Electronic Data Records Law | How to Win E-Discovery

Data Protection versus Record Retention

PCI-DSS | Telephone

Like the so-called right to be forgotten, requirements of the Payment Card Industry Data Security Standard (the PCI) can clash with record retention needs.  The PCI sets industry standards for credit card merchants to secure card data.

A student in my SANS legal course related the following story.  PCI Section 3.2.2 states:  “Do not store the card verification code or value (three-digit or four-digit number printed on the front or back of a payment card) used to verify card-not-present transactions.”  His company, a credit card merchant, takes card payments over the
telephone in live voice transactions between customers and the company’s representatives.  For each transaction, the company audio records the entire voice exchange.  Naturally, the company takes from the customer the card verification code covered by PCI 3.2.2.  As the customer vocalizes that code, the company makes an audio recording of the code.

The company noted that to record the code is a violation of the literal words of PCI 3.2.2.  However, the company also noted that legal and business imperatives call for it to retain the full audio record.  That record is needed in the event of a dispute with a customer.  A customer might try to repudiate a transaction, claiming it never happened.  Without the record, the company would lack strong evidence that the customer entered the transaction.  

Further, that audio record protects the company from other problems such as internal fraud by employees and allegations of tax evasion.  (Example: A tax authority might investigate whether the company understated its profit, assets or revenue by mis-recording the value of its rights, assets or accounts receivable applicable to credit card transactions, including recurring and contingent transactions.  Those audio records help the company prove that it properly accounted for transactions.)

Therefore, with the advice of counsel, the company decided it would store the card verification codes in audio records contrary to PCI 3.2.2.  The company would also take alternative measures to protect the data on those records from misuse or wrongful disclosure.

Dear reader: What do you think about this story?

-–Benjamin Wright, Practicing Attorney and SANS Institute Instructor on the Law of Data Security and Investigations (including e-records and e-discovery)

Investigating Staff Graft or Misconduct

Electronic Records for Audit, Ethics and Internal Control

If an institution – any institution – is to maintain its reputation, it must be prepared to investigate the actions of its employees (personnel).  Inevitably, allegations will arise that this or that employee embezzled, acted unethically, abused authority, laundered money, executed an unauthorized trade or simply made a mistake.  Power to conduct internal investigations is critical to government agencies and for-profit corporations, as well as charity, non-profit, and educational organizations.

Modern investigations today are different from those of the past, by virtue of the presence of digital records. The sheer quantity of e-records (e-mail, text, chat or instant messages, logs, meta-data, photographs, blog comments, surveillance videos, and on and on and on) is mushrooming beyond comprehension.  When an institution undertakes to audit whether a superior harassed a subordinate, an accountant misunderstood a tax liability or an administrator wrongfully tolerated a conflict of interest, a brimming corpus of electronic records can be available for examination . . . and can facilitate a just outcome.  The records can shed welcome light on whether the subject of the investigation did what is claimed, or did not do it.

A case in point is an investigation at Yale University, a regular recipient of research grants from the federal government.  Prosecutors alleged that academics at Yale had misallocated federal money (funds or assets) by (a) transferring grant funds to accounts that were not intended for the grants in question, and (b) paying themselves for summer activities using money from grants not earmarked for those activities.

In other words, the government claimed professors and staff played fast and loose in interpreting the purpose of specific grants.

In the face of such allegations, an institution has no choice but to cooperate with government.  (Which university wants to be the subject of an adversarial police raid in search of computer records?) Yale launched a massive investigation, covering some $3 billion in grants over seven years (2000-2006). It turned over more than a million pages of documents.  No doubt the massive quantity of records included email and other computer-based records.  (A similar corruption probe in the 1980s could not have yielded as many records because computers and e-mail were not as pervasive then.)  The college settled the matter in 2008 by agreeing to pay $7.6 million.  

Although Yale admitted it had made some errors, the government granted the school a release from further liability with respect to the years that were investigated.

$7.6 million is a relatively small penalty.  The university appears to have done itself three favors.  First, it had retained plentiful records for many years.  Second, it cooperated with the government and divulged rafts of records.  Third, when the allegations first arose, Yale instituted reforms preemptively, including tighter accounting controls and improved staff training.  The result was the imposition of only a small settlement payment.   And as for the future, Yale remains qualified to receive grants from the government. 

Had Yale produced fewer records, and displayed less transparency and less cooperation, the institution would not have fared so well.

I’ll bet the “errors” to which Yale admitted reflected past practices that had developed over decades, in an age when records were fewer and therefore government (inspectors general) had less ability to audit or investigate.

The incident teaches Yale staff (and staff at other institutions receiving federal grants) that they will be on a tighter leash for the future.  A digital informant is ready to snitch on them.  The super-plentiful e-records now being made about their daily activities expose them to greater review and accountability than was historically possible.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in records-dirven investigaions.  He also teaches Internet law at the SANS Institute.

EMail Evidence | Criminal Defense

Should Corporate Executives Prefer Early Deletion of E-Records?

Some executives fear that e-mail will come back to haunt them, so they minimize their use of it.  And they want corporate e-mail destroyed quickly.  

But electronic records came to the rescue of David Stockman, former CEO of bankrupt auto parts maker Collins & Aikman.  Stockman and other executives were indicted by prosecutors for alleged lying about the company’s financial condition.  Prosecutors apparently based the charges on an investigation by an outside law firm working on behalf the company’s board of directors.  Stockman and his co-defendants maintained that they were victims of a rush to justice.  They said the law firm and the prosecutors failed to examine all the complex evidence carefully. 

They and the government undertook to assemble a database containing 10 million company records, including (no doubt) copious e-mail records.  Key topics in the case included C&A's:

*  day-to-day internal communications among executives and employees regarding the accounting and invoicing for particular transactions, and 

* day-to-day communications with suppliers -- involving innumerable, detailed, nitty-gritty negotiations and documentation over topics like transaction-by-transaction rebates.

From this massive database, the defendants drew evidence, bit-by-tiny-bit, to tell their side of the story.   In a database of this size, the ability to find the right evidence depends much on the careful selection of search methodology and search algorithms.  Sometimes the only effective way to comprehend what is in the database is to engage a selective sampling of records.

Eventually the defense prevailed.  In an unusual move, the prosecutors withdrew the charges, stating that they had come to reassess the evidence in the case.  

In other words, the executives were fortunate that the company retained so many records like e-mail.  E-archives exonerated the defendants.

In a putative corporate scandal, the relevant e-mail records can be maddeningly plentiful.  A large number of computer-based records is unsurprising in a modern white collar crime investigation or police raid of corporate offices.

In this case, the defendants' legal team patiently mined the company’s email (and other records) to build a convincing case that prosecution was unwarranted.

As the quantity of records in a case swells like this, the ability of parties to review records one-by-one declines.  Increasingly the law will favor those who can draw on statistical methods (or linguistic analysis) to tease out the evidence that tells their side of the case.

(David Stockman is most famous as the Ronald Reagan’s budget director in the 1980s.)

–-Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in enterprise governance and records management.  He also delivers training in cyber defense law at the SANS Institute.