What Makes Forensic Reports Different?

Privilege, Work Product and Internal Investigations

In 1981, the Supreme Court made clear that a corporation can be a "client" for purposes of asserting the attorney-client privilege. See, Upjohn v. United States, 449 US 383. Since that time, a body of well-developed case law has enshrined the concept that internal investigations from employee interviews to the work of consultants can — and often are — protected by the attorney client privilege or work product doctrine. See, e.g., Admiral Insurance Co. v. U.S. District Court for the District of Arizona, 881 F.2d 1486 (9th Cir. 1989); Sandra T.E. v. S. Berwyn Sch. Dist. 100, 600 F.3d 612, 619-20 (7th Cir. 2010); Fed. Savs. Bank v. United States, 55 Fed. Cl. 263, 268-69 (Fed. Cl. 2003). These protections are, as one court observed, critical. "[E]xcessively narrow discovery rulings with respect to the attorney-client and work product privileges may discourage internal investigations. …." Gray v. Cleaning Sys. & Suppliers, Inc., 143 F.R.D. 48, 49 (S.D.N.Y. 1992).

While the privilege and work product protections afforded internal investigations are not absolute, the point remains that there exists a well-developed body of case law analyzing privilege and work product claims in the context of internal investigations. Yet, when confronted with internal cybersecurity investigations, the federal courts largely have abandoned this well-trod area of privilege and have been busy crafting a new body of jurisprudence.