Are AI-generated materials legally privileged? United States v. Heppner
Rose Hughes
Are AI-generated materials legally privileged? United States v. Heppner
Legal privilege ensures that you can share sensitive information with your lawyers without fear of it being used against you in court. This protection is critical in all fields of law. In patent law, without the assurance of secrecy, the ability of a patentee or a defendant to receive candid advice would be severely diminished. Now, with the growing ubiquity of AI in the legal industry, much attention has been given to the recent case of United States v. Heppner. The court was asked whether communications about a legal case with a publicly available AI platform were protected by attorney-client privilege or the similar work product doctrine. The judge's answer was a clear "no". Other than the obvious (don't put confidential information into public AI tools!), what lessons can we take from this about the safe use of AI in the patent industry?
 |
| Top secret |
AI and legal privilege: United States v. Heppner
Last year, Mr Heppner was indicted on federal charges including securities fraud. Following a grand jury subpoena and learning he was a target, Heppner, acting on his own without instruction from legal counsel, used Claude to prepare documents outlining his defence strategies. When Mr Heppner was subsequently arrested in November, federal agents executed a search warrant and seized electronic devices from his home that contained approximately thirty-one of these AI-generated documents. Heppner and his counsel asserted privilege, but the government moved to review the materials.
Judge Rakoff ruled that the AI-generated materials were not protected by attorney-client privilege. In a written memorandum, the judge explained that the AI tool failed the standard three-part test for privilege. Firstly, there was no attorney-client relationship because an AI is not a licensed professional bound by fiduciary duties or subject to professional discipline. Interestingly, in a completely unrelated case, ChatGPT has just been sued for providing legal advice without a licence. Secondly, the court found that there was no confidentiality in place as the Anthropic privacy policy for Claude discloses that they collect user inputs, trains on user data, and may disclose data to third parties including government authorities.
Finally, the judge noted that Mr Heppner did not communicate with Claude "for the purpose of obtaining legal advice", e.g. under the direction of counsel. Interestingly, the judge observed that "[h]ad counsel directed Heppner to use Claude, Claude might arguably be said to have functioned in a manner akin to a highly trained professional who may act as a lawyer's agent within the protection of the attorney-client privilege". However, because the Claude platform includes a disclaimer stating it cannot provide formal legal advice, Mr Heppner could not be considered to be seeking legal advice. As the judge also noted, "when the Government asked Claude whether it could give legal advice, it responded that 'I'm not a lawyer and can't provide formal legal advice or recommendations' and went on to recommend that a user 'should consult with a qualified attorney who can properly assess your specific circumstances'".
Given these three circumstances, it was clear to the judge that legal privilege did not apply.
The limits of protection (Work product doctrine)
The judge's reasoning on privilege noted that "some commentators have argued that whether Claude is an attorney is irrelevant because a user's AI inputs, rather than being communications, are more akin to the use of other Internet-based software, such as cloud-based word processing applications". However, that judge noted that "the use of such applications is not intrinsically privileged in any case". This leads to a second protection in US law, the work product doctrine (WPD). The WPD serves as a complementary shield to legal privilege by protecting materials prepared in anticipation of litigation. In the context of patents, this includes documents such as infringement analyses or validity opinions created by or for patent attorneys. This doctrine ensures that an attorney can prepare a case thoroughly without the risk of their internal thoughts and strategies being handed over to the other side.
In the Heppner case, the court also rejected the application of the WPD. Judge Rakoff noted again that the documents were created by Heppner independently in coordination with Claude rather than at the direction or supervision of counsel. Furthermore, simply sharing non-privileged communications with an attorney after they are created did not retroactively convert them into privileged ones. The WPD, the judge emphasised, is to protect the mental processes of lawyers, and "generally does not shield from discovery documents that were not prepared by the attorneys themselves, or their agents".
Final thoughts
The existence or otherwise of legal privilege or protection under the work product doctrine can be critical to the outcome of patent litigation in the US, and in particular the awarding of triple damages. In the US, a court may increase damages up to three times the amount found or assessed in cases of wilful infringement, i.e. where it can be proved that the defendant knew about the patent and that they were infringing.
However, it is important to understand the limitations of the applicability of the decision in Heppner. Notably, the court did not request or receive any documents from Anthropic. There was no need, as Mr Heppner had saved the advice locally on his own device. Nonetheless, the court’s reasoning regarding the privacy policy made it clear that subpoenaing the AI company directly would have been a viable path. Indeed, this kind of document discovery is not merely a theoretical concern. Last year, DHS investigators obtained prompt-level data from OpenAI through a warrant in a criminal investigation. Furthermore, in copyright litigation between the New York Times and OpenAI, the court compelled the production of twenty million anonymized chat logs. It is clear that AI companies may therefore be forced to hand over stored user data during negotiations or under legal compulsion. You cannot assume that anything submitted into a publicly available AI is or will remain confidential.
The fact that Mr Heppner was using a version of Claude lacking any confidentiality restrictions was clearly highly influential to the outcome of the case. These publicly available tools are different to the enterprise-grade versions, provided under conditions of confidentiality, with no training on user data and no data retention agreements in place (IPKat). However, regardless of even these provisions, the saved outputs of AI tools may be a different matter. Caution must therefore be taken with the use of third-party software providers and software that may store your inputs, outputs and chat history, even when these are stored locally or provided under conditions of confidentiality. Documented opinions about the validity and potential infringement risk of patents without a clear client-attorney relationship are always fraught with risk, regardless of who or what generated them.
Further reading
Use of AI in the patent industry: