How to Give Attorneys Secure Remote Access From Court and Client Sites

Attorneys do some of their most sensitive work away from the office: in a courthouse hallway before a hearing, in a client's conference room, in a hotel the night before a deposition. Each location brings an unfamiliar network and sometimes an unfamiliar device. Here is a practical approach to law firm remote access that gives attorneys their full working tools in those places while keeping client confidences protected.

What do ethics rules require when attorneys work from court or a client's office?

They require reasonable efforts to protect client information wherever the attorney works. In California, Business and Professions Code section 6068(e)(1) imposes the duty to preserve client secrets, and rule 1.1, comment 1 makes understanding the benefits and risks of relevant technology part of competence.

ABA Formal Opinion 498 (March 2021) applies the same duties to lawyers working "at home or on-the-go." It lists options such as secure internet access through secure Wi-Fi, a virtual private network or another secure portal, multi-factor authentication to firm systems, encryption of data stored on devices, patching and anti-malware on every device that holds client information. It also says client information should not be seen or overheard by others at a remote location.

Is courthouse, hotel or client guest Wi-Fi safe for client work?

Not without precautions. Treat any network the firm does not control as untrusted. California State Bar Formal Opinion No. 2010-179 concluded that an attorney using a coffee shop's public wireless connection risks violating the duties of confidentiality and competence unless the attorney takes precautions such as encrypting files and wireless transmissions and using a personal firewall. For highly sensitive matters, it says the attorney may need to avoid public wireless or obtain the client's informed consent.

The practical answer for most firms is twofold. Give attorneys a cellular hotspot or a laptop with built-in cellular service so they rarely need a shared network, and make sure every connection to firm systems is encrypted and authenticated regardless of which network carries it.

Is a VPN enough for law firm remote access?

Not on its own. A traditional VPN encrypts the connection, which addresses the Wi-Fi concern, but once connected the attorney's laptop is on the firm network with broad reach. If that laptop is compromised at a hotel, the attacker inherits the same reach. VPN appliances have also been frequent targets, and in 2024 CISA, the FBI and partner agencies urged organizations to move toward zero trust approaches.

No ethics opinion requires a particular tool. Opinion 498 names a VPN as one example. Zero trust network access meets the same goal with tighter limits on what each connection can reach. Our guide to replacing a VPN with zero trust network access walks through the move step by step.

How does zero trust access work for an attorney on the road?

Each application is published separately, and each connection is checked before it opens. NIST SP 800-207 describes zero trust as granting no implicit trust based on network location, so the courthouse network and the office network get the same scrutiny.

In practice, an attorney opening the document management system from a client's conference room goes through these checks:

• The attorney signs in with multi-factor authentication. NIST SP 800-63B-4 describes phishing-resistant authenticators such as passkeys and security keys, which hold up better than text message codes against fake sign-in pages.
• The laptop is checked for firm management, disk encryption and current patches before access is granted.
• The connection reaches only the applications that attorney is assigned, such as the document management system, the practice management system or a specific file share. The rest of the network stays invisible.
• Nothing at the office listens for inbound connections, so there is no VPN gateway exposed to the internet.

Can attorneys use a client's computer or a court kiosk for firm work?

Not for anything confidential. A device the firm does not manage may log keystrokes, cache documents or keep the attorney signed in for the next person. Configure Conditional Access so unmanaged devices are blocked from firm data, or limited to web access where your platform supports that, and give attorneys a firm device they can bring instead. Microsoft's Conditional Access guidance covers device-based controls and a report-only rollout to test them first.

What happens if a laptop is left at the courthouse?

With full disk encryption and device management in place, a lost laptop is mostly a device to replace, because the client information on it is far harder to reach. Device management lets the firm lock or wipe the laptop and revoke its access. Without those controls, the firm faces a harder question about whether client information was exposed and what it owes the client. Build the lost-device steps into your incident response plan so the answer is ready before a device goes missing.

Who is responsible for staff and paralegals working remotely?

The partners are. California rules 5.1 and 5.3 require lawyers with managerial authority to make reasonable efforts to ensure the firm has measures in place so lawyers and nonlawyer assistants comply with professional obligations. Remote access rules should cover paralegals and assistants who travel with attorneys or work from home, with the same sign-in and device requirements.

What should a law firm do this quarter?

1. List the applications attorneys need outside the office and who needs each one.
2. Issue cellular hotspots or cellular-enabled laptops to attorneys who are in court or at client sites regularly.
3. Confirm every firm laptop has disk encryption, device management and remote wipe.
4. Move multi-factor authentication to phishing-resistant methods, starting with partners and anyone with trust account access, and review risky sign-ins from unfamiliar locations each week.
5. Pilot zero trust access for one application, such as the document management system, with a small group of attorneys before retiring the VPN.
6. Write a one-page remote work policy covering public Wi-Fi, borrowed devices and lost-device reporting, and have the managing partner approve it.

How s90 helps

s90 designs and runs Zero Trust Network Access for law firms, publishing the document management system, practice management and file shares so attorneys can reach them securely from court, client sites and home. We set up the device checks and multi-factor authentication behind each connection, and we keep the records you may need if a client's outside counsel guidelines ask how remote access is protected. If your attorneys still rely on a VPN, we are glad to walk through what the move would look like for your firm.