The DOJ has recently revised its guidelines for prosecuting business organizations to assist prosecutors in deciding under what circumstances to bring corporate charges. Will these new rules make life tougher for CSOs? The Department of Justice recently announced new guidelines for prosecuting business organizations and incorporated them into the U. S. Attorney’s Manual to assist prosecutors in deciding under what circumstances to bring corporate charges. The new principles state that eligibility for cooperation with benefits is not contingent on a client’s waiving either attorney-client communications or attorney-work product.Jonathan N. Halpern, a partner with Bracewell & Giuliani LLP in New York, recently spoke with CSO Senior Editor Joan Goodchild. Halpern, who spent 15 years as an Assistant U.S. Attorney with the U.S. Attorney’s Office for the Southern District of New York, discussed what these new changes mean for CSOs and other corporate executives. Perhaps the best place to start is to lay out what is new in these recently announced guidelines. Could you explain?What happened most recently is the Department of Justice has put in place what’s called new principles of federal prosecution of business organizations. These are included in the US Attorneys Manual. They are a whole series of considerations for prosecutors use to determine whether to bring charges against a corporate entity. These new guidelines supersede what is known as the McNulty Memorandum, which was a memorandum that set forth principles to guide attorneys in 2006. Those guidelines were, in turn, to address the Thompson Memo, which was set forth in 2003. The Thompson Memo identified as a basis of cooperation issues of waiver, which were essential to whether a corporation was advancing legal fees or otherwise indemnifying employees that were viewed to be culpable. And another component of that perceived cooperation was whether corporations waived attorney-client privilege or attorney-work product material that otherwise would be protected. Those were factors a prosecutor could consider when decided whether a company was cooperating.Now what’s set forth is a whole series of factors for prosecutors to consider when determining whether to bring charges against a business. One of those factors, and there are many, is whether a corporation has cooperated. But with these new principles, the DOJ has explicitly said that waiver of attorney-client privilege or work-product materials should not be considered as basis for prosecution. In fact, there is a directive to prosecutors not to even request it. This is a big difference from McNulty Memorandum which set up a dual-tier system that said: First we want the facts. So, if there are facts set up through interviews with company attorneys, and those facts can’t be attained through non-privileged materials, we can access them through privileged materials. Now explicitly they say the government may not ask for that. Of course, corporations may always waive attorney-client privilege, but it is not going to be a factor when considering cooperation. Was there criticism in the private sector that lead to these changes?I think there was a perception that prosecutors were asking for waiver. And if they weren’t explicitly asking, then a corporation understood that it would make a prosecutors job much easier if they came forth with a waiver.So, I think there was a perception of undue pressure on companies to waive. And also there was a perception that it was completely improper for government to insist that the company not indemnify its employees for legal expenses or that it would be a consideration in the government’s determination that there was cooperation. So, do these changes ease the level of aggressiveness on the part of the government when it comes to corporate investigations?Yes. Well, look: The DOJ says “We want facts. We have to have a thorough understanding of what happened, when it happened, what was the scope of it, how far does it extend?” But what is telling here is that on one hand they are saying the key here is government measure of cooperation must remain the same for individuals. For instance: Has the party timely disclosed relevant facts about punitive misconduct? That’s the operative question in assigning corporate credit. Not whether the corporation disclosed attorney-client or work-product materials.What will this mean for CSOs, CIOs, etc.?Let me walk through the process procedurally. Whenever it’s incumbent on CSOs and other managers of information, anything that can affect security and business operations of company, the first thing is to identify the issue. Is it a complaint? Is it an issue of wrong doing? Get an understanding of who’s involved, when it occurred and whether dealing in house with counsel. Get a full, immediate understanding to see whether self-reporting is appropriate, or whether or not it is required. So I think reaching out to counsel is very important to get an immediate assessment.Preservation of all materials; hard copy, as well as electronic documents, is essential. No one wants to be accused of obstructing or taking action that would be inconsistent with getting to the root of a problem. Those would be the initial preparations. Then respond. See the scope of the problem. It’s very important for CSOs to address this with counsel. Then I think it’s up to the lawyers to determine what is the best way to identify the problem and determine if there was any wrong doing.Will this make any life easier now for CSOs or other executives?At least nominally. It says, specifically, prosecutors are directed not to ask corporations to waive these protections. However, in a foot note, again in the context of receiving credit, it says a corporation needs to produce relevant, factual information; including relevant, factual information acquired through those interviews, meaning those conducted by corporate lawyers. So what does that mean? If information comes from an interview done by a corporate attorney, arguably, that is privileged information. That is information the company holds. How else does a company learn the facts? They learn through interviews with employees. So, if it is company lawyer that is doing it, that is attorney-client privilege. So, there is a tension here. They say “We don’t want any of your privileged materials. But if you want to get credit for cooperating, you have to tell us the complete, factual information, which is the basis of the alleged wrong doing.” So it’s a little bit of a catch-22.I’m not sure as a practical matter what difference this makes. This may be window dressing in that prosecutors formally are not permitted to ask for waiver. So, what’s the bottom line? I think companies, and CSOs, have got to be vigilant. They have to have real, genuine compliance measures that are in effect. And if there are real issues of wrong doing, they have address it right away. And presumably, if they get a subpoena, they have to make sure there is a litigation or document-hold memo in place that goes to the appropriate people so all documents and backups are preserved. That is, emails, hardcopies and metadata. This way, there can be no accusation of obstruction, witting or unwitting, in the investigation. Related content feature Top cybersecurity M&A deals for 2023 Fears of recession, rising interest rates, mass tech layoffs, and conservative spending trends are likely to make dealmakers cautious, but an ever-increasing need to defend against bigger and faster attacks will likely keep M&A activity steady in By CSO Staff Sep 22, 2023 24 mins Mergers and Acquisitions Mergers and Acquisitions Mergers and Acquisitions brandpost Unmasking ransomware threat clusters: Why it matters to defenders Similar patterns of behavior among ransomware treat groups can help security teams better understand and prepare for attacks By Joan Goodchild Sep 21, 2023 3 mins Cybercrime news analysis China’s offensive cyber operations support “soft power” agenda in Africa Researchers track Chinese cyber espionage intrusions targeting African industrial sectors. By Michael Hill Sep 21, 2023 5 mins Advanced Persistent Threats Cyberattacks Critical Infrastructure brandpost Proactive OT security requires visibility + prevention You cannot protect your operation by simply watching and waiting. It is essential to have a defense-in-depth approach. By Austen Byers Sep 21, 2023 4 mins Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe