Cyber Breach Forensic Reports: Is Your Report Discoverable?
Although few courts have addressed attorney-client privilege and work product protection in the context of forensic reports, trends have emerged providing insight on how to handle them.
December 17, 2019 at 09:30 AM
6 minute read
Due to the growing prevalence of data breaches and ransomware attacks, courts have been forced to interpret and nuance privilege in the context of post-breach forensic reports. One major consideration in the context of data breach litigation strategy is how to protect forensic reports prepared by outside forensic firms from discovery in civil litigation. If the forensic report is discoverable, it could be used by the opposing party and ultimately become part of the public record in litigation.
Companies and organizations generally want to maintain privilege over forensic reports because of the likely value to potential plaintiffs. In particular, forensic reports typically identify the likely method by which a threat actor accessed a company's IT environment. In doing so, the report generally highlights critical vulnerabilities in its IT environment. Such information may identify areas in which a company failed to maintain industry standards, thereby potentially breaching its contractual and fiduciary obligations to protect sensitive information.
Courts continue to wrestle with applying conventional legal notions of privilege to novel fact patterns, often resulting in inconsistent or disappointing court decisions. Courts have held that, in certain circumstances, such forensic reports are protected by both attorney-client privilege and work product protection. Although there are few cases discussing these doctrines in the context of forensic reports, the cases provide guidance on what a company or organization can do to bolster claims that its post-breach forensic reports are shielded from discovery in civil litigation.
|Attorney-Client Privilege
Only one court has directly addressed whether forensic reports are protected by attorney-client privilege. In Genesco, Inc. v. Visa U.S.A., Inc., a case involving a cyber-attack on a retail store, the defendant's outside counsel engaged a forensic firm to assist with a privileged factual investigation as to how the cyber-attack occurred. The Middle District of Tennessee court found that the attorney-client privilege protects attorneys' factual investigations, and the protection extends to attorneys' communications with agents and experts who are retained for the purpose of providing legal advice. Accordingly, the court held that the report was protected from disclosure by the attorney-client privilege because it was: (1) prepared by the forensic firm at the direction of outside counsel; and (2) prepared to aide counsel in providing legal advice.
Companies should be mindful that attorney-client privilege is easily waived. Subject to a few exceptions, attorney-client privilege is generally waived when the holder voluntarily discloses privileged information to a third party. Thus, to reduce the likelihood that privilege is waived, a company should take care to not disclose the forensic report to any third party, without further guidance from counsel.
|Work Product Protection
Multiple federal courts have held that in certain instances, forensic reports are protected by work product protection. Whether a document is work product generally comes down to whether the document was prepared in anticipation of litigation. Although courts use different tests to interpret this phrase, trends have emerged providing guidance on how to obtain work product protection of forensic reports:
- Outside counsel should retain the forensic firm on behalf of the company or organization as opposed to serving as merely a supervisory party after the firm has been engaged by a company; and
- The engagement letter with the forensic firm should include language making sufficiently clear that the purpose of the engagement is to assist outside counsel to prepare for litigation.
Companies should bear in mind that work product protection can be overcome by a finding of substantial need by the adverse party. To strengthen the argument against finding a substantial need, outside counsel should ensure that the forensic firm conducts its investigation based on documentation that can be provided to an adverse party for an independent investigation.
In the wake of a data breach, internal and external parties may seek to obtain a copy of the report. In particular, external parties could include insurance carriers, external auditors, affiliate companies, and regulatory agencies. Internal parties may include a parent company, the incident response team, IT Department, and vendors or consultants retained by outside counsel.
In contrast to attorney-client privilege, work product protection is not automatically waived by disclosure to a third party. To determine whether work product protection is waived, most courts distinguish between disclosures to an adversary versus a non-adversary. This approach has been used in the context of forensic reports as the court in In re Experian Data Breach Litig. held that forensic reports may be disclosed to third parties so long as the disclosure is "consistent with maintaining the secrecy against opponents."
Recognizing that disclosure to selective third parties may be an appropriate business decision, companies can take precautionary measures to reduce the risk that work product protection will be waived, including:
- Redacting the report as much as possible;
- Requiring the receiving party to sign a confidentiality agreement; and
- If applicable, entering into a common interest agreement with the receiving party.
Even so, providing a forensic report to a third party increases the risk of wavier. Therefore, companies should maintaining tight control over to whom disclosure of a forensic report is made and consult with counsel before doing so.
Companies should also consider whether waiving protection vis-à-vis one potential adversary waives work product protection in litigation with future adversaries. Although this issue has not been addressed by the courts in the context of forensic reports, under the traditional analysis, federal courts use different tests to determine whether a party may selectively waive privilege.
Although few courts have addressed attorney-client privilege and work product protection in the context of forensic reports, trends have emerged providing insight on how to handle forensic reports. Due to the growing prevalence of data breach litigation and the importance of shielding forensic reports from potential plaintiffs, this is an area of law likely to be addressed by courts in the near future.
Leah K. Parsons is an associate at Squire Patton Boggs, focusing primarily on corporate matters, including mergers and acquisitions, venture capital transactions and corporate governance.
Ericka A. Johnson is an associate at Squire Patton Boggs, where she represents companies and executives in, among other things, Foreign Corrupt Practices Act (FCPA) internal investigations, enforcement actions, defense matters and compliance before the US Department of Justice and similar authorities. As part of her compliance practice, Ericka advises companies on cybersecurity risks, internal compliance measures and incident response protocols.
Colin R. Jennings is a partner at Squire Patton Boggs, where his practice focuses on global compliance work for public and privately held companies. In addition to his operations compliance work, Colin offers investigation and defense of compliance-related concerns. As a natural extension of his practice, Colin has an active data privacy and breach response practice, and he regularly interacts with federal, state and international authorities concerning data breaches, as well as coordinates the forensic analysis and resulting claims or litigation that inevitably follow a breach.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllLaw Firms Mentioned
Trending Stories
- 1Call for Nominations: The Recorder and Law.com's California Legal Awards 2025
- 2The Week in Data Dec. 13: A Look at Legal Industry Trends by the Numbers
- 3Antitrust Class Actions Against CVS, Other Pharmacy Benefit Managers Are Piling Up
- 4Judge Grinds NY's Cannabis Licensing Regime to a Halt Again
- 5On the Move and After Hours: Barclay Damon; VLJ; Barnes & Thornburg
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250