Electronic Data Records Law | How to Win E-Discovery

How to store e-mail long term?

Is Archival Affordable?

As a mere lawyer, I struggle to understand from a technical perspective how to implement e-mail retention policy in a larger organization across many years.  Legally, the organization may – due to litigation hold or other factors – have incentive to store some (maybe a lot) of email a long time, more than five or seven years.

Legally speaking, the biggest mistake with e-mail records is to destroy them too early.  That could be spoliation.  So why not delay destruction a long time?

In theory long-term storage of much e-mail should not be expensive because the cost of raw storage is dropping.  However, IT folks in my SANS courses argue that the cost of storage media is not the key issue.  They argue the overhead associated with massive storage is high (they bring up things like expensive disk arrays).

Destroy Backup Tapes, Obstruct Justice?

Canada | Politician Emails Lost?

Which employee wants to be the target of a criminal investigation into whether public record e-mails were wrongfully destroyed?  Observers of a political corruption lawsuit in British Columbia were shocked to learn that – while the well-known lawsuit was pending – IT employees destroyed backup tapes  containing key e-mails by executives (i.e., government officials negotiating the sale of the then-government enterprise, BC Rail).  

This kind of news sounds sensational in the press.  The public naturally wonders what the justification was for erasing records.  How much does it cost, citizens ask, just to retain some tapes a few more years?  Did someone apply a record destruction policy as a convenient way to eliminate embarrassing evidence?  Should the employees not have observed a "legal hold" (also known as "litigation hold") on the records?

Such destruction of records, during an on-going prosecution, could be grounds for a criminal investigation into obstruction of justice, said a local expert quoted in the BC news media.

Such destruction of records may also qualify as spoliation, worthy of sanctions by a court.

Easy to Write Policy | Hard to Follow

In the field of records management, it is easy to write a policy that says an enterprise will destroy records like email regularly, but will apply a "legal hold" when a lawsuit or investigation arises.  However, in practice, to institute a legal hold is hard.  It is hard for the responsible employees to understand when and where they need to apply a litigation hold. 

Consider this issue from the perspective of employees in government agencies or other large enterprises.  They don’t want to do anything illegal.  But for an employee to stay fully informed of all pending lawsuits and investigations (even well-known ones) can be very difficult in practice.  Many employees who have control over email records do not know all of the matters to which they many pertain.

Safer Course

From the perspective of employees, the safer course of action is to retain electronic records of executives generously, for a long time.  Modern technology is causing the cost of email retention to drop. To retain a lot of e-mail is not as expensive as retaining a lot paper holding the same content.

–Benjamin Wright

Mr. Wright teaches e-records management and cyber investigations law at the SANS Institute.

Native Format Electronically Stored Information?

Collection, Production Tactics | Ordinarily Maintained or Reasonably Usable Form

In eDiscovery, ESI can be produced in many forms.  For both the requesting party and the producing party, the form chosen can impact strategic issues like cost, search-ability and ease of manipulation.  Form of production can be a contentious issue between litigants.

California’s new electronic discovery rules (Assembly Bill 5 - amendments to the California Rules of Civil Procedure) set a framework for negotiating the form of ESI production.  

Amended Section 2031.030(a)(2) of the Code of Civil Procedure provides:  “A party demanding inspection, copying, testing, or sampling of electronically stored information may specify the form or forms in which each type of electronically stored information is to be produced.”  [Notice the words "testing" and "sampling". 

 They are a nod to the future of eDiscovery, where one-by-one review of records is impractical, so statistical methods are used instead.] 

Further, amended Section 2031.280(d) provides:  “Unless the parties otherwise agree or the court otherwise orders, the following shall apply: (1)  If a demand for production does not specify a form or forms for producing a type of electronically stored information, the responding party shall produce the information in the form or forms in which it is ordinarily maintained or in a form that is reasonably usable.”

Like the FRCP, this framework leaves lots of room for negotiation and disagreement.  

“When collecting a unit of ESI (such as an e-mail) within an organization, we might find it in more than one format,” says Greg Smith, eDiscovery specialist at Messaging Architects.  “It might be in network backup.  It might be an e-mail management system like Groupwise.  It might be in an archival system like M+Archive.  It might be in other formats and locations too.”

Leading courts like Williams v. Sprint/United have spoken of production of ESI in its “native format.” For courts like Williams, the rough idea is that a unit of ESI should come with its original meta data and structure, so as to enable better insight into what the ESI was and what it meant.  

According to Greg Smith, “The concept of native format might mean different things for different circumstances in an enterprise information system.  For example, the structure and metadata applicable to a given e-mail might be different depending on whether the email is collected from an electronic mail system like Microsoft’s Exchange or from an archive appliance like Symantec’s Enterprise Vault.  It’s my job to help trial counsel understand the different possibilities, evaluate options and then document/explain the format decisions and actions that are executed in ESI collection and production.”

–Benjamin Wright

Mr. Wright is an affiliate of messagingarchitects.com, experts in eDiscovery services.   Here is an ARMA podcast describing Messaging Architects' work in e-mail archiving, including its workshop for development of an email records policy in an enterprise.

Email Recovery | Network Back-up

E-mail Database Search and Forensics

Archival | What is a Subpoena?

As litigation and other requests for e-mail from backup tapes grow more frequent, an enterprise may be wise to restore, consolidate and archive all of its old e-mail held in backup.

Historically organizations did not think of e-mail as an asset worthy of preservation.  They did not archive it, though copies would end up in network backup.  

But experience has taught that e-mail evidence can be critical to defense of a lawsuit or enforcement of a contract.  Alternatively its disclosure might be required under a subpoena (see definition below), a court order, an administrative summons, an IRS tax audit or a freedom of information act request (FOIA).  Further, e-mail might be needed in an investigation (led internally or by outside criminal prosecutors) of a bribe, a kickback, an overcharge, tax evasion or a embezzlement of money, or it might be needed for an audit of alleged misallocation of funds. 

Archival

Greg Smith of Messaging Architects observes that repeated requests for e-mails from backup can warrant a change of thinking in the IT department. “While most backup software deals very efficiently with individual electronic records, it cannot provide the same level of access to email. This is because enterprise email exists as a record within a database (such as for Groupwise or Microsoft Exchange).  The database must be restored in its entirety and searched in its entirety in order to ascertain the contents of the database. With database sizes exceeding 100GB and scores if not hundreds of tapes, the cost to restore and search the tapes can be considerable. Recovering records for selective users and dates may satisfy the current discovery requirement, but with each successive lawsuit, or changes in discovery parameters for an existing lawsuit, restoration from tape can become a recurring financial liability.”

Greg continues, “The practical solution is to remove the information from tape permanently and place it in an electronic records format where information can be retained and managed as individual records and not conglomerates of information.  In such a format, individual email records can be sorted by user or date.”

Restored records can be archived in an open (non-proprietary) format, such as XML, which enables searchers to tap an ever-expanding array of search and forensics tools.  XML may or may not qualify as "native format" as that term is sometimes used in court decisions, though XML may be a more useful format than whatever the native format was.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, experts in e-discovery and consultants in e-mail investigations.

Post Script  What is a subpoena?  A subpoena is a legal demand that someone turn over information or evidence. Commonly the laws of litigation enable a party to subpoena other parties for records or other evidence. Sometimes the law also invests the power to subpoena in an official who conducts investigations, such as a government auditor or an inspector general. If a party abuses the power to subpoena, by demanding irrelevant records or by issuing a demand with no regard for the cost of compliance, a court may sanction the issuer of the subpoena.

Cull ESI

Search Costs in E-Discovery and E-Disclosure

Does the cost of filtering attorney-client communications from legal disclosures justify a policy of skimpy retention of email?

To understand that question, we need background:  If an enterprise possesses records, it must be prepared to disclose them when required to do so by law.  Disclosure entails effort to find and compile the relevant records.  If the records are paper, the searching and compiling are performed manually.  But if the records are electronic, automated methods for searching and compiling may be available.

For records of electronic mail, modern archival technology enables easy searches, even if the number of records is large.  Search engines can make finding/compiling records rather low cost.  From a policy perspective, those low costs help to justify more complete and lengthy retention of e-mail within an enterprise.

But wait. Some say those low costs are offset by the expense of screening out attorney communications when law requires that the enterprise disclose records.

Is that true?  Let’s analyze the topic.

When the owner of e-mail records such as a public agency must release records under e-discovery or freedom of information act (FOIA), the owner may normally withhold those records protected by attorney-client privilege.  Why?  The law wants to encourage open communication between counsel and client and to enable lawyers to create work product outside the scrutiny of adversaries.

Given this right to withhold, a record holder naturally wants to cull out any protected attorney communications before it discloses records.  If performed manually, this detection and sifting can involve much time and expense.  Some therefore argue the holder would have been wiser in the first place not to have retained the records.  They advocate deleting e-mail records as soon as possible.  If the holder does not possess the records, they say, the holder avoids the eventual cost of filtering out the protected records.

That argument, however, ignores how rapidly search engines are advancing.  Advanced search engines employing artificial intelligence and other techniques can (so their promoters claim) outperform lawyers when examining copious records. See, Daniel Fisher, “The Data Explosion,” Forbes, October 1, 2007.  I courageously predict search engine advances will accelerate as better search methodology and algorithms are developed.

As search technology improves, the need for expensive, manual screening for protected communications diminishes.

Sure, search engines can make mistakes. A lady from a government agency reminded me that if a privileged e-mail slips out in a FOIA disclosure, the law provides no way to claw it back.  So her agency tediously examines e-mails before divulging them.

My reply:  people make mistakes too.  Moreover, the risk of an occasional privilege slip-up is small reason for a government agency to adopt a policy of early e-mail destruction.  While I respect the agency’s need for confidentiality with its lawyers, many other considerations suggest the agency is wise to keep generous electronic mail records.

Another point:  is it really in the public’s interest for a government agency to place colossal emphasis on protecting its lawyer records?

As the costs drop for implementing pretty-good automated measures for screening out protected records, the argument for minimizing the size of email archives drops too.

–Benjamin Wright, JD