Electronic Data Records Law | How to Win E-Discovery

Computer Raid | Search Warrant

Police Seize Records | Civil Inspector

Law enforcement searches for and raids to seize computer records come in many shapes and sizes.  A student in one of my SANS classes – who had experience helping the FBI confiscate electronic evidence under formal search warrants – taught us that an FBI raid is swift, forceful, well-equipped and well-organized.  
 According to him, the bystanders, such as IT staff at the target enterprise, have little opportunity to say or do anything other than try to get out of the way.

But a highly-professional FBI raid is just one kind of police/prosecutor investigation that can demand computer records.  Other raids or investigations can involve law enforcement personnel who are less specialized and less well-trained.  The raid could be executed by the local county sheriff's department, which may not possess the resources and expertise of the Federal Bureau of Investigation.

The Maricopa County sheriff raided a tow truck company in Mesa, Arizona, seizing computer and other records, in connection with a fraud investigation.  Five years later (that's a long time to wait on an investigation!) prosecutors had still not decided whether charges would be brought against the truck company.  The company claims the whole event was political.

Also in Maricopa County, the sheriff's department raided one of its sister county departments in a dispute over control of county computers.  Sheriff's deputies threatened to arrest fellow county employees who stood in the way.  The computer system in question was the topic of a civil lawsuit between the county sheriff's office and the county board of supervisors.

The personnel executing a raid or inspection need not necessarily be peace officers who carry guns. They could be simply regulatory investigators.  For example, in Australia, a Fair Work Inspector can enter a business and (“without force”) demand access to computer records related to labor practices.

Any time government appears at the door looking for computers or electronic evidence, here are general guidelines for IT staff:

1.  Do not obstruct an officer acting under color of law.  An example of “color of law” is that the person carries a police badge and a gun.

2.  Do not authorize or express “consent” for the search.

3.  Designate a single, calm spokesperson to talk to the government personnel.

4.  Politely request to see and get copies of documentation of the government's authority (but don't stand in the way if your request is not immediately answered).

5.  Politely request opportunity to have counsel come and be present. 

6.  Politely explain (if given the opportunity and if truthful) that (a) the enterprise computer systems are complex and damage to them might damage the enterprise and throw employees out of work, and (b) a cooperative acquisition of records through counsel might be more prudent. 

7. Politely request to make as many records as possible of the government's activity while its on the premises.  Although FBI agents may be unlikely to allow you to follow them around, take notes and/or video them as they work, a Fair Labor Inspector might.

–Benjamin Wright, Senior SANS Institute Instructor

Local Government Email | Freedom of Information Act

E-discovery under State Open Records or Sunshine Laws

Police Video Records

Increasingly, public agencies are required to search for, locate, uncover and turn over e-mail records in response to freedom of information and open records requests.  

Generally speaking, under either state or federal law, a freedom of information act requires government to disclose requested records to citizens.  Sometimes a FOIA might be known as (or associated with) an open records act or a sunshine act.  

One example: A Kentucky judge required state government to give a man copies of e-mails between his wife, a state employee, and another state employee whom the man suspected was having an affair with his wife. (Associated Press, “Judge: Ky. Man Can See His Wife's E-Mail,” Nov. 20, 2007.)

Another example:

A newspaper requested under Arizona’s open records law access to records of e-mail by a county official on county computers. The official fought the request, claiming the records were personal and therefore not subject to disclosure. The Arizona Supreme Court held that the records must be shown to a trial judge. The judge should then decide whether they are personal records (deserving of privacy), which are to be withheld, or public records. (The Reporters Committee for Freedom of the Press, "Judge must decide whether e-mail is private," April 27, 2007.)

Third example:  A West Virginia judge held the state's FOIA required the state to release e-mails of the state's Supreme Court Chief Justice. The justice had send the e-mails from his government account to the head of a private coal company.  (The Reporters Committee for Freedom of the Press, "Even high court subject to FOIA in West Virginia," September 18, 2008). Although the released e-mails did not pertain directly to the court's internal administration or cases pending before the justice, they touched on more than merely personal matters.  They at least mentioned upcoming supreme court elections.

To respond to these requests takes time and resources on the part of agency IT staff. Haphazard records management makes the job more difficult.  Agencies therefore have incentive to keep organized, searchable e-mail records.  And they are wise to insist that all employees (including governors and supreme court justices) route all official messages to or through centrally-controlled archives.

These cases are just random examples.  I wouldn't be surprised to find similar cases in other states, whether Indiana, Ohio, Colorado, Tennessee, Arkansas, Indiana or wherever.

With the proliferation of digital gadgets in government, the quantity of records that are discoverable under FOIA is exploding.  One company that makes equipment for police departments has developed a video camera, which an officer would wear on his head, to record everything he sees and hears while on duty.  Veronica Dagher, "New Taser 'Shoots' Evidence," Wall St. J., 9/2/09.  Wow!  That would create a bonanza of government records and evidence.  [Query whether, to comply with privacy laws, police should publish warnings (such as big decals on squad cars) that officers are video recording all they see and hear.]

Update:  Reportedly, when Sarah Palin resigned as governor of Alaska, she cited $2 million as the cost incurred by the state to respond to FOIA requests about her.   FOIA is a growing expense for government.  Governments need to employ technology to contain that cost.  For example, any time government delivers information to one FOIA requester, it should publish that information on the web.  Web publication will avoid the cost of retrieving and culling the information again under future requests.

--Ben Wright

Mr. Wright, a practicing attorney, teaches the Law of Data Security and Investigations at the SANS Institute.