Hack Job Leads to Production of Forensic Cyberattack Report

• Pages: 4-5
• Date: 01 July 2021
• Author: Grant H. Hackley
• Subject Matter: Derecho Civil

Published in Litigation News Volume 46, Number 4, Summer 20 21. © 2021 by the American Bar A ssociation. Repro duced with permissi on. All rights reser ved. This informati on or any portion the reof may not be copie d or disseminated in any

form or by any means or sto red in an electronic da tabase or retrieval sy stem without the ex press writt en consent of the Amer ican Bar Associatio n.

By Grant H. Hackley, Litigation News Associate Edito r

Substance over form mat ters. A

law rm respondi ng to a cyber-

attack learne d this lesson the

hard way when a federal dis-

trict cour t ordered the r m to produce

the results of a forensic i nvestigation

performed by an outside c ybersecurity

company. The court discou nted the

rm’s claims of work-product protec-

tion and attorney-c lient privilege, nd-

ing that the r m would have conducted

the investigation i n any event and that

the substance of t he investigation did

not comport with the for m by which

it was undertaken. A BA Litigation

Section leaders wa rn that rms need

to clearly dene the pu rpose and scope

of investigations af ter a data breach to

ensure that they do not wa ive privilege

and work-product protections.

A Duty to Keep Data Secure

In Guo Wengui v. C lark Hill, PLC , et

al., the plaintif f, a prominent Chinese

businessma n and dissident, had sought

legal representation in conne ction

with his political asylum application.

According to the al legations of the

underlying malprac tice case, the pl ain-

tiff had advised t he rm of his criticism

of the Chinese re gime, prior cyb erat-

tacks direc ted at him and other cr itics,

and the risks asso ciated with his status

as a dissident.

In underta king the representation,

the rm acknowledg ed its duty to safe-

guard the plai ntiff’s informat ion and

assured him t hat “they were qualied,

capable, and competent to repres ent

plaintiff a nd to protect his interests fully

and professionally.” Relying on these rep -

resentations, t he plaintiff hired the r m.

A “Two-Tracked” Investigation

Shortly af ter the representation com-

menced, the r m suffered a cyberattack

and data breach, and t he plaintiff’s pri-

vate and condentia l information was

published online. T he rm withdrew its

representation, expl aining that its attor-

neys and employees had become w it-

nesses to the plai ntiff’s pending asylum

case. The plai ntiff then brought the mal-

practice claim , which is currently pending

in the U.S. Di strict Court for the Distr ict

of Columbi a.

During dis covery, the plainti ff asked

the rm for “all repor ts of its forensic

investigat ion into the cyb erattack.” The

rm had produced doc uments from its

usual cyberse curity vendor, eSentire.

However, two days into the cyberat tack,

the rm had reta ined outside counsel in

anticipation of potential litigation aris-

ing from the breach. I n turn, the outside

rm hired a se parate outside cyberse cu-

rity vendor, Duff & Phelps.

© Getty Image s

4 | S ECTION OF LITIGATION

Hack Job Leads to Production of

Forensic Cyberattack Report