SkarpChapter 4 of 12
Protect Privilege Without Hiding the Facts
Students will be able to separate potentially privileged legal work from discoverable operational material in an internal cyber investigation.
1. Start With Two Evidence Lanes
Two connected lanes
Operational fact-finding establishes what happened. Legal consultation applies law to those facts and advises on risk, obligations, and strategy.
Labeling is not protection
A security log, ticket, or forensic image remains an operational record after Legal receives it. A label alone does not create privilege.
2. Preserve Facts in Their Native Form
Keep source evidence separate
Logs, identity exports, tickets, and timestamped engineer notes are operational evidence even when counsel uses them to obtain legal advice.
Build a standalone factual extract
Record the source, observation, timing, confidence, action taken, and unresolved question. The factual account should not depend on a legal memorandum.
3. Test the Purpose, Not the Sender
Use a purpose test
Ask: Why was this created? A request for legal advice differs from a technical update copied to Legal.
Split mixed communications
Keep factual status reporting separate from legal recommendations. One mixed meeting should not force one undifferentiated record.
4. Apply the Purpose Test
Thought exercise: classify three records
An incident commander creates these records after suspected source-code exfiltration:
- A Git audit-log export showing downloads by repository and time.
- An email to counsel asking, "What legal standard should we use to assess notification and employee-access issues?"
- A slide deck for the executive incident meeting containing a factual timeline, a containment status, and two slides titled "Litigation exposure" and "Recommended legal position."
Pause and classify each item.
- Record 1 is operational evidence.
- Record 2 is a potential legal-consultation communication.
- Record 3 is mixed. Separate or reproduce the factual timeline and containment status as an operational record. Review the legal-analysis slides under the governing privilege rules.
The answer is not "withhold the deck." The answer is to make the factual material available in a usable form while reviewing the legal portion carefully.
5. Control Distribution Without Creating a Legal Black Box
Control the legal channel
Limit legal advice to people who need it for advice or decisions. Avoid broad forwarding and copying legal analysis into operational systems.
Do not hide remediation facts
Engineers still need accurate tasks and results. Restrict legal analysis, not facts necessary to contain, investigate, or remediate.
6. Use a Privilege Review Matrix
Review document by document
Record the author, recipients, purpose, governing rule, decision, and whether operational facts exist elsewhere.
Provide a factual substitute
Where legal annotations are reviewed separately, preserve and produce the clean technical findings or timeline when responsive and not otherwise protected.
7. Key Boundary Terms
Flip the cards to review the distinctions that keep an investigation both protected and transparent.
- Legal consultation
- A communication made for the purpose of seeking or giving legal advice. Its protection depends on the applicable legal and national privilege rules.
- Operational fact-finding
- Collection and analysis of technical and business facts, such as logs, tickets, configurations, observations, and containment actions.
- Purpose of communication
- The reason a record was created. Sender, recipient, and a privilege label are relevant but do not decide classification alone.
- Distribution control
- Limiting circulation of legal advice to necessary recipients while ensuring operational teams receive the facts needed to act.
- National privilege rules
- The Member State rules and procedure that may govern privilege or professional secrecy in an investigation by a national authority.
8. Check the Boundary
Choose the most defensible response
A regulator requests records concerning a suspected unauthorized administrative login. External counsel's annotated incident deck contains a factual timeline, screenshots of login events, and advice on enforcement exposure. What should counsel do?
Which response best separates potential privilege from discoverable facts?
- Preserve and review the legal analysis separately, while producing or preparing a clean factual timeline and login-event evidence if responsive.
- Withhold the entire deck because external counsel received it.
- Produce the annotated deck without review because it contains technical facts.
Show Answer
Answer: A) Preserve and review the legal analysis separately, while producing or preparing a clean factual timeline and login-event evidence if responsive.
The regulator can receive responsive operational facts without receiving unnecessary legal analysis. Counsel should assess the legal material under the applicable national rules, preserve the original record, and provide a reliable factual version rather than treating the entire mixed document as protected or unreviewable.
Key Terms
- Purpose test
- A document-level assessment of why a communication or record was created.
- Factual substitute
- A clean, source-supported account of responsive facts that can be provided without disclosing separable legal analysis.
- Legal consultation
- A request for or provision of legal advice. Whether it is privileged depends on the authority, procedure, lawyer relationship, and applicable national rules.
- Distribution control
- A process for limiting circulation of legal advice to necessary recipients without restricting operational facts needed for action.
- Operational fact-finding
- The technical investigation record showing what occurred and what the organization did in response.