Electronic Data Records Law | How to Win E-Discovery

Archive Facebook Business Messages

Employee Policy

Professionals, business people, and government employees are increasingly using Facebook and other social media for official business, often as agents of their employers.  Commonly, the employers are required or well-advised to make and keep records of the employees’ social media communications. 

This issue arose in a workshop that Messaging Architects and I led at a sizable enterprise (having about 8000 employees).  The purpose of the workshop was to establish policy on the retention of electronic records. The workshop pulled together representatives of disparate stakeholders within the enterprise, including the IT, legal and compliance departments.

Workshop participants, including representatives from human resources, feared that employees would ignore a policy that forbids them from using text messages, Facebook and Google Buzz to transact business.  So the workgroup drafted this language for adoption as HR corporate policy: 

“If an employee uses electronic messages for business, outside an enterprise email system account, the employee is expected to strive to make records of the messages such that they are within the control of the enterprise.”

Dear Reader:  What do you think of such a policy?

Next question:  Speaking practically, how would an employee make and keep records of Facebook communications?  I don't have all the answers, but here's a step to consider:

Facebook allows a user to submit many of his postings via email. So at http://www.facebook.com/mobile/?v=web Facebook shows the user that if he sends some text to a special email address, then the text will be posted as coming from the user. 




















For example,  . . .   here is a screenshot of a message I posted from my email account:









Facebook posts this kind of incoming email as a status update to the user’s Wall.  Note that when a user like me submits text via email, the only text that appears on the user’s Wall (status update) is the text in the subject line of the user’s email. If the user writes anything in the content of the email, Facebook seems to ignore it and seems not to post it.

Thus, in the example above, I wrote all the text in the subject line of the message from my email account to my FB account.

If an employee were to submit to FB by way of her employer-controlled e-mail account, then the account would retain the submission according to whatever record retention/destruction policy the employer has set – 90 days, seven years, or whatever. [Interesting questions: In the employer's email system, are there limits to the number of characters that can be transmitted in the subject line of an outgoing message and can be stored in the record of that message?]

A FB user can submit more than text from his email account. The FB user can also submit a photo (or even a video). FB posts the photo on the user's Wall, with text taken from the subject line of the email. For instance:


















So . . . the above is one convenient way for a business professional to store her Wall posts into her employer's email system, such that the posts will be preserved for audit, inspection, supervision, ediscovery, litigation hold and the like. 

I argue that email archives are the starting place for any enterprise that wishes to maintain electronic records for legal compliance purposes.  I argue the same goes for Twitter.

My ideas here leave scads of answered questions, such as how to record comments that others post on the user's Wall.

–Benjamin Wright

Mr. Wright teaches IT and records management law at the SANS Institute, where social network law is part of the curriculum.  He chairs a (proposed) SANS conference on e-records and e-discovery slated for Las Vegas, September 2010.

Update:  Cutting-edge Web 2.0 lawsuit.

Court Judges Corporation’s Record Retention-Destruction Routine

Phillip M. Adams & Associates v. Dell Inc.

Corporate record retention policies are taking a beating in court.

Conventional policy instructs employees to look at records on a one-by-one basis and decide according to rational standards what to keep and what to destroy.  Conventional policy further provides that when litigation arises, then a legal hold is applied – that is, record destruction is suspended and relevant records are retained.  Classic records and information management (RIM) theory holds that if a corporation follows such a conventional policy, then the corporation should not be penalized in litigation for improper destruction of records.

But the theory is not holding up.  Over the past decade, legal authorities have looked askance at record destruction policies.

At an emotional level, the attitude of authorities is, “What?  You’re telling me, big enterprise, that you don’t have any records on the topic of this lawsuit because you told your employees to destroy records (or you set up your system to destroy records automatically unless employees undertake arduous steps to preserve them)?  Explain that to me.  What is the urgency to destroy records in this digital age?   Maybe when records were paper an enterprise needed to rid itself of documents that occupy a lot of real estate and are hard to search.  But e-mail archives do not take up much physical space, and they are amenable to automated search.  I have a pointed question for you, big enterprise:  Did you as a matter of policy winnow down the number of your records so that you could achieve a general advantage in lawsuits?”

The legal system is unhappy with an enterprise that destroys records for the purpose of positioning itself for future litigation, even litigation that is not specifically anticipated.  The system calls that behavior spoliation.

Phillip M. Adams & Associates v. Dell Inc. is a striking case.  It sanctioned a company for destroying records for some years before the lawsuit was filed or specifically threatened.  In accordance with the company's policy, employees (including an engineer or two) destroyed records, or they refrained from preserving records as the company's computer systems destroyed them.

Storage space was limited on the company's central e-mail servers.  Servers overwrote (erased-purged) e-mail relatively quickly unless employees made special efforts to preserve them.

Although the company's policy was not fully expressed as a formal, unified document, the court was able to ascertain what the policy was from the company's deliberate practices and their effect.  Said the court, "“[The company's] practices  . . . tend toward loss of data. The practices place operations-level employees in the position of deciding what information is relevant to the enterprise and its data retention needs."

Effectively, the company's policy is what I've termed on this blog the make-a-decision style of records management, where individual employees are supposed to decide what records to keep and what to destroy.

The court essentially felt the policy was unreasonable.

Some commentators think the court made a bad decision because it runs counter to common business practice.  They speculate the court suspected bad faith on the company's part, but couldn’t specifically cite evidence to support that suspicion.

Regardless of whether the court was right or wrong, the case is consistent with a trend in 21st century law:  the legal system is distrustful of early or aggressive record destruction.  The legal system is providing enterprises a growing basket of incentives to be more generous in retaining records, especially email.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigations law at the SANS Institute.

Employee ESI: Private?

Internal Investigations under Data Protection Legislation

Many countries have data privacy laws limiting the disclosure of personal information their citizens. Although the laws are far from uniform around the world, the European Data Protection Directive (95/46/EC) is a leading guide.

These laws motivate (multinational) corporations to configure controls into email (as well as webmail and text-instant-message) record retention systems.

The European Data Directive generally instructs European countries to enact local privacy legislation to regulate personal information. The legislation can apply to e-mail and other electronically stored information (ESI).  As a practical matter, the details on implementation and enforcement of local (non-US) privacy laws with respect to e-mail is a very complex topic.  Some local laws can frustrate internal corporate investigations that might appear, to US-based managers for example, as routine and responsible.  They can cause emails to be withheld from investigators.

One instance: In 2001 French courts held that a foreign-headquartered company violated the privacy rights of a French engineer when it inspected his e-mail records, stored on company computers.  The records revealed he was wrongfully moonlighting on company time.  Doreen Carvajal, “The Workplace: When bosses spy on workers,” International Herald Tribune, April 21, 2004 .

As corporations install appliances to store e-mail archives, they should consider whether to implement controls for compliance with local privacy statutes.  The controls might include

1. written policies calling for compliance with local law;

2. technical blocks to prevent unauthorized people or departments from accessing specific records, while granting access to those who have been authorized; and

3. alerts and audit trails to enable after-the-fact review of who accessed which records and when.

--Benjamin Wright

Mr. Wright is a consultant to Messaging Architects, develper of sound process for electronic mail record-keeping and investigation.

SOX Record-keeping

Arthur Andersen’s Records Management Crime

The US legal system is giving all enterprises (whether public corporations, private LLCs or otherwise) reasons to be more liberal in their retention of records, especially e-mail.  One reason is a change in obstruction of justice law.

The traditional obstruction of justice statute, 18 U.S.C. §1512(b), punishes anyone who corruptly persuades another person to destroy documents to impair their use in an official proceeding.  Under that traditional statute, a criminal court convicted Arthur Andersen for destroying Enron-related papers and electronic records. The jury in Andersen’s trial said Andersen’s internal record management practices violated the statute.

But one month after Andersen’s jury trial, Congress adopted the Sarbanes-Oxley Act (SOX).  SOX modified obstruction of justice law by making it easier to convict people who destroy records.  SOX included new 18 U.S.C. §1519, which now punishes anyone who destroys, conceals, or covers up any record to impede or influence a federal lawsuit or an investigation by any federal agency, or in relation to or contemplation of any such matter or case.

Notice the differences between the traditional §1512(b) and new §1519.  Under traditional §1512(b) a crime was committed only if the defendant "corruptly persuaded another person" to destroy documents.  It might be hard for a prosecutor in a criminal trial to show corrupt persuasion of a second person.  Further, the exact words of §1512(b) seem not to apply if the defendant directly destroyed documents.   In new §1519, Congress omits the traditional “corruptly persuades another person” element. Further, new §1519 employs expansive language -- “in relation to or contemplation of any such matter or case” – to stretch the law to cover destruction of records in any way connected to a specifically anticipated lawsuit or investigation.

Enterprises be aware.  The effect of §1519 is powerful.  To win an obstruction of justice conviction, the prosecutor does not have to work as hard as he or she did in the Andersen case.  The prosecutor no longer has to show the defendant acted "corruptly" to "persuade" someone else to destroy documents.  Now, it is enough for the prosecutor to simply show that the defendant intended to destroy records with federal litigation in mind.

With new §1519, Congress emphasized its intolerance of people who mulch records in view of a lawsuit or investigation, even one that is not pending or imminent.  Hear how Senate Report 107-146 interprets new 18 U.S.C. §1519:  “This statute is specifically meant NOT to include any technical requirements, which some courts read into other obstruction of justice statutes, to tie the obstructive conduct to a pending or imminent matter. It is also meant to do away with the distinctions, which some courts have read into obstruction statutes, between court proceedings, investigations, regulatory or administrative proceedings . . . and less formal governmental inquiries. The intent of the provision is simple: people should not be destroying, altering or falsifying documents to obstruct any governmental function.”

Think about that statement from a record management perspective at a complex enterprise.  The statement seems to imply that the enterprise must implement a litigation hold with respect to future (specifically-anticipated) lawsuits/investigations, even though they are not pending or imminent.  For an enterprise, it is tough to know what is and is not anticipated somewhere out there in the future.  But the risk is that later, after the lawsuit gets going, the court may judge the enterprise's decisions retrospectively, with the benefit of 20-20 hindsight.  The court may determine, "Oh, you could have seen this coming (even though it was not imminent), so you should have implemented a legal hold."

Given that it is now easier to be convicted for destroying records, the logical response for an enterprise is to keep more records longer . . . to give itself a wider margin for error.

SOX’s new contribution to obstruction of justice law should be viewed in the context of recent cases punishing premature destruction of electronic records.  In that context, one sees a whole legal system that expects more lavish record retention than in the past.

–-Benjamin Wright

Mr. Wright teaches cyber security and investigations law at the SANS Institute.

Reference: B. Wright, “Shredding Documents Post-Arthur Andersen: Reforming Corporate Record Retention Policies for the Information Age,” a paper published 2002.

Corporate Electronic Mail Lost

Don't Adopt a Policy Executives are Disinclined to Follow in Practice

A famous e-mail spoliation case involved a formal policy that corporate executives were to “print and retain” important e-mails.  In this case the drafters of corporate records policy misunderstood how a written policy – which was sound in theory -- would be observed, or ignored, in practice.

Philip Morris and the federal government were engaged in a long-running lawsuit regarding marketing of cigarettes.  During the lawsuit, the company was required to preserve important records related to the topic of the case.

Philip Morris and its attorneys did not trust e-mail records (executives might make embarrassing, off-the-cuff comments in e-mail!), so they promulgated a two-part policy.  The first part would be to destroy e-mail in 60 days.  But they knew some e-mails would be relevant to the pending litigation and therefore the company must put those e-mails in a special category and prevent them from being destroyed.  So the second part of the policy would be print and retain – a kind of “legal hold”.  Written company policy informed executives they must print and retain paper records of e-mail pertaining to the topics important to the lawsuit.

Court Reviews Results

In 2004, after this policy had been in effect for some time, the court reviewed the results.  The court was shocked and disappointed to learn that company executives performed poorly at the task of printing and retaining. (Question to the reader: Should it come as a surprise to anyone other than a judge or a lawyer that well-compensated executives will falter at the job of [a] reading carefully through each and every one of their e-mails and deciding which ones do and which ones do not fit into a special legal hold category, and then [b] printing those special e-mails one-by-one and placing them in a select file in the cabinet for safekeeping?)

The court learned that some executives printed and retained some e-mails, but many did not.  Reply Memo in Support of the United States' Motion for Evidentiary and Monetary Sanctions Against Philip Morris USA . . . Due to Spoliation of Evidence, February 6, 2004, at page 15, footnote 20.

Further, the court learned that the print and retain policy confused some executives, as it was just one part of a complex statement of policies within the enterprise. Id. at page 15, footnote 19 

One can surmise that many executives believed they had more important things to do than (a) staying facile with the details of complex record retention policies, and (b) rigorously following the clerical duties specified by the policies. 

The company did not implement an inspection program to monitor or audit compliance with the print and retain policy – even though the company claimed – and probably honestly believed that it “vigorously monitors and reinforces compliance with its document retention polices”. Id. at page 14.

Many relevant e-mails were lost.  

Said the court: “[T]here is no question that a significant number of emails have been lost and that Philip Morris employees were not following the company’s own internal procedures for document preservation. What is particularly troubling is that Phillip Morris specifically identified at least eleven employees who failed to follow the appropriate procedures, and that those eleven employees hold some of the highest, most responsible positions in the company. These individuals include officers and supervisors who worked on scientific, marketing, corporate, and public affairs issues that are of central relevance to this lawsuit.”

Concluding that Philip Morris’ practice amounted to spoliation (i.e. wrongful destruction of evidence), the court levied memorable sanctions.  It fined the company $2.75 million.  But more importantly, it barred 11 key Philip Morris executives from giving testimony in the trial.  This latter sanction was more damaging to Philip Morris than the fine because it severely handicapped the company’s ability to defend itself in the lawsuit.

U.S. v. Philip Morris USA Inc. (D.D.C.Civil Action No.99-2496) (Sanctions Order)

Lesson to Be Learned

What is the practical interpretation of the Philip Morris case?  My interpretation: a print-and-retain policy does not work.  A print-and-retain policy means that the default is to destroy e-mail quickly . . . subject to the dubious exception that busy people like executives will one-by-one select individual e-mails for retention.  In practice busy people (who may receive scores or even hundreds of messages every day) are unlikely to patiently review every e-mail, make a responsible decision whether to keep it, and then if required dutifully ensure it is printed and stored in a paper file.

A modern update to the print-and-retain procedure is to direct employees to place retained e-mails in special folders like PST files.  Washington Metro learned that professional and managerial employees fare poorly at that task as well. 

--Benjamin Wright

Mr. Wright is an advisor to messagingarchitects.com, experts on email discovery and forensic analysis.