Electronic Data Records Law | How to Win E-Discovery

Attorney-Client Privilege | Work Product

Labels | Banners

Computers can influence the legal posture of an internal investigation.

Two legal doctrines can shield investigation-related communications from disclosure in court or in pre-trial e-discovery.  The first doctrine is attorney-client privilege, which ensures that communications between an attorney and his client remain confidential. The second doctrine is attorney work-product, which prevents disclosure to adversaries of materials prepared by an attorney for a client in anticipation of litigation.

The scope of these two doctrines can be controversial in particular cases.  Often, courts hold that records of a routine internal audit (or business audit) within an enterprise are not protected by either doctrine, even though a lawyer may have been involved or litigation may have been one of the reasons for the audit.  Edna Selan Epstein, The attorney-client privilege and the work-product doctrine, Volume 1, page 356 et seq.

The division between a mere internal audit, on the one hand, and a protected communication or record, on the other, can be open to interpretation.

That interpretation can be influenced by labels, notices and designations.  A tag or notice on a report declaring that it is protected can help persuade a court that in fact it is entitled to protection.  Example: “Confidential. This record is protected attorney-client communication and attorney work product to formulate legal advice in preparation for dispute.”

Privilege

According to a leading legal commentator, a notice declaring attorney-client privilege is “like chicken soup” for an illness. Though it's not guaranteed to succeed as a self-fulfilling declaration of legal status, it might help and normally won't hurt.  Edna Selan Epstein, The attorney-client privilege and the work-product doctrine, Volume 1 , 2007, page 877. 

Such a notice tends to show the belief, mindset and intention of the parties at the time, all critical factors in determining whether the privilege exists in a given situation.  "The professional relationship for purposes of the privilege hinges upon the belief that one is consulting a lawyer and his intention to seek legal advice.” Wylie v. Marley Co., 891 F.2d 1463, 1471 (10th Cir. 1989).

Liberal posting of labels, notices and designations is easier with computer technology.  Computers can facilitate the recording of investigative activities like meetings and interviews – in such a way that the proceedings are labeled as protected.  For example, a meeting can be held by video conference, online text forum or virtual meeting space, where all activities are recorded and a banner reads, “Confidential. This is protected attorney-client communication and attorney work product to formulate legal advice in preparation for dispute.”

Computer video enables easy recording of in-person meetings, where displays of the meetings distributed to participants show the protection banner.  (Some might call the placement of such a banner on a video display an example of augmented reality.  Wired Magazine suggests that tablet computers like iPad will become like windows on the world, where, for instance, users prop them up in a live meeting to record it and see the banners and other augmentation that enrich the experience.  Steven Levy, “Tabula Rasa: Why the new generation of tablet computers changes everything,” Wired, April 2010.)

Work Product

The absence of a lawyer's participation in the preparation of a report reduces the likelihood a court would consider it an attorney work product.  Edna Selan Epstein, The attorney-client privilege and the work-product doctrine, Volume 1, page 918. The reason is that the work product doctrine is intended to prevent disclosure of the lawyer's thinking, and nothing more.  The earmark of a report containing a lawyer's thinking is her participation in the creation of it.

Substantive involvement of a lawyer in the creation of a report is easier and less expensive with computer communication.  For instance, computer communication allows a remote lawyer to peer in on a meeting via video; he might be observing and occasionally commenting from a small window opened on his desktop monitor while he simultaneously attends to other projects.  Computers can allow a distant lawyer periodically to review the activities of an e-discovery specialist as she searches through email archives.  This video demonstrates a remote lawyer participating in an interview via webcam on his laptop:

  Technology allows logging of the specifics of a lawyer's active participation (e.g., lawyer viewed at x time, submitted comment or instruction at y time), together with a banner showing belief and intention that the report is attorney work product.

–Benjamin Wright

Attorney Wright teaches the Law of Data Security and Investigations at the SANS Institute.

Update 2013: An experienced trial lawyer advised me that normally you would not want to claim privilege and work product in the same record.  The record is subject to either one or the other but not both.  If you claim both a court might conclude you did not pecisely apply either the privilege doctrine or the work product doctrine.

Email Retention | Public Audit & Administration

German Laws, Orders, Regulations and Instructions

Affinity with Local (County) US Government

What does the law expect of electronic government records?   Records enable governments to be transparent.  If government keeps good records of its activities and gives citizens easy access to them, then citizens can review government and hold it accountable.

Today most government records are electronic.  Accordingly, the German federal government seeks to archive its electronic records, including e-mail.  A key initiative under the Federal Ministry of the Interior is DOMEA, a project that sheds light on the legal expectations for e-government records, including electronic mail. 

The DOMEA project recognizes that: “Electronic records . . . have to meet the requirements for record keeping in public administrations, which are prescribed in laws, standing orders, regulations  and instructions.  They include important points, such as: 

“1. The completeness, integrity and authenticity of official records, which means that official documents cannot be subsequently altered, changed, removed, destroyed or deleted. 

“2. The records principle of public administration, which means that documents have to be appropriately joined together in systematically arranged subject files according to the functions of a particular office. 

“3. The accountability and lawfulness of administrative procedures, which means that accountabilities and responsibilities have to be documented in records in the course of business and that the state of affairs and the development of transactions in a given case has to be completely evident in records at any time.”

Of course, the validity of these legal standards is not limited to Germany or even Europe.

If these are the legal standards for government records, then query whether popular enterprise e-mail systems such as Microsoft Exchange and Novell Groupwise are designed to meet these standards. Generally speaking, they are not.  They do not support efficient storage, management, protection and searching of vast quantities of e-mail records, collected from a large population of users over an extended period of time.  That’s one reason enterprises like governments commonly have policies to destroy most e-mail relatively quickly, such as 90 days after transmission.

But e-mail has become central to the administration of modern government.  Very often, e-mail documents official transactions and official delegations of responsibility.  It also empowers internal audits and investigations (by for example inspectors general) for fraud, waste, corruption, mismangement and misappropriation of funds.  

For some time organizations such as governments have relied on ad hoc methods for retaining e-mail – including the print-and-file method.  But e-mail is so voluminous and has become so important that ad hoc solutions are failing.  

Last week I led an on-site workshop with the staff of a mid-size county government struggling with this problem. Staff representatives hailed from IT, counsel, finance, administration, internal audit, human resources, risk management and public health services.  The county’s e-mail system is Groupwise.  The staff concluded that the county needs, in addition to Groupwise, a dedicated e-mail archive appliance. The workshop enabled the staff to write new, modern policy on e-mail archival.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigation law at the SANS Institute.

He is an advisor to Messaging Architects, where he leads an in-house workshop to help the stakeholders in an enterprise craft workable policy on the management of email and other eRecords.

P.S.  New Mexico's Attorney General (AG) indicted the state's former Secretary of State (SoS) for tax evasion and money laundering tied to alleged kickbacks to her by the recipient of federal grant money.  Stephanie Simon, "New Mexico Roiled by New Graft Case," Wall Street Journal, August 22 -23, 2009.  Among other things, the indictment alleged that the defendant advanced her crime by fabricating two official records in 2004 -- a paper letter and a paper memo.  The indictment came on the heels of thorough document reviews by both federal and state auditors.  The auditors said the Secretary of State's office maintained poor records on its management of federal grant money.  Email records (which are very hard to forge or spoof successfully) were sparse if non-existent.  Furthermore, the Secretary of State's office says it keeps financial records only three years after the close of the fiscal year.  Now, the AG and the ex-SoS disagree sharply over the allegations.  Had the SoS's office maintained more detailed and complete records (including archived email, supported by time-stamps and other audit trails), this disagreement might now be resolved.  Either (a) the ex-SoS would have been deterred at the outset from corruption for fear that the records would betray her, (b) the records would clearly exonerate the ex-SoS, or (c) the records would unambiguously demonstrate the ex-SoS's guilt.

Employee ESI: Private?

Internal Investigations under Data Protection Legislation

Many countries have data privacy laws limiting the disclosure of personal information their citizens. Although the laws are far from uniform around the world, the European Data Protection Directive (95/46/EC) is a leading guide.

These laws motivate (multinational) corporations to configure controls into email (as well as webmail and text-instant-message) record retention systems.

The European Data Directive generally instructs European countries to enact local privacy legislation to regulate personal information. The legislation can apply to e-mail and other electronically stored information (ESI).  As a practical matter, the details on implementation and enforcement of local (non-US) privacy laws with respect to e-mail is a very complex topic.  Some local laws can frustrate internal corporate investigations that might appear, to US-based managers for example, as routine and responsible.  They can cause emails to be withheld from investigators.

One instance: In 2001 French courts held that a foreign-headquartered company violated the privacy rights of a French engineer when it inspected his e-mail records, stored on company computers.  The records revealed he was wrongfully moonlighting on company time.  Doreen Carvajal, “The Workplace: When bosses spy on workers,” International Herald Tribune, April 21, 2004 .

As corporations install appliances to store e-mail archives, they should consider whether to implement controls for compliance with local privacy statutes.  The controls might include

1. written policies calling for compliance with local law;

2. technical blocks to prevent unauthorized people or departments from accessing specific records, while granting access to those who have been authorized; and

3. alerts and audit trails to enable after-the-fact review of who accessed which records and when.

--Benjamin Wright

Mr. Wright is a consultant to Messaging Architects, develper of sound process for electronic mail record-keeping and investigation.

Email Document Recordkeeping

Local County Government Compliance with State Standards

Records managers at Travis County, Texas, are publicly debating how to draft retention policy for the e-mail of over 4000 users. The county is subject to many confusing state directives and standards on records retention.  

The Travis officials (Steven Broberg and Shawn Malone) have assembled a web site and blog to explain the issues and solicit public input. The officials outline three options, roughly being:

1. Continue the status quo, where each employee stores, deletes and/or categorizes e-mail without clear, modern guidance from management on how this should be done. Under this approach, some employees store a lot, and some store less. Some print “important” e-mails and place them in a file cabinet; others do not.  

 2. Train each employee to rigorously review each e-mail and decide its retention status (i.e., destroy quickly; OR place in category X so it can be retained for a certain period; OR place in category Y so it can be retained for a different period; and so on). New technology, such as artificial intelligence, may be on the horizon to facilitate this option.  

This is what I have previously called the make-a-decision style of e-mail records management.  The Travis officials call this the bucket approach . . . each e-mail fits into a bucket (i.e., a category to which are assigned rules for retention, destruction and so on) and a way must be found to put the e-mail into the right bucket.  The officials note that some learned commenters have advocated the bucket approach, but the officials have appealed to the commenters to bring forward a good example of the bucket approach working in practice.  See video at the bottom of blog post. 

3. Keep all e-mail “indefinitely” (spam excluded).  Related to option #3 is what Broberg & Malone call the haystack approach to e-mail records management.  Rather than trying to place each e-mail into category X or Y so it can be found and managed as though it were a sheet of paper, the haystack approach simply keeps copious volumes of e-mail and then relies on search engines to find particular e-mails when they are needed, such as for e-discovery or an investigation.

Here’s my initial input to Broberg and Malone.  

First, option #3 could be implemented in many different ways. It should be understood as not a single option, but a large family of options, with many flavors and nuances.

Second, I have previously voiced skepticism about option #2. 

Third, I recently witnessed a large institution wrestle with the same topics.  It knew that, like Travis County, its present condition was option #1. The e-mail system deleted each e-mail within 90 days, unless the user (such as an inventor) took effort to store it specially, such as in a folder.  Its present e-mail usage had created and was continuing to create, vast heaps of records. The internal audit department argued that all this stuff, stored according to user discretion, contained important material. Copies were spread around (rather haphazardly) on servers, desktops, laptops, BlackBerries and Androids.  Those e-mails, and the data contained therein, included: 

* assets of the enterprise (contracts, negotiations, representations, internal controls, intellectual property, delegations of authority)

* evidence that is and will be relevant to present and future investigations (lawsuits, e-discovery, corruption audits, fraud allegations, false pretenses, whistleblower complaints, retaliation complaints, misappropriation of funds, misallocation of funds probes, hostile work environment claims, etc.)

* sensitive information such as trade secrets, other intellectual property and personally identifiable (private) information

Internal audit argued that this scattered corpus of stuff needs to be managed, measured, controlled and secured.  For privacy and other reasons, audit trails need to be kept to show who looked at which archives and when.

Further, argued internal audit, as the years go by, decisions about how long to keep this or that can change on account of matters like future litigation hold and changes in law (or changes in records management philosophy). In other words, the institution might initially set an e-mail for seven-year retention, but later learn it should be retained for 10 years. The institution needs a way to find the e-mail so it can be moved to the longer retention period.

E-mail, concluded internal audit, needs to be managed under a centralized archive appliance.  In other words, all e-mail (excluding spam and the like) needs to be copied into a archiving system control by the institution, not individual employees.  (Employees might still keep their own copies of e-mails at their discretion, but centralized archival ensures that the institution gets a copy of everything.)

Centralized e-mail archiving is largely a departure away from Travis County’s option #1, and it's not option #2.

Policy?

 So precisely how long should an enterprise keep email records? There is no universally-correct answer. I have led in-house workshops to address this question at numerous, diverse enterprises. The outcome of these workshops has varied, depending on many factors, including corporate culture.

In my experience, the best email retention policy is one that is developed by collaboration of the various stakeholder departments in the enterprise (legal, IT, HR, operations et al.). Normally, these different stakeholders will start with different positions on what the policy should say. But, in my experience, after the stakeholders have talked through the issues, they tend to compromise their positions and coalesce into a policy that is unique to the enterprise.

--Benjamin Wright

Mr. Wright is senior instructor for the SANS Institute, where he teaches its 5-day course on the law of e-discovery, electronic records, data privacy and computer investigations. 

Investigating Staff Graft or Misconduct

Electronic Records for Audit, Ethics and Internal Control

If an institution – any institution – is to maintain its reputation, it must be prepared to investigate the actions of its employees (personnel).  Inevitably, allegations will arise that this or that employee embezzled, acted unethically, abused authority, laundered money, executed an unauthorized trade or simply made a mistake.  Power to conduct internal investigations is critical to government agencies and for-profit corporations, as well as charity, non-profit, and educational organizations.

Modern investigations today are different from those of the past, by virtue of the presence of digital records. The sheer quantity of e-records (e-mail, text, chat or instant messages, logs, meta-data, photographs, blog comments, surveillance videos, and on and on and on) is mushrooming beyond comprehension.  When an institution undertakes to audit whether a superior harassed a subordinate, an accountant misunderstood a tax liability or an administrator wrongfully tolerated a conflict of interest, a brimming corpus of electronic records can be available for examination . . . and can facilitate a just outcome.  The records can shed welcome light on whether the subject of the investigation did what is claimed, or did not do it.

A case in point is an investigation at Yale University, a regular recipient of research grants from the federal government.  Prosecutors alleged that academics at Yale had misallocated federal money (funds or assets) by (a) transferring grant funds to accounts that were not intended for the grants in question, and (b) paying themselves for summer activities using money from grants not earmarked for those activities.

In other words, the government claimed professors and staff played fast and loose in interpreting the purpose of specific grants.

In the face of such allegations, an institution has no choice but to cooperate with government.  (Which university wants to be the subject of an adversarial police raid in search of computer records?) Yale launched a massive investigation, covering some $3 billion in grants over seven years (2000-2006). It turned over more than a million pages of documents.  No doubt the massive quantity of records included email and other computer-based records.  (A similar corruption probe in the 1980s could not have yielded as many records because computers and e-mail were not as pervasive then.)  The college settled the matter in 2008 by agreeing to pay $7.6 million.  

Although Yale admitted it had made some errors, the government granted the school a release from further liability with respect to the years that were investigated.

$7.6 million is a relatively small penalty.  The university appears to have done itself three favors.  First, it had retained plentiful records for many years.  Second, it cooperated with the government and divulged rafts of records.  Third, when the allegations first arose, Yale instituted reforms preemptively, including tighter accounting controls and improved staff training.  The result was the imposition of only a small settlement payment.   And as for the future, Yale remains qualified to receive grants from the government. 

Had Yale produced fewer records, and displayed less transparency and less cooperation, the institution would not have fared so well.

I’ll bet the “errors” to which Yale admitted reflected past practices that had developed over decades, in an age when records were fewer and therefore government (inspectors general) had less ability to audit or investigate.

The incident teaches Yale staff (and staff at other institutions receiving federal grants) that they will be on a tighter leash for the future.  A digital informant is ready to snitch on them.  The super-plentiful e-records now being made about their daily activities expose them to greater review and accountability than was historically possible.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in records-dirven investigaions.  He also teaches Internet law at the SANS Institute.