In its June 15, 2021, letter, Defendant provides the facts which give rise to this motion. Rutter's received two Carbon Black Defense alerts on May 29, 2019, which “detail[ed] the execution of suspicious scripts and indications of the use of potentially compromised credentials.” (Def's 6/15 Letter, at 1). On that same day, Defendant hired outside counsel, BakerHostetler, “to advise Rutter's on any potential notification obligations.” (Def's 6/15 Letter, at 1). The next day, BakerHostetler hired Kroll “to conduct forensic analyses on Rutter's card environment and determine the character and scope of the incident.” (Def's 6/15 Letter, at 1). Kroll gathered and analyzed “pertinent facts,” including forensic images and “virtual machine snapshots of a sample of potentially affected in-store site controllers.” (Def's 6/15 Letter, at 1-2). Defendant and BakerHostetler understood Kroll's work to be privileged. (Def's 6/15 Letter, at 2). Plaintiffs learned about this investigation during the Fed. R. Civ. P. 30(b)(6) deposition of Defendant's Vice President of Technology, Bernard Frazer. (Plfs' 6/15 Letter). Plaintiffs note that numerous meetings took place between Kroll representatives and Defendant, and that Defendant paid Kroll directly. (Plfs' 6/15 Letter). Kroll's investigation took approximately two months, concluding in July 2019, with Kroll providing Defendant a written report of its findings at the end of the investigation. (Plfs' 6/15 Letter). Plaintiffs now seek production of this written report and related communications between Kroll and Defendant. (Plfs' 6/15 Letter, at 1)

A. THE WORK PRODUCT DOCTRINE

Defendant asserts that the report prepared by Kroll after Defendant was alerted of possible fraudulent activity (the “Kroll Report”) is protected from discovery by the work product doctrine. (Def's 6/15 Letter). The work product doctrine serves to “promote[ ] the adversary system directly by protecting the confidentiality of papers prepared by or on behalf of attorneys in anticipation of litigation. Protecting attorneys' work product promotes the adversary system by enabling attorneys to prepare cases without fear that their work product will be used against their clients.” Westinghouse Elec. Corp. v. Republic of Philippines, 951 F.2d 1414, 1428 (3d Cir. 1991). The work product doctrine directly promotes the adversary system, whereas the attorney-client privilege serves to directly promote the attorney-client relationship. Westinghouse Elec. Corp, 951 F.2d at 1428. The Supreme Court of the United States has said that the work product doctrine “shelters the mental processes of the attorney, providing a privileged area within which he can analyze and prepare his client's case.” United States v. Nobles, 422 U.S. 225, 238 & n. 11 (1975).

*2 The doctrine applies to “documents and tangible things ... prepared in anticipation of litigation or for trial by or for another party or by or for that other party's representative (including the other party's attorney, consultant, surety, indemnitor, insurer, or agent) ...” In re Cendent Corp. Securities Litigation, 343 F.3d 658, 662 (3d Cir. 2003) (quoting Fed. R. Civ. P. 26(b)(3)). Rule 26(b)(3) establishes two types of work product: first, general documents and tangible things that are prepared in anticipation of litigation, and second, work product that consists of “mental impressions, conclusions, opinion, or legal theories of an attorney or other representative of a party concerning the litigation.” Cendent Corp, 343 F.3d at 663 (quoting Fed. R. Civ. P. 26(b)(3)). The party seeking the protection of the work product doctrine has the burden of proving that the doctrine applies. Conoco, Inc. v. U.S. Dep't of Justice, 687 F.2d 724, 730 (3d Cir. 1982).

For the work product doctrine to apply, the document must be prepared “in anticipation of litigation.” Fed. R. Civ. P. 26(b)(3). A document is prepared in anticipation of litigation if “in light of the nature of the document and the factual situation of the particular case, the document can fairly be said to have been prepared or obtained because of the prospect of litigation.” Martin v. Bally's Park Place Hotel & Casino, 983 F.2d 1252, 1258 (3d Cir. 1993) (quoting United States v. Rockwell Intern., 897 F.2d 1255, 1266 (3d Cir. 1990)). Aiding in “identifiable” or “impending” litigation must have been the “primary motivating purpose behind the creation of the document.” United States v. Rockwell Intern., 897 F.2d 1255, 1266 (3d Cir. 1990); Leonen v. Johns-Manville, 135 F.R.D. 94, 97 (D.N.J. 1990). To determine whether “the prospect of litigation” is the purpose behind the document, the initial inquiry is into whether the party which ordered or prepared the document had a “unilateral belief” that litigation would result. Martin, 983 F.2d at 1260. Second, the anticipation of litigation must be objectively reasonable. Martin, 983 F.2d at 1260.[1]

It is clear from the contract between Kroll and Defendant that the primary motivating purpose behind the Kroll Report was not to prepare for the prospect of litigation. Included in the contract is a “statement of work” (SOW) which includes a description of services. (Def's 6/15 Letter, at 14). The following is included in the “Description of Services” section of the SOW: “The overall purpose of this investigation will be to determine whether unauthorized activity within the Rutter's systems environment resulted in the compromise of sensitive data, and to determine the scope of such a compromise if it occurred.” (Def's 6/15 Letter, at 14). This language demonstrates that Defendant did not have a unilateral belief that litigation would result at the time it requested the Kroll Report. See Martin, 983 F.2d at 1260. The purpose of the investigation was to determine whether data was compromised, and the scope of such compromise if it occurred. (Def's 6/15 Letter, at 14). Without knowing whether or not a data breach had occurred, Defendant cannot be said to have unilaterally believed that litigation would result. (Def's 6/15 Letter, at 14); see Martin, 983 F.2d at 1260.

Furthermore, in its corporate deposition, Defendant stated that litigation was not contemplated at the time the Kroll Report was prepared. (Plfs' 6/15 Letter, at 17). Rutter's' corporate designee, Bernard Frazer, is the individual who signed the agreement with Kroll to perform the investigation at issue and write the Kroll Report. (Def's 6/15 Letter, at 9-16; Plfs' 6/15 Letter, at 1). Frazer testified that he was not “contemplating” forthcoming lawsuits as a result of the data breach at the time Kroll was performing its work and that he was unaware of anyone else at Rutter's contemplating such lawsuits. (Plfs' 6/15 Letter, at 17). According to Defendant, “Kroll would have prepared – done this work and prepared its incident response investigation regardless of whether or not lawsuits were filed six months later[.]” (Plfs' 6/15 Letter, at 17-18). As such, it cannot be said that the “primary motivating factor” behind the creation of the Kroll Report was to aid in identifiable or impending litigation. See Rockwell Intern., 897 F.2d at 1266 (holding that for the work product doctrine to apply, litigation must have been the “primary motivating purpose behind the creation of the document”); Leonen, 135 F.R.D. at 97 (D.N.J. 1990) (holding that there must have ben an identifiable specific claim or impending litigation when the materials were prepared).

*3 Defendant cites In re Experian Data Breach Litig., No. SACV1501592AGDFMX, 2017 WL 4325583, at *2 (C.D. Cal. May 18, 2017) in support of its position that the Kroll Report was prepared in anticipation of litigation. (Def's 6/15 Letter, at 3-4). In Experian, the investigative report was provided to Experian's outside litigation counsel, which then provided it to Experian's in-house counsel, and was not provided to Experian's Incident Response Team. Experian, 2017 WL 4325583, at *2. Here, Kroll provided its report to Defendant when it was completed and there is no evidence that it was provided first to BakerHostetler. (Plfs' 6/15 Letter, at 14, 16) (Defendant testifying that Kroll's work concluded towards end of July 2019 and that the Kroll Report was delivered to Defendant around July of 2019). Kroll was to “work alongside Rutter's IT personnel to identify and remediate any potential vulnerabilities.” (Def's 6/15 Letter, at 14) (emphasis added). In Experian, the report's legal nature was supported by declarations. Experian, 2017 WL 4325583, at *2. Unlike the declarations in Experian, Rutter's' corporate designee testified that he was unaware of anyone at Rutter's contemplating a lawsuit at the time the Kroll Report was compiled. (Plfs' 6/15 Letter, at 17).[2] Similarly, the report in In re Target Corp. Customer Data Sec. Breach Litig., MDL No. 14-2522, 2015 WL 6777384 (D. Minn. Oct. 23, 2015) was compiled after litigation was already pending and more was reasonably expected to follow. Target, 2015 WL 6777384, at *3.

For the foregoing reasons, production of the Kroll Report and related communication between Kroll and Defendant are not precluded by the work-product doctrine.

B. THE ATTORNEY-CLIENT PRIVILEGE

Defendant asserts that the Kroll Report and related communications between Kroll and Defendant are protected by the attorney-client privilege. (Def's 6/15 Letter, at 2). This privilege attaches to “(1) a communication (2) made between privileged persons (3) in confidence (4) for the purpose of obtaining or providing legal assistance for the client.” In re Teleglobe Commc'ns Corp., 493 F.3d 345, 359 (3d Cir. 2007) (internal quotation marks omitted), as amended (Oct. 12, 2007). “ ‘Privileged persons’ include the client, the attorney(s), and any of their agents that help facilitate attorney-client communications or the legal representation.” Teleglobe, 493 F.3d at 359 (citing Restatement (3d) Lawyers § 70).

Because “the attorney-client privilege obstructs the truth-finding process, it is construed narrowly.” Westinghouse Elec. Corp. v. Republic of the Philippines, 951 F.2d 1414, 1423 (3d Cir. 1991). “A communication is only privileged if it is made ‘in confidence.’ ” Teleglobe, 493 F.3d at 361 (citing Restatement (3d) Lawyers § 68). Where “persons other than the client, its attorney, or their agents are present, the communication is not made in confidence, and the privilege does not attach.” Teleglobe, 493 F.3d at 361. However, “[a]s a general matter, the privilege is not destroyed when a person other than the lawyer is present at a conversation between an attorney and his or her client if that person is needed to make the conference possible or to assist the attorney in providing legal services.” Miller v. Haulmark Transp. Sys., 104 F.R.D. 442, 445 (E.D. Pa. 1984) (privilege not waived by presence of insurance agent who arranged coverage and aided in preparation of answer); see also Quagliarello v. Dewees, 802 F.Supp.2d 620, 632-33 (E.D. Pa. 2011) (finding no waiver of attorney-client privilege where 18-year-old student-plaintiff consulted with her lawyer in the presence of her parents and a neighbor who facilitated her obtaining legal counsel); Harkobusic v. Gen. Am. Transp. Corp., 31 F.R.D. 264, 266 (W.D. Pa. 1962) (holding attorney-client privilege applied to communications between client's brother-in-law and various attorneys where brother-in-law was acting as client's agent in seeking legal advice). “These exceptions are consistent with the goal underlying the privilege because [this] type of disclosure is sometimes necessary for the client to obtain informed legal advice.” Westinghouse, 951 F.2d at 1424.

*4 A communication may only be privileged if its primary purpose is to gain or provide legal assistance. Kramer v. Raymond Corp., 1992 WL 122856, at *1 (E.D. Pa. 1992). The attorney or agent must be “ ‘acting as a lawyer’ – giving advice with respect to the legal implications of a proposed course of conduct.” Hercules Inc. v. Exxon Corp., 434 F.Supp. 136, 147 (D. Del. 1977). For the assistance to be ‘legal’ in nature, the lawyer must guide future conduct by interpreting and applying legal principles to specific facts. PAUL R. RICE, ATTORNEY-CLIENT PRIVILEGE IN THE UNITED STATES. § 7:10 (2019). The primary purpose of each communication deemed privileged must be to gain or provide legal assistance. Kramer, 1992 WL 122856, at *1. “Merely because a legal issue can be identified that relates to on-going communications does not justify shielding them from discovery.” In re Vioxx Products Liability Litigation, 501 F. Supp. 2d 789, 798 (E.D. La. 2007). Importantly, the attorney-client privilege does not protect the communication of facts. Upjohn Co. v. United States, 449 U.S. 383, 395-96 (1981) (“The client cannot be compelled to answer the question, ‘what did you say or write to the attorney?’ but may not refuse to disclose any relevant fact within his knowledge merely because he incorporated a statement of such fact into his communication to his attorney.”); U.S. Fidelity & Guar. Co. v. Barron Industries, Inc., 809 F.Supp. 355, 364 (M.D. Pa. 1992) (“The privilege simply does not attach to a discussion of the facts, no matter how extensive or involved the discussion may become.”).

Here, Defendant does not establish that the Kroll Report and related communications involved “presenting opinions and setting forth ... tactics” rather than discussing facts. See Fidelity & Guar. Co., 809 F.Supp. at 364. The SOW shows that Kroll was employed to collect data from Defendant's equipment, to monitor Defendant's equipment, to determine whether Defendant's equipment was compromised and to what extent, and to “work alongside Rutter's IT personnel to identify and remediate any potential vulnerabilities.” (Def's 6/15 Letter, at 14). Only one portion of this description of services is not inherently factual: Kroll's role in working with Rutter's IT personnel to identify and remediate potential vulnerabilities. (Def's 6/15 Letter, at 14). However, this service cannot be deemed to be gaining or providing legal assistance, as neither Kroll nor Rutter's IT personnel are professionals in the field of law and this service involves those two entities working alongside each other with no mention of attorney involvement. (Def's 6/15 Letter, at 14); see Kramer, 1992 WL 122856, at *1.

For the foregoing reasons, Defendant does not carry its burden of establishing that the Kroll Report and related communications between Kroll and Defendant had a primary purpose of providing or obtaining legal assistance for Defendant. See Teleglobe, 493 F.3d at 359. The record shows that the report and communications were either factual in nature or, where advice and tactics were involved, did not include legal input. (Def's 6/15 Letter, at 14); see Teleglobe, 493 F.3d at 359. The attorney-client privilege does not apply to the Kroll Report and related communications between Kroll and Defendant.

C. CONCLUSION

For the foregoing reasons, Plaintiffs' motion to compel production of the Kroll report and related communications between Kroll and Defendant is granted, and Defendant is to produce the same to Plaintiffs within 14 days of the date of this Order.

“A reasonable anticipation of litigation is not established by the mere fact litigation occurred, the party consulted or retained an attorney, undertook an investigation, or engaged in negotiations.” Faloney v. Wachovia Bank, N.A., 254 F.R.D. 204, 214 (E.D. Pa. 2008).

Frazer, Vice President of Technology at Rutter's, declares that the Kroll Report would have been prepared in a substantially different form, and may not have been necessary, had the threat of litigation or the legal obligation to notify anyone potentially affected by the incident not existed. (Def's 6/15 Letter, at 7). Litigation, alone, must form the basis of “work product,” so this declaration – in which Frazer speaks to Rutter's' notification obligations as a potential basis for the report – does not establish the report as work product. (Def's 6/15 Letter, at 7); see Fed. R. Civ. P. 26(b)(3); see also Litigation, Black's Law Dictionary 11th ed. 2019) (“The process of carrying on a lawsuit.”).