Electronic Data Records Law | How to Win E-Discovery

International E-mail Deletion

Computer Spoliation in Asia

Electronic discovery (EDD*) and the destruction of digital evidence are global issues, affecting more than just North America.  Throughout the world, electronic records are ubiquitous, and mushrooming in volume.  Any law enforcement investigation in the world – whether a lawsuit, a tax audit, a police inquiry, an arbitration proceeding,
a legislative hearing, an administrative probe or a government inspection – is likely today to seek access to electronic records (email, databases, flash drives, text messages, facebook posts, youtube videos, digital photographs, laptop hard drives, and more).

Naturally, to thwart an investigation, an unscrupulous holder of e-records (ESI) wants to destroy them.  In the US, we call that destruction “spoliation” or “obstruction of justice.”  Other jurisdictions may use different words for unlawful destruction of evidence, but the general concept of law must be universal.  If law enforcement is to function, it must forbid and punish wrongful destruction of electronic evidence.

Many of the leading cases punishing the destruction of computer evidence are American, and to a lesser extent Canadian.  But cases are emerging in other countries.  . . .
One such case before the Singapore High Court is K Solutions Pte Ltd v. National University of Singapore [2009] SGHC 143.  This lawsuit was a contract dispute involving IT services provided by K Solutions (KS) to a university.  Under the rules of discovery in the lawsuit, the university sought from KS certain email records, in addition to audio recordings of meetings between KS and university staff.

The court noted that Singapore rules of procedure (Order 24 rule 16(1) of the Rules of Court) require a litigant like KS to disclose relevant records to its adversary, the university.  Evidence in this case showed that KS had possessed numerous relevant electronic mail records and audio recordings, which it had not released to the university.  Although KS explained that some email records had been destroyed innocently under its policy of retaining e-mail only six months, the court was suspicious.  The court believed KS’s email destruction policy should have been suspended because KS knew that litigation was likely.  (In other words, using American parlance, KS should have applied a “litigation hold” on the email.)

The court observed that although the rules of procedure do not explicitly forbid a party from destroying records, the rules imply that records should be preserved when litigation is pending or anticipated and that wrongful destruction should be punished. 

As the court considered KS’s deletion of email, it noted that KS, during the course of the lawsuit, had also been evasive and untruthful about its records.  The court levied severe sanctions against KS, effectively granting judgment against it in favor of the university.

Analysis:  From the perspective of any enterprise such as a business, law punishing the destruction of evidence is dangerous.  Digital records are destroyed constantly, in the ordinary course of operations. But the law may punish destruction if a legal authority concludes the destruction should have been avoided.  In any investigation the authority looks backwards and second-guesses what the defendant did in the past.  Retrospection is always how investigations like lawsuits or tax appraisals work.  With the benefit of hindsight, an action (or omission) of records management that seemed innocent to the defendant at the time can appear sinister later.   All enterprises (US and non-US) therefore need margin for error.  The law gives them incentive to be more generous in retaining computer records, especially electronic mail.  And the law gives incentive to keep email of important people much longer than six months.

–Benjamin Wright

Mr. Wright serves as a public speaker on e-discovery, e-records management and IT security law.  He speaks to professionals groups like Institute of Internal Auditors and SANS Institute.

*What is EDD?  Electronic Data Discovery is a relatively new legal term of art.  It refers to the process of finding, managing and disclosing electronic records (whether on a tape, a PC, an iPod, a cell phone or whatever device) as required in a lawsuit or legal investigation, such as a regulatory audit.

Treat Electronic Records the Same as Paper Records?

In-house Local Government Counsel Sanctioned for Spoliation

Courts seem more assertive in punishing electronic spoliation than they historically were in punishing the spoliation of paper documents.  Many veteran lawyers will be astonished to hear that a federal judge sanctioned an in-house government lawyer for taking something less than vigorous steps to cause and monitor the preservation of electronic evidence.

Prior to filing a negligence lawsuit against a county sheriff’s department (Swofford v. Eslinger), the plaintiff demanded by letter that all evidence including electronic records be preserved.  General counsel for the Seminole County (Florida) Sheriff's Department, David Lane, forwarded a copy of the letter to six senior officials in the department.  Still, the department subsequently destroyed relevant e-mail records and wiped the hard drives of relevant laptops.  

The judge was highly suspicious. On her own initiative she called the in-house lawyer as a witness in a hearing on the question of spoliation.  Citing the famous Zubulake case, the judge concluded that the lawyer had defaulted on his duty to ensure that electronically stored information (ESI) was preserved.  The judge specifically opined that in a case like this counsel needs consult with IT staff about preserving ESI.  The judge imposed a monetary fine on Mr. Lane personally, the amount of which is to be determined.  (See The Pension Committee of the University of Montreal Pension Plan, et al. v. Banc of America Securities for more on a lawyer's professional duty regarding the preservation of e-records and subsequent search through them.)

The judge is saying that modern counsel must understand how ephemeral ESI is and how vigilant counsel (as an officer of the court) must be to preserve it under a litigation hold.

I don’t know how much annual salary counsel to a Florida county sheriff's department makes, but I'll bet the man is not getting rich on his salary.  The imposition of monetary sanctions on him makes quite a statement.  It is unclear whether malpractice insurance would cover this fine.

A different lawyer at a government agency recently asked me why the record retention policy for e-mail should be different from the policy for paper documents with the same content.  I believe electronic records behave differently from equivalent paper records.  They must be managed differently.  What's more, this Swofford case reinforces my impression that courts are treating electronic records differently.  It reinforces my argument that today the law gives all enterprises heightened incentive to retain email generously.  No employee of a government agency, whether counsel or otherwise, wants the risk of being held accountable for premature destruction of email. 

–Benjamin Wright

Mr. Wright is senior instructor at the SANS Institute, where he teaches a 5-day bootcamp on the law of e-records, cyber defense and computer investigations.

Electronic Mail Message Forged

Electronic Evidence | Forensics and Authentication in Police Investigation

For responsible parties like corporations and government agencies, a reason to retain all their e-mail, text and instant message records is to refute forgeries of e-records.  Thorough email archives (including each attachment) provide forensic evidence to invalidate false claims.

Just ask Australia’s prime minister, Kevin Rudd.  His political opponents tried to embarrass him with an electronic mail record purportedly from his senior advisor Andrew Charlton.  The e-mail appeared to show corruption; it appeared to show Rudd’s government conferring a business advantage to Rudd’s friend John Grant.

But fortunately for the government, it retained its own e-mail records for the time in question.  An investigation revealed that the scandalous e-mail was a forgery!

The investigation proceeded in two steps. First it examined the alleged sender’s digital records.  “Searches by the Department of Prime Minister and Cabinet and Treasury of Dr Charlton's computer and the system of the public service had found nothing.  ‘There have been exhaustive searches conducted on Dr Charlton's computer email system and no such correspondence can be found,’ Mr Rudd said.”

Second, the Australian Federal Police (equivalent to FBI) conducted a forensic analysis of two computers used by the purported receiver of the e-mail.  "Preliminary results of those forensic examinations indicate that the email referred to at the centre of this investigation has been created by a person or persons other than the purported author of the email," said the AFP.

This revelation of course played to the Prime Minister’s distinct advantage.  He could show that his adversaries had based their attack on misrepresented facts.

The Strategy Lesson:  Unless you are a criminal, your e-records are your friend.  Had the government been destroying its records quickly, it would not have been so capable of exposing this fraud.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader on ESI investigations.

Electronic Discovery Professional Duty

Falsehoods and Duty of Confidentiality

What is an e-forensics specialist to do when she discovers her client has been lying to her?  Typically this kind of computer specialist is hired to find, audit and report on electronically stored information (ESI).  If the specialist has been making representations to others -- such as a court, an internal investigator or an inspector general who has issued a subpoena, on the basis of what she now knows to be lies, she is in a bind.  Like any professional working for a client on a sensitive matter, the specialist will likely owe the client a duty of confidentiality.  Normally she will have signed a non-disclosure agreement. 

How to Preserve Reputation?

The specialist’s reputation is at stake. Obviously, to disassociate herself from misrepresentation, she can withdraw from the engagement.  But she fears that the third party will continue to rely on her representations, which are no longer well-founded. 

A practical technique available to this specialist is known as the noisy withdrawal.  Although noisy withdrawal is most commonly known from cases where lawyers learn that their clients have been lying to them, the technique is a responsible measure available any ethical professional.  

In a noisy withdrawal a professional announces that he is withdrawing from representation of his client. In addition (this is the noisy part) he declares to interested third parties that he disaffirms his prior statements made on behalf of the client.  With the noisy withdrawal, the professional aims to preserve his own credibility, without compromising the client’s secrets.  He does not reveal why he is withdrawing, why he is disclaiming prior statements or any information his client has told him.

Examples of Noisy Withdrawal

A recent example of a noisy withdrawal occurred in the investigation of Stanford Financial Group. Attorney Thomas Sjoblom had represented the firm before the Securities and Exchange Commission as it examined alleged fraud, corruption and irregularities.  But then he made a noisy withdrawal from the engagement.  Observers surmised that as the case progressed he had come to disbelieve what his client had been telling him. Kara Scannell, “Top Lawyer’s Withdrawal from Stanford Case Waves a Flag,” Wall Street Journal, Mar. 6, 2009.

Another famous example transpired in the Whitewater investigation during the Clinton presidential administration.  Legendary ethics expert Sam Dash made a noisy withdrawal when the Whitewater Independent Counsel wrongly gave the impression that Professor Dash endorsed the Counsel’s conduct.  (By the way, prior to this story, the late Sam Dash was my ethics professor in law school.  Over the long run, I hope Professor Dash’s teaching helps me stay out of trouble!)

–Benjamin Wright

Mr. Wright teaches cyber defense law at the SANS Institute, where he emphasizes the role of ethics and savvy public communications.

Employee ESI: Private?

Internal Investigations under Data Protection Legislation

Many countries have data privacy laws limiting the disclosure of personal information their citizens. Although the laws are far from uniform around the world, the European Data Protection Directive (95/46/EC) is a leading guide.

These laws motivate (multinational) corporations to configure controls into email (as well as webmail and text-instant-message) record retention systems.

The European Data Directive generally instructs European countries to enact local privacy legislation to regulate personal information. The legislation can apply to e-mail and other electronically stored information (ESI).  As a practical matter, the details on implementation and enforcement of local (non-US) privacy laws with respect to e-mail is a very complex topic.  Some local laws can frustrate internal corporate investigations that might appear, to US-based managers for example, as routine and responsible.  They can cause emails to be withheld from investigators.

One instance: In 2001 French courts held that a foreign-headquartered company violated the privacy rights of a French engineer when it inspected his e-mail records, stored on company computers.  The records revealed he was wrongfully moonlighting on company time.  Doreen Carvajal, “The Workplace: When bosses spy on workers,” International Herald Tribune, April 21, 2004 .

As corporations install appliances to store e-mail archives, they should consider whether to implement controls for compliance with local privacy statutes.  The controls might include

1. written policies calling for compliance with local law;

2. technical blocks to prevent unauthorized people or departments from accessing specific records, while granting access to those who have been authorized; and

3. alerts and audit trails to enable after-the-fact review of who accessed which records and when.

--Benjamin Wright

Mr. Wright is a consultant to Messaging Architects, develper of sound process for electronic mail record-keeping and investigation.