Electronic Data Records Law | How to Win E-Discovery

Electronic Mail Message Forged

Electronic Evidence | Forensics and Authentication in Police Investigation

For responsible parties like corporations and government agencies, a reason to retain all their e-mail, text and instant message records is to refute forgeries of e-records.  Thorough email archives (including each attachment) provide forensic evidence to invalidate false claims.

Just ask Australia’s prime minister, Kevin Rudd.  His political opponents tried to embarrass him with an electronic mail record purportedly from his senior advisor Andrew Charlton.  The e-mail appeared to show corruption; it appeared to show Rudd’s government conferring a business advantage to Rudd’s friend John Grant.

But fortunately for the government, it retained its own e-mail records for the time in question.  An investigation revealed that the scandalous e-mail was a forgery!

The investigation proceeded in two steps. First it examined the alleged sender’s digital records.  “Searches by the Department of Prime Minister and Cabinet and Treasury of Dr Charlton's computer and the system of the public service had found nothing.  ‘There have been exhaustive searches conducted on Dr Charlton's computer email system and no such correspondence can be found,’ Mr Rudd said.”

Second, the Australian Federal Police (equivalent to FBI) conducted a forensic analysis of two computers used by the purported receiver of the e-mail.  "Preliminary results of those forensic examinations indicate that the email referred to at the centre of this investigation has been created by a person or persons other than the purported author of the email," said the AFP.

This revelation of course played to the Prime Minister’s distinct advantage.  He could show that his adversaries had based their attack on misrepresented facts.

The Strategy Lesson:  Unless you are a criminal, your e-records are your friend.  Had the government been destroying its records quickly, it would not have been so capable of exposing this fraud.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader on ESI investigations.

Electronic Discovery Professional Duty

Falsehoods and Duty of Confidentiality

What is an e-forensics specialist to do when she discovers her client has been lying to her?  Typically this kind of computer specialist is hired to find, audit and report on electronically stored information (ESI).  If the specialist has been making representations to others -- such as a court, an internal investigator or an inspector general who has issued a subpoena, on the basis of what she now knows to be lies, she is in a bind.  Like any professional working for a client on a sensitive matter, the specialist will likely owe the client a duty of confidentiality.  Normally she will have signed a non-disclosure agreement. 

How to Preserve Reputation?

The specialist’s reputation is at stake. Obviously, to disassociate herself from misrepresentation, she can withdraw from the engagement.  But she fears that the third party will continue to rely on her representations, which are no longer well-founded. 

A practical technique available to this specialist is known as the noisy withdrawal.  Although noisy withdrawal is most commonly known from cases where lawyers learn that their clients have been lying to them, the technique is a responsible measure available any ethical professional.  

In a noisy withdrawal a professional announces that he is withdrawing from representation of his client. In addition (this is the noisy part) he declares to interested third parties that he disaffirms his prior statements made on behalf of the client.  With the noisy withdrawal, the professional aims to preserve his own credibility, without compromising the client’s secrets.  He does not reveal why he is withdrawing, why he is disclaiming prior statements or any information his client has told him.

Examples of Noisy Withdrawal

A recent example of a noisy withdrawal occurred in the investigation of Stanford Financial Group. Attorney Thomas Sjoblom had represented the firm before the Securities and Exchange Commission as it examined alleged fraud, corruption and irregularities.  But then he made a noisy withdrawal from the engagement.  Observers surmised that as the case progressed he had come to disbelieve what his client had been telling him. Kara Scannell, “Top Lawyer’s Withdrawal from Stanford Case Waves a Flag,” Wall Street Journal, Mar. 6, 2009.

Another famous example transpired in the Whitewater investigation during the Clinton presidential administration.  Legendary ethics expert Sam Dash made a noisy withdrawal when the Whitewater Independent Counsel wrongly gave the impression that Professor Dash endorsed the Counsel’s conduct.  (By the way, prior to this story, the late Sam Dash was my ethics professor in law school.  Over the long run, I hope Professor Dash’s teaching helps me stay out of trouble!)

–Benjamin Wright

Mr. Wright teaches cyber defense law at the SANS Institute, where he emphasizes the role of ethics and savvy public communications.

EuroSox: Audit, Disclosure for Corporations

E-mail Archives For Control and Contract Enforcement in Europe

European enterprises feel impelled to improve internal controls, and retention of e-mail records must play a role.  

For years government authorities have sought greater accountability and transparency among European companies, and greater uniformity in financial reporting.  This campaign has led the European Union to adopt amendments to the following: 4th directive 78/660/EEC (annual accounts of specific type of companies), 7th directive 83/349/EEC (consolidated accounts) 8th directive 84/253/EEC (auditor and audit committee requirements).  

In accordance with these amendments, individual EU member countries are now implementing new national law.  Informally known as “EuroSox” (a nod toward the US Sarbanes-Oxley Act - SOX), these laws reflect modern expectations that institutions open themselves to much greater outside scrutiny, through disclosure and third-party review.  

Although the details can vary from country to country, the broad message is clear:  publicly-held companies and larger public enterprises are expected to pay greater heed to responsible governance and internal control.

A critical part of modern internal control is electronic mail.  E-mail records (and other electronic messages records such as instant message) show who was delegated responsibility for what and when. They show what the terms of business deals were.  They deter the creation of false accounting books.

See for example the UK case Hall v Cognos Limited (Hull Industrial Tribunal 1803325/97).  Cognos’ company policy was not to reimburse employee expenses more than six months after they were incurred. That policy was part of the larger, written employment contract between the company and salesman Hall. The employment contract stated it could be modified only by a signed writing.  Then a superior agreed by e-mail to depart from the policy and reimburse Hall for certain old expenses. When the company failed to honor this commitment, Hall sued.  The court held the e-mail (when printed out) was in fact a signed writing that amended the employment contract.  Therefore, the court enforced the agreement to reimburse the expenses.

E-mails need to be kept (in a way that facilitates searching) so that third parties –- that is, auditors -- can review transactions and relationships after the fact.  They enable investigations into issues like fraud, bribes, kickbacks, corruption, tax evasion, false pretenses, misrepresented facts, government waste, misappropriation of funds-assets, executive abuse of assets.  As internal control grows in importance in Europe, the old practice of deleting business e-mail and text messages quickly looks more and more archaic.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, global provider of electronic archival solutions.