Kovel Agreement: When a Breach Forensic Report Stays Privileged

A Kovel agreement is an engagement in which a lawyer retains a non-lawyer expert, such as an accountant or a forensic investigator, to help the lawyer give legal advice, so that communications with the expert can fall within the attorney-client privilege. The name comes from United States v. Kovel, a 1961 Second Circuit decision. After a data breach, outside counsel uses a Kovel letter to retain the forensic firm so the investigation serves counsel's advice and litigation preparation. The letter alone decides nothing. Courts look at who hired the firm, whether its scope differs from routine security work, who paid, who saw the findings, and how the company used them. Of the nine breach rulings discussed below, seven ordered the forensic work produced.

What is a Kovel agreement?

The terms Kovel agreement, Kovel letter, and Kovel arrangement all describe this engagement. The doctrine comes from United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), decided on December 5, 1961, in an opinion by Judge Henry Friendly. Kovel was an accountant employed by a law firm that specialized in tax law. He was held in contempt after refusing to disclose a client's communications, and the Second Circuit vacated the judgment and remanded for the facts to be developed.

Judge Friendly reasoned from the example of an interpreter. A lawyer who does not speak a client's language can use a translator without losing the privilege, and the court treated an accountant the same way: "Accounting concepts are a foreign language to some lawyers in almost all cases, and to almost all lawyers in some cases." The same opinion set the limit. "What is vital to the privilege is that the communication be made in confidence for the purpose of obtaining legal advice from the lawyer." If the client wants the accountant's own advice rather than the lawyer's, the court wrote, no privilege exists.

Courts have applied the same reasoning to other experts that lawyers bring in, including a public relations firm hired by a grand jury target's lawyers in 2003 (In re Grand Jury Subpoenas Dated March 24, 2003, S.D.N.Y.). Breach cases ask the same question about the forensic firm: did counsel need the firm in order to give legal advice, or was the firm giving its own cybersecurity advice? A special master in the Samsung data breach litigation framed it in Kovel's terms in 2024, protecting a consultant only where it serves as the translator or interpreter counsel needs.

What decides whether a breach forensic report stays protected?

The facts of the engagement decide it, and courts read the contract, the invoices, and the distribution list as closely as the report. The table pairs each factor with the decisions that turned on it.

No single row decides a case. Experian's firm had worked for the company before and kept its report protected, because the court found the breach work was a separate engagement directed by counsel, while Capital One's firm signed a letter agreement with counsel and its report was still produced, because the scope matched work it was already under contract to do.

Privilege or work product: which one protects a forensic report?

Two protections are in play, and courts analyze them separately. The attorney-client privilege covers confidential communications made to obtain legal advice. It protects the communication, so the date an attacker logged in or the files they copied stay discoverable through other evidence. Work product protection, codified in Federal Rule of Civil Procedure 26(b)(3), covers documents prepared in anticipation of litigation by or for a party or its representative, and the rule names consultants among those representatives. An opposing party can overcome ordinary work product by showing substantial need and that it cannot get the equivalent without undue hardship, while counsel's mental impressions and legal theories get stronger protection.

For work product, most courts in the breach cases asked whether the report was prepared because of anticipated litigation and would not have been prepared in substantially similar form without it. The Capital One court, applying Fourth Circuit law, looked for "the driving force behind the preparation" of the report. The Experian court accepted that the company had its own duty to investigate and still protected a report that existed because counsel needed it for the litigation. The Rutter's court asked a stricter question, whether litigation was the primary motivating purpose, and found it was not.

For the attorney-client privilege, courts ask whether the primary purpose of the communication was legal advice, and forensic reports usually fail because they describe facts and technical fixes. The circuits disagree on communications with mixed purposes. The D.C. Circuit asks whether legal advice was "one of the significant purposes," while the Ninth Circuit asks for the primary purpose. The Supreme Court agreed to resolve the split in In re Grand Jury and then dismissed the case on January 23, 2023 without deciding it, as the American Bar Association's analysis of the dismissal explains. Until the Court takes another case, the test depends on where the suit is filed.

Every breach investigation has a business purpose, because the company must contain the attack, restore systems, and notify the people affected, so protection depends on showing that the counsel-directed work would have looked different without the litigation. Even a protected report leaves the evidence open: Target had produced forensic images and the card brand report was available, and the Experian court noted that the plaintiffs could obtain the same server images and hire their own expert.

Which breach cases protected the report, and which ordered it produced?

Two decisions protected the forensic work. In In re Target (D. Minn., October 23, 2015), one forensic firm ran two separate teams: one investigated for the card brands and produced a report Target did not withhold, and the other, engaged through counsel, briefed a data breach task force so counsel could advise the company. The court protected the task force materials but ordered production of the CEO's update emails to the board, which neither sought nor gave legal advice. In In re Experian (C.D. Cal., May 18, 2017), counsel hired the forensic firm, the report went to counsel, and the full report never reached Experian's incident response team.

Three decisions turned on a relationship that existed before counsel arrived. In In re Premera (D. Or. 2017), Premera hired its forensic firm in October 2014 to review its systems, the firm found malware in January 2015, and a February 2015 amendment moved supervision to outside counsel without changing the scope; the court held that "the change of supervision, by itself, is not sufficient." In In re Dominion Dental (E.D. Va., December 19, 2019), the post-breach statement of work was nearly identical to one signed in 2018, and the company had told customers it was working with a leading cybersecurity firm, so the Dominion Dental order found no separate counsel track. In In re Capital One (E.D. Va., May 26, 2020, affirmed June 25, 2020), the forensic firm held a 2015 master services agreement and a January 2019 statement of work, and the post-breach letter agreement with counsel covered the same scope.

Three more decisions turned on what the work was for. In Wengui v. Clark Hill (D.D.C., January 12, 2021), the defendant said it ran a business track through its usual security vendor and a legal track through a firm retained by counsel, but the court found no comparable business-track work, and the counsel-track report carried remediation advice and went to leadership, the IT team, and the FBI, per the ABA's case summary. In In re Rutter's (M.D. Pa., July 22, 2021), the statement of work said the investigation would determine whether a compromise had occurred, the company paid the firm directly, and the report went straight to the company. In Leonard v. McMenamins (W.D. Wash., December 6, 2023), counsel retained the firm, yet the statements of work described restoration services and the court found the report gave no legal advice.

The 2024 Samsung ruling shows how narrow the path has become. In that litigation, a special master's order filed August 19, 2024 (D.N.J. No. 23-3055) required Samsung to produce its forensic firm's briefings and analysis, even though counsel hired the firm after the breach. Thirteen Samsung employees, marketing staff among them, attended the firm's briefings, and its analysis went to 15 people. The order protected one document: a draft memorandum the firm prepared at counsel's request and showed only to counsel.

What goes in a Kovel letter for a forensic firm?

The Kovel letter should describe the engagement a judge will later test, so draft it from the case law backward. Published guidance on Kovel engagements, including the Journal of Accountancy's overview of Kovel agreements, and the breach decisions above point to these terms:

• Counsel retains the firm on the client's behalf and names the client and the matter.
• The stated purpose is to help counsel give legal advice about the incident and prepare for expected litigation and regulatory inquiries, with those risks described specifically.
• The firm works at counsel's direction, takes instructions from counsel, and delivers its findings to counsel.
• The scope is written for this incident and differs from any existing retainer, master services agreement, or earlier statement of work.
• Work product carries a legend such as "Privileged and Confidential, Prepared at the Direction of Counsel," and access is limited to the engagement team.
• Billing runs under a separate statement of work, with invoices through counsel or the legal department.
• Work papers belong to counsel, and nothing produced under the letter is reused for other work without counsel's approval.
• Counsel approves subcontractors and decides what is written down, including drafts.

Labels and reporting lines are the easiest terms to copy, and the Premera court held a change in supervision insufficient on its own, so the letter has to match the work.

How does a two-track investigation work?

A two-track investigation runs a business investigation and a legal investigation at the same time, with separate teams and separate deliverables. The business track handles containment, recovery, card brand and customer requirements, insurer claims, auditors, and the facts regulators need. The legal track answers counsel's questions: how the attacker got in as it bears on liability, what data was accessed, which notification laws apply, and what the company's exposure looks like. Target is the model courts cite, because its card brand team and its counsel team at the same forensic firm did not share the substance of their work.

The structure fails when one track exists in name only, as the defendants in Wengui and Samsung learned when each claimed two tracks and could not show the second one. A working business track produces its own findings and remediation plan from evidence it can share, and the legal track stays small. Collect the evidence once, with hash values and chain of custody, and give both tracks the same images and logs; that also keeps the company inside its preservation duty, which our litigation hold guide covers. Our guides to cyber forensics and ransomware investigations describe what each track examines.

Which mistakes put a forensic report into discovery?

Reusing the security vendor's existing contract

Premera, Dominion Dental, and Capital One all lost protection because the post-breach engagement repeated work the firm was already contracted to do. Dominion Dental's 2018 statement of work named outside counsel as a party before the breach was discovered, and the court still found the April 2019 version nearly identical. Agreeing on counsel's role inside an incident response retainer saves time, and it does not by itself give the work a litigation purpose.

Paying from the security budget

Capital One paid its forensic firm from a retainer under the pre-breach statement of work and then from its cyber budget, and only later re-designated the payments as legal expenses. Rutter's paid its firm directly. Route the engagement and invoices through counsel and the legal budget from day one.

Sending the report to the board, auditors, and the security team

Every recipient outside counsel is a fact the court can weigh. Capital One's report reached about 50 employees, the board, four regulators, and the outside auditor, and Samsung's forensic firm briefed 13 employees, including marketing staff. Give the board and the auditors a separate business summary, and let counsel decide how the board hears the privileged findings.

Writing the report as a remediation plan

A report organized around fixes reads as business work. The Wengui report carried specific remediation advice, and the McMenamins statements of work described restoration services. Remediation recommendations belong on the business track.

Repeating the findings to customers and regulators

Regulators ask for root cause, and notification letters need facts. Dominion Dental's customer letters credited a leading cybersecurity firm, and the order found that its statement to the Indiana Attorney General mirrored the firm's conclusion. Give regulators verified facts from the business track, and let counsel decide what, if anything, from the privileged work goes further.

Letting the insurance arrangement set the terms

When a cyber insurance policy assigns breach counsel, often called a breach coach, who then retains a forensic firm from the carrier's panel, check three things before work starts: that the engagement letter runs from counsel and is specific to this incident, whose budget pays the firm, and what the policy requires you to send the carrier, since every copy widens the distribution a court will review.

How BD Emerson works under a Kovel arrangement

BD Emerson does Kovel work. We work with law firms today and have done this work: outside counsel retains us, we work at counsel's direction, and our findings go to counsel. Our digital forensics services run privileged breach investigations under a separate engagement letter and statement of work, collect evidence once with hash values and chain of custody so both tracks work from the same record, and brief counsel orally until counsel decides what should be written down. Our incident response team can run the business track in parallel with separate staff.

Independence matters here. If we already provide routine security services to your company, or hold your incident response retainer, we tell counsel on the first call, because the cases above show how courts read an existing relationship, and counsel may decide another firm should run the privileged track while we support the business track. Privilege and work product decisions belong to counsel and, in the end, to the court. We structure the work so counsel can make those calls, and we do not promise that any report will be privileged.

Frequently asked questions

What is a Kovel letter? A Kovel letter is the engagement letter under which a lawyer retains a non-lawyer expert, such as an accountant or a forensic investigator, to help the lawyer advise a client. It takes its name from United States v. Kovel, a 1961 Second Circuit decision. The letter states that the expert works at counsel's direction to support legal advice, limits who sees the work, and routes findings and billing through counsel. Courts then test whether the actual work matched the letter.

Is a forensic report privileged after a data breach? It can be, and in most reported breach cases it was not. Courts protected the forensic work in Target in 2015 and Experian in 2017, where counsel directed the investigation and kept the report close. Courts ordered production in Premera, Dominion Dental, Capital One, Wengui v. Clark Hill, Rutter's, McMenamins, and Samsung, usually because the work matched routine security services, served business purposes, or circulated widely. Whether a specific report is protected is a call for counsel and, ultimately, the court.

Does a Kovel agreement protect the facts of a breach? A Kovel agreement does not protect the facts. Privilege covers communications made to obtain legal advice, and work product covers documents prepared because of litigation. The opposing side can still obtain forensic images, logs, and testimony about what happened, and the Target and Experian courts pointed to those sources when they declined to order the protected reports produced. What the agreement can protect is the counsel-directed analysis, when the engagement is set up and run that way.

Can the same forensic firm handle the privileged investigation and the remediation? It can, with separate teams, separate statements of work, and separate deliverables. In Target, one forensic firm ran a card brand investigation and a counsel-directed investigation whose teams did not share the substance of their work, and the court protected the counsel track. Where the firm already held a security contract covering the same work, as in Capital One and Premera, courts treated the post-breach engagement as a continuation of that business relationship.

Who signs a Kovel agreement, and who pays the forensic firm? Outside counsel signs as the party retaining the expert, and the client often signs as well, particularly when it pays the fees directly. Invoices should run through counsel or the legal department under a separate statement of work. In Capital One, payment from a pre-breach retainer and then the cyber budget, later re-designated as a legal expense, was among the facts the court relied on when it ordered the report produced.

Does sharing a forensic report with regulators or the FBI waive privilege? Sharing widens the record a court reviews. Capital One's report went to four regulators and its outside auditor, which the court treated as evidence of regulatory and business purpose. In the Samsung litigation in 2024, a special master held that sending an update to the FBI did not waive privilege under a federal non-waiver provision, 6 U.S.C. 1504(d)(1), but also found the update itself was not privileged. Counsel should decide what goes to any agency.

If counsel needs a forensic investigation it can direct after a breach, our digital forensics team can work under a Kovel engagement, preserve the evidence once for both tracks, and report findings the way counsel instructs.