Legal Updates

In 2019, I co-authored an article published by the American Bar Association regarding the future of U.S. pretrial discovery involving European Union data following the decision by the United States District Court for the District of Arizona in Salt River Project Agricultural Improvement & Power District v. Trench-France SAS, 303 F. Supp. 3d 1004 (D. Ariz. 2018). The article concluded that Salt River represented a potential watershed moment promoting the application of a foreign mechanism to U.S. discovery overseen by a foreign discovery master under the Hague Convention, as opposed to U.S. courts’ typical deference to domestic discovery practices. Recently, however, I was involved in a matter which demonstrated that state courts may be reluctant to follow Salt River’s lead.

Seeking to resolve a split among the Circuits “regarding the scope of liability under the [Computer Fraud and Abuse Act]’s “exceeds authorized access” clause, the Supreme Court granted certiorari to the appeal of Robert Van Buren, a former Georgia police sergeant whose criminal conviction for violating the act was upheld by the Eleventh Circuit in 2019. Under the "gates-up or gates-down" threshold established by the Court's opinion, the access to information relevant to the question of civil or criminal liability under the CFAA is defined by IT permissions. Specifically, the question is now what files or folders within a computer system is an authorized user allowed to access and did that user exceed that authorized access? 

In the wake of recent cybersecurity incidents of historical significance on May 12, 2021, President Biden issued an executive order to improve the federal government’s efforts to “identify, deter, protect against, detect, and respond” to cybersecurity incidents.

President Biden’s executive order is far more comprehensive than past government efforts in the realm of cybersecurity, nevertheless the government has also used this moment as a call to action for the private sector to step up its game. After all, a significant chunk of our critical infrastructure is owned and operated by private entities.

Companies and organizations use social media ("SoMe") to gain market advantage, shape and model their own image, market and advertise to customers, track how effective their marketing campaigns might be, understand who their customers are, test new products or services and provide a platform through which customers can provide feedback. Every post or piece of analytics could be considered a “business record,” subjecting it to discovery in both civil and criminal litigation, internal and government investigations or audits. As a result, attorneys and their IT teams should understand the best practices for preserving, processing, reviewing, and producing data from SoMe sites to acquire valuable – and usable – evidence.

“But in-house counsel was copied on the email, isn’t that enough?”

When a business faces the prospect of producing documents in litigation, determining which documents are protected by the attorney-client privilege and preventing those documents from inadvertent disclosure is of paramount importance. Such a disclosure can have serious consequences for both the attorney’s and the client’s interests, including a court finding the privilege has been waived. At the same time, if an attorney is overly restrictive or indiscriminately withholds documents, they risk losing credibility with opposing counsel and the court, which can make it more difficult to assert the privilege when necessary. 

Waiver of privilege and particularly inadvertent waiver of privilege is always a concern in e-discovery when producing documents to an outside party. Not only may your current litigation be affected but waiver may also affect your client’s future litigations and other litigation teams that had no involvement with your production. This is a particularly serious concern when producing documents to the government, given the power dynamics involved.