Hacked Washington law firm fights SEC subpoena in effort to protect attorney-client privilege

Covington & Burling has greater than 700 attorneys in Washington, D.C., the place the worldwide agency has constructed a repute of working with regulators slightly than preventing them.

But in latest weeks, Covington has discovered itself mired in an unprecedented courtroom battle with the Securities and Exchange Commission in a case that is rattled Capitol Hill’s authorized trade and threatened to upend probably the most sacred ideas in American jurisprudence: attorney-client privilege.

It began with a hack of Covington’s programs starting in 2020. After disclosing the breach to the FBI, the agency and legislation enforcement concluded {that a} Chinese state-sponsored actor was accountable and was on the lookout for info “about policy issues of specific interest to China in light of the incoming Biden Administration,” a court docket submitting mentioned.

Last 12 months, the SEC issued a subpoena demanding Covington present the names of impacted purchasers, the quantity of data compromised and the character of Covington’s communications with these purchasers. After Covington refused to conform, the SEC sued the agency in January, making an attempt to pressure it to disclose the names of almost 300 purchasers, all U.S.-listed firms or funding advisors.

“The SEC’s subpoena turns advocate into informant, conscripting Covington as a source for investigative leads against its own clients,” the agency mentioned in a submitting.

An SEC spokesperson declined to remark past public filings. A Covington spokesperson pointed CNBC to the agency’s filings in federal court docket but in addition declined to remark additional.

Covington stays unyielding in its opposition, and the agency is getting a healthy dose of assist from its authorized friends. Last week, greater than 80 of probably the most influential legislation companies within the nation filed a quick defending Covington, arguing that the SEC’s makes an attempt to subvert attorney-client privilege would fracture “one of the oldest and most inviolate principles in American law.”

In a submitting on Feb. 14, Covington mentioned that handing over the names of its purchasers would breach consumer confidentiality and have a chilling impact throughout the trade, with establishments now not sure they might belief their attorneys with delicate info. Covington not solely represents giant companies, however has probably the most energetic professional bono practices within the U.S., representing small companies, nonprofits and veterans.

Now, a Washington federal decide will decide the destiny of a case that is pitted urgent nationwide safety pursuits towards historic authorized requirements.

In the wake of high-profile assaults on the nation’s crucial vitality, monetary, and authorized infrastructure, defending U.S. establishments from international cyber intrusion has change into a high precedence for the federal government and the FBI. Officials have mentioned cooperation and assist from the personal sector, starting from small companies to high legislation companies, is a crucial a part of legislation enforcement’s efforts to guard U.S. pursuits.

Anything involving China is especially delicate, as commerce and diplomatic tensions proceed to escalate between the world’s two largest economies.

But Covington mentioned in a submitting that, with “very few exceptions,” no purchasers have been focused particularly by the Chinese state-sponsored hacker. Covington that if the SEC succeeded in forcing it to reveal the names of its probably impacted purchasers, the transfer would undermine the “cooperative relationship between the public and private sector.”

The hack, which started in November 2020, concerned a classy actor exploiting a vulnerability in Microsoft’s Exchange Server software program, the know-how that powers e-mail and calendar options for a lot of companies. It was a zero-day exploit, which meant Microsoft did not learn about the issue and could not warn customers till the breach was found in March 2021. By that point, the hacker had already compromised Covington’s programs.

Covington did not confide in the FBI the names of purchasers whose info was impacted, nor did it inform the SEC. A supply aware of the matter mentioned it nonetheless is not clear how the SEC grew to become conscious of the hack, which finally led the regulator to challenge a subpoena a 12 months in the past.

The SEC has justified its efforts by saying it seeks to make sure that no unlawful trades have been made on account of the cybersecurity breach, and that no materials nonpublic info was used for revenue. The SEC pursued an enforcement motion in 2016 towards a pair of Chinese hackers who earned greater than $3 million buying and selling off materials nonpublic info they obtained by hacking legislation companies.

Covington mentioned it had already engaged in an “extensive internal review,” court docket filings present, and devoted almost 500 hours of lawyer time in an effort to adjust to the SEC’s requests for info. The assessment concerned 9 Covington attorneys, together with a former SEC affiliate director, and concluded that the compromised knowledge of solely seven of the 298 impacted purchasers “might possibly contain MNPI.”

The litigation and related work might pressure Covington and its outdoors legislation agency, Gibson Dunn, to commit a whole bunch of billable hours preventing the SEC motion, a supply aware of the matter urged.

Covington shared its findings with the SEC, however the company refused to simply accept the restricted knowledge, in response to a submitting from the agency, and demanded the names of all of unidentified purchasers. Covington described itself as an “innocent third party,” and mentioned the SEC’s makes an attempt to entry consumer info have been unprecedented.

“An attorney is supposed to stand between his client and the power of the government,” Covington’s opposition submitting reads.

“Despite all of this, the SEC is again demanding to invade a sacred precinct of trust and confidence,” Covington’s submitting mentioned. “This Court should bar the door.”

WATCH: U.S. Select Committee on China desires emphasis on public communications