Electronic Data Records Law | How to Win E-Discovery

International E-mail Deletion

Computer Spoliation in Asia

Electronic discovery (EDD*) and the destruction of digital evidence are global issues, affecting more than just North America.  Throughout the world, electronic records are ubiquitous, and mushrooming in volume.  Any law enforcement investigation in the world – whether a lawsuit, a tax audit, a police inquiry, an arbitration proceeding,
a legislative hearing, an administrative probe or a government inspection – is likely today to seek access to electronic records (email, databases, flash drives, text messages, facebook posts, youtube videos, digital photographs, laptop hard drives, and more).

Naturally, to thwart an investigation, an unscrupulous holder of e-records (ESI) wants to destroy them.  In the US, we call that destruction “spoliation” or “obstruction of justice.”  Other jurisdictions may use different words for unlawful destruction of evidence, but the general concept of law must be universal.  If law enforcement is to function, it must forbid and punish wrongful destruction of electronic evidence.

Many of the leading cases punishing the destruction of computer evidence are American, and to a lesser extent Canadian.  But cases are emerging in other countries.  . . .
One such case before the Singapore High Court is K Solutions Pte Ltd v. National University of Singapore [2009] SGHC 143.  This lawsuit was a contract dispute involving IT services provided by K Solutions (KS) to a university.  Under the rules of discovery in the lawsuit, the university sought from KS certain email records, in addition to audio recordings of meetings between KS and university staff.

The court noted that Singapore rules of procedure (Order 24 rule 16(1) of the Rules of Court) require a litigant like KS to disclose relevant records to its adversary, the university.  Evidence in this case showed that KS had possessed numerous relevant electronic mail records and audio recordings, which it had not released to the university.  Although KS explained that some email records had been destroyed innocently under its policy of retaining e-mail only six months, the court was suspicious.  The court believed KS’s email destruction policy should have been suspended because KS knew that litigation was likely.  (In other words, using American parlance, KS should have applied a “litigation hold” on the email.)

The court observed that although the rules of procedure do not explicitly forbid a party from destroying records, the rules imply that records should be preserved when litigation is pending or anticipated and that wrongful destruction should be punished. 

As the court considered KS’s deletion of email, it noted that KS, during the course of the lawsuit, had also been evasive and untruthful about its records.  The court levied severe sanctions against KS, effectively granting judgment against it in favor of the university.

Analysis:  From the perspective of any enterprise such as a business, law punishing the destruction of evidence is dangerous.  Digital records are destroyed constantly, in the ordinary course of operations. But the law may punish destruction if a legal authority concludes the destruction should have been avoided.  In any investigation the authority looks backwards and second-guesses what the defendant did in the past.  Retrospection is always how investigations like lawsuits or tax appraisals work.  With the benefit of hindsight, an action (or omission) of records management that seemed innocent to the defendant at the time can appear sinister later.   All enterprises (US and non-US) therefore need margin for error.  The law gives them incentive to be more generous in retaining computer records, especially electronic mail.  And the law gives incentive to keep email of important people much longer than six months.

–Benjamin Wright

Mr. Wright serves as a public speaker on e-discovery, e-records management and IT security law.  He speaks to professionals groups like Institute of Internal Auditors and SANS Institute.

*What is EDD?  Electronic Data Discovery is a relatively new legal term of art.  It refers to the process of finding, managing and disclosing electronic records (whether on a tape, a PC, an iPod, a cell phone or whatever device) as required in a lawsuit or legal investigation, such as a regulatory audit.

SOX Record-keeping

Arthur Andersen’s Records Management Crime

The US legal system is giving all enterprises (whether public corporations, private LLCs or otherwise) reasons to be more liberal in their retention of records, especially e-mail.  One reason is a change in obstruction of justice law.

The traditional obstruction of justice statute, 18 U.S.C. §1512(b), punishes anyone who corruptly persuades another person to destroy documents to impair their use in an official proceeding.  Under that traditional statute, a criminal court convicted Arthur Andersen for destroying Enron-related papers and electronic records. The jury in Andersen’s trial said Andersen’s internal record management practices violated the statute.

But one month after Andersen’s jury trial, Congress adopted the Sarbanes-Oxley Act (SOX).  SOX modified obstruction of justice law by making it easier to convict people who destroy records.  SOX included new 18 U.S.C. §1519, which now punishes anyone who destroys, conceals, or covers up any record to impede or influence a federal lawsuit or an investigation by any federal agency, or in relation to or contemplation of any such matter or case.

Notice the differences between the traditional §1512(b) and new §1519.  Under traditional §1512(b) a crime was committed only if the defendant "corruptly persuaded another person" to destroy documents.  It might be hard for a prosecutor in a criminal trial to show corrupt persuasion of a second person.  Further, the exact words of §1512(b) seem not to apply if the defendant directly destroyed documents.   In new §1519, Congress omits the traditional “corruptly persuades another person” element. Further, new §1519 employs expansive language -- “in relation to or contemplation of any such matter or case” – to stretch the law to cover destruction of records in any way connected to a specifically anticipated lawsuit or investigation.

Enterprises be aware.  The effect of §1519 is powerful.  To win an obstruction of justice conviction, the prosecutor does not have to work as hard as he or she did in the Andersen case.  The prosecutor no longer has to show the defendant acted "corruptly" to "persuade" someone else to destroy documents.  Now, it is enough for the prosecutor to simply show that the defendant intended to destroy records with federal litigation in mind.

With new §1519, Congress emphasized its intolerance of people who mulch records in view of a lawsuit or investigation, even one that is not pending or imminent.  Hear how Senate Report 107-146 interprets new 18 U.S.C. §1519:  “This statute is specifically meant NOT to include any technical requirements, which some courts read into other obstruction of justice statutes, to tie the obstructive conduct to a pending or imminent matter. It is also meant to do away with the distinctions, which some courts have read into obstruction statutes, between court proceedings, investigations, regulatory or administrative proceedings . . . and less formal governmental inquiries. The intent of the provision is simple: people should not be destroying, altering or falsifying documents to obstruct any governmental function.”

Think about that statement from a record management perspective at a complex enterprise.  The statement seems to imply that the enterprise must implement a litigation hold with respect to future (specifically-anticipated) lawsuits/investigations, even though they are not pending or imminent.  For an enterprise, it is tough to know what is and is not anticipated somewhere out there in the future.  But the risk is that later, after the lawsuit gets going, the court may judge the enterprise's decisions retrospectively, with the benefit of 20-20 hindsight.  The court may determine, "Oh, you could have seen this coming (even though it was not imminent), so you should have implemented a legal hold."

Given that it is now easier to be convicted for destroying records, the logical response for an enterprise is to keep more records longer . . . to give itself a wider margin for error.

SOX’s new contribution to obstruction of justice law should be viewed in the context of recent cases punishing premature destruction of electronic records.  In that context, one sees a whole legal system that expects more lavish record retention than in the past.

–-Benjamin Wright

Mr. Wright teaches cyber security and investigations law at the SANS Institute.

Reference: B. Wright, “Shredding Documents Post-Arthur Andersen: Reforming Corporate Record Retention Policies for the Information Age,” a paper published 2002.