The massive leak of confidential documents from the Panamanian law firm Mossack Fonseca is still sending shock waves throughout the world. It’s likely to keep reverberating for some time. We’re not any closer to learning the origin of the leak because the newspaper who disseminated the information won’t reveal their source. We don’t know if the information was stolen and distributed by an activist hacker, or leaked by a current/former employee of the law firm.¹ What we do know us that a whole lot of confidential information was released and, “the data primarily comprises e-mails, pdf files, photo files, and excerpts of an internal Mossack Fonseca database.”²
In my last threat assessment I discussed the concerns about the possibility that the firm was hacked, but there is another, equally disturbing concern. The leak could have been the work of an employee of the firm, perhaps acting as a whistleblower of sorts. In that case, what should the firm fear and what are the ethical concerns?
The thing to fear? Copycats.
Sure, the idea of whistleblowers is nothing new, but I’m concerned about people who are inspired by the Snowdens and the WikiLeaks of the world. I’m worried that high profile leaks could be inspiring others to adopt a pseudo-Robin Hood mentality. I call them Disclosure Vigilantes— those employees who feel that it’s their societal duty to expose the things they define as “wrongs.” I’m not talking about people who expose criminal conduct— I’m talking about those copycats who steal and/or reveal our clients’ confidential data and leak it to someone outside the firm in an effort to make public something that they define as an affront to society. They could be personally disgusted by someone’s “excessive wealth,” or feel compelled to “uncover the extent to which Corporate America will go to keep the average worker down”….name your cause, name your villain.
The ethical concerns? Hiring and Supervision
If there is a danger that firm employees could be Disclosure Vigilantes, then what are we doing to counteract it? We need to ask whether the firm is properly vetting all of our new hires, including those in IT. Plus, are we asking the right questions during the interview process? Does our interview process in some way consider the issue of purposeful leaks (note that I’m an ethics guy, not a labor law guy, so talk to a labor lawyer to ensure that whatever questions you ask aren’t improper from a privacy/labor law/etc., perspective). From an ethical point of view, that sort of targeted due diligence during hiring could constitute the appropriate “thoroughness” required by Rule 1.1 (Competence), and it might be the “reasonable diligence” that’s required by Rule 1.3 (Diligence).
But it goes beyond just hiring. After the employees are hired we need to manage our staff, and Rule 5.3 requires that we supervise nonlawyer personnel. Lawyers in a firm have a responsibility to ensure that our nonlawyer employees behave in a manner that’s “compatible with the professional obligations of the lawyer,” and that has historically included confidentiality, among other things. But given the new reality of Disclosure Vigilanteism, that duty to supervise might be expanding to include the need to watch for morality-based intentional leaks of client information.
A savvy lawyer might see a third angle— (1) we should properly screen our new hires, (2) we should properly supervise our employees to make sure no disclosures are occurring, and…(3) maybe we should also watch for changed circumstances to our employees which could increase the probability of a purposeful disclosure. Remember, employees could change during their tenure at the firm. If that’s the case, the wise firm might ask whether we are periodically reviewing the staff to check for changed circumstances in our employees that might lead to Disclosure Vigilanteism (being cognizant, of course, of the limitations that are imposed by privacy restrictions and other labor law).
The potential for copycat Disclosure Vigilantes might be altering our responsibilities in hiring and supervising employees. I don’t want you to be that firm….the firm that finds itself in front of an ethics tribunal listening to them say, “the signs were there…you didn’t look for them”…and then hearing that dreaded phrase…you “should have known” this was going to be a problem.
¹http://www.bustle.com/articles/151771-who-leaked-the-panama-papers-the-whistleblower-had-just-one-condition, last checked by the author May 3, 2016
²http://panamapapers.sueddeutsche.de/articles/56febff0a1bb8d3c3495adf4/ last checked by the author May, 3, 2016