Electronic Data Records Law | How to Win E-Discovery

E-mail Records: Friend or Foe?

Electronic Mail Snippets Viewed in Context

For honest people, email records can often be their best defense.  Ask Matthew Tannin and Ralph Cioffi, former hedge fund managers for Bear Stearns.  Their detailed email records persuaded a criminal jury to acquit them.  That is, the jury could not find them guilty of fraud or dishonesty, as prosecutors alleged.

Thank goodness Bear Stearns did not follow the common legal advice to destroy email quickly.  Many lawyers recommend deleting email and text
messages quickly because they can provide adversaries scraps of conversation that can be misconstrued and taken out of context. 

Many lawyers and archivists recommend, for example, that email systems be configured to purge email, by default, after only 15 days or 30 days.  Such recommendations are always supplemented with the requirement that employees do something that is impractical – i.e. read all of their emails and promptly take affirmative action to keep those that are important records while allowing the others to be purged.  Experience shows that requirement is routinely ignored in practice because employees just don't have time to follow it.

In the Tannin-Cioffi case, prosecutors said the defendants were dishonest and lying to fund investors.  As evidence, the prosecutors pointed the jury to small passages clipped from emails.  In one e-mail, Tannin observed “simply no way for [the fund] to make money – ever.”  Prosecutors said this statement proved Tannin lied to investors because a few days later he expressed on a conference call his comfort with the fund’s prospects.  Amir Efrati and Peter Lattman, “U.S. Loses Bear Fraud Case,” Wall St. Journal, Nov. 11, 2009.

Some lawyers think juries are so dumb they will consider no more evidence than a few words from an email.

But in fact the Tannin-Cioffi jury considered a lot more.  It evaluated the context of that snippet of words.  It weighed the entire e-mail from which the snippet was clipped.  Amir Efrati, “Bear Loss Besets Prosecutors,” Wall St. Journal, Nov. 12, 2009.  Further, the jury considered many other emails between the men.  The jury noted for example that during the time that the prosecutors said the men had given up on the fund, their email records suggested they were working furiously hard to save it.  The jury focused on one e-mail exchange showing them working at 4 in the morning!

Notice how the detailed timestamp (metadata) on the email saved these alleged white collar criminals from jail.  Old fashioned paper letters did not record such a rich diary of business activities.  Here the electronic diary depicted the defendants doing the right thing. 

For good business people, lengthy, complete email and text message records -- including all the metadata -- are a friend.

The only people who have incentive to destroy their electronic message records quickly are mobsters, the Mafia.  They of course are motivated to toss all the smoking guns and dead bodies into the river.

Update:  Former AIG executive Joseph Cassano is also thankful for plentiful records.  Records saved him from criminal prosecution for allegedly hiding problems with AIG's mortgage-related investments in 2007.  Although prosecutors were on the verge of indicting him, notes taken by outside auditor PwC suggested that he had disclosed the problems.

–Benjamin Wright

Mr. Wright often serves as a public speaker on technology law for groups like CPA societies or Institute of Internal Auditors.  Here is an ARMA podcast describing Messaging Architects' work in e-mail archiving, including its workshop (led by Mr. Wright) for development of an email records policy in an enterprise.

Data Loss Prevention Strategy

Transparency as Compliance with Data Security Regulation

How are data holders to comply with the swelling riot of data security laws?  These laws include breach notification laws, which require that individuals and/or government be notified when the security of private data has been compromised.  Perfect compliance is impossible.

Almost all the states have adopted breach notice laws – though they are not uniform – and legislatures are expanding the scope of the laws.  

The original law from California (effective six years ago) focused on identity information – name plus social security number, driver’s license number or financial account number.  Then the California legislature expanded its law to also include breaches of medical data. That expansion became effective January 1, 2009.  Result?  In the first five months of 2009, California authorities were notified of a whopping 823 healthcare data breaches, mostly through self-reporting by healthcare entities. That’s just one industry, in one state, in five months.  And California authorities anticipate that the flow of notices will rise as people in the healthcare community become better aware of the new law. 

A data breach can occur in myriad ways:  a misdirected fax or e-mail, a hacking incident or snooping by an employee.

Meanwhile, we see floods of breach notices issued in other states and other industries – retail, nonprofit, colleges, financial, professional services, water districts, school districts, county government, municipal government, state government, federal government.  No organization is immune.  As these laws sit longer on the books, the flow of notices grows larger and larger.

Why are there so many notices?  The reason is that the laws assume that 100% data privacy can reasonably be achieved.  They further assume that any shortcoming (or suspected shortcoming) of data privacy should be an unusual event within well-managed enterprises.  The assumptions are wrong.  
The expectations of the public, and especially the expectations of policy makers, are out of touch with the reality of modern data management.  These outsized expectations contribute to a growing risk of monetary liability on the part of data holders.

So what are data holders to do?  Obviously they need to invest in data security, training and investigation – and they have been.  But banks, schools, utilities, clinics, hospitals, merchants and government agencies can throw massive investments at this problem and never meet present expectations.