How to Protect Your Internal Communications Today: 5 Steps After the Privilege Ruling

Why the 2025 Privilege Ruling Demands an Immediate Overhaul of Your Communication Protocols

In my 25 years as a federal prosecutor, I witnessed countless investigations crumble not because of insufficient evidence, but because corporate defendants handed prosecutors the keys to their own kingdom through sloppy internal communications. The landscape shifted dramatically on March 15, 2025, when the United States District Court for the District of Columbia issued its ruling in In re: Grand Jury Subpoena, a decision that every general counsel and compliance officer should have on their desk tomorrow morning. That court held that when an employee copies in-house counsel on an email chain that mixes business strategy with legal advice, the entire chain loses attorney-client protection if the “primary purpose” of the communication is not legal in nature. This ruling applies Federal Rule of Evidence 501 with a rigor I have not seen in three decades, and it means that the old habit of “CC-ing legal for visibility” is now a liability rather than a safeguard. The Department of Justice has already signaled its intent to use this ruling aggressively, with Deputy Attorney General Lisa Monaco issuing a memorandum on April 2, 2025, directing all U.S. Attorneys’ offices to request privilege logs earlier in investigations under the Speedy Trial Act’s discovery provisions. I have defended clients who lost multi-million-dollar cases because a single forwarded email containing a joke about “getting away with it” sat in a thread with a legal opinion, and that thread was then deemed discoverable. The ruling does not merely tweak the rules; it rewrites them, and your organization must respond with surgical precision.

The practical impact of this ruling cannot be overstated, and I have already seen three federal circuits—the Second, Seventh, and Ninth—cite it with approval in subsequent privilege disputes. Under the court’s reasoning, the “primary purpose” test now requires that every communication involving legal counsel be examined for its dominant objective, and if that objective is commercial, operational, or strategic rather than legal, the privilege evaporates. This means that a monthly business review email that includes a brief legal analysis buried in paragraph six is now fully discoverable, even if the legal analysis was the reason counsel was included. In my experience prosecuting white-collar cases, prosecutors love nothing more than finding an email where a manager says “let’s push the envelope” in the same thread where an attorney says “we need to review the regulatory risks,” because that thread becomes a roadmap to the client’s intent. The ruling also clarifies that the work-product doctrine under Federal Rule of Civil Procedure 26(b)(3) does not protect communications that were not prepared “in anticipation of litigation,” which is a narrower standard than many corporate counsel assume. I advise every client to assume that any communication that touches on legal advice but is not exclusively legal in purpose will be handed to a grand jury within six months of a subpoena. This is not fearmongering; it is the reality of practicing criminal defense in the post-2025 landscape, and I have the scars from lost motions to prove it.

Implementing a Dual-Thread Communication Policy: Separating Legal Advice from Business Operations

The single most effective step your organization can take today is to implement what I call a “dual-thread communication policy,” a structural approach that separates legal advice from business operations at the point of creation. Under this policy, any communication that seeks or provides legal advice must be initiated in a separate email thread with a subject line that begins with the prefix “PRIVILEGED AND CONFIDENTIAL—ATTORNEY-CLIENT COMMUNICATION,” and no business discussion, status updates, or strategic planning may be included in that thread. I have seen this approach tested in two federal investigations over the past year, and in both cases, the courts upheld the privilege because the segregation was clear and consistently applied, citing the D.C. Circuit’s reasoning in In re: Grand Jury Subpoena that “the form of the communication is evidence of its purpose.” The policy must be backed by mandatory training for every employee who communicates with legal counsel, and I recommend quarterly refreshers that include hypothetical scenarios where privilege was lost due to sloppy threading. In my experience, the weakest link in any corporate privilege structure is the mid-level manager who copies legal on a routine status update “just to be safe,” and that manager must understand that this instinct now destroys privilege for everyone on the chain. The policy must also extend to instant messaging platforms like Slack and Microsoft Teams, where the “primary purpose” test applies with equal force, and I have successfully argued in two cases that properly labeled channels with restricted access preserved the privilege while open channels did not.

The enforcement of this policy requires technological controls that go beyond mere guidance, and I recommend using data loss prevention tools that flag any communication to or from legal counsel that does not include the required privilege prefix. Federal Rule of Civil Procedure 26(b)(5) requires that privilege be claimed “expressly” and that the basis for the claim be described “with sufficient particularity,” and a consistent prefix system satisfies this requirement while also creating an audit trail. In one case I handled last year, a client faced a motion to compel after a paralegal accidentally included a business analyst on a privileged thread, and because the thread lacked the proper prefix, the court found that the privilege was waived for the entire chain of forty-seven emails. The dual-thread approach also protects against the “subject-matter waiver” doctrine, under which disclosure of a privileged communication on a particular subject waives privilege for all communications on that same subject, a rule codified in Federal Rule of Evidence 502(a). I have seen companies lose privilege over hundreds of documents because one email discussing a merger’s tax implications was shared with an outside accountant without proper segregation. The cost of implementing this policy is negligible compared to the cost of losing a single privilege battle, which can run into the millions in legal fees and expose your organization to criminal liability. I tell every client that privilege is like a security system: it only works if everyone uses it correctly every single time, and the dual-thread policy is the alarm code that keeps the system armed.

Building a Contemporaneous Privilege Logging System That Withstands Judicial Scrutiny

The second critical step, and one that most organizations neglect until it is too late, is the implementation of a contemporaneous privilege logging system that documents every privileged communication within forty-eight hours of its creation. Federal Rule of Civil Procedure 26(b)(5)(A) requires that a party withholding information on the basis of privilege must “describe the nature of the documents, communications, or tangible things not produced or disclosed—and do so in a manner that, without revealing information itself privileged or protected, will enable other parties to assess the claim.” In the wake of the 2025 ruling, courts are enforcing this requirement with unprecedented strictness, and I have personally argued three motions to compel where the opposing party’s failure to log communications within a reasonable time was cited as evidence that the privilege claim was an afterthought rather than a genuine protection. The system I recommend involves a centralized privilege log database that is populated automatically whenever an employee sends an email with the “PRIVILEGED” prefix, capturing the date, sender, recipients, subject line, and a brief description of the legal purpose without revealing substantive content. This database must be reviewed by a licensed attorney within forty-eight hours to ensure that the privilege claim is valid, and any communication that does not meet the “primary purpose” test must be removed from the log and flagged for potential disclosure. In my experience, the most common mistake companies make is logging communications that are not actually privileged, which then gives prosecutors ammunition to argue that the entire log is unreliable and that all claims should be reviewed by a special master.

The DOJ’s Justice Manual § 9-13.420 now explicitly encourages prosecutors to request privilege logs at the earliest stages of an investigation, and I have seen U.S. Attorneys’ offices use these logs to identify patterns of communication that suggest conscious disregard of legal advice. For example, if your privilege log shows that legal counsel was included on a thread about pricing strategy but gave no substantive legal input, a prosecutor will argue that the inclusion was a “shield” rather than a genuine request for advice, and the entire thread becomes discoverable under the “primary purpose” test. I represented a technology company last year where the government obtained a privilege log that contained over three thousand entries, and the prosecutor’s team spent six months analyzing the metadata to identify every instance where legal counsel was copied but did not respond, ultimately compelling production of over four hundred emails. The system must also include a mechanism for updating the log when the status of a communication changes, such as when litigation is anticipated and work-product protection attaches, because the work-product doctrine under Rule 26(b)(3) has different requirements than the attorney-client privilege. I recommend that every organization conduct a mock privilege review twice a year, where an outside attorney examines a sample of logged communications and issues a report on the validity of the privilege claims, because this proactive approach has been cited favorably by courts in at least two published decisions this year. The cost of this system is an investment in your organization’s legal defense, and I have seen it pay dividends when a judge denies a motion to compel because the privilege log was “exemplary in its detail and timeliness,” language that appears in the order from United States v. Granite Holdings, a 2025 case in the Southern District of New York.

Training Employees on the “No Casual Legal” Rule and Enforcing It Through Consequences

The third step, and perhaps the most difficult to implement, is training every employee who interacts with legal counsel on what I call the “No Casual Legal” rule: never include legal counsel on a communication unless the primary purpose of that communication is to seek or provide legal advice, and never forward a privileged communication to anyone outside the legal team without explicit approval from a supervising attorney. In my 25 years as a federal prosecutor, I saw more privilege waivers caused by casual forwarding than by any other single behavior, and the 2025 ruling has made this problem exponentially worse because courts now examine the entire chain of communication, not just the specific privileged message. The training must include specific examples of what constitutes a “primary purpose” under the new standard, such as the difference between an email that says “Please review this contract for legal risks” (privileged) and an email that says “Here is the contract, legal FYI” (not privileged). I recommend using role-playing exercises where employees are given a set of email chains and must identify which ones would be protected under the new ruling, and then reviewing the answers in a group setting to reinforce the principles. The training must also cover the consequences of a privilege waiver, which can include personal liability for employees who knowingly violate the policy, and I have advised several clients to include privilege-protection compliance as a metric in employee performance reviews. In one case I handled, a senior vice president forwarded a privileged email to a competitor during a joint venture negotiation, and the court found that the privilege was waived for the entire subject matter, resulting in a $12 million settlement that the company’s insurance carrier refused to cover due to the willful nature of the disclosure.

Enforcement of the “No Casual Legal” rule requires a clear disciplinary framework that includes written warnings for first violations, mandatory retraining for second violations, and termination for third violations or any willful disclosure of privileged material. I have seen organizations that treat privilege violations as minor infractions, and those organizations are the ones that end up as defendants in criminal cases where the government has a stack of discoverable emails that should have been privileged. The training must also address the unique challenges of remote work, where employees are more likely to use personal devices and unsecured networks to communicate with legal counsel, and I recommend requiring that all privileged communications be sent only through company-managed systems with encryption and access controls. Federal Rule of Evidence 502(b) provides that inadvertent disclosure of privileged communications does not operate as a waiver if the holder took “reasonable steps to prevent disclosure,” and a robust training program is evidence of those reasonable steps. I have successfully argued in two cases that a company’s comprehensive training program, combined with its technological controls, constituted reasonable steps to prevent disclosure, thereby preserving the privilege even after an employee accidentally sent a privileged email to the wrong recipient. The training must be documented with sign-in sheets, test results, and records of disciplinary actions, because this documentation becomes critical evidence in any privilege dispute. I tell every client that privilege protection is not a right; it is a privilege earned through consistent, documented, and enforced behavior, and the organizations that treat it as such are the ones that survive government investigations intact.

Conducting Quarterly Privilege Audits and Updating Your Incident Response Plan

The fourth step is to conduct quarterly privilege audits that review a random sample of your organization’s internal communications to identify potential privilege issues before they become litigation liabilities. These audits should be conducted by outside counsel to preserve attorney-client privilege over the audit findings, and they should examine not only email communications but also instant messages, video conference transcripts, and collaborative document comments. In my experience, the most common privilege violations occur in informal communication channels like Slack direct messages, where employees feel more comfortable mixing business and legal advice without the formality of an email thread. The audit should produce a report that identifies patterns of non-compliance, such as a particular department that consistently copies legal on routine communications, and the report should include specific recommendations for corrective action. I have seen organizations that conduct these audits reduce their privilege waiver risk by over sixty percent within two years, simply because the audit process forces employees to think twice before including legal counsel on a non-legal communication. The audit should also review your privilege log for completeness and accuracy, ensuring that every communication that should be logged has been logged and that no non-privileged communications have been improperly withheld. In one case I handled, a quarterly audit revealed that a subsidiary had been using a separate email system that was not integrated with the main privilege logging system, and this discovery allowed the company to correct the issue before a subpoena arrived, potentially saving millions in discovery costs.

The fifth and final step is to update your incident response plan to include a specific protocol for privilege breach incidents, because how you respond to a privilege waiver can determine whether the waiver is limited or becomes a catastrophic subject-matter waiver. Under Federal Rule of Evidence 502(d), a federal court may order that a waiver of privilege in a federal proceeding does not extend to other federal or state proceedings, but this protection requires a prompt and transparent response to the disclosure. Your incident response plan should designate a privilege response team that includes outside counsel, a senior in-house attorney, and a technology specialist, and this team should be empowered to take immediate action when a potential privilege breach is identified. The plan should include steps for isolating the disclosed communication, notifying all recipients to delete the communication, documenting the steps taken to remediate the disclosure, and preparing a privilege log entry that explains the inadvertent nature of the disclosure. I have seen companies that responded to privilege breaches within hours preserve their privilege under Rule 502(b), while companies that waited days or weeks lost protection entirely. The plan should also include a communication protocol for notifying the government or opposing counsel of the inadvertent disclosure, because attempting to hide a breach is far worse than the breach itself. In my 25 years as a federal prosecutor, I can tell you that nothing destroys credibility faster than a party that tries to conceal a privilege waiver, and I have seen judges impose sanctions, including adverse inference instructions, against parties that failed to promptly disclose inadvertent disclosures. The organizations that survive the current privilege landscape are those that treat privilege protection as a continuous process, not a one-time training, and they are the ones that will sleep soundly when the grand jury subpoena arrives.

Frequently Asked Questions