Today’s Lesson
Three Letters That Carry Different Weight in a Law Firm
The CIA triad — Confidentiality, Integrity, Availability — is the foundational model of information security. NIST1 and ISO 270012 structure their frameworks around these three properties. But in legal technology, each carries consequences that generic security guidance never anticipates.
Confidentiality: When a Breach Waives Privilege
Attorney-client privilege3 protects communications made in confidence for the purpose of obtaining legal advice. Once privilege is waived — including through inadvertent disclosure — the protection can be lost permanently. Federal Rule of Evidence 502 provides a safety net, but only where the holder took “reasonable steps to prevent disclosure.” Your platform architecture is the reasonable steps.
Case study — Mossack Fonseca (2016): The Panama Papers breach exposed 11.5 million documents4 — 2.6 terabytes of privileged attorney-client communications covering 214,488 offshore entities. The firm’s flat network architecture allowed complete exfiltration. Mossack Fonseca closed permanently.
ABA Formal Opinion 477R5 requires lawyers to undertake “reasonable efforts” to prevent unauthorised access. A legal SaaS platform that stores privileged communications inherits this obligation architecturally.
Integrity: Where One Changed Byte Shifts Millions
Courts require authentication of digital evidence6 under rules like FRE 901. If your platform cannot cryptographically prove a document’s integrity chain from upload through every access event, neither party can rely on the platform’s version as authoritative.
Key principle: In legal tech, integrity means not just detecting tampering — it means proving non-tampering to a standard that satisfies judicial scrutiny. Cryptographic hash chains, immutable audit logs, and version control with signed commits are the minimum viable integrity architecture.
| Integrity Threat | Legal Consequence | Required Control |
|---|---|---|
| Silent document modification | Contract disputes, inadmissible evidence | SHA-256 hash at ingest + mutation logging |
| Metadata manipulation | Spoliation sanctions, adverse inferences | Immutable metadata store |
| Audit log tampering | Inability to prove chain of custody | Append-only, hash-chained logs |
| Version history deletion | Destruction of exculpatory evidence | Write-once storage with legal hold |
Availability: When Downtime Is Negligence
Missed filing deadlines remain the number one source of legal malpractice claims.8 Courts rarely excuse late filings regardless of the reason. The statute of limitations doesn’t pause because your cloud provider had an outage.
Case study — DLA Piper (2017): The NotPetya attack paralysed DLA Piper9 for over two weeks. No email for four days. 15,000 hours of IT overtime10 to rebuild the entire infrastructure from scratch. Flat network architecture let the malware propagate across forty countries in minutes.
Privilege-Preserving Architecture: Beyond Encryption
Encryption prevents data from being read. But privilege requires something stronger: the ability to prove that unauthorised access never occurred. Four layers are required:
- Encryption (necessary but insufficient) — AES-256 at rest, TLS 1.3 in transit, per-tenant keys. Prevents reading. Does not prove non-access.
- Access attestation — Every access event cryptographically signed with accessor’s identity, timestamp, and document hash.
- Negative proof capability — Hash-chained audit logs where gaps are structurally impossible. Demonstrates that between time A and time B, only authorised accesses occurred.
- Compartmentalisation — Architectural enforcement that one compromised component cannot reach privileged data in another compartment.
The Compartmentalisation Failure
The Grubman Shire Meiselas & Sacks breach (2020)11 demonstrated what happens without compartmentalisation: REvil exfiltrated 756 GB of privileged client data in a single operation. No internal segmentation prevented lateral movement. $42 million ransom demand.
Conclusion
The CIA triad is not three separate problems. In legal technology, they are three facets of one obligation: maintaining the trust that allows lawyers to use your platform for their most sensitive work. The standard is not “was the data encrypted?” The standard is “can you prove to a court that privilege was never compromised?”