Electronic Data Records Law | How to Win E-Discovery

Archive Facebook Business Messages

Employee Policy

Professionals, business people, and government employees are increasingly using Facebook and other social media for official business, often as agents of their employers.  Commonly, the employers are required or well-advised to make and keep records of the employees’ social media communications. 

This issue arose in a workshop that Messaging Architects and I led at a sizable enterprise (having about 8000 employees).  The purpose of the workshop was to establish policy on the retention of electronic records. The workshop pulled together representatives of disparate stakeholders within the enterprise, including the IT, legal and compliance departments.

Workshop participants, including representatives from human resources, feared that employees would ignore a policy that forbids them from using text messages, Facebook and Google Buzz to transact business.  So the workgroup drafted this language for adoption as HR corporate policy: 

“If an employee uses electronic messages for business, outside an enterprise email system account, the employee is expected to strive to make records of the messages such that they are within the control of the enterprise.”

Dear Reader:  What do you think of such a policy?

Next question:  Speaking practically, how would an employee make and keep records of Facebook communications?  I don't have all the answers, but here's a step to consider:

Facebook allows a user to submit many of his postings via email. So at http://www.facebook.com/mobile/?v=web Facebook shows the user that if he sends some text to a special email address, then the text will be posted as coming from the user. 




















For example,  . . .   here is a screenshot of a message I posted from my email account:









Facebook posts this kind of incoming email as a status update to the user’s Wall.  Note that when a user like me submits text via email, the only text that appears on the user’s Wall (status update) is the text in the subject line of the user’s email. If the user writes anything in the content of the email, Facebook seems to ignore it and seems not to post it.

Thus, in the example above, I wrote all the text in the subject line of the message from my email account to my FB account.

If an employee were to submit to FB by way of her employer-controlled e-mail account, then the account would retain the submission according to whatever record retention/destruction policy the employer has set – 90 days, seven years, or whatever. [Interesting questions: In the employer's email system, are there limits to the number of characters that can be transmitted in the subject line of an outgoing message and can be stored in the record of that message?]

A FB user can submit more than text from his email account. The FB user can also submit a photo (or even a video). FB posts the photo on the user's Wall, with text taken from the subject line of the email. For instance:


















So . . . the above is one convenient way for a business professional to store her Wall posts into her employer's email system, such that the posts will be preserved for audit, inspection, supervision, ediscovery, litigation hold and the like. 

I argue that email archives are the starting place for any enterprise that wishes to maintain electronic records for legal compliance purposes.  I argue the same goes for Twitter.

My ideas here leave scads of answered questions, such as how to record comments that others post on the user's Wall.

–Benjamin Wright

Mr. Wright teaches IT and records management law at the SANS Institute, where social network law is part of the curriculum.  He chairs a (proposed) SANS conference on e-records and e-discovery slated for Las Vegas, September 2010.

Update:  Cutting-edge Web 2.0 lawsuit.

Court Judges Corporation’s Record Retention-Destruction Routine

Phillip M. Adams & Associates v. Dell Inc.

Corporate record retention policies are taking a beating in court.

Conventional policy instructs employees to look at records on a one-by-one basis and decide according to rational standards what to keep and what to destroy.  Conventional policy further provides that when litigation arises, then a legal hold is applied – that is, record destruction is suspended and relevant records are retained.  Classic records and information management (RIM) theory holds that if a corporation follows such a conventional policy, then the corporation should not be penalized in litigation for improper destruction of records.

But the theory is not holding up.  Over the past decade, legal authorities have looked askance at record destruction policies.

At an emotional level, the attitude of authorities is, “What?  You’re telling me, big enterprise, that you don’t have any records on the topic of this lawsuit because you told your employees to destroy records (or you set up your system to destroy records automatically unless employees undertake arduous steps to preserve them)?  Explain that to me.  What is the urgency to destroy records in this digital age?   Maybe when records were paper an enterprise needed to rid itself of documents that occupy a lot of real estate and are hard to search.  But e-mail archives do not take up much physical space, and they are amenable to automated search.  I have a pointed question for you, big enterprise:  Did you as a matter of policy winnow down the number of your records so that you could achieve a general advantage in lawsuits?”

The legal system is unhappy with an enterprise that destroys records for the purpose of positioning itself for future litigation, even litigation that is not specifically anticipated.  The system calls that behavior spoliation.

Phillip M. Adams & Associates v. Dell Inc. is a striking case.  It sanctioned a company for destroying records for some years before the lawsuit was filed or specifically threatened.  In accordance with the company's policy, employees (including an engineer or two) destroyed records, or they refrained from preserving records as the company's computer systems destroyed them.

Storage space was limited on the company's central e-mail servers.  Servers overwrote (erased-purged) e-mail relatively quickly unless employees made special efforts to preserve them.

Although the company's policy was not fully expressed as a formal, unified document, the court was able to ascertain what the policy was from the company's deliberate practices and their effect.  Said the court, "“[The company's] practices  . . . tend toward loss of data. The practices place operations-level employees in the position of deciding what information is relevant to the enterprise and its data retention needs."

Effectively, the company's policy is what I've termed on this blog the make-a-decision style of records management, where individual employees are supposed to decide what records to keep and what to destroy.

The court essentially felt the policy was unreasonable.

Some commentators think the court made a bad decision because it runs counter to common business practice.  They speculate the court suspected bad faith on the company's part, but couldn’t specifically cite evidence to support that suspicion.

Regardless of whether the court was right or wrong, the case is consistent with a trend in 21st century law:  the legal system is distrustful of early or aggressive record destruction.  The legal system is providing enterprises a growing basket of incentives to be more generous in retaining records, especially email.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigations law at the SANS Institute.

Electronic Mail Message Forged

Electronic Evidence | Forensics and Authentication in Police Investigation

For responsible parties like corporations and government agencies, a reason to retain all their e-mail, text and instant message records is to refute forgeries of e-records.  Thorough email archives (including each attachment) provide forensic evidence to invalidate false claims.

Just ask Australia’s prime minister, Kevin Rudd.  His political opponents tried to embarrass him with an electronic mail record purportedly from his senior advisor Andrew Charlton.  The e-mail appeared to show corruption; it appeared to show Rudd’s government conferring a business advantage to Rudd’s friend John Grant.

But fortunately for the government, it retained its own e-mail records for the time in question.  An investigation revealed that the scandalous e-mail was a forgery!

The investigation proceeded in two steps. First it examined the alleged sender’s digital records.  “Searches by the Department of Prime Minister and Cabinet and Treasury of Dr Charlton's computer and the system of the public service had found nothing.  ‘There have been exhaustive searches conducted on Dr Charlton's computer email system and no such correspondence can be found,’ Mr Rudd said.”

Second, the Australian Federal Police (equivalent to FBI) conducted a forensic analysis of two computers used by the purported receiver of the e-mail.  "Preliminary results of those forensic examinations indicate that the email referred to at the centre of this investigation has been created by a person or persons other than the purported author of the email," said the AFP.

This revelation of course played to the Prime Minister’s distinct advantage.  He could show that his adversaries had based their attack on misrepresented facts.

The Strategy Lesson:  Unless you are a criminal, your e-records are your friend.  Had the government been destroying its records quickly, it would not have been so capable of exposing this fraud.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader on ESI investigations.

Freedom of Information Act | Computer Records

Freedom of Information Act Requests Yield E-Troves of Documents

FOIA forces transparency in government, and transparency in turn forces revolution in the administration of public institutions – both national and local.

A FOIA requires government to disclose records to citizens upon request.  Remarkably, the quantity of available records relevant to any given request is skyrocketing as government agents adopt digital technology – databases, electronic mail, instant messaging, text messaging, Twitter, collaboration software and more – to execute the details of day-to-day government. The implications for democracy are profound.  So are the governance implications for enterprises of all descriptions.

Item One: Britain is in uproar over the expenses of Parliament members.  The row started when a journalist used the UK’s new FOIA to request records about M.P. requests for reimbursement of living expenses.  By age-old practice, the government covered M.P.s for the living costs associated with their official duties, but the specifics have always been hidden from public view.  Reluctantly resistantly the government prepared to turn over expense records under FOIA – though with heavy redacting to protect M.P. privacy.

But by this time loads of (un-redacted) M.P. expense records had been compiled into something that did not exist in the old days . . . a neat, convenient-to-steal electronic form.  This compact compilation of records enabled a whistleblower to spirit the records out of a government computer and into the hands of a newspaper.  The Daily Telegraph’s ensuing publication of complete, open details has embarrassed M.P.s in an historic scandal. British government will never be the same.  John F. Burns, “In Britain, Scandal Flows From Modest Request,” NY Times, May 20, 2009.

Item Two is Clark County School District, Nevada. Citizen Karen Gray requested under FOIA a year’s worth of the School Board’s e-mail, about 1500 messages.  A few years ago, records of such granularity did not even exist for a typical school board (or city/municipal commission, county management, state committee or board of trustees).  But e-mail has caused the creation of mounds of new records, which become fodder for any kind of legal investigation.

The District tried to delay disclosure.  It also tried to charge Ms. Gray $4000 for the costs of recovering the records (and filtering them for private/confidential data), but those costs reflect out-of-date, manual methods for compiling and reviewing e-mail records. The Nevada courts resisted the delay and the high charges.  The attitude of the courts was that the law favors inexpensive and generous disclosure. So the courts forced disclosure.

Ms. Gray’s case implies that Freedom of Information Act law is intolerant of governments that make their important e-mail records hard to recover.  A modern e-mail archive appliance makes the compilation and filtering of e-mail (especially that of executives, professionals, top managers, and board members) quick and inexpensive . . . consistent with the purpose of FOIA law.

–Benjamin Wright

Mr. Wright is an advisor to messagingarchitects.com, the visionaries in e-records management.

Electronic Mail Keep-Destruction Practice

Storage and Search Costs for Electronic Mail Archival

More Retention of Public Administrator E-mail?

Conventional records and information management (RIM) advice holds that each e-mail in an enterprise must be evaluated one-by-one.  Presumably, this evaluation must be performed by an employee because software isn’t up to the task.  If the employee deems the e-mail is a “record,” then (according to RIM) the employee should categorize it and place it in storage designated for that category.  If the employee does not deem it to be a “record,” it should soon be destroyed.

This advice is not working in practice.  A GAO study of senior federal government administrators found that many are not following the advice.  The nonconformists are just keeping all their e-mail – in good part because they believe that is the easiest way to avoid breaking law that requires the retention of records.  

But the nonconformist administrators are keeping the records in e-mail systems (like Groupwise or Microsoft Exchange) that are not designed for long-term storage.  

Conventional advice says these nonconformists either must work harder on sorting through their e-mail (spend more tedious hours in the office), or must hire someone to sort through it for them (incur higher labor costs).

The rationales behind conventional advice:

1. Storage is expensive, so we don’t want to keep more e-mail than necessary.
2. If you don’t put each e-mail into its category, you can’t find what you need when you need it.
3. If you store too many e-mails, it is too costly to search when you go looking for something.

 

Six Reasons Conventional Wisdom is Out of Date

I humbly argue the conventional advice is out of date – especially with respect to the e-mail of important people like executives and senior administrators.  I offer six reasons.

First:  The cost of digital storage is plummeting.  It will continue to drop. 

Second:  The number of e-mails is growing; therefore, the labor costs in evaluating e-mails one-by-one grows.

Third:  Search technologies enable easy retrieval of digital information.  Keyword and other forms of computerized search are very sophisticated and are improving rapidly.  They outperform the old-fashioned process of having people find things by peering into the categories in which they are stored.

Fourth:  When people make records decisions, they can make mistakes.  They can destroy records that someone else (a judge, an auditor, a prosecutor (district attorney), a whistleblower, an inspector general, a FOIA lawyer, a political opponent, an attorney general with a search warrant) thinks they should keep.  Or they can place a record in the wrong category.

Ask 10 lawyers about whether any given e-mail is or is not a “record,” and if so which retention category (or categories) it belongs in, and you can get 10 different opinions.

Fifth:  Employees don’t want the risk of making records mistakes.  Nevada police (state equivalent to FBI) conducted a criminal investigation of its former state treasurer for destroying e-mails that some of his staff believed should be retained.  The ex-treasurer defended himself saying he was just cleaning out insignificant stuff (what he called “clutter”).  In other words, his defense was that he had evaluated the records, deemed them to be “non-records,” and decided to destroy them in accordance with conventional RIM advice.  

The investigation did not conclude that the ex-treasurer had mismanaged records.  Prosecutors never charged him with improper destruction of records, although they did indict him for other alleged crimes.  
Here’s another way to describe the ex-treasurer’s story: a government administrator had to defend himself from allegations about his decisions to destroy “non-record” e-mail, and his defense prevailed.  His decision to destroy "non-records" was correct.  Yet, to defend himself, he had to hire a lawyer, at his own expense, and endure the peril of an invasive interrogation of his records management performance.

Which government administrator wants to defend her records decisions in a criminal (or any other kind of) investigation?  If presented with this risk, wouldn’t the administrator just prefer to keep all the records?

Sixth:  Although ordinary e-mail systems like Groupwise and Microsoft Exchange are not designed for long-term e-mail retention, other technology is designed for that purpose.  I call the technology an e-mail archive appliance.  It makes search and long-term storage of e-mail more practical and economical.

The availability of an archive appliance does not necessarily mean that an enterprise should retain all employee e-mail indefinitely.  But it does suggest very generous retention of e-mail belonging to important people like top administrators.

--Benjamin Wright

Technical footnote:  The conventional “RIM” advice as I portray it in this blog derives from lawyers and legal analysis.  Although you hear RIM used in the records manager profession, I am not talking about the records management profession per se.  When I argue against the application of RIM to e-mail, I am talking about the legal analysis – from lawyers and their publications – that has given rise to the conventional RIM understanding for e-mail.  My disagreement is not with the records management profession.