Federal Court Rejects Internet Provider's Appeal Over Cyber Attack Report Privilege

OUTCOME: Dismissed

Federal Court of Australia

[COMPANY] v [NAME] [2024] FCAFC 58 Appeal from: [NAME] v [COMPANY] [2023] FCA 1392

File number(s): VID 986 of 2023

Judgment of: MURPHY, ANDERSON AND NESKOVCIN JJ

Date of judgment: 27 May 2024

Catchwords: PRIVILEGE – legal professional privilege – [NAME] party report – investigation into cyber-attack – whether the report was created for the dominant purpose of legal advice – multiple purposes for commissioning report – unchallenged evidence – adverse inference – failure to adduce specific and focused evidence – time for assessing dominant purpose PRACTICE AND PROCEDURE – application for leave to appeal – whether leave to appeal against interlocutory ruling ought to be granted – leave denied

Legislation: Evidence Act 1995 ([NAME]) s 75

Cases cited: Ashby v Slipper [2014] FCAFC 15; (2014) 219 FCR 322 Attorney-[NAME] (NSW) v [COMPANY] [2020] NSWCA 40; 102 NSWLR 47; 380 ALR 1 [NAME] Commission v Noumi [2024] FCA 349 [NAME] Commission v [COMPANY] [COMPANY] [2020] FCA 1277; 148 ACSR 1 [COMPANY] v [NAME] (No 5) [2006] FCA 1234; 155 FCR 30 [NAME] v Commissioner of Taxation ([NAME]) [2007] FCAFC 88; 242 ALR 601 Browne v Dunn (1893) 6 R 67; 1 WLUK 44 [NAME] v [NAME] Immigration, Citizenship, Migrant Services and Multicultural Affairs [2020] FCAFC 181; 283 FCR 299 [NAME] v [COMPANY] (in liq) [2018] NSWCA 205; 98 NSWLR 493; 364 ALR 554; 130 ACSR 475 [COMPANY] v [NAME] ([COMPANY] [2021] FCA 512 [NAME] v [COMPANY] (1989) 17 NSWLR 553 [NAME] v [NAME] [NAME] [NAME] [2020] FCA 984 [NAME] v Commissioner of Taxation [2019] HCA 26; 265 CLR 646 [NAME] v Commissioner of the [NAME] Federal Police [2020] NSWCA 247; 103 NSWLR 509 [NAME] v [NAME] (Privilege) [2016] NSWSC 12 [NAME] (1959) 101 CLR 298 Kennedy v Wallace [2004] FCAFC 337; 142 FCR 185 [NAME] v [COMPANY[NAME] [COMPANY] [2011] HCA 11; 243 CLR 361 [NAME] v [NAME[NAME] [2019] FCA 1101 Perry v [NAME] [COMPANY] [2011] VSC 308 [NAME] [COMPANY] v Perry [2011] VSCA 239; 33 VR 548 [COMPANY] v [NAME] (1975) 132 CLR 362 [NAME] v [COMPANY] (No 2) [2019] FCA 1322 [NAME] v [COMPANY] [2023] FCA 1392 [NAME] v [COMPANY] (No 23) [2021] FCA 1460; 157 ACSR 438 Singapore [COMPANY] v Sydney Airports Corporation [2004] NSWSC 380 [COMPANY] v Singapore [COMPANY] [2005] NSWCA 47 [COMPANY] v [NAME] Commission [2022] FCA 208; 401 ALR 143

Division: [NAME]: Victoria

National Practice Area: Commercial and Corporations

Sub-area: Regulator and Consumer Protection

Number of paragraphs: 97

Date of hearing: 14 May 2024

Counsel for the Applicants: [redacted]

Solicitor for the Applicants: [redacted]

Counsel for the Respondents: [redacted]

Solicitor for the Respondents: [redacted]

BETWEEN: [COMPANY] (ACN [PHONE]) First Applicant

[COMPANY] (ACN [PHONE]) [NAME] Applicant

[COMPANY] (ACN [PHONE]) (and others named in the Schedule) [NAME] Applicant

AND: [NAME] First Respondent

[NAME] Respondent

order made by: MURPHY, [RESPONDENT] AND [RESPONDENT] JJ DATE OF ORDER: 27 MAY 2024

THE COURT ORDERS THAT:

1. Leave to appeal be refused. 2. The Applicants pay the Respondents' costs of and incidental to the application. Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

THE COURT

introduction 1 The applicants [COMPANY] ([COMPANY]) and its subsidiaries (Optus) apply for leave to appeal from orders 1 - 4 and 6 of the orders of a single judge of this Court made on 21 November 2023, the reasons for which were delivered on 10 November 2023: see [NAME] v [COMPANY] [2023] FCA 1392 ([NAME]). 2 The application for leave and, if leave be granted, the appeal concerns a privilege claim by Optus over a forensic investigation report prepared for one or more of the Optus parties by [NAME] ([NAME]), concerning a significant data breach involving the release of up to 9.5 million customers' private and confidential [NAME] held by Optus, apparently as a result of a cyber-attack, between 17 and 20 September 2022. The cyber-attack was publicly announced by Optus on 22 September 2022. The report by [NAME] was commissioned at a time when Optus faced potential legal threats and challenges, including prospective class actions, regulatory investigations, customer claims and the need for advice concerning remedial steps required by legislation and regulations applying to Optus. The report was provided by [NAME] to [NAME] [COUNSEL] [NAME], Optus' [NAME] and Company Secretary, and to [NAME], the legal firm retained by Optus to provide legal advice in relation to the cyber-attack, on 13 July 2023 ([NAME]). 3 The [NAME] judge accepted that [NAME] formed the view that the cyber-attack would likely lead to one or more regulatory investigations, and subsequent litigation: ([NAME] [7]), and that the litigation and legal risks arising from the cyber-attack were at the forefront of the mind of [NAME] [NAME] when he first became aware of the cyber-attack: ([NAME] [10]). [NAME] accepted that one of Optus' purposes in procuring the investigation and report by [NAME] was the purpose of obtaining the report to assist [NAME] [COUNSEL], his legal team, [COUNSEL], and counsel retained by [COUNSEL] to provide legal advice to Optus in relation to the litigation and regulatory risks Optus faced as a result of the cyber-attack (the legal purpose): ([NAME] [3], [121]). However, [NAME] concluded that the Optus parties "had multiple purposes in procuring the review and report by [NAME]": ([NAME] [3], [121]-[123]), and rejected Optus' privilege claim on the basis that Optus had failed to discharge its onus to show that the legal purpose for procuring the [NAME] was dominant: ([NAME] [3] and [167]). 4 Optus contends that the [NAME] judge erred in failing to find that the [NAME] had been created for the dominant purpose of enabling Optus to obtain legal advice or the provision of legal services to Optus for the purpose of actual or anticipated legal proceedings (Ground 1) because the [NAME] judge: (a) wrongly assessed Optus' purpose in procuring the [NAME]: (i) as at 3 October 2022 when Optus published a media release stating that it was appointing [NAME] "to conduct an independent external review of the recent cyberattack, and its security systems, controls and processes"; or (ii) as at 11 October 2022 when the board of [COMPANY] (Board) resolved to retain [NAME], rather than 13 July 2023 when the [NAME] was brought into existence and provided to [NAME] [NAME] and [NAME] or 21 October 2022 when [NAME] formally engaged [NAME] (Ground 2); (b) erred in rejecting or placing [COMPANY] weight upon the unchallenged evidence of [NAME] [NAME], including by wrongly making adverse comments in relation to that unchallenged evidence, contrary to established authority (Ground 3); (c) erred in drawing an adverse inference from the fact that no evidence was called from [NAME] [NAME] [NAME], Optus' Chief Executive Officer (CEO), in circumstances where [NAME] [NAME] gave evidence as to conversations he had with [NAME] [NAME] [NAME] on the engagement of [NAME] (Ground 4); and (d) wrongly assessed Optus' purpose principally by reference to statements made by its CEO in the 3 October 2022 media release, including by finding the statements in the media release to be the "best evidence" as to her purpose, rather than accepting [NAME] [NAME] evidence of conversations he had with the CEO leading to Optus' decision to engage [NAME], which Optus alleges supports the attested dominant purpose (Ground 5). 5 For the reasons we explain, the judgment of the [NAME] judge is not attended by sufficient doubt to warrant leave to appeal being granted. We have made orders to dismiss the application for leave to appeal.

The evidence 6 Before the [NAME] judge Optus relied on an affidavit by [NAME] made 24 August 2023 ([NAME]). The respondents relied on an affidavit of their solicitor, [NAME] [COUNSEL], made 8 September 2023, which annexed certain media releases and newspaper articles. Neither deponent was cross-examined. 7 Before the [NAME] judge, Optus sought to discharge its onus to show a privileged purpose was dominant by relying upon the unchallenged affidavit evidence of [NAME] [NAME] and the inferences which it submitted arise from that evidence. For this reason, we now turn to consider [NAME] [NAME] evidence.

[NAME] [NAME] 8 [NAME] [NAME] gave evidence that he became aware of the cyber-attack on the morning of 21 September 2022, and formed the view that the incident would "almost certainly" result in regulatory investigations including by the [NAME] ([NAME]) and/or the [NAME] Authority (ACMA), and likely to result in subsequent legal action, including civil penalty proceedings, and also highly likely to lead to one or more class actions against Optus or a representative complaint with the OIAC. He expected there to be a strong customer reaction and ongoing complaints. He said that having regard to the magnitude of the cyber-attack and his expectations of the real likelihood of litigation and regulatory actions it was "immediately evident" to him that Optus would need to engage external lawyers with specific expertise in dealing with such matters: [NAME] [14], [15], [17]-[18], [20]-[21]. 9 [NAME] [NAME] contacted [NAME] on 22 September 2022, the day after he became aware of the cyber-attack, and [NAME] was retained to advise Optus in relation to the attack: [NAME] [23]-[24]. The same day, Optus announced it had been the subject of a cyber-attack: [NAME] [29]. Within a week, many of the legal threats [NAME] [NAME] had foreseen were forming ([NAME] [29]-[42]), including that: (a) on 26 September 2022, [NAME] announced they were investigating "a possible class action against Optus on behalf of [NAME]… affected by the unauthorised access to customer data" announced by Optus on 22 September 2022: [NAME] [34]; (b) on 28 September 2022, [NAME] made a similar announcement, and announced on 7 October 2022 that it had lodged a representative complaint with the OIAC: [NAME] [35]-[36]; (c) on 11 October 2022, the OIAC announced it had commenced an investigation into the "personal [NAME] handling practices" of Optus in regard to the cyber-attack: [NAME] [41]; and (d) on 11 October 2022, the ACMA announced it had commenced an investigation in relation to the cyber-attack: [NAME] [42]. 10 [NAME] [NAME]: (a) formed the view, soon after the cyber-attack, that in order to assess Optus' legal risk, it needed to undertake a confidential, forensic investigation into the root cause of the cyber-attack, so that Optus could obtain legal advice from him, his legal team, [COUNSEL] and counsel briefed in the relevant matters: [NAME] [44]; (b) formed the view, within about a week after the cyber-attack, that the investigation was best handled by a party external to Optus which had specialist expertise in investigating and reporting on cyber matters: [NAME] [45]-[46]; (c) from the outset wanted to ensure that the independent specialist was engaged by [NAME], and that the scope of the investigation was developed by his legal team in conjunction with [NAME], so that the investigation and report would assist his team, [COUNSEL] and counsel in advising Optus on the legal risks and regulatory implications arising from the cyber-attack: [NAME] [47]-[49]. 11 [NAME] [NAME] gave evidence that he had various discussions with Optus' executives, including its CEO, the [NAME], Risk Management, the Chief [NAME], the Director, Group, Internal Audit (Finance & Operations & Fraud Risk), the Head of [NAME] IT Audit and Data, Analytics and Robotics Team "as to how we could best utilise [NAME]'s expertise to assist [[NAME] [NAME]] and [NAME] to give legal advice and manage the legal risk". He said that "[w]e ultimately landed on [NAME] carrying out a forensic investigation into the root cause of the Cyber-attack and Optus' response to it". He also said that based upon these discussions, "we" recommended to the Board that [NAME] be engaged to carry out the investigation, "which would assist me, my team and [COUNSEL] (and counsel briefed by [COUNSEL]) in advising Optus in relation to the multiple legal risks and matters arising from the Cyber-attack": [NAME] [50] and [52]. 12 [NAME] [NAME] said that on 3 October 2022 Optus announced in a media release that it was appointing [NAME] "to conduct an independent external review of the recent cyber-attack, and its security systems, controls and processes", and he exhibited a copy of the release: [NAME] [53]. 13 The terms of media release are significant to the [NAME] judges' findings ([NAME] [29]) and it is convenient to set it out here. 14 [NAME] [NAME] gave evidence that although at the time of the media release [NAME] had been selected to undertake the external review Optus was yet to settle the terms of reference for the investigation. From 3 October 2022 to 9 October 2022 he proceeded to settle the terms of reference for [NAME]'s forensic investigation: [NAME] [54]-[55]. 15 [NAME] [NAME] gave evidence that although the decision to appoint [NAME] had already been made, for "good governance" the Board was asked to approve [NAME] carrying out the investigation: [NAME] [56]. That approval came by way of a circular resolution, which [NAME] [NAME] drafted and emailed to the Board under a covering email which relevantly stated that "the Board is being asked to confirm the appointment of [NAME]". The email to the Board is extracted at [NAME] [39]. Following feedback from one of the directors on the Board, [NAME] [NAME] revised the circular resolution he had drafted. On 11 October 2022 the Board approved the revised circular resolution. 16 The revised circular resolution as passed (extracted at [NAME] [42]) addressed the nature of the investigation to be undertaken, but it did not expressly state Optus' purpose in appointing [NAME]: [NAME] [57] and [59]. It stated: [COMPANY] [PHONE] CIRCULATING RESOLUTION OF THE DIRECTORS UNDER RULE 2 OF CONSTITUTION AND SECTION 248A OF THE CORPORATIONS ACT [POSTCODE] ([NAME]) We, being all the directors of [COMPANY] ('Optus') entitled to receive notice of a board meeting and to vote on the resolution, are in favour of the resolution set out below. The resolution is passed by the directors without a board meeting on the date and at the time when the last director signs. APPOINTMENT OF [NAME] TO INVESTIGATE CYBERATTACK The directors of Optus NOTE the following: (a) on or around 22 September 2022 the directors were informed that Optus had been the subject of a cyberattack which involved unauthorised access to [NAME] and [NAME] customers' [NAME] ('Cyberattack'); (b) the directors have requested the appointment of [NAME] to conduct independent external forensic reviews of the circumstances surrounding the Cyberattack having regard to the Optus Board's delegation framework and with the [NAME] of the [NAME]; (c) [NAME] has commenced aspects of its reviews; and (d) on [NAME] 7 October 2022 a media release by [NAME] announced it had lodged a formal complaint with the [NAME] (at the time of this resolution, no formal notification of this complaint has been received by Optus). The directors of Optus RESOLVE: (a) that [NAME] be appointed to undertake independent external forensic reviews of the Cyberattack, including: 1. to identify the circumstances and root causes leading to the Cyberattack; 2. to review Optus's management of cyber risk in the context of the applicable cyber risk management policies and processes in connection to the Cyberattack; and 3. to review the Cyberattack incident response, and the appropriateness of actions taken, having regard to the existing crisis management policies and procedures; and (b) that, in relation to the reviews, Optus management be requested to report back to the Board, and in accordance with the Optus delegation framework. 17 The relevant change between the initial circular resolution drafted by [NAME] [NAME], and the revised circular resolution subsequently passed by the Board, was an alteration to the words in subpara (b) at the end of the resolution: [NAME] [57] and [59]. Before the revision subpara (b) read as follows: (b) to delegate finalising the scope and terms of the [NAME] reviews, provided they are not materially different to those above, to the Optus CEO and the [NAME] and to request they report back to the Board once the reviews are sufficiently progressed. 18 On 17 October 2022, [NAME] [NAME] instructed [NAME] to engage [NAME] to undertake the external investigation in line with the Board resolution of 11 October 2022: [NAME] [60]. 19 On 21 October 2022, [NAME] formally engaged [NAME] with [NAME] sending [NAME] a formal letter of engagement (extracted in part at [NAME] [48]) ([NAME]): [NAME] [61]. 20 Also on 21 October 2022, [NAME] [NAME] sent a letter to [NAME] in the following terms: [NAME] [62]. [NAME] We refer to your recent correspondence with [NAME[NAME], and the engagement letter (including the attached Standard Terms and Conditions) between [NAME[NAME] and [NAME] ([NAME]) dated 21 October 2022 (Engagement Letter). Capitalised terms in this letter have the same meaning as in those engagement letters, unless otherwise stated. We confirm that we have instructed [NAME[NAME] to engage [NAME] on behalf of [COMPANY] (Optus), in connection with the recent Cybersecurity Incident, pursuant to [NAME]'s engagement advising Optus. Optus acknowledges and agrees that [NAME] will provide the services under the Engagement Letters on the condition that Optus will be bound by the terms of the Engagement Letters as if it were an Addressee of the Engagement Letter. Optus further acknowledges and agrees that: (a) it will use its best endeavours to comply with the reasonable requests, suggestions and directions of [NAME] for the efficient conduct of the engagements; (b) where relevant it will obtain the necessary written authorisations from their [COMPANY] / [NAME] Party Hosting provider(s), for [NAME] to conduct testing against the Optus owned applications/infrastructure on Optus's behalf; (c) where relevant it will provide [NAME] details of any critical or fragile systems which should not be included in security testing activities and must inform [NAME] of any critical periods where testing should not be undertaken; (d) it is, and will continue to be, solely responsible for: • Establishing, maintaining and enforcing appropriate procedures and associated access controls and other technology measures over its systems and operations, including without limitation, systems designed to achieve its control objectives, financial reporting, monitoring of ongoing activities and systems designed to achieve compliance with applicable laws and regulations. • Providing in a timely manner all network, environment, programs, [NAME], and data as required by [NAME] to perform the Services and its obligation under the Terms. • [NAME] in a timely manner of any need to change the testing schedule. • Obtaining all necessary authorisations and consent from any [NAME] parties that may be directly affected by this engagement of [NAME]'s activities. • Taking the necessary precautionary steps to ensure that vulnerability testing (if performed) will not, or will not be likely to, interfere with the functioning or availability of Optus systems prior to the testing commencing. Such steps should include but may not be [COMPANY] to: a. Preparing backups of all data, configurations, programs, networks and systems which could be exposed to the vulnerability testing, to enable your staff to restore your systems to the state in which they were prior to the vulnerability testing. b. Updating and patching systems in accordance with [NAME] manufacturer and vendor recommendations. c. Having your [NAME] available during the vulnerability testing. • Designating a [NAME] with substantial computer systems, network and project management experience, preferably within senior management, to act as a point of contact for [NAME]. In the event that vulnerability testing is undertaken Optus represents and warrants that: (a) any IP addresses provided to [NAME] for vulnerability testing are owned by, or licensed to, and used exclusively by Optus (b) any access or use of Optus network, environment, programs, [NAME] (including but not [COMPANY] to personal [NAME] as defined under the Privacy Act 1988 ([NAME])) and data as required to perform the Services will not: • constitute unauthorised access or otherwise breach the Terms; or • contravene the Criminal Code Act 1995 ([NAME]), the Crimes Act 1900 (NSW) and equivalent State or Territory legislation. Optus further acknowledges that it may only use [NAME]'s Work for the Purpose as set out in the Engagement Letters and that any use of or reliance on [NAME]'s Work that is contrary to the terms of the Engagement Letter may expose [NAME] to a claim from someone with whom they have no relationship of whose interests [NAME] has not considered in providing the Services. Optus agrees that it will indemnify [NAME] (the [NAME]), in each case in respect of the specific engagement entered into by the [NAME], for: (a) any reasonable costs or expense that the [NAME] may incur in complying with any subpoena or request to produce its files or to provide evidence in respect of its Work. This indemnity does not apply to the extent that such costs are paid by the party making the request; and (b) any Loss that the [NAME] may suffer or incur in respect of any claim or action by a [NAME] party that arises as a result of: (i) any use or distribution of, or reliance on, the [NAME]'s Work that is contrary to the terms of the applicable engagement letter or a Consent; or (ii) any access to or use of the [NAME]'s Work, by any of Optus' Professional Advisers or Auditor. This indemnity in (b) does not apply to any Loss incurred in defending a claim or action by a [NAME] party: (iii) that results from any wilful misconduct or fraudulent act or omission by the [NAME]; (iv) where that [NAME] party has signed an agreement with the [NAME] that provides that it can rely on the [NAME]'s work; or (v) where the [NAME] has agreed in writing that its Work may be included in publicly available documents. Please do not hesitate to contact me should you have any queries or concerns regarding this letter. Yours sincerely [NAME] 21 On 25 October 2022, [NAME] provided [NAME] with a [NAME] guidance note on privilege, a privilege protocol for the engagement and a non-disclosure agreement to be signed by each member of the "[NAME] team": [NAME] [63]. The first part of the protocol (extracted at [NAME] [58]) provided that the purpose of the [NAME] engagement was "to enable [NAME] to provide legal advice to Optus so as to fulfil its obligations and protect its rights in responding to the Cybersecurity Incident." 22 [NAME] [COUNSEL] gave evidence that a representative from Optus Legal and/or [NAME] attended each interview conducted by [NAME] and on 13 July 2023, [NAME] provided its report to [NAME] [NAME] and the partner at [NAME]: [NAME] [64]-[65]. This is the relevant communication for which Optus claims privilege.

Relevant principles 23 The relevant legal principles applicable to Optus' claim for legal professional privilege are not in dispute and were correctly set out by the [NAME] judge at [NAME] [85]-[100]. We adopt the [NAME] judge's following summary of principles. 24 As the dispute relates to pre-trial disclosure, it is to be determined by reference to common law principles: [NAME] [85]. At common law, legal professional privilege applies to confidential communications made for the dominant purpose of the client obtaining legal advice or for use in litigation or regulatory investigations or proceedings. The protection is confined to confidential communications made for the dominant purpose of giving or obtaining (including preparation for obtaining) legal advice or the provision of legal services, including legal representation in litigation or other proceedings: [NAME] [87]. 25 The purpose for which a document was created is a matter of fact to be determined objectively, having regard to the evidence, the nature of the document, and the parties' submissions. Dominant purpose may be established by evidence and other material and circumstances showing such a description is justified. Proof of dominant purpose can be achieved in a variety of ways depending on the case at hand. In discharging that onus, focused and specific evidence is needed. But the nature and extent of the evidence needed to prove the existence of privilege is fact and circumstance dependent: [NAME] [89]. 26 The evidence of the intention of the person who made the document, or the person who authorised or procured it, is not conclusive of purpose. In many instances, it is the character of the documents over which privilege is asserted that will illuminate the purpose for which they were created: [NAME] [90]. 27 It is not sufficient to show a substantial purpose or that the privileged purpose is one of two or more purposes of equal weighting; rather it must be predominant and be the paramount or most influential purpose. The ordinary meaning of dominant purpose indicates the need for a ruling, prevailing or most influential purpose: [NAME] [91]. 28 In addition to the [NAME] judge's summary of relevant principles we would add the following. 29 In [NAME] v Commissioner of Taxation [2019] HCA 26; 265 CLR 646 at [30], the High Court noted the importance of confining legal professional privilege "within strict limits". One of those limits is to be seen in the requirement that a party claiming privilege satisfy the court of its purpose. The quality and precision of the evidence adduced in [NAME] of a claim for privilege is relevant, and dominance of purpose is not established by bare ipse dixit. [ADDRESS] of this Court in Kennedy v Wallace [2004] FCAFC 337; 142 FCR 185 at [4],[7],[14], [38] and [44] ([NAME] and [NAME]) noted that it is open to a trial judge having regard to the way in which a case is conducted to reject, or to accord [COMPANY] weight, to assertions of a witness testifying that documents were for a privileged purpose. In that case, notwithstanding the subjective evidence of the person who created the document, the evidence of surrounding circumstances demonstrated the presence of such significant non-legal purposes that there was insufficient evidence to satisfy the Court that the legal purpose was dominant. 31 In [NAME] v Commissioner of Taxation ([NAME]) [2007] FCAFC 88; 242 ALR 601 the [ADDRESS] cited [NAME] with approval and emphasised at [18] the need for "focused and specific evidence in order to ground a claim for legal professional privilege", and then went on to say that "[t]he fact that generalised evidence is not challenged in cross-examination does not mean that such evidence must be accepted, particularly when it is as manifestly inadequate as it is in this case…Simply to show that one purpose for creation of the document was to obtain legal advice or assistance is not good enough." 32 A court is not obliged to accept evidence of state of mind merely because it is asserted, and nor is it obliged to find evidence to be persuasive irrespective as to challenge by cross-examination, particularly where it is contradicted by facts otherwise established by contemporaneous material: [COMPANY] v [NAME] (1975) 132 CLR 362 at 370 – 371 ([NAME], with whom [NAME] agreed, and [NAME] J generally agreed), or "the particular circumstances point to its rejection": Ashby v Slipper [2014] FCAFC 15; 219 FCR 322 at [77] (Mansfield and Gilmour JJ).

Applicants submissions

Proposed Appeal Grounds 1, 3 and 4 33 Optus submits that despite [NAME] [NAME] evidence supporting the privilege claim, the respondents made the "calculated forensic" choice not to cross-examine him, no doubt wary that to do so may strengthen Optus' position: [NAME] v Commissioner of the [NAME] Federal Police [2020] NSWCA 247; 103 NSWLR 509 at [72]-[75] ([NAME], [NAME] and [NAME] agreeing). 34 Optus argues that this choice had consequences. It said that the respondents' choice constrained the submissions which could properly be put and the findings which were open to the [NAME] judge: [NAME] v [COMPANY[NAME] [COMPANY] [2011] HCA 11; 243 CLR 361 at [67]. It contends that according to [NAME] the [NAME] judge could not make critical comments of [NAME] as they had not been put to him. It notes that, as a [NAME] rule, unchallenged evidence ought to be accepted unless it is inherently incredible or contradicted by facts otherwise established on the evidence: [NAME] at 370 - 371. On its argument this rule applies a fortiori when the findings concern the integrity of a non-party solicitor such as [NAME] [COUNSEL]: [COUNSEL] at [77] and [141]-[142]. It says that the [NAME] rule exists for good reason, as it is necessary to provide a witness with the opportunity of offering an explanation before "it is suggested that the story he tells ought not be believed": Browne v Dunn (1893) 6 R 67; 1 WLUK 44 at [70]-[71]. 35 On Optus' submissions the [NAME] judge fell afoul of these principles in going so far as to find that [NAME] [NAME] evidence "involved an element of reconstruction": [NAME] [165], that his evidence on critical matters was "decidedly and no doubt self-advisedly vague": [NAME] [83], and "less than transparent": [NAME] [158], that if Optus' purpose had really been as [NAME] [NAME] attested it was, [NAME] [NAME] would have drafted the Board circular resolution and covering email to the Board differently: [NAME] [165], and that subsequent documents, consistent with the purpose attested to by [NAME] [NAME] such as [NAME]'s actual retainer and [NAME]' correspondence in response, were part of "endeavours to cloak the [NAME] review with legal professional privilege": [NAME] [164]. It submits that these findings were central to the [NAME] judge's reasons for rejecting or discounting [NAME]'s unchallenged evidence, and that those findings were not open given that [NAME] [NAME] had not been afforded an opportunity to respond to them: [NAME] at [67]. 36 Optus argues that an inference that Optus' CEO's true or dominant purpose was contained in a 3 October 2022 media release (extracted above) was fundamental to the [NAME] judge's decision that the dominant purpose had not been established: [NAME] [29]. It contends that this involved the following errors: (a) First, it involved rejecting [NAME] [NAME] unchallenged evidence of the discussions he had with management, including the CEO, in which it was effectively agreed to appoint [NAME] "to assist [[NAME] [NAME]] and [NAME] to give legal advice and manage the legal risk": [NAME] [50]; (b) [NAME], in drawing the inference as to the CEO's purpose, the [NAME] judge drew a [NAME] (1959) 101 CLR 298 inference against Optus for not calling direct evidence. Optus submits that such an adverse inference was not available as Optus was not required to call the CEO on an interlocutory application in circumstances where Optus' [NAME] had given direct evidence of the conversations he had with the CEO about the reasons for engaging [NAME], which was not challenged in cross-examination; (c) [NAME], the [NAME] judge's finding as to the CEO's purpose rested upon the premise that the 3 October 2022 media release would naturally reveal all of the CEO's purposes for agreeing to engage [NAME], and his finding that it was "the best evidence that I have to illuminate her purpose": [NAME] [127], such that it was significant that a legal purpose was not mentioned. Optus submits that the "best evidence" the [NAME] judge had as to the CEO's dominant purpose was in the non-public conversations the CEO had, as addressed in [NAME] [NAME] unchallenged evidence which supported the requisite dominant purpose. 37 Optus contends that the [NAME] judge wrongly proceeded on the basis that Optus had three distinct purposes for engaging [NAME], being (i) a legal advice or litigation purpose; (ii) identifying the root cause of the cyber-attack for management purposes and rectification; and (iii) the purpose of more generally reviewing Optus' management of the cyber risk in relation to making changes to its policies and processes: [NAME] [120]-[123]. It says that those purposes were not discrete as its need for legal advice and services in relation to item (i) concerned the root cause of the cyber-attack and appropriate rectification in item (ii) and the review of management and changes in (iii). 38 It says that the authorities recognise that as privilege is a fundamental right, it should not be undermined by an overly narrow or technical approach, and that the concept of legal advice extends to what should prudently and sensibly be done in the relevant legal context: [NAME] v [NAME] Immigration, Citizenship, Migrant Services and Multicultural Affairs [2020] FCAFC 181; 283 FCR 299 at [62]; [COMPANY] v [NAME] (No 5) [2006] FCA 1234; 155 FCR 30 at [44]. 39 Optus also submits that the [NAME] judge erred by giving weight to the fact that the Board's circular resolution of 11 October 2022 did not record the legal purpose ([NAME] [43]), when that resolution is of little moment as it merely "confirmed" management's decision to appoint [NAME]. And, in accordance with [NAME] [NAME] unchallenged evidence that decision was made for the purpose of enabling Optus to receive advice and legal services. The resolution simply approved the scope of [NAME]'s investigation and report without specifying Optus' purpose for seeking the report.

Proposed Appeal Ground 2 – Assessing purpose before privilege communication 40 Optus submits that the [NAME] judge's errors were compounded by his assessing Optus' dominant purpose at the wrong time. The [NAME] judge assessed the dominant purpose for which the [NAME] was brought into existence as at the time of the 3 October 2022 media release or 11 October 2022 when the Board's circular resolution confirmed [NAME]'s engagement: [NAME] [135] and [161]. 41 It contends that the [NAME] rule is that 'purpose' is to be assessed at the time that a communication is made, which in the case of a written communication is when the document came into existence, being in this case, 13 July 2023. It argues that the significance of the [NAME] judge adopting the wrong dates is that it caused an improper focus upon evidence the [NAME] judge found did not [NAME] the asserted dominant purpose, being the 3 October 2022 media release and the circular Board resolution. Thus, the [NAME] judge found the form of the later main retainer letter could not change the earlier formed dominant purpose at 3 or 11 October 2022: [NAME] [161].

Proposed Appeal Ground 5 – Wrong decision maker 42 On Optus' submissions, the [NAME] judge also erred by concluding that the appropriate decision makers for the purpose of the dominant purpose test included the Optus CEO and/or the Board: [NAME] [129]. 43 It contends that where a corporation claims legal professional privilege, it is the corporation's mind and purpose that is relevant. It says that the corporation's employees' state of mind may be attributed to it and where the communication in question is a document, the person whose purpose is relevant will generally be the person who either created the document or caused the document to be created. In this case, Optus submits that the Board's role was not such that it could be said to be the person who caused the creation of the [NAME], as the Board confirmed an earlier decision made by management. 44 Optus says that, technically, it was [NAME] which retained [NAME] and the evidence demonstrates that [NAME]'s purpose in doing so was to enable it to advise Optus pursuant to its retainer. Optus submits that it is also clear that amongst Optus' management, from beginning to end, [NAME] [NAME] was the driving force for engaging [NAME]. Optus submits that if anyone within Optus management could speak to the corporation's mind concerning the [NAME], it was [NAME] [NAME]. It notes that [NAME] [NAME] did so, and his evidence was not challenged.

Leave to Appeal 45 Optus submits that the judgment at first instance is attended with sufficient doubt to warrant the grant of leave and the appeal on each of the grounds advanced should be allowed. In addition, it contends that a determination by the [ADDRESS] on Ground 3 would provide appellate authority on an issue on which the decision in [COMPANY] v [NAME] Commission [2022] FCA 208; 401 ALR 143 conflicts with the [NAME] judge's reasons. Finally, it argues that although the case involves questions of practice and procedure, its outcome determines important substantive rights and as such, the restraints to which an appeal court might otherwise submit itself should not be rigidly applied: [NAME] v [COMPANY] (in liq) [2018] NSWCA 205; 98 NSWLR 493; 364 ALR 554; 130 ACSR 475 at [8].

Consideration 46 For the reasons that follow, the [NAME] judge's judgment is not attended with sufficient doubt to warrant a grant of leave to appeal. Moreover, in our opinion, the [NAME] judge was correct to find on the evidence that there were multiple purposes for which the [NAME] was commissioned and that the evidence did not establish that the [NAME] was procured for the dominant purpose of Optus obtaining legal advice or for use in litigation or regulatory proceedings.

Proposed Appeal Grounds 1, 3, 4 & 5 – Dominant purpose 47 Central to Optus' argument is that the [NAME] judge should have found that the affidavit evidence of Optus' [NAME], [NAME] [COUNSEL], was conclusive on the question of dominant purpose. The [NAME] judge carefully considered the evidence of [NAME] as being one of the relevant minds but nevertheless found, on the totality of the evidence, that his state of mind and conduct was only part of the analysis. The [NAME] judge found, correctly, that the states of mind of the CEO and the other board members were, on the evidence, also highly relevant to ascertaining the state of mind of Optus given Optus' multiple purposes for procuring the [NAME]. The [NAME] judge also, correctly, examined [NAME] documents and drew appropriate inferences from a consideration of the evidence as a whole. 48 The [NAME] judge found that Optus had multiple purposes including: (i) a legal advice or litigation or regulatory proceeding purpose; (ii) a purpose more generally to identify the circumstances and root causes of the cyber-attack for management purposes; (iii) a purpose of reviewing Optus management's policies and processes in relation to cyber risk: [NAME] [120]-[123]. 49 Before the [NAME] judge, Optus did not dispute that the non-privileged purposes in items (ii) and (iii) above existed, but it did not adduce "focused and specific evidence" ([NAME] at [18]) to establish that the legal purpose under item (i) was the dominant purpose. The [NAME] judge found, correctly in our view, that Optus failed to discharge its onus to show that the legal purpose was dominant: [NAME] [3] and [167]. 50 In large part that is because: (a) Optus adduced little evidence as to the predominance of the legal purpose for procuring the [NAME] against a background where there existed non-legal purposes; and (b) [NAME] [NAME] evidence did not address or even acknowledge the existence of the non-legal purposes shown by the evidence, nor explain or attempt to contextualise the non-legal purposes as opposed to the legal purpose and thereby establish that the legal purpose was Optus' dominant purpose. 51 In particular, [NAME] [NAME] did not explain or contextualise the non-legal purposes averted to by Optus' media release of 3 October 2022 (extracted above at [13]), which said that [NAME] [NAME], Optus' CEO, had recommended the [NAME] review which had been "supported unanimously by the [NAME]". The release described the proposed [NAME] investigation as an "independent external review of the recent cyber-attack, and [Optus'] security systems, controls and purposes". The media release attributed the following to the CEO: This review will help ensure we understand how [the cyber-attack] occurred and how we can prevent it from occurring again. It will help inform the response to the incident for Optus. This may also help others in the public and private sector where sensitive data is held and risk of cyberattack exists. I am committed to rebuilding trust with our customers and this important process will assist those efforts. : [NAME] [29]-[32], [124]-[126]. 52 Those non-legal purposes for undertaking the [NAME] review were also referred to in the revised circular resolution passed by the Board on 11 October 2022 (extracted above at [16]): [NAME] [38]-[43], [147]-[157], which said: The directors of Optus RESOLVE: (a) that [NAME] be appointed to undertake independent external forensic reviews of the Cyberattack, including: 1. to identify the circumstances and root causes leading to the Cyberattack; 2. to review Optus's management of cyber risk in the context of the applicable cyber risk management policies and processes in connection to the Cyberattack; and 3. to review the Cyberattack incident response, and the appropriateness of actions taken, having regard to the existing crisis management policies and procedures. 53 The [NAME] judge was correct to find that the totality of the evidence did not indicate that [NAME] [NAME] state of mind was determinative: [NAME] [129]-[133]. Based on Optus' own media release, it was the CEO who recommended the [NAME] review to the Board, which supported her recommendation. [NAME] [NAME] was a recommender to the recommender in relation to the proposed investigation, with a particular legal focus, and the evidence showed the existence of other purposes. Essentially, [NAME] held that simply to show that one purpose for the creation of the [NAME] was so that Optus could obtain legal advice or assistance was not good enough. 54 To determine whether the evidence established that the legal purpose under item (i) set out above in paragraph 48 was the dominant purpose, the [NAME] judge was required to consider the objective probabilities on the totality of the evidence, having proper regard to both what Optus' affidavit evidence said and what it did not say or explain. The [NAME] judge undertook this task with particular care as is evident from his analysis: [NAME] [119]-[167]. 55 We do not accept Optus' submission that the [NAME] judge was bound to give overwhelming significance to [NAME]'s frame of mind for the purpose of establishing that the legal purpose was the dominant purpose, nor bound to accept the unchallenged evidence of [NAME]. [NAME]'s evidence was, as the [NAME] judge said, only part of the necessary analysis: [NAME] [129]-[133]. In particular, the [NAME] judge: (a) acknowledged that [NAME] had a personal concern that the cyber-attack was likely to result in regulatory investigations and litigation and took various steps to address those risks ([NAME] [7]-[23], [45]-[47], [70]-[72], [76], [102]-[104]), taking note of the evidence in relation to [NAME] [NAME] roles and responsibilities, but also noting that his evidence often did not identify what role he was acting in, Company Secretary or [NAME], when taking certain actions: [NAME] [66]-[69], [82]; (b) took into account that [NAME] [NAME] subjectively wanted [NAME] to undertake the investigation for legal purposes, and always intended for [NAME] to be appointed by lawyers: [NAME] [74]-[75]; and (c) considered [NAME] [NAME] evidence of discussions with the CEO and other senior managers about the need for an independent review into the cyber-attack and how [NAME] was identified as a consultant to carry out a forensic investigation, but found that this evidence was "pregnant with imprecision" and had a "superficial" quality including because it was unclear who had proposed [NAME] and when. These were findings which were open to the [NAME] judge to make: [NAME] [24]-[28], [105], [111]-[112], [131]-[132]. 56 Optus seeks to make too much out of [NAME] [NAME] evidence regarding his discussions with the CEO and other senior managers. Everything that he said about any discussions he had with the CEO and other senior managers was in two paragraphs of his affidavit, where he said the following ([NAME] [50], [52]): As I stated above, Optus was considering a range of investigations and in the context of that consideration [NAME] had been proposed to assist Optus in carrying out an investigation into the Cyber-attack and Optus' response. I had various discussions with members of the senior management team at Optus [there setting out the names and titles of the CEO and relevant senior managers] as to how we could best utilise [NAME]'s expertise to assist me and [NAME] to give legal advice and manage the legal risk. We ultimately landed on [NAME] carrying out a forensic investigation into the root cause of the Cyber-attack and Optus' response to it. … Based on these discussions, we recommended to the [NAME] that [NAME] be engaged to carry out a forensic investigation into the Cyber-attack and Optus' response to it, which would assist me, my team and [COUNSEL] (and counsel briefed by [COUNSEL]) in advising Optus in relation to the multiple legal risks and matters arising from the Cyber-attack as I have explained above. 57 That evidence confirmed [NAME] [NAME] purpose, and his evidence overall indicates that from the outset he was concerned to obtain a report from [NAME] to assist him, his legal team, [COUNSEL] and counsel briefed by [COUNSEL] to provide advice in relation to the litigation and regulatory investigation risks he perceived. Nothing in the evidence indicates that his purpose changed. But [NAME] [NAME] evidence as to those discussions is both [NAME] and vague. For example, he did not say when or where those discussions took place, he did not say whether they were joint discussions, or whether he met individually with the CEO and the senior managers. In particular, he did not say anything about the other reasons for the investigation which the CEO publicly said existed in the media release, or which the Board had recorded in the circular resolution confirming [NAME]'s appointments, nor did he say anything as to whether he was aware from any of the other senior Optus managers he spoke to that they wanted [NAME] from [NAME]'s investigation for other reasons. 58 Nor did he expressly state that the [NAME] or dominant purpose of the CEO or the senior managers he spoke to for procuring the [NAME] was the legal purpose. The highest his evidence went was to say that based on those discussions "we" recommended that [NAME] be engaged "which would assist me, my team and [COUNSEL] (and counsel briefed by [COUNSEL]) in advising Optus in relation to the multiple legal risks and matters arising from the Cyber-attack" (emphasis added). We can accept that the CEO and other senior managers might expect that the proposed report by [NAME] would assist [NAME] [COUNSEL], his team, [COUNSEL] and counsel to provide legal advice, but in circumstances where the evidence showed multiple purposes that evidence was inadequate to show that that the legal purpose was Optus' dominant purpose. It would have been straightforward for [NAME] [NAME] to explain that in the discussions to which he referred it had been decided that the non-legal purposes expressed by the CEO and by the Board had either become subsidiary or had fallen away, but he did not. We cannot accept the submission of [NAME] [COUNSEL], [NAME] for Optus, that while [NAME] [COUNSEL] affidavit did not engage in "the New South Wales fetish of direct speech", his evidence "perfectly clearly" summarises the discussions [NAME] had. That is simply not the case. 59 As the [NAME] judge found, the words attributed to the CEO in the 3 October 2022 media release "manifested a dominant purpose which was other than a legal advice or litigation purpose" ([NAME] [79]), yet [NAME] [NAME] did not explain or contextualise those non-legal purposes as opposed to his legal purpose, let alone give "focused and specific evidence" in that regard so to prove that the legal purpose was Optus' dominant purpose. 60 The [NAME] judge's analysis took into account other contemporaneous documentary evidence and inferences that arose from the evidence as a whole. These included that the [NAME] judge: (a) gave detailed consideration to Optus' public statements in relation to [NAME]'s investigation between 3 October 2022 and 9 March 2023, including specific words attributed to the CEO in the 3 October 2022 media release: [NAME] [29]-[33], [56]-[57], [63]-[64], [116]-[117]. [NAME] concluded, correctly in our view, that [NAME]'s statements that: (i) "the forensic review would play a crucial role in the response to the incident for Optus, as it works to [NAME] customers"; (ii) "…we are determined to find out what went wrong. This review will help ensure we understand how it occurred, and how we can prevent it from occurring again. It will help inform the response to the incident for Optus…"; and (iii) "I am committed to rebuilding trust with our customers and this important process will assist those efforts"; did not suggest a dominant legal purpose, but did suggest that the dominant purpose in the mind of [NAME] [NAME] [NAME] and the Board was not a defensive legal or litigation strategy but to "identify the cause of what occurred so that rectification steps could be carried out to prevent a recurrence": [NAME] [124]-[126], [137]-[138]; (b) carefully considered the terms of the draft and final resolutions confirming the engagement of [NAME] and the history of the amendments to the resolution drafted by [NAME] [NAME] which resulted in the deletion of the draft term which would have delegated power over the report to [NAME] [NAME], and instead required all Optus management to report to the Board in relation to [NAME]'s "reviews", for which there was "no explanation": [NAME] [38]-[43], [147]-[150], [158] and [165]; (c) gave detailed consideration to the communications between [NAME] [NAME] and the Board around that time, including where [NAME] [NAME] described [NAME]'s appointment by reference to the announcement and without reference to a legal purpose: [NAME] [38]-[43], [147]-[150] and [165]; and (d) considered the fact that [NAME] had already commenced work before the [NAME] engagement letter of 21 October 2022 was issued in circumstances where it was not clear that that work was being done under the auspices of [NAME]: [NAME] [157]-[164]. 61 The [NAME] judge took into account, correctly in our view, that no evidence was given directly by the CEO, or the Board members, concerning the purpose of the investigation and said that Optus' failure to adduce evidence from its CEO fortified the conclusion that Optus had not established that the legal purpose for the investigation was the dominant purpose: [NAME] [139]. In [NAME] v [NAME] (Privilege) [2016] NSWSC 12 at [7], [NAME] J emphasised the need for a party claiming privilege to do so by admissible direct evidence, not hearsay. [NAME] said: To sustain a claim of privilege, the claimant must not merely assert it; but must prove the facts that establish that it is properly made. Thus a mere sworn assertion that the documents are privileged does not suffice, because it is an inadmissible assertion of law; the claimant must set out the facts from which the court can see that the assertion is rightly made, or in other words "expose … facts from which the [court] would have been able to make an informed decision as to whether the claim was supportable". The evidence must reveal the relevant characteristics of each document in respect of which privilege is claimed, and must do so by admissible direct evidence, not hearsay. (Emphasis added. Footnotes omitted.) 62 That passage has been cited with approval in [NAME] v [NAME[NAME] [2019] FCA 1101 at [54], [63] (White J); [NAME] v [COMPANY] (No 2) [2019] FCA 1322 at [8] ([NAME] J); [NAME] v [NAME] [NAME] [NAME] [2020] FCA 984 at [24] ([NAME] J); Attorney-[NAME] (NSW) v [COMPANY] [2020] NSWCA 40; 102 NSWLR 47; 380 ALR 1 at [76] ([NAME], [NAME] JA); and [NAME] Commission v [COMPANY] [COMPANY] [2020] FCA 1277; 148 ACSR 1 at [42] (O'Callaghan J). 63 Here, not only did Optus not put on direct evidence from [NAME] or any Board member, [NAME]'s evidence did not even provide hearsay evidence, on the basis of [NAME] and belief, as to [NAME] [NAME] state of mind, or as to the state of mind of the Board members to the extent that he talked to them. Such evidence would have been admissible: s 75 of the Evidence Act 1995 ([NAME]). Evidence as to their state of mind was critically relevant once it is appreciated that the media release and the circular resolution showed the existence of non-legal purposes for procuring the [NAME]. 64 Optus' submission that no [NAME] inference could be drawn must be rejected. First, a [NAME] inference can be drawn in the context of a parties' claim for privilege: [COMPANY] at [48]-[49]; Perry v [NAME] [COMPANY] [2011] VSC 308 at [72] (Robson J); [NAME] [COMPANY] v Perry [2011] VSCA 239; 33 VR 548 at [26]-[28] (Warren CJ, [NAME]). There was evidence before [NAME] as to a multiplicity of purposes for commissioning the [NAME]. The media release showed that [NAME] [NAME] [NAME] had recommended its commissioning and had expressed non-legal purposes for doing so, and the Board had unanimously agreed with that recommendation. Optus had the burden of establishing that the legal purpose was the dominant purpose for which the [NAME] was commissioned and therefore [NAME] [NAME] [NAME]'s purpose was of considerable importance. The applicants' failure to call her to give evidence was bound to be regarded as significant. 65 [NAME], Optus' contention that it was not open to draw a [NAME] inference when [NAME] [NAME] had provided "direct evidence of conversations he had with the CEO about the reasons for engaging [NAME]" must be rejected. As we have said, the only evidence [NAME] [NAME] gave as to his discussions with [NAME] [NAME] [NAME] was in [50] and [52] of his affidavit (extracted above at [56]) in which he said he had discussions with her and other senior managers "as to how we could best utilise [NAME]'s expertise to assist me and [NAME] to give legal advice and manage the legal risk". That primarily spoke to his purpose for obtaining the [NAME], and he did not say anything about [NAME] [NAME] [NAME]'s non-legal purposes, or what she said at the time, so as to establish that the legal purpose was Optus' dominant purpose. The [NAME] judge did not err in using [NAME] to more readily infer that her evidence would not have assisted Optus' claim for privilege. Nor, contrary to Optus' submissions, did the [NAME] judge err in finding that the best evidence of [NAME]'s purpose was what she said in the 3 October 2022 media release. 66 The [NAME] judge was not obliged to treat [NAME]'s evidence as determinative regarding the purpose of the [NAME] merely because he was not cross-examined on that evidence. Optus' repeated submission that his evidence was 'unchallenged' and must be accepted is misconceived. It may, depending on the particular circumstances of a case, be "wrong, unreasonable or perverse" to reject unchallenged evidence, and such an error may be a basis for overturning a decision, but there is no rule of law that a court must accept unchallenged evidence: [NAME] at [78] citing [NAME] v [COMPANY] (1989) 17 NSWLR 553 at 587-588 (Samuels JA). The fact that generalised evidence is not challenged in cross-examination does not mean that such evidence must be accepted, particularly when it is inadequate and the totality of the evidence points to its rejection, as it did in this case. 67 The [NAME] judge found that [NAME]'s evidence neither had the requisite quality of precision in relation to what it did address, nor did it address contemporaneous documents which pointed in the opposite direction, such as the 3 October 2022 media release, and that [NAME] [NAME] evidence did not establish that the legal purpose of which [NAME] [NAME] gave evidence was Optus' dominant purpose. Those were findings which were open to the [NAME] judge. That was so because [NAME]'s evidence had the deficiencies set out at paragraphs 57 to 58 above. 68 A proper consideration of the [NAME] judge's analysis reveals that it was open to the [NAME] judge to find that [NAME]'s evidence was vague, generalised, and ambiguous in key respects. 69 Faced with an absence of evidence from Optus on critical matters upon which it bore the onus, the [NAME] judge did not err in: (a) finding that the relevant state of mind to attribute to Optus was referable to Optus' CEO, and the other Board members, as well as [NAME] [NAME]: [NAME] [128]-[133]; or (b) relying upon evidence not adduced by Optus in seeking to determine the subjective purpose held by Optus' CEO, and the Board: [NAME] [120]-[127], [137]-[138] as viewed within the context of all the circumstances which the [NAME] judge set out in detail: [NAME] [140]-[164]. 70 Much of Optus' submissions were devoted to the contention that the [NAME] judge had improperly criticised [NAME]'s evidence in circumstances where none of those matters had been put to him, and that [NAME] had erred by making findings of misleading behaviour by [NAME] [NAME], in an attempt to bolster its argument that the [NAME] judge erred in not accepting his unchallenged evidence. In this regard Optus principally relied on the [NAME] judge's remarks that: (a) critical aspects of [NAME]'s evidence were "decidedly and no doubt self- advisedly vague": [NAME] [83]; (b) [NAME] [NAME] made "vague statements on matters of significance" which justified giving them reduced weight: [NAME] [127]; (c) "I am fortified in my analysis by the vagueness in how [NAME] [NAME] expressed himself in his evidence": [NAME] [131]; (d) [NAME] [NAME] explanation for the amendment to the circular resolution was "less than transparent": [NAME] [158]; (e) "Clearly, endeavours to cloak the [NAME] review with legal professional privilege were more to the fore in late October 2022 than they were at the start of the month.": [NAME] [164]; and (f) "I cannot help thinking that if the dominant purpose of Optus was as [NAME] [NAME] now says it is, he would not have drafted his 9 October 2022 email or the draft or final resolutions on 9 and 11 October 2022 respectively as they were expressed…To some degree this is speculation, but I have an uncomfortable sense that important aspects of [NAME] [NAME] affidavit concerning the time-frame prior to mid-October 2022 has involved an element of reconstruction": [NAME] [165]. 71 [NAME] for Optus submits that one of the "most disturbing aspects" of the [NAME] judgment is that [NAME] found that the events in late October 2022 constituted an attempt by [NAME] [NAME] to cloak what was not, by then, Optus' dominant purpose of obtaining legal advice with the appearance of a dominant purpose of legal advice. He contends that, as Optus only relied on [NAME] [NAME] evidence, the reference to "endeavours to cloak" must be a reference to [NAME] [NAME] conduct, and it carried the finding that he endeavoured to disguise or mislead the Court as to the true position in relation to Optus' purpose. [NAME] went as far as to submit that: …the importance of [NAME]'s finding is that there must be, in those circumstances then, an initial state of mind, in [[NAME] [NAME] mind], then a change in corporate mind - in the minds of the CEO and the board, being apparently representative of that - and a decision to cloak that by [NAME] [COUNSEL] and, presumably, the board and the CEO, by engaging in modifying the letters of engagement, so that they falsely represent a dominant purpose, which, by then, was not true. 72 Those criticisms of the [NAME] judge's reasons are overstated. 73 First, it should be understood that the respondents did not contend below that [NAME] [NAME] evidence should be disbelieved, or that his evidence showed that he had engaged in misleading behaviour by asserting that Optus' purpose for obtaining the [NAME] was the legal purpose. Their case was that [NAME] [NAME] evidence was insufficient to establish that Optus' dominant purpose for obtaining the [NAME] was the legal purpose. There was no requirement for the [NAME] judge to express any concluded view as to [NAME]'s credit. 74 [NAME], the notion that the [NAME] judge found that [NAME], the CEO and the Board had an initial view, which they then altered, and were each then engaged in an attempt to deceive in relation to Optus' purpose for commissioning the [NAME] is a construction without foundation. The [NAME] judge did not find that. The [NAME] judge was satisfied that [NAME]'s purpose was the legal purpose throughout but, having regard to the evidence that the CEO and the Board had other purposes, his evidence was insufficient for the conclusion that the legal purpose was Optus' dominant purpose. The notion that the CEO and the Board shared [NAME] [NAME] purpose is grounded in [50] and [52] of his affidavit, which evidence is vague and inconclusive, and does not establish that. 75 [NAME], contrary to Optus' submissions, the [NAME] judge's remarks at [NAME] [83], [127], [131] and [158] do not constitute adverse findings as to [NAME] [NAME] credit, integrity or probity. The central thrust of those remarks is that the [NAME] judge found [NAME]'s evidence to be vague in relation to some matters of significance, and that his evidence in relation to the change between the initial and the revised circular resolution was not explained. [NAME] was not there saying that [NAME] had not been candid or had sought to mislead. 76 To determine whether the evidence established that the legal purpose was Optus' dominant purpose the [NAME] judge was required to consider the objective probabilities on the totality of the evidence, having proper regard to both what [NAME] [NAME] evidence said and what he did not say or adequately explain. Having regard to [NAME]'s affidavit, it was open to the [NAME] judge to find that his evidence was vague on important matters and unclear on the matter to which it referred. Indeed, in our view [NAME] was correct in so finding. 77 The situation is a little different in relation to the [NAME] judge's use of the expression "self-advisedly vague": [NAME] [83]. [NAME] for Optus submits that expression steps across the line in [NAME], and says that the [NAME] judge there found that "[NAME] was clearly and deliberately vague about critical aspects of his evidence, which can only mean the dominant purpose, because nothing else was critical. So it's quite clearly, then, an express finding about his credit, and his integrity and his probity." 78 That contention is overblown. [NAME] [COUNSEL] is a solicitor giving evidence in relation to a claim for privilege, and in that sense he can be said to be self-advised. And his evidence in relation to the non-legal purposes expressed by [NAME] [NAME] [NAME] and the [NAME] was vague and inadequate to establish that the legal purpose was Optus' dominant purpose. To the extent that the expression "self-advisedly vague" might be read to carry the implication that [NAME] [NAME] evidence was deliberately vague, we accept that it should not have been said. But it is an exaggeration to describe it as an attack on [NAME]'s credit, integrity and probity when the [NAME] judge clearly accepted [NAME]'s evidence as to his purpose for procuring the [NAME]. The inadequacy in his evidence as found by the [NAME] judge was not in relation to his credibility but that, in circumstances where the evidence showed that [NAME] had multiple purposes, his evidence did not address, or even acknowledge, the existence of the non-legal purposes nor explain or attempt to contextualise the non-legal purposes as opposed to the legal purpose, and thereby prove that the legal purpose was [NAME] dominant purpose. 79 Fourth, Optus' submissions that the [NAME] judge erred in finding that [NAME] had "endeavoured to cloak", or in other words disguise the true position in relation to [NAME] purpose, and that his evidence was a "reconstruction" are centrally based in the [NAME] judge's remarks at [NAME] [164] and [165]. On a fair reading of the [NAME] judge's reasons, those remarks are not findings at all, and they do not have the significance that [NAME] seeks to give them. 80 It is unnecessary for us to summarise the [NAME] judge's reasons, and it suffices to note that [NAME]'s approach to the questions raised by the application was painstakingly thorough and careful. By the time [NAME] got to [NAME] [164] and [165] he had repeatedly explained the basis for his view that, in circumstances where the evidence showed that [NAME] [NAME] [NAME] and the Board had several non-legal purposes for seeking the [NAME], [NAME] [NAME] evidence regarding the legal purpose for the report was inadequate to establish that the legal purpose was Optus' dominant purpose. None of that, or [NAME]'s repeated statements about the inadequacy of [NAME]'s evidence, was based on any finding that [NAME] [NAME] had sought to mislead the Court as to the true position regarding Optus' dominant purpose. 81 At [NAME] [161] [NAME] reiterated his conclusion that he was not satisfied that the legal purpose was Optus' dominant purpose. Then, in something of an addendum, the [NAME] judge said that "[t]wo other points should also be made": [NAME] [163]. [NAME] then made the impugned remarks in the following two paragraphs, [NAME] [164] and [165]. Importantly, [NAME] concluded (at [NAME] [166]) by stating: Now, there has been no cross examination so I cannot make hard findings. On a fair reading of the [NAME] judge's reasons, at [NAME] [164] and [165] [NAME] noted two matters that concerned him about [NAME]'s evidence, but then said, correctly, that in the absence of cross examination he could not make findings in that regard. 82 Optus argues, in reliance on [NAME] at [75], that there was no point in the trial judge mentioning his view as to those parts of [NAME]'s evidence unless it played a role in his decision adverse to [NAME]. We take a different view. First, considered textually we see those remarks as an addendum and far from central to the decision. [NAME], in [NAME] the trial judge did not expressly say that he was not making a finding. Here, [NAME] did. 83 [NAME], the [NAME] judge's remarks in [NAME] [164] and [165] are not material to [NAME]'s conclusion that Optus had not discharged the onus of establishing its claim of privilege. If those criticisms are put to one side, it would remain our view that the [NAME] judge's judgment is not attended with sufficient doubt to warrant the grant of leave. It would remain the case that we consider the [NAME] judge was correct to find that there were multiple purposes for which the [NAME] was commissioned and that the evidence did not establish that it was procured for the dominant purpose of Optus obtaining legal advice or for use in litigation or regulatory proceedings.

Proposed Appeal Ground 2 – The time for assessment of dominant purpose 84 The [NAME] judge held that the relevant time frame for assessing the dominant purpose for which the [NAME] was brought into existence was either on 3 October 2022 when Optus referred to [NAME] being retained on [NAME] [NAME] [NAME]'s recommendation or on or prior to 11 October 2022 when the Board by resolution procured the [NAME] review. [NAME], however, accepted that later events including up to the time when the report was brought into existence and communicated can and should be looked at in assessing purpose, citing Singapore [COMPANY] v Sydney Airports Corporation [2004] NSWSC 380 at [17] to [22] (McDougall J): [NAME] [135]. That part of McDougall J's reasons was not disturbed on appeal in [COMPANY] v Singapore [COMPANY] [2005] NSWCA 47. 85 Optus, by its proposed Ground 2 and in written submissions, argues that the correct time to assess its purpose for procuring the [NAME] is either 21 October 2022 when [NAME] issued [NAME] with its formal engagement letter or 13 July 2023 when [NAME] provided its report to [NAME]. Optus' principal submission is that the [NAME] judge should have assessed its purpose as at 21 October 2022, and it said little in relation to its contention that 13 July 2023 is the relevant date. 86 There is no substance in this proposed ground of appeal. 87 In [NAME] J held that the relevant time for assessing the purpose of a report commissioned by an external solicitor is at the time that the report is commissioned, and also said that did not mean that it was illegitimate to look at anything that occurs after the report is commissioned up until the time when the document is brought into existence. Abraham J cited [NAME] with approval in [NAME] v [COMPANY] (No 23) [2021] FCA 1460; 157 ACSR 438 at [44] and again in [COMPANY] v [NAME] ([COMPANY] [2021] FCA 512 at [79], but did not express a view as to whether events after the commissioning of a report could be relevant in relation to assessing purpose. 88 The proper date upon which to assess purpose will depend upon the particular circumstances of the case. Having said that, it will usually be the case that, where a party has commissioned a report from a [NAME]-party provider the relevant time to assess the party's purpose for doing so will be at the time of commissioning. But that is not to say that evidence as to later events cannot be relevant. For example, the evidence might show that the purpose for the report changed over the period from the commissioning of the report to its provision. In [NAME] Commission v Noumi [2024] FCA 349 the respondent, which claimed privilege over a [NAME] party report it had commissioned, accepted that the purpose for obtaining a report could evolve over time and may extend from the time a report is commissioned up until the time it was brought into existence (at [77]). Shariff J accepted the parties' submissions that the purpose for which the report in that case was procured was to be assessed across the continuum of time leading up to the creation of the report (at [80]). 89 The question as to the proper date upon which to assess Optus' purpose has little significance to the overall outcome having regard to the particular circumstances of this case. 90 First, Optus did not argue before the [NAME] judge that its purpose for procuring the [NAME] should be assessed as at 13 July 2023 when the report was provided to [NAME] [NAME] and [NAME]. It cannot now raise an argument it did not run below without leave of the Court, and it did not seek leave. In any event, Optus said little or nothing to persuade us that 13 July 2023 is the proper date upon which to assess its purpose. In our view, the [NAME] judge did not err in stating that it was "unrealistic" to assess Optus' purpose as at 13 July 2023, as its receipt of the report on that date was a "mechanical output" of the purpose formed in October 2022: [NAME] [134]. 91 [NAME], Optus did not argue before the [NAME] judge that its purpose for procuring the [NAME] changed over time, and it did not make that contention before us. And there is no evidence as to any change in Optus' purpose over time. Thus, whether Optus' purpose is assessed in the period between 3 and 11 October 2022 (as the [NAME] judge found to be appropriate), or as at 21 October 2022 when [NAME] issued the formal engagement letter to [NAME] (as Optus contends is appropriate), Optus' purpose must be the same. The same applies if purpose is to be assessed as at 13 July 2023. 92 Optus, however, contends that if purpose is assessed at 21 October 2022 then it is clear that its dominant purpose is the legal purpose, because [NAME] was formally engaged by [NAME] on that date, and the terms of engagement expressly stated that the purpose of the engagement was so that [NAME] could provide legal advice to Optus. 93 The deficiency in this aspect of Optus' argument is similar to the deficiency with its arguments on the other proposed grounds. [NAME] [NAME] evidence shows that his purpose for requesting an investigation and report by [NAME] was the legal purpose, and there is nothing to show any change in his purpose. He always had the same purpose. However, the evidence shows, and Optus accepted before us, that in fact it had multiple purposes for procuring the [NAME]. In those circumstances, the fact that [NAME] [NAME] took steps to carry into effect his purpose through [NAME] did not establish Optus' dominant purpose. His evidence as to his purpose was just part of the evidence required to be taken into account in determining [NAME] dominant purpose. It was not good enough for [NAME] [NAME] evidence to establish that one of Optus' purpose for procuring the report was the legal purpose. Optus needed to establish that the legal purpose was the dominant purpose, and as the [NAME] judge explained it did not adduce adequate evidence to do so. 94 The [NAME] judge found, correctly in our view, that the [NAME] was commissioned before the formal letter of engagement was issued, and he correctly identified that the purpose of the creation of the [NAME] was formed in the period when Optus' CEO publicly announced the commissioning of the report on 3 October 2022 and the Board resolved to procure the report on 11 October 2022. The relevant timeframe to assess the purpose of commissioning the report was therefore between 3 and 11 October 2022. 95 However, even if, contrary to our view, the appropriate date for determining Optus' purpose in procuring an investigation and report by [NAME] is instead 21 October 2022, we can see no error in [NAME]'s finding that the evidence does not establish that the [NAME] was procured for the dominant purpose of legal advice or use in litigation or regulatory proceedings. 96 It follows that Optus' proposed appeal ground 2 must be rejected.

Leave to appeal – disposition 97 The [NAME] judge's judgment below is not attended with sufficient doubt to warrant the grant of leave. We have made orders to refuse leave to appeal, and for Optus to pay the respondents' costs. I certify that the preceding ninety-seven (97) numbered paragraphs are a true copy of the Reasons for Judgment of the [NAME] and [NAME].

Associate: Dated: 27 May 2024 SCHEDULE OF PARTIES VID 986 of 2023 Applicants Fourth Applicant: [redacted] [NAME] Applicant: [redacted] Sixth Applicant: [redacted]