When does privilege provide protection? Attorney-client privilege can help protect corporate information, but security managers should be aware of its legal limitations. (Legal Issues).
Given the ubiquity of the threat of legal action, experts frequently recommend having an attorney present for sensitive discussions as a preemptive defensive maneuver. The objective is to protect all of the documentation or the exchange of information under the rubric of "attorneyclient privilege."
How useful is this tactic and what are its limitations? The answer to this question is elusive; few cases address the principle of attorney-client privilege, because the issue is usually determined at pretrial hearings, not at trial. But some clear inferences can be drawn from relevant case law.
First and foremost, it is important to note that this is not a legal coat of mail that can be donned as protection against any courtroom assault. Attorney-client privilege applies to communications made in private to an attorney--the privilege does not protect the pre-existing facts that underlie the communication. This means that a company cannot hide an action or a problem by telling a lawyer and claiming that the communication to the lawyer made its existence privileged. For example, if a company employee attacked a competitor's computer network, and the company acted to cover up the action, the actions and the cover-up do not become secret or protected from disclosure just because they are revealed to an attorney while asking for advice. If a security manager is testifying under oath in court or in a deposition, he or she must truthfully answer questions about the attack and cover-up, even though the attorney-client conversation itself may be privileged and the manager may be able to refuse to answer que stions about that particular conversation.
To understand the full protections provided by attorney-client privilege, security managers must understand what types of information the privilege protects and in what circumstances. Also at issue is whether the relevant discussion is conducted with a corporate client or an individual.
Criteria. Due to its power to hide the truth, the attorney-client privilege is applied very carefully by the courts. Not every statement made to an attorney qualifies for this privilege. The oft-quoted description of the elements of this privilege comes from the U.S. federal judge in United States v. United Shoe Machinery Corporation (U.S. District Court for the District of Columbia, 1968). According to the court, the privilege applies only if the asserted holder of the privilege is or sought to become a client; the person to whom the communication was made is a member of the bar of a court, or his subordinate and in connection with this communication is acting as a lawyer. The communication must relate to a fact of which the attorney was informed by his client without the presence of strangers for the purpose of securing primarily an opinion on law, legal services, or assistance in some legal proceeding. Privilege does not apply if the communication is made for the purpose of committing a crime or tort.
In other words, to become privileged and thus undiscoverable, the client's statement must be made to an attorney in confidence for the purpose of seeking, securing, or providing legal assistance, and if the privilege is waived by a later statement or action, it will be lost. Once the privilege is lost on one occasion, it is lost forever. So if a manager tells a corporate attorney the secret being covered by privilege in a crowded room where the conversation may be overheard, the act may spoil the company's chance to assert that the information is privileged.
The privileged communication could be as simple as a nod or as complex as a thousand-page document. In most cases, documents given to an attorney are only privileged if they are kept confidential, if they are given to seek legal advice based on the documents, and if the documents would have been subject to a Fifth Amendment claim against self-incrimination had they remained in the client's control.
Simply handing documents over to a lawyer may not shield them from discovery in a trial unless the communication meets these requirements. For example, if a company hires a security consultant to conduct a vulnerability assessment and ten turns the assessment over to the corporate attorney, the information is not privileged. If the security manager and the corporate attorney discuss the legal issues raised in the assessment, that conversation could be considered privileged. but the assessment is still not protected.
Two-way street. Many cases have held that the lawyer's communications back to the client are also privileged. The privilege may attach to communication in a conversation intended to secure legal services, even if the communicator never agrees to retain that particular lawyer as counsel.
The privilege only protects communications for the purpose of receiving legal advice or legal services, however. Communications with an attorney solely for business or personal purposes will not be held privileged. So, for example, if a security manager tells a lawyer about the company's dealings with an outside company to solicit his investment advice, the conversation is probably not privileged. By contrast, if a manager tells a lawyer the same information to receive his legal opinion of whether the dealings make the manager an "insider" under the security laws, thus precluding an investment, then the conversation is likely to be privileged.
The mere fact that an attorney-client relationship exists is not privileged. Generally, the identity of the client and the amount paid to the lawyer are subjects that must be disclosed.
Confidentiality. The privilege does not exist unless the communication is made in private and is kept confidential. Speaking in front of friends, relatives, or coworkers could ruin the privileged nature of communications made to an attorney. Yet two parties with a common interest can talk to a lawyer together and not lose their privilege.
The privilege can be waived unknowingly through carelessness or inadvertent disclosure. The conversation may be disclosed in numerous ways-leaving documents in the open, being overheard on an airplane, telling a son or girlfriend--but all of these circumstance destory the privilege.
The privilege must be asserted by the holder, if the privilege-holder fails to object to disclosure of privileged material in litigation, the privilege is lost. Where the privilege-holder places the privileged matter at issue in litigation, the privilege is lost, if a security manager is asked to recount a privileged conversation, even on the witness stand, and neither the manager nor his lawyer object to the question, the privilege will disappear with the answer.
The Internet provides some special considerations for maintaining privilege. Knowing that e-mail can be intercepted, is it prudent to send unencrypted information you hope to keep privileged over the Internet? The American Bar Association in a March 10, 1999, formal opinion concluded that a "lawyer may transmit information relating to the representation of a client by unencrypted email sent over the Internet" without violating ethical responsibilities. However, most commentators note that where the message is sensitive and encryption is simple, clients should think carefully before risking an unencrypted transmission. As stated, attorney-client privilege can be lost through carelessness.
Agents. Agents of the lawyer under his personal supervision, such as law clerks, paralegals, secretaries, patent agents, and investigators, are generally included in the scope of the privilege. Also, certain experts, such as accountants, can qualify for the privilege in some circumstances where they are helping the lawyer provide legal services. In some cases, the client may use an agent, such as a secretary or a translator, to communicate with the attorney, and if the client expects confidentiality and is careful to keep the communication secret, then the privilege may still apply.
Ownership. The privilege belongs to the client. The attorney cannot volunteer to waive it on the client's behalf without permission of the client.
Confessions. While statements about past crimes or fraud may be privileged, no privilege applies to communications between an attorney and a client concerning an intended or continuing crime or fraud. In other words, if a client confesses to his attorney about kidnapping someone in the past, then his statements may be privileged unless he also confesses that he is still holding that person hostage. Similarly, communications would not be privileged if the client and the lawyer discuss the best ways to destroy documents that prove an earlier crime.
Corporate clients. Attorney-client privilege becomes more complicated where the client is a corporation rather than an individual, Of course, not every communication between a corporation and its counsel is privileged. For example, no privilege seems to exist between corporate shareholders and the corporation's counsel.
For corporate communications to attorneys to hold a privilege, they must qualify for privilege under the traditional elements already described. In addition, the communications must come from either senior management (the control group) or an employee at the direction of superiors.
The control group is made up of individuals in a position to control the corporation. if a corporate officer is capable of controlling the corporation or making decisions on behalf of the corporation, then that officer is entitled to consult with corporate counsel on a confidential basis.
However, corporate communication can also be considered privileged if it meets the test set out in Upjohn v. United States (US. Supreme Court, 1981). In the case, the Court ruled that corporate communications can be held privileged when the communications are made by corporate employees to corporate counsel by order of their superiors with the purpose of having the corporation receive legal advice from the counsel. Also privileged is information needed by corporate counsel that is not available to upper-level management. The communicated information is privileged if it concerns matters within the scope of the employees' corporate duties, if the employees are aware that they are attempting to obtain legal advice from the counsel, and the communications are ordered to be kept confidential and they are kept confidential.
The source of advice. For the purposes of attorney-client privilege, no distinction is made between an in-house attorney and an attorney outside the corporate organization, although, due to their day-to-day familiarity with corporate affairs, greater judicial scrutiny is usually required for communications to an in-house attorney.
An in-house counsel may perform multiple roles within a corporation. While this multiplicity of function will not automatically preclude the privilege from attaching to communications to an in-house attorney, the attorney must carefully demonstrate that he or she was serving in a legal capacity when a questioned communication was made. Generally speaking, the lack of local bar membership for an in-house corporate counsel will not preclude attorney-client privilege.
The fact that a security manager reports to the legal department does not drape a privilege over all the manager's conversations. The only conversations that will likely fall under the attorney-client privilege will be those undertaken pursuant to legitimate legal counseling or trial preparation, under specific direction of a lawyer. Other administrative or investigative functions are not privileged.
Sometimes a corporate client communicates both legal and business information to a lawyer. The client asserting that the information is privileged bears the burden of proving that the communication was for legal, rather than business, purposes. When a lawyer acts as an investigator, privilege may depend on whether the lawyer is reviewing information that needs legal analysis or whether the lawyer's review does not require a legal background. If the lawyer is acting in the same manner as any lay investigator, then communications from corporate employees to the lawyer are not likely to be held as privileged.
For example, if a company suspects that an executive is embezzling money, and the company sends a lawyer for initial information gathering to interview the executive's secretary for evidence of theft, the conversation will probably not be privileged. Conversely, if the lawyer asks the same secretary the same set of questions in a subsequent interview to evaluate her as a material witness on behalf of the corporation, the conversation is more likely to be privileged, even if the same issues are discussed.
Certain reports made to corporate counsel may also be classified as both legal and business communications. Some courts specify that if a communication is primarily concerned with legal matters, then it may be the subject of privilege.
Personal privilege. Sometimes a manager's personal legal interests may conflict with the employer's interests. Recently, for example, managers and executives with major companies such as WorldCom and Enron have been threatened with criminal or civil penalties and encouraged to testify against their superiors or against the corporation itself. While security managers have not yet surfaced as major targets of investigation, they have access to many corporate secrets and may someday be faced with the dilemma--does protecting yourself mean testifying against your employer? While everyone is bound to truthfully answer questions asked under oath-unless protected by the Fifth Amendment--a manager should first work with his or her own personal lawyer who can advise the manager on how much to cooperate with the company's lawyer. While taking a position adverse to one's company may be a perfect recipe for losing a job, it may protect a manager from criminal prosecution--and in the case of known criminal or fraudulent a ctivity, it may also be the ethical course of action.
Security issues can affect the entire enterprise. As problems arise, security managers may need to call on corporate counsel for legal guidance. Understanding the privileges attached to attorney-client communications, especially in the corporate setting, can mean the difference between successful resolution of a problem and serious embarrassment or penalties for the company. Corporate attorneys are hired not only to help but also to keep secrets confidential. Security managers should take care to preserve the privileges that protect information and to understand when those protections don't apply.
Theodore F. Claypoole is a technology attorney with Womble Carlyle Sandridge and Rice in Charlotte, North Carolina.
|Printer friendly Cite/link Email Feedback|
|Author:||Claypoole, Theodore F.|
|Date:||Jan 1, 2003|
|Previous Article:||A year of reassessment: the ASIS annual employment survey looks at how 9-11 affected corporate security functions, staffing, budgets, and policies....|
|Next Article:||Maimonides solves storage problems: keeping stored data safe and available is a matter of life or death for a hospital. New storage technology makes...|