protect client email under ABA Rule 1.6(c) explains.
NIST SP 800-177 Rev. 1 names the standards22. SPF, DKIM and DMARC authenticate the sending domain. TLS protects mail in transit. S/MIME encrypts and authenticates message content. Encryption protects the message, not the mailbox. If a third party obtains an attorney's username and password, encryption does not stop them reading the inbox16. Multi-factor authentication and frequently changed passwords remain critical18. For attachments, password protection is the minimum for PII or NPI.
Missed phishing raises the likelihood of disclosure, one of the five factors. If a third party obtains a lawyer's username and password, encryption does not stop them reading the inbox. A false negative is a harmful message the firm's filters let through. Ask any inbound email tool to show its missed messages on your own mail during a trial, with the reason behind each verdict. Then close the payment path: the FBI advises verifying any request to change account information through a secondary channel or two-factor authentication21.
Warn the client and move sensitive email to a channel the third party cannot open. Opinion 477 says privilege and confidentiality may be waived when a client uses devices that a third party can access or control, and the lawyer must decide whether to warn the client3. Texas Opinion 648 lists a third person, such as a spouse in a divorce case, who may know the password, and a client's work account among its triggers. The North Carolina Bar Association adds that on a shared device or account, the email must stay encrypted until the client opens it with credentials they created.
Check six items, then compare them with the scores on your open matters.
Track these three shares weekly.
Five, from Comment [18] to Model Rule 1.6(c): sensitivity, likelihood of disclosure without added safeguards, cost, difficulty, and the effect on the lawyer's ability to represent the client. A client agreement or a law can raise the level on top of them.
Generally no, in the ABA's view. Unencrypted email is sufficient for routine messages of normal or low sensitivity when basic security methods are in place. Texas Opinion 648 reaches the same view for confidential information sent by email. Encryption comes in where a factor or a trigger calls for it.
Yes. A client may require special security measures that the rule does not. In New Hampshire the cost can pass to the client under Rule 1.5(a), and a lawyer may consider withdrawing if the demands are too onerous.
The lawyer may need to explain the cost of enhanced measures and obtain the client's informed consent before using them. Write the client's decision into the engagement letter or the matter file.
No. Whoever holds the attorney's username and password reads the inbox whatever the encryption. Multi-factor authentication is a critical control for that risk.
Texas Opinion 648 says the evaluation of email technology and practices should be ongoing, because the risk of interception may change over time. A dated review in each matter file shows when it was last done.
