Katherine Forrest: Yeah, and so I actually want to sort of take a step back, because I know we have a whole bunch of international listeners, and say that the American process of litigating includes this very broad discovery where you can ask, each side can ask, for the other side's documents relating to issues in the litigation. But protected from disclosure are certain documents that fall under certain privileges and the primary privilege is the attorney-client privilege. And, you know, the core of that privilege is to allow free and open communication between an attorney and his or her client, to keep those confidential. And really to do that, there have to be a whole series of statutes and rules that provide protections, that guarantee protections. When you have documents that fall under the attorney-client privilege, then what you do is rather than disclosing those documents, you would provide a log or a list of those documents so the other side will know they exist but isn't entitled to see them. Now, typically, when you're talking about the attorney-client privilege, you're talking about communications between the individual or company and its, or his or her, attorney that is seeking or providing legal advice or conveying legal advice that's been provided. So, for instance, if I go to a lawyer and I'm in my individual capacity and I'm seeking legal advice, I haven't yet retained that lawyer. That conversation is nonetheless protected by the attorney-client privilege. Once I've retained the lawyer, then my communications with that lawyer for trying to obtain legal advice is also privileged. And what the lawyer says to me is privileged. And by the way, if I tell somebody, say I'm an executive at a company and I've been given privileged advice from the lawyer to the company in the United States, then I, as an executive of that company, could tell another executive of that same company that's still confidential that advice and that advice would then stay privileged. So again, it's all about trying to encourage clients to be open and candid with their lawyers without fear that their communications are going to be disclosed.
Scott Caravello: Yeah, so the work product doctrine is related, but it's distinct. And so I want to read the rule and then talk about how it's actually been interpreted. And so that's Federal Rule of Civil Procedure 26(b)(3)(A), which says that, “materials are not discoverable that are prepared in anticipation of litigation or trial by or for another party or its representative, including the other party's attorney.” So, it protects materials that are prepared in anticipation of litigation, especially materials that reflect legal strategy, mental impressions, or theories of the case. So, typically it's prepared by a lawyer, or at the direction of a lawyer, butut I wanted to read the language of the rule itself because to some ears it can sound broader. And if the party, him or herself, without the direction of a lawyer, but still anticipating litigation, creates work product on his or her own initiative, it could still be protected.
Katherine Forrest: Right. And so this, I think, is going to be one of the hearts of the debate that we're going to talk about in terms of the Heppner decision versus the Warner v. Gilbarco decision, because in Heppner, Rakoff essentially said it had to be directed by a lawyer. It could be done by an agent of a lawyer, but it had to be directed by the lawyer. It couldn't just be done on the initiative of the litigant, him or herself. And when you go back to Federal Rule of Civil Procedure 26(b)(3), big, (A)—there's always the big “A” and the little “a,” and this is the big “A,” the big A, it's exactly as you say, Scott, so good for you since it's only 6 a.m. in whatever island you're on out there in Hawaii. But there's another piece of it that I actually want to read which is, not only does it say under this rule that it has to be anticipation of litigation or for trial by or for another party, by or for another party. So, it could be by your adversary, right? Or it's representative. So that would make you think that the “or its representative,” or the party's representative, is meaningful, that the or is meaningful, that the party means one thing and the representative means something else, you know. Statutes, you really have to be careful about these words. But then there's a parenthetical. And the parenthetical says, “including the other party's attorney,” okay, that's the lawyer we've been talking about all the time, “the consultant, the surety, the indemnitor, the insurer, or the agent.” So, there's actually a call out of who the representative could be, it's not limited to, it's only including. So we've got party or representative, and then we have including and then a list that includes the lawyer. So, I find this, you know, pretty interesting in terms of what we're going to be doing as we talk about what work product means with the Heppner case.
Scott Caravello: I totally, totally agree. And I think that really all just gets to the heart of the case. There's countless cases that are defining work product as at the direction of a lawyer. As Judge Rakoff says in the opinion, that the primary purpose is still to protect the mental impressions of the attorney, notwithstanding what we discussed about the statute, contemplating that a party could also create work product. And, so, you know, unlike the attorney-client privilege, work product protection is not automatically waived just because a document is shared with a third party. And that's really important to this set of cases too. Waiver of work product generally requires disclosure to an adversary or disclosure in a way that substantially increases the likelihood that the material will reach an adversary.
Katherine Forrest: Right, and that actually, you're just actually reading language from the Warner-Gilbarco case, which talks about what level of confidentiality do you have to have and where can there be a, “perhaps even a little bit of a break in confidentiality that's not going to destroy the privilege.” And we're going to talk about this, but in the Warner v. Gilbarco case, citing some Sixth Circuit precedent, it does use exactly the language that you've said, which is, “waiver requires disclosure to an adversary,” which would not be the chatbot, “or disclosure in a way that substantially,” substantially “increases the likelihood that the material will reach an adversary,” which is not just going into a, you know, trillion piece of data training corpus for a chatbot. So these are really interesting, I think, points for us to just put out there on the table at first and then let's just go through it. So we'll start with the SDNY case. That's the Heppner case. And, I think that the chronology of that case is useful for folks to have in mind because the attorney client or work product documents that were at issue were created by the target, which is Mr. Heppner, before he was actually the defendant in a criminal case in 2025. So in 2025, Mr. Heppner receives a grand jury subpoena. He's told he's now a target, which is specialized language in the prosecutorial world, that you are now potentially looking at being a possible defendant. And the allegation that he was up against, and that's now the subject of this complaint, is that he defrauded investors allegedly out of $150 million. That's still to be tried. These are only allegations. But then on October 28th, 2025, so that's after Mr. Heppner uses Claude to create some documents for himself, he enters some queries. He asks Claude questions that he thinks are part of his legal strategy. On October 28th, 2025, the grand jury issues its indictment, which means that the grand jury has agreed, they've sworn out the indictment, they've agreed that he should be indicted. He then is arrested in the Northern District of Texas on November 5th. A search warrant is issued for his computer, etc., etc. These documents then are discovered. There's actually, by the way, a very serious protocol that gets put in place by the prosecutors and defense counsel that's taken really seriously where you have a clean team. 31 documents were identified. They were segregated. So the trial team and the clean team don't communicate about the content of those documents. But the whole issue has to do with these 31 documents. So, Judge Rakoff addressed first what he thought of as a question of first impression. And I think, in fact, but for the fact, you know, I'm using the word fact too many times, but you get it. And the fact of the matter is how I can use it a third time, right? But Judge Rakoff said this is a case of first impression. But interestingly, I just want to suggest that while it's a case of first impression about Claude and attorney-client privilege and work product, it's not a case about first impression, about 26(b)(3)(A) and who can create work product, or about what it takes to break the confidentiality of work product. That there is existing case law on those two key questions, and so we'll get to that, but… in any event, he, Rakoff, was addressing whether or not the defendants, that's Mr. Heppner's interactions with this Claude tool, was not, very importantly, not an enterprise tool. It was not behind a corporate set of firewalls and a corporate set of restrictions and with all of the confidentiality restrictions that you can put in place now with enterprise versions of tools. It was effectively the downloaded-off-the-internet version of Claude, that whether or not that kind of publicly available generative AI tool can create documents for an individual defendant that are either protected by attorney-client privilege or work product? And his answer was no. That in his view, in Judge Rakoff's view, the defendant had used Anthropic, the Claude tool from Anthropic, to generate these documents that outlined his defense theories, legal argument strategy, and that they were not protected.
Scott Caravello: Yeah, and you know, the-the opinion makes a broader point too, which was Judge Rakoff emphasizing that the recognized privileges depend on a trusting human relationship with a licensed professional who is subject to, you know, ethical obligations and discipline that lawyers have to follow. And so an AI platform just doesn't fit that mold.
Katherine Forrest: Right. I mean, there really were two primary facts that the case turned on. First, that the defendant himself had entered the queries into Claude on his own initiative. And so that really, by the way, so just keep in the back of your mind, we're going to have litigation on this issue, whether or not 26(b)(3)(A) is going to play a role down the road. That was not addressed as part of this. And second, that the Claude terms of service had suggested or state that the output can be used to train the model and be provided to third parties under certain circumstances. And, Rakoff rejected the privilege protection on the grounds that these were not communications between a client and an attorney. They were communications between an individual Mr. Heppner and his chatbot, and that the Claude tool, as Rakoff said, could not be a lawyer and had no fiduciary duties, as you said, trusting human relationship. Then the court found, secondly, that the communications weren't confidential. And that's where we want to get to this other series of cases that I'm predicting are going to be litigated in the future about under what circumstances you can have a situation where a piece of work product is disclosed under circumstances not intended to get into an adversary's hands, and say several steps removed from an adversary's hands. And, you know, Rakoff found that because of the terms of service, Heppner did not have a reasonable expectation of confidentiality and that that was that.
Scott Caravello: Right. So, Rule 26(b)(3)(A) is about the work product protection, but so maybe we can just focus quickly again on the attorney-client privilege portion of it. And the court explained there that while maybe a closer call, the communications weren't made for the purpose of obtaining legal advice. And Judge Rakoff looked to Claude's response when it's prompted to give legal advice—it says that it doesn't do so, and it directs users to consult a qualified attorney. And again, the defendant was acting independently, not at counsel's direction.
Katherine Forrest: Right. So, Heppner tried to defend the protection of these documents, these 31 documents, on the basis of both that attorney-client privilege and on work product. You've described the attorney-client privilege and the work product is as we've said, it's the 26(b)(3)(A) where Rakoff said, look, these were not prepared at the direction of the lawyer. They were prepared on your own initiative and they weren't at counsel's direction. They don't reflect counsel's mental impressions and so that fails. So, that's actually what I mean by when I keep going back to 26(b)(3)(A).
Scott Caravello: Yeah, and you know, maybe this is a good place to pause and mention why this decision shouldn't be taken to signal that litigants in the Southern District of New York are now subject to some sort of AI equals waiver rule, right? Aside from the fact that it's a district court decision, Judge Rakoff explicitly noted that if counsel had directed the client to use the AI tool, the analysis might have been different and it could have potentially been closer to what's known as the Kovel exception, which is where third parties act as agents to facilitate legal advice.
Katherine Forrest: Yes, and, you know, that ultimately focuses on part of the parenthetical of 26(b)(3)(A) about agents. But what's interesting about the confidentiality piece in terms of how Rakoff describes it is that the terms of service actually say that Anthropic won't train on the inputs or outputs unless it receives users' permission. And the language stating that Anthropic might disclose user information to government and third parties is in line with legal obligations like a subpoena, for example, that's commonly found in privacy policies, including at other tech firms and in lots of terms of service, because there can be situations where there is all kinds of things. Let's just take CSAM as an example where there might be a real reason to have to have the government inquire into particular materials.
Scott Caravello: Right, so, you know, the ruling may be limited closely to the facts that were before the court. And, you can imagine that with a different AI tool, like with an enterprise version, like you were discussing, and where the use is directed by counsel, the issues Judge Rakoff identified just go away.
Katherine Forrest: Right or, , bringing in 26(b)(3)(A)—if it has any life—there are some Second Circuit cases that weren't part of the briefing here, but it would be interesting to see briefing and then have a district court decision on that. But let's move on to the Michigan case, which comes out the other way and is on a different set of facts. That's the Warner v. Gilbarco case. And there, this was a discovery dispute, and the court denied a motion to compel discovery into the plaintiff's use of AI tools. Here, the tool was ChatGPT. And so, you know, what happens in the American system is we've talked about this discovery where you can get each other's documents that relate to a case, but if a party refuses to produce certain documents, you can have a motion to compel those documents. And so this case said, no, you can't have the ChatGPT chat documents. It has–it comes to the opposite conclusion as Heppner. And so we'll talk about that. But the facts as an initial matter were very different in Warner. And so, because we were talking about a pro se plaintiff, perhaps the court was led more quickly to 26(b)(3)(A) and italicized the word “party” when it talks about 26(b)(3)(A) and work product in connection with its decision in that case.
Scott Caravello: Absolutely. And you know, the court went out of its way to push back on the idea that using AI automatically opens the door to discovery or waives protection. The defendants argued that the plaintiff's AI use should make her internal analyses discoverable or at least require a privilege log along the lines of what you were talking about earlier, Katherine. And the court found that the information that was at issue, though, was protected by the work product doctrine. And that's 26(b)(3)(A). And the work product was squarely at issue in the case because like you mentioned, the plaintiff was a pro se litigant, meaning she represented herself. While a pro se litigant can't broadly claim attorney-client privilege since there are no attorneys involved, work product can then protect their mental impressions, drafts, and internal strategy.
Katherine Forrest: Right, and because to waive work product requires some amount of disclosure, that's when the court got into the next part of its decision, which is what does disclosure mean in terms of work product? And the court said nothing about the terms of service, but talked about get into the hands of an adversary or be geared towards getting into the hands of an adversary… or let me actually just read it… “While the mere showing of a voluntary disclosure to a third party will generally suffice to show waiver of the attorney-client privilege,” it should not itself suffice, “it should not suffice in itself for a waiver of the work product privilege.” And it says that ChatGPT and other generative AI programs are tools, not persons. And even if they have administrators somewhere in the background, they're tools and not persons. So as plaintiff noted in her response, defendant's motion asks the court to compel plaintiff's internal analysis and mental impressions, her thought process, rather than any existing documents or evidence, which is not discoverable as a matter of law. So, the court then found that it was intrusive and said no.
Scott Caravello: Right, and so take all of that together and it makes you think, wait a minute, the defendant in Heppner was a party—like we've been talking about this entire time—why was the fact that he used Claude on his own initiative fatal to his work product claims? Right, look at 26(b)(3)(A)…again… it talks about parties. I got... Well, Judge Rakoff had distinguished cases where the materials created by a party were protected.
Katherine Forrest: Hey, I've got you saying it! I've got you saying it!
Scott Caravello: …It talks about parties. Well, Judge Rakoff had distinguished cases where the materials created by a party were protected explaining, like I mentioned before, that the core purpose of the work product doctrine is still to protect the attorney's mental impressions. But maybe the outcome would have been different if the defendant's AI use had been directed by counsel, or if, as Judge Rakoff noted, it actually reflected counsel's legal strategy. So it just drives home the point across these two cases that if you just change the facts a bit, maybe you get a different outcome.
Katherine Forrest: Right, and I think that's absolutely correct. The lesson I think you've really got to take from the Heppner case is twofold. One is you want to understand that things to be most protected should be at the direction of an attorney who is directing a party, an agent, the indemnitor, the surety, all of the things that are in the parenthetical of 26(b)(3)(A). And also that you should be doing it with the kind of confidentiality protections you can get from an enterprise version. As we've always said to our clients again and again, don't put things that you expect to be confidential inside of a public tool. That's why shadow AI can be dangerous because you don't get the confidentiality protections that you get with an enterprise tool. But let me just say one final word on this pro se point, which is that the court in Michigan in the Warner v. Gilbarco case didn't say anything specifically suggesting that the plaintiff's lack of representation affected the work product determination. It's not as if the court said, hey, and because this individual is pro se, we're now going to rely on 26(b)(3)(A) and the word “party.” The court instead positions 26(b)(3)(A) as just the rule and reads into the rule that a party, presumably whether represented or not under the court's rationale as the court said it–at least it didn't say anything differently–would be subject to the same kind of protection.
Scott Caravello: And then if I can just make one final point as we wrap this up and take more of an AI lens on this whole thing too, and not just talking about the privilege rules, I think what's really, really interesting is each judge's characterization of AI and how that affected the outcome and how maybe we see courts adopt one framework or the other when considering similar issues going forward. Is the AI a stand-in for a human? Or is it just a tool? Because that was important to both rulings in a very impactful way. And so we're going to see how that plays out in the courts going forward.
Katherine Forrest: Yeah, we're really going to see many, many more cases on this. There have already been some other discovery rulings in the OpenAI class actions that are pending in the Southern District of New York. Also, not quite on the same points that we've got here, but we'll be seeing a lot more in this space and bring it to our listeners in later episodes. That's all we've got time for today. Scott, you've got to go get yourself a cup of coffee. I'm Katherine Forrest.
Scott Caravello: Absolutely. I'm Scott Caravello. Don't forget to like and subscribe.
Katherine Forrest: All right, take care.
