Electronic Data Records Law | How to Win E-Discovery

Behavioral Biometric Forensics | Privacy

Computer interfaces to measure and record human movement are becoming more common.  These recorded measurements can be analyzed forensically to help identify people.

Microsoft is about to launch Kinect, a technology for detecting and interpreting the movement of humans in a defined space, like a living room.  Initially Microsoft will apply the technology to its Xbox game console, so that players can interact by moving their bodies rather than moving a joystick or a wii-mote.  With time, however, Microsoft envisions Kinect gathering human input in many computing environments.

Even though Kinect may today not be intended for biometrics, it will be capturing biometrically measurable information about the movement of people.  To one degree or another, the way an individual moves (walks, swings her arms and so on) is unique.    If Kinect is capturing and measuring movements, it is inevitable that the measurements will be recorded.  

If records exist, then it is only a matter of time before they become the subject of an investigation into who was interacting with a certain computer at a certain place and time.  Cell phones and toll road tags were not intended to track the whereabouts of users.  But they collect a lot of data about the location of people at particular times, and that data became irresistible to divorce lawyers and criminal investigators, who, using the power of law, were able to demand access to the data.  

Imagine an interactive display in a shopping mall.  As patrons walk by, they can interact with the display by dancing, jumping or waving.  But eventually there will be an investigation into whether Joey walked by that display (on his way allegedly to rob a store), and authorities will access the data for analysis.

Other sources of measurements for human movement are the accelerometers in iPhones.  They have been used to measure, for example, the gait of the person holding an iPhone.  If those measurements can be captured, someone can write an app to record them.  Then, contrary to the intention of the app writer, some investigator will lawfully tap those records in e-discovery to find out who was using the iPhone.

Behavior biometric measurements are not, by themselves, highly reliable identifiers of individuals.  However, the measurements can be forensically meaningful.  When combined with other indicia of identity (such as eyewitness identification), biometric measurements can help to pinpoint someone.

Behavioral biometric records will be a new privacy battleground in coming years.

Text Messages Wiped from BlackBerries

Lawsuit Evidence Erased from Personal & Corporate Cell Phones | Court Punishes | Business Policy

To spoliate means to destroy or conceal evidence that one has reason to believe will be needed in litigation.  If a court finds a litigant has spoliated evidence, such as records, then the court will impose penalties.

Courts have punished many organizations for failing to keep electronic mail records.  Logically, the same punishment awaits organizations that fail to retain executive text

and instant messages, but to support that proposition I’ve not been able to cite a case.  Now I can cite Southeastern Mechanical Services, Inc. v. Brody, 2009 WL 2883057 (M.D. Fla. Aug. 31, 2009).

In a trade secret lawsuit, the court had ordered several employees of the defendant to surrender their BlackBerries to forensic experts for investigation.  (Two of the BlackBerries belonged to the corporate defendant; one was the personal property of the employee.)  But when the experts received the BlackBerries, the devices were devoid of data – no text message records, no calendar items, no call history, nothing.  The court knew that the employees regularly used the devices for more than just telephone calls. 

The defendant argued there was no spoliation because the devices were configured so that all electronic mails would be copied and preserved in the defendant’s corporate e-mail server.  Yet the court was highly suspicious. What about text messages?  Those were not copied to the e-mail server.  Why were all of the devices wiped clean? 

The court concluded that the defendant and/or its employees had intentionally destroyed records such as text messages on the smart-phones.  As punishment the court dealt the defendant a strategic disadvantage in the lawsuit, in the form an adverse inference for the jury later in the lawsuit.  (In other words, as the jury is empaneled, it will be informed that the defendant had mishandled important records, which could be taken as a strike against the defendant.)

Lesson:  As a matter of policy, an enterprise is wise to preserve the business text and instant messages (IM) of its employees – especially executives, managers and professionals -- just as it does email.  A text message can be legal evidence just as an email can be.

The phones in this case were BlackBerries.  It seems the outcome would have been the same were the phones, Androids, iPhones (which now supports MMS) or some other form of PDA.  Eventually, we'll see cases dealing with record retention/destruction for MMS (multimedia messaging service).  Soon thereafter the cases will address high definition (HD) videoconferencing, also known as telepresence.

Update:  A policy workshop I led created some language for enterprise policy on recording text, Facebook and other "unconventional" electronic business messages.

Another Update: Modern smartphones like the HTC One allow the user to back text messages up to an email account, like an enterprise account. Thus, when an executive sends or receives a legally significant text message, she can archive it in her enterprise email account.

–Benjamin Wright

Mr. Wright teaches eDiscovery and Data Security Law at the SANS Institute.

Text Email Home PC - BlackBerry - iPhone - Cell Phone

Discovery in Business Lawsuit?

How far will the law will go to get the e-mails, text message records, that are relevant to a legal inquiry like a lawsuit?

An eye-opening Canadian case is CIBC World Markets Inc. v. Genuity Capital Markets, [2005] O.J. No. 614 (S.C.J) (QL).

CIBC sued Genuity, alleging it had stolen trade secrets from CIBC.  When a lawsuit like this is filed, the parties are expected to apply a litigation hold to ensure no records are destroyed.  But a litigation hold is hard to implement if a litigant is not causing copies of all business e-mails to be stored in a central archive.  Furthermore, if the litigant is not storing copies of all its employees’ messages, then it may be forced to canvass their home computers.
 
In the CIBC case, the court permitted forensics experts to go to great lengths and expense to locate e-mail.  They were granted access to all PCs, BlackBerries (smart mobile phones) and similar devices under the influence of the Genuity's employees, including devices at home (like iPods, iPhones or Androids) and belonging to spouses and children!  (In an investigation like this, imagine what goes through the mind of an employee who might have been involved in any kind of marital strife or infidelity.)

The lesson from the case is that enterprises are wise to keep extensive, centrally-managed archives of all business-related e-mail (including webmail, SMS, MMS [multimedia message service], text messages and instant messages) by employees and other personnel.  That way they avoid the expense and hassle associated with searches of home computers and other personal gadgets.

This topic grows more important as informal electronic contracting, such as trading in OTC derivatives, attracts greater scrutiny, regulation, litigation and investigations.

–Benjamin Wright

Click Here

 

Mr. Wright teaches electronic data and records law at the SANS Institute.

Documentation for Swap Contracts

Electronic Records of OTC Derivatives Contracts

New financial regulations, when coupled with advancing technology, will force the retention of massive electronic commerce records.  Hear what the authorities are saying about the regulation of financial derivatives:

First:  Famed economist Hernando de Soto says poor documentation for $1 quadrillion worth of financial derivatives is wreaking havoc on the world economy. "Toxic Assets Were Hidden Assets," Wall Street Journal, 3/25/09, pA13.  He calls for much better documentation of derivatives contracts.

Second:  Former SEC Chairman Harvey Pitt recommends much new record-keeping and reporting by entities like hedge funds that have not previously been regulated. “Former SEC chief says gather, share more data,” USA Today, 3/27/09 p3B.

Third:  To prevent more of the “toxic” assets poisoning today’s financial system, Treasury Secretary Geithner says, “We will require that all non-standardized derivatives contracts be reported to trade repositories and be subject to robust standards for documentation and confirmation of trades, netting, collateral and margin practices, and close-out practices.”

What’s the definition of a “non-standardized derivatives contract?”  It’s really just a negotiated contract that allocates risk between two or more parties.  It can cover most any kind of risk or possibility, from the risk of a lawsuit to the potential for rain in the Australian Outback.  (A derivative can even be "embedded" in an routine commercial contract, such as a sale agreement or a mining agreement.)  The scope of this field is breathtaking.  Non-standardized derivatives contracts have become a very large, thinly-monitored part of our financial world. 

So what’s a complete record of one of these derivatives contracts look like?  Would it be a stack of paper, stapled together, with signatures at the end?  It could indeed be such a stack of paper. 

But . . . let’s think deeper about how contracts are documented these days.  As the methods for written business communication – letter, telex, fax, e-mail, instant message and so on -- have grown progressively more cheap and easy, the challenges for documenting complex contracts have risen.

If the derivatives contract were entered in the 1970s, using the practices of the day, a stack of paper, stapled together, would most likely be the form it would have taken.  It might have been supplemented with a few paper letters and, once-in-a-blue-moon, a telex or two.  (Some court cases enforced telex similar to paper correspondence.)

Then in the 1980s faxes became popular, and the contract might have been a stack of stapled paper, supplemented or amended by several faxes. (We learned years ago that faxes can be legally-binding records, just like paper-written letters.)  

Next, in the 1990s e-mail started to become a common form of business communication.  Numerous judicial decisions have held e-mail to be legally-binding “signed writings” essentially equivalent to paper letters.  

See JSO Associates, Inc. v Price (informal e-mails can constitute signed writings agreeing to hire a broker to sell securities and pay a commission) and Cloud Corp. v. Hasbro (formal paper contract that says it can be amended only by a signed writing is amended by informal e-mails).

The e-mails in a contractual relationship can be very numerous.  And they often are not as clearly written as old-fashioned, formal paper contracts were.

Today non-standard derivatives contracts (a.k.a. "swaps," or "custom," "customized," "tailored," "bespoke" or "bilateral" derivatives) can be negotiated, documented, amended, supplemented and interpreted by a dizzying array of electronic communications.  Fax and e-mail are probably most common, but instant messages, phone text messages, chat rooms, message boards, social networking channels and voicemail-converted-to-text are rising in usage among busy traders.  (Dedicated online marketplaces like Agora-X and 360T provide organized electronic environments for communication and negotiation of over-the-counter derivatives instruments.  A brochure for 360T says its secure marketplace supports "Real-time online chat with any requesting counterparty individual.")

In the derivatives world, "novation" (substitution of one counterparty for another) commonly occurs by e-mail.

All this communication can be critical to full documentation for a modern financial contract.  In the Lehman Brothers bankruptcy, for example, the administrator digs through mountains of e-mail to figure out what the firm’s rights and obligations were in the over-the-counter derivatives market.