Logs and Audit Trails for Data Privacy and Internal Control
Filtering Attorney Work Product
Electronic records such as email serve as memorials of business actions and as evidence of legal responsibility. But they are also vulnerable to abuse by privacy infringers or trade secret thieves.
One key to protecting e-records is metadata. Meta-data comprises all the ancillary notes and audit trail surrounding a given record (a given e-mail) . . . the system logs showing when a record was created, who accessed it and when, how and when it was changed, to whom it was forwarded and possibly much more. Metadata can illuminate an auditor or detective about the status, the history or the security of the record in question.
For records containing personally identifiable information (PII), good meta-data can be invaluable as an instrument of privacy. Metadata can deter a snoop. A busybody in a hospital who wants to peek at a celebrity’s patient record will think twice before doing so if he knows the system will create an audit trail showing what he saw and when he saw it. Further, in the investigation of a hacker incident, system logs can inform whether (for instance) the crook accessed credit card record X or social security number Y. Armed with this information, an investigator can evaluate whether the hacker did or did not actually breach the security of record X or record Y.
Example: In the wake of a security breach at one of its hotels, Best Western International was able to evaluate the breach and narrow the universe of affected credit card numbers by inspecting specific logs on the computer in question.
Accordingly, a well-crafted e-mail archival system will maintain extensive meta-data about each electronic mail record. The M+Archive product for instance keeps tabs on who viewed a record, when it was printed and so on.
Be all that as it may, sometimes system logs are undesirable. For example, when an attorney turns over records in an eDiscovery request, she normally should not turn over metadata that constitutes her own work product. As she reviews individual emails in an archival system, the system may be keeping meta-records showing which records she accessed, when she accessed them and how often. Those records are probably her attorney work product, which normally is excluded from disclosure in the discovery phase of litigation. She should normally screen out any such work product when she turns over required emails to another party.
I spoke to Ranjit Sarai, e-discovery expert at Messaging Architects. “The management of meta-data in an enterprise archival system can be tricky,” he said. “Normally you want the system to be making meta records for security and accountability purposes. But sometimes ediscovery lawyers want to turn this logging feature off, or they want to filter out their work product metadata before delivering records to an adversary. We have experience helping an attorney understand the options and craft a solution for her particular case.”
Mr. Wright often serves as a public speaker on the law of electronic records and investigations.