Electronic Data Records Law | How to Win E-Discovery

Email Retention | Public Audit & Administration

German Laws, Orders, Regulations and Instructions

Affinity with Local (County) US Government

What does the law expect of electronic government records?   Records enable governments to be transparent.  If government keeps good records of its activities and gives citizens easy access to them, then citizens can review government and hold it accountable.

Today most government records are electronic.  Accordingly, the German federal government seeks to archive its electronic records, including e-mail.  A key initiative under the Federal Ministry of the Interior is DOMEA, a project that sheds light on the legal expectations for e-government records, including electronic mail. 

The DOMEA project recognizes that: “Electronic records . . . have to meet the requirements for record keeping in public administrations, which are prescribed in laws, standing orders, regulations  and instructions.  They include important points, such as: 

“1. The completeness, integrity and authenticity of official records, which means that official documents cannot be subsequently altered, changed, removed, destroyed or deleted. 

“2. The records principle of public administration, which means that documents have to be appropriately joined together in systematically arranged subject files according to the functions of a particular office. 

“3. The accountability and lawfulness of administrative procedures, which means that accountabilities and responsibilities have to be documented in records in the course of business and that the state of affairs and the development of transactions in a given case has to be completely evident in records at any time.”

Of course, the validity of these legal standards is not limited to Germany or even Europe.

If these are the legal standards for government records, then query whether popular enterprise e-mail systems such as Microsoft Exchange and Novell Groupwise are designed to meet these standards. Generally speaking, they are not.  They do not support efficient storage, management, protection and searching of vast quantities of e-mail records, collected from a large population of users over an extended period of time.  That’s one reason enterprises like governments commonly have policies to destroy most e-mail relatively quickly, such as 90 days after transmission.

But e-mail has become central to the administration of modern government.  Very often, e-mail documents official transactions and official delegations of responsibility.  It also empowers internal audits and investigations (by for example inspectors general) for fraud, waste, corruption, mismangement and misappropriation of funds.  

For some time organizations such as governments have relied on ad hoc methods for retaining e-mail – including the print-and-file method.  But e-mail is so voluminous and has become so important that ad hoc solutions are failing.  

Last week I led an on-site workshop with the staff of a mid-size county government struggling with this problem. Staff representatives hailed from IT, counsel, finance, administration, internal audit, human resources, risk management and public health services.  The county’s e-mail system is Groupwise.  The staff concluded that the county needs, in addition to Groupwise, a dedicated e-mail archive appliance. The workshop enabled the staff to write new, modern policy on e-mail archival.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigation law at the SANS Institute.

He is an advisor to Messaging Architects, where he leads an in-house workshop to help the stakeholders in an enterprise craft workable policy on the management of email and other eRecords.

P.S.  New Mexico's Attorney General (AG) indicted the state's former Secretary of State (SoS) for tax evasion and money laundering tied to alleged kickbacks to her by the recipient of federal grant money.  Stephanie Simon, "New Mexico Roiled by New Graft Case," Wall Street Journal, August 22 -23, 2009.  Among other things, the indictment alleged that the defendant advanced her crime by fabricating two official records in 2004 -- a paper letter and a paper memo.  The indictment came on the heels of thorough document reviews by both federal and state auditors.  The auditors said the Secretary of State's office maintained poor records on its management of federal grant money.  Email records (which are very hard to forge or spoof successfully) were sparse if non-existent.  Furthermore, the Secretary of State's office says it keeps financial records only three years after the close of the fiscal year.  Now, the AG and the ex-SoS disagree sharply over the allegations.  Had the SoS's office maintained more detailed and complete records (including archived email, supported by time-stamps and other audit trails), this disagreement might now be resolved.  Either (a) the ex-SoS would have been deterred at the outset from corruption for fear that the records would betray her, (b) the records would clearly exonerate the ex-SoS, or (c) the records would unambiguously demonstrate the ex-SoS's guilt.

Investigating Staff Graft or Misconduct

Electronic Records for Audit, Ethics and Internal Control

If an institution – any institution – is to maintain its reputation, it must be prepared to investigate the actions of its employees (personnel).  Inevitably, allegations will arise that this or that employee embezzled, acted unethically, abused authority, laundered money, executed an unauthorized trade or simply made a mistake.  Power to conduct internal investigations is critical to government agencies and for-profit corporations, as well as charity, non-profit, and educational organizations.

Modern investigations today are different from those of the past, by virtue of the presence of digital records. The sheer quantity of e-records (e-mail, text, chat or instant messages, logs, meta-data, photographs, blog comments, surveillance videos, and on and on and on) is mushrooming beyond comprehension.  When an institution undertakes to audit whether a superior harassed a subordinate, an accountant misunderstood a tax liability or an administrator wrongfully tolerated a conflict of interest, a brimming corpus of electronic records can be available for examination . . . and can facilitate a just outcome.  The records can shed welcome light on whether the subject of the investigation did what is claimed, or did not do it.

A case in point is an investigation at Yale University, a regular recipient of research grants from the federal government.  Prosecutors alleged that academics at Yale had misallocated federal money (funds or assets) by (a) transferring grant funds to accounts that were not intended for the grants in question, and (b) paying themselves for summer activities using money from grants not earmarked for those activities.

In other words, the government claimed professors and staff played fast and loose in interpreting the purpose of specific grants.

In the face of such allegations, an institution has no choice but to cooperate with government.  (Which university wants to be the subject of an adversarial police raid in search of computer records?) Yale launched a massive investigation, covering some $3 billion in grants over seven years (2000-2006). It turned over more than a million pages of documents.  No doubt the massive quantity of records included email and other computer-based records.  (A similar corruption probe in the 1980s could not have yielded as many records because computers and e-mail were not as pervasive then.)  The college settled the matter in 2008 by agreeing to pay $7.6 million.  

Although Yale admitted it had made some errors, the government granted the school a release from further liability with respect to the years that were investigated.

$7.6 million is a relatively small penalty.  The university appears to have done itself three favors.  First, it had retained plentiful records for many years.  Second, it cooperated with the government and divulged rafts of records.  Third, when the allegations first arose, Yale instituted reforms preemptively, including tighter accounting controls and improved staff training.  The result was the imposition of only a small settlement payment.   And as for the future, Yale remains qualified to receive grants from the government. 

Had Yale produced fewer records, and displayed less transparency and less cooperation, the institution would not have fared so well.

I’ll bet the “errors” to which Yale admitted reflected past practices that had developed over decades, in an age when records were fewer and therefore government (inspectors general) had less ability to audit or investigate.

The incident teaches Yale staff (and staff at other institutions receiving federal grants) that they will be on a tighter leash for the future.  A digital informant is ready to snitch on them.  The super-plentiful e-records now being made about their daily activities expose them to greater review and accountability than was historically possible.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in records-dirven investigaions.  He also teaches Internet law at the SANS Institute.