The Chatbot Made Me Do It! - Washington State Bar News

Competence and confidentiality in an age of artificial intelligence

COLUMN > Ethics & the Law

By Mark J. Fucile

The 9000 series is the most reliable computer ever made. No 9000 computer has ever made a mistake or distorted information. We are all, by any practical definition of the words, foolproof and incapable of error.
HAL the computer
2001: A Space Odyssey (1968)¹

Earlier this year, a lawyer in New York City was handling a personal injury case against an airline for a passenger who was injured on an incoming international flight. The lawyer filed the case in state court in Manhattan. The defendant airline removed the case to federal court and moved to dismiss the claim as time-barred under the “Montreal Convention” governing international air travel. The lawyer was unfamiliar with the Montreal Convention but had heard of the web version of a “chatbot” that he thought was “‘like a super search engine.’”² The lawyer fed case-specific information into the application and it produced a brief complete with multiple case citations supporting the lawyer’s client’s position. The lawyer was not admitted in federal court, so he had his partner, who was admitted in that federal district court, sign and file the brief. Neither verified the citations.

Unfortunately for the lawyers, the chatbot made up the citations. The fictitious citations came to light when first the defendant and then the court could not locate any of the decisions. Eventually, the lawyers fessed up. The lawyer who used the chatbot confessed he didn’t understand how it worked. He offered that, like HAL the computer in our opening quote, he was “‘operating under the false perception that this website … could not possibly be fabricating cases on its own.’”³

Understandably, the court was not amused. It sanctioned both lawyers and their law firm.⁴In doing so, the court noted that while “[t]echnological advances are commonplace and there is nothing inherently improper about using a reliable artificial intelligence tool for assistance[,] … existing rules impose a gatekeeping role on attorneys to ensure the accuracy of their filings.”⁵

In this column, we’ll look at two aspects of the emerging use of artificial intelligence (AI) tools in law practice. First, we’ll survey our duty of technological competence under RPC 1.1. Second, we’ll examine the interplay between information supplied to tools like the one used by the New York lawyer and our duty of confidentiality under RPC 1.6.

Before we do, four qualifiers are in order.

First, although we will focus here on the rules governing competence and confidentiality, these should by no means be considered an exhaustive list. Emerging AI issues may include—among others—permissible billing for specialized AI products under RPC 1.5, supervision of the use of such products by lawyers and staff under RPCs 5.1 and 5.3, and communicating with clients under RPC 1.4 about how AI products are being used in the delivery of their services.⁶ These are not necessarily new areas as applied to technology generally. The ABA, for example, issued an ethics opinion 30 years ago on billing for “computerized” legal research.⁷ Like any emerging technology, however, there will undoubtedly be nuances specific to AI.

Second, again like other technologies that preceded it, AI will likely touch many aspects of the legal profession and legal services over time.⁸ In this column, however, we’ll focus on lawyers using this emerging technology in their practices today.

Third, we’ll focus on the Rules of Professional Conduct and associated law firm risk management. Other areas of substantive law, such as copyright, can also come into play depending on the circumstances.⁹

Fourth, like the technology itself, potential guidance is not static. The ABA, for example, recently established a task force to examine the impact of AI on the legal profession.¹⁰ Other bar organizations have created similar study groups.¹¹These efforts may result in further guidance tailored to specific issues as they emerge in this rapidly developing area.

Competence

RPC 1.1 sets our benchmark duty of competence:

A lawyer shall provide competent representation to a client. Competent representation requires the legal knowledge, skill, thoroughness and preparation reasonably necessary for the representation.

In 2016, the Washington Supreme Court adopted an amendment to the comments to RPC 1.1 that stressed that our duty of competence includes understanding the technology we use to serve clients:

[8] To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology[.]¹²

The Washington amendment followed a similar change to the corresponding ABA Model Rule adopted in 2012 on the recommendation of the ABA “20/20” Commission that reviewed the ABA Model Rules in light of, among other developments, changes in law practice technology.¹³ The 20/20 Commission noted that the addition reflected in the comment “would serve as a reminder to lawyers that they should remain aware of technology, and its benefits and risks, as part of their ethical duty.”¹⁴

While RPC 1.1 frames competence as a regulatory requirement, it is not hard to imagine that if client harm resulted from a lawyer’s incompetent use of practice technology, a common law negligence claim for legal malpractice would follow. In fact, the court in the New York case observed that the lawyer’s inept citation to non-existent cases harmed his client by depriving him of “arguments based on authentic judicial precedents.”¹⁵ Washington Pattern Jury Instruction 107.04 frames the standard of care in the legal malpractice context, in relevant part, as follows: “An attorney has a duty to use that degree of skill, care, diligence, and knowledge possessed and used by a reasonable, careful, and prudent attorney in the State of Washington acting in the same or similar circumstances.”

Although the comment to both the ABA and Washington versions of RPC 1.1 is comparatively new, the idea reflected is not. Going back to the late 1990s, a series of ABA opinions has addressed a broad spectrum of law practice technology through that same lens, including the use of email,¹⁶ metadata in shared electronic documents,¹⁷ cloud-based files,¹⁸ cybersecurity,¹⁹ and virtual practice.²⁰ Washington has a series of advisory opinions on many of these same topics that make essentially the same point.²¹

None of these authorities suggest that we need to stop practicing law until we have advanced degrees in computer science. At the same time, they all counsel that if we are going to use a technology in law practice, we need to do it competently and understand its benefits and risks so that our clients are protected. In some circumstances, we can meet that standard through our own review. In others, however, we may need to employ the assistance of technology professionals either within our law firms or outside consultants.²²

In some situations, our decision to use—or not use—a particular technology may be a matter of choice. In others, however, we are required to embrace technology through imperatives like mandatory electronic court filings or client electronic billing guidelines. In still other situations, particular technologies such as email, mobile phones, and electronic files have become so ubiquitous that they are now essentials of practice management for many lawyers and law firms.

As the court in our New York illustration noted, “[t]echnological advances are commonplace.”²³ Readers of a certain vintage, for example, may recall when the term “Shepardize” meant a meticulous search through a series of red hardcover books and softbound supplements to make sure a case was still “good law.” Now, the same task occurs automatically in commonly used electronic legal databases. The New York court also underscored, however, that whatever technology we may use in law practice, we—and our law firms—are responsible for using it competently.

It remains to be seen how AI tools—whether as standalone products or incorporated into other technologies—will ultimately impact law practice. “Early adopters” of tools like chatbots today, however, need to familiarize themselves sufficiently with the technology to integrate it competently into their practices.

Confidentiality

Although the accent in the New York decision was on competence, there is another facet that should not be overlooked: confidentiality. The lawyer used an increasingly case-specific series of prompts with the chatbot that eventually produced the brief that his partner filed.²⁴ Because AI tools have the ability to translate research into work product, the confidentiality risk is potentially much sharper than in a traditional electronic database where, in an analogous context, a lawyer might simply enter a search query along the lines of “statute /2 limitation! /25 Montreal /2 Convention.”

Our duty under the confidentiality rule—RPC 1.6—is broad and is framed around protecting “information relating to the representation of a client” rather than privileged attorney-client communications standing alone. Albeit in a non-electronic setting, the Washington Supreme Court in In re Cross, 198 Wn.2d 806, 500 P.3d 958 (2021), recently emphasized both the broad sweep of the duty of confidentiality under RPC 1.6 and that a “knowing” violation occurs when a lawyer intends the act involved that resulted in disclosure of confidential information (in Cross, the act was providing a declaration that included confidential information).²⁵

Comments 18 and 19 to RPC 1.6 specifically link competence to confidentiality and neatly capture this notion in the title to their subsection: “Acting Competently to Preserve Confidentiality.” Given this link, it would not be remarkable for a theory of legal malpractice under WPI 107.04 to be predicated on a lawyer’s failure to protect client confidentiality by disclosing otherwise protected information to a chatbot if client damage followed. In fact, the particular chatbot the lawyer used in the New York case includes a routine warning not to disclose sensitive information precisely because it is not a confidential forum.²⁶ In the analogous context of the attorney-client privilege, voluntary disclosure to a third person is generally considered a waiver.²⁷ Moreover, waiver generally applies to the subject concerned rather than a specific conversation.²⁸ Although a reader might ask how this might be discovered, the practical answer is: “you never know.” The New York lawyer in our example found himself explaining the specific information he had used with the chatbot in a sanctions hearing that The New York Times described as “cringe-inducing.”²⁹

As the court in the New York case noted, “there is nothing inherently improper about using a reliable artificial intelligence tool for assistance.”³⁰ Because these tools are fundamentally different than a traditional electronic legal database, however, lawyers need to be appropriately sensitive to confidentiality considerations. These can range from ensuring that prompts don’t reveal sensitive client information when using a product that is not confidential to carefully reviewing the contractual terms and related technological safeguards when purchasing systems that promise confidentiality. Again, these are not necessarily new concerns as applied to technology generally. The ABA’s recent virtual practice opinion, for example, addresses confidentiality issues with “smart speakers” that in many respects are similar to those with “free” chatbots.³¹ The WSBA’s advisory opinions on cloud-based file storage and virtual practice, in turn, survey contractual and technological considerations when evaluating third-party vendors with whom we share confidential client information.³²

Summing Up

Even in an age of artificial intelligence, it remains the lawyer’s job to competently use the technological tools chosen, preserve client confidentiality when doing so, and vet the results.

About the author

Mark J. Fucile of Fucile & Reising LLP advises lawyers, law firms, and legal departments throughout the Northwest on professional responsibility and risk management. He is a former chair of the WSBA Committee on Professional Ethics. He is the editor-in-chief of the WSBA Legal Ethics Deskbook and a co-editor of the WSBA Law of Lawyering in Washington and the OSB Ethical Oregon Lawyer. He can be reached at 503-224-4895 or:

mark@frllp.com

NOTES

1. See www.imdb.com/title/tt0062622/quotes/.

2. Mata v. Avianca, Inc., __ F. Supp. 3d __, 2023 WL 4114965 at *8 (S.D.N.Y. June 22, 2023) (Mata).

3. Id. at *3.

4. Id. at *17.

5. Id. at *1.

6. In addition to these more prosaic issues, emerging considerations may also include more exotic variants such as whether AI is considered a “nonlawyer assistant” under RPC 5.3, lawyer liability for misrepresentation by AI under RPCs 3.3, 3.4, 4.1, and 8.4, and potential unauthorized practice issues under RPC 5.5.

7. See ABA Formal Op. 93-379 (1993) (addressing billing for a variety of cost items, including computerized legal research).

8. See, e.g., Anthony E. Davis, “The Future of Law Firms (and Lawyers) in the Age of Artificial Intelligence,” 27 No. 1 Professional Lawyer 3 (2020) (surveying the potential impact of AI on traditional law firms and their lawyers).

9. See, e.g., Matthew Henshon, “Artificial Intelligence, Copyright Law, and the Future,” June 15, 2023, available on the ABA website at www.americanbar.org.

10. See ABA Task Force on the Law and Artificial Intelligence (accessible on the ABA website at www.americanbar.org).

11. See, e.g., New York State Bar Association Task Force on Artificial Intelligence (accessible on the NYSBA website at www.nysba.org).

12. Washington Supreme Court Order No. 25700-A-1146, June 2, 2016.

13. ABA, A Legislative History: The Development of the ABA Model Rules of Professional Conduct, 1982-2013 (2013) at 42-43.

14. Id. at 43.

15. Mata, supra note 2, 2023 WL 4114965, at *1.

16. See ABA Formal Ops. 99-413 (1999), 11-460 (2011), and 477R (2017).

17. See ABA Formal Op. 06-442 (2006).

18. See ABA Formal Op. 477R (2017).

19. See ABA Formal Op. 483 (2018).

20. See ABA Formal Op. 498 (2021).

21. See, e.g., WSBA Advisory Ops. 2175 (2008) (email), 2217 (2012) (email), 2216 (2012) (metadata), 2215 (2012) (cloud-based files), and 201601 (amended 2022) (virtual offices).

22. When employing outside consultants, it is important to remember that we remain responsible under RPC 5.3, which addresses supervision of nonlawyers, for ensuring the consultants understand and agree to carry out their work consistent with our duties—such as confidentiality. See generally ABA Formal Op. 08-451 (2008) (discussing outsourced services); ABA Formal Op. 498, supra note 20, at 7 (addressing use of outside technological services).

23. Mata, supra note 2, 2023 WL 4114965, at *1.

24. Id. at *8.

25. See also RPC 1.6(c) (requiring lawyers to make “reasonable efforts” to prevent inadvertent disclosure of confidential information).

26. See chat.openai.com.

27. See Robert H. Aronson, Maureen A. Howard & Jennifer M. Aronson, The Law of Evidence in Washington § 9.04[3] (rev. 5th ed. 2023).

28. Id., § 9.05[7][a].

29. Benjamin Weiser & Nate Schweber, “The ChatGPT Lawyer Explains Himself,” N.Y. Times, June 8, 2023 (available at www.nytimes.com).

30. Mata, supra note 2, 2023 WL 4114965, at *1.

31. ABA Formal Op. 498, supra note 20, at 6.

32. WSBA Advisory Ops. 2215, supra note 21 (cloud-based file storage), and 201601, supra note 21 (virtual practice). See also Daniel W. Linna, Jr. & Wendy J. Muchman, “Ethical Obligations to Protect Client Data When Building Artificial Intelligence Tools: Wigmore Meets AI,” 27 No. 1 ABA Professional Lawyer 27, 32 (2020) (noting that cloud computing provides a general template for vetting confidentiality considerations with third-party vendors).