On February 20th, my article warning about the dangers of clients using GenAI tools and creating discoverable information was published. Unbeknownst to me, the day before the article was published, a ruling from the Southern District of New York affirmed my very fears. So once again, I get to say, “I told you so.” Unlike what many think, just because someone puts something in a GenAI tool doesn’t mean it’s private.
In United States of America v. Bradley Heppner, Judge Rakoff ruled that certain written exchanges Heppner had with the GenAI platform, Claude, were not protected from disclosure to the government by either the work product or attorney client privilege.
Without Suggestion from Counsel
The key concept cited by Judge Rakoff was that Heppner consulted Claude without any suggestion or direction of counsel when he: a) outlined for Claude his defense strategy and sought comments, b) outlined the law and facts he might argue, and c) asked what the other side might argue. He then gave what he had learned from Claude to his counsel.
Heppner argued that he did all this in anticipation of speaking with his lawyer to get legal advice.
The Attorney-Client Privilege
According to the court, application of the attorney-client privilege requires a communication between a client and their lawyer, that was intended to be and was kept confidential, and was for purpose of obtaining legal advice.
Judge Rakoff made short work of Heppner’s attorney-client privilege argument. First of all, the communications between Heppner and Claude were not between lawyer and client but between a client and a GenAI platform. Second, the communications were not confidential. Under the terms of use, it was clear that Claude collects data from those who use it and then uses those communications for training purposes. Heppner was thus clearly on notice of the lack of confidentiality and that any input data could be disclosed to others. As a result, said the court, Heppner had no reasonable expectation of privacy.
The court noted Heppner’s argument that he consulted with Claude with the intent to give it to counsel to get later advice. But that argument rang hollow since Heppner didn’t tell counsel in advance that he was going to do it, and his lawyer didn’t know he did it.
The Work Product Privilege
The work product privilege is designed to protect and shelter the mental processes and thinking of an attorney in representing their client and in anticipation of litigation. But the key, said the court, was that the material needs to be prepared by the attorney. Certainly, said the court, the privilege may apply if done by an agent and at the direction of the attorney. On first blush, that sounds like it may save the Heppner communications from disclosure. But once again, Heppner didn’t communicate with Claude under the direction of his lawyer or, again, even with his knowledge. So, there was no way either Heppner or Claude was acting as an agent of the lawyer. Even if the material was prepared in anticipation of litigation, the privilege doesn’t apply, nor did it reflect the lawyer’s strategy or mental processes.
Lessons Learned
I have been warning about the impact of throwing caution to the wind when inputting sensitive material into GenAI tools.
First, it’s clear that what a client puts into a GenAI and what they get out before they see a lawyer is fair game for discovery. Nor, under the court’s analysis in Heppner, will it be protected from once litigation is commenced unless directed by the lawyer. That doesn’t change by afterwards saying, well, I was going to give to my lawyer. Right. How convenient.
Granted, some systems provide the option to direct the tool not to disclose the information to others or use it for training. But it still pays to read the terms of use very carefully before placing confidential material into the platform. Oh, and by the way, ignoring the privilege issue for the moment, under the ethical confidentiality rules (Model Rule 1.6), it’s not just confidential material we need to protect. It’s information “relating to the representation of a client.” That’s a little broader.
Nor will ignorance of the terms of use be an excuse. Terms of use matter and it’s clear — lawyer or not — they better be read.
So, as I have discussed before, we as lawyers need to educate our clients as to these basic principles if we want to protect them down the road.
But What About the Lawyers?
But what about us lawyers? It’s been said over and over that we shouldn’t put client confidential material into an open or public system. And that we need to be careful in directing our clients to use the tools as well. Merely telling a client to look something on ChatGPT doesn’t make what they input or get back privileged if the other criteria are not met.
But more and more, I see lawyers themselves going to public GenAI tools to do many of the things Heppner was doing: brainstorming their cases and strategies. Will the work product privilege apply to that material?
Certainly, if the lawyer inputs the material, the platform might be considered an agent. Assuming that the material is being prepared or obtained in anticipation of litigation and contains or references the lawyer’s mental processes and strategies, there should be no problem, right?
Maybe. As I have discussed, the issue is whether the privilege is waived by placing it in a public platform where, like Claude, the material is retained by the platform and used for training.
In thinking how this issue might come up, assume that you use Claude and ask it for help with evaluating your strategy. Assuming that what you say is relevant to the case itself (which granted could be a tall order for the other side to show), your opponent moves to compel production of the material. You make your arguments, and your adversary says with a sly smile, “I actually asked ChatGPT what it thought about this. Here is what it said”:
Placing thoughts and ideas into a large language model (LLM) like ChatGPT could potentially waive work product protection. If a lawyer uses a public, consumer-facing LLM (like ChatGPT or Copilot) without a confidentiality agreement or enterprise-level protections, inputting sensitive legal analysis or impressions might be considered disclosure to a third party. If the provider reserves the right to retain, review, or use the input data, a court might find that confidentiality was not preserved.
Nothing like having your own tool stuck up your you know what. As the judge says, you got 10 days to produce your prompts and the outputs.
What’s the Point?
The point is not to use GenAI tools but to use them knowledgeably, understanding the risks to you and to your client. You can’t do that by sticking your head in the sand about GenAI. You need to carefully read the terms of use. You need to train yourself. Beyond what you do for yourself, you also need to educate your clients. You need to think about what you’re putting in and getting out and weigh the risks.
As a profession, we don’t want our clients or ourselves ending up like Mr. Heppner.
Stephen Embry is a lawyer, speaker, blogger, and writer. He publishes TechLaw Crossroads, a blog devoted to the examination of the tension between technology, the law, and the practice of law.
The post Hate To Say I Told You So Again: Your Chats Ain’t Private appeared first on Above the Law.
On February 20th, my article warning about the dangers of clients using GenAI tools and creating discoverable information was published. Unbeknownst to me, the day before the article was published, a ruling from the Southern District of New York affirmed my very fears. So once again, I get to say, “I told you so.” Unlike what many think, just because someone puts something in a GenAI tool doesn’t mean it’s private.
In United States of America v. Bradley Heppner, Judge Rakoff ruled that certain written exchanges Heppner had with the GenAI platform, Claude, were not protected from disclosure to the government by either the work product or attorney client privilege.
Without Suggestion from Counsel
The key concept cited by Judge Rakoff was that Heppner consulted Claude without any suggestion or direction of counsel when he: a) outlined for Claude his defense strategy and sought comments, b) outlined the law and facts he might argue, and c) asked what the other side might argue. He then gave what he had learned from Claude to his counsel.
Heppner argued that he did all this in anticipation of speaking with his lawyer to get legal advice.
The Attorney-Client Privilege
According to the court, application of the attorney-client privilege requires a communication between a client and their lawyer, that was intended to be and was kept confidential, and was for purpose of obtaining legal advice.
Judge Rakoff made short work of Heppner’s attorney-client privilege argument. First of all, the communications between Heppner and Claude were not between lawyer and client but between a client and a GenAI platform. Second, the communications were not confidential. Under the terms of use, it was clear that Claude collects data from those who use it and then uses those communications for training purposes. Heppner was thus clearly on notice of the lack of confidentiality and that any input data could be disclosed to others. As a result, said the court, Heppner had no reasonable expectation of privacy.
The court noted Heppner’s argument that he consulted with Claude with the intent to give it to counsel to get later advice. But that argument rang hollow since Heppner didn’t tell counsel in advance that he was going to do it, and his lawyer didn’t know he did it.
The Work Product Privilege
The work product privilege is designed to protect and shelter the mental processes and thinking of an attorney in representing their client and in anticipation of litigation. But the key, said the court, was that the material needs to be prepared by the attorney. Certainly, said the court, the privilege may apply if done by an agent and at the direction of the attorney. On first blush, that sounds like it may save the Heppner communications from disclosure. But once again, Heppner didn’t communicate with Claude under the direction of his lawyer or, again, even with his knowledge. So, there was no way either Heppner or Claude was acting as an agent of the lawyer. Even if the material was prepared in anticipation of litigation, the privilege doesn’t apply, nor did it reflect the lawyer’s strategy or mental processes.
Lessons Learned
I have been warning about the impact of throwing caution to the wind when inputting sensitive material into GenAI tools.
First, it’s clear that what a client puts into a GenAI and what they get out before they see a lawyer is fair game for discovery. Nor, under the court’s analysis in Heppner, will it be protected from once litigation is commenced unless directed by the lawyer. That doesn’t change by afterwards saying, well, I was going to give to my lawyer. Right. How convenient.
Granted, some systems provide the option to direct the tool not to disclose the information to others or use it for training. But it still pays to read the terms of use very carefully before placing confidential material into the platform. Oh, and by the way, ignoring the privilege issue for the moment, under the ethical confidentiality rules (Model Rule 1.6), it’s not just confidential material we need to protect. It’s information “relating to the representation of a client.” That’s a little broader.
Nor will ignorance of the terms of use be an excuse. Terms of use matter and it’s clear — lawyer or not — they better be read.
So, as I have discussed before, we as lawyers need to educate our clients as to these basic principles if we want to protect them down the road.
But What About the Lawyers?
But what about us lawyers? It’s been said over and over that we shouldn’t put client confidential material into an open or public system. And that we need to be careful in directing our clients to use the tools as well. Merely telling a client to look something on ChatGPT doesn’t make what they input or get back privileged if the other criteria are not met.
But more and more, I see lawyers themselves going to public GenAI tools to do many of the things Heppner was doing: brainstorming their cases and strategies. Will the work product privilege apply to that material?
Certainly, if the lawyer inputs the material, the platform might be considered an agent. Assuming that the material is being prepared or obtained in anticipation of litigation and contains or references the lawyer’s mental processes and strategies, there should be no problem, right?
Maybe. As I have discussed, the issue is whether the privilege is waived by placing it in a public platform where, like Claude, the material is retained by the platform and used for training.
In thinking how this issue might come up, assume that you use Claude and ask it for help with evaluating your strategy. Assuming that what you say is relevant to the case itself (which granted could be a tall order for the other side to show), your opponent moves to compel production of the material. You make your arguments, and your adversary says with a sly smile, “I actually asked ChatGPT what it thought about this. Here is what it said”:
Placing thoughts and ideas into a large language model (LLM) like ChatGPT could potentially waive work product protection. If a lawyer uses a public, consumer-facing LLM (like ChatGPT or Copilot) without a confidentiality agreement or enterprise-level protections, inputting sensitive legal analysis or impressions might be considered disclosure to a third party. If the provider reserves the right to retain, review, or use the input data, a court might find that confidentiality was not preserved.
Nothing like having your own tool stuck up your you know what. As the judge says, you got 10 days to produce your prompts and the outputs.
What’s the Point?
The point is not to use GenAI tools but to use them knowledgeably, understanding the risks to you and to your client. You can’t do that by sticking your head in the sand about GenAI. You need to carefully read the terms of use. You need to train yourself. Beyond what you do for yourself, you also need to educate your clients. You need to think about what you’re putting in and getting out and weigh the risks.
As a profession, we don’t want our clients or ourselves ending up like Mr. Heppner.
Stephen Embry is a lawyer, speaker, blogger, and writer. He publishes TechLaw Crossroads, a blog devoted to the examination of the tension between technology, the law, and the practice of law.
The post Hate To Say I Told You So Again: Your Chats Ain’t Private appeared first on Above the Law.
