Electronic Data Records Law | How to Win E-Discovery

Virtual Counterfeit Investigations

Consent, Contracts, Privacy Rights in the Information Economy

Professional investigators should read cyber terms of service.

Technology contracts like terms of service (ToS) and end user license agreements (EULAs) are having a growing impact on the execution and outcome of investigations . . . internal investigations,
private investigations, forensics examinations, law enforcement investigations, intellectual property investigations, cyber-theft investigations and many more.

Increasingly, social, business, academic and entertainment interaction occurs inside virtual environments.  These environments saturate modern life:  web pages, video games, online schools, social networks, digital media (books, music, movies) smartphone apps and corporate computer networks.

As users enter these environments, they are commonly required to agree to legal terms of use and access.  These agreements can govern official investigations that may come later.  These agreements can (and increasingly do) contain statements that users consent to official audits and probes and consent to limits on their privacy.

 

University Network Terms Applicable to Student

For example, when a freshman student at the University of Wisconsin attached his PC to the university's network, he agreed to terms of service, which included an acknowledgment that the university could execute IT security measures.  Later, when a university system administrator suspected that the student's PC was involved in an ongoing, dangerous hacking incident on the network, the administrator hacked remotely into the student's PC.  

While searching inside the PC, the administrator found evidence that incriminated the student in illegal hacking outside the university's network.  The university gave this evidence to government prosecutors, who attempted to use the evidence in a criminal trial against the student.  The student objected, on the grounds that the university had violated his privacy.  The court disagreed with the student.  The court said the student's privacy had not been violated because he consented – by virtue of the security clause in the network terms of service – to the search by the system administrator. US v. Heckenkamp

 

Social Network's Terms Authorizing Investigation

Here are example terms of service authorizing investigations, published by Zenbe, a social networking service for sharing information among friends:

Zenbe reserves the right to access, read, archive, monitor, and disclose any information it reasonably believes is necessary to:  1. enforce this Agreement, including investigation of potential violations hereof.  2. protect the rights, property or safety of Zenbe, its users and the public.  3. satisfy any applicable law, regulation, legal process or governmental request.  4. detect, prevent, or address fraud, security or technical issues, including the filtering of spam.

Terms like these can be relevant to monitoring users in online communities and business  transactions.

 

Terms for Investigationg Abuse of Online Games and Credits

Entrepreneurs are inventing new ways to transact business online.  They are devising myriad electronic credits, coupons, vouchers, discount codes, trading cards, play money, online property, virtual game pieces and more.  As they distribute these virtual goods and assets to users, their power to investigate their users is critical to nixing abuse, foiling hacks, thwarting counterfeits and maintaining the quality of their product or service.  Investigations are a growing component of the information economy.

A substantial method for entrepreneurs to police their products and services is to require users to click on terms of use that include power on the part of the entrepreneurs to investigate their users.

 

Terms for Internal Investigations

Some investigations are internal to an enterprise, as is the case with a human resources (HR) investigation.  The scope of an internal investigation can depend on contract terms or written employment policies.  For example, in Ontario v Quon, a police officer said his boss violated his privacy when the boss reviewed text messages the officer sent from his employer-issued pager.  In other words, he argued that his government employer violated his Fourth Amendment right to be free from unreasonable search.  However, the US Supreme Court held the employer did not violate privacy, in part because the officer had previously known by virtue of department policy that management could review (investigate) the content of messages exchanged through the department's equipment.

An employer or other organization that creates an electronic space is remiss if it lacks terms of use that include rights for official investigation.  Although those rights may exist without explicit statement in an agreement, the user's assent to them erodes her ability to object to an investigation when it happens.

 

Terms of Service Applicable to Professional Investigators

To be sure, terms in an agreement cannot legitimize an irresponsible investigation.  But terms can help clarify that the user was warned he could be scrutinized, records could be captured and evidence could be used against him.   They can clarify that as a condition to his treatment as an authorized user, he consents to monitoring and evaluation.

A professional investigator should take note when the subject of investigation has agreed to no relevant terms or agreement.  The lack of agreed terms can constrain the investigation.

Conversely the investigator should note whether multiple, overlapping terms of investigation apply simultaneously to a person under investigation.  For instance, suppose an investigator is engaged by the operator of a game app that works inside Facebook, and the investigator is examining whether Jane is abusing the game.  The game terms that Jane agreed to when she started the game may support the investigation.  The investigator may gather relevant evidence from game app’s network.

 

In addition, the terms of Facebook may support the investigation.  The investigator may be able to get help from Facebook.  Facebook, based on its terms of service, may be willing to cooperate with the investigation and turn over its own records about Jane.

–Benjamin Wright

Mr. Wright teaches e-Investigations Law at the SANS Institute.

Related: EDiscovery and Investigations on Facebook.

 

 

 

Archive Twitter Official Business Records

Twitter Legal Compliance Policy

Many enterprises and professionals are using Twitter* for official business.  One local government example is the City of Raleigh, North Carolina.  The Raleigh municipal government appears to be using Twitter to broadcast public service messages.

For legal purposes, many professionals and enterprises are wise to archive some or all of their Twitter (or Foursquare) communications.  Records may be needed for such purposes as subpoenas, e-discovery (EDD), public records law and the like.  

How does one record Twitter for long-term storage?  In practice it is difficult for an enterprise (or an individual professional) to manage electronic records –-Twitter or otherwise -- for long periods of time. This difficulty motivates records managers to focus their attention and resources.

I argue that electronic mail should normally be the cornerstone for archiving electronic business records.  My feeling is that e-mail is the first digital place the legal system expects to find important records.  When records managers tackle electronic records, e-mail is the logical first place for to focus attention and resources.  Every business person has an e-mail account, through which he or she exchanges important messages.

Thus, as a business professional adopts social media like Twitter and Facebook for serious communications, a practical approach to archiving those communications is to capture them in the professional's email account.  Services like Twitter and Facebook come and go.  They are hot this year, but something else may replace them next year.  The professional's email account, however, is fairly permanent and stable.  The email account is the unified, timeless place to store all important communications.

I've previously suggested how to use a business email account to capture Facebook messages.  Native Facebook provides tools for exchanging many kinds of FB messages via email.

I've looked for similar tools at Twitter.com.  However, native Twitter does not appear to support email as much as FB does.  Instead, Twitter supports SMS*.  SMS is normally associated with cell phones. 

Twitter's support for SMS gives me ideas for simple record-keeping.  It is relatively easy to integrate SMS with email for the purpose of capturing messages in an e-mail account.  I offer some simple examples here. I'll bet even better ways exist. 

For some professionals, the easiest way to submit a tweet* to Twitter via SMS, while also saving a copy in a business email account, is with a cell phone.  Many cell phone services such as Sprint allow the user to send an SMS message to a mobile number (such as the mobile number that Twitter supports) and, at the same time, to an e-mail address.  Accordingly, a user could use SMS on his Sprint phone to send a tweet to Twitter, with a copy to his business e-mail account, where it can be archived like all his other email.

In the alternative, the professional can subscribe to a paid service like ipipi.com to act as a gateway between email and SMS.

If the professional uses Microsoft Outlook for e-mail, she could exchange SMS message from her email client using the Outlook Mobile Service.  The service works via an SMS account with a provider like your cell phone carrier, and thus might involve special charges.  Using the Outlook Mobile Service, the user could send an SMS tweet to Twitter, and her Outlook account would keep a record just as it normally would keep a record of an outgoing email.

Here is a screenshot of a tweet sent from a Sprint phone.




What do you think of these ideas, Gentle Reader?

Update:  Apparently there is a twitter gadget for gmail that will store your tweets in gmail so they can be archived like email.

Another update:  Apparently Twitter, and search engines that search Twitter, lose much of the tweet conversation quickly.  Although Twitter keeps tweets indefinitely, it is unable to search for features like hashtags, which organize ongoing conversations, such as #iranelection.  Similarly, LinkedIn seems not to display public conversations more than a couple of weeks.

Third update:  The Broward County Sheriff's Department has created its own Twitter-like service, called CyberVisor, to broadcast messages about crimes and emergencies as they develop.  Presumably the Sheriff's Department can control and record this service better than something on Twitter.

–Benjamin Wright

Mr. Wright teaches e-discovery, records management and cyber security law at the SANS Institute.


* What is Twitter? Twitter is a popular social media service that allows users to broadcast and read short messages.  The little messages are normally stored on Twitter’s web site (in the form of a so-called micro-blog), and are often transmitted to other places such as cell phones and widgets on other web pages.

* What is SMS?  SMS means short message service.  It is best known as the standard for exchanging text messages among cellular and mobile phones.

* What is a tweet?  A tweet is a short text message, no more than 140 characters, broadcast or micro-blogged from a user's account in Twitter.

Facebook Business Records

Record Retention Policy?

Social networking like Twitter is becoming more popular as a medium of communication for official, business or professional messages.  Should these messages be recorded?  Often the answer is yes.

California attorney Laura Meier has written an article* saying it is becoming more common for local governments to use Facebook and other social networking media to interact with citizens.  An example (not cited by Ms. Meier) is City of Westerville, Ohio.  Ms. Meier suspects that public records/ open meetings / sunshine laws could require governments to record much of this communication.  These laws generally help citizens monitor the actions of their government and audit for misuse of public resources.

The Florida Attorney General opined that presumably most of the Facebook communications created by a Florida city government would be public records that should be retained according to official schedules for public records.

Update:  See new post on how to record Facebook messages for official business.

Private enterprises are using Facebook to transact business.  (Soon they may be using Google Buzz too.)  A vendor named Worklight offers software that provides a “secure corporate overlay for Facebook,” claiming its product allows enterprise employees to interact via Facebook, while ensuring that sensitive information does not leak to outsiders.  Worklight suggests one way to use Facebook (using its secure software) in a private company would be to approve purchasing transactions.  Manager Sally for instance might use Facebook to authorize clerk Bill to spend $10,000. The enterprise would need to make and keep a virtual record of such authorization for purposes of internal control.

I am not aware of any vendor yet selling software to help an enterprise record activity in a public social networking environment like Facebook.  (Vendors, note the market opportunity here.)  One of my fellow instructors at the SANS Institute, Kevin Johnson, says that Facebook publishes APIs that a third-party vendor might use to make such software. (Kevin is a contributor to Social Media Security.)

Until a vendor makes a product for recording Facebook, how is an enterprise to record it?  One not-so-convenient way is “print screen.”

I prefer not discouraging enterprises like municipal governments from using effective technology to fulfill their mission.  As they assess the difficulty of recording Facebook, they should remember that records management has never been perfect.  Paper records were easy to mishandle and lose.

–Benjamin Wright

Mr. Wright teaches eDiscovery and data security law at the SANS Institute.

* D. Derleth, L. Meier, R. Moin, "Social Networking Sites:  Legal Issues for Public Agencies and Public Officials to Consider," The Public Law Journal, vol. 32, no. 4, Fall 2009.  Another issue Ms. Meier raises is whether information posted on a social media site could put a city on notice of a hazardous condition, which the city is obligated to address, even though the city does not have staff dedicated to monitoring the site sufficiently to understand the notice and act on it.

Freedom of Information Act | Computer Records

Freedom of Information Act Requests Yield E-Troves of Documents

FOIA forces transparency in government, and transparency in turn forces revolution in the administration of public institutions – both national and local.

A FOIA requires government to disclose records to citizens upon request.  Remarkably, the quantity of available records relevant to any given request is skyrocketing as government agents adopt digital technology – databases, electronic mail, instant messaging, text messaging, Twitter, collaboration software and more – to execute the details of day-to-day government. The implications for democracy are profound.  So are the governance implications for enterprises of all descriptions.

Item One: Britain is in uproar over the expenses of Parliament members.  The row started when a journalist used the UK’s new FOIA to request records about M.P. requests for reimbursement of living expenses.  By age-old practice, the government covered M.P.s for the living costs associated with their official duties, but the specifics have always been hidden from public view.  Reluctantly resistantly the government prepared to turn over expense records under FOIA – though with heavy redacting to protect M.P. privacy.

But by this time loads of (un-redacted) M.P. expense records had been compiled into something that did not exist in the old days . . . a neat, convenient-to-steal electronic form.  This compact compilation of records enabled a whistleblower to spirit the records out of a government computer and into the hands of a newspaper.  The Daily Telegraph’s ensuing publication of complete, open details has embarrassed M.P.s in an historic scandal. British government will never be the same.  John F. Burns, “In Britain, Scandal Flows From Modest Request,” NY Times, May 20, 2009.

Item Two is Clark County School District, Nevada. Citizen Karen Gray requested under FOIA a year’s worth of the School Board’s e-mail, about 1500 messages.  A few years ago, records of such granularity did not even exist for a typical school board (or city/municipal commission, county management, state committee or board of trustees).  But e-mail has caused the creation of mounds of new records, which become fodder for any kind of legal investigation.

The District tried to delay disclosure.  It also tried to charge Ms. Gray $4000 for the costs of recovering the records (and filtering them for private/confidential data), but those costs reflect out-of-date, manual methods for compiling and reviewing e-mail records. The Nevada courts resisted the delay and the high charges.  The attitude of the courts was that the law favors inexpensive and generous disclosure. So the courts forced disclosure.

Ms. Gray’s case implies that Freedom of Information Act law is intolerant of governments that make their important e-mail records hard to recover.  A modern e-mail archive appliance makes the compilation and filtering of e-mail (especially that of executives, professionals, top managers, and board members) quick and inexpensive . . . consistent with the purpose of FOIA law.

–Benjamin Wright

Mr. Wright is an advisor to messagingarchitects.com, the visionaries in e-records management.

Recordkeeping for Social Networking Managers

Social Networks for Official, Commercial & Employment Transactions

By law, employers generally need to keep records of employment decisions.  So when the boss conveys a pink slip by way of Facebook, the employer needs a legal record of it.

What?  Fire someone by Facebook . . . a posting on a wall?  Would a manager do that?  Yes.  A spa in Canada (British Columbia) used Facebook to notify Crystal Bell of her job termination.

The history of electronic messaging tells a story about business records.  As each new form of message comes along, we initially doubt you can conduct business with such a flimsy thing.  Fax as a medium for transacting serious business?  No way, people thought in the early 1980s.  But as time passed –- and as court cases enforced fax contracts -- we grew more comfortable with fax as a business tool.  Today, fax is considered a responsible, even conservative medium for transmitting signed agreements and binding business records. 

Then, when electronic mail came into the workplace, conventional wisdom dismissed it.  Convention said e-mail was not a business record, said it could not (conveniently) be authenticated with a signature, and said it should be deleted quickly like so much water-cooler chitchat.  But naturally business people embraced e-mail as a tool for making obligations and delegating authority.  Today we see the law giving enterprises growing reason to store e-mail as business records.

I predict the same process will unfold for collaborative (Web 2.0 and social network) media like instant message, Facebook, Twitter and Myspace.  Old-fashioned folks will try to ban these technologies as methods for conducting important business.  They will, initially, ignore them as records to be kept.

But the outcome of the story is inevitable.  Busy people (like the boss in BC) will use the new channels to hire, fire, negotiate, agree and so on.

The managers of records need to plan for capturing the records of Web 2.0.  Those records can become the subject of a subpoena, an IRS taxpayer audit, an administrative summons or an internal investigation or the source of exculpatory evidence in defense of lawsuits.