On February 14, 2023, Covington & Burling LLP ("Covington") filed its opposition to the SEC's administrative subpoena in connection with its investigation into possible violations of federal securities laws after a cyberattack on the law firm's systems. The SEC's application seeks the names of approximately 300 Covington clients whose information was accessed as part of an attack on the law firm's database.
Click here for additional background on the cyberattack, the SEC's investigation, and the SEC's argument in support of its subpoena, and related attorney-client privilege/ethical concerns.
Covington's opposition addresses the friction between the SEC's subpoena and the protections afforded by the attorney-client privilege and Covington's ethical duties to its clients. Covington's brief makes the following important points:
- The SEC's subpoena runs afoul of Covington's ethical obligations under D.C. Bar Rule 1.6. Rule 1.6 states that a lawyer "shall not knowingly . . . reveal a confidence or secret of the lawyer's client" without the client's consent. To date, only two Covington clients have agreed to provide their names to the SEC.
- Although Rule 1.6(e)(2) permits disclosure when "required by law or court order," the SEC's subpoena is not a "law or court order."
- Covington's clients' names are privileged because their clients identities are sufficiently intertwined with their clients' confidences. As a general rule, client names are not typically privileged under D.C.'s ethical rules. However, where "a client's identity is sufficiently intertwined with the client's confidences," the D.C. rules provide an exception that protects the client's confidential information. Covington has argued that the SEC's demand for client names is the first step towards its demand for privileged information because the SEC "will need to probe for details about the content of the files accessed." Thus, Covington posits that its clients' names fit the exception.
- The SEC's application does not outweigh Covington and its clients' privacy interests.
With respect to the attorney-client privilege arguments, Covington's brief did not stop at the argument that its clients' identities were covered by privilege. Covington also warned the court that the subpoena was a "transparent first step toward a piecemeal dismantling of the fundamental protections for attorney-client communications, attorney work product, and client confidences." As we said in our earlier post, the implications of this decision could have a profound impact on the attorney-client privilege and the confidentiality rules. Stay tuned for future developments.
This alert provides general coverage of its subject area. We provide it with the understanding that Frankfurt Kurnit Klein & Selz is not engaged herein in rendering legal advice, and shall not be liable for any damages resulting from any error, inaccuracy, or omission. Our attorneys practice law only in jurisdictions in which they are properly authorized to do so. We do not seek to represent clients in other jurisdictions.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.