Electronic Data Records Law | How to Win E-Discovery

Email Recovery | Network Back-up

E-mail Database Search and Forensics

Archival | What is a Subpoena?

As litigation and other requests for e-mail from backup tapes grow more frequent, an enterprise may be wise to restore, consolidate and archive all of its old e-mail held in backup.

Historically organizations did not think of e-mail as an asset worthy of preservation.  They did not archive it, though copies would end up in network backup.  

But experience has taught that e-mail evidence can be critical to defense of a lawsuit or enforcement of a contract.  Alternatively its disclosure might be required under a subpoena (see definition below), a court order, an administrative summons, an IRS tax audit or a freedom of information act request (FOIA).  Further, e-mail might be needed in an investigation (led internally or by outside criminal prosecutors) of a bribe, a kickback, an overcharge, tax evasion or a embezzlement of money, or it might be needed for an audit of alleged misallocation of funds. 

Archival

Greg Smith of Messaging Architects observes that repeated requests for e-mails from backup can warrant a change of thinking in the IT department. “While most backup software deals very efficiently with individual electronic records, it cannot provide the same level of access to email. This is because enterprise email exists as a record within a database (such as for Groupwise or Microsoft Exchange).  The database must be restored in its entirety and searched in its entirety in order to ascertain the contents of the database. With database sizes exceeding 100GB and scores if not hundreds of tapes, the cost to restore and search the tapes can be considerable. Recovering records for selective users and dates may satisfy the current discovery requirement, but with each successive lawsuit, or changes in discovery parameters for an existing lawsuit, restoration from tape can become a recurring financial liability.”

Greg continues, “The practical solution is to remove the information from tape permanently and place it in an electronic records format where information can be retained and managed as individual records and not conglomerates of information.  In such a format, individual email records can be sorted by user or date.”

Restored records can be archived in an open (non-proprietary) format, such as XML, which enables searchers to tap an ever-expanding array of search and forensics tools.  XML may or may not qualify as "native format" as that term is sometimes used in court decisions, though XML may be a more useful format than whatever the native format was.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, experts in e-discovery and consultants in e-mail investigations.

Post Script  What is a subpoena?  A subpoena is a legal demand that someone turn over information or evidence. Commonly the laws of litigation enable a party to subpoena other parties for records or other evidence. Sometimes the law also invests the power to subpoena in an official who conducts investigations, such as a government auditor or an inspector general. If a party abuses the power to subpoena, by demanding irrelevant records or by issuing a demand with no regard for the cost of compliance, a court may sanction the issuer of the subpoena.

Text Email Home PC - BlackBerry - iPhone - Cell Phone

Discovery in Business Lawsuit?

How far will the law will go to get the e-mails, text message records, that are relevant to a legal inquiry like a lawsuit?

An eye-opening Canadian case is CIBC World Markets Inc. v. Genuity Capital Markets, [2005] O.J. No. 614 (S.C.J) (QL).

CIBC sued Genuity, alleging it had stolen trade secrets from CIBC.  When a lawsuit like this is filed, the parties are expected to apply a litigation hold to ensure no records are destroyed.  But a litigation hold is hard to implement if a litigant is not causing copies of all business e-mails to be stored in a central archive.  Furthermore, if the litigant is not storing copies of all its employees’ messages, then it may be forced to canvass their home computers.
 
In the CIBC case, the court permitted forensics experts to go to great lengths and expense to locate e-mail.  They were granted access to all PCs, BlackBerries (smart mobile phones) and similar devices under the influence of the Genuity's employees, including devices at home (like iPods, iPhones or Androids) and belonging to spouses and children!  (In an investigation like this, imagine what goes through the mind of an employee who might have been involved in any kind of marital strife or infidelity.)

The lesson from the case is that enterprises are wise to keep extensive, centrally-managed archives of all business-related e-mail (including webmail, SMS, MMS [multimedia message service], text messages and instant messages) by employees and other personnel.  That way they avoid the expense and hassle associated with searches of home computers and other personal gadgets.

This topic grows more important as informal electronic contracting, such as trading in OTC derivatives, attracts greater scrutiny, regulation, litigation and investigations.

–Benjamin Wright

Click Here

 

Mr. Wright teaches electronic data and records law at the SANS Institute.

Electronic Discovery Professional Duty

Falsehoods and Duty of Confidentiality

What is an e-forensics specialist to do when she discovers her client has been lying to her?  Typically this kind of computer specialist is hired to find, audit and report on electronically stored information (ESI).  If the specialist has been making representations to others -- such as a court, an internal investigator or an inspector general who has issued a subpoena, on the basis of what she now knows to be lies, she is in a bind.  Like any professional working for a client on a sensitive matter, the specialist will likely owe the client a duty of confidentiality.  Normally she will have signed a non-disclosure agreement. 

How to Preserve Reputation?

The specialist’s reputation is at stake. Obviously, to disassociate herself from misrepresentation, she can withdraw from the engagement.  But she fears that the third party will continue to rely on her representations, which are no longer well-founded. 

A practical technique available to this specialist is known as the noisy withdrawal.  Although noisy withdrawal is most commonly known from cases where lawyers learn that their clients have been lying to them, the technique is a responsible measure available any ethical professional.  

In a noisy withdrawal a professional announces that he is withdrawing from representation of his client. In addition (this is the noisy part) he declares to interested third parties that he disaffirms his prior statements made on behalf of the client.  With the noisy withdrawal, the professional aims to preserve his own credibility, without compromising the client’s secrets.  He does not reveal why he is withdrawing, why he is disclaiming prior statements or any information his client has told him.

Examples of Noisy Withdrawal

A recent example of a noisy withdrawal occurred in the investigation of Stanford Financial Group. Attorney Thomas Sjoblom had represented the firm before the Securities and Exchange Commission as it examined alleged fraud, corruption and irregularities.  But then he made a noisy withdrawal from the engagement.  Observers surmised that as the case progressed he had come to disbelieve what his client had been telling him. Kara Scannell, “Top Lawyer’s Withdrawal from Stanford Case Waves a Flag,” Wall Street Journal, Mar. 6, 2009.

Another famous example transpired in the Whitewater investigation during the Clinton presidential administration.  Legendary ethics expert Sam Dash made a noisy withdrawal when the Whitewater Independent Counsel wrongly gave the impression that Professor Dash endorsed the Counsel’s conduct.  (By the way, prior to this story, the late Sam Dash was my ethics professor in law school.  Over the long run, I hope Professor Dash’s teaching helps me stay out of trouble!)

–Benjamin Wright

Mr. Wright teaches cyber defense law at the SANS Institute, where he emphasizes the role of ethics and savvy public communications.

Computer Forensics Experts: State Law Regulation

E-Evidence Collection and Processing for Traffic Cameras

The Texas Private Security Bureau issued an opinion saying it "generally" believes the operators of red-light cameras need not be licensed as private investigators.  The opinion may help us interpret law on the licensing of computer forensics experts.

The Bureau’s rationale is that the camera operators are performing mere "ministerial" actions at the direction of municipal government employees. (By qualifying its opinion with the word “generally,” the Bureau implies there could be exceptions.) In other words, the Bureau seems to believe the operators are not conducting the investigations that trigger a licensing requirement; rather, the municipalities are performing the investigations.

What Is This Government Agency?

The Private Security Bureau is the state government agency charged with implementing the PI licnesing law.  Its opinion is authoritative and carries weight.  Its formal opinion shows how the Bureau would interpret the law in an enforcement setting.  But the Bureau's opinion is not the last word on the meaning of the law.  While worthy of respect, the Bureau's opinion is not necessarily binding on a court.

Background: As reported before, a Texas judge held that the operator of a red-light traffic camera violated the law by failing to hold a private investigator's license. Now, for help in arguing the judge was wrong, the camera operator has appealed to the Private Security Bureau, and the Bureau has spoken.

Texas Legislation

This controversy is an unintended consequence of recent Texas legislation compelling computer forensics experts to get licensed as private investigators under state regulation. Last year the legislature amended the Texas Occupation Code so that Section 1702.104  now reads: "(a) A person acts as an investigations company [which must be licensed] if the person: (1) engages in the business of obtaining or furnishing, or accepts employment to obtain or furnish, information related to . . . the cause or responsibility for . . . loss, accident, damage, or injury to a person or to property. . . . (b) For purposes of Subsection (a)(1), obtaining or furnishing information includes information obtained or furnished through the review and analysis of, and the investigation into the content of, computer-based data not available to the public."

Analysis of Bureau's Opinion

Let's examine the logic of the Private Security Bureau in excluding traffic light camera operators. The Bureau reasons that Sec. 1702.321(a) excludes government employees from being licensed. Thus, thinks the Bureau, if at the direction of government employees (such as employees of the municipality of College Station) a business (i.e., a camera operator) performs “ministerial” acts in an investigation (i.e., obtaining of evidence), then that business need not be licensed.

So what is the implication of the Bureau’s logic?  Just as 1702.321(a) excludes government employees from licensure, Section 1702.324 excludes other people, such as “an attorney while engaged in the practice of law.” The reason for excluding attorneys is that they are licensed under the bar association.  It would seem that if direction from a government employee overcomes the need for a license, then direction from an attorney would overcome it too.

Therefore, it would seem that if an attorney hires a computer forensics professional to preform ministerial acts, then the professional would not need to get a PI license. But the Bureau does not explicitly say that.

Neither does the Bureau tell us what constitutes “ministerial” acts. Note that the Bureau opines that ministerial acts would exclude a person from the licensing requirement, even though the statute itself does not say that. Section 1702.104 broadly purports to require licensure for anyone engaged in the business of obtaining or furnishing investigative evidence.

Assessment of Bureau's Opinion

My own feeling is that the Bureau is headed in the right direction. A reasonable, practical interpretation of this too-broadly-worded statute would exclude from licensure those people (including businesses) engaged in collection of evidence under the close direction and supervision of another qualified person such as a government employee or a licensed attorney.

What I don't know is this:  Are red-light camera companies actually performing under the close direction and supervision of government employees?

–Benjamin Wright

Mr. Wright teaches the law of cyber investigations at the SANS Institute.

Update 2013:  Private investigator licensure can be unexpected issue in cyberspace.

EDD | Professional Ethics & Responsibility

Red Light Traffic Camera Records Challenged in Civil Lawsuit

Do the collection and evaluation of electronic records for use in court require a professional license? In litigation a mistake on this question can surprisingly cause a party to lose a lawsuit.

One Court Rules

A Texas judge ruled the company operating a red-light enforcement camera (Affiliated Computer Services (ACS)) was acting illegally because it did not have a private investigator license.  As the operator of the system, the company was involved in collecting and evaluating electronic records for the purpose of presenting findings in court.  This case has spawned an uproar statewide, where motorists (such as Jim Ash, citizen of College Station, Texas) are challenging traffic tickets, demanding repayment of fines they’ve paid and complaining about police and politicians who support automated (robo-cop) traffic enforcement.  

In effect, motorists are arguing the digital evidence against them should be thrown out of court because it was managed by an investigator who should have been licensed but was not.

Broadly-Worded Texas Legislation

The controversy in Texas is an unintended consequence of recent legislation compelling computer forensics experts get licensed as private investigators under state regulation. Last year the legislature amended the Texas Occupation Code so that Section 1702.104 now reads: "(a) A person acts as an investigations company [which must be licensed] if the person: (1) engages in the business of obtaining or furnishing, or accepts employment to obtain or furnish, information related to . . . the cause or responsibility for . . . loss, accident, damage, or injury to a person or to property. . . . (b) For purposes of Subsection (a)(1), obtaining or furnishing information includes information obtained or furnished through the review and analysis of, and the investigation into the content of, computer-based data not available to the public."

In our digital age, this is broad language that might be read to cover data collection and evaluation activities unexpectedly. [*First Footnote] It might cover activities not only in criminal investigations, but also in civil lawsuits like bankruptcies and failed business deals.  In Texas the traffic violations in red-light camera cases are often civil law matters, not criminal law.

When the Texas legislature amended the Occupation Code, I'm sure it did not realize it might be forcing local state governments (like the municipality of College Station) to return millions of dollars in revenue from run-of-the-mill, civil law traffic tickets.  

On its face, it is unclear whether Section 1702.104 covers the mere searching for and collection of computer data, as distinguished from the review/evaluation/assessment of its content.  

Is this Licensure Requirement Wise?

The computer (IT) forensics profession argues that a broad understanding of private investigator (PI) licensure is unwise. In August 2008 the profession persuaded the American Bar Association to pass Resolution 301  urging lawmakers to “refrain from requiring private investigator licenses for persons engaged in:

- computer or digital forensic services or in the acquisition, review, or analysis of digital or computer-based information, whether for purposes of obtaining or furnishing information for evidentiary or other purposes, or for providing expert testimony before a court; or

- network or system vulnerability testing, including network scans and risk assessment and analysis of computers connected to a network.”

The ABA argues that computer forensics is a separate profession from private investigation and should be treated differently.

Details of the controversy between these two professions vary from state to state. E-discovery professionals should know the PI licensure laws and regulations of the states in which they work.

Update:  The Texas Private Security Bureau has weighed in with an opinion on this topic.  See my analysis.

Another update:  Citizen Jim Ash believes he has found evidence that the contract between the camera company in his case (American Traffic Solutions or ATS) and the city of College Station violate the Texas legislation enabling automated red-light enforcement.  Ash says Texas law forbids the company from being paid based on a per-violation basis.  But he reads the contract between ATS and the city as providing such payment.

Update June 2009:  Jim Ash has launched a referendum [**Second Footnote] drive to ban red light cameras from College Station.  In just a couple of weeks, he has amassed 744 of the 850 voter signatures he needs to get the measure on the ballot.

–Benjamin Wright

*First Footnote:  One of the reasons Section 1702.104 has attracted notoriety is that, in enforcement of the Section, the Texas Private Security Board reportedly sent letters to Geek Squad (!). The letters warned the intrepid computer repair guys not to learn about child, spouse or employee use of the computers they are fixing.

**Second Footnote:  When I originally wrote about Jim Ash's voters' effort in College Station, I called it a "referendum," not having researched or thought about the technical difference between a referendum and a petition initiative under the city's charter or under the Texas law of municipalities.  I have since learned that the effort is a "petition initiative," not a referendum.