Electronic Data Records Law | How to Win E-Discovery

Text Messages Wiped from BlackBerries

Lawsuit Evidence Erased from Personal & Corporate Cell Phones | Court Punishes | Business Policy

To spoliate means to destroy or conceal evidence that one has reason to believe will be needed in litigation.  If a court finds a litigant has spoliated evidence, such as records, then the court will impose penalties.

Courts have punished many organizations for failing to keep electronic mail records.  Logically, the same punishment awaits organizations that fail to retain executive text

and instant messages, but to support that proposition I’ve not been able to cite a case.  Now I can cite Southeastern Mechanical Services, Inc. v. Brody, 2009 WL 2883057 (M.D. Fla. Aug. 31, 2009).

In a trade secret lawsuit, the court had ordered several employees of the defendant to surrender their BlackBerries to forensic experts for investigation.  (Two of the BlackBerries belonged to the corporate defendant; one was the personal property of the employee.)  But when the experts received the BlackBerries, the devices were devoid of data – no text message records, no calendar items, no call history, nothing.  The court knew that the employees regularly used the devices for more than just telephone calls. 

The defendant argued there was no spoliation because the devices were configured so that all electronic mails would be copied and preserved in the defendant’s corporate e-mail server.  Yet the court was highly suspicious. What about text messages?  Those were not copied to the e-mail server.  Why were all of the devices wiped clean? 

The court concluded that the defendant and/or its employees had intentionally destroyed records such as text messages on the smart-phones.  As punishment the court dealt the defendant a strategic disadvantage in the lawsuit, in the form an adverse inference for the jury later in the lawsuit.  (In other words, as the jury is empaneled, it will be informed that the defendant had mishandled important records, which could be taken as a strike against the defendant.)

Lesson:  As a matter of policy, an enterprise is wise to preserve the business text and instant messages (IM) of its employees – especially executives, managers and professionals -- just as it does email.  A text message can be legal evidence just as an email can be.

The phones in this case were BlackBerries.  It seems the outcome would have been the same were the phones, Androids, iPhones (which now supports MMS) or some other form of PDA.  Eventually, we'll see cases dealing with record retention/destruction for MMS (multimedia messaging service).  Soon thereafter the cases will address high definition (HD) videoconferencing, also known as telepresence.

Update:  A policy workshop I led created some language for enterprise policy on recording text, Facebook and other "unconventional" electronic business messages.

Another Update: Modern smartphones like the HTC One allow the user to back text messages up to an email account, like an enterprise account. Thus, when an executive sends or receives a legally significant text message, she can archive it in her enterprise email account.

–Benjamin Wright

Mr. Wright teaches eDiscovery and Data Security Law at the SANS Institute.

Destroy Backup Tapes, Obstruct Justice?

Canada | Politician Emails Lost?

Which employee wants to be the target of a criminal investigation into whether public record e-mails were wrongfully destroyed?  Observers of a political corruption lawsuit in British Columbia were shocked to learn that – while the well-known lawsuit was pending – IT employees destroyed backup tapes  containing key e-mails by executives (i.e., government officials negotiating the sale of the then-government enterprise, BC Rail).  

This kind of news sounds sensational in the press.  The public naturally wonders what the justification was for erasing records.  How much does it cost, citizens ask, just to retain some tapes a few more years?  Did someone apply a record destruction policy as a convenient way to eliminate embarrassing evidence?  Should the employees not have observed a "legal hold" (also known as "litigation hold") on the records?

Such destruction of records, during an on-going prosecution, could be grounds for a criminal investigation into obstruction of justice, said a local expert quoted in the BC news media.

Such destruction of records may also qualify as spoliation, worthy of sanctions by a court.

Easy to Write Policy | Hard to Follow

In the field of records management, it is easy to write a policy that says an enterprise will destroy records like email regularly, but will apply a "legal hold" when a lawsuit or investigation arises.  However, in practice, to institute a legal hold is hard.  It is hard for the responsible employees to understand when and where they need to apply a litigation hold. 

Consider this issue from the perspective of employees in government agencies or other large enterprises.  They don’t want to do anything illegal.  But for an employee to stay fully informed of all pending lawsuits and investigations (even well-known ones) can be very difficult in practice.  Many employees who have control over email records do not know all of the matters to which they many pertain.

Safer Course

From the perspective of employees, the safer course of action is to retain electronic records of executives generously, for a long time.  Modern technology is causing the cost of email retention to drop. To retain a lot of e-mail is not as expensive as retaining a lot paper holding the same content.

–Benjamin Wright

Mr. Wright teaches e-records management and cyber investigations law at the SANS Institute.

Risk Mitigation | Email Archive

Evidence | Tort Lawsuit Defense

Insurance | Hidden Cameras | E-Messages

Law and politics give institutions incentive to collect and archive plentiful records.  The best way to maintain plentiful records in practice is to archive email.

Records are evidence of due diligence and responsible corporate behavior.  In the past, records were expensive to keep and manage. But costs are plummeting as information technology advances.

A case in point:  The use of a taser in police work is controversial because, legally speaking, officers should use it only when circumstances warrant.  But proving, after-the-fact, what the circumstances were can be difficult. So the company that makes tasers sees an opportunity.  Recognizing that the cost of gathering and storing video evidence is declining, the company has developed a video camera for police officers to wear while on duty. The camera will capture trainloads of data.  The company has further developed a technology for economically storing and managing that data. Veronica Dagher, “New Taser 'Shoots' Evidence,” Wall St. J., Sept. 2, 2009.

Update:  A police officer in Fort Smith, Arkansas, was wearing a video camera when he fatally shot a gunman, November 2009.  The police department released the video record to local media.  The local prosecutor investigated the shooting, and part of the investigation included review of the video record.  The prosecutor concluded that the officer acted lawfully, as he had ordered he gunman nine times to drop the gun he was pointing at officers.


Insurance

For an enterprise like a police department or a doctors' office, greater quantities of records can mean reduced risk of liability for negligence (tort).  Good records support a defendant’s position that its people exercised due care and it therefore is not liable.

For physicians, lawyers and other professionals, classic advice for the avoidance of malpractice claims is to make and retain thorough records of services performed.


Hidden Cameras

In this technological age, hidden cameras and surprise evidence are becoming more common.  They can embarrass an organization, as they did ACORN, a high-profile advocacy group for the poor.

Yet, surprise evidence may evaporate if the organization maintains its own detailed records that counteract the surprise.  Example: In the famous murder prosecution of Carolyn Warmus, a key issue was whether she placed a phone call to a gun shop.  At trial, her defense team produced “surprise evidence” – an original telephone bill – showing she did not make the call.  But the evidence backfired because the prosecution established that the “original” bill was in fact a forgery.  It did so by drawing on secure computer records at the telephone company and testimony from a telephone company employee.


Electronic Message Archival

The electronic records in an enterprise such as a government agency are often in diverse formats and locations, which makes long-term retention and management difficult.  The enterprise therefore has incentive to emphasize the archiving of electronic messages such as e-mail. Three reasons:

1. Electronic messages represent a detailed, time-stamped diary of many of the day-to-day activities and intentions of the executives and staff at the enterprise.

2. The IT industry has fielded numerous, competitive products for archival of enterprise electronic messages.  Good archive products support economical retention and rigorous searching of records.  Good archival includes storage of records in a non-proprietary format like XML.

3. If electronic messages are the focal point for record archiving, then the enterprise can direct employees to use electronic messages generously as the journal of their activities.  Journaling can include attaching to email documents like spreadsheets or (short) videos.

–Benjamin Wright

Mr. Wright teaches the law of data security and investigations at the SANS Institute.