Internal Investigations in the Time of COVID-19:

By Robert H. Feinberg and Ashley Repka

Benjamin Franklin once said, “The handshake of the host affects the taste of the roast.” He was right: a simple handshake introduction can be telling, not least of all in the context of internal investigations.  Most obvious, seeing witnesses face-to-face, looking them in the eyes and getting a sense for who they are is a very real part of the investigative process. Perhaps less obvious, but just as important, in-person meetings, debriefings and interviews are crucial tools for building a collaborative and trustful relationship between counsel and client, a foundation for protection of attorney-client privilege and confidentiality.

Plainly stated, operating internal investigations while practicing social distancing is difficult – in many respects. Documentary evidence is often best shared and sensitive conversations are often best had while live and in-person, sitting across a table, where participants can talk without social distancing obstacles or electronic intermediaries. Unfortunately, the business community’s need for internal investigations will likely remain steady, if not increase, in the time of COVID-19¹ and new challenges to conduct such investigations will be left in its wake. 

Internally, as employees relocate offices to their homes or transition more frequently between office and home, companies face increased risk that sensitive documents will be lost, misplaced or exposed to third parties. Likewise, as sensitive conversations increasingly take place on personal phones or videoconferencing platforms, companies face increased risk that sensitive information will be overheard or accessed by third parties—whether family members, neighbors or others. Attorney-client privilege—often a critical consideration because internal investigations can uncover sensitive details about a business and its people—may be challenged in such circumstances, where information is flowing more freely and through more avenues of communication. Moreover, these internal concerns coincide with an identified risk of cyberattacks related to COVID-19,² which threaten both the loss of privilege and/or confidentiality and the possibility of future investigations into a company’s privacy practices and compliance obligations.

Therefore, experienced counsel is needed to both establish the privilege and guard it as the investigation proceeds in the COVID-19 environment. Companies and their counsel may want to consider devoting time and energy now to develop, implement and make known an informed, comprehensive set of best practices designed to (1) protect attorney-client privilege and work product protection during ongoing investigations, and (2) maintain the privacy and security of sensitive information, to help avoid the necessity of future investigations. Three broad practices, applicable generally, but especially in the time of COVID-19, are useful to keep in mind:

1. Keeping the investigation team well-informed and its work product footprint well-contained

Early in the investigative process, explain potential attorney-client privilege, work product and confidentiality protection pitfalls arising from COVID-19 and the remote work environment to the investigative team. Encourage common practices among players, including outside counsel, in-house counsel, client employees, and consultants, including the following:

• Maintain physical files in the relevant office, to the greatest extent possible;
• Dedicate an area for storage of sensitive documents and work product in home offices when sensitive physical files must be removed;
• Maintain best practices for electronic storage of sensitive documents and work product, including use of VPN, non-local storage and (where appropriate) encryption;
• Avoid use of more informal communication channels such as chat functions within videoconference applications, text messages, etc. that may feel more acceptable in the work-from-home environment. Keep in mind these more informal channels still may be discoverable if litigation ensues, and may not be protected by privilege;
• Ensure conversations are conducted in a private area of the home or other workspace; and
• Securely share only those documents that must be shared and only with those individuals who must see or possess them. For videoconference interviews or debriefings touching on highly-sensitive documents or work product, which may have been presented to the interviewee or client only temporarily within the confines of an in-person meeting, consider the use of screen-sharing versus emailing or otherwise electronically sending the documents, keeping in mind (and instructing against) the ability of a witness or client to screenshot such information during the videoconference.³  

2. Being diligent about threats, even those not fully in your control

Counsel should also be aware of and, as best as possible, guard against more covert, unilateral actions by witnesses or other actors that might defeat claims of privilege in future litigation or risk exposure of sensitive information critical to the investigation.

• At the beginning of any witness interview or other sensitive call, clarify it should not be recorded by either party. Better yet, use a videoconference platform that alerts all parties when any party is recording.⁴ Keep in mind such recordings may be discoverable in subsequent litigation and remind both the investigation team and those with which it communicates of the potential illegality of unilateral recording;⁵
• Utilize all security features available on videoconferencing platforms and confirm all parties’ personal security measures at the beginning of each call. Document in written interview or call notes the witness’s or other individual’s confirmation they are alone and in an area where the conversation will not be overheard;
• Don’t get lazy about document security. Use trusted applications and platforms; utilize encryption and two-factor authorization where appropriate to guard against cyberattacks.

3. Document, Document, Document!

Clear documentation of the investigative process is important to maintaining attorney-client privilege, work product protection and the integrity of an investigation. Counsel should clarify, in writing, early on and repeatedly throughout, the purpose and scope of the investigation and make clear, where applicable, that the work is being performed in anticipation of litigation. In addition:

• Document altered or additional privacy practices implemented to address COVID-19 generally and the way they are applied to work on the investigation specifically;⁶
• As mentioned above, document at the beginning of any sensitive call the participants’ confirmation they are in a secure setting and are not recording;
• Document and regularly update the location of any key documents and those with access to them, both physically and electronically.

Finally, although framed above in the context of protecting privilege and confidentiality, these measures also are important to attorneys’ fulfillment of their ethical obligation to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.”⁷ That is, counsel are responsible not only for advising clients to take protective steps, but for taking such steps themselves in the interest of the client. Counsel, whether in-house or independent, should not expect clients to act with thoughtfulness, cautiousness, foresight or intentionality it is not itself actively exhibiting.