Cloudy Ethics

• Author: Jason Tashea
• Pages: 30-32

30 || ABA JOURNAL APRIL 2018

SHUTTERSTOCK

Business of Law

||

SPECIAL EDITION

WITH A FUNERAL HOME IN ASHES and a n

insurance company refusi ng to pay benefits, the last

thing you’d expect to hear a bout is online security and

the cloud.

But that’s exactly what happ ened in 2014 when the

Holding Funeral Home lost a building in Ca stlewood,

Virginia , to a fire and Harleysville In surance Co. refused

to pay out the claim, alleg ing misrepresentation and

other issues.

During the invest igation, security video foota ge of the

incident was shared bet ween the insurer and the National

Insurance Cri me Bureau through the cloud storage ser-

vice Box. The investigat or who created the account didn’t

password-protect it . Pretty soon that account cont ained

the entirety of the plai nti’s case file, including priv ileged

information. Anyone who ha d a link could access it.

Sure enough, the opposing counsel s mistakenly

received acces s. After downloading the ent ire file,

the funeral home’s attorney s saw everything, including

privileged docu ments, but they did not notify the insur-

er’s attorneys, thi nking that privilege had be en waived.

At first, the insu rer and its lawyers seemed out of luck.

In 2017, U.S. Magistrate Judge Pamela Meade Sargent sided

with the funera l home’s attorneys in Harleysville Insuran ce

Co. v. Holding Funeral Home and de termined the failure to

limit permissions a nd create a password did waive priv ilege.

She wrote that it wa s “the cyberworld equivalent of leaving

its claims file on a bench in t he public square and telling its

counsel where they could find it .”

Luckily for the insurer, U.S. Dis trict Judge James P. Jones,

on appeal, rejected t he magistrate’s reasoning. Jones con-

cluded that the disclosure w as inadvertent and the unique

URL of 32 randomly ass igned characters created by B ox,

which was needed to a ccess the account, made it “impo ssible

for anyone, let alone a particu lar person connected with t he

case, to ac cidentally stumble across the Box folder.”

While failing at c ybersecurity basics , the judge determined

that the insurer ha d acted reasonably and priv ilege hadn’t

been waived.

BE REASONABLE

Whether for personal or professiona l applications, remote

storage has become t he standard for millions of Americ ans.

However, this and other internet-en abled technologies can

Lawyers have an ethical duty to safeguard clients’ confidential

information—a task that’s become more complicated as the cloud

becomes more ubiquitous By Jason Tashea

Cloudy Ethics