Discovery is a process whereby information relevant and responsive to a litigation is distilled from larger sets of data in the possession of the producing party. This responsive information becomes increasingly concentrated as the process moves from preservation to collection to culling to review. Finally, after essentially boiling off the irrelevant data, the concentrated responsive information is produced to the requesting party. The discovery process has also concentrated the value of the information being produced because, by removing the irrelevant, the production contains more information that is commercially sensitive or potentially embarrassing. Used inappropriately, the production could significantly injure the producing party.

Protective orders were designed to protect against exactly this issue. For example, in a federal court action, Federal Rule of Civil Procedure 26(c) allows a court to “issue an order to protect a party or person from annoyance, embarrassment, oppression, or undue burden or expense.” Similarly, under New York law, N.Y. C.P.L.R. §3103(b) allows a court to issue a protective order “designed to prevent unreasonable annoyance, expense, embarrassment, disadvantage, or other prejudice.” It is well understood that while parties are entitled to discovery to prosecute their claims or defenses, they are not entitled to conduct discovery to satisfy their curiosity or obtain information to use elsewhere. Thus, protective orders are traditionally drafted to protect against one party using an opponent's production outside of the litigation or intentionally disclosing the production to a third party.

In the age of cyber attacks, hacking, and digital corporate espionage, however, this traditional view of protective orders no longer protects the producing party. Traditionally, the biggest threat to the produced data was intentional misuse from an opponent, not someone breaking into a lawyer's office to steal their opponent's documents. The risks have increased. As discovery has become predominately digital, producing parties must now face the threat of third parties stealing highly sensitive information not just from their and their advisor's computer systems, but their opponents' data systems as well. Companies can build their own data security systems and choose advisors with appropriate security,1 but they cannot choose their opponents, their opponents' counsel, or their opponents' discovery vendors. Traditional protective orders do not account for this new threat, and, absent explicit obligations, requesting parties have little incentive to defend against the threat of hacking and implement security measures to protect their opponents' data.