Increasingly, c-suite executives and board members have questions about their companies' cybersecurity practices — or lack thereof. This monthly series is intended to provide high-level answers to some of those questions, specifically focusing on the development of cybersecurity policies, incident-response plans, liability of board members and executives for data breaches and the attorney-client privilege for cybersecurity investigations. Part one of this series launched in last month's edition of The Privacy Advisor, and discussed, "what is cybersecurity?" Part two examined the liability of companies after a data breach. Part three discusses: How do we keep cybersecurity work confidential?
Increasingly, companies are hiring external cybersecurity consultants to help them improve their information security practices and remediate harm caused by data breaches, denial of service attacks, and other incidents.
This is a good trend. Companies often do not have employees who have the same depth of skills and expertise in cybersecurity. High-quality outside firms are essential for companies to recover from incidents and protect their systems from further attacks.
However, these consultants typically have wide-ranging access to a company’s computer systems. Their emails, reports, memos, and other work product often contain highly sensitive information about the company’s information security practices and vulnerabilities.
Cybersecurity consultants often are quite good at identifying vulnerabilities that could have been avoided relatively easily (such as using a better firewall or requiring employees to change their passwords every 90 days).
This information would be quite valuable to plaintiffs’ lawyers who are seeking to convince a court that a data breach was caused by a company’s negligence. Moreover, a regulator could use a cybersecurity consultant’s report to demonstrate that a company’s lax security practices violated consumer protection laws.
U.S. civil procedure generally requires parties in civil litigation to provide the other side with relevant internal documents during discovery, unless an evidentiary privilege protects the information.
Among the types of information that are privileged in the U.S. are communications between companies and their attorneys, the work product of attorneys, a psychotherapist’s notes, and a private discussion between an individual and religious leader. Many states also provide limited privileges for journalists’ communications with confidential sources and the work product of an accountant.
Companies often are surprised that there is no explicit privilege for the work product or communications of a cybersecurity consultant. This partly is due to the nascence of the cybersecurity profession; it takes courts or legislatures years to develop a privilege.
Until states and the federal government begin to provide an explicit privilege for cybersecurity work and communications, companies will need to begin with the assumption that their cybersecurity consultants’ work is not privileged and could be discovered in civil litigation or regulatory actions.
The most effective way to prevent disclosure is to limit the amount of written material that cybersecurity consultants produce. When possible, in-person, oral briefings are preferable. To be sure, the consultants still could be subject to depositions, but written reports and email often contain the “smoking gun” that could be devastating in litigation.
Of course, it often is impossible for a consultant to conduct wide-ranging assessment of a company’s cybersecurity without producing written reports. To the extent that a consultant must produce written materials, the consultant and company should attempt to increase the likelihood that one of three existing privileges will protect the material:
- Attorney-client privilege: Protects communications between attorneys and clients in the course of providing legal advice. The privilege applies not only to attorneys, but also individuals who assist them in providing the legal advice (such as paralegals and consultants).
- Work product doctrine: Protects documents that are prepared in anticipation of litigation. Unlike the attorney-client privilege, this protection is not absolute; the opposing party still could obtain the work product if it demonstrates that it has a substantial need for the information and cannot obtain equivalent information without undue hardship.
- Non-testifying expert privilege: Protects the compelled testimony of an expert, is retained in anticipation of litigation, and is not expected to be called as a witness at trial. Like the work product doctrine, this privilege can be overcome in exceptional circumstances.
Cybersecurity consultants, of course, typically are not lawyers. So there is no guarantee that these privileges will apply to cybersecurity work product. To increase the chances that a court will find that a privilege applies, companies should consider the following precautions:
- The company’s outside attorney should engage the services of a cybersecurity consultant, and the attorney will direct the consultant’s work.
- The cybersecurity consultant’s statement of work and engagement agreement with the attorney should clearly state that the work is being performed in anticipation of litigation, or for providing legal advice.
- Attorneys should have an active role in supervising the consultants’ work. For instance, attorneys must be included on every communication between a consultant and the company.
- The cybersecurity consultant’s internal contact at the company should be the general counsel, and not the chief information officer or chief information security officer.
- Every communication should be labeled “ATTORNEY-CLIENT PRIVILEGE,” and reports should be labeled “ATTORNEY WORK PRODUCT.”
Ultimately, if a court determines that reports or communications are unrelated to legal advice, then the information still might be discoverable. However, given the sensitivity of this information, a company would be wise to make every attempt to obtain a privilege from discovery.
photo credit: Dell Women's Entrepreneur Network 2014 - Austin via photopin (license)