Technology and legal services

Technology can help law firms offer services that are more efficient, productive, and accurate. But the legal market faces challenges in realising these benefits. Investment in technology is lower in the legal sector than in other professional services sectors, such as accountancy.¹ Client engagement, feedback, and online access to documents are also lower compared to other sectors.² Firms will find it difficult to compete if they cannot keep pace with the technology that clients increasingly expect them to use.³

Increasing use of technology can benefit the legal market by:

• improving access to legal services
• meeting demand
• driving competition in the market
• improving standards of service.

Improving access to legal services

Technology is likely to bring fundamental changes to the way that people benefit from professional services and to the way in which professionals share their knowledge.⁴ Our paper, Improving access - tackling unmet legal needs highlights how technology, such as the use of automated services, can help improve access to justice.⁵

If firms can increase their efficiency and productivity, they can reduce costs to meet the needs of those who would not otherwise be able to afford legal advice – while still operating profitably.⁶ Over a third of those with legal problems attempt to solve them without professional legal advice, and 28 percent of people considering taking legal advice do not use a solicitor because they think they are unaffordable.⁷ This is a large market that is available for firms that can take the advantages of improved efficiency.

"More technology has helped deliver a competitive fee without compromising quality."

Remote working systems and services that are accessed through phones and the internet also help to deliver legal services to those who may be able to afford legal advice, but who cannot physically access it. Examples include those living in more remote areas or in 'advice deserts' where they are far away from specialists in the area of work they need.

Increasing access to legal services, should increase demand in the market. Rather than reducing the work available for lawyers, advanced technology may increase it.

Meeting demand

People increasingly use technology in their day-to-day lives. Over a third of businesses and almost half of people who use legal services⁹ say that they want online legal services. Firms are working to meet this demand but there is more to do.

Nearly a third of all legal services are now online or by email, at least in part. In conveyancing services, this increases to over half.¹⁰

There are also public policy benefits to using technology to deliver legal services. For example, the Government is looking to improve the home buying process, through the introduction of e-conveyancing.¹¹

"[Buyers] can now search for a home online, but the buying process is too slow, costing time and money so we're looking for innovative digital solutions including making more data available online."

The Ministry of Justice (MoJ) piloted an online court scheme for county court claims. 1,400 people used the pilot scheme and 80 percent responded positively.¹³ The new service is now live for anyone wanting to start a county court action for money claims up to £10,000. It is designed to encourage settlement. As such, it gives links to free mediation services as well as allowing people to issue and respond to claims online. The MoJ is piloting a further extension of the scheme for claims up to £25,000, which is expected to run until November 2019.

Online claims resolution will become more and more popular. The most widely used legal service in the world is an online dispute resolution system, Modria, which is based on the system that eBay uses to deal with disputes between buyers and sellers. eBay alone handles over 60m disputes per year.¹⁴ Many more small consumer disputes are settled each year using systems built around Modria. The Canadian online court service – the Civil Resolution Tribunal – uses the same system.¹⁵ These systems have the potential to resolve disputes quickly, cheaply, and in a way that is proportionate to the value of the claim.¹⁶

---

Case example: A digital escrow service

A technology firm launched a digital escrow business, aiming to simplify conveyancing and other large transactions. They offered the means for the UK's first digital mortgage settlement in May 2018.¹⁷ The firm's process involves verifying the identity of all parties, holding funds securely and then releasing them only when all parties agree. By reducing the number of steps needed to safely transfer funds, this system has the potential to reduce fraud and make conveyancing more efficient.

---

Helping firms compete

Firms we regulate face competition from other businesses offering legal services, some of which are technology-focused. These businesses do not need to be regulated under the Legal Services Act 2007 if they only offer unreserved legal services. To compete with these providers, solicitors and firms need to be able to offer comparable or better services at a comparable cost.

Around half of small firms had adopted new technology within the last two years.¹⁸ The biggest challenges they faced as businesses were:

• acquiring new business
• clients demanding 'more for less'
• the amount of time spent on administrative tasks.

Technology can help firms with all these issues. Using technology is not about reducing employment. Instead it helps to free up solicitors' time to focus on giving better value and more engagement with clients.¹⁹ The firm can then take on more business and increase revenue while reducing the cost of any individual case.²⁰ In the wider economy, employment has grown fastest in occupations that have used technology to focus their staff on high skill tasks.²¹

"…between 1982 and 2002, employment grew significantly faster in occupations that used computers because automation enabled workers to focus on other parts of their jobs: this increased demand for human workers to handle higher-value tasks that had not been automated."

Improving standards of service

Technology can help firms complete work more quickly and accurately. This is particularly the case with AI applications that can automate routine process work. Clients value quick and predictable conclusions, and the most common cause for complaints to the Legal Ombudsman is delays.²³ The combination of rapid processing of routine tasks with greater engagement is therefore likely to make clients more satisfied.²⁴

More than a third of firms report issues with maintaining consistency across large volumes of work, and larger firms are especially susceptible to this.²⁵ Digitising and automating processes could help to improve this by making sure processes are followed, and mistakes are identified and flagged.

As noted above, using technology more effectively should help to free solicitors to spend more of their time working directly with clients. As well as making better use of solicitors' time, this should also help to give the highest standards of service and client satisfaction.

Improving existing ways of working

Law firms are using technology to help simplify and improve existing processes. Examples include:

• Online document portals, including those that improve communication within firms or with clients and others, giving progress updates, automating routine tasks and offering the ability to create, store and sign legal documents electronically.
• Online production, negotiation and signing of contracts, such as non-disclosure agreements.
• Electronic case management systems with intuitive interfaces that improve compliance, coordination and in-house communication.
• Electronic billing that improves accuracy, compliance, and reduces time spent on administration. It also increases transparency and speed of billing.

Dispersed firms and remote working

Dispersed, or 'virtual', firms operate without necessarily having a physical office or any of the usual infrastructure of a business. They offer services to clients remotely, and often at a lower cost because of their reduced overheads.²⁶ Particularly important technologies for these firms include:

• affordable cloud data storage
• remote, secure access to files or systems
• improved communication, such as videoconferencing and telepresence (technologies that use virtual reality technology or interactive robots for participation in distant events).

Blockchain and smart contracts

Smart contracts and blockchain technology could change how parties to agreements manage their legal obligations. The terms of a contract can be written as computer code, with each one being recorded as completed immediately upon fulfilment. An example would be transferring funds once ownership changes. These smart contracts reduce the chance of a payment deadline or completion stage being missed.

Many commercial smart contracts rely on blockchain.²⁷ A blockchain is a distributed, tamper-proof digital ledger in which transactions are recorded transparently, irrevocably and chronologically. This is also the technology behind cryptocurrencies.

How a blockchain works

Transaction

Two parties want to exchange something using the blockchain.

Block creation

All transaction requests at the same time are packaged as a 'block' - one item on the chain - and sent to the network of computers behind the blockchain.

Network verification

The networked computers apply the network's rules to decide whether the transaction is valid. If a consensus of computers decide that it is, they verify it.

Hashing

The system encrypts the new block with a time stamp and reference to the previous block. This gives a chain of records that cannot be falsified, since any tampered block would disagree with those held by every other computer on the network and since the block is digitally signed.

Finalising

The new block is added to the chain, recording that ownership of the exchanged item has changed.

An online conveyancing platform completed the first digital exchange of conveyancing contracts and recorded it using a blockchain.²⁸ This is a fast, auditable and verifiable system for recording the agreement. The associated identification security also reduces the risk of certain forms of property fraud. Many organisations, including the Land Registry, are examining the potential of blockchain systems for speeding up and recording transactions, compliance details and contracts.²⁹

Self-serve online legal provision

There are many providers that offer a package of online legal documents for people and businesses to amend and use. These self-serve documents are available in several areas of law, from will writing to company formation and employment contracts, many of which are auto-completed online. They can often be checked by a legal adviser for an additional fee.

Other services include online family and immigration advice that offers access to solicitors to answer more complex questions for a fixed cost.³⁰

Many common legal situations are straightforward, and technology now exists to automate simple advice. Issues such as parking fine challenges, welfare applications or basic civil claims involve defined processes with limited options. These straightforward structures can easily be automated, as computers work very well with this form of logic. And there are smartphone and tablet apps that firms and other providers are using to deliver accessible advice and access to their services. Automation can therefore help in delivering these services efficiently and at a large scale.

Chatbots

A chatbot is a system that simulates interaction with a human while guiding the user through a series of process steps. Chatbots are capable of understanding user requests and processing them, often using natural language. They are commonly used to respond to online queries and route people to the right person if they cannot answer the question. This form of automation is particularly suited to legal processes where an initial description of facts needs to be translated into a specific series of grounds for claim and recorded in a prescribed form.

---

Case example: An automated assistant

There is a chatbot that carries out all the functions of a junior barristers' clerk. The system took six months to train, a quarter of the time needed to train a human to the same level, and handles 100 instructions a day.³¹

The chatbot can carry out tasks that include finding which barristers are available, carrying out conflict checks, and using the chambers' referral network to refer clients to solicitors as needed. It can do much of this because a wide range of legal computer networks and social media have interface systems, called application programming interfaces, that allow different systems to communicate and share data automatically.

Since introducing the chatbot, its operators have been able to reduce hours for all their staff without any reduction in pay.³² This shows how productivity enhancements from intelligent machines can improve work for staff and firm owners, as well as for people who use legal services.

---

As with any work, it is the responsibility of the lawyers involved to maintain ethical and professional standards by regularly checking the output of any system delivery (see the section on 'Ethical issues from the use of AI').

---

Using multi-disciplinary collaboration to create innovative answers

Business technology is changing fast. Law firms need to understand both their own business and the full possibilities of information technology (IT) to get the best out of that change. This makes it helpful for different disciplines to work together to meet people's needs.

In September 2017 a large law firm launched a tech innovation space, inviting their clients and eight technology innovation companies to work together in developing technology assisted solutions to legal and regulatory compliance problems. Another City firm has launched a technology incubator programme to host tech start-ups in the legal technology scene, giving them ongoing legal and business advice, expertise and mentoring.³³

Another collaborative project is a legal industry group to help firms develop smart contracts and blockchain technologies.³⁴ It aims to develop best practices and legal standards. Members include large City firms, legal tech firms, and it has support from groups such as the Linux Foundation.³⁵

Firms and tech companies have held 'hackathon' events where programmers are challenged to come up with creative solutions. For example, automated translation systems for those facing language problems or technology to make it easier for people to navigate legal information.³⁶

A group of large law firms are working to support the launch of a new services automation platform. They are aiming to set industry standards for how lawyers interact with legal technology, how data is managed and how secure hosting and storage is maintained.³⁷

AI refers to software systems that can interpret data in ways that would normally need human involvement. It is loosely defined as machine learning that can improve its own capabilities without needing humans to reprogram it.³⁸ This allows the system to process information more quickly and accurately. AI systems are generally focused on specific tasks and aim to assist and enhance performance. They enhance human judgment and intelligence, rather than replace the need for it.

"Automated machines collate data – AI systems understand it."

The use of AI has great potential to increase business efficiency, with advantages for both firms and their clients. Its use across the UK has the potential to add £630bn to the economy by 2035.⁴⁰ And it is predicted to create 14.9m new jobs by 2027.⁴¹

Commercial use of machine learning is a relatively recent innovation. Their use in the law is, therefore, still in its early stages. We can, however, already see signs of the impact that these intelligent systems will have.

Uses of AI in law

Many legal activities need law firms to produce and check very large amounts of information accurately. This can be very time consuming, which makes it extremely expensive. It also needs the understanding of a trained lawyer, leaving them unavailable for other tasks. AI has the potential to take over this sort of work once the system has been trained appropriately.

AI can support evidence-based decision-making. It can help determine the chances of success in litigation, support the disclosure process and is also applicable in areas of law such as commercial conveyancing. For example, AI contract review tools have the capability to read and understand several leases about one client and pull out and risk assess important terms. It frees lawyers to spend time engaging with clients and on tasks that need human skills.

As with many new technologies, firms may have initial uncertainty around the use of AI. This may soon give way to a perception that it is less efficient or riskier not to use it.

Around 40 of the 100 biggest UK firms are already using AI systems on active files, quadruple the number doing this two years ago. Around 30 further top firms are currently piloting systems, and still more are considering a pilot.⁴²

AI systems have been developed and applied in areas that include:

• document reviews, such as contract reviews and discovery
• conflict checks and due diligence
• identifying precedents
• legal research and analytics
• predicting case outcomes
• billing.

Automated review

AI platforms can interpret and review documents such as commercial loan agreements or corporate contracts. This can save considerable time and expense. One large accounting firm states that their own contract analysis system has saved 360,000 hours of their lawyers' time each year with better accuracy. It can review documents in seconds rather than hours.⁴³

AI can also make due diligence and other compliance tasks more efficient. One of these systems is being used to halve the time taken on due diligence work.⁴⁴ Rather than simply searching for critical terms, the system 'reads' documents and can detect missing information. The main reason for introducing it was to process a high volume of data rather than productivity enhancement.⁴⁵

Document discovery is another very time-consuming task that has the potential to be automated with AI. A US law firm used this technology in 2016 to draw out the potentially relevant information from 29m documents.⁴⁶ AI discovery may reduce the chance of missing an important piece of evidence. It may also make the facts in the case clearer at an earlier stage, helping to reach an appropriate outcome faster and making settlement more likely.

---

Case example: An algorithmic competition

A legal technology company organised a contest to test their AI against human legal performance. The competition gave 20 experienced lawyers and an AI system the task of detecting issues in contract clauses. The company chose lawyers who had significant commercial experience in this task, and the contracts they chose were five publicly available non-disclosure agreements.

Both humans and the AI were highly accurate, with the AI performing as well as the highest scoring lawyers in the exercise. The human lawyers, however, took 92 minutes on average to complete their reviews while the AI took 26 seconds.

---

Case example: AI-powered legal privilege review

At the start of 2018, the Serious Fraud Office (SFO) used AI to process more than half a million documents in a day as part of an investigation. This was 2,000 times faster than a human lawyer.⁴⁷ The SFO have decided to use an AI tool for use on all new casework.

---

Case example: Predicting outcomes

Machine learning can analyse huge amounts of historical reference data to identify patterns and relationships, giving insights on future outcomes. This can be used to assess the chances of winning a case, to predict the other party's likely strategy, or to value a settlement.

The ability to predict the outcome and likely settlement value of a case at the outset should contribute to reaching appropriate settlements faster. By giving a better overview of the likely scale and complexity of a case, it should also make cost and time estimates more accurate.

---

Case example: A predictive competition

A legal tech start-up company staged a 'human versus machine' challenge to predict the outcomes of real payment protection insurance (PPI) cases received by the Financial Ombudsman. The result was a comfortable win for the AI system, which was accurate in 86 percent of cases compared to 62 percent for the humans. The team behind the AI stated that their system's victory may have been due to a better grasp of non-legal factors that contributed to the outcome of cases.

---

Case example: Legal operations platforms and improved chatbots

Firms have teamed up with universities and software companies to develop AI software for use in legal services. One alternative business structure (ABS), in conjunction with a US software company and based on university research, developed software to implement global end to end legal operations platforms. This technology aims to support in-house legal teams to make quicker and better decisions, through automation of workflows, data and document generation, case and document management, document storage, reporting and systems integration.

Improved chatbots use AI for natural language understanding and self-learning. This lets them give automated expert advice on more complex situations. One example allows two parties to work together to create agreements, offering expert help when the parties need it. The advice that the parties receive is impartial because the AI is not a human acting for one party. This means that both sides can use the system at the same time without conflict concerns. This shows how AI systems can help solve problems efficiently and collaboratively.

Ethical issues from the use of AI

The question of how to use AI in professional practice while meeting ethical standards has been the subject of some debate.⁴⁸ Some issues that could arise are:

• self-learning systems that have direct interactions with clients are in some ways carrying out the function of a lawyer without a human directly present
• a firm that operates a chatbot to give basic advice online may not be able to identify all the individuals who the system is advising on its behalf
• a self-executing contract in conveyancing may involve the system carrying out a reserved activity without requiring human supervision
• the results of a neural network's analysis may be hard to verify, and it may be hard to understand how the system has reached the conclusions that it has

It is important for those using AI systems to be sure that they are doing so in a way that is consistent with their professional duties. (See also, the section on 'Transparency and bias').

The European Commission has set up an AI Alliance, in partnership with the experts on its High Level Group on Artificial Intelligence, to establish draft guidance on the ethical use of AI.⁴⁹ The alliance allows members to contribute their views while accessing official documents on the subject of AI and adding reports to an open library. The Alliance is likely to produce its draft guidance by the beginning of 2019.

As the use of AI in businesses is relatively new, the ethical issues are still emerging. As with many other issues of innovation, solicitors taking up AI in their work will need to apply the Principles and their own ethical judgment to resolve issues that come up. We discuss some of the issues below and will continue to update the advice that we give as the scope and use of AI develops.

Protecting data

The General Data Protection Regulation (GDPR) applies to personal data being used in the big data models that drive AI. The Information Commissioner's Office (ICO) has set out their views on the implications of big data, AI and machine learning for data protection.⁵⁰

When a firm is training an AI system, they may need to use data from one client's case, so the AI can understand other clients' cases. Solicitors gain expertise by learning from cases and applying that knowledge to others, and the same applies to AI. They must still protect the confidentiality of client data and avoid conflicts.

Some firms may wish to work together and with outside technology companies to produce effective AI. They must determine how best to protect client confidentiality and meet their professional obligations in these cases. It may help to anonymise and aggregate the data and make sure that clients have given their consent to how their data will be used.

All businesses holding sensitive data need to protect it. This is particularly the case in solicitors' firms given their additional duties of confidentiality and legal privilege. AI can be used to assess compliance with GDPR.⁵¹

Our paper, IT Security: Keeping information and money safe, gives more information on the risks, and how to make sure you have effective controls in place. And the ICO's advice line and accessible guidance helps small businesses comply with the GDPR. The Law Society has a guide for solicitors on GDPR compliance.

Transparency and bias

It is important that firms are transparent with their clients about how they are using technology, particularly where issues of data processing and confidentiality are concerned.

Currently AI needs a human to operate it, interpret and confirm its results and quality control the system. As more of the processing work supporting legal services is completed by computers, firms need to be careful that the work remains transparent and to be aware of the associated ethical challenges.⁵²

With GDPR, firms must be able to tell people how their data is used. Firms also need to be able to explain the assumptions and reasoning behind some automated decisions. They may find this difficult where the decisions are made by self-learning AI. This requires some level of expertise and firms will need to invest in this resource. The ICO expects "algorithmic accountability and auditability". In other words, they expect firms to be able to show that their algorithms comply with GDPR.⁵³ And we expect the same from firms – they need to be able to demonstrate that their advice is competent, fair and compliant with their other obligations, such as confidentiality and conflict obligations.

Without transparency, AI is more likely to develop biases without the operator realising this. There have been studies⁵⁴ as well as real world examples of how unwanted biases exist and develop in sophisticated algorithms.⁵⁵ For example, a facial recognition system may fail to recognise all individuals it is supposed to identify if it has only been trained on a single ethnicity.

To address this problem, a group of technology companies including IBM, Microsoft, Facebook and Google formed a partnership in 2017.⁵⁶ The group works to recognise and minimise bias.

Solicitors adopting these technologies must make sure that they monitor the results. They must train them in a way that makes sure that the Principles and Code of Conduct are followed. It is important to monitor the performance of a system on an ongoing basis. In many ways, this is a similar task to that of introducing and supervising a trainee.

One advantage of AI is that checking and testing its workings can be an easier task than analysing human thinking, particularly if the AI has been set up well. While the AI systems used by lawyers can have biases, misunderstandings and errors in the same way as those who train and use them, it can be simpler to identify and correct them.

Open data

AI technology depends on the availability of data for efficiency and development. It is particularly effective when large systems can communicate with one another. The Government recommended in 2017 that data held by public organisations should be made open wherever the risks allow.⁵⁷

We are promoting open data in our 'Better information, more choice' reforms. We will publish more of the regulatory information we hold on firms including a digital register. Firms will also need to make a range of information available, such as prices and the services offered on their websites. The Legal Services Board has approved plans to publish price information for some areas of law, including conveyancing, probate, and small business debt recovery.

Quality assurance and testing

Bias is not the only way that an AI model could produce poor results. The system's decisions or other outputs may not be accurate if:

• a firm uses the wrong type of analytical system for a task
• the system is trained using poor or incomplete data.

As with any type of computer software, there will also be many different types of AI on the market, some of which may vary in quality.

It can be hard to see why AI systems reach the conclusions that they do. Because of this, problems in their reasoning may only become apparent later. By that time, they may have affected the advice that the firm has given or its decisions in litigation. As these systems can learn very quickly, problems in their reasoning can also appear rapidly.⁵⁸

It is important that firms have a structured quality assurance programme for the systems they buy or use. They should test their systems before using them across their operations, for instance:

• piloting a chatbot system before rolling it out to the public
• testing automated discovery on archived files before using it for new cases.

As with avoiding bias when training a system, this testing and assurance should be an ongoing process. Supervisors would assess trainees' work at regular intervals to make sure they are maintaining quality and ethical standards, and they should do the same for AI.

Ethical responsibility and the scope of regulation

Our regulation is based on the outcomes that firms achieve, not the tools that they use to achieve them. For example, we expect firms to give a competent and timely service to their clients, but we would not try to tell them which case management method they should use to do this.

We do not intend to impose any specific rules on the use of IT or AI. It is not for us to say which AI systems firms should buy.

We regulate all activities carried out by recognised bodies and sole practitioners. With ABSs, we regulate all their legal activities and any other activities specified on their licence. If a firm we regulate is using advanced technologies in giving a service that we regulate, then we will regulate that activity on the same basis as any other. This includes where the firm is automating the activity concerned.

Individual solicitors and firms are responsible for the service they give to people, including whether they use technology to advise clients or use it to work on client matters. They cannot outsource this responsibility to a third party. If there is an error or flaw in an AI system run, or provided by, a separate technology company then we are unlikely to take regulatory action where the firm did everything it reasonably could to assure itself that the system was appropriate and to prevent any issues arising. People will of course be able to seek redress in the usual way if they have suffered a loss or detriment, such as taking their complaint forward to the Legal Ombudsman or making a negligence claim.

How we are encouraging technological innovation

Our priorities are the protection of the public, supporting the rule of law and the proper administration of justice.

The Competition and Markets Authority found that the market is not as competitive as it could be and that people who use legal services find it difficult to compare providers and make good choices when purchasing services.

Our Looking to the Future and Better Information programmes include reforms that will see:

• a shorter code of conduct for solicitors and firms
• revised and simplified accounts rules
• revised and simplified authorisation, practising and disciplinary rules
• a revised enforcement strategy based on the maintenance of high professional standards
• removal of restrictions on solicitors offering non-reserved services to the public through any business
• allowing self-employed solicitors to offer reserved services to the public on a freelance basis
• more proportionate financial protections
• more information about pricing, regulatory protections and quality in the market – to help people make better choices.

We believe that these proposed changes will provide a regulatory environment more supportive of innovation, competition and growth. Crucially, increased practising flexibility will allow solicitors to deliver legal services to the public in a range of businesses, including some of the online-based, document review, chat-bot and AI led businesses discussed in this report.

Many of our reforms make it easier for technology to help improve legal services. The unbundling of legal services gives scope for technology to be used alongside traditional methods of service delivery. In many cases the legal process can be broken down into smaller pieces of work, some of which can be automated, or improved through use of technology. Our Looking to the Future programme gives more information about how our ongoing reforms aim to help firms deliver these new models of legal services.⁵⁹

SRA Innovate

To further encourage higher levels of innovation in legal services we have launched our innovation space, SRA Innovate. This gives a dedicated space for innovation, including use of technology. It aims to encourage the development of new services and service delivery methods to benefit the public. Through SRA Innovate, we can grant waivers allowing firms the freedom to explore new ways of working. We have already seen some success stories. Our early information from piloting the scheme is that it has been useful for firms of all sizes as well as new entrants into the legal market.⁶⁰

Firms that have an idea for an innovative way of working, but are unsure about whether it would lead them to breach one of our regulations, can discuss it with our Professional Ethics team. Our team can give information about our approach to granting waivers and the criteria that we consider. Solicitors and firms can also join our Innovate virtual reference group, and help us develop our thinking.

In this paper the examples of technological advances are mostly those adopted by large firms. But firms of any size can benefit from intelligent technologies. We give guidance specifically for small firms on our small firms page on our website.

Legal education

Education needs to meet the needs of a changing market. The flexibility offered by the Solicitors Qualifying Examination will improve opportunities for a more multi-disciplinary approach to legal education. Firms and training providers are taking advantage of this. For example, in 2017 we granted our first approval for a law firm to introduce a technology services training seat for up to six months as part of its training contract programme in 2018. And one of the largest firms has now introduced a dedicated training contract programme specialising in legal technology.

The needs of students give opportunities for business. One legal start-up offers on-demand paralegals through an online portal that connects law students with in-house counsel and firms. This reduces costs and improves access and flexibility to users of legal services. And it shows how technology can be used to give real-world work experience.

We want to see firms using AI and other IT to improve their work and help their clients. It is still, of course, important that they protect client data and money while maintaining their other obligations. We have joined up with the NCSC to create the following list of the best tips for staying safe while using IT.

General principles

Cyber security does not have to be complicated. Following the advice in this section should help you keep your clients and your own business safe. No guide can guarantee to protect you from all threats, but sensible practices can reduce the chance of a successful attack.

• Have sensible and pragmatic security arrangements to support you and your staff while you use IT systems.
  • Security that interferes with your, and your staff's, ability to work is bad security.
• No security measure is completely reliable, and attackers will sometimes succeed.
  • Have a plan to recover from attacks, and to be able to detect when they have happened.
  • Try to minimise the harm that a single breach could cause.

Maintain your system

Keeping your IT equipment up to date is one of the most important and effective things you can do to improve your security. Software developers will update programs on a regular basis to fix vulnerabilities that they have discovered. Your systems are vulnerable until you patch them by installing the update.

• Keep your systems and devices up to date.
• Once a system is no longer supported by its manufacturer and is no longer kept updated, you should replace it.

You also need to make sure that your system and any tools you use are properly defended and that this defence is effective.

• Use antivirus software on all your desktops and laptops.
  • Antivirus software is included for free in most popular operating systems.
  • Mobile phones and tablets may not need separate antivirus software. The NCSC's gives more detail about this.
• Make sure that your system has a firewall, which creates a defence between your own network and the internet.
• Most popular operating systems include a firewall, but you should check that it is switched on and working.

Backup your data

You need to protect not only your clients' confidential information, but you also need to protect your own data to make sure that you can keep operating after an incident. Part of this protection involves keeping effective and regular backups.

• Backup your important data to protect it from loss due to an accident or a ransomware attack.
  • Identify what you need to keep.
  • Make sure that your backup system is not permanently connected to the device holding the original copy, to preserve it if there is a ransomware attack.
  • Make sure that access to backup systems is restricted.
  • A backup on the cloud, or in remote storage you control, would be a useful addition to a local backup system
  • Cloud storage is affordable and can represent a simple solution.
• Make sure that you make backups frequently enough for them to be useful.
  • Automated backup systems can help make backing up a part of your everyday activities.
• Make sure you know how to restore your system from a backup.

For more information, the NCSC produce more detailed advice on backup systems.

Working on the move

The ability to work on the move is a major advantage brought by IT, but you need to protect confidential information. As mobile devices such as smartphones are not used only in the safety of the office, they need careful protection.

• Encrypt laptops and install a system to track and delete data from tablets and phones remotely if they are lost or stolen.
  • Someone who is not authorised to access a device or system should not be able to access information on it or use it to access working systems.
  • A suitable PIN or complex password will protect your device, and many devices include fingerprint recognition.
  • The NCSC give more detailed advice on how to protect mobile devices.
• Be careful about who can see or overhear what you are doing when working with sensitive information.
  • Screen protectors are available which can help stop people from reading over your shoulder.
• Public wi-fi hotspots can be insecure, and it is hard to prove that a hotspot belongs to who it claims.
  • The best option for remote internet access is to use your device's mobile 3G or 4G network, which will have built-in security.
  • Devices without built-in access to mobile networks can use tethering, which shares the connection from another device, or can use a dongle from the mobile provider.
  • If you must use public wi-fi, then you should use a virtual private network from a reputable provider, which secures your data.

Access controls

Your clients' confidential information and your own business data should be accessible to you but not to anyone you have not authorised. When set up correctly, passwords are a free, easy and effective way to secure your systems.

• Use two-factor authentication for log-ins where possible:
  • Two factor authentication means systems that need two different methods to prove identity before they allow access, for instance a password combined with a code sent to a smartphone.
• Make sure that you and all staff avoid predictable passwords, using longer strings of characters that cannot be easily guessed.
  • Make sure your staff have access to good guidance on choosing passwords that are easy to remember but hard to guess.
  • The NCSC give advice on how to choose a non-predictable password.
  • It is acceptable not to change passwords frequently if they are secure to begin with.
  • Change all passwords if you have reason to suspect any breach in the system.
  • Your system should not need staff to share passwords or accounts to do their jobs.
• If staff need multiple passwords, consider whether a password manager could help.
  • Password managers create and store passwords for you and secure them with a master password.
  • As the master password gives access to all the others, it will need to be a strong one, such as a combination of three random words.
• Control access to removable media such as datasticks.
  • Datasticks can be a channel for malware infection and can also be used to steal data.
  • You can reduce the need for datasticks by using email or cloud storage to transfer data.
• Do not use an administrator account on your system (a user account with the privilege to access others' accounts or install new software) for regular work.
  • Reserve administrator accounts for when the system needs to be maintained.
  • Reserve them for use by those whose responsibilities require them to maintain the system.

Phishing

Phishing attacks are when criminals use fake communications to try to steal information or money. These are the main cyber security threat to solicitors and their firms at present. Whatever your firm's size or type of work, you will receive phishing attempts. Some of these attacks will get past even the most observant users.

• Consider why criminals might want to target your organisation to help decide how to prevent this.
• Make sure your staff know your normal operating procedures, particularly considering interactions with other organisations, so they are in a better place to spot requests that are out of the ordinary.
• Make sure you have a process for staff to seek help if they are unsure.
• Decide what you and your staff should do with a communication that may be a phishing attempt.
• Many phishing attempts impersonate a senior member of your staff and aim to get a junior staff member to send money or information urgently. A clear reporting line for genuine instructions will help to protect from this.
• It can help to consider how your communications appear to your clients, suppliers and other firms, to make sure that your own communications are not mistaken for phishing emails and do not leave others vulnerable.
  • Including a routine warning note that your bank details will not change at any point in a transaction will help to prevent email modification frauds.

It would be unrealistic to expect staff to identify all phishing emails. However, there are common warning signs.

• Some phishing scams use poor spelling or grammar or are not of the level of quality or design expected from the sender they are impersonating.
• Less targeted phishing emails may address you as "valued customer" rather than by name.
• Be suspicious of invoices that relate to services you are not aware of having ordered, or of emails that claim you have been a victim of some form of crime.

The NCSC give more detailed advice on how to protect yourself from phishing.

Training and testing

It is important that all your staff understand how to use IT systems safely. You should make sure that they know why you have put security measures in place.

• Use training to help build a culture of reporting, where staff feel comfortable coming forward with issues that they have encountered.
• Test security systems to make sure that you are confident that they are working and that you know what to do in the event of an incident. If you are using advanced systems such as AI, be aware that algorithms can contain errors or hidden biases.
  • Test your proposed system against a variety of situations to make sure you are satisfied before using it for real cases.