Electronic Data Records Law | How to Win E-Discovery

Virtual Counterfeit Investigations

Consent, Contracts, Privacy Rights in the Information Economy

Professional investigators should read cyber terms of service.

Technology contracts like terms of service (ToS) and end user license agreements (EULAs) are having a growing impact on the execution and outcome of investigations . . . internal investigations,
private investigations, forensics examinations, law enforcement investigations, intellectual property investigations, cyber-theft investigations and many more.

Increasingly, social, business, academic and entertainment interaction occurs inside virtual environments.  These environments saturate modern life:  web pages, video games, online schools, social networks, digital media (books, music, movies) smartphone apps and corporate computer networks.

As users enter these environments, they are commonly required to agree to legal terms of use and access.  These agreements can govern official investigations that may come later.  These agreements can (and increasingly do) contain statements that users consent to official audits and probes and consent to limits on their privacy.

 

University Network Terms Applicable to Student

For example, when a freshman student at the University of Wisconsin attached his PC to the university's network, he agreed to terms of service, which included an acknowledgment that the university could execute IT security measures.  Later, when a university system administrator suspected that the student's PC was involved in an ongoing, dangerous hacking incident on the network, the administrator hacked remotely into the student's PC.  

While searching inside the PC, the administrator found evidence that incriminated the student in illegal hacking outside the university's network.  The university gave this evidence to government prosecutors, who attempted to use the evidence in a criminal trial against the student.  The student objected, on the grounds that the university had violated his privacy.  The court disagreed with the student.  The court said the student's privacy had not been violated because he consented – by virtue of the security clause in the network terms of service – to the search by the system administrator. US v. Heckenkamp

 

Social Network's Terms Authorizing Investigation

Here are example terms of service authorizing investigations, published by Zenbe, a social networking service for sharing information among friends:

Zenbe reserves the right to access, read, archive, monitor, and disclose any information it reasonably believes is necessary to:  1. enforce this Agreement, including investigation of potential violations hereof.  2. protect the rights, property or safety of Zenbe, its users and the public.  3. satisfy any applicable law, regulation, legal process or governmental request.  4. detect, prevent, or address fraud, security or technical issues, including the filtering of spam.

Terms like these can be relevant to monitoring users in online communities and business  transactions.

 

Terms for Investigationg Abuse of Online Games and Credits

Entrepreneurs are inventing new ways to transact business online.  They are devising myriad electronic credits, coupons, vouchers, discount codes, trading cards, play money, online property, virtual game pieces and more.  As they distribute these virtual goods and assets to users, their power to investigate their users is critical to nixing abuse, foiling hacks, thwarting counterfeits and maintaining the quality of their product or service.  Investigations are a growing component of the information economy.

A substantial method for entrepreneurs to police their products and services is to require users to click on terms of use that include power on the part of the entrepreneurs to investigate their users.

 

Terms for Internal Investigations

Some investigations are internal to an enterprise, as is the case with a human resources (HR) investigation.  The scope of an internal investigation can depend on contract terms or written employment policies.  For example, in Ontario v Quon, a police officer said his boss violated his privacy when the boss reviewed text messages the officer sent from his employer-issued pager.  In other words, he argued that his government employer violated his Fourth Amendment right to be free from unreasonable search.  However, the US Supreme Court held the employer did not violate privacy, in part because the officer had previously known by virtue of department policy that management could review (investigate) the content of messages exchanged through the department's equipment.

An employer or other organization that creates an electronic space is remiss if it lacks terms of use that include rights for official investigation.  Although those rights may exist without explicit statement in an agreement, the user's assent to them erodes her ability to object to an investigation when it happens.

 

Terms of Service Applicable to Professional Investigators

To be sure, terms in an agreement cannot legitimize an irresponsible investigation.  But terms can help clarify that the user was warned he could be scrutinized, records could be captured and evidence could be used against him.   They can clarify that as a condition to his treatment as an authorized user, he consents to monitoring and evaluation.

A professional investigator should take note when the subject of investigation has agreed to no relevant terms or agreement.  The lack of agreed terms can constrain the investigation.

Conversely the investigator should note whether multiple, overlapping terms of investigation apply simultaneously to a person under investigation.  For instance, suppose an investigator is engaged by the operator of a game app that works inside Facebook, and the investigator is examining whether Jane is abusing the game.  The game terms that Jane agreed to when she started the game may support the investigation.  The investigator may gather relevant evidence from game app’s network.

 

In addition, the terms of Facebook may support the investigation.  The investigator may be able to get help from Facebook.  Facebook, based on its terms of service, may be willing to cooperate with the investigation and turn over its own records about Jane.

–Benjamin Wright

Mr. Wright teaches e-Investigations Law at the SANS Institute.

Related: EDiscovery and Investigations on Facebook.

 

 

 

Attorney-Client Privilege | Work Product

Labels | Banners

Computers can influence the legal posture of an internal investigation.

Two legal doctrines can shield investigation-related communications from disclosure in court or in pre-trial e-discovery.  The first doctrine is attorney-client privilege, which ensures that communications between an attorney and his client remain confidential. The second doctrine is attorney work-product, which prevents disclosure to adversaries of materials prepared by an attorney for a client in anticipation of litigation.

The scope of these two doctrines can be controversial in particular cases.  Often, courts hold that records of a routine internal audit (or business audit) within an enterprise are not protected by either doctrine, even though a lawyer may have been involved or litigation may have been one of the reasons for the audit.  Edna Selan Epstein, The attorney-client privilege and the work-product doctrine, Volume 1, page 356 et seq.

The division between a mere internal audit, on the one hand, and a protected communication or record, on the other, can be open to interpretation.

That interpretation can be influenced by labels, notices and designations.  A tag or notice on a report declaring that it is protected can help persuade a court that in fact it is entitled to protection.  Example: “Confidential. This record is protected attorney-client communication and attorney work product to formulate legal advice in preparation for dispute.”

Privilege

According to a leading legal commentator, a notice declaring attorney-client privilege is “like chicken soup” for an illness. Though it's not guaranteed to succeed as a self-fulfilling declaration of legal status, it might help and normally won't hurt.  Edna Selan Epstein, The attorney-client privilege and the work-product doctrine, Volume 1 , 2007, page 877. 

Such a notice tends to show the belief, mindset and intention of the parties at the time, all critical factors in determining whether the privilege exists in a given situation.  "The professional relationship for purposes of the privilege hinges upon the belief that one is consulting a lawyer and his intention to seek legal advice.” Wylie v. Marley Co., 891 F.2d 1463, 1471 (10th Cir. 1989).

Liberal posting of labels, notices and designations is easier with computer technology.  Computers can facilitate the recording of investigative activities like meetings and interviews – in such a way that the proceedings are labeled as protected.  For example, a meeting can be held by video conference, online text forum or virtual meeting space, where all activities are recorded and a banner reads, “Confidential. This is protected attorney-client communication and attorney work product to formulate legal advice in preparation for dispute.”

Computer video enables easy recording of in-person meetings, where displays of the meetings distributed to participants show the protection banner.  (Some might call the placement of such a banner on a video display an example of augmented reality.  Wired Magazine suggests that tablet computers like iPad will become like windows on the world, where, for instance, users prop them up in a live meeting to record it and see the banners and other augmentation that enrich the experience.  Steven Levy, “Tabula Rasa: Why the new generation of tablet computers changes everything,” Wired, April 2010.)

Work Product

The absence of a lawyer's participation in the preparation of a report reduces the likelihood a court would consider it an attorney work product.  Edna Selan Epstein, The attorney-client privilege and the work-product doctrine, Volume 1, page 918. The reason is that the work product doctrine is intended to prevent disclosure of the lawyer's thinking, and nothing more.  The earmark of a report containing a lawyer's thinking is her participation in the creation of it.

Substantive involvement of a lawyer in the creation of a report is easier and less expensive with computer communication.  For instance, computer communication allows a remote lawyer to peer in on a meeting via video; he might be observing and occasionally commenting from a small window opened on his desktop monitor while he simultaneously attends to other projects.  Computers can allow a distant lawyer periodically to review the activities of an e-discovery specialist as she searches through email archives.  This video demonstrates a remote lawyer participating in an interview via webcam on his laptop:

  Technology allows logging of the specifics of a lawyer's active participation (e.g., lawyer viewed at x time, submitted comment or instruction at y time), together with a banner showing belief and intention that the report is attorney work product.

–Benjamin Wright

Attorney Wright teaches the Law of Data Security and Investigations at the SANS Institute.

Update 2013: An experienced trial lawyer advised me that normally you would not want to claim privilege and work product in the same record.  The record is subject to either one or the other but not both.  If you claim both a court might conclude you did not pecisely apply either the privilege doctrine or the work product doctrine.

Public Relations of a Data Security Breach?

Professional Education - Technology

[Update:  I've an evaluating Google Buzz as a vehicle for crisis communications, such as public announcements and interaction following an information security incident.]

Public communications are an under-appreciated facet of cybersecurity.  Over the years, I have increasingly emphasized public communications in my SANS LEG523 course on the law of information security (which includes e-discovery, record retention and internal investigations). 

Public communications is much more than just press releases and press conferences.  It embraces a wide array of
public statements related to IT security -- policies, disclaimers, web notices, contracts, network terms & conditions, blogs, filings submitted to regulators, interactions with law enforcement, breach notices to consumers, declarations made in courts of law, and much, much more. 

For instance, observe how central publicity is to the pivotal IT security lawsuit PlainsCapital Bank v. Hillary Machinery.

If anything could summarize my 5-day LEG523 course, it would be this:  Words count, and words need to selected carefully.  The words your enterprise utters to the world can have an astonishing impact on legal liability, public reputation, regulatory compliance, the cooperation (or not) of law enforcement and so on.  Silence also counts, and silence is often a bad idea. 

No other training course in the world will shake up your thinking about information and computer security as much as LEG523. 

I'd be happy to answer questions about the course.

Learn more and register.

--Benjamin Wright, Senior Legal Issues Instructor, SANS Institute

EDD Search and Analysis

Advanced ESI Culling, Clustering and Concept Review

E-discovery search and analysis engines are proliferating.   Enhanced keyword search methods (such as fuzzy search that looks for forensic gems like misspelled keywords) are coming to recognize more nuances.  Other analytical technologies are emerging as well, and they are influencing the outcomes of audits, lawsuits and internal investigations.

Take the Lehman Brothers bankruptcy, which oversees 3.2 billion e-mail and instant message records. To glean value from this ocean of records, investigators and auditors need more than just conventional keyword search.  New methods include visual mapping of users, dates, transactions and relationships and searches for concepts like compensation rather than just words like “salary” or “bonus.” Telis Demos, "Smoking-Gun Search Engines Find Profit," Fortune, March 2, 2009, p. 24.

Savvy inspection of eDiscovery records can uncover hidden inference and meaning, and dramatically change the result of lawsuits and investigations.  For instance, the US Department of Justice indicted David Stockman, ex-CEO of Collins & Aikman, for alleged fraud, supporting its indictment with extensive factual references and analysis – including the report of an internal investigation conducted by a prestigious law firm on behalf of the company’s board of directors.  For Stockman, the outlook was grim; at a minimum he faced a grueling criminal trial.  

However, during the pre-trial litigation, Stockman’s defense team assiduously assembled a 15-million  (!) document database of e-mail and other records from the company.  From this huge corpus, the team drew out unexpected insights about how business actually transpired at the company and about how supplier rebates (a key topic) worked in the industry.  The insights suggested that neither DoJ nor the internal investigator really understood the case.  These insights enabled the defense to construct a radically different interpretation of Stockman’s tenure as CEO and, eventually, to persuade the DoJ that it had made a mistake.  In an unusual about-face, DoJ withdrew criminal charges against Stockman before the trial began.

In other words, ESI data-mining is the reason Stockman walks a free man today.

According to Ranjit Sarai, eDiscovery specialist at Messaging Architects, litigants like Stockman can achieve courtroom advantage by exposing e-mail databases to advanced or experimental search techniques. “When an investigator is trying to understand a multitude of e-mail records, scrub them for privacy compliance or cull out privileged communications, keyword-oriented searches can be very tedious and can mask the big picture.  Alternative analytical tools can often yield better results.  For example, they can visually map things like time relationships, which can highlight suspicious activities or contradict an adversary’s interpretation of what happened in the case.”

To assemble such as database, a litigant like Stockman would need to access to the records in a machine-processable format, such as XML.  Sometimes courts roughly refer to such as format as "native format," but eDiscovery formatting is a complex topic.

–Benjamin Wright

Mr. Wright is an advisor to messagingarchitects.com, experts in e-discovery services, training and software.   Here is an ARMA podcast describing Messaging Architects' work in e-mail archiving, including its workshop for development of an email records policy in an enterprise.

Email Recovery | Network Back-up

E-mail Database Search and Forensics

Archival | What is a Subpoena?

As litigation and other requests for e-mail from backup tapes grow more frequent, an enterprise may be wise to restore, consolidate and archive all of its old e-mail held in backup.

Historically organizations did not think of e-mail as an asset worthy of preservation.  They did not archive it, though copies would end up in network backup.  

But experience has taught that e-mail evidence can be critical to defense of a lawsuit or enforcement of a contract.  Alternatively its disclosure might be required under a subpoena (see definition below), a court order, an administrative summons, an IRS tax audit or a freedom of information act request (FOIA).  Further, e-mail might be needed in an investigation (led internally or by outside criminal prosecutors) of a bribe, a kickback, an overcharge, tax evasion or a embezzlement of money, or it might be needed for an audit of alleged misallocation of funds. 

Archival

Greg Smith of Messaging Architects observes that repeated requests for e-mails from backup can warrant a change of thinking in the IT department. “While most backup software deals very efficiently with individual electronic records, it cannot provide the same level of access to email. This is because enterprise email exists as a record within a database (such as for Groupwise or Microsoft Exchange).  The database must be restored in its entirety and searched in its entirety in order to ascertain the contents of the database. With database sizes exceeding 100GB and scores if not hundreds of tapes, the cost to restore and search the tapes can be considerable. Recovering records for selective users and dates may satisfy the current discovery requirement, but with each successive lawsuit, or changes in discovery parameters for an existing lawsuit, restoration from tape can become a recurring financial liability.”

Greg continues, “The practical solution is to remove the information from tape permanently and place it in an electronic records format where information can be retained and managed as individual records and not conglomerates of information.  In such a format, individual email records can be sorted by user or date.”

Restored records can be archived in an open (non-proprietary) format, such as XML, which enables searchers to tap an ever-expanding array of search and forensics tools.  XML may or may not qualify as "native format" as that term is sometimes used in court decisions, though XML may be a more useful format than whatever the native format was.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, experts in e-discovery and consultants in e-mail investigations.

Post Script  What is a subpoena?  A subpoena is a legal demand that someone turn over information or evidence. Commonly the laws of litigation enable a party to subpoena other parties for records or other evidence. Sometimes the law also invests the power to subpoena in an official who conducts investigations, such as a government auditor or an inspector general. If a party abuses the power to subpoena, by demanding irrelevant records or by issuing a demand with no regard for the cost of compliance, a court may sanction the issuer of the subpoena.