In this three-part series from our partner, RPost, you will learn about the importance of secure e-delivery and ways to safeguard your critical client communications. While a lawyer’s ethical obligation to protect confidential information online has been a concern for some time, the ABA Standing Committee on Ethics and Professional Responsibility has recently issued ABA Formal Opinion 477R, which provides direction regarding when heightened security measures are warranted.
According to Foreign Policy, The Pentagon was a recent victim of an email spoofing campaign. Pentagon colleagues, partners and vendors received fake emails that appeared to have been sent from Defense Security Service (DSS) employees. Cyber criminals were most likely trying to hack into company servers and then find a backdoor into the Pentagon server itself.
Most business owners don’t know how easy it is to send a fake email that appears to come from a colleague, vendor or even a public figure. This is one of many common misconceptions about email security and delivery. Here are some other common assumptions that are made every day:
1. I did not get a bounce notice, so I know my email got there.
This is a false assumption.
Why? Email technologists estimate that more than half of recipient mail servers do not return bounce notification emails.
In case you are curious why some mail servers are configured to not return bounce notices, here is a slightly technical explanation. Spammers often send spam relayed through unknowing ISP mail servers to every conceivable iteration of “yourname@yourfirm.com”. They will use automated systems to send to y.name@yourfirm.com, your.name@yourfirm.com, your.n@youfirm.com, and so on. Since most of these are not real addresses, your firm would be sending thousands of bounce notices back to unknowing sending ISP servers if your firm’s mail servers were configured to send bounce notices. The sending ISP servers would then believe your firm’s servers were sending it spam, possibly resulting in your firm’s email servers getting blacklisted. Your firm’s legitimate email would then simply disappear (before reaching the recipients) until your IT staff cleared up the blacklisting issue. This phenomenon is called “backscatter blacklisting”.
2. I copied (cc’d or bcc’d) myself and got the copy – so I know my message was delivered to all recipients.
This is a false assumption.
Why? Receipt of internal email within the organization does not have any bearing as to whether or not the email got to the Internet – and certainly does not prove delivery.
Here is a technical explanation of why that is the case. In most cases, if the sender and recipient have the same email domain (the domain being “@yourfirm.com”), the email will never need to transmit from your mail server to the Internet to reach the recipient. The email will travel from your computer to your mail server, and then, if your mail server sees the recipient domain as its own, it will look up the recipient in its own local directory, and put the email into that recipient folder (mailbox) locally on the mail server. The email will not need to be transmitted to the Internet to reach the recipient.
In the case where you copy yourself (or staff) on the message going to an external party, the message to your (and your staff) will remain on your mail server, and the message copy for the external party will transmit to the Internet. Whether it is delivered will be dependent on a number of Internet delivery variables, but delivery success is independent of whether or not you (or staff) received their copy.
CARET Legal is the only legal practice management software with integrated RPost email encryption that is easy for both senders and recipients to use. Learn more about RMail. RMail is an RPost service.
Written by CARET Legal partner, RPost, the creator of the patented Registered Email™ technology. RPost provides email senders with Legal Proof® evidence of delivery, time of delivery, and exact message content in the form of a Registered Receipt™ email record.
