(Reuters) - A D.C. federal judge has granted a discovery bid by a former Clark Hill client to compel the law firm to provide him a forensic report and other documents related to a 2017 cyberattack on the firm's computer servers.

U.S. District Judge James Boasberg in a Tuesday ruling rejected the law firm's arguments that a report created by consultancy Duff & Phelps and related materials are protected by work product and attorney-client privileges.

The discovery dispute arose in a malpractice lawsuit brought by plaintiff Guo Wengui, a U.S.-based businessman and Chinese dissident with a reported net worth over $1 billion. Guo had retained Clark Hill for assistance on an asylum petition and sued after a hacker published his confidential information online.

Clark Hill, represented by Jenner & Block, declined to comment on the ongoing litigation. A lawyer with The Casper Firm who represents Guo didn't immediately respond to a request for comment.

The case also names a Clark Hill immigration attorney as a defendant. The Detroit-founded firm has more than 650 attorneys and professionals.

Clark Hill argued in response to Guo's motion to compel discovery that the report from Duff & Phelps is privileged because the consulting firm generated the report for the firm's outside counsel, Musick, Peeler & Garrett, which was hired by the firm in preparation for litigation arising out of the attack. Musick Peeler engaged Duff & Phelps to do an investigation for the purpose of helping it advise the firm, Clark Hill said.

Parties under the work-product privilege can't obtain discovery of documents that are prepared "in anticipation of litigation." The court in its Tuesday order found that Clark Hill had not met its burden to show the report or similar documents wouldn't have been made in the "ordinary course of business irrespective of litigation."

The need to determine how a breach occurred is generally a necessary business function for organizations and it's likely that the firm would have done such an investigation, the court said, citing other court rulings.

The report, which the court has reviewed in camera, "summarizes the findings of such an investigation," the judge said.

He wasn't persuaded by Clark Hill's lawyers' arguments that the report qualifies for such protection because it was one half of a "two-tracked investigation" of the attack, with the other half being work the firm said was done by its usual cybersecurity vendor to investigate the attack to preserve "business continuity." But the court said there isn't evidence that the vendor produced findings or a comprehensive report and the record suggests Clark Hill turned to Duff & Phelps instead of the vendor for the investigation.

The court also found Duff & Phelps' role "seems to have been far broader than merely assisting outside counsel in preparation for litigation." The judge notes in the opinion that the report provides a summary of Duff & Phelps' findings and recommendations for boosting the firm's cybersecurity – and was shared with Clark Hill IT staff and the FBI.

On the law firm's attorney-client privileged argument, the court concluded the report isn't a communication between an attorney and a client and is "rather one between an attorney and an outside consultant hired by the attorney."

The judge also granted Guo's requested discovery for information related to the attack and other clients of the firm. The information is "clearly relevant, and appropriate redactions can assuage any privilege or privacy concerns," the judge said.

The scope of the attack is "directly germane" to the core issue of the case and there isn't a basis for the firm's "blanket refusal" to the production requests," the court said.

The case is Wengui v. Clark Hill PLC et al, U.S. District Court for the District of Columbia, No. 1:19-cv-03195

For Wengui: Ari Casper of The Casper Firm

For Clark Hill: Kali Bracey of Jenner & Block