Question: My company’s network has been hacked, and we think sensitive consumer information has been stolen. We hired a forensic consultant to help us determine the scope of the invasion. Will our communications with our forensic consultant and their reports be protected under the attorney-client privilege and/or the attorney work product doctrine?
Answer: It depends on the circumstances, but you can take some steps to increase the likelihood that the communications and reports will be protected.
- Involve outside counsel. With respect to the attorney-client privilege, courts have viewed corporate in-house counsel as having "mixed" responsibilities at their corporations (i.e., both legal and business roles), and thus communications made between in-house attorneys and in-house business people may not always be held to be privileged. In contrast, outside counsel typically are not seen as serving a mixed responsibility role in that they are usually engaged for "the purpose of obtaining legal advice." Consequently, there is a greater likelihood that a court will uphold the attorney-client privilege with respect to communications between a company and its retained law firm.
- Use outside counsel to prepare work product. In addition, depending on the circumstances, it also may be easier to convince a court that the work product developed by an outside law firm in a pre-litigation context was prepared "in anticipation of litigation" (as opposed to some other reason) and therefore should be protected by the attorney work-product doctrine.
- Use outside counsel to oversee forensic investigations. The attorney-client privilege only protects the "communication" of certain information between attorney and client, and does not protect the underlying facts contained in such communications (if the facts can be obtained from another source). It is important that a consultant’s reports be closely connected to the attorney’s "provision of legal advice" and, where possible, rendered directly to the attorney as opposed to the client. If the consultant is retained by an outside attorney, a court may be more likely to view the consultant as aiding the attorney in the rendering of legal advice to the client (as opposed to fulfilling the role of a mere fact gatherer). Additionally, having the outside attorney retain the consultant may emphasize that the purpose of such retention is preparation for litigation (and documents generated out of such relationship may consequently be viewed as subject to the attorney work-product doctrine).
- Control written materials. In all events, the best practice is to assume that consultant materials may be discoverable and to take precautions against inadvertently creating a paper trail in the course of an investigation that may hurt the client’s legal position.