Electronic Data Records Law | How to Win E-Discovery

Facebook Business Records

Record Retention Policy?

Social networking like Twitter is becoming more popular as a medium of communication for official, business or professional messages.  Should these messages be recorded?  Often the answer is yes.

California attorney Laura Meier has written an article* saying it is becoming more common for local governments to use Facebook and other social networking media to interact with citizens.  An example (not cited by Ms. Meier) is City of Westerville, Ohio.  Ms. Meier suspects that public records/ open meetings / sunshine laws could require governments to record much of this communication.  These laws generally help citizens monitor the actions of their government and audit for misuse of public resources.

The Florida Attorney General opined that presumably most of the Facebook communications created by a Florida city government would be public records that should be retained according to official schedules for public records.

Update:  See new post on how to record Facebook messages for official business.

Private enterprises are using Facebook to transact business.  (Soon they may be using Google Buzz too.)  A vendor named Worklight offers software that provides a “secure corporate overlay for Facebook,” claiming its product allows enterprise employees to interact via Facebook, while ensuring that sensitive information does not leak to outsiders.  Worklight suggests one way to use Facebook (using its secure software) in a private company would be to approve purchasing transactions.  Manager Sally for instance might use Facebook to authorize clerk Bill to spend $10,000. The enterprise would need to make and keep a virtual record of such authorization for purposes of internal control.

I am not aware of any vendor yet selling software to help an enterprise record activity in a public social networking environment like Facebook.  (Vendors, note the market opportunity here.)  One of my fellow instructors at the SANS Institute, Kevin Johnson, says that Facebook publishes APIs that a third-party vendor might use to make such software. (Kevin is a contributor to Social Media Security.)

Until a vendor makes a product for recording Facebook, how is an enterprise to record it?  One not-so-convenient way is “print screen.”

I prefer not discouraging enterprises like municipal governments from using effective technology to fulfill their mission.  As they assess the difficulty of recording Facebook, they should remember that records management has never been perfect.  Paper records were easy to mishandle and lose.

–Benjamin Wright

Mr. Wright teaches eDiscovery and data security law at the SANS Institute.

* D. Derleth, L. Meier, R. Moin, "Social Networking Sites:  Legal Issues for Public Agencies and Public Officials to Consider," The Public Law Journal, vol. 32, no. 4, Fall 2009.  Another issue Ms. Meier raises is whether information posted on a social media site could put a city on notice of a hazardous condition, which the city is obligated to address, even though the city does not have staff dedicated to monitoring the site sufficiently to understand the notice and act on it.

US Interior Dept. Destroys Email

Printing of Electronic Mail as Federal Government Record Retention?

The Bureau of Indian Affairs (US Department of the Interior) suffered embarrassment in court for the deletion of financial e-mails by former Assistant Secretary – Indian Affairs, Neal McCaleb.  The e-mails contained important information about money the bureau was collecting and holding in trust for Indian tribes. McCaleb deleted the e-mails because his IT department allocated him too little hard disk space. Under department policy, he was expected to print important e-mails onto paper before he deleted them, but because of confusion about who was authorized and directed to do the printing, no one actually performed the tedious and unwanted task.

Officials like Mr. McCaleb don't naturally embrace clerical duties like printing of e-mails.

The case demonstrates  

1. how legally important e-mail records can be,

2. the folly of an IT department trying to save a couple of bucks by being stingy with hard disk space, and

3. how dangerous it is today to view printing as a way to preserve email (or text messages) need for purposes of internal control or funds management.

See Jean Pagano, “Special Master reports findings on deleted e-mails: Department of Interior described as ‘chaotic’,” Native American Press/Ojibwe News, January 31, 2003. This matter was part of the protracted “Cobell” litigation brought by Native Americans against the Department of the Interior. Cobell v. Norton, et al. Case No. 1:96CV01285 (D.D.C.).

–Benjamin Wright

Employee ESI: Private?

Internal Investigations under Data Protection Legislation

Many countries have data privacy laws limiting the disclosure of personal information their citizens. Although the laws are far from uniform around the world, the European Data Protection Directive (95/46/EC) is a leading guide.

These laws motivate (multinational) corporations to configure controls into email (as well as webmail and text-instant-message) record retention systems.

The European Data Directive generally instructs European countries to enact local privacy legislation to regulate personal information. The legislation can apply to e-mail and other electronically stored information (ESI).  As a practical matter, the details on implementation and enforcement of local (non-US) privacy laws with respect to e-mail is a very complex topic.  Some local laws can frustrate internal corporate investigations that might appear, to US-based managers for example, as routine and responsible.  They can cause emails to be withheld from investigators.

One instance: In 2001 French courts held that a foreign-headquartered company violated the privacy rights of a French engineer when it inspected his e-mail records, stored on company computers.  The records revealed he was wrongfully moonlighting on company time.  Doreen Carvajal, “The Workplace: When bosses spy on workers,” International Herald Tribune, April 21, 2004 .

As corporations install appliances to store e-mail archives, they should consider whether to implement controls for compliance with local privacy statutes.  The controls might include

1. written policies calling for compliance with local law;

2. technical blocks to prevent unauthorized people or departments from accessing specific records, while granting access to those who have been authorized; and

3. alerts and audit trails to enable after-the-fact review of who accessed which records and when.

--Benjamin Wright

Mr. Wright is a consultant to Messaging Architects, develper of sound process for electronic mail record-keeping and investigation.

Cross-Border eDisclosure

Blocking Statutes and International E-Discovery

Numerous non-US jurisdictions (especially in Europe) have enacted so-called blocking statutes to restrict the export of important business records. Much of the motivation for these statutes is to prevent compliance with discovery demands in US litigation. These statutes give corporations incentive to design cross-border controls into e-mail archival systems.

Example Statutes

Examples of blocking statutes include the following:

• France has one of the broadest statutes, Law No . 80 - 538 of July 16, 1980, Journal Officiel de la Republique Francaise, July 17, 1980, p. 1799. It generally forbids French persons from disclosing to foreign governments (such as courts) documents that are important to the sovereignty, security or fundamental economic interests of France. French courts recently fined a French lawyer €10,000 for attempting to obtain records in connection with a lawsuit in the US.
• Ontario’s Business Records Protection Act, R.S.O. 1990, c. B.19, generally restricts divulgence of sensitive corporate financial records to foreign governments.

 

• The Netherlands Economic Competition Act of June 28, 1956 (amended by Act of Nov. 14, 1958, Art. 39), generally bans compliance with foreign government measures (such as lawsuits seeking documents) to regulate competition.
• United Kingdom's (UK) Protection of Trading Interests Act 1980 c 11 generally enables or requires British government to frustrate efforts by foreign governments to discover certain important business documents.
• Malaysia's blocking statute is addressed in Gucci Amer., Inc. v. Curveal Fashion, 2010 WL 808639 (S.D.N.Y. Mar. 8, 2010).

Implications for Archives Email

As corporations install appliances to archive e-mail, they can evaluate whether to implement controls for compliance with local blocking statutes.  As a practical matter, the controls might focus on managing efforts to retrieve large quantities of records (litigation e-discovery) rather than just a few records at a time (ordinary course of business).

The controls might include: 

1. written policies to forbid violation of local law;

2. technical blocks to prevent unauthorized people or departments from accessing particular records, while granting access to those who have been authorized; and

3. alerts and audit trails to enable after-the-fact review of who accessed which records and when.

--Benjamin Wright

Mr. Wright teaches computer records management and investigation law at the SANS Institute.

E-Discovery Strategy, Search & Artificial Intelligence

E-mail Archive Policy

In a legal dispute, you want as much of two assets as you can get – evidence and brainpower.  You want evidence to supply facts so you can understand and support your side of the case.  And you want good analysis and judgment so you can assemble the best arguments and make the best decisions about how to manage your case.  

Since e-discovery affects both evidence and brainpower, it is revolutionizing litigation and, more generally, all manner of investigations (whether they be investigations of bribes, kickbacks, corruption, espionage, overcharges, misallocation of funds, abuse of power, breach of trust or any other misconduct). 

Litigation Dynamics

A lawsuit today is not your father’s lawsuit.  The advent of electronic records like e-mail causes the quantity of records potentially relevant to a lawsuit/investigation to swell beyond imagination.  In any dispute, this profusion of records opens vast opportunity to those able to exploit it.  Smart litigants today (a) welcome oceans of records, and (b) seek advanced analytics and artificial intelligence to glean from those oceans the best case.

Lesson From Tyco Scandal

Observe the lesson from the Tyco International scandal (white collar crime). Chief Executive Officer Dennis Kozlowski and Chief Financial Officer Mark Swartz were convicted (under New York law, even though Tyco's headquarters was in New Hampshire) for taking money from the company.  They said the money was authorized compensation, approved by the board of directors, but top decisions at the company were poorly documented. Company leaders did business the old-fashioned way, with voice conversations and handshakes.  Hence the records to support CEO Kozlowski’s and CFO Swartz’s side of the case were thin. Dan Ackman, “Tyco Trial II: Verdict First, Law Second,” Forbes, June 17, 2005.  

But compare the case of Tyco’s General Counsel, Mark Belnick. Like his bosses Kozlowski and Swartz, Belnick went to trial for allegedly stealing money from the company (misappropriation of funds and assets). Yet the jury acquitted him.  The jurors could not find him guilty, even though they “felt he was morally guilty”. Why? The jury was persuaded "Everything that he got was documented through e-mails and memos . . ." Steve Fishman, “The Convert,” New York Magazine, August 2, 2004.

Records Make the Difference in Trial

Wow.  The difference between Kozlowski and Swartz, who are in jail, and Belnick, who is free, was records.  The bosses didn’t have them, but Belnick did.  The existence of those records, and the ability of Belnick’s defense team to assemble them into a credible story was crucial to his case.  Belnick's story is a lesson about the Information Age.  In the age of abundant digital records, advantage goes to the party who can better marshal records.  

[Update:  In another heartening Information Age story, digital records come to the rescue of a falsely accused defendant.  Defendant proves he did not commit murder by drawing on (a) New York City transit authority records showing his whereabouts based on metrocard found in his wallet at time of arrest; (b) timestamped photo showing him cashing payroll check; and (c) records of when he clocked out at work.] 

Success with Electronic Records

I therefore argue enterprises are wise not to fear e-discovery, but rather to embrace it.  They should relish systematic archival of massive records (including new things like Twitter tweets, voicemail-converted-to-text, cell phone text messages, iPhone calendar alarms, BlackBerry mail, smart phone SMS), and seek tools, including artificial intelligence, that enable brilliant searching and sifting through those archives.  They thereby position themselves to capitalize on unexpected or nuanced discoveries within their records.  I’ve published more big-picture observations about e-discovery in this blog.