A lawyer working from a home office, a client’s conference room, or an airport lounge between hearings is still bound by the same duty of confidentiality that applied at the firm’s own server room. The setting changed. The obligation didn’t.
The rule that already covers this
Most attorneys know Model Rule 1.6 requires reasonable efforts to protect client information from unauthorized disclosure. Fewer connect it directly to a laptop on hotel Wi-Fi or a phone tethered to a coffee shop hotspot. The American Bar Association’s Standing Committee on Ethics and Professional Responsibility addressed the remote practice question directly in Formal Opinion 495, and Comment 8 to Model Rule 1.1 goes further, treating an understanding of relevant technology risks as part of basic competence rather than an optional extra. In practice, that means a lawyer who sends a draft settlement agreement over an unsecured network isn’t just taking a personal risk. They’re taking one on behalf of a client who never agreed to it.
Where remote work actually breaks down
The failures rarely look dramatic. They tend to be small, procedural gaps that only matter because of what’s flowing through them.
| Common remote work habit | Why it’s a problem |
| Reviewing privileged documents on hotel or airport Wi-Fi | Networks are shared, and traffic can be exposed to others on the same connection |
| Using a personal device without encryption for client files | No control over what happens if the device is lost or stolen |
| Sending draft filings through personal email as a workaround | Bypasses firm-managed security and audit trails entirely |
| Working from a coworking space without checking its network setup | Third-party networks rarely meet the same standard as firm infrastructure |
Practical steps that don’t require an IT department
Most solo practitioners and small firms don’t have dedicated security staff, and they don’t need one to close most of this gap.
- Keep client work on a firm-managed device with full-disk encryption, rather than a personal laptop shared with family.
- Route any work done on public or unfamiliar networks through a VPN, so the connection itself isn’t the point of exposure.
- Use a password manager rather than reused passwords across case management software, email, and billing systems.
- Confirm that any cloud storage or e-filing platform used remotely supports two-factor authentication, and turn it on.
A VPN is a small line item against a real exposure
For lawyers weighing whether a VPN is worth adding to the monthly software budget, the cost comparison is straightforward. According to Proton VPN promo codes, Cybernews currently lists the provider’s two-year plan at $2.99 a month with the discount applied, alongside a 30-day money-back window that lets a firm test it on a few devices before committing further. Cybernews’ coverage of Proton VPN elsewhere notes the provider’s audited no-logs policy, which matters more for legal work than for casual browsing, since the whole point is having no record of what was transmitted or when.
That’s a modest expense set against the cost of a confidentiality breach, which can mean a malpractice claim, a bar complaint, or simply a client who no longer trusts the firm with sensitive matters. The ABA’s guidance on lawyers working remotely doesn’t prescribe a specific tool, but it does make clear that “I was working from a hotel” isn’t a defense to a confidentiality lapse, only a description of where it happened.
Firms that have moved toward more flexible, hybrid arrangements since 2020 have generally treated this as a policy question rather than a purely technical one: which devices are approved for client work, which networks are off-limits without a VPN, and who signs off when an associate wants to work from somewhere new. For young lawyers building those habits early in a career, Leaders in Law’s guide on navigating solo practice versus firm life covers the broader infrastructure decisions that this kind of security planning tends to fall under, whether that means setting up a home office from scratch or negotiating what a firm’s IT policy actually requires before the first case file ever leaves the building.
