How should law firms manage attorney phones without overreaching?

An attorney's phone holds client email, text threads with opposing counsel, calendar entries for confidential meetings and often a document app full of draft agreements. It is also the device most likely to be left in a rideshare or a courtroom gallery. Managing it is part of protecting client confidences. Managing it badly, by taking control of a personal phone the firm does not own, creates its own problems with attorney trust, workarounds and employee privacy. Here is how law firm mobile device management can protect client information on phones without overreaching.

What do ethics rules require for attorneys' phones?

They require lawyers to protect client confidences on every device that holds them, phones included. In California, Business and Professions Code section 6068(e)(1) imposes the duty to preserve client secrets, and rule 1.1, comment 1 makes understanding the benefits and risks of relevant technology part of competence.

No rule names a specific phone setting. ABA Model Rule 1.6(c) and Comment 18 measure reasonableness by factors that include the sensitivity of the information, the likelihood of disclosure without added safeguards, the cost and difficulty of the safeguards, and whether they make it harder for the lawyer to represent clients. That last factor matters for phones: a control so intrusive that attorneys stop using firm tools is not helping.

ABA Formal Opinion 498 (March 2021) gives the clearest list for devices used outside the office: strong unique passwords, patching, anti-malware, encryption of stored data and multi-factor authentication to firm systems. It also says that unless the technology assists the lawyer's practice, the lawyer should disable the listening capability of smart speakers, virtual assistants and other listening-enabled devices while communicating about client matters.

Why do phones need their own policy?

Because phones carry client information in more places than a laptop and are lost more easily. Email, messaging apps, photos of signed documents, voicemail transcripts and cloud file apps all sit on one small device that leaves the office every day.

Remote wipe helps, but it is not a complete answer. NIST SP 800-124 Rev. 2, the federal guide to managing mobile devices in organizations, says organizations should not rely on remote wipe as the sole security control for protecting sensitive data. A phone that is encrypted, locked with a strong passcode and limited in what it can copy out of firm apps is protected before anyone notices it is missing.

When does law firm mobile device management become overreaching?

It becomes overreaching when the firm takes more control or visibility than it needs to protect client information. The common example is enrolling an attorney's personal phone in full device management, which can give the firm the ability to wipe the entire phone and to see details about the device and its apps.

NIST SP 800-124 Rev. 2 flags this directly. It says management systems may be able to collect sensitive information about an employee, that collection of personal data should require user consent and a clear description of what the organization can access, and that staff may turn to unsanctioned tools when administration practices appear to invade their privacy. For a law firm, that last point is the real risk: an attorney who refuses enrollment and forwards client email to a personal account has created a bigger confidentiality problem than the one the policy was meant to solve.

A full wipe of a personal phone is the other trap. It can erase family photos and personal messages along with firm data, and that possibility alone is enough for many attorneys to resist enrollment.

Should the firm issue phones or let attorneys use their own?

Either can work, and each calls for a different level of control. A firm-owned phone can be fully managed: the firm controls apps, settings and updates, and can wipe the whole device when it is lost or when the attorney leaves.

A personal phone is better served by app-level protection. NIST says that for bring-your-own-device programs, mobile application management (MAM) instead of full device management may help address users' privacy concerns, because MAM does not require the owner to enroll the whole device. NIST also describes a selective, or enterprise, wipe that removes only the settings, data and apps the organization provided.

Cost is part of the decision in California. In Cochran v. Schwan's Home Service (2014), the Court of Appeal held that when employees must use personal cell phones for work calls, Labor Code section 2802 requires the employer to reimburse a reasonable percentage of their phone bills. Firms that rely on personal phones should factor that into the comparison with firm-issued devices. The counsel review list below covers what to bring.

What can app-level protection do on a personal phone?

It can protect firm data inside approved apps while leaving the rest of the phone alone. Typical app protection policies can:

• Require a PIN or biometric unlock to open firm email, document and messaging apps.
• Block copying, pasting or saving firm data into personal apps and personal cloud storage.
• Encrypt firm data stored inside approved apps.
• Require a minimum operating system version before firm apps will open.
• Remove only firm data and apps when a phone is lost or an attorney leaves.

Paired with conditional access rules in the firm's identity system, these policies can also block firm email from opening in unapproved mail apps. What the firm does not see is the attorney's personal photos, texts, browsing or location. Saying that plainly in the policy does more for adoption than any technical setting.

Do privacy laws limit what the firm collects from phones?

They can. Since January 1, 2023, the CCPA's partial exemptions for employee information have been inoperative, so a firm that meets the CCPA's definition of a covered business owes its California employees the same notice at collection and data minimization duties it owes consumers. Location history, app inventories and device identifiers gathered through device management are personal information. Collecting only what is needed to protect client data keeps that obligation manageable.

Supervisory duties apply too. California rules 5.1 and 5.3 require managing lawyers to make reasonable efforts to ensure the firm has measures in place giving reasonable assurance that lawyers and nonlawyer staff comply with professional obligations. A written phone policy, applied the same way to partners and staff, is one of those measures.

What should a law firm BYOD policy include?

It should cover which phones the firm issues, how firm-owned and personal phones are protected, what attorneys are told and what happens when a phone is lost. A firm of 5 to 100 attorneys can put these steps in place this quarter:

• Decide which roles get firm-owned phones and which may use personal phones, and document the reimbursement approach for personal phones.
• Fully manage firm-owned phones, with encryption, a strong passcode, automatic updates and full wipe on loss.
• Apply app protection policies to personal phones instead of full enrollment, with selective wipe only.
• Require multi-factor authentication and conditional access for email and document systems so firm data opens only in approved apps.
• Write a one-page notice that tells attorneys what the firm can and cannot see and do on their phones.
• Add a lost-phone step to the incident response plan: who to call, how fast firm data is removed and how the event is recorded.
• Remind attorneys to silence voice assistants during client calls, as Opinion 498 describes.

For related steps, see how to give attorneys secure remote access from court and client sites and how to block personal AI accounts on firm devices.

What should your counsel review before rolling out a phone policy?

Do this review before the firm rolls out or changes its phone policy, and again whenever it starts requiring staff to use personal phones for work. Bring these decisions to the review:

• Reimbursement for personal phones: how the firm will reimburse a reasonable percentage of phone bills under Labor Code section 2802 and Cochran v. Schwan's Home Service (2014). Bring the current stipend or reimbursement policy and a list of roles required to use personal phones.
• Employee notice for device data: whether the firm is a covered business and, if so, what its notice at collection must say about data gathered through device or app management under Civil Code sections 1798.100(a) and 1798.140(d). Bring the management platform's list of data it collects and the current employee privacy notice.
• Client security requirements: whether any client agreement requires phone controls beyond the firm's standard policy, which ABA Model Rule 1.6, Comment 18 says a client may do. Bring engagement letters and outside counsel guidelines that mention devices or data security.

How does s90 help?

s90 manages firm-owned and personal phones for law firms across Los Angeles and Orange County, using app protection on personal devices so attorneys keep their privacy and the firm keeps control of client data. We document the policy, the settings and the evidence so managing partners can show what reasonable efforts look like. If your phone policy is overdue for a review, we are happy to walk through it with you.