Netskope, Inc. v. Fortinet, Inc.

Background

Netskope requested emails sent or received by John Whittle, a Fortinet executive who had held both business and legal-counsel roles. The request covered internal communications about the patents at issue, pre-litigation licensing negotiations with Netskope, and negotiations with other companies. Netskope asserted that the communications were relevant to affirmative defenses, including unclean hands, and to the value of the patents.

Fortinet offered to produce only external emails concerning the patents, Netskope, and the other companies. It contended that the internal emails were either protected by attorney-client privilege or work-product protection, or were irrelevant. Fortinet also argued that producing the emails and preparing a privilege log would be unduly burdensome.

Court’s Analysis

The court found that the requested communications were likely relevant under the broad discovery standard in Federal Rule of Civil Procedure 26. Whittle had signed agreements with other companies and participated in pre-litigation negotiations with Netskope, making it plausible that his emails contained information relevant to Netskope’s defenses.

The court explained that a party withholding otherwise discoverable information on privilege grounds must describe the withheld material, usually through a privilege log. The party asserting privilege bears the burden of establishing that the privilege applies. Fortinet had not produced a privilege log and instead argued that nearly all of Whittle’s relevant communications were privileged.

The court rejected Fortinet’s position that Whittle’s emails were automatically privileged because he had worked as in-house counsel. Attorney-client privilege does not protect an attorney’s business advice, and Fortinet’s dual-role argument did not establish that all of Whittle’s communications were privileged. By refusing to identify specific documents and the specific privilege claimed, Fortinet had effectively asserted an improper blanket privilege.

The court also rejected Fortinet’s burden argument. Fortinet had not quantified the burden, such as by providing search-term hit counts, and the court found that the burden argument was effectively another blanket privilege objection.

Order

The court ordered Fortinet to produce the requested emails by November 28, 2025. It found Netskope’s proposed search terms reasonable and proportionate because Fortinet had not provided specific proof of burden. If Fortinet claimed privilege over any emails, it was required to produce a privilege log complying with the applicable standing order.

The judge’s name is not readable in the provided signature block, so the opinion is attributed here to the court.