EFCG, Inc. v. AEC Advisors, LLC

Background

EFCG asked the court for a protective order covering documents responsive to a subpoena that defendants served on Technology On Premises (TOPIT), EFCG’s longtime information-technology vendor. TOPIT withheld the documents at EFCG’s request, and EFCG claimed attorney-client privilege and the work product doctrine. The work product doctrine generally protects documents and tangible things prepared because of anticipated litigation or for trial.

EFCG initially identified three categories totaling 16 email chains and service tickets. It later submitted a revised privilege log identifying four categories totaling 25 email chains and service tickets. The court reviewed the challenged documents privately. The documents concerned technical work surrounding the individual defendants’ departure from EFCG, including disabling accounts, changing passwords, monitoring data transfers, and forensic investigations by Kroll, a forensic information-technology firm EFCG retained after the defendants’ departure.

Defendants argued that the documents were ordinary business records created by TOPIT, which was a longtime information-technology vendor rather than a firm specially retained for litigation. They also argued that they had a substantial need for factual information about EFCG’s computers, password changes, and related events.

Legal standards

The attorney-client privilege protects confidential communications made for the purpose of obtaining or providing legal advice, but the party claiming the privilege must establish its required elements. The work product doctrine applies when a document was prepared because of the prospect of litigation, rather than in the ordinary course of business or in substantially the same form regardless of litigation. Non-opinion work product may sometimes be discoverable if the opposing party shows substantial need and cannot obtain the equivalent information without undue hardship.

Court’s analysis

Category 1. The court ordered production of all Category 1 documents. These emails were dated September 11, 2018, and were sent among EFCG and TOPIT personnel, without lawyers, experts, or litigation consultants as senders or recipients. They did not refer to legal advice, litigation, or communications with EFCG’s lawyers. The court concluded that the actions discussed—such as shutting off computers, deactivating accounts, and changing a shared email password—could have been routine business steps when employees departed. EFCG therefore did not establish attorney-client privilege or work product protection for these emails.

Category 2. The court ruled that the Category 2 documents did not need to be produced. These documents, dated September 19 and 20, 2018, discussed Kroll’s forensic investigation into alleged misconduct by the individual defendants. The court found that the investigation was conducted in anticipation of litigation, which was supported by EFCG’s lawsuit against the same defendants approximately one week later. Although the emails did not reveal or request legal advice, they reflected forensic work performed for anticipated litigation and were protected by the work product doctrine. The court rejected defendants’ request for premature discovery merely because Kroll had access to the information and defendants’ expert wanted it. The court noted that defendants could later be entitled to facts or data considered by an expert if EFCG presented expert testimony about Kroll’s investigation and results.

Category 3. The court required production of some service tickets and allowed limited redactions of others. Assuming tickets 1495736 and 1497148 had been withheld in full, the court ruled that they were not attorney-client privileged but that portions reflected work performed in anticipation of litigation. EFCG could redact specified text from each ticket and had to produce the remainder.

The court ordered unredacted production of tickets 1487794, 1488798, and 1489114. Ticket 1487794 reflected routine information-technology work and did not show litigation-related work. Ticket 1488798 concerned setting up a computer profile for Renee and did not reveal investigative work. For ticket 1489114, the court found that two redactions were unwarranted because they concerned recycling a device and discussing how to proceed, rather than investigative work.

Category 4. The court allowed limited protection for Category 4 emails. EFCG could redact the first paragraph of a September 28, 2018 email from Dimitri Milionis to Greg Melli-Jones and Chris Payne because that paragraph revealed information about Kroll’s forensic work. EFCG had to produce the rest of that email and its replies and forwards. EFCG could withhold emails between Milionis and Payne dated November 28, 2018, because they discussed work performed or planned at the direction of EFCG’s lawyer and appeared related to the issues in the state-court lawsuit and this action.

The court declined to find that EFCG had entirely lost work product protection because it first listed the Category 3 and Category 4 materials on the revised privilege log. It warned that similar mistakes in the future could lead to a different result.

Disposition

The court granted in part and denied in part EFCG’s protective-order motion. EFCG had to promptly produce all Category 1 documents; it did not have to produce Category 2 documents; and it had to produce the specified Category 3 and Category 4 documents, with only the redactions or withholding authorized by the order.