Electronic Data Records Law | How to Win E-Discovery

Corporate Social Media | Civil Lawsuit E-Discovery

Log-on and Password to Opponent?

A few cases have required a social media user to give his password, user name and log in ID to an opponent for ediscovery.  In these cases, the user was an individual.   But what if the user were an enterprise?

In Zimmerman v. Weis Markets Inc., an employee claimed he suffered great injury from a workplace accident, so he sued his employer.   But the public portions of his Myspace and Facebook sites contradicted some of his claims.   His employer surmised that non-public portions of his social sites would reveal more information relevant to his injury.

No Expectation of Privacy?

The Pennsylvania court compelled the employee to give to the employer his Myspace and Facebook passwords, user names and log in names.
 The court dismissed the employee’s claims to privacy, saying, “Zimmerman voluntarily posted all of the pictures and information on his Facebook and Myspace sites to share with other users of these social network sites, and he cannot now claim he possesses any reasonable expectation of privacy to prevent [his employer] from access to such information.”

What Do Social Media Privacy Policies Say?

The court went on to say, “All the authorities recognize that Facebook and Myspace do not guarantee complete privacy.  Facebook’s privacy policy explains that users post any content on the site at their own risk and informs users that this information may become publicly available.”

Although the privacy policies at those sites are very complex, the court did not engage in an in-depth analysis of the precise words in those policies.

Access to Email and Chat Messages?

Further, the court did not consider that those log-on credentials will grant access to the content of private, one-on-one chat or email messages, or messages that are the equivalent to private email.

Historically, in civil ediscovery, it has been more common to require an email user to turn over relevant messages -- one-by-one –- not to turn over his log-on credentials so the opponent can access all messages in his email account.

The configuration of social media sites is complex, and privacy for particular bits of information can often be adjusted with a fine degree of precision.  For example, in Google Plus, a user can “post” information on his page, but make it viewable by only one friend.  In effect, the “post” is analogous to a private email message to that friend.


Enterprise Data in the Cloud

Could the logic of Zimmerman be applied against an enterprise in a civl lawsuit?  Could it lead to a requirement that an enterprise turn over full administrator access credentials for a social networking facility the enterprise uses with its employees and select trading partners such as vendors and customers?

It is becoming common for firms to use services like Yammer or Chatter, third-party, cloud-based services, to provide “internal” social networking.

Imagine this scenario: The opponent of a corporation shows a court that public postings of the corporation, sent in connection with a service like Yammer, are inconsistent with claims the corporation makes in litigation.   The “internal” part of the service shares information among the corporation, its employees and selected “business associates.”  In the “internal” service, varying degrees of access are granted to different people for different bits of information.

Further imagine that the confidentiality terms of the service provider do not guarantee absolute confidentiality under all circumstances. (A service provider cannot make such a guarantee.)

Under the logic of Zimmerman, I can imagine the corporation’s opponent arguing that it should be given powerful log-on credentials so it can broadly view the part of the service used “internally” by the corporation.

Non-Disclosure Terms

What is a corporation using services like Yammer to do?   One step would be to liberally post terms and banners requiring users of the internal service to agree that the contents of the service are confidential and shall not be disclosed.   That step will not defeat all of the Zimmerman logic, but it will help to distance this corporate scenario from the facts of the Zimmerman case.  In Zimmerman, the employee did not post a notice on the private portions of his social sites requiring viewers to maintain confidentiality.

–Benjamin Wright

Mr. Wright teaches the law of data security and investigations at the SANS Institute.

Related Post: Social Network terms of service applicable to forensic investigation?

Tag Disclosed ESI | Privacy, Control, Security

Warn FBI, Auditor, Examiner, Adversary, Regulator, Investigator or Inspector General

Ediscovery Production Strategy-Services for Text, Email, Twitter, Facebook Google+ or Other Social Network Records

Subpoena . . . tax audit . . . court order . . . police raid . . . search warrant . . . criminal investigation . . . regulatory proceeding . . . administrative summons . . . grand jury inquiry . . . litigation discovery demand -- any of these could compel or motivate a party holding e-records to reveal or produce them.

But often the party that receives (or seizes) the records should be expected to safeguard them after they arrive.

Laws requiring the safeguarding of records are many and diverse.  One small example:  As a business discloses information to the federal government, it can (if justified) tag or annotate the information as a “trade secret.”  By so doing, the business warns government employees that they violate federal law (18 U.S.C. Section 1905) if they abuse the trade secret, such as disclose it to a competitor or to the news media.

Legally speaking, the tagging or annotating of records can be strategically powerful.  But when a large quantity of e-records (SMS, chat, e-mail, Web 2.0, iPhone, BlackBerry) is involved, manual annotation is laborious and expensive.

Emerging technology affords a solution.  Technology empowers producing parties to annotate (label, tag) records with ever-better precision and efficiency.

When records like instant messages are disclosed under law, it is becoming more common that they be disclosed in an electronic format that supports annotations, such as XML.

Electronic annotation (commenting) enables highly granular, specifically-targeted legal notices.  Targeted annotation can give the producing party an advantage.  The advantage is more apparent when large numbers of record are at issue and different records require different notices.

By long-standing practice, lawyers often mark disclosed records with warnings or reservations of rights. But historically these notices were expressed as general, blanket statements in transmittal letters. (See footnote.)

When numerous records are involved, blanket statements may not be as effective as specific, record-by-record annotations.   Suppose for example that five million email records are being produced.  Within those records are, say, 2137 that contain personally identifiable information (PII), which the producing party is obligated to safeguard.  The producing party may better fulfill its obligation by specifically annotating each of the 2137 with strong warnings, rather than with general notices covering the whole five million.  (Example:  “WARNING: This email may contain private data protected by law.  Access on need-to-know basis only.”)

Specific annotations can include any of a range of legal statements:  disclaimers, instructions, interpretations, cross references, self-serving language, reservations of rights, claims of privacy, contractual terms of use, designation as attorney work product and more.

According to Ranjit Sarai, e-discovery consultant at Messaging Architects, “Annotations can involve advanced services in e-record production.  Manual annotation of individual records can be very time consuming.  But we can recommend or develop routines for identifying relevant records and placing the prescribed annotations on them.  We can facilitate collaborative, team annotations.  We can also help bring the appropriate attention to annotations.  Some annotations should be understated.  Others should scream out in blinking neon lights.”

Update:  Tags and annotations can be inserted according to varying degrees of granularity, whether record-by-record, word-by-word, or something else.  US intelligence agencies are managing massive databases on terrorists by tagging each word, one-by-one.  A tag can show, for example, the level of security clearance an analyst needs in order to see the word.  Advanced search software can prevent an analyst from seeing information for which he does not have adequate clearance, while alerting him that the database may contain additional information relevant to his inquiry, access to which will require higher authority.   Siobhan Gorman, "How a Team of Geeks Cracked Spy Trade," Wall St. J., 4 Sept. 09.

–Benjamin Wright

Mr. Wright delivers education on cyber defense law under the SANS Institute.


Footnote:  A case known as Teachers Insurance(1) suggested that when a company discloses information to the Securities and Exchange Commission, it waives attorney-client privilege on that information, unless it explicitly reserves its privilege rights.  Applying that idea, a company in another case(2) attempted to make such a reservation of rights in the transmittal letter sent with documents disclosed to the SEC. 

(1)Teachers Insurance and Annuity Assn. of America v. Shamrock Broadcasting Co, 521 F. Supp. 638 (SDNY 1981).

(2)In re Subpoena Duces Tecum to Fulbright and Jaworski and Vinson & Elkins, 183 Fed. Sec. L. Rep. para. 99,505 (DDC 1983).

Internet Terms, Contracts, Disclaimers

Financial Derivatives Yield Unexpected Incentives

Hedge Fund Public Disclaimer of Liability-Responsibility?

Web Notice to Pre-empt Complaints | EMail Disclaimer | Contract Enforcement | Battle of the Forms

The World Wide Web is changing contract and commercial law practices.  As a global medium for broadcasting terms, notices, conditions, and disclaimers, the web empowers business innovators preemptively to warn their trading partners of risk and to disclaim responsibility to prospective counterparties.  Business innovators might therefore use the web to reduce their legal risk.

This blog post presents an advanced idea.  To explain it will require space, so please hang with me as I lay out my argument.  First I will explain how forward-thinking traders like hedge funds can be exposed to new legal liability.  Then I will explain a method for containing that exposure, a method that could apply to more than just hedge funds and financial markets.  

The legal desire to warn others and disclaim liability is acute in the cutthroat world of financial derivatives and structured finance.  Derivatives (which are fueled by efficient digital
technology), especially credit default swaps (CDS), allow aggressive traders to assume unconventional, counterintuitive positions – positions that may surprise and even anger other parties.  Three examples:

1. George Soros says some of the bondholders in the AbitibiBowater and General Motors bankruptcies perversely preferred to dissolve the companies rather than reorganize them on account of the bondholders’ positions in credit default swaps.  “CDS are instruments of destruction that ought to be outlawed,” he proclaimed (emphasis added).  Further, to hold both a bond and a corresponding CDS simultaneously “is like buying life insurance on someone else’s life and owning a license to kill him.” George Soros, “My three steps to financial reform,” Financial Times, June 17, 2009.

2. Some analysts complain about a Fidelity mutual fund that simultaneously held both bonds issued by the distressed Six Flags company and hedged CDS positions relative to those bonds.  According to the analysts, the mutual fund turned down a reasonable restructuring offer for the Six Flags company.  Strangely, the mutual fund preferred that Six Flags sink into bankruptcy where bondholders as bondholders would receive less.  The Economist magazine goes on to observe, “By purchasing a material amount of a firm’s debt in conjunction with a disproportionately large number of CDS contracts, rapacious lenders (mostly hedge funds) can render bankruptcy more attractive than solvency.” “CDSs and bankruptcy: No empty threat,” The Economist, June 20, 2009, p. 79 (emphasis added to highlight that the Economist thinks the mutual fund's behavior was bad and presumably should be punished).

3. Amherst Holdings, a Texas investment firm, “ambushed” some big banks.  The banks were counterparties to which Amherst had sold CDSs so that the banks could hedge their losses on bonds they owned representing defaulting mortgages.  From the sale of the CDSs, Amherst and its associates earned multimillion dollar fees from the banks.  Under the terms of the CDSs, team Amherst would have to pay handsomely as the losses from the defaulting mortgages were allocated under the bonds to the banks.  But then Amherst executed a maneuver that prevented the banks from collecting under the CDSs.  It used a little-known legal loophole to arrange (with the party that services the bonds) for the bonds to be paid in full! The banks were not prepared for this scenario. The result was that team Amherst did not have to pay as expected under the CDSs.  On balance, Amherst made money, and the banks lost the substantial fees they had paid team Amherst for the CDSs.  Some of the banks have complained to industry trade associations that Amherst acted improperly.  Zuckerman, Ng & Rappaport, “A Daring Trade Has Wall Street Seething,” Wall Street Journal, June 12, 2009. Deutsche Bank averred that a maneuver like Amherst’s might be illegal.

In each of these three stories, counterparties or other investors felt the successful traders had acted unfairly, possibly deceptively and perhaps even illegally.

When large sums of money are lost unexpectedly, losers are prone to seek legal or political redress. They might try to claim, for example, that they were victims of fraud or that they were entitled to more disclosure of the other party’s intention, position, or strategy.

Web Notice to Pre-empt Complaints

But in anticipation of the possibility of such legal claims, unconventional traders might take steps long in advance.  They might pre-empt such claims by issuing a general warning and disclaimer. They might conspicuously publish on their Web pages a notice like this:

“Notice. This is notice published by ABC Hedge Fund (the “Fund”) to the attention of any party that may have a direct or indirect relationship to the Fund’s investments, including but not limited to an investor, a counterparty or the issuer of debt, equity or other rights, interests or securities.  Please be advised that the Fund may assume or take advantage of innovative, unconventional or surprising positions.  While the Fund shall always stay in full compliance with all applicable laws, please be alert that the Fund may aggressively pursue trading or investment strategies that are novel or counterintuitive.  Except to the extent the Fund otherwise explicitly agrees in writing, the Fund disclaims responsibility to (a) inform others of its intentions, trading positions or investment strategies, or (b) look out for the interests of others or divine their intentions, strategies or expectations.”

Publication of such a notice/disclaimer would create electronic records suggesting that prospective “victims” had been warned in advance.

How effective might such a notice be?  Although the legal effect of any kind of disclaimer can rarely be certain for all circumstances, support is growing for the proposition that general-distribution legal notices can be delivered by way of publication on the web.  Observe four angles on the topic: