Substance over form matters. A law firm responding to a cyber-attack learned this lesson the hard way when a federal district court ordered the firm to produce the results of a forensic investigation performed by an outside cybersecurity company. The court discounted the firm’s claims of work-product protection and attorney-client privilege, finding that the firm would have conducted the investigation in any event and that the substance of the investigation did not comport with the form by which it was undertaken.

Download PDF