In “The 80/20 Principle,” Ernie Svenson demystifies technology and introduces tools that improve your workday. This edition: A reminder that secure file sharing for lawyers includes checking all those share links that never expired.
In August of last year, Forbes reported that Google had indexed more than 370,000 conversations with Grok. Around the same time, Fast Company found thousands of shared ChatGPT conversations sitting in search results — names, resumes, confidential work material.
No model leaked anything. Nobody was hacked.
Both Exposures Came From the Share Link
OpenAI had a checkbox that made a shared chat discoverable by search engines, and enough people clicked it without understanding what it did that OpenAI removed the feature. Grok’s share links were published to the web and left open to search engines, apparently without users realizing it.
The AI part worked fine. The sharing is what failed.
That’s worth a minute of your attention, because the same mechanism is already running in your practice, and it’s much older than any chatbot.
Your Links Don’t Expire
Let it sink in.
In 2021 you sent a client a Dropbox link. Or a co-counsel. Or an expert.
That link still works.
Not “might still work.” Share links don’t expire on their own. Unless somebody turned it off, every link you’ve created is still live, still pointing at whatever is in that folder now, and still openable by anyone who has it — in an old email, in a forwarded email, in an inbox that got breached three years ago.
Here’s how to find out how bad it is.
Go Look at Your Cloud Storage
Open your cloud storage on the web, not the app on your desktop.
Fair warning: Neither Dropbox nor Google makes this easy for one person to check their own account. Dropbox’s help documentation doesn’t describe any way for an individual user to pull up a list of every link they’ve created. Google’s documentation covers finding files shared with you, not a list of what you’ve shared out. Worth checking for yourself, because both companies change their interfaces constantly.
If you’re on a Dropbox team, your admin has more to work with: The admin console has an external sharing view that shows files, folders and links shared outside your team. Google Workspace admins have their own reporting.
For everybody else, it’s folder by folder. Which sounds worse than it is, because you don’t need to check all of them.
Start with matters you’ve closed. Open each folder’s sharing settings and look for two things: links set so anyone with the link can open them, and people who still have access.
Ten folders will tell you what you need to know.
What Turns Up
- The client folder you shared during a matter you closed in 2022.
- The folder you shared with a contract attorney who hasn’t worked with you since who knows when.
- A link you made to send one document, now pointed at a folder that holds 40.
- The former assistant who still has access, because nobody removes people — they just stop inviting them.
None of that is a hack. It’s all working exactly as designed.
Fix What You Find
Kill the links you don’t need. Turn “anyone with the link” into named people. Remove anyone who’s gone. If a matter is closed, the sharing on that folder should be closed too.
Then make it a habit: Closing a matter includes closing its sharing.
Then Do It Four More Times
Secure file sharing for lawyers isn’t a one-time thing. The same question works on every system you own, and each one is about as quick:
- Your email. Any forwarding rules you didn’t set up this year? Somebody set one up to a personal Gmail account and forgot about it.
- Your practice management system. Does everyone have full access because setting up roles was tedious? Check who can open what.
- Your note-taker. What does it keep after the meeting — audio, transcript, summary — and can you delete it? Answer that before your next client call, not after.
- Anything that sends on its own. Review requests, marketing sequences, and alerts. Would you want that going to a criminal defense client?
The Bottom Line: The Boring Setting Is the Risk
The Grok and ChatGPT stories got attention because they involved AI. They weren’t really about AI. They were about a sharing setting that did precisely what it was configured to do, for longer than anyone was paying attention.
You have those settings too, and yours are pointed at client files. Start with your closed-matter folders. That one you can finish today.
More From Ernie Svenson and the 80/20 Principle
AI Note-Takers for Lawyers: The Recording Risk You Need to Fully Understand
AI Training for Lawyers: Why One Skill Beats Nine Prompts
Your Law Firm’s Knowledge Is Trapped: A Chatbot Can Let It Out
How Using AI Skills for Law Firm Workflows Can Turbocharge Your SOPs
Why I Switched From ChatGPT to Claude (And What Finally Pushed Me Over)
Loom for Lawyers: Why You Should Be Creating Shareable Videos
Top 8 Tech Tools for Solo and Small Firm Lawyers to End the Chaos
AI Tools for Lawyers: Why You Shouldn’t Stick to Just One
Our Fingers Can’t Keep Up With AI
Image © iStockPhoto.com.
Sign up for Attorney at Work’s daily practice tips newsletter here and subscribe to our podcast, Attorney at Work Today.
