Cloud IT For Lawyers

Originally published on Law Technology Today on November 14, 2016.

On Friday evening, September 23^rd, Jack’s email access was about to change. His Yahoo email account, the one that he had since law school, received a password reset request. Since it is an email account that is not checked frequently, Jack didn’t notice. But, since the account was used as his backup account in case he forgot his password, he didn’t know it now, but Jack’s law firm email had been hacked.

Jack’s paralegal received an email from him indicating that a wire needed to go out to a client. In his criminal law practice, this is not an everyday occurrence but certainly not unusual. His paralegal replied back to his email letting him know that the bank puts much more scrutiny on wire transfers then they used to and they would have to jump through some hoops to the wire to go through.

This email exchange was not between the paralegal and the attorney, but the paralegal and the email hacker. The hacker, using the same short email correspondence and email signature that Jack would normally use with his paralegal, did not raise any suspicions. The hacker continued the correspondence with the paralegal and told her to proceed with the wire and to get whatever authorization was needed both from the bank and from his partner since he would not be in the office. She responded back that she would start working on it.

Then, Jack walked through the office door.

His paralegal told him as he walked in the door that she was working on the wire and he replied, “What are you talking about?” She replied that she was working on the wire that they had been talking about over email. He replied again asking, “What email? What wire?”

She showed him the emails that she had received from his email account. He did not send the emails and there was no record of the emails in his Sent Items on his iPhone. They immediately called me knowing something was wrong.

I asked him to log into his email account to immediately change his password. He tried, but he said he couldn’t remember his password. I tried to log into his Google Apps for Work account with the last password that I knew. The “Forgot Password” page said it was changed 11 days ago. Jack said that he didn’t change his password 11 days ago. He wasn’t even in the office that day. It also hadn’t prompted him to change it on any of his mobile devices or in Outlook.

Luckily, we were able to recover his email account using the last password he knew and a text authentication to his phone. We were able to change his email password and take a look at what had happened.

We discovered that filters were put in place that would delete any email traffic between his paralegal and his email account. In addition, any emails that included the word “transfer” would be automatically marked read and deleted as well. The filters in his Google Apps account looked like this:

We were able to change all the passwords for everyone involved, remove the filters and confirm that no other access had come from his account. In checking his account, we could see where someone else had accessed his account:

They were all locations in the U.S., but Jack hadn’t been to any of them. Was this a US based hack? Probably not, but most likely someone was bouncing their access off of infected machines in those locations.

In this case, this attorney was lucky. We were able to catch this hack early, before any wired funds had been transferred.

Is this the end of it? I don’t know. Jack still has a Yahoo email account. Was that compromised? It could have been. There has certainly been lots of internet traffic about Yahoo accounts being for sale on the Dark Web.

What can you do to protect yourself from a hack similar to this? Consider the following:

1. Confirm that your computer and browser are up to date with updates and virus protection. This is your first line of defense. It may not protect you from all hacks and malware, but it is a good start.
2. Check to see if your email has been compromised. In Google Apps, you can check here to confirm that all of the authorized access is yours. In Office 365, you can check here for steps to take if you think you have been compromised.
3. Use a password manager like LastPass or KeepPassx to help remember, update and create secure passwords.
4. Enable two-step authentication. This is an authentication system that requires two steps to make changes to your account, like password changes. Two step authentication would have sent a text to a phone with an additional code to authenticate account access. We had talked about implementing two-step authentication, but had not set it up yet. Most online systems including Quickbooks, Dropbox, and most practice management systems offer two-step authentication. If it is available to you, be sure that it is turned on.

In Jack’s case, we have changed all of the passwords for all accounts, scanned computers for malware, changed the backup email account and implemented the two-step authentication that we had been discussing.

We are still watching Jack’s email for suspicious activity. So far, nothing has come up, but we certainly don’t want it to happen again. The scary part is, was someone monitoring his email for 11 days? Possibly. Many hackers will infect machine and networks and wait days, weeks or months before they do something. Is your machine or network compromised? Check your accounts today and implement practices to protect yourself and your firm.

It really can happen to you.

I am not an accountant, but invariably I am pulled into discussions with law firms about their time and billing systems. A pain point that continues to come up for both small and large firms alike is the management of their trust accounts. Some firms choose to delegate this chore to internal accountants/bookkeepers or to outsourced accounting firms, while others prefer to keep track of this critical piece of their practice themselves. Up to now, I have seen (most) trust accounts very diligently monitored by attorneys.

But, most attorneys are not accountants. They keep track of their trust accounts in whatever way they can; through their billing system, separately in Excel or even on paper. Yikes!

Now, firms have a great alternative for keeping their trust accounts up to date. Trustbooks (www.trustbooks.com) is cloud-based trust accounting software solution for managing law firm’s trust accounts. For the reasonable cost of $25/month or $250/year, attorneys can be sure that their trust accounts are accurate and up to date.

The concept is simple, but brilliant. Trustbooks was created by a CPA who worked with law firms and found that attorneys needed an easier way to keep track of this important part of their practice. Trustbooks keeps track of the balances in your trust accounts, deposits, and payments, and allows firms to write trust account checks right out of this easy to use software.

Trustbooks allows attorneys to manage all of their trust transactions (for single or multiple trust accounts) in one place and access it 24 hours a day. Firms can quickly see their latest trust balances and transactions on the Dashboard screen and know exactly what is going on with their trust accounts even if they are not managing the accounts personally:

Firms can easily add deposits to trust accounts and make payments from trust accounts with the click of a mouse.  The software immediately updates the accounts and makes sure the trust account doesn’t go below zero. You know it shouldn’t go below zero, right?

In addition, Trustbooks performs trust account reconciliations, including three-way reconciliations. If you are so inclined (or required) to do daily reconciliations, it is easily done.

Finally, something that you don’t see from other cloud-base software is the check writing feature. Rather than switching between software and your accounting system to write trust account checks, firms using Trustbooks can write checks directly from their software. Once the check is written, the trust account balance is updated immediately in the software to reflect any changes in the balance.

While the target market for this software is attorneys, if your firm has outsourced its accounting function, the firm’s accountants can use it as well to keep the firm up to date on its trust account.

As with most cloud-based software, Trustbooks is constantly updating their software. Some useful features that will be coming down the pike soon include integration with other software, month-end reports and on-boarding resources to help you make the transition to Trustbooks as painless as possible. Cool!

If your firm is using software like Quickbooks or Excel or manually tracking by hand, Trustbooks would be a huge time saver to make sure that your trusts accounts are up to date and ready for that State Bar audit. That is worth the price of admission. Check out the 30-day free trial and see if you don’t agree that it is a better way to work with your trust account.

(Originally published on March 4, 2014 on Law Technology Today. Read original post here.)

Starting your own firm is an exciting endeavor.  No longer will you be restricted by the rules and processes of your Big Law firm.  There are so many decisions to be made like new email addresses and websites, internet service providers, document storage options, logos, marketing opportunities, social media…. The to-do list can seem endless.

But before you leave the comforts of Big Law, there are a few items that you might want to consider taking with you. While Big Law may have been confining, it also provided many of the creature comforts that you need to consider as you are embarking on this new adventure. They include:

• Documents – In many instances, your documents may have existed in a firm-wide server-based document management system. While such a system was great in a large firm for finding documents, such as system might not be ideal in a smaller firm. Take what documents you can, with the approval of your firm, and make sure they are in a format that can be used in a small office. The export of documents in a folder and subfolder structure with clients and matters, and document types, is fine. Ensure that the names of the documents that are exported for you are correct and not some gobbledygook name from the document management system that you no longer have access to.
• Contacts and calendars – Hopefully, you have the ability to take your existing contact list and calendar with you as you move away from your old firm. If you know the system that you would like to use in your new firm, be sure that your contacts and calendars are exported in that format. For most people, one of the following two options will work:
  • CSV (comma separated values) – The .csv files are easily imported into cloud-based systems.
  • PST (Outlook data file) – The.pst files are easily imported into Microsoft Outlook.

If you are not sure of the system you will be using in your new firm, ask if you can have your data in both formats so you do not limit your opportunities.

• Templates and “Go-Bys” – Most attorneys do not creating every document from scratch but often use go-bys and templates to create documents from Motions to Briefs. If you can, again with the approval of your firm, copy these standard documents and templates that you will use to create your new documents. Everyone has those favorite documents that you use over and over. These documents are an essential tool for your new practice.
• Pictures and biography information – In addition to creating a new firm, you will be creating a new website as well. Photos are essential piece of your new website and if you have good photos from your old firm that you can take with you that will assist with your new website. In addition, many attorneys include their biography information on their websites as well. Before that information is taken off of your old firm site, be sure you have a copy of that information for your new site. You will most likely be updating it (and hopefully getting some new pictures as well), but it is nice to know the information that was on your old site and not have to start from scratch.

Now that we have talked about the information to take with you, let’s talk about what not to take. The prospect of creating a new firm is exciting, but if you’ve been practicing for 20 years, Big Law is all you know. Now that your new firm will be small and nimble, try to break the preconceived notions of how law firms work. Consider some of the Big Law ideas to leave behind:

• Paper and Electronic Files – If your old firm was a paper monster, consider using tools like a ScanSnap iX500 scanner to move your firm toward a paperless office. Did your old firm pay thousands a month for off-site storage as a result of this paper monster? Make plans now on how to keep (or not keep) those paper files so you don’t suffer the same expense down the road.
• Client Numbering – Was your old firm bogged down in six digit client and matter numbers that no one could remember? Consider a client numbering or naming strategy that will work for your new firm and establish procedures for this system to accommodate growth. Do you need six digits for client number? Probably not to start off, but a sound numbering or name strategy is essential for organization.
• Time Entry – If you had someone else entering your time, is that an option for your new firm? If not, consider easily accessible tools on iPhones and iPads (like the iTimekeep app or Bill4Time.com) to enter your own time easily. These options may not have been as cost-effective in a larger firm, but they can be the key to accurately capturing time in a small firm.
• Virtual Services – If you used internal transcription services, consider using voice recognition software (like Dragon NaturallySpeaking 12) or a virtual transcription or digital dictation service. If you need an assistant, consider hiring a virtual assistant to start rather than a physical assistant.
• Hourly rates – Were your hourly rates so high to compensate for the Big Law overhead? Leave the big firm overhead behind and lower your hourly rate accordingly. Consider flat fees and alternative fee arrangements for clients interested in alternative billing arrangements that big firms were reluctant to offer.

It is a huge transition to move from Big Law to a solo or small practice, and thinking ahead can ease the difficulty inherent in the process. But, by utilizing your Big Law experience, bringing with you some tools that will help in the transition and leaving the Big Law processes behind, your new firm will flourish. Best of luck to you in this new adventure!