The Public Link and the Urgent Email
Paralegal Owen works at a 12-person firm. Client files are kept in a personal Dropbox account that a partner created using his own Gmail address and shares by link. While looking for a deposition transcript, Owen opens a folder labeled 'Smith_v_Alderman' and sees that the link setting is 'Anyone with the link can view.' The folder holds about 1,400 documents, including medical records, a settlement memorandum, and a client's Social Security number. Later that afternoon Owen receives an email that appears to be from the same partner, sent from a slightly different domain, asking him to send the 'Smith settlement memo' and the client's SSN to a 'new expert' at a Gmail address by 5:00 p.m. The partner is in a deposition all day.
1. What should Owen do first about the publicly viewable folder?
Read the worked answer
First priority: stop the exposure, then preserve the evidence
- Report to the partner and to whoever handles firm IT immediately, in writing. This is not a 'mention it Monday' item.
- Change the folder's sharing setting from 'anyone with the link' to restricted, and, if the account allows it, revoke the existing link. That is a security fix, not destruction of evidence.
- Before or while doing that, preserve the access log and the sharing settings - screenshots with timestamps, the link's creation date, and any record of who accessed it. Without the log, nobody can tell whether the 1,400 documents were downloaded, which determines whether notification is required.
- Do not delete the folder, do not delete the Dropbox account, and do not 'test' the link by sending it to someone outside the firm.
Why it matters - Rule 1.6(c) requires the lawyer to make reasonable efforts to prevent unauthorized access to client information. Medical records and an SSN in a publicly viewable folder is the paradigm case. The firm may have notification duties under state breach statutes and obligations under its malpractice or cyber policy; identifying which clients are affected is the attorney's job, and the access log is what makes it possible.
2. How should Owen handle the email requesting the settlement memo and the client's Social Security number?
Read the worked answer
Treat it as phishing until proven otherwise
- Red flags: a slightly wrong domain, urgency with a 5:00 p.m. deadline, a request for an SSN and a privileged settlement memo, and a 'new expert' on a free email service.
- Do not reply, do not forward, do not click any link or open an attachment, and do not send the memo or the SSN - not even an 'is this really you?' reply to the same address.
Verify out of band - Call the partner's known cell number or walk to her office; do not use the phone number or address in the email.
Even if the instruction is genuine, it is a problem - Sending a client's SSN and a settlement memorandum to an unverified Gmail address, to a person with no engagement letter or confidentiality agreement, raises Rule 1.6 disclosure issues and Rules 5.1 and 5.3 supervision issues. The correct path is to route the request through the attorney, confirm the expert is actually engaged and bound by confidentiality, and transfer the documents by a secure method.
Preserve and report - Keep the email with full headers for the investigation, report it to IT and the partner, and expect a password reset and MFA enrollment on the partner's account if there is any sign the credentials were compromised.
3. What are Owen's broader professional obligations and what should he propose to the firm?
Read the worked answer
Owen's own duties
- Report up the chain, in writing, and keep a copy. Rule 5.3 governs the firm's responsibility for nonlawyer staff, but Owen also has an independent professional duty not to participate in, or conceal, a known risk to client confidences.
- Do not unilaterally migrate 1,400 files to a new platform, rename the folder, or reorganize anything. Moving client files without direction risks breaking the chain of custody and losing metadata the firm may need.
- Do not discuss the discovery with other staff or clients. Gossip about a breach is itself a secondary disclosure.
What to propose, with reasoning
- Firm-controlled storage on a business account, with unique credentials, multi-factor authentication, and role-based access - not a partner's personal Gmail-linked Dropbox.
- A written retention and access policy, plus a documented offboarding step so departing staff lose access.
- Encryption for anything leaving the firm, and a rule that SSNs and medical records never travel by ordinary email.
- A short training session, because the failure here is habits, not hardware. Rule 1.1, comment 8 makes technology competence part of competence; a firm storing privileged medical records in a public folder is not meeting it.
If nothing changes - Escalate to another partner or the firm's general counsel. A pattern of ignoring known risks is exactly what a malpractice plaintiff will point to, and Owen's contemporaneous written report is both a protection and an obligation.