Comment to the Montana Supreme Court on Metadata

Update 2016-11-30

As I wrote in my original post below, I wrote my comment on the assumption that no other comments were going to be filed (not that I wouldn’t welcome them, but it seemed like the bar had other interests). As it happened, four other comments were filed in total:

• The Board of Trustees of the State Bar of Montana commented that they are “unpersuaded that being the first in the country to adopt this rule is either necessary or wise.” They went on: “[t]he Trustees are united in the belief that the proposed rule is unnecessary, confusing, and must be rejected.”
• The State Bar of Montana Technology Committee stated that “The proposed rule stems from a fear of technology and a fundamental misunderstanding of what is and is not possible.”
• The (non-lawyer) IT Program Manager at the State Bar of Montana wrote a short letter encouraging the Court to “ponder whether this rule… achieves the more important function of protecting clients.” He also suggested easy tools to remove unnecessary information from documents.
• Finally, the State Bar of Montana Ethics Committee refused to consider changes to their proposal (recommended by the Trustees and the Technology Committee). “The committee foresees technology’s contribution to the erosion of professionalism and standards of courtesy in a rapidly changing bar,” and went on to cite the adoption of the Uniform Bar Exam (a shared bar exam that allows people to apply to multiple bars for admission on the basis of having taken one exam) as background for the rule. As someone admitted to the Montana bar having taken the UBE, this argument does not seem responsive to the concerns that I raised (which the ethics committee had not yet seen) or that the Trustees or Technology Committee raised (which the ethics committee had seen); however, I would invite all readers please to examine this comment (and all of the comments) to see if the argument works for them.

My comment is also on the docket, if anyone wanted proof that I did in fact submit it.

Finally, thanks to the variety of lawyers and non-lawyers who submitted changes, corrections, etc. to my comment; I forgot to thank them in the original blog post, and I feel bad about that. They are awesome.

I will update this post again when I learn what the Court’s decision is.

Original Post

Lawyers are a self-regulating profession; that means that we create the rules that are used to determine whether we’re behaving in a manner consistent with the requirements of professional responsibility and legal ethics. From time to time, then, the rules need to be updated. While the American Bar Association has created its Model Rules of Professional Conduct, those rules have no legal effect (though they have a not-insignificant persuasive effect). Instead, each state has a process by which it proposes and adopts its own rules of professional conduct.

Recently, the State Bar of Montana proposed a set of changes to the Montana rules having to do with technology. Many of those changes are excellent; one, however, gave me some concern. Changes to the rules are proposed to the Montana Supreme Court, who will then often solicit comment on the changes before deciding whether to adopt them. Hence, I submitted a comment, which I have rendered below in HTML; here is the PDF version of the comment.

As of the time I wrote this, no other comments had been received on this particular proposal (Rule 4.4(c)). If you’re curious what other sorts of proposals are being made, or to see other comments, the full docket is here.

The Comment

November 22, 2016

Re: AF 09-0688 - Addition of Rule 4.4(c) to the Rules of Professional Responsibility

Honorable Justices of the Montana Supreme Court,

My name is Brendan Francis O’Connor. I am an attorney admitted to practice in the State of Montana; I am also a researcher and practitioner in the field of computer security.¹ I write to comment from a technical perspective on the proposed addition of a Rule 4.4(c) to the Montana Rules of Professional Responsibility, the text of which is as follows:

“A lawyer shall not knowingly access or use electronically stored information in a communication or document received from another lawyer, for the purpose of discovering protected work product, privileged or other confidential information unless the receiving lawyer has obtained permission to do so from the author of the communication or document. Communication or document as used in this rule excludes documents produced in discovery and information that is the subject of criminal investigation.”

First, the rule, as drafted, does not produce a workable distinction between “electronically stored information” and the content of a document—nor does one exist. It seems likely, from the phrase “electronically stored information in a communication or document” that the drafters mean any information that was not typed at a keyboard by a human being—so-called “metadata.” The issue with restricting document metadata is that there is not a meaningful difference between content and metadata—all of the data in a file is interpreted and used by standard tools in their normal course of operation.

For instance, take the case of a JPEG image.² A digital camera is simply a computer with a specialized light sensor on it.³ When the camera takes a picture, the sensor captures light during the instant that the shutter is open. Once the light has been captured in a temporary format stored in the computer’s memory, the computer adds a large amount of information to the photo to allow it to be interpreted by other computers before saving it. This information, called EXIF data,⁴ often includes the model of camera, the lens used, whether the flash was triggered, the focal length and aperture setting of the camera, and information necessary to display the image (for instance, information about how color is represented in the image, or the image rotation). The information can be very extensive; it may include the serial number of the camera, the location, altitude, and direction of the camera,⁵ and information about how the photo was edited, if the photo was edited at the time it was taken (on the camera) or later (e.g., using Adobe Photoshop).

This information does not require deep technical understanding to locate or use; indeed, every image-displaying program will need at least some of the information, and common image software, from Photoshop or iPhoto to the Flickr image-sharing website, will make great use of all of the EXIF data. For instance, Flickr’s mapping functionality⁶ automatically places images uploaded to it on a world map; this allows people to look in specific areas for photos of interest. One might search “court” near 59620 and find images of the Old Supreme Court Chamber; these would be different from searching “court” near 59101 and finding images of Billings courthouses. Similarly, many “photo album” programs automatically use the image location to categorize different parts of a trip. In this way, the location is not separate from the image; it is a significant part of understanding the image and being able to work with it efficiently, and that is why it is included in the image file. The same is true for all of the information embedded in the image, from the color of a part of the image to the lens used to capture the image. Indeed, Flickr displays nearly all this information for each image when a user clicks “Show EXIF,” and most software can display relevant metadata for a file being edited in just a few clicks.

Every type of computer file has metadata of one sort or another. Video DVDs contain region and video encoding information, stating where they are meant to be played and how the video is stored. Documents in Microsoft Word format include metadata relating to formatting (selecting the font size, for instance), metadata relating to the document’s creator and editors, and in some cases (when the feature has been expressly enabled for a particular document by its creator, for this is not the default), information about changes made to the document. MP3 files include information about the artist and album, as well as information relating to where the music was purchased. Computers store metadata for every file stored on a drive, including when the files were first saved, last changed, and last opened. Even computer hardware has metadata; when a USB device is plugged into a computer, it identifies itself to the computer to explain what it is and how to use it before any other data is transmitted. All of this information is viewable; it does not require special tools or uncommon skills to use. Metadata is inextricable from the normal use and function of any computer. In this way, metadata gives new life to “the medium is the message;” without the metadata to give context to the remainder of the message, it would be unintelligible.

Second, attorneys already have effective, built-in tools to remove unnecessary metadata from documents. When attorneys need to remove information from a paper document (for instance, in response to Rule 1.6), they can redact it. Attorneys are also able to remove metadata from a document trivially, if they feel that the metadata might reveal privileged or work product information. For instance, Microsoft Word has several built-in tools to do this, including the “Check For Issues” button prominently displayed in modern versions of Word; in addition, saving the document as a PDF before sending it removes Track Changes, Comments, and many other potential sources of privileged or work product information from a document. These tools are built-in to many document editors and operating systems, and are easy to use when necessary.

Finally, this rule may have the unintended effect of dissuading Montana attorneys from using technology to manage their legal practices. Modern legal practice management tools automate the discovery and use of document metadata. For instance, the MetaJure platform⁷ uses document metadata, both that which is stored inside the document and that which is found outside the document (such as information about an email to which a document was attached) to locate, organize, and make documents available throughout a firm. This use of metadata helps firms comply with their obligations to their clients and to opposing counsel, by minimizing the number of documents that are lost in the virtual shuffle.

The proposed rule would require that attorneys go to significant lengths to avoid any inadvertent contact with document metadata, lest normal tools for photo viewing, document editing, or the like (all of which must use and display metadata as part of their normal course of operation, as described above) reveal confidential information that was transmitted to them. While it is certainly possible that this use might be found not to be “for the purpose of discovering… confidential information,” the rule will create a chilling effect that dissuades attorneys from using technology to its fullest extent lest they be found to have violated the rule. This is particularly egregious because Rule 4.4(b), which deals with information inadvertently sent to an attorney, does not require this level of care with paper documents; as amended by this Court on September 22, 2016, the rule only requires notification of the sender if an attorney knows that a document was inadvertently sent. To say that electronic documents are somehow both different from paper documents, and more dangerous, significantly harms the cause of efficiency in moving to an electronic practice, which in turn will hurt both clients and the efficient administration of justice.

I recognize and applaud the hard work of the State Bar of Montana on issues relating to technology. I am very much in favor of the change to the Preamble to the Montana Rules of Professional Conduct, adopted by this Court’s order on September 22, 2016: “Competence implies an obligation to keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology.” I think that it is excellent that the Bar and the Court wish to ensure that the Rules take into account the changing nature of technology; when they do so, it would be my request that they first ask if their goals are best met by curtailing a particular use of technology, or by, as in the Preamble, reaffirming an attorney’s existing obligations regardless of the medium. In many cases, I would submit that the answer most in keeping with the tenor and traditions of the legal profession would be the latter.

I humbly request that this Court reject the proposed Rule 4.4(c) in its entirety.

Sincerely yours,

Brendan Francis O’Connor