Evidence | Tort Lawsuit Defense
Insurance | Hidden Cameras | E-Messages
Law and politics give institutions incentive to collect and archive plentiful records. The best way to maintain plentiful records in practice is to archive email.
Records are evidence of due diligence and responsible corporate behavior. In the past, records were expensive to keep and manage. But costs are plummeting as information technology advances.
A case in point: The use of a taser in police work is controversial because, legally speaking, officers should use it only when circumstances warrant. But proving, after-the-fact, what the circumstances were can be difficult. So the company that makes tasers sees an opportunity. Recognizing that the cost of gathering and storing video evidence is declining, the company has developed a video camera for police officers to wear while on duty. The camera will capture trainloads of data. The company has further developed a technology for economically storing and managing that data. Veronica Dagher, “New Taser 'Shoots' Evidence,” Wall St. J., Sept. 2, 2009.
Update: A police officer in Fort Smith, Arkansas, was wearing a video camera when he fatally shot a gunman, November 2009. The police department released the video record to local media. The local prosecutor investigated the shooting, and part of the investigation included review of the video record. The prosecutor concluded that the officer acted lawfully, as he had ordered he gunman nine times to drop the gun he was pointing at officers.
Insurance
For an enterprise like a police department or a doctors' office, greater quantities of records can mean reduced risk of liability for negligence (tort). Good records support a defendant’s position that its people exercised due care and it therefore is not liable.
For physicians, lawyers and other professionals, classic advice for the avoidance of malpractice claims is to make and retain thorough records of services performed.
Hidden Cameras
In this technological age, hidden cameras and surprise evidence are becoming more common. They can embarrass an organization, as they did ACORN, a high-profile advocacy group for the poor.
Yet, surprise evidence may evaporate if the organization maintains its own detailed records that counteract the surprise. Example: In the famous murder prosecution of Carolyn Warmus, a key issue was whether she placed a phone call to a gun shop. At trial, her defense team produced “surprise evidence” – an original telephone bill – showing she did not make the call. But the evidence backfired because the prosecution established that the “original” bill was in fact a forgery. It did so by drawing on secure computer records at the telephone company and testimony from a telephone company employee.
Electronic Message Archival
The electronic records in an enterprise such as a government agency are often in diverse formats and locations, which makes long-term retention and management difficult. The enterprise therefore has incentive to emphasize the archiving of electronic messages such as e-mail. Three reasons:
1. Electronic messages represent a detailed, time-stamped diary of many of the day-to-day activities and intentions of the executives and staff at the enterprise.
2. The IT industry has fielded numerous, competitive products for archival of enterprise electronic messages. Good archive products support economical retention and rigorous searching of records. Good archival includes storage of records in a non-proprietary format like XML.
3. If electronic messages are the focal point for record archiving, then the enterprise can direct employees to use electronic messages generously as the journal of their activities. Journaling can include attaching to email documents like spreadsheets or (short) videos.
–Benjamin Wright
Mr. Wright teaches the law of data security and investigations at the SANS Institute.
office
September 11, 2009
July 14, 2009
Data Loss Prevention Strategy
Transparency as Compliance with Data Security Regulation
How are data holders to comply with the swelling riot of data security laws? These laws include breach notification laws, which require that individuals and/or government be notified when the security of private data has been compromised. Perfect compliance is impossible.
Almost all the states have adopted breach notice laws – though they are not uniform – and legislatures are expanding the scope of the laws.
The original law from California (effective six years ago) focused on identity information – name plus social security number, driver’s license number or financial account number. Then the California legislature expanded its law to also include breaches of medical data. That expansion became effective January 1, 2009. Result? In the first five months of 2009, California authorities were notified of a whopping 823 healthcare data breaches, mostly through self-reporting by healthcare entities. That’s just one industry, in one state, in five months. And California authorities anticipate that the flow of notices will rise as people in the healthcare community become better aware of the new law.
A data breach can occur in myriad ways: a misdirected fax or e-mail, a hacking incident or snooping by an employee.
Meanwhile, we see floods of breach notices issued in other states and other industries – retail, nonprofit, colleges, financial, professional services, water districts, school districts, county government, municipal government, state government, federal government. No organization is immune. As these laws sit longer on the books, the flow of notices grows larger and larger.
Why are there so many notices? The reason is that the laws assume that 100% data privacy can reasonably be achieved. They further assume that any shortcoming (or suspected shortcoming) of data privacy should be an unusual event within well-managed enterprises. The assumptions are wrong.
The expectations of the public, and especially the expectations of policy makers, are out of touch with the reality of modern data management. These outsized expectations contribute to a growing risk of monetary liability on the part of data holders.
So what are data holders to do? Obviously they need to invest in data security, training and investigation – and they have been. But banks, schools, utilities, clinics, hospitals, merchants and government agencies can throw massive investments at this problem and never meet present expectations.