Electronic Data Records Law | How to Win E-Discovery

Treat Electronic Records the Same as Paper Records?

In-house Local Government Counsel Sanctioned for Spoliation

Courts seem more assertive in punishing electronic spoliation than they historically were in punishing the spoliation of paper documents.  Many veteran lawyers will be astonished to hear that a federal judge sanctioned an in-house government lawyer for taking something less than vigorous steps to cause and monitor the preservation of electronic evidence.

Prior to filing a negligence lawsuit against a county sheriff’s department (Swofford v. Eslinger), the plaintiff demanded by letter that all evidence including electronic records be preserved.  General counsel for the Seminole County (Florida) Sheriff's Department, David Lane, forwarded a copy of the letter to six senior officials in the department.  Still, the department subsequently destroyed relevant e-mail records and wiped the hard drives of relevant laptops.  

The judge was highly suspicious. On her own initiative she called the in-house lawyer as a witness in a hearing on the question of spoliation.  Citing the famous Zubulake case, the judge concluded that the lawyer had defaulted on his duty to ensure that electronically stored information (ESI) was preserved.  The judge specifically opined that in a case like this counsel needs consult with IT staff about preserving ESI.  The judge imposed a monetary fine on Mr. Lane personally, the amount of which is to be determined.  (See The Pension Committee of the University of Montreal Pension Plan, et al. v. Banc of America Securities for more on a lawyer's professional duty regarding the preservation of e-records and subsequent search through them.)

The judge is saying that modern counsel must understand how ephemeral ESI is and how vigilant counsel (as an officer of the court) must be to preserve it under a litigation hold.

I don’t know how much annual salary counsel to a Florida county sheriff's department makes, but I'll bet the man is not getting rich on his salary.  The imposition of monetary sanctions on him makes quite a statement.  It is unclear whether malpractice insurance would cover this fine.

A different lawyer at a government agency recently asked me why the record retention policy for e-mail should be different from the policy for paper documents with the same content.  I believe electronic records behave differently from equivalent paper records.  They must be managed differently.  What's more, this Swofford case reinforces my impression that courts are treating electronic records differently.  It reinforces my argument that today the law gives all enterprises heightened incentive to retain email generously.  No employee of a government agency, whether counsel or otherwise, wants the risk of being held accountable for premature destruction of email. 

–Benjamin Wright

Mr. Wright is senior instructor at the SANS Institute, where he teaches a 5-day bootcamp on the law of e-records, cyber defense and computer investigations.

Best Practice | E-mail Record Retention

Laptop ESI Litigation Hold

Court Case | Policy Risk

Accepted “best practice” says employees like executives should review e-mails and documents one-by-one and decide which to keep and which to destroy.  The rationale behind the practice is that it is imprudent to retain all records.  This practice further holds that employees should be trained not to keep insignificant documents and email messages, lest record archives fill up with junk, making search for important records more difficult.  One more tenet of the best practice is that when litigation is anticipated, the destruction of e-mail and documents (even insignificant messages) related to the topic of the litigation should cease so that records are not spoliated.  

Accepted best practice suffered another blow in court.  In Goodman v. Praxair Services, Inc., 2009 WL 1955805 (D.Md. July 7, 2009), the court sanctioned a corporation for failing to keep all of an executive’s emails and e-documents on a topic after litigation was threatened, even though during the time in question the executive kept what she deemed to be “relevant” e-mails and documents, while allowing only “irrelevant” ones to be destroyed.

Risk

The case spotlights a big risk associated with the accepted best practice:  Knowing when and how to apply a litigation hold is tricky.  The danger sprouts from the proclivity of courts to second-guess an enterprise after it, acting through its employees, makes a decision.  Although an enterprise makes a decision about whether to implement a litigation hold on Day Number 1 (when the enterprise knows little about the potential lawsuit that may or may not materialize), the court’s review of that decision may happen on Day Number 2601, long after the lawsuit is underway and at a time when it is clear what the focus of the lawsuit is.

Even after the decision to initiate a litigation hold has been made, the hold is hard to implement in practice.  If, before the litigation hold, the enterprise's default practice is to destroy records, then to make and enforce an exception to the default for precisely the right records is not easy.

Facts

So what happened in the Goodman case?

First:  According to allegation by a consultant, the consultant and the CEO of a corporation speak by telephone (end of December 2000) concerning a disagreement over compensation to the consultant under a contract.  Allegedly, the CEO suggested that the consultant take a small amount to settle the matter rather than having to sue the corporation to win more money.

Second:  The consultant stated to the corporation in a letter dated January 5, 2001, that he had consulted two attorneys concerning this contract dispute.  The letter spoke generally about the possibility that the consultant would pursue a lawsuit on the matter, without forcefully threatening it.

Third:  February 19, 2001, the consultant sent a stronger letter threatening litigation.

Fourth:  After receipt of the February 19 letter, the corporation’s CEO instituted a litigation hold on all then-existing e-mails and other documents related to the matter in her possession.  [What is a "litigation hold" aka "legal hold"?  It is a procedure whereby a party, anticipating or knowing of a lawsuit or legal investigation, takes special steps to prevent the loss of records that would normally be destroyed.] The CEO initiated this litigation hold on her own initiative.  It was not formally instituted throughout the company and was not instituted under the supervision of counsel. The litigation hold ultimately proved to be imperfect, as the court suspected some relevant documents were destroyed when the CEO’s laptop was later discarded.

Fifth:  Before February 19, the CEO’s usual practice was to review each of her e-mails and documents, print the relevant ones (that is, relevant in her eyes) and delete the others.

Sixth:  The court seemed to believe that the CEO deleted some e-mailed related to the topic of the lawsuit between January 5 and February 19, although the court did not specifically identify any such e-mails or their content.

Seventh:  Despite the litigation hold, the corporation eventually discarded the CEO’s laptop, which, in the opinion of the court, might have held some relevant records.  Although the court did not have conclusive evidence that any particular relevant record was destroyed, it distrusted the practice whereby the CEO decided what was and was not relevant.  Said the court, “The argument of an accused spoliator that it did not violate its duty to preserve evidence because it retained the ‘relevant’ information and only deleted ‘irrelevant’ information rings particularly hollow.  The ultimate decision of what is relevant is not determined by a party's subjective assessment filtered through its own perception of self-interest.”

Three years after the consultant sent the letters identified above, the consultant sued and sought e-discovery for all of the CEO’s relevant e-mails and e-documents.  The corporation turned over the records it had.  The corporation said it had not required to institute a litigation hold until February 19, 2001, because until then it could not have reasonably expected the topic to materialize into a lawsuit. The corporation further argued that nothing relevant had been destroyed because the CEO kept what she thought was relevant.

Ruling: Spoliation

The court, however, ruled that the corporation had committed spoliation because it should have applied a litigation hold on all the CEO’s email and e-documents touching on the subject of the lawsuit, starting from the January 5, 2001, letter. (As I said, that’s the letter that talked generally about a lawsuit, without forcefully threatening it.)  Instead, the CEO said her legal hold started with the February 19 letter.

The key to this case is that the court believed the litigation hold started too late.  The court seemed suspicious that the CEO destroyed some relevant evidence between January 5 and February 19, although the court could not specifically put its finger on what that evidence was.

Punishment: Strategic Disadvantage in Lawsuit

To punish the spoliation, the court dealt the corporation a strategic disadvantage.  It said that when the jury is empaneled as the lawsuit goes to trial, the jury will be informed that the corporation was negligent in its preservation of relevant e-mails and electronic documents.  This strategic disadvantage could make it more difficult for the corporation to win the case.  (See important footnote below.)

The court further held that the consultant would be entitled to reimbursement from the corporation for some of the consultant’s litigation costs in pursuing the spoliation complaint.

Analysis: Incentive for More Generous Retention

The court’s application of law to the facts of this case fails to persuade me.  I respectfully observe that the court could not identify any relevant record that had been destroyed and could not establish that any such record had been destroyed.  Nevertheless, the opinion is influential because it was written by a federal magistrate judge, Paul W. Grimm, who is considered a leader in the law of ediscovery.

Regardless of whether the court applied the law correctly, the case continues a distinct trend in American jurisprudence.  In this decade, courts have tended to expect enterprise electronic mail records to be well preserved and are suspicious if they are not.  Selective printing of e-mail by executives has evoked judicial skepticism.

What does this case, and the trend which it continues, tell people who craft real-world policies for the review, retention and destruction of enterprise electronic mail?  They suggest that policy makers are wiser to keep all the records of important people a long time.  They suggest that the accepted “best practice” is under siege. 

Safer Practice:  Keep More Email of Important People

But wait.  The Goodman court did not say that a corporation must keep all the records of important people.  All the court said was “don’t spoliate,” which strictly speaking means don’t destroy records when you have reason to believe they will be needed for future litigation.  That’s easier said than done.  My experience says it is very hard in practice for an enterprise to divine what a court (which has not even been selected yet because no lawsuit has been filed) may consider important several years in the future.  Further, few organizations can afford to have lawyers regularly engaged in analysis as to whether a legal hold should be applied at this time to these records versus that time for those records.  Therefore, the safer practice is to keep a lot of digital records, as the cost of digital storage is dropping. 

With that said, I believe it is very hard to “keep all the records of important people a long time.”  As archival technology advances, that may become easier. 

However, as of today, I argue that an enterprise is wise to place emphasis on the long-term retention of e-mail by executives and other decision-makers.  The reason is that email is a choke point in the modern enterprise.  It records rich, time-stamped detail about the activities of the enterprise, including copies of, references to or links to documents like spreadsheets. 

Email is not a comprehensive journal of the activities in an enterprise, but it is key, and the technology available for archiving it is relatively well-developed and economical to implement.

–Benjamin Wright

A practicing attorney, Mr. Wright teaches the law of data security and investigations at the SANS Institute.

Footnote:  I don’t wish to overstate the severity of the sanction the court applied in this case.  The court held that the consultant “is entitled to an adverse jury instruction . . . with respect to [the corporation]'s failure to preserve [the CEO]'s laptop and [the CEO]'s failure to preserve her relevant emails and documents.  The appropriate instruction would be a general adverse instruction that permits, but does not require, the jury to draw an adverse inference against [the corporation] as a result of its violation of the duty to preserve relevant evidence.”  Although this does deal an advantage to the consultant, it is not a decisive advantage.  The corporation may be able to overcome it and still prevail at trial.  The sanction is less severe than the sanction in some other leading e-spoliation cases.  Hence, Goodman should not be taken as earth-rocking authority for the proposition that enterprises will be treated harshly if they rely on executives to decide, one-by-one, which record is relevant for retention and which is not.

Court Judges Corporation’s Record Retention-Destruction Routine

Phillip M. Adams & Associates v. Dell Inc.

Corporate record retention policies are taking a beating in court.

Conventional policy instructs employees to look at records on a one-by-one basis and decide according to rational standards what to keep and what to destroy.  Conventional policy further provides that when litigation arises, then a legal hold is applied – that is, record destruction is suspended and relevant records are retained.  Classic records and information management (RIM) theory holds that if a corporation follows such a conventional policy, then the corporation should not be penalized in litigation for improper destruction of records.

But the theory is not holding up.  Over the past decade, legal authorities have looked askance at record destruction policies.

At an emotional level, the attitude of authorities is, “What?  You’re telling me, big enterprise, that you don’t have any records on the topic of this lawsuit because you told your employees to destroy records (or you set up your system to destroy records automatically unless employees undertake arduous steps to preserve them)?  Explain that to me.  What is the urgency to destroy records in this digital age?   Maybe when records were paper an enterprise needed to rid itself of documents that occupy a lot of real estate and are hard to search.  But e-mail archives do not take up much physical space, and they are amenable to automated search.  I have a pointed question for you, big enterprise:  Did you as a matter of policy winnow down the number of your records so that you could achieve a general advantage in lawsuits?”

The legal system is unhappy with an enterprise that destroys records for the purpose of positioning itself for future litigation, even litigation that is not specifically anticipated.  The system calls that behavior spoliation.

Phillip M. Adams & Associates v. Dell Inc. is a striking case.  It sanctioned a company for destroying records for some years before the lawsuit was filed or specifically threatened.  In accordance with the company's policy, employees (including an engineer or two) destroyed records, or they refrained from preserving records as the company's computer systems destroyed them.

Storage space was limited on the company's central e-mail servers.  Servers overwrote (erased-purged) e-mail relatively quickly unless employees made special efforts to preserve them.

Although the company's policy was not fully expressed as a formal, unified document, the court was able to ascertain what the policy was from the company's deliberate practices and their effect.  Said the court, "“[The company's] practices  . . . tend toward loss of data. The practices place operations-level employees in the position of deciding what information is relevant to the enterprise and its data retention needs."

Effectively, the company's policy is what I've termed on this blog the make-a-decision style of records management, where individual employees are supposed to decide what records to keep and what to destroy.

The court essentially felt the policy was unreasonable.

Some commentators think the court made a bad decision because it runs counter to common business practice.  They speculate the court suspected bad faith on the company's part, but couldn’t specifically cite evidence to support that suspicion.

Regardless of whether the court was right or wrong, the case is consistent with a trend in 21st century law:  the legal system is distrustful of early or aggressive record destruction.  The legal system is providing enterprises a growing basket of incentives to be more generous in retaining records, especially email.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigations law at the SANS Institute.

Documentation for Swap Contracts

Electronic Records of OTC Derivatives Contracts

New financial regulations, when coupled with advancing technology, will force the retention of massive electronic commerce records.  Hear what the authorities are saying about the regulation of financial derivatives:

First:  Famed economist Hernando de Soto says poor documentation for $1 quadrillion worth of financial derivatives is wreaking havoc on the world economy. "Toxic Assets Were Hidden Assets," Wall Street Journal, 3/25/09, pA13.  He calls for much better documentation of derivatives contracts.

Second:  Former SEC Chairman Harvey Pitt recommends much new record-keeping and reporting by entities like hedge funds that have not previously been regulated. “Former SEC chief says gather, share more data,” USA Today, 3/27/09 p3B.

Third:  To prevent more of the “toxic” assets poisoning today’s financial system, Treasury Secretary Geithner says, “We will require that all non-standardized derivatives contracts be reported to trade repositories and be subject to robust standards for documentation and confirmation of trades, netting, collateral and margin practices, and close-out practices.”

What’s the definition of a “non-standardized derivatives contract?”  It’s really just a negotiated contract that allocates risk between two or more parties.  It can cover most any kind of risk or possibility, from the risk of a lawsuit to the potential for rain in the Australian Outback.  (A derivative can even be "embedded" in an routine commercial contract, such as a sale agreement or a mining agreement.)  The scope of this field is breathtaking.  Non-standardized derivatives contracts have become a very large, thinly-monitored part of our financial world. 

So what’s a complete record of one of these derivatives contracts look like?  Would it be a stack of paper, stapled together, with signatures at the end?  It could indeed be such a stack of paper. 

But . . . let’s think deeper about how contracts are documented these days.  As the methods for written business communication – letter, telex, fax, e-mail, instant message and so on -- have grown progressively more cheap and easy, the challenges for documenting complex contracts have risen.

If the derivatives contract were entered in the 1970s, using the practices of the day, a stack of paper, stapled together, would most likely be the form it would have taken.  It might have been supplemented with a few paper letters and, once-in-a-blue-moon, a telex or two.  (Some court cases enforced telex similar to paper correspondence.)

Then in the 1980s faxes became popular, and the contract might have been a stack of stapled paper, supplemented or amended by several faxes. (We learned years ago that faxes can be legally-binding records, just like paper-written letters.)  

Next, in the 1990s e-mail started to become a common form of business communication.  Numerous judicial decisions have held e-mail to be legally-binding “signed writings” essentially equivalent to paper letters.  

See JSO Associates, Inc. v Price (informal e-mails can constitute signed writings agreeing to hire a broker to sell securities and pay a commission) and Cloud Corp. v. Hasbro (formal paper contract that says it can be amended only by a signed writing is amended by informal e-mails).

The e-mails in a contractual relationship can be very numerous.  And they often are not as clearly written as old-fashioned, formal paper contracts were.

Today non-standard derivatives contracts (a.k.a. "swaps," or "custom," "customized," "tailored," "bespoke" or "bilateral" derivatives) can be negotiated, documented, amended, supplemented and interpreted by a dizzying array of electronic communications.  Fax and e-mail are probably most common, but instant messages, phone text messages, chat rooms, message boards, social networking channels and voicemail-converted-to-text are rising in usage among busy traders.  (Dedicated online marketplaces like Agora-X and 360T provide organized electronic environments for communication and negotiation of over-the-counter derivatives instruments.  A brochure for 360T says its secure marketplace supports "Real-time online chat with any requesting counterparty individual.")

In the derivatives world, "novation" (substitution of one counterparty for another) commonly occurs by e-mail.

All this communication can be critical to full documentation for a modern financial contract.  In the Lehman Brothers bankruptcy, for example, the administrator digs through mountains of e-mail to figure out what the firm’s rights and obligations were in the over-the-counter derivatives market.