Electronic Data Records Law | How to Win E-Discovery

Text Messages Wiped from BlackBerries

Lawsuit Evidence Erased from Personal & Corporate Cell Phones | Court Punishes | Business Policy

To spoliate means to destroy or conceal evidence that one has reason to believe will be needed in litigation.  If a court finds a litigant has spoliated evidence, such as records, then the court will impose penalties.

Courts have punished many organizations for failing to keep electronic mail records.  Logically, the same punishment awaits organizations that fail to retain executive text

and instant messages, but to support that proposition I’ve not been able to cite a case.  Now I can cite Southeastern Mechanical Services, Inc. v. Brody, 2009 WL 2883057 (M.D. Fla. Aug. 31, 2009).

In a trade secret lawsuit, the court had ordered several employees of the defendant to surrender their BlackBerries to forensic experts for investigation.  (Two of the BlackBerries belonged to the corporate defendant; one was the personal property of the employee.)  But when the experts received the BlackBerries, the devices were devoid of data – no text message records, no calendar items, no call history, nothing.  The court knew that the employees regularly used the devices for more than just telephone calls. 

The defendant argued there was no spoliation because the devices were configured so that all electronic mails would be copied and preserved in the defendant’s corporate e-mail server.  Yet the court was highly suspicious. What about text messages?  Those were not copied to the e-mail server.  Why were all of the devices wiped clean? 

The court concluded that the defendant and/or its employees had intentionally destroyed records such as text messages on the smart-phones.  As punishment the court dealt the defendant a strategic disadvantage in the lawsuit, in the form an adverse inference for the jury later in the lawsuit.  (In other words, as the jury is empaneled, it will be informed that the defendant had mishandled important records, which could be taken as a strike against the defendant.)

Lesson:  As a matter of policy, an enterprise is wise to preserve the business text and instant messages (IM) of its employees – especially executives, managers and professionals -- just as it does email.  A text message can be legal evidence just as an email can be.

The phones in this case were BlackBerries.  It seems the outcome would have been the same were the phones, Androids, iPhones (which now supports MMS) or some other form of PDA.  Eventually, we'll see cases dealing with record retention/destruction for MMS (multimedia messaging service).  Soon thereafter the cases will address high definition (HD) videoconferencing, also known as telepresence.

Update:  A policy workshop I led created some language for enterprise policy on recording text, Facebook and other "unconventional" electronic business messages.

Another Update: Modern smartphones like the HTC One allow the user to back text messages up to an email account, like an enterprise account. Thus, when an executive sends or receives a legally significant text message, she can archive it in her enterprise email account.

–Benjamin Wright

Mr. Wright teaches eDiscovery and Data Security Law at the SANS Institute.

Text Email Home PC - BlackBerry - iPhone - Cell Phone

Discovery in Business Lawsuit?

How far will the law will go to get the e-mails, text message records, that are relevant to a legal inquiry like a lawsuit?

An eye-opening Canadian case is CIBC World Markets Inc. v. Genuity Capital Markets, [2005] O.J. No. 614 (S.C.J) (QL).

CIBC sued Genuity, alleging it had stolen trade secrets from CIBC.  When a lawsuit like this is filed, the parties are expected to apply a litigation hold to ensure no records are destroyed.  But a litigation hold is hard to implement if a litigant is not causing copies of all business e-mails to be stored in a central archive.  Furthermore, if the litigant is not storing copies of all its employees’ messages, then it may be forced to canvass their home computers.
 
In the CIBC case, the court permitted forensics experts to go to great lengths and expense to locate e-mail.  They were granted access to all PCs, BlackBerries (smart mobile phones) and similar devices under the influence of the Genuity's employees, including devices at home (like iPods, iPhones or Androids) and belonging to spouses and children!  (In an investigation like this, imagine what goes through the mind of an employee who might have been involved in any kind of marital strife or infidelity.)

The lesson from the case is that enterprises are wise to keep extensive, centrally-managed archives of all business-related e-mail (including webmail, SMS, MMS [multimedia message service], text messages and instant messages) by employees and other personnel.  That way they avoid the expense and hassle associated with searches of home computers and other personal gadgets.

This topic grows more important as informal electronic contracting, such as trading in OTC derivatives, attracts greater scrutiny, regulation, litigation and investigations.

–Benjamin Wright

Click Here

 

Mr. Wright teaches electronic data and records law at the SANS Institute.

Email Retention | Public Audit & Administration

German Laws, Orders, Regulations and Instructions

Affinity with Local (County) US Government

What does the law expect of electronic government records?   Records enable governments to be transparent.  If government keeps good records of its activities and gives citizens easy access to them, then citizens can review government and hold it accountable.

Today most government records are electronic.  Accordingly, the German federal government seeks to archive its electronic records, including e-mail.  A key initiative under the Federal Ministry of the Interior is DOMEA, a project that sheds light on the legal expectations for e-government records, including electronic mail. 

The DOMEA project recognizes that: “Electronic records . . . have to meet the requirements for record keeping in public administrations, which are prescribed in laws, standing orders, regulations  and instructions.  They include important points, such as: 

“1. The completeness, integrity and authenticity of official records, which means that official documents cannot be subsequently altered, changed, removed, destroyed or deleted. 

“2. The records principle of public administration, which means that documents have to be appropriately joined together in systematically arranged subject files according to the functions of a particular office. 

“3. The accountability and lawfulness of administrative procedures, which means that accountabilities and responsibilities have to be documented in records in the course of business and that the state of affairs and the development of transactions in a given case has to be completely evident in records at any time.”

Of course, the validity of these legal standards is not limited to Germany or even Europe.

If these are the legal standards for government records, then query whether popular enterprise e-mail systems such as Microsoft Exchange and Novell Groupwise are designed to meet these standards. Generally speaking, they are not.  They do not support efficient storage, management, protection and searching of vast quantities of e-mail records, collected from a large population of users over an extended period of time.  That’s one reason enterprises like governments commonly have policies to destroy most e-mail relatively quickly, such as 90 days after transmission.

But e-mail has become central to the administration of modern government.  Very often, e-mail documents official transactions and official delegations of responsibility.  It also empowers internal audits and investigations (by for example inspectors general) for fraud, waste, corruption, mismangement and misappropriation of funds.  

For some time organizations such as governments have relied on ad hoc methods for retaining e-mail – including the print-and-file method.  But e-mail is so voluminous and has become so important that ad hoc solutions are failing.  

Last week I led an on-site workshop with the staff of a mid-size county government struggling with this problem. Staff representatives hailed from IT, counsel, finance, administration, internal audit, human resources, risk management and public health services.  The county’s e-mail system is Groupwise.  The staff concluded that the county needs, in addition to Groupwise, a dedicated e-mail archive appliance. The workshop enabled the staff to write new, modern policy on e-mail archival.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigation law at the SANS Institute.

He is an advisor to Messaging Architects, where he leads an in-house workshop to help the stakeholders in an enterprise craft workable policy on the management of email and other eRecords.

P.S.  New Mexico's Attorney General (AG) indicted the state's former Secretary of State (SoS) for tax evasion and money laundering tied to alleged kickbacks to her by the recipient of federal grant money.  Stephanie Simon, "New Mexico Roiled by New Graft Case," Wall Street Journal, August 22 -23, 2009.  Among other things, the indictment alleged that the defendant advanced her crime by fabricating two official records in 2004 -- a paper letter and a paper memo.  The indictment came on the heels of thorough document reviews by both federal and state auditors.  The auditors said the Secretary of State's office maintained poor records on its management of federal grant money.  Email records (which are very hard to forge or spoof successfully) were sparse if non-existent.  Furthermore, the Secretary of State's office says it keeps financial records only three years after the close of the fiscal year.  Now, the AG and the ex-SoS disagree sharply over the allegations.  Had the SoS's office maintained more detailed and complete records (including archived email, supported by time-stamps and other audit trails), this disagreement might now be resolved.  Either (a) the ex-SoS would have been deterred at the outset from corruption for fear that the records would betray her, (b) the records would clearly exonerate the ex-SoS, or (c) the records would unambiguously demonstrate the ex-SoS's guilt.

Email Deleted | England

Restoring Network Backup Tapes

A landmark case in England teaches that lessons in the US on e-mail retention and destruction policy are equally applicable in the United Kingdom. The lessons: 1. Early deletion of e-mail can cost a company later in litigation. 2. The law is giving all organizations incentive to generously retain e-mail in a centralized archival system.  (This incentive would even extend to webmail that employees use for business purposes.)

Digicel et al v. Cable & Wireless, et al [2008] EWHC 2522 (Ch) was a commercial dispute between telecommunications providers in the Caribbean (including St Lucia, St Vincent and the Grenadines, Grenada, Barbados, The Cayman Islands, Trinidad and Tobago, and The Turks and Caicos Islands).

Digicel claimed C&W unlawfully failed to connect Digicel to C&W’s network. Digicel sued in English court. Under the Civil Procedure Rules (applicable in England and Wales), Digicel sought from C&W “disclosure”of e-mail of seven former employees. (In the US we use the word “discovery” rather than disclosure.)

Said the British court: "The 7 individuals are former employees of a [C&W] Defendant company. The e-mail accounts of those former employees were deleted [purged] from the relevant server following the ending of their employment. However, it may be the case that some or all of the individual's e-mail accounts exist on the back-up tapes."

The court's logic illuminates why I argue against the practice of destroying employee e-mail upon termination of employment (aka dismissal). E-mail records of ex-employees are assets of the employer that the employer is often wise to keep.  

To search for particular e-mails by way of corporate backup tapes is expensive and tedious. C&W argued that this effort was not legally justified.

The UK court evaluated whether to order searching (restoration) of C&W’s backup tapes. For guidance, it looked to experience in other countries, such as the law of e-discovery in the US. 

The court decided to order extensive restoration of back-up tapes.  

The court noted that some foreign (such as US) judicial decisions have shifted some of the cost of e-disclosure (e-discovery) to the requesting party (Digicel). The court said it would postpone until later the question whether Digicel should bear any of the costs.

The court’s approach was remarkably consistent with the US approach (citing US authorities), where courts have taught us more about e-discovery and electronically stored information (ESI). 

–Benjamin Wright

Mr. Wright is an consultant to messagingarchitects.com, leader in sound process for eDisclosure and Groupwise archival.  Mr. Wright and Messaging Architects have teamed to educate professionals about eDiscovery.   Mr. Wright is also a senior instructor at the SANS Institute, where he teaches the modern law of internal investigations and enterprise data policies.

EMail Evidence | Criminal Defense

Should Corporate Executives Prefer Early Deletion of E-Records?

Some executives fear that e-mail will come back to haunt them, so they minimize their use of it.  And they want corporate e-mail destroyed quickly.  

But electronic records came to the rescue of David Stockman, former CEO of bankrupt auto parts maker Collins & Aikman.  Stockman and other executives were indicted by prosecutors for alleged lying about the company’s financial condition.  Prosecutors apparently based the charges on an investigation by an outside law firm working on behalf the company’s board of directors.  Stockman and his co-defendants maintained that they were victims of a rush to justice.  They said the law firm and the prosecutors failed to examine all the complex evidence carefully. 

They and the government undertook to assemble a database containing 10 million company records, including (no doubt) copious e-mail records.  Key topics in the case included C&A's:

*  day-to-day internal communications among executives and employees regarding the accounting and invoicing for particular transactions, and 

* day-to-day communications with suppliers -- involving innumerable, detailed, nitty-gritty negotiations and documentation over topics like transaction-by-transaction rebates.

From this massive database, the defendants drew evidence, bit-by-tiny-bit, to tell their side of the story.   In a database of this size, the ability to find the right evidence depends much on the careful selection of search methodology and search algorithms.  Sometimes the only effective way to comprehend what is in the database is to engage a selective sampling of records.

Eventually the defense prevailed.  In an unusual move, the prosecutors withdrew the charges, stating that they had come to reassess the evidence in the case.  

In other words, the executives were fortunate that the company retained so many records like e-mail.  E-archives exonerated the defendants.

In a putative corporate scandal, the relevant e-mail records can be maddeningly plentiful.  A large number of computer-based records is unsurprising in a modern white collar crime investigation or police raid of corporate offices.

In this case, the defendants' legal team patiently mined the company’s email (and other records) to build a convincing case that prosecution was unwarranted.

As the quantity of records in a case swells like this, the ability of parties to review records one-by-one declines.  Increasingly the law will favor those who can draw on statistical methods (or linguistic analysis) to tease out the evidence that tells their side of the case.

(David Stockman is most famous as the Ronald Reagan’s budget director in the 1980s.)

–-Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in enterprise governance and records management.  He also delivers training in cyber defense law at the SANS Institute.