Attorney-client Privilege Offers No Protection Against an Intruder Copying Files

Attorney-client privilege is one of the strongest protections in law. It prevents a court compelling disclosure of communications between a client and their lawyer, and it exists because legal advice is worthless if the client cannot be candid.

It protects against compulsion. It does not protect against copying, and the distinction is doing a great deal of unacknowledged work.

If an intruder takes privileged material and publishes it, the privilege has not been defeated in any legal sense. It simply never addressed that scenario. The information is out, and the protection was about what an opposing party could demand, not about what a third party could take.

Which means the practical confidentiality of privileged communications rests entirely on the firm’s technical controls — the least examined layer of a protection everybody treats as robust.

Professional conduct rules on confidentiality — Rule 1.6 in the ABA model and its equivalents elsewhere — impose a duty to safeguard client information. A breach exposing client data can therefore generate an ethics complaint alongside the ordinary regulatory and contractual fallout.

That is unusual. In most sectors a breach is a data protection matter. In law it can also be a question of whether the practitioner met their professional obligations, which is a personal exposure rather than a corporate one.

Firms tend to treat information security as an IT budget line. On this analysis it is closer to professional indemnity: a control on which a core duty depends, where failure attaches to individuals.

Framed that way, questions like whether the document management system enforces phishing-resistant authentication stop being technical preferences and become questions about whether the firm can keep the promise its clients are relying on.