Electronic Data Records Law | How to Win E-Discovery

Attorney-Client Privilege | Work Product

Labels | Banners

Computers can influence the legal posture of an internal investigation.

Two legal doctrines can shield investigation-related communications from disclosure in court or in pre-trial e-discovery.  The first doctrine is attorney-client privilege, which ensures that communications between an attorney and his client remain confidential. The second doctrine is attorney work-product, which prevents disclosure to adversaries of materials prepared by an attorney for a client in anticipation of litigation.

The scope of these two doctrines can be controversial in particular cases.  Often, courts hold that records of a routine internal audit (or business audit) within an enterprise are not protected by either doctrine, even though a lawyer may have been involved or litigation may have been one of the reasons for the audit.  Edna Selan Epstein, The attorney-client privilege and the work-product doctrine, Volume 1, page 356 et seq.

The division between a mere internal audit, on the one hand, and a protected communication or record, on the other, can be open to interpretation.

That interpretation can be influenced by labels, notices and designations.  A tag or notice on a report declaring that it is protected can help persuade a court that in fact it is entitled to protection.  Example: “Confidential. This record is protected attorney-client communication and attorney work product to formulate legal advice in preparation for dispute.”

Privilege

According to a leading legal commentator, a notice declaring attorney-client privilege is “like chicken soup” for an illness. Though it's not guaranteed to succeed as a self-fulfilling declaration of legal status, it might help and normally won't hurt.  Edna Selan Epstein, The attorney-client privilege and the work-product doctrine, Volume 1 , 2007, page 877. 

Such a notice tends to show the belief, mindset and intention of the parties at the time, all critical factors in determining whether the privilege exists in a given situation.  "The professional relationship for purposes of the privilege hinges upon the belief that one is consulting a lawyer and his intention to seek legal advice.” Wylie v. Marley Co., 891 F.2d 1463, 1471 (10th Cir. 1989).

Liberal posting of labels, notices and designations is easier with computer technology.  Computers can facilitate the recording of investigative activities like meetings and interviews – in such a way that the proceedings are labeled as protected.  For example, a meeting can be held by video conference, online text forum or virtual meeting space, where all activities are recorded and a banner reads, “Confidential. This is protected attorney-client communication and attorney work product to formulate legal advice in preparation for dispute.”

Computer video enables easy recording of in-person meetings, where displays of the meetings distributed to participants show the protection banner.  (Some might call the placement of such a banner on a video display an example of augmented reality.  Wired Magazine suggests that tablet computers like iPad will become like windows on the world, where, for instance, users prop them up in a live meeting to record it and see the banners and other augmentation that enrich the experience.  Steven Levy, “Tabula Rasa: Why the new generation of tablet computers changes everything,” Wired, April 2010.)

Work Product

The absence of a lawyer's participation in the preparation of a report reduces the likelihood a court would consider it an attorney work product.  Edna Selan Epstein, The attorney-client privilege and the work-product doctrine, Volume 1, page 918. The reason is that the work product doctrine is intended to prevent disclosure of the lawyer's thinking, and nothing more.  The earmark of a report containing a lawyer's thinking is her participation in the creation of it.

Substantive involvement of a lawyer in the creation of a report is easier and less expensive with computer communication.  For instance, computer communication allows a remote lawyer to peer in on a meeting via video; he might be observing and occasionally commenting from a small window opened on his desktop monitor while he simultaneously attends to other projects.  Computers can allow a distant lawyer periodically to review the activities of an e-discovery specialist as she searches through email archives.  This video demonstrates a remote lawyer participating in an interview via webcam on his laptop:

  Technology allows logging of the specifics of a lawyer's active participation (e.g., lawyer viewed at x time, submitted comment or instruction at y time), together with a banner showing belief and intention that the report is attorney work product.

–Benjamin Wright

Attorney Wright teaches the Law of Data Security and Investigations at the SANS Institute.

Update 2013: An experienced trial lawyer advised me that normally you would not want to claim privilege and work product in the same record.  The record is subject to either one or the other but not both.  If you claim both a court might conclude you did not pecisely apply either the privilege doctrine or the work product doctrine.

Risk Mitigation | Email Archive

Evidence | Tort Lawsuit Defense

Insurance | Hidden Cameras | E-Messages

Law and politics give institutions incentive to collect and archive plentiful records.  The best way to maintain plentiful records in practice is to archive email.

Records are evidence of due diligence and responsible corporate behavior.  In the past, records were expensive to keep and manage. But costs are plummeting as information technology advances.

A case in point:  The use of a taser in police work is controversial because, legally speaking, officers should use it only when circumstances warrant.  But proving, after-the-fact, what the circumstances were can be difficult. So the company that makes tasers sees an opportunity.  Recognizing that the cost of gathering and storing video evidence is declining, the company has developed a video camera for police officers to wear while on duty. The camera will capture trainloads of data.  The company has further developed a technology for economically storing and managing that data. Veronica Dagher, “New Taser 'Shoots' Evidence,” Wall St. J., Sept. 2, 2009.

Update:  A police officer in Fort Smith, Arkansas, was wearing a video camera when he fatally shot a gunman, November 2009.  The police department released the video record to local media.  The local prosecutor investigated the shooting, and part of the investigation included review of the video record.  The prosecutor concluded that the officer acted lawfully, as he had ordered he gunman nine times to drop the gun he was pointing at officers.


Insurance

For an enterprise like a police department or a doctors' office, greater quantities of records can mean reduced risk of liability for negligence (tort).  Good records support a defendant’s position that its people exercised due care and it therefore is not liable.

For physicians, lawyers and other professionals, classic advice for the avoidance of malpractice claims is to make and retain thorough records of services performed.


Hidden Cameras

In this technological age, hidden cameras and surprise evidence are becoming more common.  They can embarrass an organization, as they did ACORN, a high-profile advocacy group for the poor.

Yet, surprise evidence may evaporate if the organization maintains its own detailed records that counteract the surprise.  Example: In the famous murder prosecution of Carolyn Warmus, a key issue was whether she placed a phone call to a gun shop.  At trial, her defense team produced “surprise evidence” – an original telephone bill – showing she did not make the call.  But the evidence backfired because the prosecution established that the “original” bill was in fact a forgery.  It did so by drawing on secure computer records at the telephone company and testimony from a telephone company employee.


Electronic Message Archival

The electronic records in an enterprise such as a government agency are often in diverse formats and locations, which makes long-term retention and management difficult.  The enterprise therefore has incentive to emphasize the archiving of electronic messages such as e-mail. Three reasons:

1. Electronic messages represent a detailed, time-stamped diary of many of the day-to-day activities and intentions of the executives and staff at the enterprise.

2. The IT industry has fielded numerous, competitive products for archival of enterprise electronic messages.  Good archive products support economical retention and rigorous searching of records.  Good archival includes storage of records in a non-proprietary format like XML.

3. If electronic messages are the focal point for record archiving, then the enterprise can direct employees to use electronic messages generously as the journal of their activities.  Journaling can include attaching to email documents like spreadsheets or (short) videos.

–Benjamin Wright

Mr. Wright teaches the law of data security and investigations at the SANS Institute.

Electronic Discovery Professional Duty

Falsehoods and Duty of Confidentiality

What is an e-forensics specialist to do when she discovers her client has been lying to her?  Typically this kind of computer specialist is hired to find, audit and report on electronically stored information (ESI).  If the specialist has been making representations to others -- such as a court, an internal investigator or an inspector general who has issued a subpoena, on the basis of what she now knows to be lies, she is in a bind.  Like any professional working for a client on a sensitive matter, the specialist will likely owe the client a duty of confidentiality.  Normally she will have signed a non-disclosure agreement. 

How to Preserve Reputation?

The specialist’s reputation is at stake. Obviously, to disassociate herself from misrepresentation, she can withdraw from the engagement.  But she fears that the third party will continue to rely on her representations, which are no longer well-founded. 

A practical technique available to this specialist is known as the noisy withdrawal.  Although noisy withdrawal is most commonly known from cases where lawyers learn that their clients have been lying to them, the technique is a responsible measure available any ethical professional.  

In a noisy withdrawal a professional announces that he is withdrawing from representation of his client. In addition (this is the noisy part) he declares to interested third parties that he disaffirms his prior statements made on behalf of the client.  With the noisy withdrawal, the professional aims to preserve his own credibility, without compromising the client’s secrets.  He does not reveal why he is withdrawing, why he is disclaiming prior statements or any information his client has told him.

Examples of Noisy Withdrawal

A recent example of a noisy withdrawal occurred in the investigation of Stanford Financial Group. Attorney Thomas Sjoblom had represented the firm before the Securities and Exchange Commission as it examined alleged fraud, corruption and irregularities.  But then he made a noisy withdrawal from the engagement.  Observers surmised that as the case progressed he had come to disbelieve what his client had been telling him. Kara Scannell, “Top Lawyer’s Withdrawal from Stanford Case Waves a Flag,” Wall Street Journal, Mar. 6, 2009.

Another famous example transpired in the Whitewater investigation during the Clinton presidential administration.  Legendary ethics expert Sam Dash made a noisy withdrawal when the Whitewater Independent Counsel wrongly gave the impression that Professor Dash endorsed the Counsel’s conduct.  (By the way, prior to this story, the late Sam Dash was my ethics professor in law school.  Over the long run, I hope Professor Dash’s teaching helps me stay out of trouble!)

–Benjamin Wright

Mr. Wright teaches cyber defense law at the SANS Institute, where he emphasizes the role of ethics and savvy public communications.