Electronic Data Records Law | How to Win E-Discovery

Email Recovery | Network Back-up

E-mail Database Search and Forensics

Archival | What is a Subpoena?

As litigation and other requests for e-mail from backup tapes grow more frequent, an enterprise may be wise to restore, consolidate and archive all of its old e-mail held in backup.

Historically organizations did not think of e-mail as an asset worthy of preservation.  They did not archive it, though copies would end up in network backup.  

But experience has taught that e-mail evidence can be critical to defense of a lawsuit or enforcement of a contract.  Alternatively its disclosure might be required under a subpoena (see definition below), a court order, an administrative summons, an IRS tax audit or a freedom of information act request (FOIA).  Further, e-mail might be needed in an investigation (led internally or by outside criminal prosecutors) of a bribe, a kickback, an overcharge, tax evasion or a embezzlement of money, or it might be needed for an audit of alleged misallocation of funds. 

Archival

Greg Smith of Messaging Architects observes that repeated requests for e-mails from backup can warrant a change of thinking in the IT department. “While most backup software deals very efficiently with individual electronic records, it cannot provide the same level of access to email. This is because enterprise email exists as a record within a database (such as for Groupwise or Microsoft Exchange).  The database must be restored in its entirety and searched in its entirety in order to ascertain the contents of the database. With database sizes exceeding 100GB and scores if not hundreds of tapes, the cost to restore and search the tapes can be considerable. Recovering records for selective users and dates may satisfy the current discovery requirement, but with each successive lawsuit, or changes in discovery parameters for an existing lawsuit, restoration from tape can become a recurring financial liability.”

Greg continues, “The practical solution is to remove the information from tape permanently and place it in an electronic records format where information can be retained and managed as individual records and not conglomerates of information.  In such a format, individual email records can be sorted by user or date.”

Restored records can be archived in an open (non-proprietary) format, such as XML, which enables searchers to tap an ever-expanding array of search and forensics tools.  XML may or may not qualify as "native format" as that term is sometimes used in court decisions, though XML may be a more useful format than whatever the native format was.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, experts in e-discovery and consultants in e-mail investigations.

Post Script  What is a subpoena?  A subpoena is a legal demand that someone turn over information or evidence. Commonly the laws of litigation enable a party to subpoena other parties for records or other evidence. Sometimes the law also invests the power to subpoena in an official who conducts investigations, such as a government auditor or an inspector general. If a party abuses the power to subpoena, by demanding irrelevant records or by issuing a demand with no regard for the cost of compliance, a court may sanction the issuer of the subpoena.

Electronic Discovery Professional Duty

Falsehoods and Duty of Confidentiality

What is an e-forensics specialist to do when she discovers her client has been lying to her?  Typically this kind of computer specialist is hired to find, audit and report on electronically stored information (ESI).  If the specialist has been making representations to others -- such as a court, an internal investigator or an inspector general who has issued a subpoena, on the basis of what she now knows to be lies, she is in a bind.  Like any professional working for a client on a sensitive matter, the specialist will likely owe the client a duty of confidentiality.  Normally she will have signed a non-disclosure agreement. 

How to Preserve Reputation?

The specialist’s reputation is at stake. Obviously, to disassociate herself from misrepresentation, she can withdraw from the engagement.  But she fears that the third party will continue to rely on her representations, which are no longer well-founded. 

A practical technique available to this specialist is known as the noisy withdrawal.  Although noisy withdrawal is most commonly known from cases where lawyers learn that their clients have been lying to them, the technique is a responsible measure available any ethical professional.  

In a noisy withdrawal a professional announces that he is withdrawing from representation of his client. In addition (this is the noisy part) he declares to interested third parties that he disaffirms his prior statements made on behalf of the client.  With the noisy withdrawal, the professional aims to preserve his own credibility, without compromising the client’s secrets.  He does not reveal why he is withdrawing, why he is disclaiming prior statements or any information his client has told him.

Examples of Noisy Withdrawal

A recent example of a noisy withdrawal occurred in the investigation of Stanford Financial Group. Attorney Thomas Sjoblom had represented the firm before the Securities and Exchange Commission as it examined alleged fraud, corruption and irregularities.  But then he made a noisy withdrawal from the engagement.  Observers surmised that as the case progressed he had come to disbelieve what his client had been telling him. Kara Scannell, “Top Lawyer’s Withdrawal from Stanford Case Waves a Flag,” Wall Street Journal, Mar. 6, 2009.

Another famous example transpired in the Whitewater investigation during the Clinton presidential administration.  Legendary ethics expert Sam Dash made a noisy withdrawal when the Whitewater Independent Counsel wrongly gave the impression that Professor Dash endorsed the Counsel’s conduct.  (By the way, prior to this story, the late Sam Dash was my ethics professor in law school.  Over the long run, I hope Professor Dash’s teaching helps me stay out of trouble!)

–Benjamin Wright

Mr. Wright teaches cyber defense law at the SANS Institute, where he emphasizes the role of ethics and savvy public communications.

Email Retention | Public Audit & Administration

German Laws, Orders, Regulations and Instructions

Affinity with Local (County) US Government

What does the law expect of electronic government records?   Records enable governments to be transparent.  If government keeps good records of its activities and gives citizens easy access to them, then citizens can review government and hold it accountable.

Today most government records are electronic.  Accordingly, the German federal government seeks to archive its electronic records, including e-mail.  A key initiative under the Federal Ministry of the Interior is DOMEA, a project that sheds light on the legal expectations for e-government records, including electronic mail. 

The DOMEA project recognizes that: “Electronic records . . . have to meet the requirements for record keeping in public administrations, which are prescribed in laws, standing orders, regulations  and instructions.  They include important points, such as: 

“1. The completeness, integrity and authenticity of official records, which means that official documents cannot be subsequently altered, changed, removed, destroyed or deleted. 

“2. The records principle of public administration, which means that documents have to be appropriately joined together in systematically arranged subject files according to the functions of a particular office. 

“3. The accountability and lawfulness of administrative procedures, which means that accountabilities and responsibilities have to be documented in records in the course of business and that the state of affairs and the development of transactions in a given case has to be completely evident in records at any time.”

Of course, the validity of these legal standards is not limited to Germany or even Europe.

If these are the legal standards for government records, then query whether popular enterprise e-mail systems such as Microsoft Exchange and Novell Groupwise are designed to meet these standards. Generally speaking, they are not.  They do not support efficient storage, management, protection and searching of vast quantities of e-mail records, collected from a large population of users over an extended period of time.  That’s one reason enterprises like governments commonly have policies to destroy most e-mail relatively quickly, such as 90 days after transmission.

But e-mail has become central to the administration of modern government.  Very often, e-mail documents official transactions and official delegations of responsibility.  It also empowers internal audits and investigations (by for example inspectors general) for fraud, waste, corruption, mismangement and misappropriation of funds.  

For some time organizations such as governments have relied on ad hoc methods for retaining e-mail – including the print-and-file method.  But e-mail is so voluminous and has become so important that ad hoc solutions are failing.  

Last week I led an on-site workshop with the staff of a mid-size county government struggling with this problem. Staff representatives hailed from IT, counsel, finance, administration, internal audit, human resources, risk management and public health services.  The county’s e-mail system is Groupwise.  The staff concluded that the county needs, in addition to Groupwise, a dedicated e-mail archive appliance. The workshop enabled the staff to write new, modern policy on e-mail archival.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigation law at the SANS Institute.

He is an advisor to Messaging Architects, where he leads an in-house workshop to help the stakeholders in an enterprise craft workable policy on the management of email and other eRecords.

P.S.  New Mexico's Attorney General (AG) indicted the state's former Secretary of State (SoS) for tax evasion and money laundering tied to alleged kickbacks to her by the recipient of federal grant money.  Stephanie Simon, "New Mexico Roiled by New Graft Case," Wall Street Journal, August 22 -23, 2009.  Among other things, the indictment alleged that the defendant advanced her crime by fabricating two official records in 2004 -- a paper letter and a paper memo.  The indictment came on the heels of thorough document reviews by both federal and state auditors.  The auditors said the Secretary of State's office maintained poor records on its management of federal grant money.  Email records (which are very hard to forge or spoof successfully) were sparse if non-existent.  Furthermore, the Secretary of State's office says it keeps financial records only three years after the close of the fiscal year.  Now, the AG and the ex-SoS disagree sharply over the allegations.  Had the SoS's office maintained more detailed and complete records (including archived email, supported by time-stamps and other audit trails), this disagreement might now be resolved.  Either (a) the ex-SoS would have been deterred at the outset from corruption for fear that the records would betray her, (b) the records would clearly exonerate the ex-SoS, or (c) the records would unambiguously demonstrate the ex-SoS's guilt.

Investigating Staff Graft or Misconduct

Electronic Records for Audit, Ethics and Internal Control

If an institution – any institution – is to maintain its reputation, it must be prepared to investigate the actions of its employees (personnel).  Inevitably, allegations will arise that this or that employee embezzled, acted unethically, abused authority, laundered money, executed an unauthorized trade or simply made a mistake.  Power to conduct internal investigations is critical to government agencies and for-profit corporations, as well as charity, non-profit, and educational organizations.

Modern investigations today are different from those of the past, by virtue of the presence of digital records. The sheer quantity of e-records (e-mail, text, chat or instant messages, logs, meta-data, photographs, blog comments, surveillance videos, and on and on and on) is mushrooming beyond comprehension.  When an institution undertakes to audit whether a superior harassed a subordinate, an accountant misunderstood a tax liability or an administrator wrongfully tolerated a conflict of interest, a brimming corpus of electronic records can be available for examination . . . and can facilitate a just outcome.  The records can shed welcome light on whether the subject of the investigation did what is claimed, or did not do it.

A case in point is an investigation at Yale University, a regular recipient of research grants from the federal government.  Prosecutors alleged that academics at Yale had misallocated federal money (funds or assets) by (a) transferring grant funds to accounts that were not intended for the grants in question, and (b) paying themselves for summer activities using money from grants not earmarked for those activities.

In other words, the government claimed professors and staff played fast and loose in interpreting the purpose of specific grants.

In the face of such allegations, an institution has no choice but to cooperate with government.  (Which university wants to be the subject of an adversarial police raid in search of computer records?) Yale launched a massive investigation, covering some $3 billion in grants over seven years (2000-2006). It turned over more than a million pages of documents.  No doubt the massive quantity of records included email and other computer-based records.  (A similar corruption probe in the 1980s could not have yielded as many records because computers and e-mail were not as pervasive then.)  The college settled the matter in 2008 by agreeing to pay $7.6 million.  

Although Yale admitted it had made some errors, the government granted the school a release from further liability with respect to the years that were investigated.

$7.6 million is a relatively small penalty.  The university appears to have done itself three favors.  First, it had retained plentiful records for many years.  Second, it cooperated with the government and divulged rafts of records.  Third, when the allegations first arose, Yale instituted reforms preemptively, including tighter accounting controls and improved staff training.  The result was the imposition of only a small settlement payment.   And as for the future, Yale remains qualified to receive grants from the government. 

Had Yale produced fewer records, and displayed less transparency and less cooperation, the institution would not have fared so well.

I’ll bet the “errors” to which Yale admitted reflected past practices that had developed over decades, in an age when records were fewer and therefore government (inspectors general) had less ability to audit or investigate.

The incident teaches Yale staff (and staff at other institutions receiving federal grants) that they will be on a tighter leash for the future.  A digital informant is ready to snitch on them.  The super-plentiful e-records now being made about their daily activities expose them to greater review and accountability than was historically possible.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in records-dirven investigaions.  He also teaches Internet law at the SANS Institute.

Freedom of Information Act | Restore Erased Email

Electronic Records Had Been Discarded Under Interpretation of Retention Policy

Why Allow Deletion If Government Must Later Restore Records?

A county's formal policy on e-mail destruction failed to save it from the cost of recovering deleted e-mails in a lawsuit under Ohio's Public Records Act. Like FOIA laws in other states, Ohio's Records Act requires state government agencies like counties to disclose records to citizens upon request.

The case in question is a decision by the Ohio Supreme Court, State ex rel. Toledo Blade Co. v. Seneca County Board of Commissioners, 2008 WL 5157733 (Ohio Dec. 9, 2008).  Plaintiff sought e-mails of county commissioners concerning demolition of an old courthouse.  The county turned over some e-mails, but plaintiff managed to show that some relevant e-mails were missing because they had been deleted. It made this showing by analyzing the e-mails that were turned over and proving some logical gaps appeared within them.  Also, some commissioners admitted they had deleted some of their relevant e-mails.

Forensics Reverses Written Policy!

The county's written policy allowed each user to delete e-mail that the user deemed to be of "no significant value." (Some people call such e-mails "non-records".)  Such a policy is a version of the make-a-decision style of e-mail (text and instant message) records management, where users are expected to decide the destruction/retention fate of each message.  

After the court determined that some relevant e-mails must have been deleted, it observed that through the use of forensics measures some e-mails might be recoverable from commissioner hard drives. The county argued it should not be required to restore deleted e-mails because they had been deleted in accordance with the county's record retention policy, which the county had adopted in good faith. Further, the county argued that forensics measures are excessively expensive.

The court disagreed with the county. The court ordered the county to undertake costly forensics steps to search for and restore deleted e-mail records that met certain criteria – all at the county's expense.

Different Retention Policy Needed

Gadzooks! If a government agency is required under a FOIA to incur great expense to recover deleted e-mails after officials had determined -- under a formally-adopted policy -- that the e-mails were of "no significant value," then it makes no sense to let officials delete e-mails in the first place.  Such a make-a-decision style of policy is unworkable because it will cause the government regularly to employ expensive forensics to recover deleted records.  As a policy matter, the government is wiser just to archive copious records and take decision-making out of the hands of individual users.

I have long questioned e-mail retention policies (the make-a-decision policies) that emphasize a user examining each particular message and then deciding whether to destroy it or to keep it.  But some learned people disagree with me.  An argument they sometimes make in favor of the make-a-decision style policy is that it mimics how paper was handled. With paper, they argue, lots of documents came across the desk of each official. The official would decide whether to throw the paper in the trash can, or to place it in folder A, or folder B or folder C.

Yet this Toledo Blade case demonstrates that e-mail is different from paper. Even after e-mail is deleted, it can still be recovered forensically.  The cost of recovery can be high, but this court forced government to incur that cost.

Technical footnote: The court ruled the commissioners had probably violated the county's policy by deleting e-mails that were of significant value, when the policy said that only insignificant records would be deleted. However, this detail should not change our understanding of the case's import.  From the point of view of someone writing records management policy, the risk is ever-present that a court will second-guess users after-the-fact.  Looking back at past decisions, a court can always say, "user should not have allowed that e-mail to be deleted" or "user should have placed that e-mail in retention category X rather than retention category Y."  Users always make records management mistakes, and thus leave an enterprise constantly exposed to the threat of having to employ forensics (after-the-fact) to reverse user decisions.  Therefore, the policy writer is motivated just to remove users from retention/deletion decisions.

Background:  One of the purposes behind Freedom of Information Acts -- and public records acts generally -- is to enable citizens, FBI, police and internal auditors to investigate public officials for fraud, waste, corruption, embezzlement, conflicts of interest and misappropriation of funds.  The ever-present possibility of such a probe motivates officials to be fair and honest.

–Benjamin Wright