Electronic Data Records Law | How to Win E-Discovery

Whistleblowers Leak Secrets

Wikileaks.com for Accountability

If a public organization doesn't embrace transparency, transparency will be thrust upon it forcibly.  For any institution, its electronic records are so detailed and subject to revelation in so many ways that the institution must find a way to pre-empt their inopportune public disclosure.  Better to come clean with information now – before the lawsuit (think deposition) or the FOIA request or the hacker break-in brings the information to light.

The climate research unit at the University of East Anglia is learning directly how disconcerting unexpected disclosure can be.  
 Someone – whether an outside hacker spy or an inside whistleblower – has leaked volumes of e-mails, software, source code and programmer notes to the world.  As a world leader on climate modeling, the university is shocked to see its internal discussions hung out for public scrutiny.

Some emails suggest the university's scientists had earlier tried to destroy records to prevent their disclosure under a freedom of information request.  Other records arguably depict programmers manipulating data for key climate modeling software in a deceptive manner.  Some emails appear to show researchers misallocating expenses against a US government research grant.

Some observers speculate all these records had been assembled for a freedom of information request, and after the request was denied, an internal whistleblower elected to liberate them.  Once information leaves the confines of the institution, it's easy to broadcast through channels like Wikileaks.com.

Separately, another institution on which technology has violently imposed transparency is international banking.  An IT staffer at LGT Group stole secret bank customer records and sold them to the German tax authorities, who used them to prosecute tax evaders. “Liechtenstein Under Siege Clings to Bank Secrecy to Outdo Swiss,” Bloomberg.com 2/27/08. 

Then a US Senate investigative committee data-mined Homeland Security records of foreign visitors to uncover a pattern of Swiss bankers coming to the US illegally to solicit deposits from rich American taxpayers.  These unsavory revelations -- made possible by new technology -- has devastated the long-standing industry of secret bank accounts in places like Switzerland.  The US has largely closed down that industry as an avenue for tax evasion and other crime. Kevin McCoy, “IRS: Offshore tax crackdown should produce 'billions',” USA Today, Nov. 17, 2009.

So in this technological age of leaks and sousveillance, what are institutions to do?  Here are three mild examples of proactive transparency: 

* New York City allows web-empowered citizens to track their government's performance on details like response times on calls to the fire department or the street maintenance crews.

* The City lets the same citizens monitor how the city is spending federal stimulus dollars.

* 15 local governments in South Carolina now post their full check registers online so citizens can scrutinize how the governments spend cash and which vendors get how much money.

Update November 29, 2009:  After thinking about it, the University of East Anglia has decided that radical transparency is the only logical policy.  In the wake of the hacker break-in described above, the University has announced it will reveal "all" of its climate data as soon as possible.

–Benjamin Wright

Mr. Wright teaches Data Retention and Security Law at the SANS Institute, where he emphasizes how critical public communications are to good information security.

Related post: Whistleblowers with cameras

Whistleblowers and Digital Records Force Transparent Governance

Public Disclosure Defuses Scandal

Publish FOIA Response?

Technology motivates any publicly accountable organization (nonprofit, corporation, government) to adopt a radically open style of governance.

Owing to email, data logs, text messages and the like, the quantity of official business records ascends skyward, while the granularity of those records grows ever more fine.  Detailed within these innumerable records are the secrets of the organization.

Stored this way, secrets are dangerous.

Keeping secrets –- or just withholding information -- is becoming harder and harder.  Secrets and records can leak out by way of FOIA, spies, gossip, hackers, mistakes, e-discovery, whistleblowers, external surveillance, or just the natural course of events (sousveillance). In finance, a "trusted" banker will leak to a friend secrets about exotic instruments like credit default swaps, which are so new that the law has yet to establish "insider trading" rules applicable to them.  Kara Scannell, "Trader's 'Nice Little Kiss' Tests Reach of Regulations," Wall Street Journal, March 31, 2010.

A leak is dangerous.

The leak is an invitation for an adversary to allege malfeasance.  When a secret leaks, the adversary's storyline becomes (a) the organization possessed information that the public needed, (b) the organization wrongfully withheld the information and (c) the public now knows the information only because a righteous force external to the organization brought it to light.

For a smart organization, the best posture is to preempt the leaking.  Before the leak happens, it should embrace transparency and publish (most all of) its records and activities onto the public Internet.  It should expose its information to independent review and debate.  Authors Tapscott and Ticoll admiringly call such an organization the naked corporation.

False Statement?

Take for example the story of the small, grassroots political action committee named “Take Back Your City,” which is promoting a vote by citizens against red light cameras in the municipality of College Station, Texas.  Through freedom of information act, the PAC obtained extensive email records regarding the city government’s use of the cameras.  In this trove of information, the PAC found what it believes is smoking gun evidence that the city is engaged in false, illegal political advertising about the effectiveness of the cameras.  The city claims – in a flyer to be inserted in monthly utility bills -- that the cameras have reduced traffic accidents, but the PAC says an internal city email contradicts that claim.  The PAC attached the email as evidence to a formal complaint it filed with the Texas Ethics Commission. 

Whether this complaint will result in ethics sanctions against the city (or more particularly the city manager cited in the complaint), I don’t know.  But the city’s defense would be easier had it been more open and transparent with its records.  When it gave the email records to the PAC, it could have also posted them all on its web page as well.  (Why not? The city had already gone to the trouble to compile them.)  Then, when it prepared its flyer for the utility bills, it could have made its point about accident reductions while also saying, “Each citizen can draw his or her own conclusions.  The city has posted on its web page exhaustive records regarding traffic cameras.” 

Such openness takes the punch out of allegations that the city lied.  Effectively, it enables the city to say, “We drew a conclusion from the data and told citizens our conclusion, but our statements to citizens were more than just that.  We also made all the data available to the citizens and told them they could read it themselves and draw their own conclusions.  We've opened the data to third party review.”

Investigating Leaks

Another lesson in transparency derives from the contrast in styles between the board of directors at Hewlett-Packard Company and the town council at Watertown, Massachusetts.

When HP saw that someone on its board was leaking company secrets, it assumed cloak-and-dagger
  mode. It didn’t talk about the problem.  It secretly hired private investigators to spy on members of its board as well as reporters in the media.  The private eyes violated the privacy of the directors by hijacking their telephone calling records.  AT&T discovered the hijacking and reported it to its customer, Tom Perkins, one of the directors targeted by the spying. The result was an embarrassing, debilitating scandal, with lawsuits, criminal complaints, an SEC investigation, a congressional investigation, and the end of career for two of the company’s top lawyers.

HP followed the old-fashioned, closed approach to resolving a crisis.  But in this Internet age -- where clandestine activities are hard to keep clandestine -- that approach led to disaster.

Compare the youtube video below.  It shows the town council dealing with the same problem as the HP board – insider leaks.  The leaks pertained to closed-door deliberations about contracts.  But rather than spying on its members in the dark of night, the Watertown council brought the issue into the open.  It discussed the topic in public, video-broadcast session! 

Notice that Watertown’s transparency immediately deters future leaks.  The leaker has to be thinking, “My leaks are attracting negative attention.  Now all the citizens are on alert, and some knowledgeable witness watching out there may come forward with embarrassing information that reveals me as the leaker.  I’d best stop leaking.”



By being transparent, the council uses the Internet as its enforcer, and it avoids the risk of a HP-style scandal.  Legal compliance meets modern public communications.

–Benjamin Wright

At the SANS Institute, Mr. Wright stresses that, in the wake of a data security incident, the delivery of a effective public message is as important as the technical and legal response.

Surveillance Technology Changes Law Enforcement

Municipal Government Referendum on Digital Video and Photography

FOIA as Data-mining by Citizens

Computers change how police investigations work.  Take a traffic citation, for example. In the past, for a police officer to issue a traffic ticket, the officer had to be present at the scene and had to talk to the motorist face-to-face.  At an emotional level – as well as an administrative one -- the police officer was deterred from issuing tickets for minor, technical violations of traffic laws.  

For example, if an officer observed a motorist not quite clear an intersection before the traffic light turned red, the officer might think twice before chasing the motorist down and issuing a citation.  To pursue the motorist takes time away from other duties.  Then, the motorist may argue the officer’s observation was wrong.  Further, the motorist may confront the officer as a human.  The motorist may say by words, body language or the expression on his face, “you are a jerk for issuing me this frivolous ticket.” Police officers don’t like being told (even politely and subtly) that they are hyper-technical jerks.

Digital technology changes this legal proceeding.  A red light camera at an intersection transmits electronic records to a police officer (detective) who is not standing on the street, but seated in a comfortable office.  The records provide evidence that is more fixed than mere memory.  The officer can review the digital evidence in no time and issue the citation with the click of a button.  For the officer, the legal investigation and decision are like playing a dull, unemotional video game.  The officer may issue many more citations than in the past.

Automated traffic cameras can make a motorist angry.  The motorist loses the ability to discuss the situation with the investigating officer at the scene, where the motorist might talk about the danger of slamming on the brakes when a light changes.  With computer enforcement, the motorist just gets a bland notice in the mail with a photograph and possibly web access to a computer video of the event. 

Jim Ash, a citizen of College Station, Texas, feels that the dehumanization of law enforcement is an infringement of privacy, a civil right.  In our electronic age, privacy is an ill-defined notion, but it resonates with people in a democracy.

Mr. Ash is leading a grass-roots voter referendum [see Footnote] to ban red-light cameras in College Station.  He is exploiting the power that modern technology affords individuals – a web site and numerous freedom of information act (FOIA) requests for discovery of voluminous electronic records (including email) maintained by the City of College Station and other local governments in Texas.  He says he has uncovered an email from the mayor acknowledging that red light cameras will cause more rear-end collisions, while possibly reducing other collisions. (Most mayors would prefer that their email be withheld from political activists like Ash.)

Ash has collected about 1000 verified signatures from College Station voters, enough to cause the referendum to appear on a forthcoming ballot.  He plans to deliver the signatures to City Hall management in a rally scheduled for around Noon, July 16, 2009.

Ash is promoting the rally with radio commercials playing in College Station.  Following are two MP3s of the commercials.

Download See you there Track 1

Download You want to see this Track 2

Update:  The College Station City Secretary has confirmed that Ash and his team collected and delivered more than enough signatures to place the red light issue on the ballot for the next election.   Ash has formed a political action committee named Take Back Your City.

Update November 4, 2009:  According to the local TV station, the voters of College Station, Texas, voted to approve the petition initiative against red light cameras.

Update:  This photo shows workers deactivating the red light cameras in College Station, November 24, 2009:

–Benjamin Wright

Mr. Wright delivers training on cyber defense law and ethics under the SANS Institute.

Footnote:  When I originally wrote about Jim Ash's voters' effort in College Station, I called it a "referendum," not having researched or thought about the technical difference between a referendum and a petition initiative under the city's charter or under the Texas law of municipalities.  I have since learned that the effort is a "petition initiative," not a referendum.

Email Recovery | Network Back-up

E-mail Database Search and Forensics

Archival | What is a Subpoena?

As litigation and other requests for e-mail from backup tapes grow more frequent, an enterprise may be wise to restore, consolidate and archive all of its old e-mail held in backup.

Historically organizations did not think of e-mail as an asset worthy of preservation.  They did not archive it, though copies would end up in network backup.  

But experience has taught that e-mail evidence can be critical to defense of a lawsuit or enforcement of a contract.  Alternatively its disclosure might be required under a subpoena (see definition below), a court order, an administrative summons, an IRS tax audit or a freedom of information act request (FOIA).  Further, e-mail might be needed in an investigation (led internally or by outside criminal prosecutors) of a bribe, a kickback, an overcharge, tax evasion or a embezzlement of money, or it might be needed for an audit of alleged misallocation of funds. 

Archival

Greg Smith of Messaging Architects observes that repeated requests for e-mails from backup can warrant a change of thinking in the IT department. “While most backup software deals very efficiently with individual electronic records, it cannot provide the same level of access to email. This is because enterprise email exists as a record within a database (such as for Groupwise or Microsoft Exchange).  The database must be restored in its entirety and searched in its entirety in order to ascertain the contents of the database. With database sizes exceeding 100GB and scores if not hundreds of tapes, the cost to restore and search the tapes can be considerable. Recovering records for selective users and dates may satisfy the current discovery requirement, but with each successive lawsuit, or changes in discovery parameters for an existing lawsuit, restoration from tape can become a recurring financial liability.”

Greg continues, “The practical solution is to remove the information from tape permanently and place it in an electronic records format where information can be retained and managed as individual records and not conglomerates of information.  In such a format, individual email records can be sorted by user or date.”

Restored records can be archived in an open (non-proprietary) format, such as XML, which enables searchers to tap an ever-expanding array of search and forensics tools.  XML may or may not qualify as "native format" as that term is sometimes used in court decisions, though XML may be a more useful format than whatever the native format was.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, experts in e-discovery and consultants in e-mail investigations.

Post Script  What is a subpoena?  A subpoena is a legal demand that someone turn over information or evidence. Commonly the laws of litigation enable a party to subpoena other parties for records or other evidence. Sometimes the law also invests the power to subpoena in an official who conducts investigations, such as a government auditor or an inspector general. If a party abuses the power to subpoena, by demanding irrelevant records or by issuing a demand with no regard for the cost of compliance, a court may sanction the issuer of the subpoena.

Freedom of Information Act | Computer Records

Freedom of Information Act Requests Yield E-Troves of Documents

FOIA forces transparency in government, and transparency in turn forces revolution in the administration of public institutions – both national and local.

A FOIA requires government to disclose records to citizens upon request.  Remarkably, the quantity of available records relevant to any given request is skyrocketing as government agents adopt digital technology – databases, electronic mail, instant messaging, text messaging, Twitter, collaboration software and more – to execute the details of day-to-day government. The implications for democracy are profound.  So are the governance implications for enterprises of all descriptions.

Item One: Britain is in uproar over the expenses of Parliament members.  The row started when a journalist used the UK’s new FOIA to request records about M.P. requests for reimbursement of living expenses.  By age-old practice, the government covered M.P.s for the living costs associated with their official duties, but the specifics have always been hidden from public view.  Reluctantly resistantly the government prepared to turn over expense records under FOIA – though with heavy redacting to protect M.P. privacy.

But by this time loads of (un-redacted) M.P. expense records had been compiled into something that did not exist in the old days . . . a neat, convenient-to-steal electronic form.  This compact compilation of records enabled a whistleblower to spirit the records out of a government computer and into the hands of a newspaper.  The Daily Telegraph’s ensuing publication of complete, open details has embarrassed M.P.s in an historic scandal. British government will never be the same.  John F. Burns, “In Britain, Scandal Flows From Modest Request,” NY Times, May 20, 2009.

Item Two is Clark County School District, Nevada. Citizen Karen Gray requested under FOIA a year’s worth of the School Board’s e-mail, about 1500 messages.  A few years ago, records of such granularity did not even exist for a typical school board (or city/municipal commission, county management, state committee or board of trustees).  But e-mail has caused the creation of mounds of new records, which become fodder for any kind of legal investigation.

The District tried to delay disclosure.  It also tried to charge Ms. Gray $4000 for the costs of recovering the records (and filtering them for private/confidential data), but those costs reflect out-of-date, manual methods for compiling and reviewing e-mail records. The Nevada courts resisted the delay and the high charges.  The attitude of the courts was that the law favors inexpensive and generous disclosure. So the courts forced disclosure.

Ms. Gray’s case implies that Freedom of Information Act law is intolerant of governments that make their important e-mail records hard to recover.  A modern e-mail archive appliance makes the compilation and filtering of e-mail (especially that of executives, professionals, top managers, and board members) quick and inexpensive . . . consistent with the purpose of FOIA law.

–Benjamin Wright

Mr. Wright is an advisor to messagingarchitects.com, the visionaries in e-records management.