Blanket Privilege Assertion Rejected Where Attorney Wore Two Hats

“Netskope requested production of certain emails sent or received by John Whittle, a Fortinet executive who has held both business and legal counsel roles.” Netskope, Inc. v. Fortinet, Inc., 2025 WL 3190693 (N.D. Cal. Nov. 14, 2025).

Fortinet contended that its internal emails were either irrelevant or “privileged as attorney-client communications or attorney work product, because all of Whittle’s communications on those topics are inherently legal advice….” It asserted that it would be unduly burdensome to provide a privilege log.

The court rejected the relevance argument and wrote: “Fortinet has not produced a privilege log but denies that it is asserting a blanket privilege. Instead, Fortinet contends that it would be overly burdensome to produce a privilege log because all or nearly all of Whittle’s relevant communications are privileged.”

The Netskope court was “unpersuaded.”

“First, though Whittle has worked as in-house counsel for Fortinet, it does not follow that his emails are automatically privileged.” They could be unprivileged business advice.

Netskope need not take Fortinet’s assertion to the contrary at face value—that is the purpose of a privilege log. By failing to produce a privilege log, Fortinet has effectively asserted a blanket privilege over all of Whittle’s internal communications, without stating whether it is asserting attorney-client privilege or work product privilege (or both, or something else) over specific emails. This is improper.

The court continued:

Second, Fortinet asserts that producing the emails would be unduly burdensome, but this “effectively is a blanket privilege objection, since defendant’s claim of burden rests on general assertions regarding the existence of privileged material.”…. Further, Fortinet has not quantified this potential burden by providing, for example, hit counts to Netskope’s proposed email search terms, despite Netskope’s requests to do so. Thus, Fortinet’s burden claims must fail.

Therefore, the court ordered Fortinet to produce the requested emails; however, it granted leave to assert privilege in a proper privilege log.