Electronic Data Records Law | How to Win E-Discovery

Archive Facebook Business Messages

Employee Policy

Professionals, business people, and government employees are increasingly using Facebook and other social media for official business, often as agents of their employers.  Commonly, the employers are required or well-advised to make and keep records of the employees’ social media communications. 

This issue arose in a workshop that Messaging Architects and I led at a sizable enterprise (having about 8000 employees).  The purpose of the workshop was to establish policy on the retention of electronic records. The workshop pulled together representatives of disparate stakeholders within the enterprise, including the IT, legal and compliance departments.

Workshop participants, including representatives from human resources, feared that employees would ignore a policy that forbids them from using text messages, Facebook and Google Buzz to transact business.  So the workgroup drafted this language for adoption as HR corporate policy: 

“If an employee uses electronic messages for business, outside an enterprise email system account, the employee is expected to strive to make records of the messages such that they are within the control of the enterprise.”

Dear Reader:  What do you think of such a policy?

Next question:  Speaking practically, how would an employee make and keep records of Facebook communications?  I don't have all the answers, but here's a step to consider:

Facebook allows a user to submit many of his postings via email. So at http://www.facebook.com/mobile/?v=web Facebook shows the user that if he sends some text to a special email address, then the text will be posted as coming from the user. 




















For example,  . . .   here is a screenshot of a message I posted from my email account:









Facebook posts this kind of incoming email as a status update to the user’s Wall.  Note that when a user like me submits text via email, the only text that appears on the user’s Wall (status update) is the text in the subject line of the user’s email. If the user writes anything in the content of the email, Facebook seems to ignore it and seems not to post it.

Thus, in the example above, I wrote all the text in the subject line of the message from my email account to my FB account.

If an employee were to submit to FB by way of her employer-controlled e-mail account, then the account would retain the submission according to whatever record retention/destruction policy the employer has set – 90 days, seven years, or whatever. [Interesting questions: In the employer's email system, are there limits to the number of characters that can be transmitted in the subject line of an outgoing message and can be stored in the record of that message?]

A FB user can submit more than text from his email account. The FB user can also submit a photo (or even a video). FB posts the photo on the user's Wall, with text taken from the subject line of the email. For instance:


















So . . . the above is one convenient way for a business professional to store her Wall posts into her employer's email system, such that the posts will be preserved for audit, inspection, supervision, ediscovery, litigation hold and the like. 

I argue that email archives are the starting place for any enterprise that wishes to maintain electronic records for legal compliance purposes.  I argue the same goes for Twitter.

My ideas here leave scads of answered questions, such as how to record comments that others post on the user's Wall.

–Benjamin Wright

Mr. Wright teaches IT and records management law at the SANS Institute, where social network law is part of the curriculum.  He chairs a (proposed) SANS conference on e-records and e-discovery slated for Las Vegas, September 2010.

Update:  Cutting-edge Web 2.0 lawsuit.

Employee Privacy on Social Network

Trespassing in Cyberspace

Computer Investigation Law

Investigators engaged in electronic discovery should be mindful of posted terms, conditions, EULAs, labels, notices, warnings, banners, contracts, agreements and no-trespassing signs.  They can have legal effect in the electronic world, and may be binding on an investigator who encounters them. 

Consider Pietrylo v. Hillstone Restaurant Group.  

While off-duty, restaurant employees maintained a password-protected MySpace forum, labeled as “talk about all the crap/drama/and gossip occurring in our workplace, without having to worry about outside eyes prying in.”  Pietrylo created and maintained the forum, explicitly designated it as “invitation only,” and distributed passwords to a limited number of employees.  One of these employees gave her password (whether voluntarily or otherwise is unclear) to restaurant management.  Management accessed the forum, and discovered . . .

City Government | Deleted Official E-mails

Expensive Forensic Recovery | Political Cover-up? | State Retention Schedule

Compliance with e-mail retention law is not easy.  Email in an enterprise like a municipal government is voluminous.  And at city hall failure to keep required electronic mail records can look like a scandal, where it appears officials are trying to cover-up the truth about something important.

Hence, the City of Boston has hired a forensic specialist to attempt to recover the destroyed e-mails of an aide to the mayor.  As part of the specialist's investigation, he or she might look on PC hard drives and in network backup tapes to locate erased records.

Forensic retrieval of email is costly.  The expense of forensics quickly exceeds whatever the city might have been saving by not implementing a comprehensive email archival system in the first place.  Had the city foreseen it would eventually be forced to restore deleted e-mails, it would have readily seen the need for good archival as a matter of good IT management.

The city did have an archival program, but it only pertained to emails that had resided in a user’s inbox for more than 90 days.  In other words, the program gave decision-making responsibility to users.  If users decided to delete records before 90 days, then the records would not be archived.  Among the problems with giving users such decision power is that users are rarely qualified (and rarely have the time) to exercise the required judgment.  Further, a user has a conflict of interest.  If a record reflects negatively on the user, she naturally prefers to destroy it.

Generally speaking, the Massachusetts state record retention schedules applicable to city government require that email correspondence of “no informational or evidential value” be retained a minimum of two years. 

But just instituting a policy that all e-mail be kept two years does not solve all of the city’s record retention problem.  Many e-mails must be retained for various longer periods, depending on content.  To examine email content and determine that this record needs X retention period and that record needs Y retention period is very, very difficult in practice.  In fact, I am skeptical that such one-by-one examination can be done effectively in government across many users over an extended period of time. (If you dear reader know of any case study showing it can be done, I cordially invite you to point me to that study!)

Under the auspices of Messaging Architects, I led a workshop on this topic with the stakeholders (IT, HR, legal department et al) in Jackson County, Oregon, February 2009. The conclusion was that the county government would archive all e-mail (spam excluded) more or less indefinitely.

–Benjamin Wright, Senior SANS Instructor for e-Discovery and e-Record Retention Law