A minor pre-trial ruling out of the Southern District of New York has caused rather more spluttering over coffee than the underlying case probably deserves. Judge Jed Rakoff, eminent, formidable, and now 82, has quietly released a cat among the pigeons.
In United States v. Heppner, he ruled that a defendant’s written exchanges with a public AI system (Claude) about defence strategy were not protected by attorney-client privilege or the work-product doctrine. Asking ChatGPT, Claude or Gemini for case strategy, in the Court’s view, is essentially the same as asking a helpful stranger on a park bench. One who is neither a lawyer nor bound to keep a secret.
The problem was not that he wrote down his defence thinking. It was that he disclosed that thinking to an external entity first. The Court effectively treated the exchanges as the equivalent of handing one’s notes to a third party not bound by confidentiality before ever showing them to counsel.
The Court’s reasoning is worth reading in full because it is quite specific and blunt. Privilege failed because Claude is not a lawyer, the exchanges were not confidential given the platform’s data-use terms, and the defendant was acting on his own rather than at counsel’s direction.
OpenAI’s Sam Altman has publicly cautioned that one should assume conversations with ChatGPT are not private and may be disclosable. Sensible advice in a data-retention age. But the strangeness here is more specific. The defendant was not casually chatting. He was, in effect, drafting his own defence and pressure-testing arguments. Had he written the same material in a notebook, a Word file, or on the back of an envelope, no one would suggest privilege had evaporated because the medium involved electricity. Introduce an LLM, however, and the notes apparently become a conversation with an unlicensed and rather indiscreet entity.
What the ruling does not grapple with is the obvious next set of questions. Are enterprise systems different from public ones? Does it matter if the model is contractually bound not to train on or retain data? What if the discussion is anonymised and conducted purely in the abstract? Investigators and lawyers are already using enterprise deployments precisely to avoid the “third party disclosure” problem. The judgment is notably silent on whether that distinction matters, which leaves us in the slightly surreal position of not knowing whether they are using a tool or accidentally publishing their thoughts. judgment also edges into curious territory by treating the model as though it were a quasi-person rather than software.
For investigators, this is awkward. We routinely map facts, test hypotheses, and think about client strategy on paper or screen. Are we now to assume any exploratory exchange with an LLM is potentially discoverable? Does the answer change depending on which version is used? The ruling offers limited comfort.
It is beyond presumptuous to second-guess a ruling on new technology by one of New York’s most distinguished and longest serving jurists, but I struggle to see this being the final word. For the moment, it is the law in the Southern District. The case itself is relatively modest and unlikely to be appealed, so the ruling may sit there for some time, like a grenade politely passed around the dinner table.
Lawyers we have spoken to range from baffled to quietly alarmed. The practical guidance emerging is stark. Assume every interaction with a public LLM is discoverable. Enterprise systems are being treated as the safer course, though whether they are legally safer remains, at present, an unanswered question.
No doubt the courts will eventually decide whether these systems are tools, agents, or something resembling an over-eager junior who takes meticulous notes and forwards them to the other side. Until then, those of us who write down our thoughts may wish to remember that, in this new world, the walls apparently have ears…and an autocomplete function.
The following Raedas team members have prepared this update: Andrew Wordsworth, Emad Rajeh
Andrew Wordsworth – Partner, Dubai (awordsworth@raedas.com)
Emad Rajeh – Senior Associate, Washington, D.C. (erajeh@raedas.com)