-: SJC-12946, Attorney General v. Facebook, Inc.
-: Great, okay,
Attorney Ellsworth.
-: Good morning, may it please the court.
In March, 2018,
facing actual and anticipated litigation arising
from the highly publicized Cambridge Analytica events,
Facebook did what every other company routinely does
in similar circumstances,
it hired outside legal counsel
to design and conduct an internal investigation.
As the superior court found,
the investigation was intended to gather the facts
needed to provide legal advice to Facebook
about litigation, compliance,
regulatory inquiries, and other legal risks.
None of this is contested.
And the law is clear
that attorney driven internal investigations like this
are routinely held by courts in the Commonwealth
and around the country,
to be protected by the attorney-client privilege,
as well as the attorney work product doctrine.
But the superior court found the privilege
didn't apply for two reasons.
First, because the information sought was factual in nature
and second,
because Facebook made public statements about the existence
of the investigation.
And the superior court found the work product doctrine
didn't apply simply because Facebook undertakes ongoing
enforcement efforts related to user privacy.
-: Miss Ellsworth, can I ask you a question
that deals with our standard of review?
Ellsworth: Yes
-: One of the key findings by the trial judge was
that this was business as usual, right?
Or not business as usual.
What do we do with his findings
and all of the subsidiary findings?
Is that a de novo review?
Or is he entitled to any discretion in that.
-: It's de novo, your honor.
And I'd point the court to the Comcast decision,
which notes both that questions of privilege
and work product are reviewed by this court de novo
and that in particular on a motion to compel like this one
where the superior court only considered
documentary evidence
to the extent that it's a mixed question of fact and law,
it is still reviewed on a de novo basis by this court.
So I don't think the superior courts factual findings
are entitled to any difference from this court.
-: Thank you.
-: On that, so may I ask you a question that could,
that you say it was an anticipation of litigation,
is that correct?
-: That's correct, your honor.
-: But yet it was part of an ongoing procedure.
-: Well the superior court made that finding.
I think it's an erroneous finding,
but I just back up and remind the court
that in the Comcast decision,
as well as the Alderman decision from the second circuit
that that decision relies on,
the fact that an investigation or a particular action
is both in anticipation of litigation
and may also serve some other business purpose
does not render that no longer subject
to the attorney work product doc.
-: Right, I'm just trying to think,
they could have hired attorneys
for this in anticipation of litigation,
but they also could have hired a different category
of people such as computer analysts
to develop the factual information.
Would that then render the factual information available
for discovery?
-: Well, let me respond in two ways.
I don't think that Facebook could have,
or would have hired anyone other than attorneys
to conduct an investigation of this scope.
Remember here,
the idea was to look and determine whether
in light of the revelations about violations
of Facebook policies and misuse of user data,
there were any other apps or developers
that had similarly slipped through the cracks, right?
The idea was to look back and assess legal risk.
So for that reason as the declaration of Ms. Chen,
which is upended to
on which the district court relied,
the superior court relied
that the manner in which Facebook chose to undertake this
was in fact to seek legal advice,
which is why the privilege applies
as well as the work product doctrine.
In response to your question,
as to whether if Facebook could have hired
non-legal individuals to carry out the same investigation,
as I said, it would be a different form,
but to the extent that those individuals would be acting
at the direction of counsel in anticipation of litigation.
Remember at this time,
litigation had already been filed against Facebook,
and there's an exhibit to that declaration
that lays it all out.
That to would qualify as anticipation of litigation
for purposes of the work product doctrine.
-: Can I ask you,
I think an issue that permeates the decision,
it's kinda like have your cake and eat it doctrine,
where there's an internal investigation
outside counsel,
and I get what you're saying about
anticipation of litigation,
but at the same time
we have the PR aspect of this
and the assurances that Facebook needs to give the public
to continue to use its product i.e.
that it's going to be secure.
So how do you address this cake and eat it issue?
-: Well, your honor,
I'd point the court to a few different things.
First of all,
the statements that the superior court referenced
and that the attorney general has referenced
in her briefing,
those are general public statements about the existence
of an investigation.
They certainly don't reveal any confidential communication
that's subject to the attorney client-privilege
and neither the superior court nor the attorney general
has suggested otherwise.
But the fact that an investigation
may also have a business purpose,
the PR purposes that your honor referred to
that does not mean that it can't also be an anticipation
of litigation.
I point the court to the Southern District of New York's
decision in the General Motors ignition-switch litigation.
There we have the CEO of General Motors
testifying before Congress,
providing information about the fact of this investigation
there's clearly a PR component to it,
but the SDNY held that that doesn't vitiate
the applicability of the attorney work product doctrine.
And again, in Comcast,
this court relied heavily on the second circuit decision
in Alderman,
which said to allow the fact that there may be dual purposes
to undermine the work product
would essentially swallow the doctrine in whole.
So I don't think the fact that those dual purposes
might exist,
those can't eliminate the protections
of the attorney work product doctrine.
-: I get that there's a dual purpose here,
and I've read the cases that you're talking about.
So I understand they seem to provide protection.
They also,
if there's a substantial need that kicked in here.
So let me back up for a second.
It's clear after Cambridge Analytica,
that there's been a huge data privacy breach,
and there may be some unfair
and deceptive practices out there.
How does the AG investigate this then?
Because you put a big black box
over all the information now by,
and I'm not saying you're doing anything
that others don't do,
that's illegitimate,
but you're basically by having an attorney driven process,
protecting all that data
but they have a substantial need to do their job,
which is to protect the public
from unfair and deceptive practices.
So how do they investigate then
if you've basically put a big black box over everything
through this attorney driven process?
-: So allow me to give two responses, please, Justice Kafker.
First of all,
the substantial need only comes in as you're well aware,
if it is fact for product
as opposed to opinion work product.
And I will argue this is opinion work product
but let me come back to that and address--
-: But before you do that,
so everything then falls into opinion work product
in your view,
then they can't do their job.
They have to be able to do their job
which is to protect the public.
You have to do your job,
which is to do your internal
but it has to give somewhere,
this information has to be accessible somehow.
So how does it work?
-: So the information can be accessible
to the attorney general.
What the attorney general can't do,
is what they've done here,
which is in these requests,
ask for precisely what the attorneys did,
ask for the fruits of that labor.
Instead-- -: Well,
how would they do that otherwise?
How do they get the information?
-: So they should set their own parameters.
They're interested in apps that have call it 500,000 users,
apps that--
-: And then they would send that request to you
and you would say, sure, here it is.
-: If the CID were issued in that manner,
potentially there would be burdened questions or--
-: Wonder why they didn't think of that.
-: Well, that's probably a question for Ms. Cable,
but they're certainly welcome to set their own parameters
and --
-: Well, isn't it because there's 500,000 apps.
And how do they do this in an efficient way then?
I understand we're not gonna asking you to be the lawyer
for the AG,
but you're trying to protect all this information
they have a right to it.
Like I thought, when I read some of your exhibits,
you said, oh, we've told the people who've been suspended.
So I thought that's pretty good,
that gets them started.
But then I realized you suspend people
for 18 different reasons
that don't necessarily have to do with the fact
that they've been bad actors.
So how do they get this information,
if this were another company
with the scope of this information,
I'm just trying to figure out
how this works in the real world.
-: So let me just back up for a second,
because to make sure that it's clear.
There have been huge volumes of information
produced to the attorney general
in response to these three CIDs,
data, documents,
briefings of the attorney general
including some of what's included in the appendix here,
the letters that are explaining what has been done.
The attorney general can take that information
and devise her own search criteria
and make requests in that manner
to the extent that she's interested in investigating
certain types of apps with certain types of permissions
based of-- -: But
we know what kind of apps she's interested in.
-: Well, the request that we're dealing with here
is not what they're driving at or what this CID drives at.
It uses the language of Facebook's internal investigation.
It asks for apps that based on Facebook's
investigative experience,
Facebook's outside counsel's investigative experience
are likely to pose substantial risk of stealing user data.
But when you--
-: This is not, this privilege can sometimes yield.
-: Well, the attorney client privilege, your honor,
does not yield, right?
Even in the face of the at-issue waiver doctrine,
the attorney--
-: What about when there's a factual basis
to support a reasonable belief
that there's a strong, strong public interest justifying
the disclosure.
-: Again, the fact that there might be a strong public
interest in a disclosure,
I'm not sure there is here,
but taking the hypothetical at its terms
that doesn't allow the attorney general to invade
the attorney client privilege.
Chapter 93A, section 6, expressly says in subpart 5,
that the CID cannot request information
that's protecting privilege.
-: How did they get to it?
Okay, so let me pose this.
Can they ask you for the absent of been suspended
for privacy breaches?
Or are you gonna respond, no,
because that will reveal which apps we discovered
have privacy breaches.
Let me use that hypothetical.
Can they ask for that information?
Please tell us all the apps that have been suspended
because they violated our policies
and gave out private people's information inappropriate.
-: I believe we've given them that information, your honor.
So there are apps that are banned
when they actually breach privacy.
Those apps have been banned,
and that information has been provided
to the attorney general and to any users
who may have been impacted.
This-- -: So the
attorney general now knows all of the apps
where there've been privacy breaches.
-: Where they've been banned because Facebook has determined
that there has been some breach
of either Facebook's policies
or the terms and conditions.
Then the larger list of apps
that have been suspended from the platform,
those are apps that as your honor
obviously knows from looking at the appendix,
either didn't respond to requests for information,
didn't cooperate,
or satisfactorily engaged with Facebook in its attempt
to ensure that user privacy
has not been compromised in this investigation.
But I think the information that, your honor
positive the attorney general has.
-: Can I just ask, just to clarify.
Are you saying that they have the information in that form
that those apps have been banned for privacy breaches?
Or is it a larger category
of apps for a number of reasons.
-: They've been informed of any app
that has been banned from the platform,
of which I think there's only a small number.
That the suspensions list that your honors have seen
is in the form that it's in the record
which simply provides the names of the apps.
-: But there are a hundred thousand others,
sorry, Justice Budd.
-: No, no, I just meant,
is there more than one reason to ban an app though?
-: Yes, there may well be
and Facebook has engaged with the attorney general's office
in a back and forth dialogue on some of the actions
that have been taken.
Again, we're not claiming privilege over actions
that the company has taken,
sending cease and desist letters,
sending requests for information banning,
all of that has been provided
to the attorney general's office.
-: But I guess what I'm trying to ask is,
is the reason for the ban also being,
if there's more than one reason to ban an app,
is the reason a particular app or category of apps
have been banned,
has that been disclosed?
-: Your honor, I think it may have been in part, right?
I wanna be careful to be accurate in my answer.
I'm not sure that every single reason has been given.
Because I do think that would start again to implicate
privilege and work product concerns,
in the same way that when one elects to file a complaint
against one particular actor and maybe not another actor,
I don't think that the recipient of your complaint
the defendant in a civil suit for example,
is entitled to get your underlying decision-making,
a client's underlying decision-making
as to why they brought suit against one person
and not another.
So I do think the privilege attaches
to some of the reasoning.
-: But I thought, like I read some of those exhibits.
You reported 22,000 apps had been suspended
and one of them,
but then when you start reading,
it looks like you've sort of figured out
that four or five actors have,
Cambridge Analytica and a couple of others,
but there are another 50,000,
they're a hundred thousand
that are still under investigation, right?
Do they get anything useful from what you're doing?
Or as Chief Justice Budd just points out,
you're telling them people have been suspended,
but there's so many different ways that you can be suspended
and the information doesn't provide any specifics
of who really are the bad actors out there.
-: Well, let me parse the question a little bit,
whether the information that we're providing
or whether the information that's being withheld
on the basis of privilege or work product
is useful is I think a different question.
It's up to the attorney general to determine
what type of investigations she wants to undertake.
-: We know what kind she wants to take,
but you've protected so much information through the ADI
that it's very difficult for them to get useful information
have you.
It appears based on the exhibits I read,
but I haven't read the whole record yet.
And I know it's been the more--
-: And again--
-: Can I ask a question?
I know there's a multi-district litigation in California.
Has discovery proceeded in that multi-district litigation
in California,
or are they at the same impasse that we are here?
-: They have requested
that multi-district litigation has also requested
something similar to what the attorney general
has requested and it has not been provided.
it's being withheld on the same basis
of privilege and work product
as was withheld from the attorney general here.
Elspeth: Where's that in the process in court?
-: The court has not,
I believe there's sort of a discussion ongoing
with the court and the parties about the fact
of the privilege claim that Facebook is making there.
It's not been teed up for the court to make a decision
on a motion to compel.
-: So that's not,
we're not gonna get an imminent decision
out of the federal court on that.
-: No, I believe your honor,
they may well be waiting for this court.
-: Now, counsel, can you tell me,
is there any analogy to be made here
with the tobacco litigation?
-: I don't think so, your honor.
Again, what I would submit to the court is that there are,
there's a manner for the attorney general to get
much of the information
that she is seeking to obtain
by simply trying to piggyback off the investigation
that Facebook's counsel has done.
-: No, that seems what she's trying to do
by asking you for what the fact results, right?
-: Well, what she's asking for,
is the product of counsel's attorney decision making
and assessment of risks,
such that the five contested requests
are requests that asked for the categorization
that Facebook's counsel has undertaken
to determine whether a particular app or developer
presents legal risks to Facebook in the same manner
that Aleksandr Kogan presented legal risks
to Facebook, right?
What the attorney general is seeking
are counsel's risk categorizations and assessments.
That's not information
that she's entitled to seek under chapter 93A
and it's information--
-: Can I ask you a question about that?
Wouldn't any app or list of apps
that Facebook came up with under this investigation
fall within that category?
Because to get into the category,
there has to be a risk.
-: That's right.
Because it's attorney conducted investigation
in order to assess legal risks.
The superior court found that.
The Chen declaration sets that out.
These are the types of investigations that companies
of Facebook size undertake when of this magnitude
has been uncovered.
It's both not unusual
and I think it's an appropriate application of the privilege
as all the federal courts that we cited have found.
-: Can I ask you a question about the attorney client
privilege in this, where to draw the line,
as far as when a company touts its investigation source
to lose the privilege?
I get that routinely companies say,
we're gonna take our hard look at this,
we're engaged in private counsel.
We read in the Globe constantly,
a private school has a scandal and they hire counsel,
so we know we're gonna assure people
it's being taken care of.
And there's a whole bunch of lawyers
who brought an amicus brief
who want us to respect that, include I assume your firm.
But where does that line get crossed?
So as to lose the privilege.
-: So the line is crossed when privileged communication,
an actual confidential communication is put at issue
in a litigation,
that's the Darius vs City of Boston case.
So it is not enough that public statements have been made
that describe the fact of an investigation,
or even some details about what the investigation
may be looking at,
what this court has found routinely
is that first of all,
the at-issue privilege is only
when something's been injected as a claim or defense
in a litigation,
which is not the case here.
We haven't injected ADI into any sort of ongoing litigation.
-: Well, how could you, if nobody knows what it is,
they can't really bring any litigation, can they?
-: So, again, first of all,
there's a lot of litigation
that has been brought against Facebook, right?
A huge number of shareholders, derivative consumer actions,
so other AGs have--
-: But I mean about this particular kinda thing.
-: And again, looking at the attorney General's CID,
the subject of her investigation is not Facebook's app
developer investigation,
the subject of the investigation is whether there are apps
or developers that have violated user privacy.
So it's not that the CID has defined
some statement Facebook made about ADI
as being something that she's looking into.
This is a manner in which she's trying to obtain information
for her investigation.
And again, there are other ways that she can get it.
-: But feel free to finish my question
about the tout line.
-: So again, this is not been put at issue by Facebook
in any particular litigation.
The superior court relied on in re Grand Jury investigation.
I'm sure the court has read the case again.
The privilege was found not to exist at all,
because there was no expectation of confidentiality
because of the chapter 51A mandatory reporting
that are assigned to investigations of abuse.
So the paragraph in re Grand Jury
about the fact that the private school there
had potentially touted its investigation,
first of all, it's dicta.
But second of all,
it's not what Facebook has done here.
Facebook has not tried to use this as a reason
why the attorney general shouldn't investigate
or why a litigant shouldn't obtain relief.
It's something Facebook is doing to assess
its own legal risk,
to determine whether it should be bringing
other affirmative litigation,
which in fact, it has done
arising out of the investigation.
-: But does it, sorry, Justice Gaziano are you done?
-: Am done.
-: So, given the breadth of your interpretation
of the work product doctrine,
are you really requiring the AG to basically do its own
ADI investigation from day one
with the raw materials
that were available before Cambridge Analytica went public
but everything afterwards,
you've, again, put it under this big black box
that we can't even get a look at.
So don't they have to basically recreate
the ADI without the benefit of anything
that happened after the Cambridge Analytica information
became public.
Isn't that what you're asking them to do?
-: They do have to do their own investigation
but that's the nature of the work product doctrine.
It applies just as equally to the AG,
as it does to private litigants.
-: Everything after Cambridge Analytica
is now protected in your view
because you developed the process for the fix.
You developed the protocol and everything else,
but they have to be able to investigate this
'cause they have a duty to protect the public
from unfair and deceptive acts.
And even your client has recognized
their unfair and deceptive backs out there.
But I don't know how they do it
unless you're basically requiring them to do the ADI
themselves from scratch.
But they get no information
after Cambridge Analytica, right?
'Cause you sorted everything,
you devise the investigation,
you put them in this box,
so do they start over with no information after March 18th,
whatever that date is.
-: They don't your honor,
lemme refine the description of our privilege
and work product claim.
The factual information that is developed by counsel,
communicated to and from counsel,
they are not entitled to that specific traunch
of information.
-: I totally, I get that.
How do they investigate all of this deception
out there by some of these app holders?
These apps, when you,
all they get is what happened before this investigation
in your view.
Because you directed everything,
Gibson Dunn directed everything after that date,
how did they do this?
Do they say, give me all 500,000 apps.
They're not software developers.
Do they have to literally start over without
and then as soon as they start asking particular questions,
you say, "Well, we sorted this.
"We can't give you that."
That'll tell us if we answer that question,
it'll reveal what the ADI did.
I just don't know how they do it.
-: Well, that's the nature of privilege and work product.
There is certain information that even a regulator
is not entitled to invade upon.
I do think it's an overstatement to say
that they cannot get some of this information,
they know they're sophisticated data abuse attorneys.
They understand-- -: Okay,
give me one example, how do they,
forget about Cambridge Analytica some.
There's another app out there
that violated this privilege, okay?
They violated all your policies.
If they ask,
give me the name of an app that violate your policies
and you just say, "Well, you can't do that.
"Because we sorted that out."
So how do they figure out?
How do they identify that individual app
that engaged in unfair and deceptive practices?
-: So they asked for that and they obtained it, right?
They received information about apps
that we have determined violated policies
or breached user data.
-: Well, is that right?
Or is just as Chief Justice Budd's question,
you gave them people who've been suspended
and there are 15 different reasons
why they've been suspended.
Did you give them a list?
And what exhibit is it in
of the apps that violated the privacy protocols
like Cambridge Analytica did?
Or where do we find that?
What exhibit is that in?
-: There's, your honor,
I'll need a moment to find the actual exhibit number.
But in the record,
there is communications from counsel to the attorney general
identifying the names of certain developers
that have been banned from the platform.
And I believe the names are in the impounded appendix,
have been banned from the platform
because they have been found to have
violated Facebook's policies
and done misused user data.
So I can find it for your honor and submit it after the.
-: That would be useful 16 L letter for us.
What exhibit that's in,
that would be very helpful.
Frank: I'm sorry.
-: No, I was just gonna see if anyone had any more questions.
Go ahead, please.
-: Just one.
So, the whole issue is whether or not the ADI
has really lapped the field, right?
So in the typical investigation,
go back to the private school scenario.
So the private school has a scandal
and they hire your firm
and they interview all the employees.
They try to do this to appease the trustees
and the people that send their kids to that school.
The police can come in,
they can interview the same employees,
they can do whatever they need to do
independent of the internal investigation.
But here, the problem is
that the ADI has kind of lapped the field
and the investigators have an inability
to gather the same information
that you folks do.
Is that an issue in this case?
-: I think I would factually dispute
that they have an inability to obtain
at least the similar information.
They have received a lot of information,
they can make queries.
So that just as a fact--
-: I get this that your response to the other CDIs.
And I also understand that perhaps the AG shouldn't be able
to just ask for everything you did,
but that's something we'll ask the AG.
So please continue your answer.
-: So then I think the answer is that no,
the fact that it's a large-scale investigation
because the company is large,
the amount of data is large,
and the issue is large.
That doesn't mean that it cannot still be subject
to the privilege and work product protections.
And I think that the attorney general has the ability
to seek the factual information that she needs.
And the fact that the application
of the privilege and work product
may somehow impede the investigation,
that is the nature of privilege and work product.
It protects against civil and government regulators alike
in order to encourage the type of self-reflection
and consultation would learn at counsel
to allow you to conform your activities to the law, right?
This is Upjohn, this is Comcast,
this is why internal investigations like this
are routinely held to be privileged
and that privilege is upheld
because we want companies to be undertaking
investigations like this,
to ensure that there are no bad actors
that have slipped through their other enforcement mechanisms
or that have engaged in conduct
that both the company and potentially a regulator
would find contrary to law.
-: Thank you very much.
Ellsworth: Thank you.
-: Attorney Cable.
-: Good morning,
may it please the court,
Sara Cable for the attorney general.
Your honors, I wanna pick up on that discussion
and specifically the question of,
why can't the attorney general do her own investigation?
Why can't she just ask for the names of all of the apps?
The fact is we did.
This has been an investigation since March, 2018.
In a prior CID in June, 2018.
And it's in the record at page 1st appendix 412.
We asked Facebook.
And this is before we even knew
before any assertion of privilege
before we even knew any details about the ADI.
Can you tell us what apps,
just simply identify them.
You've taken some enforcement action against
short of kicking off your platform
because they did tell us
who they kicked off their platform.
We wanna know,
who you did not kick off your platform,
even if they should have been kicked off your platform.
And the response we got was a brick wall.
All of this falls within the attorney client privilege,
or is all attorney work product.
And that's when they asserted the ADI for the first time.
We then engaged in order to try to narrow the dispute
and in a multi-month back and forth,
meet and confer, that was productive in some respects
but that was not productive in
convincing us that, number one,
there was incredibly material information at stake here,
and that we did not think was covered by the privilege.
It was only after many months of back and forth
when we learned and I believe it was June of 2019
a year later,
that there was a smaller group of apps.
We thought at the time it was approximately 10,000,
we're now learning that potentially it's 2 million,
it's unclear.
That Facebook had looked at and had some reason to think
there was something suspicious.
Those apps may have violated its platform policies.
Those apps may have engaged in some sort of data misuse.
They hadn't kicked them off the platform yet.
There are five categories that we asked for.
Those are the five contested requests in the court's order.
-: But you're tracking their categories though.
They have a very good argument
that because of, I mean, you may be have rights
to this somehow,
but they're being sued.
This is not one where we're imagining a lawsuit
being sued around the country, around the world.
And so, you've gotta do some of your own homework here.
You can't just ask for what they did,
because some of it is gonna fall within that privilege,
probably.
So I'm not sure,
five of those six categories
were sort of what they did, right?
There's one where you're asking
what another part of Facebook did
but don't you have to do your own step by step process.
Where you don't just completely track
what they did in the ADI.
I have some sympathy for their argument on this point,
you may have a substantial need and you have a job to do,
but I'm wondering whether you're trying to do it
in a shortcut.
-: Your honor, I can answer that in two ways.
Number one,
with respect to the categories we've requested again,
these are in our prayer for relief
at the 1st appendix page 46.
The parameters for those groupings
do not by their terms,
reveal any opinion work product,
do not reveal any attorney client privilege,
do not reveal any attorney analysis,
do not reveal the reasons why the apps were grouped
into these categories
other than at a very general level
and that--
-: Doesn't the ADI group into the categories
you're looking for.
Aren't you sort of tracking their categorization.
-: We are and that's because when we tried to do it
by a different route,
by asking just give us the names of all of the apps
they balked.
And that was back in June, they said everything is covered.
No matter how you ask it,
it's all attorney client privilege.
But getting back to the phrasing we used.
Yes, the phrasing is the phrasing
that their attorneys told us,
but they admit that that phrasing itself
is not attorney client privilege and is not work product
and that's at page 21 of their reply brief, footnote 10.
Where they tell us,
and this is in furtherance of their argument
that their public statements or other statements
haven't waived the privilege.
We didn't waive the privilege by providing
these descriptions of apps that the AG is seeking.
That is not a waiver of the privilege,
because that does not reveal any work product
or excuse me, any attorney client privilege
or any legal analysis.
And so, and if you look at the descriptions,
they are very factual,
they are quite obvious.
And the reason we ask for them was because Facebook told us
they had narrowed this group of potential bad actors--
-: But they do it through the ADI,
why can't they make you,
I'm just trying to figure out
why you can't rephrase your question.
I think you probably have a substantial need
for a lot of this information,
but I can't figure out why you don't have to reformulate
some of this because in the cases are very protective
of this work product doctrine,
at least at the first level,
is this covered by work product?
Can we get to whether there's a substantial need
and then we get to the third step,
whether it's opinion versus fact.
But I worry that the trial judge decided it on the,
that there's no work product here
but I'm just not sure that's consistent with Comcast.
-: I'd like to,
so Comcast says that documents, materials prepared
because of litigation can obtain work product protection
but documents that were generated
or that would have been generated
in the ordinary course of business
or irrespective of the litigation are not.
And that is clear in Comcast.
-: But this is clearly a different nature.
The ADI is
because literally there's a gigantic problem out there.
They create this ADI
which is attorney driven at every step.
And it's different from what they were doing before.
Maybe, yes, before you managed that somewhat,
but this is really a much different way of investigating
than they had historically.
It's not a mirror image of it's predecessor.
-: Your honor, it is done in a different form.
They've conceded that, I think that's what the papers show.
But I wanna describe
what we're looking at in this investigation.
Yes, we are trying to identify bad actors.
If that's all we were looking at,
we might be satisfied with Facebook telling us
who they've identified as a bad actor,
but there's another very important prong
of this investigation.
And that is whether Facebook is doing what it's been telling
its users from day one, it already was doing,
which is enforcing its platform
against misbehaving app developers
who might misappropriate users information.
The reason we are focused on what Facebook was doing
for its enforcement efforts
even after the Cambridge Analytica incident
is because in that incident
where one app obtained the sensitive data
of 87 million people,
millions in Massachusetts,
Facebook knew that Cambridge Analytica had obtained
that data improperly in 2015.
-: But for example,
you can get all the Cambridge Analytica information
because you don't need their help identifying
that they're a bad actor.
So I understand you're looking for this group
that hasn't been already kicked off the platform
but you suspect are bad actors
and they may be covering for them.
And you have a right to investigate that.
But what you're asking them to do
is turn over their own way of deciding
whether someone's a bad actor or not.
And they did this through the ADI,
which seems protected.
Why can't you take that second category
within interrogatories
and that are narrowly written,
so they can't keep saying, well, the ADI blocks it.
Why can't you track that down yourself?
Why can't you narrow it through a series
of discovery requests,
as opposed to asking for what the ADI did?
-: The answer is
we don't have the authority under chapter 93A
to issue interrogatories.
We're either able to obtain documents or take depositions.
The scope of information here--
-: Okay, so why can't you,
you know who the people are in the company,
forget about the ADI people.
You know, you don't need Zuckerberg whatever,
you can ask for various managers there
and say, okay,
this policy says this,
who were the people who violated this?
Can you do that?
Ask them who violated the policy.
I understand this is an enormous undertaking
and you may not have the resources to fight Facebook
but they've created
an internal investigation
that at least the case law seems to protect.
So why can't you get this information
the normal way through your process as opposed to
pigging backing on all of their work.
-: So first, I'll say again, we tried to ask them,
tell us the apps that you're investigating,
even before we knew of the ADI
and they refused because of the ADI.
That was in June. -: But you see by asking
it that way,
that's clearly attorney driven information.
Why aren't you asking more basic questions?
Okay, what apps meet this policy?
Which apps violated that policy?
I'm just trying to figure out
why you can't do it in a more linear way
as opposed to asking them to do all the work for you.
-: I think if we had asked,
so if we had asked Facebook,
can you tell us which apps you've determined
violate your policy?
They would tell us they can't because it's work product
because they are now investigating that in the ADI.
As to whether we could depose individuals
as a result of the superior court's order,
Facebook produced privilege log to us.
We now know that there are over two--
-: I'm just and I don't mean to be difficult,
I just don't understand it yet.
So you've got a bunch of apps,
you know there are 10,000 apps
you keep asking who violated your policies.
Could you, again, that is an attorney kind of issue.
Can you ask, which apps gave the information
to people besides themselves?
Meaning what Cambridge Analytica did it,
gave it to political consultants.
Can you ask it that way?
That's a factual question
that's different from who violated your policies
which is a legal question.
-: What we actually asked, I think is instructive.
We asked Facebook in request one,
can you tell us the apps that you've determined
have a large number of installing users
we don't need to know the number,
whatever that is, tell us.
Group two,
tell us which apps fall within your own words
based on Facebook's past investigative experience,
not the ADI past experience,
raised some questions,
who are they?
Number three,
who are the apps--
-: They refused to answer that question.
Group three,
who are the apps that were identified to you
outside of Facebook,
outside the ADI,
who were they?
They refused to answer that question.
Request four,
Facebook you tell us you've done a detailed
background analysis on some group of apps and developers.
We're not asking for your analysis,
we're not asking for why.
We just wanna know what is that group?
Who are they?
The fifth request,
you've also told us Facebook
that you've engaged in a technical analysis
of another group of apps.
We don't need the analysis.
We don't need to know the trigger.
We don't need to know the conclusions.
Who are they?
That is what we've asked for and they've refused.
-: Can I ask you a question?
And I get they might have a problem to the extent
that they try to conceal from you non ADI information,
what's the basis of the judge's factual finding
that the ADI was business as usual
when there exists the Facebook Enforcement Program
which would be business as usual certainly.
-: Sure, your honor.
So the factual basis,
let me just find it in my notes here.
I think the best place to look
would be at the sources at page 32 to 33 of our brief.
And they're further described in detail
in our impounded brief at page 33, footnote nine.
And those reference the various policies
detailed description
of their pre ADI enforcement mechanisms,
examples of prior enforcement.
It also outlines the multiple statements by the company
and their CEO that the purpose of this investigation
was to identify bad actors going forward
and improve the platform going forward.
-: Oh, it's the look forward that is the issue, right?
-: It's the look forward,
it's that they are investigating past conduct of apps
currently on the platform
to make the current platform safer for the future.
It is not, we are looking back at apps
that were on the platform
that are no longer on this version of the platform.
It is, let's widen the scope of our ongoing enforcement
efforts in time to kick it back,
we clearly need to take a second look back at that history.
And based on what they found in the past,
they are taking present action on present apps now.
And that's why this is an ongoing continuation
of the same enforcement practices.
Putting lawyers in charge of it,
is not enough to convert that to work product.
-: Let me ask you the same question,
I asked myself with regard the attorney client privilege
and where do we draw the line between PR statements
and waiver of the privilege in this whole
touting the investigations so as to wave.
Where do you draw that line?
-: I think your honor, I think you,
I believe it was you, you drew it.
It is perfectly fine for a company to announce
that it is engaging in an internal investigation,
and it is perfectly fine to announce
that it is doing so because clearly an incident raised
some concerns.
But what Facebook did here was it used the investigation
as a way to comfort the public
and importantly to improve the platform today
and going forward.
And it promised users,
if we find bad actors, we will tell you,
please keep using Facebook,
there's no issue.
-: How's that different from the prep school
that says we have this scandal
and don't worry about your kids
'cause we're gonna do the investigation
and your kids will be safe.
How's that different?
-: I think in the grand jury investigation case
of this court,
I think those statements gave the court pause to.
Where I think the school in that case was saying,
we have this internal investigation,
don't worry
but we're not gonna give you the facts about it.
And the court said,
you have to give it to the government.
You're saying all these things,
you're saying there's people you're investigating
and government is simply asking who they are.
You can not hide those facts.
Frank: Okay.
-: The grand jury case
is really distinguishable
because the prep school had a duty to report to authorities
every issue, every case of this kind of sexual exploitation.
So that's not a good case for you.
Give me the case, any case.
'Cause I read a lot of the ones cited.
Every time they find attorney,
they find work product protection
when there is actual litigation going on out there.
Which case should we look to?
Which supports your view
that this is not covered by work product
when there is massive litigation already imminent.
-: I think the Upjohn case, your honor.
-: Doesn't that come out the other way.
-: In Upjohn,
the court decided that the lawyers interview notes
were protected,
but the court was careful to note that the government
was free to interview the employees who were interviewed.
The government could get the identity
of the employees interviewed.
They can't get the notes
but they get the identity.
And that is exactly what Facebook is trying
to not give us here,
the identity of the apps that they're investigating.
So I think that Upjohn supports our argument.
That was a key fact for the court in finding that--
-: Is that done under the substantial
need aspect of work product
or did they say it was outside of the work product?
-: They said that that was outside of the work product.
It frankly, it wasn't an issue in the case
because Upjohn had provided the government in that case
with that list,
but the court pointed to that.
-: But then it's totally it wasn't even a contested issue.
-: It was important to the court
because it and maybe this gets to your question,
the court said there is another way that the government
can get its own information here.
And that is by doing its own interviews
of those employees.
We can't do that here
because we don't know the names of the apps at issue.
-: Well, you don't know them.
They may be stonewalling you on issues
that you're entitled to,
but I'm not sure you're, I just,
again, I find all the cases out there
seem to say this is work product.
And then the question is,
but at the same time,
you've gotta a right and a duty to investigate them,
so it seems like this is a substantial need issue
and how you define it.
But then I get back to,
I can't figure out whether you've asked.
-: May I ask, oh, go ahead.
Scott: No, go ahead.
-: I just wanna take this in a different direction
for a short minute.
And that is going back to this idea
of the attorney client work product privilege
and its applications to corporations.
Because there are certainly a lot of supreme court cases
that apply them to corporations
but I think when you look at Upjohn
and when you look at the older cases,
there's really no articulated reason for that.
It seems to just be assumed.
Have you come across anything in your research in this area
that suggests that that is an area that would be fruitful
for consideration.
-: Not sure I understand the question, to?
-: Well, what I'm saying is that the cases
from the Supreme court
that talk about the attorney client product
or the attorney client privilege and corporations
assume it applies,
but there was some discussion
in the '30s, and '40s, and '50s
whether it should or not.
And it was really never explicitly resolved
whether it should and why.
It's just assumed.
And I'm wondering if there's anything,
if that's just a permanent
black letter law now,
or is it something in the law
that is left undone that needs to be pursued.
-: To be honest, your honor
I don't have the answer today.
But I think in terms of the application
of the attorney client privilege here,
it cannot conceal facts.
And the first five requests we've asked for, are facts.
They are not communications,
they reveal no communications,
they reveal no advice,
and Facebook has admitted as such.
As to the last request, which is for communication.
-: How have they admitted?
'Cause I've read a bunch of exhibits
where they're contesting this every step of the way,
I'd be shocked if they admitted anything.
-: At page 21 of their reply brief note 10.
-: Can you read the sentence to us.
-: Sure.
Facebook is not as the attorney general suggests
informs the attorney general
of the detailed attorney derived criteria
used to analyze data and assess legal risk.
Although Facebook has provided high level descriptions
of the investigations contours to the attorney general
based on the attorney general's assurances now reneged
that doing so would not be used to claim a waiver.
It has not described the specific criteria used to analyze
that data nor how that analysis affects counsel's evaluation
of potential legal risk.
-: That's not, okay, give me a break.
That's not a waiver.
That's the opposite of a waiver.
You must have misunderstood it, yeah.
-: I raised this only to say that the way
they're describing the categories we've asked for,
they're explicitly saying the words in those categories
do not reflect
their thought processes.
-: They're protecting themselves
by saying how they've described it
is not quite comprehensive
because they don't wanna blow the privilege.
So I don't know, but anyway, that doesn't help.
-: Great,
anybody else have any other questions?
Okay, thank you counsel.
-: Thank you, your honor.
-: Your honor, with your permission,
I'd like to submit a letter pursuant to rule 22c
just to address a few of the factual statements
Ms. Cable made.
-: That's fine.
-: Thank you,
thank you very much.