A spokesperson for Covington said the firm will "review the decision carefully and consider any next steps in consultation with our affected clients."
Any final outcome could make it easier for the government to get information on law firm clients in the future, and law firms warn it could chill cooperation between the private sector and authorities investigating cyberattacks.
The SEC had sought the names of all the nearly 300 companies affected, but Covington resisted identifying any clients.
The agency said it needed the names to probe for securities law violations associated with the attack, arguing that Covington’s law firm status did not shield it from cooperating.
Covington told the court a law firm’s clients are part of a “zone of privacy” protected by the U.S. Constitution and legal ethics rules.
Persons:
Burling, Judge Amit Mehta, Covington, cyberattacks, Mehta, Andrew Goudsward, David Bario, Susan Heavey
Organizations:
Covington, Burling, U.S . Securities, Exchange Commission, U.S, SEC, Circuit U.S, of, Thomson
Locations:
Covington, Washington