Electronic Data Records Law | How to Win E-Discovery

Is OWADE Illegal?

Forensics Investigation as Computer Crime?

OWADE (Offline Windows Analysis and Data Extraction) is an open source forensics tool for extracting “hidden” data from the hard drive of a Windows PC.  According to New Scientist, OWADE enables an investigator to “bypass” the encryption Windows uses to store data on the hard drive so the investigator can discover web browsing history, including user IDs and passwords.  New Scientist, “New forensics tool can expose all your online activity,” Sept. 7, 2011.

I wonder whether OWADE violates the Windows EULA or other legal restrictions  Microsoft asserts with respect to Windows.   
 For example, paragraph 8 of the End User License Agreement for Windows 7 Professional says the user may not “work around any technical limitations in the [Windows] software.”

What is the implication of an investigator violating the Windows EULA when he gathers data?  Is the investigator committing a computer crime?  Is he accessing a computer without authority and causing harm (paraphrase for violating the Computer Fraud and Abuse Act)?  

Is he infringing privacy law?  

Is he opening himself to a lawsuit from any person who is harmed?  

Is he rendering the data he collects inadmissible as evidence in court?

What do you think?

[Update: I wonder whether use of OWADE would violate the Digital Millennium Copyright Act (DMCA). 17 USC Sec. 1201 (a)(1) (A): “No person shall circumvent a technological measure that effectively controls access to a work protected under this title.” The argument might be this: 1. The Windows user used Windows to make records of his “work” (i.e. codes showing his browsing activity and history). 2. He used the encryption in Windows to control access to his “work.” 3. OWADE circumvents the encryption.  

DMCA is complex. I note that DMCA contains many exceptions, including certain exceptions for law enforcement.]

–Benjamin Wright

Mr. Wright teaches the law of data security and investigations at the SANS Institute.

International E-mail Deletion

Computer Spoliation in Asia

Electronic discovery (EDD*) and the destruction of digital evidence are global issues, affecting more than just North America.  Throughout the world, electronic records are ubiquitous, and mushrooming in volume.  Any law enforcement investigation in the world – whether a lawsuit, a tax audit, a police inquiry, an arbitration proceeding,
a legislative hearing, an administrative probe or a government inspection – is likely today to seek access to electronic records (email, databases, flash drives, text messages, facebook posts, youtube videos, digital photographs, laptop hard drives, and more).

Naturally, to thwart an investigation, an unscrupulous holder of e-records (ESI) wants to destroy them.  In the US, we call that destruction “spoliation” or “obstruction of justice.”  Other jurisdictions may use different words for unlawful destruction of evidence, but the general concept of law must be universal.  If law enforcement is to function, it must forbid and punish wrongful destruction of electronic evidence.

Many of the leading cases punishing the destruction of computer evidence are American, and to a lesser extent Canadian.  But cases are emerging in other countries.  . . .
One such case before the Singapore High Court is K Solutions Pte Ltd v. National University of Singapore [2009] SGHC 143.  This lawsuit was a contract dispute involving IT services provided by K Solutions (KS) to a university.  Under the rules of discovery in the lawsuit, the university sought from KS certain email records, in addition to audio recordings of meetings between KS and university staff.

The court noted that Singapore rules of procedure (Order 24 rule 16(1) of the Rules of Court) require a litigant like KS to disclose relevant records to its adversary, the university.  Evidence in this case showed that KS had possessed numerous relevant electronic mail records and audio recordings, which it had not released to the university.  Although KS explained that some email records had been destroyed innocently under its policy of retaining e-mail only six months, the court was suspicious.  The court believed KS’s email destruction policy should have been suspended because KS knew that litigation was likely.  (In other words, using American parlance, KS should have applied a “litigation hold” on the email.)

The court observed that although the rules of procedure do not explicitly forbid a party from destroying records, the rules imply that records should be preserved when litigation is pending or anticipated and that wrongful destruction should be punished. 

As the court considered KS’s deletion of email, it noted that KS, during the course of the lawsuit, had also been evasive and untruthful about its records.  The court levied severe sanctions against KS, effectively granting judgment against it in favor of the university.

Analysis:  From the perspective of any enterprise such as a business, law punishing the destruction of evidence is dangerous.  Digital records are destroyed constantly, in the ordinary course of operations. But the law may punish destruction if a legal authority concludes the destruction should have been avoided.  In any investigation the authority looks backwards and second-guesses what the defendant did in the past.  Retrospection is always how investigations like lawsuits or tax appraisals work.  With the benefit of hindsight, an action (or omission) of records management that seemed innocent to the defendant at the time can appear sinister later.   All enterprises (US and non-US) therefore need margin for error.  The law gives them incentive to be more generous in retaining computer records, especially electronic mail.  And the law gives incentive to keep email of important people much longer than six months.

–Benjamin Wright

Mr. Wright serves as a public speaker on e-discovery, e-records management and IT security law.  He speaks to professionals groups like Institute of Internal Auditors and SANS Institute.

*What is EDD?  Electronic Data Discovery is a relatively new legal term of art.  It refers to the process of finding, managing and disclosing electronic records (whether on a tape, a PC, an iPod, a cell phone or whatever device) as required in a lawsuit or legal investigation, such as a regulatory audit.

Risk Mitigation | Email Archive

Evidence | Tort Lawsuit Defense

Insurance | Hidden Cameras | E-Messages

Law and politics give institutions incentive to collect and archive plentiful records.  The best way to maintain plentiful records in practice is to archive email.

Records are evidence of due diligence and responsible corporate behavior.  In the past, records were expensive to keep and manage. But costs are plummeting as information technology advances.

A case in point:  The use of a taser in police work is controversial because, legally speaking, officers should use it only when circumstances warrant.  But proving, after-the-fact, what the circumstances were can be difficult. So the company that makes tasers sees an opportunity.  Recognizing that the cost of gathering and storing video evidence is declining, the company has developed a video camera for police officers to wear while on duty. The camera will capture trainloads of data.  The company has further developed a technology for economically storing and managing that data. Veronica Dagher, “New Taser 'Shoots' Evidence,” Wall St. J., Sept. 2, 2009.

Update:  A police officer in Fort Smith, Arkansas, was wearing a video camera when he fatally shot a gunman, November 2009.  The police department released the video record to local media.  The local prosecutor investigated the shooting, and part of the investigation included review of the video record.  The prosecutor concluded that the officer acted lawfully, as he had ordered he gunman nine times to drop the gun he was pointing at officers.


Insurance

For an enterprise like a police department or a doctors' office, greater quantities of records can mean reduced risk of liability for negligence (tort).  Good records support a defendant’s position that its people exercised due care and it therefore is not liable.

For physicians, lawyers and other professionals, classic advice for the avoidance of malpractice claims is to make and retain thorough records of services performed.


Hidden Cameras

In this technological age, hidden cameras and surprise evidence are becoming more common.  They can embarrass an organization, as they did ACORN, a high-profile advocacy group for the poor.

Yet, surprise evidence may evaporate if the organization maintains its own detailed records that counteract the surprise.  Example: In the famous murder prosecution of Carolyn Warmus, a key issue was whether she placed a phone call to a gun shop.  At trial, her defense team produced “surprise evidence” – an original telephone bill – showing she did not make the call.  But the evidence backfired because the prosecution established that the “original” bill was in fact a forgery.  It did so by drawing on secure computer records at the telephone company and testimony from a telephone company employee.


Electronic Message Archival

The electronic records in an enterprise such as a government agency are often in diverse formats and locations, which makes long-term retention and management difficult.  The enterprise therefore has incentive to emphasize the archiving of electronic messages such as e-mail. Three reasons:

1. Electronic messages represent a detailed, time-stamped diary of many of the day-to-day activities and intentions of the executives and staff at the enterprise.

2. The IT industry has fielded numerous, competitive products for archival of enterprise electronic messages.  Good archive products support economical retention and rigorous searching of records.  Good archival includes storage of records in a non-proprietary format like XML.

3. If electronic messages are the focal point for record archiving, then the enterprise can direct employees to use electronic messages generously as the journal of their activities.  Journaling can include attaching to email documents like spreadsheets or (short) videos.

–Benjamin Wright

Mr. Wright teaches the law of data security and investigations at the SANS Institute.

Court Judges Corporation’s Record Retention-Destruction Routine

Phillip M. Adams & Associates v. Dell Inc.

Corporate record retention policies are taking a beating in court.

Conventional policy instructs employees to look at records on a one-by-one basis and decide according to rational standards what to keep and what to destroy.  Conventional policy further provides that when litigation arises, then a legal hold is applied – that is, record destruction is suspended and relevant records are retained.  Classic records and information management (RIM) theory holds that if a corporation follows such a conventional policy, then the corporation should not be penalized in litigation for improper destruction of records.

But the theory is not holding up.  Over the past decade, legal authorities have looked askance at record destruction policies.

At an emotional level, the attitude of authorities is, “What?  You’re telling me, big enterprise, that you don’t have any records on the topic of this lawsuit because you told your employees to destroy records (or you set up your system to destroy records automatically unless employees undertake arduous steps to preserve them)?  Explain that to me.  What is the urgency to destroy records in this digital age?   Maybe when records were paper an enterprise needed to rid itself of documents that occupy a lot of real estate and are hard to search.  But e-mail archives do not take up much physical space, and they are amenable to automated search.  I have a pointed question for you, big enterprise:  Did you as a matter of policy winnow down the number of your records so that you could achieve a general advantage in lawsuits?”

The legal system is unhappy with an enterprise that destroys records for the purpose of positioning itself for future litigation, even litigation that is not specifically anticipated.  The system calls that behavior spoliation.

Phillip M. Adams & Associates v. Dell Inc. is a striking case.  It sanctioned a company for destroying records for some years before the lawsuit was filed or specifically threatened.  In accordance with the company's policy, employees (including an engineer or two) destroyed records, or they refrained from preserving records as the company's computer systems destroyed them.

Storage space was limited on the company's central e-mail servers.  Servers overwrote (erased-purged) e-mail relatively quickly unless employees made special efforts to preserve them.

Although the company's policy was not fully expressed as a formal, unified document, the court was able to ascertain what the policy was from the company's deliberate practices and their effect.  Said the court, "“[The company's] practices  . . . tend toward loss of data. The practices place operations-level employees in the position of deciding what information is relevant to the enterprise and its data retention needs."

Effectively, the company's policy is what I've termed on this blog the make-a-decision style of records management, where individual employees are supposed to decide what records to keep and what to destroy.

The court essentially felt the policy was unreasonable.

Some commentators think the court made a bad decision because it runs counter to common business practice.  They speculate the court suspected bad faith on the company's part, but couldn’t specifically cite evidence to support that suspicion.

Regardless of whether the court was right or wrong, the case is consistent with a trend in 21st century law:  the legal system is distrustful of early or aggressive record destruction.  The legal system is providing enterprises a growing basket of incentives to be more generous in retaining records, especially email.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigations law at the SANS Institute.

Electronic Mail Message Forged

Electronic Evidence | Forensics and Authentication in Police Investigation

For responsible parties like corporations and government agencies, a reason to retain all their e-mail, text and instant message records is to refute forgeries of e-records.  Thorough email archives (including each attachment) provide forensic evidence to invalidate false claims.

Just ask Australia’s prime minister, Kevin Rudd.  His political opponents tried to embarrass him with an electronic mail record purportedly from his senior advisor Andrew Charlton.  The e-mail appeared to show corruption; it appeared to show Rudd’s government conferring a business advantage to Rudd’s friend John Grant.

But fortunately for the government, it retained its own e-mail records for the time in question.  An investigation revealed that the scandalous e-mail was a forgery!

The investigation proceeded in two steps. First it examined the alleged sender’s digital records.  “Searches by the Department of Prime Minister and Cabinet and Treasury of Dr Charlton's computer and the system of the public service had found nothing.  ‘There have been exhaustive searches conducted on Dr Charlton's computer email system and no such correspondence can be found,’ Mr Rudd said.”

Second, the Australian Federal Police (equivalent to FBI) conducted a forensic analysis of two computers used by the purported receiver of the e-mail.  "Preliminary results of those forensic examinations indicate that the email referred to at the centre of this investigation has been created by a person or persons other than the purported author of the email," said the AFP.

This revelation of course played to the Prime Minister’s distinct advantage.  He could show that his adversaries had based their attack on misrepresented facts.

The Strategy Lesson:  Unless you are a criminal, your e-records are your friend.  Had the government been destroying its records quickly, it would not have been so capable of exposing this fraud.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader on ESI investigations.