Electronic Data Records Law | How to Win E-Discovery

Lawsuit Advantage

Electronic Discovery Search-Strategy

Litigants by their nature are in search of advantage over their adversaries.  In this computer age, new tools for advantage emerge every day. 

An intriguing discipline that could yield new tools is linguistic analysis, especially sentiment analytics.  A company
named Jodange searches vast quantities of text in social media (Twitter, Facebook, LinkedIn, Yelp, online dating sites) to ascertain the opinion (the sentiment) of thought leaders or interest groups.  It employs computer-driven algorithms to analyze, for instance, the compositional semantics within text (e.g., tweets on Twitter) to glean what, say, US consumers think of brand X.

For sentiment analytics, I see a promising application in what we lawyers call "eDiscovery."  eDiscovery is a rapidly growing field, where much money is at stake.  eDiscovery includes the collection and review of vast quantities of data (especially email) in a lawsuit or investigation.  A business or government lawsuit can involve tens of millions of emails -- too many to read and understand one-by-one.  Linguistic analysis, and sentiment analytics, could be valuable to a litigant seeking e-Discovery (EDD) advantage.

Intent Influences Legal Results

Why do I think sentiment analytics could be especially relevant to a lawsuit?  The reason is that very often legal liability or outcome depends on the “intent” of a person or an enterprise.  For example, to commit a crime a defendant must usually intend to do something wrong.  No intent, no crime.  

In complex criminal cases, like one against a corporate defendant, the defendant strives to show that it had no intent to behave badly or break the law.

To deduce the intent of people or entities from large numbers of communications such as e-mails is not easy for a jury or a judge.  Sentiment analytics could help.  Just as it can help interpret the opinion of 20,000 consumers, it could help answer questions like, what was the corporation thinking, what did it mean to do, what was its intention?

Example in a Lawsuit

I imagine this kind of argument being made by an antitrust defendant in court:  “Sentiment analytics of four million emails within ABC Corporation reveals that neither the company, its staff nor its leadership had a plan, desire or intention to fix prices, to conspire with competitors or to otherwise violate the antitrust laws.”  Presented correctly, that kind of argument could be powerful, and could open a new chapter in American jurisprudence.

The cases to which sentiment analytics applies need not necessarily involve extremely large numbers of messages.  Sentiment analytics might be useful for interpreting, say, a few hundred messages in a child custody battle or the augmented reality advertisements broadcast to the patrons of a restaurant during a particular week.

Investigators -- whether they be courts, auditors or regulatory authorities -- need new tools.  Linguistic analysis tools could help any kind of investigator make sense of voluminous electronic evidence.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigations law at the SANS Institute.

Whistleblowers Leak Secrets

Wikileaks.com for Accountability

If a public organization doesn't embrace transparency, transparency will be thrust upon it forcibly.  For any institution, its electronic records are so detailed and subject to revelation in so many ways that the institution must find a way to pre-empt their inopportune public disclosure.  Better to come clean with information now – before the lawsuit (think deposition) or the FOIA request or the hacker break-in brings the information to light.

The climate research unit at the University of East Anglia is learning directly how disconcerting unexpected disclosure can be.  
 Someone – whether an outside hacker spy or an inside whistleblower – has leaked volumes of e-mails, software, source code and programmer notes to the world.  As a world leader on climate modeling, the university is shocked to see its internal discussions hung out for public scrutiny.

Some emails suggest the university's scientists had earlier tried to destroy records to prevent their disclosure under a freedom of information request.  Other records arguably depict programmers manipulating data for key climate modeling software in a deceptive manner.  Some emails appear to show researchers misallocating expenses against a US government research grant.

Some observers speculate all these records had been assembled for a freedom of information request, and after the request was denied, an internal whistleblower elected to liberate them.  Once information leaves the confines of the institution, it's easy to broadcast through channels like Wikileaks.com.

Separately, another institution on which technology has violently imposed transparency is international banking.  An IT staffer at LGT Group stole secret bank customer records and sold them to the German tax authorities, who used them to prosecute tax evaders. “Liechtenstein Under Siege Clings to Bank Secrecy to Outdo Swiss,” Bloomberg.com 2/27/08. 

Then a US Senate investigative committee data-mined Homeland Security records of foreign visitors to uncover a pattern of Swiss bankers coming to the US illegally to solicit deposits from rich American taxpayers.  These unsavory revelations -- made possible by new technology -- has devastated the long-standing industry of secret bank accounts in places like Switzerland.  The US has largely closed down that industry as an avenue for tax evasion and other crime. Kevin McCoy, “IRS: Offshore tax crackdown should produce 'billions',” USA Today, Nov. 17, 2009.

So in this technological age of leaks and sousveillance, what are institutions to do?  Here are three mild examples of proactive transparency: 

* New York City allows web-empowered citizens to track their government's performance on details like response times on calls to the fire department or the street maintenance crews.

* The City lets the same citizens monitor how the city is spending federal stimulus dollars.

* 15 local governments in South Carolina now post their full check registers online so citizens can scrutinize how the governments spend cash and which vendors get how much money.

Update November 29, 2009:  After thinking about it, the University of East Anglia has decided that radical transparency is the only logical policy.  In the wake of the hacker break-in described above, the University has announced it will reveal "all" of its climate data as soon as possible.

–Benjamin Wright

Mr. Wright teaches Data Retention and Security Law at the SANS Institute, where he emphasizes how critical public communications are to good information security.

Related post: Whistleblowers with cameras

Email Retention | Public Audit & Administration

German Laws, Orders, Regulations and Instructions

Affinity with Local (County) US Government

What does the law expect of electronic government records?   Records enable governments to be transparent.  If government keeps good records of its activities and gives citizens easy access to them, then citizens can review government and hold it accountable.

Today most government records are electronic.  Accordingly, the German federal government seeks to archive its electronic records, including e-mail.  A key initiative under the Federal Ministry of the Interior is DOMEA, a project that sheds light on the legal expectations for e-government records, including electronic mail. 

The DOMEA project recognizes that: “Electronic records . . . have to meet the requirements for record keeping in public administrations, which are prescribed in laws, standing orders, regulations  and instructions.  They include important points, such as: 

“1. The completeness, integrity and authenticity of official records, which means that official documents cannot be subsequently altered, changed, removed, destroyed or deleted. 

“2. The records principle of public administration, which means that documents have to be appropriately joined together in systematically arranged subject files according to the functions of a particular office. 

“3. The accountability and lawfulness of administrative procedures, which means that accountabilities and responsibilities have to be documented in records in the course of business and that the state of affairs and the development of transactions in a given case has to be completely evident in records at any time.”

Of course, the validity of these legal standards is not limited to Germany or even Europe.

If these are the legal standards for government records, then query whether popular enterprise e-mail systems such as Microsoft Exchange and Novell Groupwise are designed to meet these standards. Generally speaking, they are not.  They do not support efficient storage, management, protection and searching of vast quantities of e-mail records, collected from a large population of users over an extended period of time.  That’s one reason enterprises like governments commonly have policies to destroy most e-mail relatively quickly, such as 90 days after transmission.

But e-mail has become central to the administration of modern government.  Very often, e-mail documents official transactions and official delegations of responsibility.  It also empowers internal audits and investigations (by for example inspectors general) for fraud, waste, corruption, mismangement and misappropriation of funds.  

For some time organizations such as governments have relied on ad hoc methods for retaining e-mail – including the print-and-file method.  But e-mail is so voluminous and has become so important that ad hoc solutions are failing.  

Last week I led an on-site workshop with the staff of a mid-size county government struggling with this problem. Staff representatives hailed from IT, counsel, finance, administration, internal audit, human resources, risk management and public health services.  The county’s e-mail system is Groupwise.  The staff concluded that the county needs, in addition to Groupwise, a dedicated e-mail archive appliance. The workshop enabled the staff to write new, modern policy on e-mail archival.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigation law at the SANS Institute.

He is an advisor to Messaging Architects, where he leads an in-house workshop to help the stakeholders in an enterprise craft workable policy on the management of email and other eRecords.

P.S.  New Mexico's Attorney General (AG) indicted the state's former Secretary of State (SoS) for tax evasion and money laundering tied to alleged kickbacks to her by the recipient of federal grant money.  Stephanie Simon, "New Mexico Roiled by New Graft Case," Wall Street Journal, August 22 -23, 2009.  Among other things, the indictment alleged that the defendant advanced her crime by fabricating two official records in 2004 -- a paper letter and a paper memo.  The indictment came on the heels of thorough document reviews by both federal and state auditors.  The auditors said the Secretary of State's office maintained poor records on its management of federal grant money.  Email records (which are very hard to forge or spoof successfully) were sparse if non-existent.  Furthermore, the Secretary of State's office says it keeps financial records only three years after the close of the fiscal year.  Now, the AG and the ex-SoS disagree sharply over the allegations.  Had the SoS's office maintained more detailed and complete records (including archived email, supported by time-stamps and other audit trails), this disagreement might now be resolved.  Either (a) the ex-SoS would have been deterred at the outset from corruption for fear that the records would betray her, (b) the records would clearly exonerate the ex-SoS, or (c) the records would unambiguously demonstrate the ex-SoS's guilt.

Terminate Employee, Delete Email?

Are Layoffs a Reason to Destroy Electronic Mail Records?

Departure (dismissal) of an employee does not justify destruction of his e-mail records stored on employer equipment. Those records are not the property of the employee or (normally in the U.S., with some qualifications) the vessel of his privacy.  The records are an asset of the employer, showing what the employee did in his capacity as an employee and agent of the employer and how he was supervised.

In our changing economy, employers are learning how to get the same productivity with fewer people.  As they let some employees go, the email records of those employees are part of the employer's valuable institutional memory.

Wasting Manager Time

A manager is wasting her time if she paws through a departing employee’s e-mail to decide what to keep and what to destroy (delete).  It is better just to keep the e-mail, consistent with the retention and privacy practices generally applicable for all employees. 

Email is an Asset of the Enterprise

E-mail records memorialize intellectual property development by employees (such as an inventor or engineer), and they record when and under what conditions trade secrets are shared with business partners.  In intellectual property (IP) disputes, proving the time and date that particular events transpired is essential.  The beauty of email records is that every message is stamped with time and date.

Today, e-mail records are critical to many investigations and disputes; they are even critical under search warrants, where law enforcement seizes records under court supervision. In Jane Doe v. Norwalk Community College (a sexual harassment case), the court sanctioned a college for destroying electronic records of a suspect teacher after he left the college.  The same could happen to any educational institution (public or private . . . higher, secondary, primary, K-12).

E-mail records show what commitments employees did and did not make on behalf of the employer. In Cloud Corp. v. Hasbro,  314 F.3d 289 (7th Cir. 2002), employee e-mail effectively modified a paper-written contract that said it could not be modified except by a “signed writing”.  E-mail can be a legally-binding “signed writing” that memorializes the employer’s rights and responsibilities under contracts.

Federal Sentencing Guidelines

E-mail records showing day-to-day education and supervision of employees are consistent with the expectations of the Federal Sentencing Guidelines.  The Sentencing Guidelines are the framework within which federal judges select penalties for convicted criminals.  If a criminal happens to be an enterprise, the Guidelines call for leniency where the enterprise had taken steps to prevent and mitigate crime by employees.  In other words, bad employees might go to jail, but their not-so-bad employer might avoid stiff criminal penalties.

Under the Sentencing Guidelines, the steps the employer must take include establishing and promoting an employee ethics program and then monitoring and disciplining employee conduct.  To show that an employer did this, electronic mail records (ESI) can be key evidence.  They can document regular education, supervision and discipline of employees.

Update: The Federal Sentencing Guidelines are proposed to be amended so as to place more emphasis on complete record retention.

Policy?

So precisely how long should employers keep email records? There is no one-size-fits-all answer.  I have led in-house workshops to address this question at numerous, diverse enterprises. The outcome of these workshops has varied, depending on many factors, including corporate culture.

In my experience, the best email retention policy is one that is developed by collaboration of the various stakeholder departments in the enterprise (legal, IT, HR, operations et al.).  Normally, these different stakeholders start with different positions on what the policy should say.  But, in my experience, after the stakeholders have talked through the issues, they tend to compromise their positions and coalesce into a policy that is unique to the enterprise.

–-Benjamin Wright

Mr. Wright is senior instructor for the SANS Institute, where he delivers professional training on the law of e-discovery, e-records management and internal investigations.

P.S.  Employers may believe that by deleting email they are preventing a future eDiscovery adversary from conducting a so-called fishing expedition through the records.  However, I argue that the advantages of generous record retention outweigh the risk of a fishing expedition.