It's Been a Privilege to Serve You–a Mock Hearing

### Overview This session presents a mock evidentiary hearing before U.S. Magistrate Judge Laurel Beeler in the hypothetical case of *Who I Want To Grow Up To Be v. Dolls-R-Us*. The dispute centers on a motion to compel discovery of a post-incident forensic investigation report and related interview records generated by a third-party cybersecurity firm, Technotronic. Dolls-R-Us had contracted with the plaintiff to manufacture Ruth Bader Ginsburg action figures, requiring commercial security assessments and penetration testing. Prior to delivery, threat actors penetrated Dolls-R-Us, compromised credentials, manipulated backup encryption keys, and executed a ransomware attack over Labor Day weekend. Production was halted for six weeks, causing the plaintiff to miss the holiday season and incur severe financial and contract losses. Dolls-R-Us asserted that the forensic investigation was privileged work product directed by outside legal counsel in anticipation of litigation.

### Key Topics - **Attorney-Client Privilege and Work Product Doctrine**: Whether a technical forensic investigation directed by outside counsel following a ransomware incident is shielded from civil discovery, or constitutes an ordinary business practice required under an incident response plan (IRP). - **Dual-Purpose Investigations and Preexisting Vendor Relationships**: The legal complications that arise when the same security firm performs both pre-incident risk assessments and post-breach forensics, including team collaboration across internal Chinese walls. - **Case Law Standards in Incident Response**: Judicial analysis stemming from cases such as *Premera*, *Dominion Dental*, and *Capital One*, specifically evaluating statement-of-work (SOW) scopes and whether investigations would have occurred in substantially similar form "but for" the prospect of litigation.

### Technical Details - **Hypothetical Intrusion Mechanics**: Attackers established persistence, escalated privileges, surveilled management, manufacturing, and development systems, and altered the encryption keys of an automated backup utility service, rendering backups unusable because they were never tested. - **Pre-Incident vs. Post-Incident Scopes**: In June, Technotronic executed a commercial security assessment and penetration test contracted directly by Dolls-R-Us. In September, after the ransomware deployment, outside counsel (α, β, and γ) retained Technotronic under a separate agreement funded via a legal contingency budget to determine the scope of unauthorized access, examine data exfiltration, evaluate regulatory breach notice triggers (PI/PHI), and assess exposure to OFAC sanctions. - **Information Isolation and Collaboration**: Inside Dolls-R-Us, technical findings were restricted to three individuals (the VP of Information Systems, assistant/system director, and architect). However, testimony revealed that Technotronic's forensic team reviewed the prior June assessment report and consulted with the assessment team to investigate whether unremediated vulnerabilities facilitated the ransomware intrusion.

### Takeaways - **Separation of Scope and Vendors**: Courts closely scrutinize statements of work, retainer timelines, and previous engagements. Reusing the same vendor for both baseline IT security assessments and privileged breach investigations risks eroding work product claims if the scopes overlap or if the work would be conducted under routine IRP business operations. - **Fact Product vs. Work Product Reality**: True underlying factual information regarding an incident cannot easily be hidden simply by routing technical investigations through outside counsel. - **Two-Track Investigations**: While maintaining separate tracks—one internal technical investigation for business remediation and one strictly counsel-directed investigation for litigation—can better insulate legal reports, conducting two comprehensive parallel investigations is expensive and may still require disclosing underlying technical facts during litigation.