HOW PRIVILEGE UNDERMINES CYBERSECURITY.

In recent years, cyberattacks have cost firms countless billions of dollars, undermined consumer privacy, distorted world geopolitics, and even resulted in death and bodily harm. Rapidly accelerating cyberattacks have not, however, been bad news for many lawyers. On the contrary, lawyers that specialize in coordinating all elements of victims' incident-response efforts are increasingly in demand. Lawyers' dominant role in cyber-incident response is driven in part by their purported capacity to ensure that information produced during the breach response process remains confidential, particularly in any subsequent lawsuit. By interposing themselves between their clients and any thirdparty consultants involved in incident response, lawyers can often shield any materials produced after a breach from discovery under either attorney-client privilege or work-product immunity. Moreover, by limiting and shaping the documentation produced by breached firms' personnel and third-party consultants in the wake of a cyberattack, attorneys can limit the availability of potentially damaging information to plaintiffs' attorneys, regulators, or media, even if their attorney-client privilege and work-product immunity arguments falter. Relying on over sixty interviews with a broad range of actors in the cybersecurity landscape -- including lawyers, forensic investigators, insurers, and regulators -- this Article shows how, in their efforts to preserve the confidentiality of incident-response efforts, lawyers may undermine the long-term cybersecurity of both their clients and society more broadly. We find that lawyers often direct forensic providers to refrain from making recommendations to clients about how to enhance their cyber defenses, restrict direct communications between cybersecurity firms and clients, insist upon hiring cybersecurity firms with limited familiarity with the client's networks or internal processes, and strictly limit dissemination of the cybersecurity firm's conclusions to the client's internal personnel. To ensure their clients do not inadvertently waive any legal confidentiality protections, lawyers also frequently refuse to share any written documentation regarding a breach with third parties like insurers, regulators, and law enforcement. Even worse, we find that law firms overseeing breach investigations increasingly instruct cybersecurity firms not to craft any final report regarding a breach whatsoever. These practices, we find, may impair the ability of breached firms to learn from cybersecurity incidents and implement long-term remediation measures. Furthermore, such efforts to protect confidentiality inhibit insurers' capacity to understand the efficacy of different security countermeasures and regulators' power to investigate cybersecurity incidents. To reverse these trends, the Article suggests that materials produced during incident response should be entitled to confidentiality protections that are untethered from the provision of legal services. But such protections should be coupled with new requirements that firms impacted by a cyberattack disclose specific forensic evidence and analysis. By disentangling the incident-response process from the production of information that can hold firms accountable for failing to take appropriate and required precautions, the Article aims to remove barriers to effective incident response while preserving incentives for firms to take cybersecurity seriously. [ABSTRACT FROM AUTHOR]

Copyright of Harvard Journal of Law & Technology is the property of Harvard Law School Journals and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)