This article appeared in Cybersecurity Law & Strategy, an ALM publication for privacy and security professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers, Corporate Counsel, Internet and Tech Practitioners, In-House Counsel. Visit the website to learn more.

A lesson learned by young lawyers everywhere is that internal, corporate investigations can be, and frequently are, privileged. However, it is difficult to square that concept with the recent spate of federal court opinions that have concluded that cybersecurity forensic reports generally are not privileged. These rulings, which have been well documented elsewhere, have come perilously close to holding that cybersecurity forensic reports can never be privileged. What is unclear is why courts have decided to blaze new privilege ground when application of existing, internal investigation rules of privilege were — and are — available to resolve the question before them. And unfortunately, the abandonment of established privilege doctrines have had a counterproductive impact.

Privilege, Work Product and Internal Investigations