Electronic Data Records Law | How to Win E-Discovery

EFT Law | 4A-202 | 4A-203

Uniform Commercial Code Article 4A | Electronic Banking

Brian Krebs is publicizing many chilling stories of cybertheft, where small-to-medium enterprises lose money from their online accounts maintained at regional banks.  Lawsuits abound.

In good part, the electronic funds transfer (EFT) relationship between a bank and its business (commercial) customer is governed by Uniform Commercial Code Article 4A.  What are the rules when an unidentified computer thief wires money out of a businesses account?  This chart summarizes what Article 4A says on the topic.




Following is an article I published in 1993, where I argued that UCC 4A properly balanced the interests of banks and their business customers.  I’ve edited the only slightly from what I wrote in 1993. 

The rash of stories that Krebs is publicizing is unprecedented in the 20-some-odd-year history of UCC 4A.  In light of this rash, I am re-evaluating what I wrote in 1993.  Notice that the hypothetical case I discussed below involved $5 million, whereas the cases Krebs exposes involve only tens or hundreds of thousands of dollars.  The corporate victims of today's heist are less able to acquire expertise in IT security.

I’m not finished with my re-evaluation, but here's what I wrote . . .

UCC 4A's Delicate Balance

Hypothetical Question: Suppose a precocious 17-year-old uses her PC to send an electronic payment order to bank, relieves a corporate bank of $5 million, and vanishes with the cash.  Neither the bank nor the corporate customer knows who committed the crime or how.  Who should eat the loss . . .

Treat Electronic Records the Same as Paper Records?

In-house Local Government Counsel Sanctioned for Spoliation

Courts seem more assertive in punishing electronic spoliation than they historically were in punishing the spoliation of paper documents.  Many veteran lawyers will be astonished to hear that a federal judge sanctioned an in-house government lawyer for taking something less than vigorous steps to cause and monitor the preservation of electronic evidence.

Prior to filing a negligence lawsuit against a county sheriff’s department (Swofford v. Eslinger), the plaintiff demanded by letter that all evidence including electronic records be preserved.  General counsel for the Seminole County (Florida) Sheriff's Department, David Lane, forwarded a copy of the letter to six senior officials in the department.  Still, the department subsequently destroyed relevant e-mail records and wiped the hard drives of relevant laptops.  

The judge was highly suspicious. On her own initiative she called the in-house lawyer as a witness in a hearing on the question of spoliation.  Citing the famous Zubulake case, the judge concluded that the lawyer had defaulted on his duty to ensure that electronically stored information (ESI) was preserved.  The judge specifically opined that in a case like this counsel needs consult with IT staff about preserving ESI.  The judge imposed a monetary fine on Mr. Lane personally, the amount of which is to be determined.  (See The Pension Committee of the University of Montreal Pension Plan, et al. v. Banc of America Securities for more on a lawyer's professional duty regarding the preservation of e-records and subsequent search through them.)

The judge is saying that modern counsel must understand how ephemeral ESI is and how vigilant counsel (as an officer of the court) must be to preserve it under a litigation hold.

I don’t know how much annual salary counsel to a Florida county sheriff's department makes, but I'll bet the man is not getting rich on his salary.  The imposition of monetary sanctions on him makes quite a statement.  It is unclear whether malpractice insurance would cover this fine.

A different lawyer at a government agency recently asked me why the record retention policy for e-mail should be different from the policy for paper documents with the same content.  I believe electronic records behave differently from equivalent paper records.  They must be managed differently.  What's more, this Swofford case reinforces my impression that courts are treating electronic records differently.  It reinforces my argument that today the law gives all enterprises heightened incentive to retain email generously.  No employee of a government agency, whether counsel or otherwise, wants the risk of being held accountable for premature destruction of email. 

–Benjamin Wright

Mr. Wright is senior instructor at the SANS Institute, where he teaches a 5-day bootcamp on the law of e-records, cyber defense and computer investigations.