Law.com Subscribers SAVE 30%

Call 855-808-4530 or email [email protected] to receive your discount on a new subscription.

Business Crimes BulletinFeaturesEvidenceWhite Collar Crime

Why Are Courts Making Cybersecurity Forensics Reports Not Privileged?

By David P. Saunders
October 01, 2021

A lesson learned by young lawyers everywhere is that internal, corporate investigations can be, and frequently are, privileged. However, it is difficult to square that concept with the recent spate of federal court opinions that have concluded that cybersecurity forensic reports generally are not privileged. These rulings, which have been well documented elsewhere, have come perilously close to holding that cybersecurity forensic reports can never be privileged. What is unclear is why courts have decided to blaze new privilege ground when application of existing, internal investigation rules of privilege were — and are — available to resolve the question before them. And unfortunately, the abandonment of established privilege doctrines have had a counterproductive impact.

Privilege, Work Product and Internal Investigations

In 1981, the Supreme Court made clear that a corporation can be a "client" for purposes of asserting the attorney-client privilege. See, Upjohn v. United States, 449 US 383. Since that time, a body of well-developed case law has enshrined the concept that internal investigations from employee interviews to the work of consultants can – and often are – protected by the attorney client privilege or work product doctrine. See, e.g., Admiral Insurance Co. v. U.S. District Court for the District of Arizona, 881 F.2d 1486 (9th Cir. 1989); Sandra T.E. v. S. Berwyn Sch. Dist. 100, 600 F.3d 612, 619-20 (7th Cir. 2010); Fed. Savs. Bank v. United States, 55 Fed. Cl. 263, 268-69 (Fed. Cl. 2003). These protections are, as one court observed, critical. "[E]xcessively narrow discovery rulings with respect to the attorney-client and work product privileges may discourage internal investigations …." Gray v. Cleaning Sys. & Suppliers, Inc., 143 F.R.D. 48, 49 (S.D.N.Y. 1992).

While the privilege and work product protections afforded internal investigations are not absolute, the point remains that there exists a well-developed body of case law analyzing privilege and work product claims in the context of internal investigations. Yet, when confronted with internal cybersecurity investigations, the federal courts largely have abandoned this well-trod area of privilege and have been busy crafting a new body of jurisprudence.

This premium content is locked for Entertainment Law & Finance subscribers only

  • Stay current on the latest information, rulings, regulations, and trends
  • Includes practical, must-have information on copyrights, royalties, AI, and more
  • Tap into expert guidance from top entertainment lawyers and experts

For enterprise-wide or corporate acess, please contact Customer Service at [email protected] or 877-256-2473

Read These Next
Strategy vs. Tactics: Two Sides of a Difficult Coin Image

With each successive large-scale cyber attack, it is slowly becoming clear that ransomware attacks are targeting the critical infrastructure of the most powerful country on the planet. Understanding the strategy, and tactics of our opponents, as well as the strategy and the tactics we implement as a response are vital to victory.

Major Differences In UK, U.S. Copyright Laws Image

This article highlights how copyright law in the United Kingdom differs from U.S. copyright law, and points out differences that may be crucial to entertainment and media businesses familiar with U.S law that are interested in operating in the United Kingdom or under UK law. The article also briefly addresses contrasts in UK and U.S. trademark law.

The Article 8 Opt In Image

The Article 8 opt-in election adds an additional layer of complexity to the already labyrinthine rules governing perfection of security interests under the UCC. A lender that is unaware of the nuances created by the opt in (may find its security interest vulnerable to being primed by another party that has taken steps to perfect in a superior manner under the circumstances.

Role and Responsibilities of Practice Group Leaders Image

Ideally, the objective of defining the role and responsibilities of Practice Group Leaders should be to establish just enough structure and accountability within their respective practice group to maximize the economic potential of the firm, while institutionalizing the principles of leadership and teamwork.

Removing Restrictive Covenants In New York Image

In Rockwell v. Despart, the New York Supreme Court, Third Department, recently revisited a recurring question: When may a landowner seek judicial removal of a covenant restricting use of her land?