US Court Rules Cyber-Security Expert Reports Privileged

A US court recently found that reports prepared by a computer security firm in the wake of a cyber-attack were not required to be disclosed in litigation arising from the attack as they were protected by attorney-client privilege. The input of the computer security firm was necessary to enable the lawyers to advise their client on the likelihood of litigation arising from the attack. The reports therefore facilitated effective consultation between the lawyers and their client and attracted legal privilege.

The case highlights the role lawyers can play in managing the consequences of a cyber-attack and in minimising litigation exposure.

BACKGROUND TO LITIGATION

The decision was given in the context of litigation arising from a "sophisticated cyber-crime attack" on US retailer, Genesco in 2010. The perpetrators planted malware on Genesco's computer system in an effort to steal payment card information which Genesco was transmitting in unencrypted form to its