Electronic Data Records Law | How to Win E-Discovery

City Government | Deleted Official E-mails

Expensive Forensic Recovery | Political Cover-up? | State Retention Schedule

Compliance with e-mail retention law is not easy.  Email in an enterprise like a municipal government is voluminous.  And at city hall failure to keep required electronic mail records can look like a scandal, where it appears officials are trying to cover-up the truth about something important.

Hence, the City of Boston has hired a forensic specialist to attempt to recover the destroyed e-mails of an aide to the mayor.  As part of the specialist's investigation, he or she might look on PC hard drives and in network backup tapes to locate erased records.

Forensic retrieval of email is costly.  The expense of forensics quickly exceeds whatever the city might have been saving by not implementing a comprehensive email archival system in the first place.  Had the city foreseen it would eventually be forced to restore deleted e-mails, it would have readily seen the need for good archival as a matter of good IT management.

The city did have an archival program, but it only pertained to emails that had resided in a user’s inbox for more than 90 days.  In other words, the program gave decision-making responsibility to users.  If users decided to delete records before 90 days, then the records would not be archived.  Among the problems with giving users such decision power is that users are rarely qualified (and rarely have the time) to exercise the required judgment.  Further, a user has a conflict of interest.  If a record reflects negatively on the user, she naturally prefers to destroy it.

Generally speaking, the Massachusetts state record retention schedules applicable to city government require that email correspondence of “no informational or evidential value” be retained a minimum of two years. 

But just instituting a policy that all e-mail be kept two years does not solve all of the city’s record retention problem.  Many e-mails must be retained for various longer periods, depending on content.  To examine email content and determine that this record needs X retention period and that record needs Y retention period is very, very difficult in practice.  In fact, I am skeptical that such one-by-one examination can be done effectively in government across many users over an extended period of time. (If you dear reader know of any case study showing it can be done, I cordially invite you to point me to that study!)

Under the auspices of Messaging Architects, I led a workshop on this topic with the stakeholders (IT, HR, legal department et al) in Jackson County, Oregon, February 2009. The conclusion was that the county government would archive all e-mail (spam excluded) more or less indefinitely.

–Benjamin Wright, Senior SANS Instructor for e-Discovery and e-Record Retention Law

Email Recovery | Network Back-up

E-mail Database Search and Forensics

Archival | What is a Subpoena?

As litigation and other requests for e-mail from backup tapes grow more frequent, an enterprise may be wise to restore, consolidate and archive all of its old e-mail held in backup.

Historically organizations did not think of e-mail as an asset worthy of preservation.  They did not archive it, though copies would end up in network backup.  

But experience has taught that e-mail evidence can be critical to defense of a lawsuit or enforcement of a contract.  Alternatively its disclosure might be required under a subpoena (see definition below), a court order, an administrative summons, an IRS tax audit or a freedom of information act request (FOIA).  Further, e-mail might be needed in an investigation (led internally or by outside criminal prosecutors) of a bribe, a kickback, an overcharge, tax evasion or a embezzlement of money, or it might be needed for an audit of alleged misallocation of funds. 

Archival

Greg Smith of Messaging Architects observes that repeated requests for e-mails from backup can warrant a change of thinking in the IT department. “While most backup software deals very efficiently with individual electronic records, it cannot provide the same level of access to email. This is because enterprise email exists as a record within a database (such as for Groupwise or Microsoft Exchange).  The database must be restored in its entirety and searched in its entirety in order to ascertain the contents of the database. With database sizes exceeding 100GB and scores if not hundreds of tapes, the cost to restore and search the tapes can be considerable. Recovering records for selective users and dates may satisfy the current discovery requirement, but with each successive lawsuit, or changes in discovery parameters for an existing lawsuit, restoration from tape can become a recurring financial liability.”

Greg continues, “The practical solution is to remove the information from tape permanently and place it in an electronic records format where information can be retained and managed as individual records and not conglomerates of information.  In such a format, individual email records can be sorted by user or date.”

Restored records can be archived in an open (non-proprietary) format, such as XML, which enables searchers to tap an ever-expanding array of search and forensics tools.  XML may or may not qualify as "native format" as that term is sometimes used in court decisions, though XML may be a more useful format than whatever the native format was.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, experts in e-discovery and consultants in e-mail investigations.

Post Script  What is a subpoena?  A subpoena is a legal demand that someone turn over information or evidence. Commonly the laws of litigation enable a party to subpoena other parties for records or other evidence. Sometimes the law also invests the power to subpoena in an official who conducts investigations, such as a government auditor or an inspector general. If a party abuses the power to subpoena, by demanding irrelevant records or by issuing a demand with no regard for the cost of compliance, a court may sanction the issuer of the subpoena.

Cull ESI

Search Costs in E-Discovery and E-Disclosure

Does the cost of filtering attorney-client communications from legal disclosures justify a policy of skimpy retention of email?

To understand that question, we need background:  If an enterprise possesses records, it must be prepared to disclose them when required to do so by law.  Disclosure entails effort to find and compile the relevant records.  If the records are paper, the searching and compiling are performed manually.  But if the records are electronic, automated methods for searching and compiling may be available.

For records of electronic mail, modern archival technology enables easy searches, even if the number of records is large.  Search engines can make finding/compiling records rather low cost.  From a policy perspective, those low costs help to justify more complete and lengthy retention of e-mail within an enterprise.

But wait. Some say those low costs are offset by the expense of screening out attorney communications when law requires that the enterprise disclose records.

Is that true?  Let’s analyze the topic.

When the owner of e-mail records such as a public agency must release records under e-discovery or freedom of information act (FOIA), the owner may normally withhold those records protected by attorney-client privilege.  Why?  The law wants to encourage open communication between counsel and client and to enable lawyers to create work product outside the scrutiny of adversaries.

Given this right to withhold, a record holder naturally wants to cull out any protected attorney communications before it discloses records.  If performed manually, this detection and sifting can involve much time and expense.  Some therefore argue the holder would have been wiser in the first place not to have retained the records.  They advocate deleting e-mail records as soon as possible.  If the holder does not possess the records, they say, the holder avoids the eventual cost of filtering out the protected records.

That argument, however, ignores how rapidly search engines are advancing.  Advanced search engines employing artificial intelligence and other techniques can (so their promoters claim) outperform lawyers when examining copious records. See, Daniel Fisher, “The Data Explosion,” Forbes, October 1, 2007.  I courageously predict search engine advances will accelerate as better search methodology and algorithms are developed.

As search technology improves, the need for expensive, manual screening for protected communications diminishes.

Sure, search engines can make mistakes. A lady from a government agency reminded me that if a privileged e-mail slips out in a FOIA disclosure, the law provides no way to claw it back.  So her agency tediously examines e-mails before divulging them.

My reply:  people make mistakes too.  Moreover, the risk of an occasional privilege slip-up is small reason for a government agency to adopt a policy of early e-mail destruction.  While I respect the agency’s need for confidentiality with its lawyers, many other considerations suggest the agency is wise to keep generous electronic mail records.

Another point:  is it really in the public’s interest for a government agency to place colossal emphasis on protecting its lawyer records?

As the costs drop for implementing pretty-good automated measures for screening out protected records, the argument for minimizing the size of email archives drops too.

–Benjamin Wright, JD

 

Email Document Recordkeeping

Local County Government Compliance with State Standards

Records managers at Travis County, Texas, are publicly debating how to draft retention policy for the e-mail of over 4000 users. The county is subject to many confusing state directives and standards on records retention.  

The Travis officials (Steven Broberg and Shawn Malone) have assembled a web site and blog to explain the issues and solicit public input. The officials outline three options, roughly being:

1. Continue the status quo, where each employee stores, deletes and/or categorizes e-mail without clear, modern guidance from management on how this should be done. Under this approach, some employees store a lot, and some store less. Some print “important” e-mails and place them in a file cabinet; others do not.  

 2. Train each employee to rigorously review each e-mail and decide its retention status (i.e., destroy quickly; OR place in category X so it can be retained for a certain period; OR place in category Y so it can be retained for a different period; and so on). New technology, such as artificial intelligence, may be on the horizon to facilitate this option.  

This is what I have previously called the make-a-decision style of e-mail records management.  The Travis officials call this the bucket approach . . . each e-mail fits into a bucket (i.e., a category to which are assigned rules for retention, destruction and so on) and a way must be found to put the e-mail into the right bucket.  The officials note that some learned commenters have advocated the bucket approach, but the officials have appealed to the commenters to bring forward a good example of the bucket approach working in practice.  See video at the bottom of blog post. 

3. Keep all e-mail “indefinitely” (spam excluded).  Related to option #3 is what Broberg & Malone call the haystack approach to e-mail records management.  Rather than trying to place each e-mail into category X or Y so it can be found and managed as though it were a sheet of paper, the haystack approach simply keeps copious volumes of e-mail and then relies on search engines to find particular e-mails when they are needed, such as for e-discovery or an investigation.

Here’s my initial input to Broberg and Malone.  

First, option #3 could be implemented in many different ways. It should be understood as not a single option, but a large family of options, with many flavors and nuances.

Second, I have previously voiced skepticism about option #2. 

Third, I recently witnessed a large institution wrestle with the same topics.  It knew that, like Travis County, its present condition was option #1. The e-mail system deleted each e-mail within 90 days, unless the user (such as an inventor) took effort to store it specially, such as in a folder.  Its present e-mail usage had created and was continuing to create, vast heaps of records. The internal audit department argued that all this stuff, stored according to user discretion, contained important material. Copies were spread around (rather haphazardly) on servers, desktops, laptops, BlackBerries and Androids.  Those e-mails, and the data contained therein, included: 

* assets of the enterprise (contracts, negotiations, representations, internal controls, intellectual property, delegations of authority)

* evidence that is and will be relevant to present and future investigations (lawsuits, e-discovery, corruption audits, fraud allegations, false pretenses, whistleblower complaints, retaliation complaints, misappropriation of funds, misallocation of funds probes, hostile work environment claims, etc.)

* sensitive information such as trade secrets, other intellectual property and personally identifiable (private) information

Internal audit argued that this scattered corpus of stuff needs to be managed, measured, controlled and secured.  For privacy and other reasons, audit trails need to be kept to show who looked at which archives and when.

Further, argued internal audit, as the years go by, decisions about how long to keep this or that can change on account of matters like future litigation hold and changes in law (or changes in records management philosophy). In other words, the institution might initially set an e-mail for seven-year retention, but later learn it should be retained for 10 years. The institution needs a way to find the e-mail so it can be moved to the longer retention period.

E-mail, concluded internal audit, needs to be managed under a centralized archive appliance.  In other words, all e-mail (excluding spam and the like) needs to be copied into a archiving system control by the institution, not individual employees.  (Employees might still keep their own copies of e-mails at their discretion, but centralized archival ensures that the institution gets a copy of everything.)

Centralized e-mail archiving is largely a departure away from Travis County’s option #1, and it's not option #2.

Policy?

 So precisely how long should an enterprise keep email records? There is no universally-correct answer. I have led in-house workshops to address this question at numerous, diverse enterprises. The outcome of these workshops has varied, depending on many factors, including corporate culture.

In my experience, the best email retention policy is one that is developed by collaboration of the various stakeholder departments in the enterprise (legal, IT, HR, operations et al.). Normally, these different stakeholders will start with different positions on what the policy should say. But, in my experience, after the stakeholders have talked through the issues, they tend to compromise their positions and coalesce into a policy that is unique to the enterprise.

--Benjamin Wright

Mr. Wright is senior instructor for the SANS Institute, where he teaches its 5-day course on the law of e-discovery, electronic records, data privacy and computer investigations.