Electronic Data Records Law | How to Win E-Discovery

City Government | Deleted Official E-mails

Expensive Forensic Recovery | Political Cover-up? | State Retention Schedule

Compliance with e-mail retention law is not easy.  Email in an enterprise like a municipal government is voluminous.  And at city hall failure to keep required electronic mail records can look like a scandal, where it appears officials are trying to cover-up the truth about something important.

Hence, the City of Boston has hired a forensic specialist to attempt to recover the destroyed e-mails of an aide to the mayor.  As part of the specialist's investigation, he or she might look on PC hard drives and in network backup tapes to locate erased records.

Forensic retrieval of email is costly.  The expense of forensics quickly exceeds whatever the city might have been saving by not implementing a comprehensive email archival system in the first place.  Had the city foreseen it would eventually be forced to restore deleted e-mails, it would have readily seen the need for good archival as a matter of good IT management.

The city did have an archival program, but it only pertained to emails that had resided in a user’s inbox for more than 90 days.  In other words, the program gave decision-making responsibility to users.  If users decided to delete records before 90 days, then the records would not be archived.  Among the problems with giving users such decision power is that users are rarely qualified (and rarely have the time) to exercise the required judgment.  Further, a user has a conflict of interest.  If a record reflects negatively on the user, she naturally prefers to destroy it.

Generally speaking, the Massachusetts state record retention schedules applicable to city government require that email correspondence of “no informational or evidential value” be retained a minimum of two years. 

But just instituting a policy that all e-mail be kept two years does not solve all of the city’s record retention problem.  Many e-mails must be retained for various longer periods, depending on content.  To examine email content and determine that this record needs X retention period and that record needs Y retention period is very, very difficult in practice.  In fact, I am skeptical that such one-by-one examination can be done effectively in government across many users over an extended period of time. (If you dear reader know of any case study showing it can be done, I cordially invite you to point me to that study!)

Under the auspices of Messaging Architects, I led a workshop on this topic with the stakeholders (IT, HR, legal department et al) in Jackson County, Oregon, February 2009. The conclusion was that the county government would archive all e-mail (spam excluded) more or less indefinitely.

–Benjamin Wright, Senior SANS Instructor for e-Discovery and e-Record Retention Law

Porn | Employee Computers

Hostile Workplace Lawsuits in the Age of Networked Computers

In the workplace, electronic pornography is legal poison.  A singular lawsuit against the Chicago Police Department demonstrates the value of technical measures to filter, screen or block porn (including lewd spam).

In a hostile workplace lawsuit against an employer (whether private sector or government), the existence of porn on work computers or in work e-mail systems can be highly prejudicial.  Even though the employer objected to porn and enforced an explicit policy against it, its presence can reflect horribly on the employer as a case goes to a public courtroom.

In Williams v. City of Chicago (US Dist Ct, N.D. Illinois, E Div 03C2994, Jul 13, 2004), e-pornography backed the police department into an indefensible position.  Officer Williams had complained more than once about a sexually offensive work environment, including both foul comments by co-workers and nasty images on computers (e-mail and otherwise).

The department had a formal policy against such behavior, and Ms. Williams' supervisors endeavored to uphold that policy.

In pursuit of the policy, supervisors had promptly investigated and responded to her complaints, including removal of pornography.  The city argued that on account of its good policy it should be entitled to "summary judgment" in the case. Under summary judgment, the city would win the case before it went to the jury.

However, the court ruled there was insufficient evidence to award summary judgment to the city. In other words, the court said the case should go to a jury for decision.   According to the court: "If the jury determines that pornography was so prevalent that the City should have known about it, the jury could conclude that the City was negligent in discovering the harassment.  Similarly, if the jury determines that the City knew about the pornography because others had complained about it, the jury could conclude that the City was negligent in remedying the harassment."

Wow.  How can the police department (or a sherrif's office) withstand a jury trial focused on the amount of pornography on the department's computers?  Such a public trial would be highly embarrassing, even if the department eventually won the case!  The local media would have a field day.  At this point, the city has strong incentive to settle – at considerable expense – with Ms. Williams.  (I can't tell from the court's opinion whether the city did settle with Mr. Williams, but I'll bet it did.)

Behold the city's unenviable position.  Even after it settles, its problem remains.  The continued presence of Internet pornography can prejudice the city in future cases brought by future employee-plaintiffs, just as it did in Ms. Williams' case.  A case could rise directly from sexual harassment allegations, or from allegations of retaliation following a complaint about porn.

I therefore argue an employer like this police department has good reason to seek technical measures to mitigate its problem.  Although technical filters and blocks are imperfect, they can materially reduce the quantity of pornography in workplace e-mail and systems.

–-Benjamin Wright

 Mr. Wright teaches Internet Records and Security Law for the SANS Institute, where he covers topics like investigations into cybertheft and HR allegations.

E-Discovery Strategy, Search & Artificial Intelligence

E-mail Archive Policy

In a legal dispute, you want as much of two assets as you can get – evidence and brainpower.  You want evidence to supply facts so you can understand and support your side of the case.  And you want good analysis and judgment so you can assemble the best arguments and make the best decisions about how to manage your case.  

Since e-discovery affects both evidence and brainpower, it is revolutionizing litigation and, more generally, all manner of investigations (whether they be investigations of bribes, kickbacks, corruption, espionage, overcharges, misallocation of funds, abuse of power, breach of trust or any other misconduct). 

Litigation Dynamics

A lawsuit today is not your father’s lawsuit.  The advent of electronic records like e-mail causes the quantity of records potentially relevant to a lawsuit/investigation to swell beyond imagination.  In any dispute, this profusion of records opens vast opportunity to those able to exploit it.  Smart litigants today (a) welcome oceans of records, and (b) seek advanced analytics and artificial intelligence to glean from those oceans the best case.

Lesson From Tyco Scandal

Observe the lesson from the Tyco International scandal (white collar crime). Chief Executive Officer Dennis Kozlowski and Chief Financial Officer Mark Swartz were convicted (under New York law, even though Tyco's headquarters was in New Hampshire) for taking money from the company.  They said the money was authorized compensation, approved by the board of directors, but top decisions at the company were poorly documented. Company leaders did business the old-fashioned way, with voice conversations and handshakes.  Hence the records to support CEO Kozlowski’s and CFO Swartz’s side of the case were thin. Dan Ackman, “Tyco Trial II: Verdict First, Law Second,” Forbes, June 17, 2005.  

But compare the case of Tyco’s General Counsel, Mark Belnick. Like his bosses Kozlowski and Swartz, Belnick went to trial for allegedly stealing money from the company (misappropriation of funds and assets). Yet the jury acquitted him.  The jurors could not find him guilty, even though they “felt he was morally guilty”. Why? The jury was persuaded "Everything that he got was documented through e-mails and memos . . ." Steve Fishman, “The Convert,” New York Magazine, August 2, 2004.

Records Make the Difference in Trial

Wow.  The difference between Kozlowski and Swartz, who are in jail, and Belnick, who is free, was records.  The bosses didn’t have them, but Belnick did.  The existence of those records, and the ability of Belnick’s defense team to assemble them into a credible story was crucial to his case.  Belnick's story is a lesson about the Information Age.  In the age of abundant digital records, advantage goes to the party who can better marshal records.  

[Update:  In another heartening Information Age story, digital records come to the rescue of a falsely accused defendant.  Defendant proves he did not commit murder by drawing on (a) New York City transit authority records showing his whereabouts based on metrocard found in his wallet at time of arrest; (b) timestamped photo showing him cashing payroll check; and (c) records of when he clocked out at work.] 

Success with Electronic Records

I therefore argue enterprises are wise not to fear e-discovery, but rather to embrace it.  They should relish systematic archival of massive records (including new things like Twitter tweets, voicemail-converted-to-text, cell phone text messages, iPhone calendar alarms, BlackBerry mail, smart phone SMS), and seek tools, including artificial intelligence, that enable brilliant searching and sifting through those archives.  They thereby position themselves to capitalize on unexpected or nuanced discoveries within their records.  I’ve published more big-picture observations about e-discovery in this blog.