Electronic Data Records Law | How to Win E-Discovery

Custom Professional Training

Tutorials | Questions Answered

Price | Professional Credit | E-Policy Workshop

Many professionals who visit this blog are looking for education on electronic records or technology law. Mr. Wright can deliver custom tutorials on the topics important to you right now.  A tutorial can be one hour, two hours, a half-day, or more.

Benjamin Wright has much experience training professionals on such topics as e-discovery, e-record privacy, data security law, cyber defense investigations, record retention policies, BYOD, e-commerce records and contracts, and more.

Now he delivers this continuing professional education on a tailored, as-needed basis.  Tell him what interests you, and he will work with you to develop a curriculum and a delivery plan.  The number of students could be one, two, 100, or more.

The method of delivery could be Webex, on-site, telephone conference, or something else, depending your needs and resources. A tutorial could combine lecture and interactive Q & A.

To discuss, please call Mr. Wright at 1.214.403.6642.


Price

Price would depend on many factors, such as the length of seminar time, the medium of delivery, out-of-pocket expenses, and the amount of advanced preparation involved.  A one-hour briefing by Mr. Wright to a small audience (delivered by telephone call you initiate) on a topic for which he already has material, could cost as little as $375.


Continuing Professional Education Credit

Many professionals – auditors, lawyers, investigators, accountants, records managers, security professionals -- need continuing professional education (CPE and CLE) hours.  Mr. Wright's tutorials are of a quality to support the granting of credit.  Mr. Wright will be happy to sign a letter confirming that any particular professional participated in a seminar.  However, the application for and obtaining of credit will be the responsibility of the individual professional.

Rules for continuing legal education credit vary by jurisdiction.  Often an attorney can obtain credit by applying for it after attending a seminar.


Policy Workshop

Mr. Wright and Messaging Architects deliver an in-house workshop for developing enterprise policy on BYOD and the retention, destruction and management of electronic records, especially e-mail.

=
Statement from Andrew Scygiel, Merck & Co., Inc. to Mr. Wright:  "Thanks again for a great class and very insightful information.  You have really changed my view of records and I have 'aspired' to be much more aware of our policy and how today's climate can affect us."

As senior legal instructor at the SANS Institute, Mr. Wright emphasizes that -- in response to an IT security incident -- an effective public message is just as critical as the technical and legal responses.

Metadata | Email Discovery Control

Logs and Audit Trails for Data Privacy and Internal Control

Filtering Attorney Work Product

Electronic records such as email serve as memorials of business actions and as evidence of legal responsibility.  But they are also vulnerable to abuse by privacy infringers or trade secret thieves.

One key to protecting e-records is metadata.  Meta-data comprises all the ancillary notes and audit trail surrounding a given record (a given e-mail) . . . the system logs showing when a record was created, who accessed it and when, how and when it was changed, to whom it was forwarded and possibly much more.  Metadata can illuminate an auditor or detective about the status, the history or the security of the record in question.

For records containing personally identifiable information (PII), good meta-data can be invaluable as an instrument of privacy.  Metadata can deter a snoop.  A busybody in a hospital  who wants to peek at a celebrity’s patient record will think twice before doing so if he knows the system will create an audit trail showing what he saw and when he saw it.  Further, in the investigation of a hacker incident, system logs can inform whether (for instance) the crook accessed credit card record X or social security number Y.  Armed with this information, an investigator can evaluate whether the hacker did or did not actually breach the security of record X or record Y.

Example: In the wake of a security breach at one of its hotels, Best Western International was able to evaluate the breach and narrow the universe of affected credit card numbers by inspecting specific logs on the computer in question. 

Accordingly, a well-crafted e-mail archival system will maintain extensive meta-data about each electronic mail record.  The M+Archive product for instance keeps tabs on who viewed a record, when it was printed and so on. 

Be all that as it may, sometimes system logs are undesirable.  For example, when an attorney turns over records in an eDiscovery request, she normally should not turn over metadata that constitutes her own work product.  As she reviews individual emails in an archival system, the system may be keeping meta-records showing which records she accessed, when she accessed them and how often.  Those records are probably her attorney work product, which normally is excluded from disclosure in the discovery phase of litigation.  She should normally screen out any such work product when she turns over required emails to another party.

I spoke to Ranjit Sarai, e-discovery expert at Messaging Architects. “The management of meta-data in an enterprise archival system can be tricky,” he said. “Normally you want the system to be making meta records for security and accountability purposes.  But sometimes ediscovery lawyers want to turn this logging feature off, or they want to filter out their work product metadata before delivering records to an adversary.  We have experience helping an attorney understand the options and craft a solution for her particular case.”

–Ben Wright

Mr. Wright often serves as a public speaker on the law of electronic records and investigations.

Data Loss Prevention Strategy

Transparency as Compliance with Data Security Regulation

How are data holders to comply with the swelling riot of data security laws?  These laws include breach notification laws, which require that individuals and/or government be notified when the security of private data has been compromised.  Perfect compliance is impossible.

Almost all the states have adopted breach notice laws – though they are not uniform – and legislatures are expanding the scope of the laws.  

The original law from California (effective six years ago) focused on identity information – name plus social security number, driver’s license number or financial account number.  Then the California legislature expanded its law to also include breaches of medical data. That expansion became effective January 1, 2009.  Result?  In the first five months of 2009, California authorities were notified of a whopping 823 healthcare data breaches, mostly through self-reporting by healthcare entities. That’s just one industry, in one state, in five months.  And California authorities anticipate that the flow of notices will rise as people in the healthcare community become better aware of the new law. 

A data breach can occur in myriad ways:  a misdirected fax or e-mail, a hacking incident or snooping by an employee.

Meanwhile, we see floods of breach notices issued in other states and other industries – retail, nonprofit, colleges, financial, professional services, water districts, school districts, county government, municipal government, state government, federal government.  No organization is immune.  As these laws sit longer on the books, the flow of notices grows larger and larger.

Why are there so many notices?  The reason is that the laws assume that 100% data privacy can reasonably be achieved.  They further assume that any shortcoming (or suspected shortcoming) of data privacy should be an unusual event within well-managed enterprises.  The assumptions are wrong.  
The expectations of the public, and especially the expectations of policy makers, are out of touch with the reality of modern data management.  These outsized expectations contribute to a growing risk of monetary liability on the part of data holders.

So what are data holders to do?  Obviously they need to invest in data security, training and investigation – and they have been.  But banks, schools, utilities, clinics, hospitals, merchants and government agencies can throw massive investments at this problem and never meet present expectations.

Wise organizations will start talking in public about data security.  I recently recommended to a municipal power utility that it convene public forums on the topic, and involve community leaders such as representatives from the city council and the state's attorney general's office.  Organizations like a power utility need to inform the public about how challenging and expensive it is in reality to protect 100% of the data 100% of the time.  They need to explain in detail why it is impossible to close off all security risks while performing their regular services to the public.  And they need to seek input from stakeholders.

No, mere publicity and public dialog will not absolve organizations from issuing breach notices in compliance with law.  

But transparency – candid, open disclosure of problems in advance can influence how harshly authorities, such as courts, attorneys general or consumer protection agencies, interpret and enforce these demanding laws.  Our legal system has long held that organizations will be treated more leniently when they display diligence toward compliance with difficult laws.

Update:  Even e-mail security vendor McAfee inadvertently broadcast via e-mail a spreadsheet containing details (including dietary preferences) of some 1408 conference attendees.

Update:  A data leakage audit of a Boston CPA firm revealed that staff made an astonishing 3200 data security slip-ups over the course of the 38-day audit.  This is a firm that believed it possessed the required policies and technology to protect data. Jackie Noblett, “One Firm’s Story: Your Data Isn’t As Secure As You Think,” Boston Business Journal, Dec. 26, 2008.

Another update:  A survey shows that mere accidents by employees account for far more data security breaches than do malicious actions by insiders.

One more update:  IT Security breaches soared in Canada in 2009.  The Globe and Mail, September 29, 2009.
 
–Benjamin Wright

At the SANS Institute, Mr. Wright teaches computer security law, where he stresses that a cyber-security program must include effective public communications. 

Medical Technology Regulation

Telemedicine Licensure and Data Security

Technology perennially introduces problems for compliance with law and regulation.  But often technology can help alleviate those problems by fostering transparency and accountability.

Take for instance telemedicine, a promising family of technologies for making healthcare more affordable and accessible. Telemedicine allows, for example, a geographically remote physician to examine and treat a patient.  It can do wonders for a patient in a rural clinic who needs attention from a specialist in a distant city.  But telemedicine raises medical license issues for a physician in, say, Illinois who is treating a patient in Wyoming.  If the Illinois specialist must become licensed in each state where her patients happen to be at the time she delivers care, then red tape will impede her practice of telemedicine.

Telemedicine also raises data security issues.  On the Internet, data security law is bewilderingly confusing because authorities have recently issued a cacophony of new and very demanding laws, regulations and standards.  Often these rules are poorly written and reflect expectations that are unrealistic in our networked society.  Assorted guidance like HIPAA, state privacy regulations, breach notification laws, "20 Critical Security Controls", PCI-DSS and others purport to tell us how to protect data that might be involved in a telemedicine transaction.  But full, strict compliance with all these requirements is sparse if not impossible in the real world, as demonstrated by the daily parade of stories about how private data has leaked out of hospitals, corporations, universities, government agencies (federal, state, local and foreign) and every other organization under the sun.

So do these legal problems mean telemedicine is doomed?  No.  Just as Internet technology looks like a dark cloud to anyone seeking literal compliance with all applicable laws, information technology itself provides a silver lining.  Technology engenders the transparency and accountability that are favored in law.

The Internet allows a practitioner of telemedicine to explain to regulators – and to prospective patients – what she is doing, the value of it and the risks associated with it.  It enables the specialist doctor in Illinois to publicize, via web postings, how she is helping patients

in numerous other states, how she is taking rational steps (such as involving local doctors) to avoid or limit any medical injury in target states, and how she is endeavoring (albeit imperfectly) to protect private data.  Through the Internet, she can invite any regulators or members of the public who have reservations or constructive suggestions about her activities to contact her and discuss.

IT further allows the specialist's telemedicine system to store copious, detailed records of what care was provided, when and how, including the good faith methods used to minimize any unlicensed practice of medicine and to safeguard the patient’s private data.  Good records could even include full recordings of interactive videoconferences between patient and doctor.  Good records are the basis for third-party review and accountability to the public.

Together, electronic transparency and accountability avoid a core evil that regulations abhor: a cover-up.  So often, it is deception or cover-up that transforms a legally ambiguous situation into a violation of law.  Here are four examples:

1. When computer crime experts differentiate good “white hat” computer security research from bad “black hat” hacking, a decisive factor is whether the suspect engaged in any trickery or concealment.

2. Martha Stewart did not go to jail for insider trading, though she did have inside information at the time of making a stock trade. She went to jail for attempting a cover-up of that trade, that is, obstructing an investigation into whether she had traded on insider information.

3. Arthur Andersen was not criminally convicted for the audit work it performed for Enron.  Rather, a jury convicted Andersen for a cover-up, that is, destroying records that might be needed to review the audit work.

4. Law normally does not require a mere witness to crime to report it.  But if the witness takes any step to prevent others from uncovering the crime, then the witness is herself guilty of the crime known as “misprision of a felony.”

Let me say all this another way:  When literal compliance with complex law is difficult, parties are wise to talk candidly about the problem in public and about their good faith effort to comply.  Candid communication can diminish expectations for strict compliance and can soften the law’s interpretation and enforcement.

I’m not saying that public relations and record keeping are all that's necessary to comply with law on the Internet.  But when a person makes a sincere attempt to comply with otherwise conflicting, unrealistic or outdated regulations, transparency and accountability can weigh heavily in favor of a conclusion that the person effectively did comply.

Update 1:  The technologies to support telemedicine are advancing to include more than just microphones and video cameras.  Biomedical, Inc. has created a digestible computer chip, which will can transmit medical information from inside a patient.  Don Clark, "Take Two Digital Pills and Call Me in the Morning," Wall Street Journal,  Aug. 4, 2009.  Imagine a patient who ingests such a pill at home; the pill relays information to a device connected to the patient's home computer, which forwards it via the Internet to a remote physician.

Update 2: As cheap new technologies enable consumers at home to collect floods of data about their vital signs, issues will arise concerning the unauthorized practice of medicine.  A person (possibly a remote physician who is not licensed in the consumer's state) or a software program may help the consumer interpret the data.  Would this help constitute unauthorized practice of medicine, if the person or software explicitly disclaims giving medical advice or diagnosing disease and recommends that the consumer consult a licensed physician?  

A few years ago, Texas lawyers questioned whether self-help software was engaged in the unauthorized practice of law.  The legislature then enacted special legislation to declare that software is 
not engaged in unauthorized practice -- so long as the software conspicuously states it is not a substitute for the advice of an attorney.

Some worry that healthcare reform in the US will lead to a shortage of doctors.  Kirch, "How to Fix the Doctor Shortage," Wall St. J., Jan. 5, 2010.  If a shortage does materialize, state regulators may be less inclined to conclude that help from software or remote physicians constitutes the unauthorized practice of medicine.  Regulators may feel that software and remote physicians can help to reduce the wait times for people who really need an in-person visit with a doctor.

–-Benjamin Wright

Mr. Wright the law of data security and investigations at the SANS Institute.

Update:  Interview of Mr. Wright regarding telemedicine regulation.

PII Security Legislation

Safeguard Anonymous Private Data?

Patterns of Behavior Are Protected Identifiers?

Privacy as a legal concept is in crisis. The law of privacy is becoming so expansive that the scope of the law is confusing, and literal compliance can entail strange and arduous effort.

Connecticut Legislation

Consider Connecticut’s new Public Act No. 08-167. Section 1(a) says, “Any person in possession of personal information of another person shall safeguard the data, computer files and documents containing the information from misuse by third parties . . .” Then, Section 1(c) explains:

“As used in this section, ‘personal information’ means information capable of being associated with a particular individual through one or more identifiers, including, but not limited to, a Social Security number, a driver's license number, a state identification card number, an account number, a credit or debit card number, a passport number, an alien registration number or a health insurance identification number, and does not include publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media.”

That seems like a breathtakingly broad definition.

Observe that it considers any “account number” as an identifier that triggers the requirement for security in Section 1(a). Public Act No. 08-167 does not define “account number,” which can make for surprising results for all kinds of organizations that collect money, including small ones like neighborhood parent-teacher associations. 

Surprising Case Example - Health Club Locker Number 

For example, suppose a small health club keeps track of membership payments according to locker numbers, which are viewable in the locker room. That practice may be a mistake under Connecticut’s law because anyone walking through the locker room could learn that my locker number, i.e., my account number, is “57". That unit of identifying information might be misused by, say, a snoopy debt collector who is investigating how much I spend on luxuries like club membership. Knowing my name and locker number, he could telephone the health club and say, “This is Ben Wright, and my locker number is 57.  Can you tell me how much I owe on my club membership this month?”

So, to say it in different words:  This little health club has opened itself to a lawsuit in Connecticut by doing something (making account number and locker number the same thing) that would seem to be perfectly natural and insignificant to anyone but the most paranoid of lawyers.

Behavior Patterns as Identifiers?

Although Connecticut’s law itemizes some identifiers like “account numbers” and Social Security numbers, its definition of personal information reaches wider than the itemized list.  The law regulates any and all “information capable of being associated” with a person through an “identifier.”

What kinds of information can be used to identify people by way of an “identifier?” What about patterns of behavior and patterns of social relationship? Could patterns of activity be “identifiers?” I don’t see why not.

Academic researchers have demonstrated that so-called anonymous data about human behavior can be used to identify individuals. For instance, researchers started with “anonymized” data from one Web 2.0 service, Twitter.  From this data, they ascertained the identities of individual Twitter users.  How did they do it? They drew on behavior data from another Web 2.0 service, Flickr.  By comparing maps of relationships from unnamed Twitter users with maps of relationships for known Flickr users, the researchers uncovered the identities of the Twitter users!

From the perspective of privacy, this research is chilling.

Is All Data About a Person Private?

Responding to this research, a privacy advocate is naturally inclined to say that no one should keep any data about anyone. 

While that response may be excessive, it does accurately reflect the privacy concern when anyone retains information about the patterns of behavior of individuals.

Another Case Example - Identifying People by Writing Style

So given how information about behavior patterns can serve as the “identifiers” of an individual . . . let's consider the following application of Connecticut law.  Suppose a small nonprofit in Connecticut works with volunteers to develop and publish opinions on controversial civil rights topics, such as abortion or homosexual marriage.  The organization attributes the opinions only to itself, without identifying the volunteers involved in writing them.  

Sally is one of those writer volunteers. The organization publishes a controversial opinion based largely on prose composed by Sally. Could the organization be violating Connecticut law simply by publishing Sally’s written words? Logically, the answer could be yes. Here’s the logic . . .

Examples of Sally’s writing – on non-controversial topics – appear in association with her name in many public places such as blogs, libraries, Facebook pages, LinkedIn comments, letters to the editor and so on.  

Research shows that people can be identified according to their writing style – syntax, word choice and so on.  In fact, researchers today track “anonymous” terrorists according to the style of their writing, records and communication on the web.

Hence, when the civil rights organization publishes Sally’s words, even with her name removed, it is failing to safeguard her personal information.  It is opening her to embarrassment and ridicule by people who disagree. Adversaries could analyze the patterns of behavior exhibited in the published words and ascertain that Sally is the author!  

In other words, in the legislative terms of Public Act No. 08-167, the organization failed to protect her personal identifying information (i.e., the patterns of her unique writing style woven into her text) from being "misused" to criticize her personally. 

What Does This Mean in Practice?

So what could the organization have done to comply with Connecticut law?  Before publishing Sally's words, the organization could have removed from the words the “identifier” linking to Sally by hiring a team of third-party writers to rearrange the words into anonymous writing style.

Shiver my timbers. Thats a lot of work for a small nonprofit, just to comply with Connecticut privacy law.  The regulation chills free speech.  Is that really what the Connecticut legislature had in mind?

Society faces an emerging conflict between the civil right of privacy and the civil right of free speech.

Global Impact of Strange Legislation

Notice that the foregoing conundrums arise from legislation enacted by just one small US state.  But in our Internet-connected world, the data privacy law of Connecticut can be applicable to the activities of an organization in Australia or Hong Kong.  Further, nothing prevents the legislature of Arizona, Pennsylvania, Michigan or name-your-jurisdiction from adopting law that is similarly strange and broad in scope -- all the while using words and standards that differ from Connecticut's.  

Full compliance with data privacy law has become very difficult.

–Benjamin Wright

Mr. Wright teaches data law, including electronic data discovery (EDD) at the SANS Institute.