Perspectives by Sally Vazquez-Castellanos, Esq.
Published on November 3, 2025.
This morning’s discussion with ChatGPT…
ABA’s Reasonableness Standard in Security
Technology has transformed law practice in America. The American Bar Association’s (ABA) Formal Opinion 512 (2024) on Generative AI extends long-standing ethical principles to new tools that permeate research, drafting, and communication.
In spite of all of the excitement surrounding artificial intelligence, the Metaverse and those cool shades that may take the optical industry to new heights, the truth is that courts and attorneys must traverse these areas at a much slower pace. There are several important reasons why that would be which includes assessing risks in privacy and security as well as balancing individual privacy and fundamental rights against threats to our nations security.
Meanwhile, there’s an ethical foundation that has not caught up to the notion of the transformative nature of technology—sometimes with very good reason. It takes time and a solid body of laws, regulations and guidelines for attorneys to grasp where all of this is going to play out across our legal system.
For example, lawyers are bound by several important duties that include competence (Rule 1.1), confidentiality (Rule 1.6), communication (Rule 1.4), and supervision (Rules 5.1 & 5.3). The difference is these duties apply across complex systems—AI engines, cloud platforms, client portals—that were once the domain of IT specialists, not attorneys.
The challenge for the modern bar is that not all lawyers have the same resources to meet these obligations. Given the current threat environment, that’s not necessarily a bad thing. In a lawyer’s sanctuary, international regulations that led to the Cloud Act and changes at the Department of Commerce (DOC) in the United States sends a resounding message that technology adoption may need to be implemented with great care—if at all. The same may hold true for the use of smartphones in practice when it comes to handling client data.
Lessons from Panama Papers and DLA Piper
The 2016 Panama Papers breach at Mossack Fonseca revealed how out-of-date web systems and poor patch management could expose clients globally. A year later, DLA Piper’s ransomware attack demonstrated that even firms with advanced infrastructure are vulnerable.
These events highlight the gap between large institutions with full-time security teams and smaller practices that rely on affordable, commercially available tools.
For the solo practitioner, “reasonable security” can be quite different from a multinational’s security architecture. It means using available, trustworthy technology prudently, documenting decisions, and staying informed.
What “Reasonable Security” Means in Practice
The ABA and most state bars associations interpret “reasonable security” as a process, not perfection. Lawyers must make reasonable efforts to safeguard client information in proportion to their practice, the sensitivity of client matters, and ultimately make a decision based on whether it would be practical to implement these measures. Once again—a decision not to adopt these technologies may prove to be the wisest course of action depending on your particular area of practice. It’s always best to consult seasoned professionals as well as having some kind of understanding with respect to international transfers of data and the current regulations at DOC.
Reasonableness may include:
Using reputable cloud or software vendors with built-in encryption and routine patching (as discussed—cloud system adoption and smartphone usage requires a great deal of research, care and prudence before you proceed). Given the rise of identity theft across the nation, we may need things like multi-factor authentication and secure-sharing practices but ongoing threats and vulnerabilities continue to increase in one form or another.
We are all learning that it is important to keep operating systems and applications updated. Understanding basic GAPP Principles (Generally Accepted Privacy Principles) such as avoiding unnecessary data collection, prolonged retention of data, and proper storage and disposal of personal information for clients are all extremely important. Equally important is to embrace adoption of an appropriate security posture for your law firm and to ensure that your service providers are meeting your firms standards for IT services, which includes shoring up agreements with all of your providers.
Reasonableness may not require an enterprise level budget. What is required is shoring up your knowledge in data protection, security and encryption methods for your area of practice.
Understanding the Cloud Environment and its Controversies Post 9-11
Attorneys working in criminal defense, immigration, family law, and juvenile or dependency matters face unique risks. Client information in these fields is highly personal, often subject to confidentiality statutes, and can carry life-altering consequences if compromised.
For such practices, adopting AI or cloud-based systems prematurely—or without full control—may increase attorney exposure. Every attorney should understand the adoption of a cloud environment and how it might impact your practice. The answers may not be found in a discussion over foundational provisions of your cloud services agreement. Please do your homework before adopting any service or provider for handling client information.
Some Information Technology (IT) advice may include considering the storage of client data locally or in a private cloud where practical. Control encryption keys directly rather than delegating them to a vendor. Avoid feeding client facts into public AI tools whose training or retention policies are opaque.
For some lawyers, the most ethical and competent choice may be to refrain from using these technologies.
Even so, abstaining from AI or advanced cloud services does not make anyone immune. Email, mobile devices, and even court-mandated e-filing systems expose practitioners to constant risk. The difference lies in managing those risks consciously and documenting why certain tools were adopted—or avoided.
The Cloud Question: Promise, Pressure, and Unequal Readiness
Cloud computing is now mainstream in law, but it remains controversial. Large firms tout scalability and 24-hour patching; solos see dependency, cost, and lost control. Both are right.
In criminal or family matters, cloud replication can trigger cross-border and privacy concerns. The EU-U.S. Data Privacy Framework, rooted in President Biden’s Executive Order 14086 (2022), restored data-transfer adequacy between the U.S. and EU, but its stability remains uncertain in the wake of the Schrems II decision.
Meanwhile, the CLOUD Act (2018) still authorizes U.S. authorities to compel production of data stored abroad by U.S. companies. For lawyers, this means that client files hosted in a public cloud could be reachable under warrants or subpoenas beyond their control.
The ethical baseline is simple but demanding: if a lawyer uses cloud services, they must understand the platform’s security, jurisdiction, and retrieval rights. If that knowledge or control is unattainable, opting out is a reasonable exercise of competence—not resistance to progress.
The Uneven Burden of AI Governance
AI is arriving unevenly across the legal system. A handful of large firms are deploying vetted, closed-domain AI models; others are experimenting under supervision; most small firms are still weighing the risks. State bars, public-defender offices, and family courts are themselves struggling to draft clear guidance.
Until funding, oversight, and reliable vendor governance are widespread, lawyers in sensitive or resource-limited practices are justified in proceeding slowly—or not at all. Prudence is not backwardness; it is fidelity to the core duty of care.
Who’s on Your Phone Today?
Every lawyer’s phone is now an extension of the law office. IBM’s 2025 Cost of a Data Breach Report found the average U.S. breach now costs $10.22 million, and nearly 97 percent of AI-related incidents occurred where access controls were weak. Sixty-three percent of organizations still lack formal AI-governance programs.
Cyber risk is universal—but so is responsibility. Enable multi-factor authentication. Use strong passphrases. Know which apps access your contacts and files. Security begins with awareness, not expense.
A Realistic Standard for an Unequal Profession
The ideal of “reasonable security” must be grounded in economic and institutional reality. Not every lawyer can—or should—compete with corporate cybersecurity budgets. But every lawyer can act with care, humility, and documentation.
Ethical competence in 2025 means knowing your limits, understanding your tools, and protecting client trust within those limits. Whether practicing in a multinational office or a small coworking space, the same principle applies: technology serves justice only when guided by judgment.
Sources
American Bar Association, Formal Opinion 512: Use of Generative Artificial Intelligence in the Practice of Law (July 29 2024).
ABA Formal Opinion 477R (2017); Model Rules 1.1, 1.4, 1.5, 1.6, 5.1, 5.3.
ABA Law Practice Division, Law Firm Guide to Cybersecurity (2024).
IBM Security, 2025 Cost of a Data Breach Report and X-Force Threat Intelligence Index 2025.
European Court of Justice, Data Protection Commissioner v. Facebook Ireland & Max Schrems (Schrems II) (2020).
White House, Executive Order 14086 (Oct 7 2022); Executive Order 14117 (Feb 28 2024).
U.S. Congress, Clarifying Lawful Overseas Use of Data (CLOUD) Act (2018).
WIRED, “The Security Flaws at the Heart of the Panama Papers.” BBC News, “DLA Piper Ransomware Attack Shows Law Firms Are Prime Targets.”
Legal Disclaimer
This blog post is for informational purposes only and does not constitute legal advice. Reading this article does not create an attorney-client relationship. For advice about your specific legal matter, please consult a qualified attorney.
About the Author
California’s Attorney and Shareholder at Los Angeles-based family law firm Castellanos & Associates, APLC. Focuses on legal issues at the intersection of children’s privacy, global data protection, and the impact of media and technology on families.