Electronic Data Records Law | How to Win E-Discovery

Metadata | Email Discovery Control

Logs and Audit Trails for Data Privacy and Internal Control

Filtering Attorney Work Product

Electronic records such as email serve as memorials of business actions and as evidence of legal responsibility.  But they are also vulnerable to abuse by privacy infringers or trade secret thieves.

One key to protecting e-records is metadata.  Meta-data comprises all the ancillary notes and audit trail surrounding a given record (a given e-mail) . . . the system logs showing when a record was created, who accessed it and when, how and when it was changed, to whom it was forwarded and possibly much more.  Metadata can illuminate an auditor or detective about the status, the history or the security of the record in question.

For records containing personally identifiable information (PII), good meta-data can be invaluable as an instrument of privacy.  Metadata can deter a snoop.  A busybody in a hospital  who wants to peek at a celebrity’s patient record will think twice before doing so if he knows the system will create an audit trail showing what he saw and when he saw it.  Further, in the investigation of a hacker incident, system logs can inform whether (for instance) the crook accessed credit card record X or social security number Y.  Armed with this information, an investigator can evaluate whether the hacker did or did not actually breach the security of record X or record Y.

Example: In the wake of a security breach at one of its hotels, Best Western International was able to evaluate the breach and narrow the universe of affected credit card numbers by inspecting specific logs on the computer in question. 

Accordingly, a well-crafted e-mail archival system will maintain extensive meta-data about each electronic mail record.  The M+Archive product for instance keeps tabs on who viewed a record, when it was printed and so on. 

Be all that as it may, sometimes system logs are undesirable.  For example, when an attorney turns over records in an eDiscovery request, she normally should not turn over metadata that constitutes her own work product.  As she reviews individual emails in an archival system, the system may be keeping meta-records showing which records she accessed, when she accessed them and how often.  Those records are probably her attorney work product, which normally is excluded from disclosure in the discovery phase of litigation.  She should normally screen out any such work product when she turns over required emails to another party.

I spoke to Ranjit Sarai, e-discovery expert at Messaging Architects. “The management of meta-data in an enterprise archival system can be tricky,” he said. “Normally you want the system to be making meta records for security and accountability purposes.  But sometimes ediscovery lawyers want to turn this logging feature off, or they want to filter out their work product metadata before delivering records to an adversary.  We have experience helping an attorney understand the options and craft a solution for her particular case.”

–Ben Wright

Mr. Wright often serves as a public speaker on the law of electronic records and investigations.

Email Recovery | Network Back-up

E-mail Database Search and Forensics

Archival | What is a Subpoena?

As litigation and other requests for e-mail from backup tapes grow more frequent, an enterprise may be wise to restore, consolidate and archive all of its old e-mail held in backup.

Historically organizations did not think of e-mail as an asset worthy of preservation.  They did not archive it, though copies would end up in network backup.  

But experience has taught that e-mail evidence can be critical to defense of a lawsuit or enforcement of a contract.  Alternatively its disclosure might be required under a subpoena (see definition below), a court order, an administrative summons, an IRS tax audit or a freedom of information act request (FOIA).  Further, e-mail might be needed in an investigation (led internally or by outside criminal prosecutors) of a bribe, a kickback, an overcharge, tax evasion or a embezzlement of money, or it might be needed for an audit of alleged misallocation of funds. 

Archival

Greg Smith of Messaging Architects observes that repeated requests for e-mails from backup can warrant a change of thinking in the IT department. “While most backup software deals very efficiently with individual electronic records, it cannot provide the same level of access to email. This is because enterprise email exists as a record within a database (such as for Groupwise or Microsoft Exchange).  The database must be restored in its entirety and searched in its entirety in order to ascertain the contents of the database. With database sizes exceeding 100GB and scores if not hundreds of tapes, the cost to restore and search the tapes can be considerable. Recovering records for selective users and dates may satisfy the current discovery requirement, but with each successive lawsuit, or changes in discovery parameters for an existing lawsuit, restoration from tape can become a recurring financial liability.”

Greg continues, “The practical solution is to remove the information from tape permanently and place it in an electronic records format where information can be retained and managed as individual records and not conglomerates of information.  In such a format, individual email records can be sorted by user or date.”

Restored records can be archived in an open (non-proprietary) format, such as XML, which enables searchers to tap an ever-expanding array of search and forensics tools.  XML may or may not qualify as "native format" as that term is sometimes used in court decisions, though XML may be a more useful format than whatever the native format was.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, experts in e-discovery and consultants in e-mail investigations.

Post Script  What is a subpoena?  A subpoena is a legal demand that someone turn over information or evidence. Commonly the laws of litigation enable a party to subpoena other parties for records or other evidence. Sometimes the law also invests the power to subpoena in an official who conducts investigations, such as a government auditor or an inspector general. If a party abuses the power to subpoena, by demanding irrelevant records or by issuing a demand with no regard for the cost of compliance, a court may sanction the issuer of the subpoena.

Freedom of Information Act | Computer Records

Freedom of Information Act Requests Yield E-Troves of Documents

FOIA forces transparency in government, and transparency in turn forces revolution in the administration of public institutions – both national and local.

A FOIA requires government to disclose records to citizens upon request.  Remarkably, the quantity of available records relevant to any given request is skyrocketing as government agents adopt digital technology – databases, electronic mail, instant messaging, text messaging, Twitter, collaboration software and more – to execute the details of day-to-day government. The implications for democracy are profound.  So are the governance implications for enterprises of all descriptions.

Item One: Britain is in uproar over the expenses of Parliament members.  The row started when a journalist used the UK’s new FOIA to request records about M.P. requests for reimbursement of living expenses.  By age-old practice, the government covered M.P.s for the living costs associated with their official duties, but the specifics have always been hidden from public view.  Reluctantly resistantly the government prepared to turn over expense records under FOIA – though with heavy redacting to protect M.P. privacy.

But by this time loads of (un-redacted) M.P. expense records had been compiled into something that did not exist in the old days . . . a neat, convenient-to-steal electronic form.  This compact compilation of records enabled a whistleblower to spirit the records out of a government computer and into the hands of a newspaper.  The Daily Telegraph’s ensuing publication of complete, open details has embarrassed M.P.s in an historic scandal. British government will never be the same.  John F. Burns, “In Britain, Scandal Flows From Modest Request,” NY Times, May 20, 2009.

Item Two is Clark County School District, Nevada. Citizen Karen Gray requested under FOIA a year’s worth of the School Board’s e-mail, about 1500 messages.  A few years ago, records of such granularity did not even exist for a typical school board (or city/municipal commission, county management, state committee or board of trustees).  But e-mail has caused the creation of mounds of new records, which become fodder for any kind of legal investigation.

The District tried to delay disclosure.  It also tried to charge Ms. Gray $4000 for the costs of recovering the records (and filtering them for private/confidential data), but those costs reflect out-of-date, manual methods for compiling and reviewing e-mail records. The Nevada courts resisted the delay and the high charges.  The attitude of the courts was that the law favors inexpensive and generous disclosure. So the courts forced disclosure.

Ms. Gray’s case implies that Freedom of Information Act law is intolerant of governments that make their important e-mail records hard to recover.  A modern e-mail archive appliance makes the compilation and filtering of e-mail (especially that of executives, professionals, top managers, and board members) quick and inexpensive . . . consistent with the purpose of FOIA law.

–Benjamin Wright

Mr. Wright is an advisor to messagingarchitects.com, the visionaries in e-records management.