(Update) Battle Over SEC’s Attempt to Compel Law Firm to Comply with Subpoena into Cyberattack Continues

This article was originally published February 17, 2023.

On February 14, 2023, Covington & Burling LLP (“Covington”) filed its opposition to the SEC’s administrative subpoena in connection with its investigation into possible violations of federal securities laws after a cyberattack on the law firm’s systems. The SEC’s application seeks the names of approximately 300 Covington clients whose information was accessed as part of an attack on the law firm’s database.

Covington’s opposition addresses the friction between the SEC’s subpoena and the protections afforded by the attorney-client privilege and Covington’s ethical duties to its clients. Covington’s brief makes the following important points:

The SEC’s subpoena runs afoul of Covington’s ethical obligations under D.C. Bar Rule 1.6. Rule 1.6 states that a lawyer “shall not knowingly . . . reveal a confidence or secret of the lawyer’s client” without the client’s consent. To date, only two Covington clients have agreed to provide their names to the SEC.
Although Rule 1.6(e)(2) permits disclosure when “required by law or court order,” the SEC’s subpoena is not a “law or court order.”
Covington’s clients’ names are privileged because their clients identities are sufficiently intertwined with their clients’ confidences. As a general rule, client names are not typically privileged under D.C.’s ethical rules. However, where “a client’s identity is sufficiently intertwined with the client’s confidences,” the D.C. rules provide an exception that protects the client’s confidential information. Covington has argued that the SEC’s demand for client names is the first step towards its demand for privileged information because the SEC “will need to probe for details about the content of the files accessed.” Thus, Covington posits that its clients’ names fit the exception.
The SEC’s application does not outweigh Covington and its clients’ privacy interests.

With respect to the attorney-client privilege arguments, Covington’s brief did not stop at the argument that its clients’ identities were covered by privilege. Covington also warned the court that the subpoena was a “transparent first step toward a piecemeal dismantling of the fundamental protections for attorney-client communications, attorney work product, and client confidences.” As we said in our earlier post, the implications of this decision could have a profound impact on the attorney-client privilege and the confidentiality rules. Stay tuned for future developments.