By Joseph R. Marconi & Brian C. Langs
Johnson & Bell, Ltd.
Chicago 

The future ain’t what it used to be.
— Yogi Berra

Many lawyers are still unaware that effective July 1, 2003, our Supreme Court promulgated rules which conferred protection from professional liability in certain circumstances. Illinois Supreme Court Rules 721 and 722 allow lawyers in Illinois to protect themselves against vicarious liability for legal malpractice committed by other lawyers at their firm provided that the law firm (1) maintains one of the business forms enumerated by Rule 721¹ and (2) maintains the minimum amount of malpractice insurance or other proof of financial responsibility required by Rule 722.

Conditions for Limited Liability Protection

While Rule 721 extends limited liability protection to non-Illinois licensed lawyers and entities who are shareholders, members, or partners of a law firm with an Illinois office, that limited liability protection is conditioned on at least one partner being a member of the Illinois bar. This provision requires a limited liability law firm in Illinois to have at least one partner who is a natural person licensed to practice law in Illinois. Further, an authorized limited liability entity may only practice law in Illinois or maintain an office in Illinois for that purpose after being issued a certificate of registration by the Illinois Supreme Court. A certificate of registration will continue in effect until it is suspended or revoked subject to annual renewal on or before January 31st of each year.

Finally, Rule 721 eliminated vicarious liability for legal malpractice committed by other lawyers at a limited liability law firm as long as the law firm maintains minimum insurance or proof of financial responsibility pursuant to Illinois Supreme Court Rule 722. To evidence proof of minimum insurance or financial responsibility, an authorized shareholder, member, or partner of a limited liability entity must provide an affidavit or a verification by certification under §1-109 of the Illinois Code of Civil Procedure with each application for registration or renewal.

Minimum Insurance or Proof of Financial Responsibility

Rule 722 defines “minimum insurance” as “a professional liability insurance policy applicable to a limited liability entity, and any of its owners or employees, for wrongful conduct.” Minimum insurance must exist, “in one or more policies, with respect to claims asserted during an annual policy period due to alleged wrongful conduct occurring during the policy period and the previous six years.” The minimum amount of insurance is “$100,000 per claim and $250,000 annual aggregate, times the number of lawyers in the firm at the beginning of the annual policy period, provided that the firm’s insurance need not exceed $5,000,000 per claim and $10,000,000 annual aggregate.”

Alternatively, an Illinois law firm may enjoy limited liability status by submitting proof of financial responsibility. To do so, it must evidence funds equaling at least the minimum required annual aggregate for minimum insurance referenced above. Proof of such funds may be in any of the following forms: (1) deposit in trust or in bank escrow of cash, bank certificates of deposit, or United States Treasury obligations; (2) a bank letter of credit; or (3) a surety bond. These funds must be “specifically designated and segregated for the satisfaction of any judgments” against the law firm.

Rules 721 Has No Bearing on Individual Ethical Conduct

Rule 721(b) emphasizes that the Rule “does not diminish or change the obligation of each attorney engaged in the practice of law on behalf of the corporation, association, limited liability company, or registered limited liability partnership to conduct himself or herself in accordance with the standards of professional conduct applicable to attorneys licensed by [the Illinois Supreme Court].”

Personal Liability

Regardless of the business form, a lawyer will always be liable for his own acts or omissions arising from professional legal services. Additionally, a lawyer is liable for acts or omissions of those individuals under his supervision or control. Furthermore, shareholders, partners, managers, or members should take care to strictly comply with entity formalities to avoid individual liability through piercing of the limited liability veil.

The Supreme Court of Illinois provides forms and guidance with regard to firm registration and annual renewal at the following internet address:https://www.state.il.us/court/SupremeCourt/Prof_Serv/default.asp (last visited April 28, 2015).

¹ Ill. Sup. Ct. R. 721 allows a firm to organize as any one of the following business forms: a professional corporation (P.C.), a professional association, a limited liability company (LLC), or a registered limited liability partnership (LLP). Limited partnerships (LPs) and limited liability limited partnerships (LLLPs) are not enumerated in Rule 721, and these business forms are therefore unavailable.

By Joseph R. Marconi & Brian C. Langs⁽¹⁾
Johnson & Bell, Ltd.
Chicago 

E-mail and wire fraud risks increase in a cloud-based world. Data management safeguards can prevent possible legal malpractice from cyber-security breaches.

It’s cloud’s illusions that I recall
I really don’t know clouds at all…
— Judy Collins

Back in July of 2011, we warned of a then popular e-mail/fraudulent check scheme whereby lawyers would receive e-mails from alleged potential foreign clients looking to collect debts from customers. Those scammers convinced the unsuspecting lawyers to deposit fraudulent “settlement checks” into client accounts and wire the “clients’ share” to foreign accounts after the bogus checks cleared. When the frauds were eventually uncovered by the banks, the lawyers were left with liability to the banks for the fraudulent check and wire transfers.² Since then, newer, more complex electronic scams have surfaced whereby hackers intercept e-mails between lawyers and clients that contain wire transfer instructions. After intercepting such an e-mail, the hacker changes the instructions in the e-mail to wire money to his own untraceable account. The hacker forwards his bogus wiring instructions to the unsuspecting recipient, all while “masking” his identity as the sender and making it appear to the recipient as if the instruction came from the correct sender, whether lawyer or client.

Attorneys Present a Target for Sophisticated Hackers & Wire Fraud

Depending on your firm’s sophistication and budget, the type of transaction involved, and the needs of your client, there are some preventative measures that can be considered with regard to protecting your firm and your clients from this and other wire transfer and electronic fraud schemes. Prevention techniques can include hiring a third-party e-mail encryption service provider or sending sensitive wire transfer instructions via facsimile rather than e-mail.³

This and other even more sophisticated electronic scams are becoming more prevalent. Given the confidential and valuable information passed between clients and their lawyers due to the attorney-client privilege, lawyers’ and law firms’ computer and e-mail accounts have become favorite targets. Whether an attorney transfers or stores confidential client information using password-protected corporate e-mail systems, “cloud computing,”⁴ third-party off-site network administrator vendors, third-party hosted e-discovery management platforms, or a variety of other electronic data transfer or data storage solutions available through the Internet, the attorney inevitably faces an inherent risk that confidential client information will be susceptible to theft by a hacker or by an unscrupulous third-party employee. In the absence of reasonable, preventative, and precautionary measures, the lawyer also risks losses for the firm and its clients associated with such a theft.

Understanding how and why lawyers and law firms may be exposed to cybercrime is the first step in prevention. Because of the ever increasing capabilities of cloud computing and, with it, the proliferation of everyday use of mobile devices—such as smartphones, tablets, and laptops—lawyers and law firms put sensitive client material at risk simply by falling asleep on the train home or finishing a brief on the redeye. A misplaced smartphone or briefcase can result in serious consequences if a device ends up in the wrong hands. In addition, mobile devices and both cloud-based and in-firm corporate networks and email systems are susceptible to electronic hacking where a hacker will illegally gain access to electronic information using a variety of more sophisticated methods. Law firms and lawyers present a particularly appealing target for hackers because the mandatory confidentiality of the attorney-client relationship creates a virtual treasure trove of sensitive client information—such as social security numbers, medical information, trade secrets, wire transfer instructions, privileged litigation communications and strategy, and internal corporate strategies—much of which can be very valuable to an array of criminal enterprises.

Professional Obligations of Attorneys in the Cloud

Illinois Rule of Professional Conduct 1.6(a) requires a lawyer practicing in Illinois to make reasonable efforts to ensure the confidentiality of client information, including electronically stored client information.⁵ However, to be competitive in today’s legal services market, lawyers and law firms must utilize the cost-saving and organizational advantages technology allows them to offer recurring and prospective clients. While technology utilization is necessary, the prudent lawyer will also realize that the use of technology to electronically store and transfer sensitive client information necessitates proactive implementation of safeguards that will help in the prevention and defense of this information’s electronic theft. The extent and levels of necessary safeguards will likely be determined by the size of the law firm and its areas of practice, among other considerations. Depending on the specific needs of a firm or solo practitioner, there is a vast selection of cyber security precautions available but every law firm utilizing the technology discussed in this article should at least consider undertaking the following.⁶

Implement Data Management Safeguards

Every law firm should maintain computer-use policies requiring employees to use and routinely update passwords for e-mail, document management systems, mobile devices, and laptops. Intranets, extranets, and Citrix-like virtual desktops also invariably require password protection. In today’s corporate environments, while all networks and company laptops probably employ anti-virus protection, employees using personal laptops to perform work outside of the office must be required to install similar anti-virus protection. Firm policies should include periodic inspections of mobile devices and personal laptops to ensure that employees do not turn off password and/or anti-virus protection functions out of convenience or technical incompetence. Other safeguards may include limiting who may access particular materials electronically and when they may share, print, or alter data. Finally, every firm’s computer-use policy should communicate to its employees, (1) the seriousness of the firm’s confidentiality obligation to its clients, (2) the very real possibility of a cyber-attack, and (3) the procedure for reporting a potential data breach or suspected disclosure.

Address Firm Data Retention Policies

A law firm likely houses an incredible amount of data through its electronic document management system and its corporate network and e-mail system. It should maintain clear policies regarding the length of time certain types of data will be stored, the strength of security to be maintained for certain stored data, and the procedures for eliminating unnecessary or outdated data. Just as a law firm is routinely required to destroy or shred sensitive hard copy materials, it must have procedures in place to completely remove and destroy sensitive electronic data from firm databases and to destroy unwanted or out of date firm equipment that may have housed sensitive information.

In conclusion, attorneys can and should take the necessary precautions to minimize the likelihood of cyber-security breaches, not only to give their clients peace of mind, but also to better shield themselves from third-party and first-party liabilities if a theft of information or other security breach actually occurs.

[1]Joe is a shareholder of Johnson & Bell, Ltd., and the chairman of the business litigation/transaction group and co-chair of the employment group. He appreciates Johnson & Bell associate, Brian C. Langs, for his assistance in the drafting of this article.

[2]For the full article, see Joseph R. Marconi and Victor J. Pioli, Lawyers are Increasingly the Targets of Email/Fraudulent Check Schemes, ISBA Mutual Insurance Company Liability Minute, (July 13, 2011 12:46 PM), http://www.isbamutual.com/liability-minute/lawyers-are-increasingly-the-targets-of-emailfraud.

[3]For more detailed information and recommendations regarding protecting your firm and your clients from e-mail interception and other types of check and wire transfer fraud, see Ronald Trubiana, Title Agents and Lawyers: Be Wary and Protect Yourselves, THE TRUSTED ADVISOR, October 2010, http://www.atgf.com/tools-publications/trusted-adviser/check-and-wire-transfer-fraud-growth-industry (last visited July 25, 2014); ALTA Best Practices Frequently Asked Questions: Best Practices #3: Email Encryption, ATTORNEYS’ TITLE GUARANTY FUND, http://www.atgf.com/tools-publications/alta-best-practices-frequently-asked-questions (last vistied July 25, 2014); Ronald Trubiana, Update from ATG Administration: Five Ways to Reduce Exposure to Wire Fraud, THE TRUSTED ADVISOR, April 2010, http://www.atgf.com/tools-publications/trusted-adviser/five-ways-reduce-exposure-wire-fraud (last visited July 25, 2014).

[4]“Cloud computing” can include receiving and sending e-mails on a smartphone or tablet; using a web-based email platform like Gmail, Yahoo! or Microsoft Outlook Web Access; or using products like Google Docs, Microsoft Office 365, Dropbox, SharePoint intranets/extranets, and Citrix Desktop as a Service (“DaaS”). As Formal Opinion 2011-200 of the Pennsylvania Bar Association Committee on Legal Ethics and Professional Responsibility aptly remarks, “cloud computing is merely a fancy way of saying stuff’s not on your computer.”

[5]See Ill. State Bar Ass’n Adv. Op. Prof’l. Conduct Nos. 96-10, 10-01; see also State Bar Ariz. Ethics Op. 09-04; N.Y. State Bar Ass’n Ethics Adv. Op. 842; Mass. Bar Ass’n Ethics Op.12-03; Pa. Bar Ass’n Form. Op. 2011-200 (all discussing substantially similar versions of subsection (a) of IRCP 1.6, entitled “Confidentiality of Information,” and its applicability to a lawyer’s ethical duty to protect electronically stored or transferred confidential client information).

[6]Much of the content below making particular suggestions for precautionary actions by law firms was taken from two excellent articles: Seth L. Laver, Understanding and Protecting Against Cyber Risk, FOR THE DEFENSE (DRI’s Monthly Magazine), July 2012 at 46–49 and Rene L. Siemens and David L. Beck, Cyber Insurance—Mitigating Loss from Cyber Attacks, PERSPECTIVES ON INSURANCE RECOVERY NEWSLETTER, Summer 2012, http://www.pillsburylaw.com/publications/cyber-insurancemitigating-loss-from-cyber-attacks (last visited July 8, 2014). Both articles are recommended readings that provide detailed discussion of many of the issues raised in this article.

By Joseph R. Marconi & Brian C. Langs⁽¹⁾
Johnson & Bell, Ltd.
Chicago 

Omittance is no quittance.
— Shakespeare

How many lawyers assist a client in forming a corporation, but merely assist in filing the annual reports and do nothing else? Failure to advise of the risk associated with this minimal approach may now more likely result in veil-piercing to reach the client for individual liability.

Illinois courts have long held that the failure to follow corporate procedure may lead to the individual liability of a shareholder, director, or officer. Now, according to a recent case in the Appellate Court for the First District, even a non-shareholder — who is not an officer, director, or employee of a corporation — may be found individually liable for a judgment against a corporation where he exercises only equitable ownership and control over a corporation, even if there were no allegations that he engaged in any wrongdoing in the underlying case.

In John Buckley and Mama Grimm’s Bakery, Inc. v. Haithham Abuzir, 2014 IL App (1st) 130469 (April 10, 2014), a bakery corporation and its individual owner sought to pierce the corporate veil of a pastries corporation to collect a judgment directly from its individual financier and controller. The trial court granted the individual defendant’s motion section 2-615 motion to dismiss because the individual defendant was not a shareholder, director, officer, or employee of the pastries corporation. Plaintiffs appealed the dismissal. On appeal, plaintiffs maintained that the defendant made all the business decisions for the pastries corporation and exercised control over it to such a degree that it amounted to a dummy corporation and alter ego of the individual defendant. The individual defendant made two arguments in defense: (1) Illinois courts only pierce the corporate veil to impose liability on a corporation’s shareholders, officers, directors, or employees, and he was none of these; and (2) he was not party to the underlying action and was therefore deprived of the ability to defend himself against the allegations made against the pastries corporation.

With regard to the latter issue, the First District held that if plaintiffs proved defendant was the alter ego of the pastries corporation, the decision not to defend the underlying suit would have been his own, ipso facto. After acknowledging that the courts and commenters around the country were split on the issue of whether the corporate veil may be pierced to reach non-shareholders and/or those individuals lacking a corporate title at all, the Mama Grimm’s court determined that the majority of jurisdictions have held that a defendant’s lack of shares or corporate title does not preclude veil-piercing. Relying on Fontana v. TLD Builders, 362 Ill. App. 3d 491 (2d 2005), the Mama Grimm’s court further stated that Illinois falls in line with that majority and held that equitable ownership as pleaded by Mama Grimm’s may satisfy the unity-of-interest-and-ownership prong for piercing the corporate the veil, regardless of whether an individual is a non-shareholder or lacks any other formal title within the corporation.

This case clarifies a previously muddy area of Illinois law and requires that closely held corporations undertake every effort to maintain the corporate form. Lawyers should stress to their clients the importance of adequate capitalization, issuance of stock, election of a board of directors, recording of meeting minutes, and other corporate formalities. The simple formation of a corporation is not enough for individual clients to avoid personal liability, even if the individual is not a shareholder, director, or officer of the corporation.

[1] Joe Marconi is a shareholder of Johnson & Bell, Ltd., the head of the Business Litigation/Transactions group and co-chair of the Employment group. He gratefully acknowledges the assistance of Johnson & Bell, Ltd. associate, Brian C. Langs, for the research and drafting of this article.

By Joseph R. Marconi & Brian C. Langs⁽¹⁾
Johnson & Bell, Ltd.
Chicago 

Estate planning often involves multiple professionals who must exchange confidential information regarding their clients’ affairs. The Illinois Court of Appeals provides an insightful opinion regarding when such privileges terminate, who can waive them after the client’s death, and what actions, if any, would put confidential information “at issue” and thus make discoverable.

When an estate planning client dies, the attorney client privilege continues to bind the attorney regarding communications with third parties, just as it did while the client lived. What does change upon the death of a client, however, is the status of that client’s agents — such as accountants, financial advisers, bankers and others who, prior to the client’s death, were privy to confidential communications without resulting in a waiver of the privilege. Because the death of the principal ends the agency relationship, post death communications to such agents become discoverable to third parties.

The Illinois First District Court of Appeals recently examined the effect of the client’s death on privilege claims in Adler v. Greenfield, 2013 IL App (1st) 121066; 2013 Ill. App. LEXIS 323 (1st Dist. May 24, 2013). In Adler an estate planning law firm was sued for malpractice by disappointed third party beneficiaries alleging that the intentions of the testator were not followed to their detriment.

Plaintiffs (beneficiaries) sought both pre and post death communications between the decedents, the law firm, and a bank that assisted the decedents in estate planning. The document requests included direct communications between the attorney and the bank, both before and after the decedents’ death, and between the bank and the decedents. The law firm and the bank both refused to turn over the communications, asserting attorney client privilege. After a lengthy exchange of motions to compel and reconsider, the law firm ultimately refused to turn over a limited number of documents despite a discovery order to do so and requested the imposition of a nominal monetary contempt sanction to permit an appeal. The trial court obliged, and the Court of Appeals reviewed the matter de novo.2

Specifically, the firm withheld 22 documents that were communications with the bank; the bank itself produced five of these, leaving 17 attorney-bank communications at issue. The court’s inquiry centered on the role of the bank as an agent for the decedents — a status that conveyed attorney client privilege protection to its communications with counsel, and which removed the “third party” status that would have otherwise waived the privilege claim. The bank assisted the decedents in formulating an estate plan and eventually became co-executor and co-trustee. Ultimately, the court determined that prior to the decedents’ death, the bank was acting as decedents’ agent, thus bringing communications with their attorney within the privilege. The pre-death communications directly concerned instructions and concerns of the clients expressed through the bank relative to their estate planning. Many began with a clarifying statement, such as, “As you may know [bank] has been assisting [decedents] with their investments … .”

However, after the decedents’ death, that agency relationship terminated, the result being that post-death communications by the attorney to the bank were unprivileged communications with a third party. “[U]nder agency principles, the death of the principal terminates the authority of the agent.” Id. at 1233.

Having found that such pre-death communications fell within the attorney client privilege, the court then examined whether that privilege was somehow waived. Two grounds were offered — that plaintiffs, as successor co-trustees and co-executors of the estate, were the holder of the privilege and could therefor waive it; and, that the attorney’s conduct in representing the estate was at issue in the case. Id. at 1234.

As to the holder of the privilege issue, the court noted that the privilege survives the death of the client. “The only context in which a client’s death might affect the viability of the privilege is a will contest … [because] a decedent would (if one could ask him) waive the privilege in order that the distribution scheme he actually intended be put into effect.” Id. at 1234 [citing Hitt v. Stephens, 285 Ill.App.3d 713, 717-718 (4th Dist. 1996)]. In this case, the issue of which will to enter into probate had been previously determined in another venue, leaving only malpractice claims, “brought by beneficiaries in their individual capacities against [attorney] … [the] estate was not even a party to the action.” Id. at 1235. Indeed, the estate itself suffered no damages, but only the beneficiaries, thus plaintiffs’ status as co-trustee would not have conveyed standing to pursue the malpractice claim in any case. Id. at 1235.

Importantly, as to the argument that the attorney’s representation continued with respect to the decedents’ estate so that the co-trustees now controlled the privilege, the plaintiff “offered no case law and we have discovered none, that would permit a trustee to assert or waive a decedents’ privilege outside the context of a will contest.” Id. at 1235.

With regard to the claim that the attorney’s performance is “at issue”, the court noted that the privilege does not belong to the attorney but to the client. Therefore the attorney may not “waive” the privilege due to his or her own conduct. It is, rather, the client who, by virtue of pleading, puts privileged information “at issue” such as by alleging the time of discovering an injury in the context of the statute of limitations issue.3 Given the analysis in those precedents, “it is the client, not the attorney, that places the attorney’s advice at issue for the purposes of waiving the privilege. Accordingly, we cannot find that [attorney] waived the privilege by placing his conduct at issue.” Id. at 1236.

The lessons of Adler are relatively clear. Most importantly:

• Attorney communications with a client’s agent cease to be privileged upon the death of the client, thus negating the privilege for subsequent disclosures;
• Clearly communicating the context and purpose of communicating with a third party to establish agency is beneficial to establish privilege claims;
• The remaining privilege is not controlled by the beneficiaries or the executor/trustees of the estate except in the sole context of a will contest;
• No action by the attorney, nor any issue raised by anyone but the actual client, can put privileged material “at issue” and thus subject to disclosure.
• The importance of understanding bullet point one cannot be overemphasized. Once your client has joined the Choir Invisible, anything you disclose to anyone outside your office, including, but not limited to, your client’s own agents, relatives, executors, administrators, bankers, accountants or other associates is no longer privileged and is entirely discoverable as a result. While it is true that “dead men tell no tales” — the dead man’s agents may well be compelled to.
  

  ---