Why Are Courts Making Cybersecurity Forensics Reports Not Privileged?

A lesson learned by young lawyers everywhere is that internal, corporate investigations can be, and frequently are, privileged. However, it is difficult to square that concept with the recent spate of federal court opinions that have concluded that cybersecurity forensic reports generally are not privileged. These rulings, which have been well documented elsewhere, have come perilously close to holding that cybersecurity forensic reports can never be privileged. What is unclear is why courts have decided to blaze new privilege ground when application of existing, internal investigation rules of privilege were — and are — available to resolve the question before them. And unfortunately, the abandonment of established privilege doctrines have had a counterproductive impact.

Privilege, Work Product and Internal Investigations

In 1981, the Supreme Court made clear that a corporation can be a "client" for purposes of asserting the attorney-client privilege. See, Upjohn v. United States, 449 US 383. Since that time, a body of well-developed case law has enshrined the concept that internal investigations from employee interviews to the work of consultants can – and often are – protected by the attorney client privilege or work product doctrine. See, e.g., Admiral Insurance Co. v. U.S. District Court for the District of Arizona, 881 F.2d 1486 (9th Cir. 1989); Sandra T.E. v. S. Berwyn Sch. Dist. 100, 600 F.3d 612, 619-20 (7th Cir. 2010); Fed. Savs. Bank v. United States, 55 Fed. Cl. 263, 268-69 (Fed. Cl. 2003). These protections are, as one court observed, critical. "[E]xcessively narrow discovery rulings with respect to the attorney-client and work product privileges may discourage internal investigations …." Gray v. Cleaning Sys. & Suppliers, Inc., 143 F.R.D. 48, 49 (S.D.N.Y. 1992).