Electronic Data Records Law | How to Win E-Discovery

Court Judges Corporation’s Record Retention-Destruction Routine

Phillip M. Adams & Associates v. Dell Inc.

Corporate record retention policies are taking a beating in court.

Conventional policy instructs employees to look at records on a one-by-one basis and decide according to rational standards what to keep and what to destroy.  Conventional policy further provides that when litigation arises, then a legal hold is applied – that is, record destruction is suspended and relevant records are retained.  Classic records and information management (RIM) theory holds that if a corporation follows such a conventional policy, then the corporation should not be penalized in litigation for improper destruction of records.

But the theory is not holding up.  Over the past decade, legal authorities have looked askance at record destruction policies.

At an emotional level, the attitude of authorities is, “What?  You’re telling me, big enterprise, that you don’t have any records on the topic of this lawsuit because you told your employees to destroy records (or you set up your system to destroy records automatically unless employees undertake arduous steps to preserve them)?  Explain that to me.  What is the urgency to destroy records in this digital age?   Maybe when records were paper an enterprise needed to rid itself of documents that occupy a lot of real estate and are hard to search.  But e-mail archives do not take up much physical space, and they are amenable to automated search.  I have a pointed question for you, big enterprise:  Did you as a matter of policy winnow down the number of your records so that you could achieve a general advantage in lawsuits?”

The legal system is unhappy with an enterprise that destroys records for the purpose of positioning itself for future litigation, even litigation that is not specifically anticipated.  The system calls that behavior spoliation.

Phillip M. Adams & Associates v. Dell Inc. is a striking case.  It sanctioned a company for destroying records for some years before the lawsuit was filed or specifically threatened.  In accordance with the company's policy, employees (including an engineer or two) destroyed records, or they refrained from preserving records as the company's computer systems destroyed them.

Storage space was limited on the company's central e-mail servers.  Servers overwrote (erased-purged) e-mail relatively quickly unless employees made special efforts to preserve them.

Although the company's policy was not fully expressed as a formal, unified document, the court was able to ascertain what the policy was from the company's deliberate practices and their effect.  Said the court, "“[The company's] practices  . . . tend toward loss of data. The practices place operations-level employees in the position of deciding what information is relevant to the enterprise and its data retention needs."

Effectively, the company's policy is what I've termed on this blog the make-a-decision style of records management, where individual employees are supposed to decide what records to keep and what to destroy.

The court essentially felt the policy was unreasonable.

Some commentators think the court made a bad decision because it runs counter to common business practice.  They speculate the court suspected bad faith on the company's part, but couldn’t specifically cite evidence to support that suspicion.

Regardless of whether the court was right or wrong, the case is consistent with a trend in 21st century law:  the legal system is distrustful of early or aggressive record destruction.  The legal system is providing enterprises a growing basket of incentives to be more generous in retaining records, especially email.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigations law at the SANS Institute.

Electronic Mail Message Forged

Electronic Evidence | Forensics and Authentication in Police Investigation

For responsible parties like corporations and government agencies, a reason to retain all their e-mail, text and instant message records is to refute forgeries of e-records.  Thorough email archives (including each attachment) provide forensic evidence to invalidate false claims.

Just ask Australia’s prime minister, Kevin Rudd.  His political opponents tried to embarrass him with an electronic mail record purportedly from his senior advisor Andrew Charlton.  The e-mail appeared to show corruption; it appeared to show Rudd’s government conferring a business advantage to Rudd’s friend John Grant.

But fortunately for the government, it retained its own e-mail records for the time in question.  An investigation revealed that the scandalous e-mail was a forgery!

The investigation proceeded in two steps. First it examined the alleged sender’s digital records.  “Searches by the Department of Prime Minister and Cabinet and Treasury of Dr Charlton's computer and the system of the public service had found nothing.  ‘There have been exhaustive searches conducted on Dr Charlton's computer email system and no such correspondence can be found,’ Mr Rudd said.”

Second, the Australian Federal Police (equivalent to FBI) conducted a forensic analysis of two computers used by the purported receiver of the e-mail.  "Preliminary results of those forensic examinations indicate that the email referred to at the centre of this investigation has been created by a person or persons other than the purported author of the email," said the AFP.

This revelation of course played to the Prime Minister’s distinct advantage.  He could show that his adversaries had based their attack on misrepresented facts.

The Strategy Lesson:  Unless you are a criminal, your e-records are your friend.  Had the government been destroying its records quickly, it would not have been so capable of exposing this fraud.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader on ESI investigations.

US Interior Dept. Destroys Email

Printing of Electronic Mail as Federal Government Record Retention?

The Bureau of Indian Affairs (US Department of the Interior) suffered embarrassment in court for the deletion of financial e-mails by former Assistant Secretary – Indian Affairs, Neal McCaleb.  The e-mails contained important information about money the bureau was collecting and holding in trust for Indian tribes. McCaleb deleted the e-mails because his IT department allocated him too little hard disk space. Under department policy, he was expected to print important e-mails onto paper before he deleted them, but because of confusion about who was authorized and directed to do the printing, no one actually performed the tedious and unwanted task.

Officials like Mr. McCaleb don't naturally embrace clerical duties like printing of e-mails.

The case demonstrates  

1. how legally important e-mail records can be,

2. the folly of an IT department trying to save a couple of bucks by being stingy with hard disk space, and

3. how dangerous it is today to view printing as a way to preserve email (or text messages) need for purposes of internal control or funds management.

See Jean Pagano, “Special Master reports findings on deleted e-mails: Department of Interior described as ‘chaotic’,” Native American Press/Ojibwe News, January 31, 2003. This matter was part of the protracted “Cobell” litigation brought by Native Americans against the Department of the Interior. Cobell v. Norton, et al. Case No. 1:96CV01285 (D.D.C.).

–Benjamin Wright

Electronic Mail Keep-Destruction Practice

Storage and Search Costs for Electronic Mail Archival

More Retention of Public Administrator E-mail?

Conventional records and information management (RIM) advice holds that each e-mail in an enterprise must be evaluated one-by-one.  Presumably, this evaluation must be performed by an employee because software isn’t up to the task.  If the employee deems the e-mail is a “record,” then (according to RIM) the employee should categorize it and place it in storage designated for that category.  If the employee does not deem it to be a “record,” it should soon be destroyed.

This advice is not working in practice.  A GAO study of senior federal government administrators found that many are not following the advice.  The nonconformists are just keeping all their e-mail – in good part because they believe that is the easiest way to avoid breaking law that requires the retention of records.  

But the nonconformist administrators are keeping the records in e-mail systems (like Groupwise or Microsoft Exchange) that are not designed for long-term storage.  

Conventional advice says these nonconformists either must work harder on sorting through their e-mail (spend more tedious hours in the office), or must hire someone to sort through it for them (incur higher labor costs).

The rationales behind conventional advice:

1. Storage is expensive, so we don’t want to keep more e-mail than necessary.
2. If you don’t put each e-mail into its category, you can’t find what you need when you need it.
3. If you store too many e-mails, it is too costly to search when you go looking for something.

 

Six Reasons Conventional Wisdom is Out of Date

I humbly argue the conventional advice is out of date – especially with respect to the e-mail of important people like executives and senior administrators.  I offer six reasons.

First:  The cost of digital storage is plummeting.  It will continue to drop. 

Second:  The number of e-mails is growing; therefore, the labor costs in evaluating e-mails one-by-one grows.

Third:  Search technologies enable easy retrieval of digital information.  Keyword and other forms of computerized search are very sophisticated and are improving rapidly.  They outperform the old-fashioned process of having people find things by peering into the categories in which they are stored.

Fourth:  When people make records decisions, they can make mistakes.  They can destroy records that someone else (a judge, an auditor, a prosecutor (district attorney), a whistleblower, an inspector general, a FOIA lawyer, a political opponent, an attorney general with a search warrant) thinks they should keep.  Or they can place a record in the wrong category.

Ask 10 lawyers about whether any given e-mail is or is not a “record,” and if so which retention category (or categories) it belongs in, and you can get 10 different opinions.

Fifth:  Employees don’t want the risk of making records mistakes.  Nevada police (state equivalent to FBI) conducted a criminal investigation of its former state treasurer for destroying e-mails that some of his staff believed should be retained.  The ex-treasurer defended himself saying he was just cleaning out insignificant stuff (what he called “clutter”).  In other words, his defense was that he had evaluated the records, deemed them to be “non-records,” and decided to destroy them in accordance with conventional RIM advice.  

The investigation did not conclude that the ex-treasurer had mismanaged records.  Prosecutors never charged him with improper destruction of records, although they did indict him for other alleged crimes.  
Here’s another way to describe the ex-treasurer’s story: a government administrator had to defend himself from allegations about his decisions to destroy “non-record” e-mail, and his defense prevailed.  His decision to destroy "non-records" was correct.  Yet, to defend himself, he had to hire a lawyer, at his own expense, and endure the peril of an invasive interrogation of his records management performance.

Which government administrator wants to defend her records decisions in a criminal (or any other kind of) investigation?  If presented with this risk, wouldn’t the administrator just prefer to keep all the records?

Sixth:  Although ordinary e-mail systems like Groupwise and Microsoft Exchange are not designed for long-term e-mail retention, other technology is designed for that purpose.  I call the technology an e-mail archive appliance.  It makes search and long-term storage of e-mail more practical and economical.

The availability of an archive appliance does not necessarily mean that an enterprise should retain all employee e-mail indefinitely.  But it does suggest very generous retention of e-mail belonging to important people like top administrators.

--Benjamin Wright

Technical footnote:  The conventional “RIM” advice as I portray it in this blog derives from lawyers and legal analysis.  Although you hear RIM used in the records manager profession, I am not talking about the records management profession per se.  When I argue against the application of RIM to e-mail, I am talking about the legal analysis – from lawyers and their publications – that has given rise to the conventional RIM understanding for e-mail.  My disagreement is not with the records management profession. 

Recordkeeping for Social Networking Managers

Social Networks for Official, Commercial & Employment Transactions

By law, employers generally need to keep records of employment decisions.  So when the boss conveys a pink slip by way of Facebook, the employer needs a legal record of it.

What?  Fire someone by Facebook . . . a posting on a wall?  Would a manager do that?  Yes.  A spa in Canada (British Columbia) used Facebook to notify Crystal Bell of her job termination.

The history of electronic messaging tells a story about business records.  As each new form of message comes along, we initially doubt you can conduct business with such a flimsy thing.  Fax as a medium for transacting serious business?  No way, people thought in the early 1980s.  But as time passed –- and as court cases enforced fax contracts -- we grew more comfortable with fax as a business tool.  Today, fax is considered a responsible, even conservative medium for transmitting signed agreements and binding business records. 

Then, when electronic mail came into the workplace, conventional wisdom dismissed it.  Convention said e-mail was not a business record, said it could not (conveniently) be authenticated with a signature, and said it should be deleted quickly like so much water-cooler chitchat.  But naturally business people embraced e-mail as a tool for making obligations and delegating authority.  Today we see the law giving enterprises growing reason to store e-mail as business records.

I predict the same process will unfold for collaborative (Web 2.0 and social network) media like instant message, Facebook, Twitter and Myspace.  Old-fashioned folks will try to ban these technologies as methods for conducting important business.  They will, initially, ignore them as records to be kept.

But the outcome of the story is inevitable.  Busy people (like the boss in BC) will use the new channels to hire, fire, negotiate, agree and so on.

The managers of records need to plan for capturing the records of Web 2.0.  Those records can become the subject of a subpoena, an IRS taxpayer audit, an administrative summons or an internal investigation or the source of exculpatory evidence in defense of lawsuits.