Logs and Audit Trails for Data Privacy and Internal Control
Filtering Attorney Work Product
Electronic records such as email serve as memorials of business actions and as evidence of legal responsibility. But they are also vulnerable to abuse by privacy infringers or trade secret thieves.
One key to protecting e-records is metadata. Meta-data comprises all the ancillary notes and audit trail surrounding a given record (a given e-mail) . . . the system logs showing when a record was created, who accessed it and when, how and when it was changed, to whom it was forwarded and possibly much more. Metadata can illuminate an auditor or detective about the status, the history or the security of the record in question.
For records containing personally identifiable information (PII), good meta-data can be invaluable as an instrument of privacy. Metadata can deter a snoop. A busybody in a hospital who wants to peek at a celebrity’s patient record will think twice before doing so if he knows the system will create an audit trail showing what he saw and when he saw it. Further, in the investigation of a hacker incident, system logs can inform whether (for instance) the crook accessed credit card record X or social security number Y. Armed with this information, an investigator can evaluate whether the hacker did or did not actually breach the security of record X or record Y.
Example: In the wake of a security breach at one of its hotels, Best Western International was able to evaluate the breach and narrow the universe of affected credit card numbers by inspecting specific logs on the computer in question.
Accordingly, a well-crafted e-mail archival system will maintain extensive meta-data about each electronic mail record. The M+Archive product for instance keeps tabs on who viewed a record, when it was printed and so on.
Be all that as it may, sometimes system logs are undesirable. For example, when an attorney turns over records in an eDiscovery request, she normally should not turn over metadata that constitutes her own work product. As she reviews individual emails in an archival system, the system may be keeping meta-records showing which records she accessed, when she accessed them and how often. Those records are probably her attorney work product, which normally is excluded from disclosure in the discovery phase of litigation. She should normally screen out any such work product when she turns over required emails to another party.
I spoke to Ranjit Sarai, e-discovery expert at Messaging Architects. “The management of meta-data in an enterprise archival system can be tricky,” he said. “Normally you want the system to be making meta records for security and accountability purposes. But sometimes ediscovery lawyers want to turn this logging feature off, or they want to filter out their work product metadata before delivering records to an adversary. We have experience helping an attorney understand the options and craft a solution for her particular case.”
–Ben Wright
Mr. Wright often serves as a public speaker on the law of electronic records and investigations.
data break-in
August 05, 2009
July 14, 2009
Data Loss Prevention Strategy
Transparency as Compliance with Data Security Regulation
How are data holders to comply with the swelling riot of data security laws? These laws include breach notification laws, which require that individuals and/or government be notified when the security of private data has been compromised. Perfect compliance is impossible.
Almost all the states have adopted breach notice laws – though they are not uniform – and legislatures are expanding the scope of the laws.
The original law from California (effective six years ago) focused on identity information – name plus social security number, driver’s license number or financial account number. Then the California legislature expanded its law to also include breaches of medical data. That expansion became effective January 1, 2009. Result? In the first five months of 2009, California authorities were notified of a whopping 823 healthcare data breaches, mostly through self-reporting by healthcare entities. That’s just one industry, in one state, in five months. And California authorities anticipate that the flow of notices will rise as people in the healthcare community become better aware of the new law.
A data breach can occur in myriad ways: a misdirected fax or e-mail, a hacking incident or snooping by an employee.
Meanwhile, we see floods of breach notices issued in other states and other industries – retail, nonprofit, colleges, financial, professional services, water districts, school districts, county government, municipal government, state government, federal government. No organization is immune. As these laws sit longer on the books, the flow of notices grows larger and larger.
Why are there so many notices? The reason is that the laws assume that 100% data privacy can reasonably be achieved. They further assume that any shortcoming (or suspected shortcoming) of data privacy should be an unusual event within well-managed enterprises. The assumptions are wrong.
The expectations of the public, and especially the expectations of policy makers, are out of touch with the reality of modern data management. These outsized expectations contribute to a growing risk of monetary liability on the part of data holders.
So what are data holders to do? Obviously they need to invest in data security, training and investigation – and they have been. But banks, schools, utilities, clinics, hospitals, merchants and government agencies can throw massive investments at this problem and never meet present expectations.