Electronic Data Records Law | How to Win E-Discovery

Custom Professional Training

Tutorials | Questions Answered

Price | Professional Credit | E-Policy Workshop

Many professionals who visit this blog are looking for education on electronic records or technology law. Mr. Wright can deliver custom tutorials on the topics important to you right now.  A tutorial can be one hour, two hours, a half-day, or more.

Benjamin Wright has much experience training professionals on such topics as e-discovery, e-record privacy, data security law, cyber defense investigations, record retention policies, BYOD, e-commerce records and contracts, and more.

Now he delivers this continuing professional education on a tailored, as-needed basis.  Tell him what interests you, and he will work with you to develop a curriculum and a delivery plan.  The number of students could be one, two, 100, or more.

The method of delivery could be Webex, on-site, telephone conference, or something else, depending your needs and resources. A tutorial could combine lecture and interactive Q & A.

To discuss, please call Mr. Wright at 1.214.403.6642.


Price

Price would depend on many factors, such as the length of seminar time, the medium of delivery, out-of-pocket expenses, and the amount of advanced preparation involved.  A one-hour briefing by Mr. Wright to a small audience (delivered by telephone call you initiate) on a topic for which he already has material, could cost as little as $375.


Continuing Professional Education Credit

Many professionals – auditors, lawyers, investigators, accountants, records managers, security professionals -- need continuing professional education (CPE and CLE) hours.  Mr. Wright's tutorials are of a quality to support the granting of credit.  Mr. Wright will be happy to sign a letter confirming that any particular professional participated in a seminar.  However, the application for and obtaining of credit will be the responsibility of the individual professional.

Rules for continuing legal education credit vary by jurisdiction.  Often an attorney can obtain credit by applying for it after attending a seminar.


Policy Workshop

Mr. Wright and Messaging Architects deliver an in-house workshop for developing enterprise policy on BYOD and the retention, destruction and management of electronic records, especially e-mail.

=
Statement from Andrew Scygiel, Merck & Co., Inc. to Mr. Wright:  "Thanks again for a great class and very insightful information.  You have really changed my view of records and I have 'aspired' to be much more aware of our policy and how today's climate can affect us."

As senior legal instructor at the SANS Institute, Mr. Wright emphasizes that -- in response to an IT security incident -- an effective public message is just as critical as the technical and legal responses.

Freedom of Information Act | Computer Records

Freedom of Information Act Requests Yield E-Troves of Documents

FOIA forces transparency in government, and transparency in turn forces revolution in the administration of public institutions – both national and local.

A FOIA requires government to disclose records to citizens upon request.  Remarkably, the quantity of available records relevant to any given request is skyrocketing as government agents adopt digital technology – databases, electronic mail, instant messaging, text messaging, Twitter, collaboration software and more – to execute the details of day-to-day government. The implications for democracy are profound.  So are the governance implications for enterprises of all descriptions.

Item One: Britain is in uproar over the expenses of Parliament members.  The row started when a journalist used the UK’s new FOIA to request records about M.P. requests for reimbursement of living expenses.  By age-old practice, the government covered M.P.s for the living costs associated with their official duties, but the specifics have always been hidden from public view.  Reluctantly resistantly the government prepared to turn over expense records under FOIA – though with heavy redacting to protect M.P. privacy.

But by this time loads of (un-redacted) M.P. expense records had been compiled into something that did not exist in the old days . . . a neat, convenient-to-steal electronic form.  This compact compilation of records enabled a whistleblower to spirit the records out of a government computer and into the hands of a newspaper.  The Daily Telegraph’s ensuing publication of complete, open details has embarrassed M.P.s in an historic scandal. British government will never be the same.  John F. Burns, “In Britain, Scandal Flows From Modest Request,” NY Times, May 20, 2009.

Item Two is Clark County School District, Nevada. Citizen Karen Gray requested under FOIA a year’s worth of the School Board’s e-mail, about 1500 messages.  A few years ago, records of such granularity did not even exist for a typical school board (or city/municipal commission, county management, state committee or board of trustees).  But e-mail has caused the creation of mounds of new records, which become fodder for any kind of legal investigation.

The District tried to delay disclosure.  It also tried to charge Ms. Gray $4000 for the costs of recovering the records (and filtering them for private/confidential data), but those costs reflect out-of-date, manual methods for compiling and reviewing e-mail records. The Nevada courts resisted the delay and the high charges.  The attitude of the courts was that the law favors inexpensive and generous disclosure. So the courts forced disclosure.

Ms. Gray’s case implies that Freedom of Information Act law is intolerant of governments that make their important e-mail records hard to recover.  A modern e-mail archive appliance makes the compilation and filtering of e-mail (especially that of executives, professionals, top managers, and board members) quick and inexpensive . . . consistent with the purpose of FOIA law.

–Benjamin Wright

Mr. Wright is an advisor to messagingarchitects.com, the visionaries in e-records management.

Investigating Staff Graft or Misconduct

Electronic Records for Audit, Ethics and Internal Control

If an institution – any institution – is to maintain its reputation, it must be prepared to investigate the actions of its employees (personnel).  Inevitably, allegations will arise that this or that employee embezzled, acted unethically, abused authority, laundered money, executed an unauthorized trade or simply made a mistake.  Power to conduct internal investigations is critical to government agencies and for-profit corporations, as well as charity, non-profit, and educational organizations.

Modern investigations today are different from those of the past, by virtue of the presence of digital records. The sheer quantity of e-records (e-mail, text, chat or instant messages, logs, meta-data, photographs, blog comments, surveillance videos, and on and on and on) is mushrooming beyond comprehension.  When an institution undertakes to audit whether a superior harassed a subordinate, an accountant misunderstood a tax liability or an administrator wrongfully tolerated a conflict of interest, a brimming corpus of electronic records can be available for examination . . . and can facilitate a just outcome.  The records can shed welcome light on whether the subject of the investigation did what is claimed, or did not do it.

A case in point is an investigation at Yale University, a regular recipient of research grants from the federal government.  Prosecutors alleged that academics at Yale had misallocated federal money (funds or assets) by (a) transferring grant funds to accounts that were not intended for the grants in question, and (b) paying themselves for summer activities using money from grants not earmarked for those activities.

In other words, the government claimed professors and staff played fast and loose in interpreting the purpose of specific grants.

In the face of such allegations, an institution has no choice but to cooperate with government.  (Which university wants to be the subject of an adversarial police raid in search of computer records?) Yale launched a massive investigation, covering some $3 billion in grants over seven years (2000-2006). It turned over more than a million pages of documents.  No doubt the massive quantity of records included email and other computer-based records.  (A similar corruption probe in the 1980s could not have yielded as many records because computers and e-mail were not as pervasive then.)  The college settled the matter in 2008 by agreeing to pay $7.6 million.  

Although Yale admitted it had made some errors, the government granted the school a release from further liability with respect to the years that were investigated.

$7.6 million is a relatively small penalty.  The university appears to have done itself three favors.  First, it had retained plentiful records for many years.  Second, it cooperated with the government and divulged rafts of records.  Third, when the allegations first arose, Yale instituted reforms preemptively, including tighter accounting controls and improved staff training.  The result was the imposition of only a small settlement payment.   And as for the future, Yale remains qualified to receive grants from the government. 

Had Yale produced fewer records, and displayed less transparency and less cooperation, the institution would not have fared so well.

I’ll bet the “errors” to which Yale admitted reflected past practices that had developed over decades, in an age when records were fewer and therefore government (inspectors general) had less ability to audit or investigate.

The incident teaches Yale staff (and staff at other institutions receiving federal grants) that they will be on a tighter leash for the future.  A digital informant is ready to snitch on them.  The super-plentiful e-records now being made about their daily activities expose them to greater review and accountability than was historically possible.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in records-dirven investigaions.  He also teaches Internet law at the SANS Institute.

Terminate Employee, Delete Email?

Are Layoffs a Reason to Destroy Electronic Mail Records?

Departure (dismissal) of an employee does not justify destruction of his e-mail records stored on employer equipment. Those records are not the property of the employee or (normally in the U.S., with some qualifications) the vessel of his privacy.  The records are an asset of the employer, showing what the employee did in his capacity as an employee and agent of the employer and how he was supervised.

In our changing economy, employers are learning how to get the same productivity with fewer people.  As they let some employees go, the email records of those employees are part of the employer's valuable institutional memory.

Wasting Manager Time

A manager is wasting her time if she paws through a departing employee’s e-mail to decide what to keep and what to destroy (delete).  It is better just to keep the e-mail, consistent with the retention and privacy practices generally applicable for all employees. 

Email is an Asset of the Enterprise

E-mail records memorialize intellectual property development by employees (such as an inventor or engineer), and they record when and under what conditions trade secrets are shared with business partners.  In intellectual property (IP) disputes, proving the time and date that particular events transpired is essential.  The beauty of email records is that every message is stamped with time and date.

Today, e-mail records are critical to many investigations and disputes; they are even critical under search warrants, where law enforcement seizes records under court supervision. In Jane Doe v. Norwalk Community College (a sexual harassment case), the court sanctioned a college for destroying electronic records of a suspect teacher after he left the college.  The same could happen to any educational institution (public or private . . . higher, secondary, primary, K-12).

E-mail records show what commitments employees did and did not make on behalf of the employer. In Cloud Corp. v. Hasbro,  314 F.3d 289 (7th Cir. 2002), employee e-mail effectively modified a paper-written contract that said it could not be modified except by a “signed writing”.  E-mail can be a legally-binding “signed writing” that memorializes the employer’s rights and responsibilities under contracts.

Federal Sentencing Guidelines

E-mail records showing day-to-day education and supervision of employees are consistent with the expectations of the Federal Sentencing Guidelines.  The Sentencing Guidelines are the framework within which federal judges select penalties for convicted criminals.  If a criminal happens to be an enterprise, the Guidelines call for leniency where the enterprise had taken steps to prevent and mitigate crime by employees.  In other words, bad employees might go to jail, but their not-so-bad employer might avoid stiff criminal penalties.

Under the Sentencing Guidelines, the steps the employer must take include establishing and promoting an employee ethics program and then monitoring and disciplining employee conduct.  To show that an employer did this, electronic mail records (ESI) can be key evidence.  They can document regular education, supervision and discipline of employees.

Update: The Federal Sentencing Guidelines are proposed to be amended so as to place more emphasis on complete record retention.

Policy?

So precisely how long should employers keep email records? There is no one-size-fits-all answer.  I have led in-house workshops to address this question at numerous, diverse enterprises. The outcome of these workshops has varied, depending on many factors, including corporate culture.

In my experience, the best email retention policy is one that is developed by collaboration of the various stakeholder departments in the enterprise (legal, IT, HR, operations et al.).  Normally, these different stakeholders start with different positions on what the policy should say.  But, in my experience, after the stakeholders have talked through the issues, they tend to compromise their positions and coalesce into a policy that is unique to the enterprise.

–-Benjamin Wright

Mr. Wright is senior instructor for the SANS Institute, where he delivers professional training on the law of e-discovery, e-records management and internal investigations.

P.S.  Employers may believe that by deleting email they are preventing a future eDiscovery adversary from conducting a so-called fishing expedition through the records.  However, I argue that the advantages of generous record retention outweigh the risk of a fishing expedition.