Electronic Data Records Law | How to Win E-Discovery

Whistleblowers and Digital Records Force Transparent Governance

Public Disclosure Defuses Scandal

Publish FOIA Response?

Technology motivates any publicly accountable organization (nonprofit, corporation, government) to adopt a radically open style of governance.

Owing to email, data logs, text messages and the like, the quantity of official business records ascends skyward, while the granularity of those records grows ever more fine.  Detailed within these innumerable records are the secrets of the organization.

Stored this way, secrets are dangerous.

Keeping secrets –- or just withholding information -- is becoming harder and harder.  Secrets and records can leak out by way of FOIA, spies, gossip, hackers, mistakes, e-discovery, whistleblowers, external surveillance, or just the natural course of events (sousveillance). In finance, a "trusted" banker will leak to a friend secrets about exotic instruments like credit default swaps, which are so new that the law has yet to establish "insider trading" rules applicable to them.  Kara Scannell, "Trader's 'Nice Little Kiss' Tests Reach of Regulations," Wall Street Journal, March 31, 2010.

A leak is dangerous.

The leak is an invitation for an adversary to allege malfeasance.  When a secret leaks, the adversary's storyline becomes (a) the organization possessed information that the public needed, (b) the organization wrongfully withheld the information and (c) the public now knows the information only because a righteous force external to the organization brought it to light.

For a smart organization, the best posture is to preempt the leaking.  Before the leak happens, it should embrace transparency and publish (most all of) its records and activities onto the public Internet.  It should expose its information to independent review and debate.  Authors Tapscott and Ticoll admiringly call such an organization the naked corporation.

False Statement?

Take for example the story of the small, grassroots political action committee named “Take Back Your City,” which is promoting a vote by citizens against red light cameras in the municipality of College Station, Texas.  Through freedom of information act, the PAC obtained extensive email records regarding the city government’s use of the cameras.  In this trove of information, the PAC found what it believes is smoking gun evidence that the city is engaged in false, illegal political advertising about the effectiveness of the cameras.  The city claims – in a flyer to be inserted in monthly utility bills -- that the cameras have reduced traffic accidents, but the PAC says an internal city email contradicts that claim.  The PAC attached the email as evidence to a formal complaint it filed with the Texas Ethics Commission. 

Whether this complaint will result in ethics sanctions against the city (or more particularly the city manager cited in the complaint), I don’t know.  But the city’s defense would be easier had it been more open and transparent with its records.  When it gave the email records to the PAC, it could have also posted them all on its web page as well.  (Why not? The city had already gone to the trouble to compile them.)  Then, when it prepared its flyer for the utility bills, it could have made its point about accident reductions while also saying, “Each citizen can draw his or her own conclusions.  The city has posted on its web page exhaustive records regarding traffic cameras.” 

Such openness takes the punch out of allegations that the city lied.  Effectively, it enables the city to say, “We drew a conclusion from the data and told citizens our conclusion, but our statements to citizens were more than just that.  We also made all the data available to the citizens and told them they could read it themselves and draw their own conclusions.  We've opened the data to third party review.”

Investigating Leaks

Another lesson in transparency derives from the contrast in styles between the board of directors at Hewlett-Packard Company and the town council at Watertown, Massachusetts.

When HP saw that someone on its board was leaking company secrets, it assumed cloak-and-dagger
  mode. It didn’t talk about the problem.  It secretly hired private investigators to spy on members of its board as well as reporters in the media.  The private eyes violated the privacy of the directors by hijacking their telephone calling records.  AT&T discovered the hijacking and reported it to its customer, Tom Perkins, one of the directors targeted by the spying. The result was an embarrassing, debilitating scandal, with lawsuits, criminal complaints, an SEC investigation, a congressional investigation, and the end of career for two of the company’s top lawyers.

HP followed the old-fashioned, closed approach to resolving a crisis.  But in this Internet age -- where clandestine activities are hard to keep clandestine -- that approach led to disaster.

Compare the youtube video below.  It shows the town council dealing with the same problem as the HP board – insider leaks.  The leaks pertained to closed-door deliberations about contracts.  But rather than spying on its members in the dark of night, the Watertown council brought the issue into the open.  It discussed the topic in public, video-broadcast session! 

Notice that Watertown’s transparency immediately deters future leaks.  The leaker has to be thinking, “My leaks are attracting negative attention.  Now all the citizens are on alert, and some knowledgeable witness watching out there may come forward with embarrassing information that reveals me as the leaker.  I’d best stop leaking.”



By being transparent, the council uses the Internet as its enforcer, and it avoids the risk of a HP-style scandal.  Legal compliance meets modern public communications.

–Benjamin Wright

At the SANS Institute, Mr. Wright stresses that, in the wake of a data security incident, the delivery of a effective public message is as important as the technical and legal response.

Structured Finance Computer Documentation

Email Evidence in Lawsuits over Financial Derivatives

The treasury departments of local governments and institutions like private schools have fresh reason to keep their electronic mail for a long time.  Sometimes these institutions enter complex financial transactions – derivatives, credit default swaps and the like.

To the players in this “structured finance” market, the bad economy brought surprises.  The trades they made did not pan out as expected.  A rash of lawsuits has emerged, and the lawsuits have revealed that the documentation for the trades is often confused or lacking.  Claire Coe Smith, "Complex Investments Spur Lawsuits in Europe," Wall St J., 28 Sept 09.  

A litigation lawyer quoted in the Wall Street Journal observes that in case after case, the formal documentation for these complex trades did not match the intent of the parties.  Under close inspection, the formulas written into the contracts don’t work, or the sheer words of the documentation do not allocate risk as expected.  This observation suggests that often industry practices outpaced the paperwork and parties did not take time to carefully review what they were doing.  

Two Example Lawsuits

Muddled transactions like these have historically concluded in lawsuits and settlements.  In the 1990s Orange County, California, settled with Merrill Lynch for $400 million under a lawsuit claiming fraud in the sale of derivatives to the county.  

March 2010: School districts in Wisconsin are suing a financial advisor and the Royal Bank of Canada in connection with misunderstood investments in collateralized debt obligations/credit default swaps.

How to Resolve Dispute? 

So how does a court resolve a lawsuit over a complex but poorly documented contract?

If the contract was formally written on paper and signed, the surrounding communications among the parties – such as e-mail – may or may not impact the outcome of the case.  Contract law embraces a concept called the parol evidence rule, which strives to keep the focus of a contract lawsuit on the words written on the signed paper.  It prefers that the court just interpret those words.  The parol evidence rule strives to save the court from the effort of interpreting all of the other “external” communications between the parties, such as letters, faxes, emails, web notices, oral conversations and social networking chat.  Benjamin Wright, The Law of Electronic Commerce, § 17.5, 2nd ed.

However, if a court finds that the written paper does not “integrate” the whole deal between the parties, then the court may consider the external communications.  For example, the court may find that the paper does not integrate all of a derivatives deal because the parties made clear that some of their informal e-mail traffic memorialized a critical part of their understanding.

Reason To Retain Records

What’s more, if the formally-written words are ambiguous, then the court may consider the external communications to interpret what the written words meant.  Ambiguity, as we are learning, is apparently common in the documentation of structured finance.  Wise treasurers therefore preserve all of their e-mail (and text messages on their BlackBerries) related to these transactions.

–Benjamin Wright

Mr. Wright teaches cyber investigations law at the SANS Institute.

Update 2013:  Comments embedded in a word processing document could influence court interpretation of final contract printed from that document.