Summary
In a recent trademark infringement case, an attorney shared a Zoom hearing link with their client's overseas consultant who then improperly posted the link on social media, allowing unauthorized individuals to access the proceeding. While the court found this incident did not waive privilege, the judge warned that future breaches could result in serious consequences, and advised parties to implement robust security measures to protect the confidentiality and integrity of virtual hearings.
Here is the article, formatted in HTML:Case Background
The COVID-19 pandemic forced courts around the world to rapidly transition from in-person proceedings to remote video hearings. While remote court appearances have enabled the wheels of justice to keep turning during this public health crisis, they have also introduced a host of new cybersecurity risks. A recent case in the United States District Court for the Southern District of New York highlights the importance of properly securing remote court proceedings.
In this trademark infringement lawsuit, the defendant corporation was represented by outside counsel admitted pro hac vice. When the case proceeded to a preliminary injunction hearing held via Zoom, the defense attorney provided the remote hearing link to an overseas consultant of the defendant company so they could observe the proceedings. However, unbeknownst to the attorney, the consultant then shared the Zoom link on social media. As a result, an unknown number of unauthorized individuals were able to eavesdrop on portions of the hearing.
Upon discovering this serious breach, the presiding judge halted the hearing and ordered both parties to submit briefing on whether the consultant's actions constituted a waiver of attorney-client privilege and work product protections. The judge emphasized her "concern[s] about confidentiality and security in a virtual environment," noting that "even the most carefully crafted protective order is useless if the parties' representatives do not abide by it."
Key Legal Issues
This case raises critical questions about cybersecurity obligations in the context of remote court proceedings:
1) What level of security is required when conducting virtual hearings?
2) Who is responsible for ensuring the security of remote court appearances?
3) What are the potential consequences of security breaches during virtual proceedings?
Maintaining security and confidentiality is essential for the integrity of the judicial process. Sensitive information is routinely discussed during hearings, including confidential business information, trade secrets, personal medical details, minors' identities, and more. Protective orders are commonly used to prevent the disclosure of such information. However, those orders must be supported by reasonable security measures, especially in a virtual environment where it can be more difficult to control access.
Courts have an obligation under the Fifth and Fourteenth Amendments to ensure proceedings meet due process requirements, which encompass the right to a fair and public trial (while still protecting sensitive information as appropriate). The Sixth Amendment also guarantees a defendant's right to a public trial in criminal cases. Additionally, Federal Rule of Civil Procedure 43(a) and Federal Rule of Criminal Procedure 53 govern the use of remote testimony and virtual proceedings. Thus, courts must strike a careful balance between security, confidentiality, and public access when conducting remote hearings.
Attorneys also have ethical duties under the ABA Model Rules of Professional Conduct and state bar rules to protect their clients' confidential information. Model Rule 1.6(c) requires lawyers to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client." The ABA has issued guidance stating that these reasonable efforts include using secure videoconferencing platforms and following best practices for safeguarding sensitive data.
The Court's Decision and Rationale
After reviewing briefing from both parties, the judge held that the consultant's unauthorized sharing of the Zoom hearing link did not waive privilege or work product protections. The judge found that defense counsel acted reasonably and could not have anticipated the consultant would improperly disseminate the access information, especially after counsel had orally instructed them to keep the link confidential.
However, the judge issued a strong warning to counsel about the necessity of maintaining virtual hearing security. She noted that going forward, any further breaches could potentially result in waiver of privilege or even sanctions. The judge advised the parties to treat remote proceedings "with the same gravity and care as you would proceedings in the courtroom" and to implement protocols to prevent unauthorized access, such as:
- Using secure, encrypted videoconferencing platforms
- Password-protecting meetings
- Authenticating participants' identities
- Using waiting room features to admit only authorized individuals
- Providing written instructions about confidentiality obligations to all attendees
- Monitoring the participant list to identify any unauthorized users
- Removing or blocking unauthorized users from accessing the proceeding
The judge also recommended that counsel proactively discuss security expectations with their clients and any third parties who may attend virtual hearings. While the rapid shift to remote proceedings caught many off guard, courts and lawyers must now implement reasonable security measures as a regular part of practice.
Implications for Law and Practice
This case serves as a critical reminder that "Zoom bombing" and improper disclosure of remote hearing information is a serious issue with potentially significant consequences. All participants in the judicial system have a part to play in safeguarding the security and integrity of virtual proceedings:
Courts should establish clear, consistent protocols for remote hearing security. Protective orders dealing with confidential information should specify requirements for how that information must be protected in a virtual environment. Courts may wish to use secure, enterprise-grade videoconferencing software that offers more robust security features than free or consumer-oriented products. Court staff should be trained on security best practices and know how to quickly remove unauthorized users or terminate a compromised meeting. Where appropriate, courts should offer public access through separate, view-only live streams rather than interactive meeting links.
Attorneys must take proactive steps to maintain client confidentiality during remote court appearances. Lawyers should have explicit conversations with clients and any permitted third parties (like expert witnesses or consultants) about their obligation to keep hearing information secure. Access links should only be provided to individuals who have agreed in writing to abide by all protective orders and confidentiality rules. Counsel should retain control over who can access meetings (e.g. by serving as "host" and manually admitting participants) and be prepared to promptly remove anyone who is not authorized to attend.
Parties, witnesses, and other participants must understand that remote hearings are official court proceedings with the same expectations of decorum, integrity, and confidentiality as in-person appearances. Hearing links and other access information should never be shared with unauthorized individuals. If a participant becomes aware of a potential security breach, they should promptly inform the court and the attorneys so remedial measures can be taken. Circumventing court security protocols could lead to serious penalties.
The legal system's reliance on remote proceedings is likely to continue even after the pandemic ends. While virtual hearings offer greater convenience and flexibility, they also come with increased data security responsibilities. By implementing sensible security measures and remaining vigilant to potential vulnerabilities, courts and lawyers can harness the benefits of remote technologies while still preserving the fairness, reliability, and integrity of the judicial process.
References
Here are the references I could find in the article, with some uncertainty:- Federal Rule of Civil Procedure 43(a) (governs the use of remote testimony and virtual proceedings in civil cases)
- Federal Rule of Criminal Procedure 53 (governs the use of remote testimony and virtual proceedings in criminal cases)
- ABA Model Rule of Professional Conduct 1.6(c) (requires lawyers to make reasonable efforts to prevent unauthorized disclosure of client information)
For more insights, read our Divorce Decoded blog.