ABA Formal Opinion 477R: Risk Factors and Security Measures

ABA Formal Opinion 477R tells lawyers that no single method of electronic communication is automatically safe for client information. Issued in 2017 to replace Formal Opinion 99-413, it requires a case-by-case analysis of each communication and security measures scaled to the sensitivity of the information involved. Unencrypted email is still acceptable for routine matters, but the opinion draws its authority from Model Rules 1.1, 1.4, and 1.6 to reject the idea that any default channel covers every situation.¹

What Changed From Opinion 99-413

In 1999, the ABA concluded in Formal Opinion 99-413 that a lawyer could send unencrypted email without violating the Model Rules because email offered “a reasonable expectation of privacy from a technological and legal standpoint,” comparable to regular mail and landline phone calls.

Opinion 477R doesn’t discard that conclusion. It acknowledges that the basic premise “remains true today for routine communication with clients, presuming the lawyer has implemented basic and reasonably available methods of common electronic security measures.” But it draws a sharp line: “cyber-threats and the proliferation of electronic communications devices have changed the landscape and it is not always reasonable to rely on the use of unencrypted email.”¹ Communication through mobile apps, message boards, or unsecured networks may lack even the baseline expectation of privacy that email provides.

The opinion is anchored in Model Rule 1.6(c), which requires lawyers to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”² It also draws on Model Rule 1.1 and its Comment 8, which folds technology competence into the duty of competent representation: a lawyer must “keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology.”³

The practical translation is straightforward. A routine scheduling email through a standard account with basic security is still fine. Trade secrets, medical records, or litigation strategy sent over an unsecured channel is not. The lawyer’s job is to figure out which situation applies before hitting send.

The Five Factors Lawyers Must Weigh

Opinion 477R directs lawyers to apply the five factors from Comment 18 to Model Rule 1.6(c) every time they evaluate a communication method. These factors are non-exclusive, but every assessment should address at least the following:

Sensitivity of the information. A draft press release and a client’s psychiatric records call for very different protection. The more damaging the exposure would be, the stronger the safeguards must be.
Likelihood of disclosure without additional safeguards. A file sent over a firm’s internal encrypted network carries different risk than the same file emailed from a coffee shop’s public Wi-Fi.
Cost of additional safeguards. Encryption software, secure client portals, and VPN subscriptions all cost money, and a sole practitioner handling a low-stakes matter operates under different constraints than a large firm on a major merger.
Difficulty of implementing the safeguards. A tool that is impractical to configure is not a realistic option.
Impact on the lawyer’s ability to represent clients. If a security measure makes critical software “excessively difficult to use,” it may cause more harm than the risk it addresses.¹

The opinion is emphatic that this analysis happens on a “case-by-case basis” and that lawyers must “constantly analyze how they communicate electronically about client matters.”¹ New clients, new matters, and new technology each trigger fresh analysis.

Security Measures That Match the Risk

The opinion identifies categories of safeguards without prescribing a rigid checklist. The right combination depends on where the five-factor analysis lands for a given matter.

Encryption

Opinion 477R describes encryption as a “particularly strong protective measure” that is “warranted in some circumstances.” It states that “if client information is of sufficient sensitivity, a lawyer should encrypt the transmission and determine how to do so to sufficiently protect it.”¹ For matters of normal or low sensitivity, standard methods at reasonable cost may suffice. For the most sensitive information, the opinion suggests a lawyer may need to avoid electronic transmission altogether.

Networks and Devices

Firewalls and anti-malware software form perimeter defenses and need regular updates. Public Wi-Fi at hotels, airports, and coffee shops is among the riskiest environments for transmitting client information. A VPN encrypts the connection between the device and the VPN provider, preventing others on the same network from seeing the data. Opinion 477R specifically calls out “unsecured networks” as places where the baseline expectation of privacy breaks down.¹

Laptops, phones, and tablets that hold client data need strong passwords or biometric locks. Remote-wipe capability lets a lawyer erase data from a lost or stolen device, and the opinion identifies this as part of a reasonable security strategy.¹

Client Portals

Encrypted client portals offer meaningful advantages over standard email for sensitive documents. Portals encrypt data in transit, create audit trails that record when a client viewed or downloaded a file, and centralize case communications in one place. For matters at the top of the sensitivity scale, directing a client to a secure portal is substantially safer than emailing an attachment that then sits indefinitely in an inbox.

When You Need to Talk to the Client

For routine communications using standard security, Opinion 477R does not require special permission from the client. Model Rule 1.4, however, requires lawyers to “reasonably consult with the client about the means by which the client’s objectives are to be accomplished” and to explain matters well enough for informed decisions.⁴ When a matter involves information so sensitive that standard methods are inadequate, the lawyer must discuss the risks and obtain informed consent before choosing a communication method.

The same obligation runs in the other direction. If a client insists on an insecure method, unencrypted text messages for a matter that clearly warrants more, the lawyer must explain the risks, advise against the practice, and document the conversation. If the client still wants to proceed, that choice should be memorialized in writing.

Supervising Staff and Vetting Vendors

A lawyer’s duty to secure electronic communications does not end at their own keyboard. Model Rule 5.1 requires partners and supervisory lawyers to “make reasonable efforts to ensure that the firm has in effect measures giving reasonable assurance that all lawyers in the firm conform to the Rules of Professional Conduct.”⁵ Model Rule 5.3 extends the same principle to nonlawyer staff, requiring “reasonable efforts to ensure that the person’s conduct is compatible with the professional obligations of the lawyer.”⁶ Paralegals, legal assistants, IT staff, and temporary contractors who handle client files must follow the same security protocols the lawyers do. A firm that encrypts every lawyer’s email but lets a paralegal send unencrypted documents from a personal Gmail account has failed this obligation.

Third-party technology vendors sit inside the same reasonable-efforts standard. Cloud storage, practice management software, and communication platforms all involve handing client data to an outside company. Before signing a contract, investigate whether the vendor has experienced a data breach, how any past deficiencies were addressed, and what levels of encryption are offered for sensitive data.

The contract matters as much as the vendor’s reputation. Key provisions to negotiate:

Liability for breaches. Watch for licensing terms that try to eliminate the vendor’s own liability if client data is compromised, and make the vendor responsible for its subcontractors’ privacy and cybersecurity conduct.
Data breach notification. Specify how quickly the vendor must notify the firm of a breach and what the notice must include.
Exit strategy. Require return of all client data in a usable format on termination, set the timeline and cost, and require secure deletion of remaining copies.
Data location and jurisdiction. Address where data is stored and which laws govern disputes.

Cost should not be the primary factor when choosing a vendor for client data. The cheapest option frequently cuts corners on the features that matter most.

If the Communication Method Fails

Opinion 477R governs the front end: choosing and using communication methods that meet the reasonable-efforts standard. When a breach happens anyway, a separate opinion takes over. ABA Formal Opinion 483, issued in 2018, builds on the same Model Rules and adds post-breach obligations, including notification to current clients when there is a reasonable possibility that the breach negatively affects their interests. State data breach statutes and, where health information is involved, federal rules under HIPAA or the FTC’s Health Breach Notification Rule may impose their own reporting duties independent of the ethics rules.⁷ Lawyers building a compliance program around 477R should treat Opinion 483 as its companion on the response side.

1
American Bar Association. ABA Formal Opinion 477R Securing Electronic Communications
2
American Bar Association. Model Rules of Professional Conduct Rule 1.6 Confidentiality of Information
3
American Bar Association. Model Rules of Professional Conduct Rule 1.1 Competence – Comment
4
American Bar Association. Model Rules of Professional Conduct Rule 1.4 Communications
5
American Bar Association. Model Rules of Professional Conduct Rule 5.1 Responsibilities of a Partner or Supervisory Lawyer
6
American Bar Association. Model Rules of Professional Conduct Rule 5.3 Responsibilities Regarding Nonlawyer Assistance
7
Federal Trade Commission. Data Breach Response A Guide for Business