Law.com Subscribers SAVE 30%

Call 855-808-4530 or email [email protected] to receive your discount on a new subscription.

Business Crimes BulletinFeaturesEvidenceWhite Collar Crime

Why Are Courts Making Cybersecurity Forensics Reports Not Privileged?

By David P. Saunders
October 01, 2021

A lesson learned by young lawyers everywhere is that internal, corporate investigations can be, and frequently are, privileged. However, it is difficult to square that concept with the recent spate of federal court opinions that have concluded that cybersecurity forensic reports generally are not privileged. These rulings, which have been well documented elsewhere, have come perilously close to holding that cybersecurity forensic reports can never be privileged. What is unclear is why courts have decided to blaze new privilege ground when application of existing, internal investigation rules of privilege were — and are — available to resolve the question before them. And unfortunately, the abandonment of established privilege doctrines have had a counterproductive impact.

Privilege, Work Product and Internal Investigations

In 1981, the Supreme Court made clear that a corporation can be a "client" for purposes of asserting the attorney-client privilege. See, Upjohn v. United States, 449 US 383. Since that time, a body of well-developed case law has enshrined the concept that internal investigations from employee interviews to the work of consultants can – and often are – protected by the attorney client privilege or work product doctrine. See, e.g., Admiral Insurance Co. v. U.S. District Court for the District of Arizona, 881 F.2d 1486 (9th Cir. 1989); Sandra T.E. v. S. Berwyn Sch. Dist. 100, 600 F.3d 612, 619-20 (7th Cir. 2010); Fed. Savs. Bank v. United States, 55 Fed. Cl. 263, 268-69 (Fed. Cl. 2003). These protections are, as one court observed, critical. "[E]xcessively narrow discovery rulings with respect to the attorney-client and work product privileges may discourage internal investigations …." Gray v. Cleaning Sys. & Suppliers, Inc., 143 F.R.D. 48, 49 (S.D.N.Y. 1992).

While the privilege and work product protections afforded internal investigations are not absolute, the point remains that there exists a well-developed body of case law analyzing privilege and work product claims in the context of internal investigations. Yet, when confronted with internal cybersecurity investigations, the federal courts largely have abandoned this well-trod area of privilege and have been busy crafting a new body of jurisprudence.

This premium content is locked for Entertainment Law & Finance subscribers only

  • Stay current on the latest information, rulings, regulations, and trends
  • Includes practical, must-have information on copyrights, royalties, AI, and more
  • Tap into expert guidance from top entertainment lawyers and experts

For enterprise-wide or corporate acess, please contact Customer Service at [email protected] or 877-256-2473

Read These Next
Overview of Regulatory Guidance Governing the Use of AI Systems In the Workplace Image

Businesses have long embraced the use of computer technology in the workplace as a means of improving efficiency and productivity of their operations. In recent years, businesses have incorporated artificial intelligence and other automated and algorithmic technologies into their computer systems. This article provides an overview of the federal regulatory guidance and the state and local rules in place so far and suggests ways in which employers may wish to address these developments with policies and practices to reduce legal risk.

Is Google Search Dead? How AI Is Reshaping Search and SEO Image

This two-part article dives into the massive shifts AI is bringing to Google Search and SEO and why traditional searches are no longer part of the solution for marketers. It’s not theoretical, it’s happening, and firms that adapt will come out ahead.

While Federal Legislation Flounders, State Privacy Laws for Children and Teens Gain Momentum Image

For decades, the Children’s Online Privacy Protection Act has been the only law to expressly address privacy for minors’ information other than student data. In the absence of more robust federal requirements, states are stepping in to regulate not only the processing of all minors’ data, but also online platforms used by teens and children.

Revolutionizing Workplace Design: A Perspective from Gray Reed Image

In an era where the workplace is constantly evolving, law firms face unique challenges and opportunities in facilities management, real estate, and design. Across the industry, firms are reevaluating their office spaces to adapt to hybrid work models, prioritize collaboration, and enhance employee experience. Trends such as flexible seating, technology-driven planning, and the creation of multifunctional spaces are shaping the future of law firm offices.

From DeepSeek to Distillation: Protecting IP In An AI World Image

Protection against unauthorized model distillation is an emerging issue within the longstanding theme of safeguarding intellectual property. This article examines the legal protections available under the current legal framework and explore why patents may serve as a crucial safeguard against unauthorized distillation.