Cybersecurity for Law Firms and Notaries in Quebec

Thursday, 4 p.m., at a notarial office in the West Island. A home sale is set to close the next morning. The buyer receives an email that appears to come from the office: "Due to a change of financial institution, please wire the down payment to the account below." The logo, the signature block and the tone are perfect. Only the sender's address is off by a single letter.

To a fraudster, law firms and notarial offices offer everything at once: confidential information, large sums moving through trust accounts, and email exchanges with clients who trust their professional. Professional secrecy doesn't stop at the server room door.

The rules of the Barreau du Québec and the Chambre des notaires actually contain more specific technology obligations than many practitioners realize. Let's go through them, then get to the practical measures.

Professional secrecy in the age of email

Neither the Barreau nor the Chambre bans the cloud or email. Their rules are technology-neutral: the Barreau's practice regulation defines a file as all the documents of a mandate, kept on paper or on a medium based on information technology. What matters is the outcome: confidentiality must be ensured, whatever the tool.

Since 2020, the lawyers' code has said so explicitly: the knowledge and skills a lawyer must keep current include those relating to the information technologies used in their professional activities. In other words, "I'm not a tech person" is no longer a defence. Nobody expects you to configure a firewall, but you do need to understand the risks of the tools you choose.

If you practise outside Quebec, your law society has its own rules. The threats described below are the same everywhere.

What the orders' regulations say

One note on the safe requirement: if your backups are in the cloud, check with the Chambre how it applies to your setup. The two practice regulations are only available in French on LégisQuébec.

Both orders also publish guides (in French). The Barreau offers a guide on managing and securing information technology for lawyers and their teams, along with a practical privacy guide that confirms Quebec's private-sector privacy law applies to law firms. In 2023, the Chambre des notaires published a document on the information protection obligations of notaries and their technology providers.

The threats facing firms

• Wire fraud. The fraudster slips into an email thread between the office, the client, the broker or the lender, then swaps the banking details at the right moment. It's vendor banking change fraud applied to trust funds.
• A compromised mailbox. Weeks of silent access let an attacker read litigation strategy or ongoing negotiations.
• Ransomware that locks your files the day before a hearing or a closing.
• A lost laptop, unencrypted, left on the commuter train or at the courthouse.
• Generative AI, when someone pastes a client contract into a public tool to summarize it. See our article on generative AI and data leaks.

An example: at a six-lawyer firm in downtown Montréal, a hidden forwarding rule on an assistant's mailbox had been sending a copy of every email containing the word "judgment" to an outside address for a month. The password had been phished, and multi-factor authentication wasn't turned on.

Priority measures

Here's the checklist our team uses as a starting point with legal practices:

• Multi-factor authentication on email, document management, trust accounting software and remote access (see how to choose your MFA).
• Trust account details given to the client early in the mandate, through a channel other than email.
• A line in every transaction email: "We will never change our banking details by email."
• Any unusual payment instruction confirmed by phone, at the number already on file.
• Encrypted laptops and phones, with automatic screen lock.
• A secure portal or file share for sensitive documents.
• Tested backups, including an offline copy; for notaries, storage that complies with section 32.
• Digital signature card or key never lent out, and its code never shared, not even with a trusted assistant.
• Confidentiality agreements for staff, articling students and the IT provider.
• A quarterly review of forwarding rules and delegated mailbox access.
• A designated privacy officer and an up-to-date incident register.

When an incident happens

If a wire has been diverted, every hour counts: call your financial institution immediately to try to stop the funds, then the police. For a compromised account, reset credentials, end sessions and look for forwarding rules before anything else.

Then come your Law 25 obligations. If the incident presents a risk of serious injury, you must promptly notify the Commission d'accès à l'information and the people affected; either way, it goes in the register. The process is covered in our article on reporting an incident to the CAI. Notify your professional liability insurer as well, and turn to your order for ethics questions.

Our team can assess your firm's security, from your Microsoft 365 configuration to your payment procedures, as part of a cybersecurity audit. If your office is in Greater Montréal, one of our experts can meet you on-site, discreetly.