Concern over a federal court’s decision this week requiring a law firm to disclose a handful of clients to the Securities and Exchange Commission is mainly about the door this is opening for regulators to get information from outside counsel in the future, analysts say. 

“Standing on its own, it’s not an earth-shaking decision,” University of Michigan Law Professor Adam Pritchard told Bloomberg Law. “But with the SEC, when you give them an inch, they will always ask for a mile. It’d be surprising if this were the last case we saw like this.”

In his July 24 ruling in SEC v. Covington & Burling, Judge Amit Mehta of the U.S. District Court for the District of Columbia said there’s no violation of attorney-client privilege in the law firm simply giving the regulator the names of seven corporate clients whose information was potentially accessed in 2020 when hackers broke into the law firm’s technology system. 

“Identifying the seven client names would not divulge any protected communications about the data breach,” Mehta said.   

Substantive communication

Covington had argued, without success, the names were privileged because it signaled that the companies had had discussions with the law firm about disclosing the hack, which is in itself a substantive communication.

It would, the firm said, “apprise the SEC which clients received specific information and advice from Covington in connection with the cyberattack.”  

In its lawsuit seeking enforcement of its subpoena, the SEC said it wasn’t seeking privileged information and there’s nothing privileged about the names of the clients.   

“The Subpoena does not call for protected information, and the Commission is not seeking privileged communications,” the agency said.

In a second line of argument, Covington said the SEC was grasping for wrongdoing because it had no reason to think the companies had done anything unlawful; it was just trying to see, once it learned the companies might have been hacked, if they had disclosed the incident and if insider trading had resulted from it.  

“Absent reasonable grounds to believe a violation of the securities laws has occurred, the SEC cannot rummage through Covington’s files or disrupt its attorney-client relationships,” the law firm’s counsel argued. 

A group of 83 law firms in a brief supporting Covington’s view said the SEC was opening an inquiry into the clients’ conduct solely on the basis they might have been breached, what the firms called a “fishing expedition” that turned “attorneys into witnesses against their own clients.” 

Foreign government role

The 2020 hack of Covington’s technology system is believed to be by a Chinese government-related entity, Hafnium, in search of information related to the then-incoming Biden administration’s China-related policy plans.

Covington disclosed the breach and said it might have involved almost 300 corporate clients. After a review, it concluded most clients weren’t breached, but it couldn’t rule out that information on seven of them had been.  

The SEC said it needs the client names to ensure they didn’t make false statements about the incident and that trades weren’t made on the basis of information that came out of it. 

Norman Goldberger, a partner at Ballard Spahr, told American Lawyer in February that concern over attorney-client privilege goes deeper than the disclosure of company names; it goes to the more substantive information regulators could try to get going forward.

“If [the regulators] win this, then they have accomplished quite a bit,” Goldberger said. “The first case is hard but the next one isn’t.”

The Association of Corporate Counsel, which filed its own brief earlier this year, said the ruling sends a signal to agencies throughout the government that they can go after information that up to this point has been considered privileged. 

“More than 300 federal agencies have this same subpoena power and if upheld, the court’s decision threatens to expand the use of administrative subpoenas,” said Susanna McDonald, vice president and chief legal officer of ACC. 

Covington has not said whether it will appeal. “We will review the decision carefully and consider any next steps in consultation with our affected clients," a spokesperson for the firm said in reports.