ABA Approves Unencrypted Internet E-mail
for Transmission of Confidential Client Information
By Jeffrey A. Cohen, Esq.

E-mail has become an important business tool in today's fast paced business environment. Yet many professionals resist E-mail as a communications tool due to the inherent informality, immediacy and responsiveness that is required. E-mail in business is often fired off without the time effort and thought that is given to other written correspondence. At the same time E-mail has a permanency that raises it's significance above that of a telephone conversation. Encryption solutions present their own difficulties for occasional E-mail.

Many attorneys, as a result, will avoid the use of E-mail and in doing so may rely upon what was formerly a question as to the confidentiality of E-mail and the protection of confidential client information transmitted by E-mail. A recent opinion issued by the American Bar Association Standing Committee on Ethics and Professional Responsibility answers this question and clears the way for your attorney to communicate with clients regularly by E-mail. [ABA Formal Opinion No. 99-413]

The committee explained that the lawyer's duty is to "take reasonable steps in the circumstances to protect such information against unauthorized use or disclosure. Reasonable steps include choosing means of communication in which the lawyer has a reasonable expectation of privacy".

After comparing the typical means of communication between lawyers and clients with E-mail the committee concluded that "A lawyer may transmit information relating to the representation of a client by unencrypted e-mail sent over the Internet without violating [the duty of confidentiality] because the mode of transmission affords a reasonable expectation of privacy from a technological and legal standpoint".

This opinion should convince lawyers that communications by E-mail are sufficiently safe at least for ordinary communications and questions. In spite of the expectation of privacy, however, highly sensitive information may well be better handled by traditional means such as personal delivery or arrangements should be made for an agreed encryption protocol. If regular and extensive sensitive communications are contemplated consideration should be given to a non-Internet based system or Extranet which can provide varying degrees of protection well in excess of unencrypted E-mail.