Legal Process Outsourcing (LPO): Addressing Security Concerns

A major concern for law firms that are consideringfact that most providers are obligated to keep the
whether or not to take the legal process outsourcingidentity of their clients confidential makes it difficult for a
(LPO) plunge is that of data protection. Clientfirm to ascertain whether a current adversary is
confidentiality is so rooted in the legal culture, and isoutsourcing work to the same provider.
such a fundamental aspect of professional legal ethics,Protections for the outsourcing firms can certainly be
that the mere notion of a pair of eyes glimpsing dataput into place. First and foremost, the contract
from across the Atlantic and Pacific oceans sendsbetween provider and client should make it absolutely
shivers up the spines of many lawyers. Yet the ironicclear that the provider must inform the client as soon
part is that there is a group of entities whoseas it learns of any possible conflict issues.
obsession with security issues may make that ofSecond, the firm should make sure that the provider it
attorneys seem a trivial thing - the outsourcingchooses is able to clearly articulate - and, if possible,
companies themselves. The building and maintaining ofdemonstrate - the security safeguards it has
relationships with current and future clients is theimplemented to ensure the validity of the process.
lifeblood for service providers.These safeguards should be included in the statement
As outsourcing becomes more widespread andof work agreement, in list format, along with the
competition in the marketplace grows, the ability toadditional provision that the security devices must be
illustrate the existence (and continued use) of powerfulmaintained for the breadth of the contract. Thus
safeguards will increasingly become one of thedetermination of liability of the contracting parties for
significant factors for companies that are decidingany security breach that results in measurable
which provider to link up with. Consequently, the leadingdamages will be easier to ascertain.
outsourcing companies take security concernsThird, due to the fact that technology and business
extremely seriously, which may explain why manyprocedures must often become intertwined in order
domestic studies have shown that the outsourcingfor the outsourcing process to run efficiently, the
process is no less secure, and may in fact be evensecurity program used by the vendor should exist on
more secure, than having the same servicesboth the physical and virtual levels for it to be as
performed in-house.comprehensive as possible. It would be somewhat
Process fidelity is definitely necessary in the legalcontradictory for an outsourcing company to rely on
arena, but this needs to be placed in perspective. Whilethe fact that the production staff for two adverse law
legal documentation does sometimes consist offirms exists in separate offices, on separate floors or
sensitive information, the sensitivity often stems fromeven in different cities. The very premise behind the
the defining characteristics of litigation and practiceoutsourcing process is that physical separation is not a
procedures. Law firms are no different from othercomplete bar to the sharing of information - as such, a
companies in that they do not like to have theircompany cannot on one hand praise the concept that
business practices broadcasted to the general public.geographical differences are no longer barriers to the
However, concerning the type of damage that can beexchange of information and data, while relying strictly
caused by leaking of information, legal data is inon geographical barriers as the only security measures
general substantially less sensitive than other types ofput in place by the company. There is no doubt that
data that have been outsourced for years on aphysical separation of the production staff for adverse
massive scale. When the fact that large banks,businesses is a good step; however, virtual separation
financial institutions, and even the IRS are outsourcingis needed as well in order to create a robust security
on an extended basis, the entire issue of datamodel.
protection insofar as LPO is concerned is put intoImportant questions that law firms may need
clearer perspective. Suddenly, summons andanswered before an outsourcing program is initiated
complaints and discovery materials take on a wholeinclude: How does the provider structure their
new light when attorneys digest the fact thatproduction units? Are these units separated, and if
extensive credit histories, records of financialthey are, along what lines does the separation occur?
transactions and tax forms are being processed byWhat is the architecture of the physical premises
the millions overseas.where the work takes place? What kind of office
However, this is not to say that legal information shouldequipment exists in that location? What types of things
not be afforded the highest degree of protection,are prohibited from being brought to the work site?
especially regarding issues of conflict of interest. TheWhat tracking and auditing features are used in the
legal community is one that is tightly bound togethertechnology that allows the process to take place?
and thrives on the flow of information betweenWho is responsible for the tracking and auditing? The
affiliates and adversaries. On a regular basis, membersgeneral rule of thumb is that if the question is important
of the defense bars network with members of theenough for the attorney to ask, then it should be
plaintiff bars. Moreover, many of the same lawyersincluded in the written contract.
frequent the same courtrooms in the same venues,Once the above questions and issues are addressed
and attend the same continued legal educationto the inquiring firm's satisfaction, the ties can be
courses and alumni events. Thus in order to beloosened and the dress shoes put on the desk,
supremely effective, outsourcing models must placebecause one major aspect of the outsourcing
great emphasis on separation of competing interests.phenomenon has been resolved. True, other issues do
The question therefore becomes: How can a law firmabound, but this one is a biggie. If the security concerns
be assured that they are not outsourcing work to acan be alleviated, then one huge step has been taken
company that is also working on the same matter fortowards reaching the ultimate goal of commencing a
opposing counsel? While the chances of this happeningmutually beneficial business relationship.
may be somewhat slim, it is still a viable concern. The