Privilege and Forensics Lab
Practise keeping incident response privileged. Three fictional clients, three decisions that courts have actually split on: who retains the forensic firm, how the report is built, and what travels to regulators, insurers and the board.
Each fact pattern is scored on seven decisions, with a seeded "how it played out" step, named classic mistakes, and a case memo and register you can download with Pro. The best answer is the defensible practice, because several of these questions are unsettled.
Not legal advice. Educational practice only, not legal advice. The people, companies, domains and facts are fictional. Rules differ by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer before relying on anything here.
Not legal advice. Educational practice only, not legal advice. The people, companies, domains and facts are fictional. Rules differ by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer before relying on anything here.
You are outside cyber counsel at Aldermoor & Pike LLP
Aldermoor & Pike LLP is a fictional law firm with a cyber incident practice. Three clients call in the first days after a breach, each worried about the same thing: will the forensic report be read by the other side? You advise on who should hire the investigators, what the engagement and the report should look like, who may see the output, and what has to be disclosed anyway. All parties are fictional. The legal rules named are real and were checked against the sources listed on the page.
- 1Issue spotting: What is the real privilege problem in this fact pattern?
- 2Governing rule: Which rule or test decides it?
- 3Strategy: How do you structure the engagement or the response?
- 4Evidence and record: What record do you create now to carry the burden later?
- 5Who sees what: Who receives what? Tick every step that belongs.
- 6Communications: What do you tell the board, IT, the insurer or the regulator?
- 7Next step: What do you do next?
- 8See how it played out, from a seeded outcome
3 fact patterns. Pro keeps the rules in a fold-out and hides the hints. A good record choice uncovers hidden complications as you go. Passing score is 70%.
Loading…
TL;DRWhat this lab is
4 points
- A fictional-client practice lab for cyber counsel: three fact patterns on keeping a forensic report privileged, with seeded outcomes.
- It is built from real rules (work product, Kovel, selective waiver, FRE 502, GDPR Art 33, SEC Item 1.05) that were checked against primary or authoritative sources, listed on the page.
- Educational practice, not legal advice. Rules vary by jurisdiction and change.
- Pro lab: free to try with 3 Pro tool runs in total, shared across all Pro tools. Downloading the case memos and CSV register is Pro only.
Sources checked
Every rule named in this lab was checked against these pages on 2026-11-02. Law changes, so read the current text before you rely on any of it.
The vendor already on retainer
- In re Capital One Consumer Data Security Breach Litigation, MDL No. 1:19md2915 (E.D. Va. June 25, 2020), memorandum opinion and order (copy hosted by Robinson Bradshaw) (copy of a court opinion, checked 2026-11-02). Work product "because of" test, the two RLI prongs, the pre-existing SOW, business-critical budget, and wide distribution of the report.
- Sullivan & Cromwell client memo on the Capital One decision (26 June 2020) (secondary source, checked 2026-11-02). Quotes the court on alternatives (different vendors, scopes of work or investigation teams). Secondary: read together with the opinion.
- Federal Rules of Civil Procedure, Rule 26 (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 26(b)(3)(A) work product; Rule 26(b)(5)(A) the duty to describe withheld material.
- Guo Wengui v. Clark Hill, PLC, No. 19-3195 (JEB) (D.D.C. Jan. 12, 2021), memorandum opinion (copy hosted by Alston & Bird) (copy of a court opinion, checked 2026-11-02). Forensic report not work product or privileged; two-track story unsupported by the record; Kovel applied narrowly; remediation content and sharing with IT and the FBI.
One report, three audiences
- Guo Wengui v. Clark Hill, PLC, No. 19-3195 (JEB) (D.D.C. Jan. 12, 2021), memorandum opinion (copy hosted by Alston & Bird) (copy of a court opinion, checked 2026-11-02). Forensic report not work product or privileged; two-track story unsupported by the record; Kovel applied narrowly; remediation content and sharing with IT and the FBI.
- In re Pacific Pictures Corp., 679 F.3d 1121 (9th Cir. 2012), opinion (Ninth Circuit website) (court opinion, checked 2026-11-02). Ninth Circuit rejects selective waiver for voluntary disclosure to the government; a post hoc confidentiality letter did not save the privilege.
- Federal Rules of Civil Procedure, Rule 26 (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 26(b)(3)(A) work product; Rule 26(b)(5)(A) the duty to describe withheld material.
Notices on a clock, privilege on a shelf
- Upjohn Co. v. United States, 449 U.S. 383 (1981) (Cornell LII) (reproduction of official text, checked 2026-11-02). Corporate attorney-client privilege protects communications, not the underlying facts.
- GDPR Article 33, notification of a personal data breach to the supervisory authority (gdpr-info.eu reproduction of Regulation (EU) 2016/679) (reproduction of official text, checked 2026-11-02). Art 33(1) 72 hours where feasible; 33(3) minimum content; 33(4) phased information; 33(5) documentation. The official EUR-Lex page could not be opened in this session.
- SEC, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Release 33-11216 (2023) (regulator, checked 2026-11-02). Form 8-K Item 1.05: file within four business days of determining an incident is material; no need to disclose technical detail that would impede response.
- Federal Rules of Evidence, Rule 502 (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). Rule 502(a) scope of waiver, 502(b) inadvertent disclosure, 502(d) court order.
- In re Pacific Pictures Corp., 679 F.3d 1121 (9th Cir. 2012), opinion (Ninth Circuit website) (court opinion, checked 2026-11-02). Ninth Circuit rejects selective waiver for voluntary disclosure to the government; a post hoc confidentiality letter did not save the privilege.
- In re Capital One Consumer Data Security Breach Litigation, MDL No. 1:19md2915 (E.D. Va. June 25, 2020), memorandum opinion and order (copy hosted by Robinson Bradshaw) (copy of a court opinion, checked 2026-11-02). Work product "because of" test, the two RLI prongs, the pre-existing SOW, business-critical budget, and wide distribution of the report.
Frequently asked questions
Is this legal advice?
No. It is educational practice with fictional clients. Rules vary by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer.
Does hiring a law firm to run the forensic investigation make the report privileged?
Not by itself. In the cases the lab draws on, courts looked at why the report was created, whether it would have existed in much the same form anyway, how it was paid for and who received it. The lab teaches building a real legal track.
Are the court decisions in the lab settled law everywhere?
No. They are decisions of particular courts. Other courts have protected counsel-commissioned reports on different facts, and several questions, such as waiver by sharing with a regulator, depend on the circuit.
Do I need Pro to use the lab?
The lab is free to try with 3 Pro tool runs in total, shared across all Pro tools. Downloading the memos and register is Pro only.
Where do the rules come from?
Each fact pattern lists the court opinions, rules and regulator documents opened to check it, with the date checked. The Sources block on the page shows them all.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.