Since March 2020, online mediation has established itself as the safest way to mediate cases. In this context, “safety” is a relative term. Online video-conference technology is certainly safe in terms of preventing exposure to COVID-19. But how safe is it in terms of security, confidentiality, and party self-determination in mediation?
The security of video-conferencing platforms used for online mediation such as Zoom, Microsoft Teams, and others is evolving and improving. In our opinion, the level of encryption—a mathematical formula, or algorithm, used to change data into unreadable and readable forms, such as 256-bit or “end-to-end” encryption—is less important than how users safeguard passwords and hyperlinks to online meetings. Many of the security threats about which we heard months ago, including “Zoom bombing,” were caused by users who forwarded links or passwords to the public on social media or to others who were not careful to safeguard that information.
Much has changed since then. Zoom has tweaked numerous default settings to better manage, if not eliminate, unwanted parties from meetings. Some platforms, for higher subscription fees, will certify security compliance with the Health Insurance Portability and Accounting Act (HIPAA) and other privacy laws and regulations.
Other than the security of a particular platform, a number of important ethical concerns are raised when parties mediate disputes online. Confidentiality and mediator neutrality, for instance, are core principles in mediation. Video conferencing platforms have numerous settings that must be programmed to protect information from unwarranted disclosure. Each mediation must be carefully managed for the same reason: to avoid disclosing information intended to be kept confidential. Mediators have an ethical obligation to competently operate all technologies that facilitate settlement discussions. In addition, mediation is intended to serve the interests of the parties, and to that end, the mediator is responsible for helping the parties make informed choices about which technologies to use. For these reasons, users should be wary of mediators who do not understand or will not manage these technologies.
Rather than take the time to understand video-conferencing technology, some mediators allow one of the participating law firms to manage the platform and “host” the session, which gives that firm complete control over the platform. Alternatively, some mediators will hire (at the parties’ expense) a fourth party, such as a deposition transcription company, to control the platform’s settings and manage the mediation. In either situation, the participants and mediator, alone or in combination, sow the seeds for problems: they lose control over confidentiality; they create a forum that is not neutral or may not appear neutral to the parties; and they prohibit the parties’ ability to decide for themselves what technologies will be used in the mediation. The lawyers in these circumstances have not, however, shed themselves of the non-dischargeable responsibility to maintain client confidences. A number of security and ethical concerns warrant consideration before scheduling and engaging in an online mediation session.
Exposing confidential information, intentionally or by accident, is a cardinal sin of a mediator. At the outset, from our view, the question advocates should ask themselves is, “Who should control the platform and its security settings?” Where trust between litigating parties is non-existent or in very short supply, why would anyone give control of the platform to their opponent, even assuming the risks were fully explained?
On the surface, hosting an online mediation may appear to be the same as hosting an in-person mediation. But there are critical differences. Most video-conferencing platforms permit recording, chat messaging, screen sharing, and other forms of communication that need to be disabled or managed by the mediator, not someone else who cannot assume the mediator’s obligations to maintain confidentiality and neutrality. Under “normal” circumstances, you would not want your mediator to assign those obligations to your opponent or anyone else, especially a non-mediator who is unaware of ethical issues in mediation. From a practical perspective, you would not expect to hire a fourth party at an in-person mediation to manage the “waiting room” or the breakout rooms, reassign people to different caucus discussions, or assist the parties with drafting a term sheet. Again, who should be able to perform these functions?
Party participants should not regard the online mediation forum as anything other than neutral. They also have roles and responsibilities in managing the security of the platform. Mediators should develop and circulate protocols that explain the importance of information security and confidentiality, and they should set forth standards of acceptable online behavior. The participants can and should take an active role in revising the protocols to best suit their mediation needs.
Most importantly, the mediator must have all participants agree in advance not to share the meeting number or password with anyone else; not to record anything on their smartphones; and acknowledge that no one else is physically present in the room with them or can overhear their conversations during the mediation. The mediator’s concern for confidentiality is no different than counsel’s concern for inadvertent waivers of privilege caused by unmuted audio equipment or the presence of non-clients. These assurances are easily obtained. If your mediator is not doing this, then who is?
Public-health concerns need not impede access to a secure and ethical mediation. New developments bring new challenges and responsibilities. Most law practices already understand the need to maintain robust internal information security protocols as part of their firm’s office-management practices. The mediation process that is ancillary to trial practice is no different; the same expectations should apply to mediation practice. Mediators, like law firms, should be expected to keep up with the changing times while maintaining competency, confidentiality, neutrality, and party self-determination regardless of where and how they practice.