Electronic Data Records Law | How to Win E-Discovery

Whistleblowers and Digital Records Force Transparent Governance

Public Disclosure Defuses Scandal

Publish FOIA Response?

Technology motivates any publicly accountable organization (nonprofit, corporation, government) to adopt a radically open style of governance.

Owing to email, data logs, text messages and the like, the quantity of official business records ascends skyward, while the granularity of those records grows ever more fine.  Detailed within these innumerable records are the secrets of the organization.

Stored this way, secrets are dangerous.

Keeping secrets –- or just withholding information -- is becoming harder and harder.  Secrets and records can leak out by way of FOIA, spies, gossip, hackers, mistakes, e-discovery, whistleblowers, external surveillance, or just the natural course of events (sousveillance). In finance, a "trusted" banker will leak to a friend secrets about exotic instruments like credit default swaps, which are so new that the law has yet to establish "insider trading" rules applicable to them.  Kara Scannell, "Trader's 'Nice Little Kiss' Tests Reach of Regulations," Wall Street Journal, March 31, 2010.

A leak is dangerous.

The leak is an invitation for an adversary to allege malfeasance.  When a secret leaks, the adversary's storyline becomes (a) the organization possessed information that the public needed, (b) the organization wrongfully withheld the information and (c) the public now knows the information only because a righteous force external to the organization brought it to light.

For a smart organization, the best posture is to preempt the leaking.  Before the leak happens, it should embrace transparency and publish (most all of) its records and activities onto the public Internet.  It should expose its information to independent review and debate.  Authors Tapscott and Ticoll admiringly call such an organization the naked corporation.

False Statement?

Take for example the story of the small, grassroots political action committee named “Take Back Your City,” which is promoting a vote by citizens against red light cameras in the municipality of College Station, Texas.  Through freedom of information act, the PAC obtained extensive email records regarding the city government’s use of the cameras.  In this trove of information, the PAC found what it believes is smoking gun evidence that the city is engaged in false, illegal political advertising about the effectiveness of the cameras.  The city claims – in a flyer to be inserted in monthly utility bills -- that the cameras have reduced traffic accidents, but the PAC says an internal city email contradicts that claim.  The PAC attached the email as evidence to a formal complaint it filed with the Texas Ethics Commission. 

Whether this complaint will result in ethics sanctions against the city (or more particularly the city manager cited in the complaint), I don’t know.  But the city’s defense would be easier had it been more open and transparent with its records.  When it gave the email records to the PAC, it could have also posted them all on its web page as well.  (Why not? The city had already gone to the trouble to compile them.)  Then, when it prepared its flyer for the utility bills, it could have made its point about accident reductions while also saying, “Each citizen can draw his or her own conclusions.  The city has posted on its web page exhaustive records regarding traffic cameras.” 

Such openness takes the punch out of allegations that the city lied.  Effectively, it enables the city to say, “We drew a conclusion from the data and told citizens our conclusion, but our statements to citizens were more than just that.  We also made all the data available to the citizens and told them they could read it themselves and draw their own conclusions.  We've opened the data to third party review.”

Investigating Leaks

Another lesson in transparency derives from the contrast in styles between the board of directors at Hewlett-Packard Company and the town council at Watertown, Massachusetts.

When HP saw that someone on its board was leaking company secrets, it assumed cloak-and-dagger
  mode. It didn’t talk about the problem.  It secretly hired private investigators to spy on members of its board as well as reporters in the media.  The private eyes violated the privacy of the directors by hijacking their telephone calling records.  AT&T discovered the hijacking and reported it to its customer, Tom Perkins, one of the directors targeted by the spying. The result was an embarrassing, debilitating scandal, with lawsuits, criminal complaints, an SEC investigation, a congressional investigation, and the end of career for two of the company’s top lawyers.

HP followed the old-fashioned, closed approach to resolving a crisis.  But in this Internet age -- where clandestine activities are hard to keep clandestine -- that approach led to disaster.

Compare the youtube video below.  It shows the town council dealing with the same problem as the HP board – insider leaks.  The leaks pertained to closed-door deliberations about contracts.  But rather than spying on its members in the dark of night, the Watertown council brought the issue into the open.  It discussed the topic in public, video-broadcast session! 

Notice that Watertown’s transparency immediately deters future leaks.  The leaker has to be thinking, “My leaks are attracting negative attention.  Now all the citizens are on alert, and some knowledgeable witness watching out there may come forward with embarrassing information that reveals me as the leaker.  I’d best stop leaking.”



By being transparent, the council uses the Internet as its enforcer, and it avoids the risk of a HP-style scandal.  Legal compliance meets modern public communications.

–Benjamin Wright

At the SANS Institute, Mr. Wright stresses that, in the wake of a data security incident, the delivery of a effective public message is as important as the technical and legal response.

Freedom of Information Act | Computer Records

Freedom of Information Act Requests Yield E-Troves of Documents

FOIA forces transparency in government, and transparency in turn forces revolution in the administration of public institutions – both national and local.

A FOIA requires government to disclose records to citizens upon request.  Remarkably, the quantity of available records relevant to any given request is skyrocketing as government agents adopt digital technology – databases, electronic mail, instant messaging, text messaging, Twitter, collaboration software and more – to execute the details of day-to-day government. The implications for democracy are profound.  So are the governance implications for enterprises of all descriptions.

Item One: Britain is in uproar over the expenses of Parliament members.  The row started when a journalist used the UK’s new FOIA to request records about M.P. requests for reimbursement of living expenses.  By age-old practice, the government covered M.P.s for the living costs associated with their official duties, but the specifics have always been hidden from public view.  Reluctantly resistantly the government prepared to turn over expense records under FOIA – though with heavy redacting to protect M.P. privacy.

But by this time loads of (un-redacted) M.P. expense records had been compiled into something that did not exist in the old days . . . a neat, convenient-to-steal electronic form.  This compact compilation of records enabled a whistleblower to spirit the records out of a government computer and into the hands of a newspaper.  The Daily Telegraph’s ensuing publication of complete, open details has embarrassed M.P.s in an historic scandal. British government will never be the same.  John F. Burns, “In Britain, Scandal Flows From Modest Request,” NY Times, May 20, 2009.

Item Two is Clark County School District, Nevada. Citizen Karen Gray requested under FOIA a year’s worth of the School Board’s e-mail, about 1500 messages.  A few years ago, records of such granularity did not even exist for a typical school board (or city/municipal commission, county management, state committee or board of trustees).  But e-mail has caused the creation of mounds of new records, which become fodder for any kind of legal investigation.

The District tried to delay disclosure.  It also tried to charge Ms. Gray $4000 for the costs of recovering the records (and filtering them for private/confidential data), but those costs reflect out-of-date, manual methods for compiling and reviewing e-mail records. The Nevada courts resisted the delay and the high charges.  The attitude of the courts was that the law favors inexpensive and generous disclosure. So the courts forced disclosure.

Ms. Gray’s case implies that Freedom of Information Act law is intolerant of governments that make their important e-mail records hard to recover.  A modern e-mail archive appliance makes the compilation and filtering of e-mail (especially that of executives, professionals, top managers, and board members) quick and inexpensive . . . consistent with the purpose of FOIA law.

–Benjamin Wright

Mr. Wright is an advisor to messagingarchitects.com, the visionaries in e-records management.

Freedom of Information Act | Restore Erased Email

Electronic Records Had Been Discarded Under Interpretation of Retention Policy

Why Allow Deletion If Government Must Later Restore Records?

A county's formal policy on e-mail destruction failed to save it from the cost of recovering deleted e-mails in a lawsuit under Ohio's Public Records Act. Like FOIA laws in other states, Ohio's Records Act requires state government agencies like counties to disclose records to citizens upon request.

The case in question is a decision by the Ohio Supreme Court, State ex rel. Toledo Blade Co. v. Seneca County Board of Commissioners, 2008 WL 5157733 (Ohio Dec. 9, 2008).  Plaintiff sought e-mails of county commissioners concerning demolition of an old courthouse.  The county turned over some e-mails, but plaintiff managed to show that some relevant e-mails were missing because they had been deleted. It made this showing by analyzing the e-mails that were turned over and proving some logical gaps appeared within them.  Also, some commissioners admitted they had deleted some of their relevant e-mails.

Forensics Reverses Written Policy!

The county's written policy allowed each user to delete e-mail that the user deemed to be of "no significant value." (Some people call such e-mails "non-records".)  Such a policy is a version of the make-a-decision style of e-mail (text and instant message) records management, where users are expected to decide the destruction/retention fate of each message.  

After the court determined that some relevant e-mails must have been deleted, it observed that through the use of forensics measures some e-mails might be recoverable from commissioner hard drives. The county argued it should not be required to restore deleted e-mails because they had been deleted in accordance with the county's record retention policy, which the county had adopted in good faith. Further, the county argued that forensics measures are excessively expensive.

The court disagreed with the county. The court ordered the county to undertake costly forensics steps to search for and restore deleted e-mail records that met certain criteria – all at the county's expense.

Different Retention Policy Needed

Gadzooks! If a government agency is required under a FOIA to incur great expense to recover deleted e-mails after officials had determined -- under a formally-adopted policy -- that the e-mails were of "no significant value," then it makes no sense to let officials delete e-mails in the first place.  Such a make-a-decision style of policy is unworkable because it will cause the government regularly to employ expensive forensics to recover deleted records.  As a policy matter, the government is wiser just to archive copious records and take decision-making out of the hands of individual users.

I have long questioned e-mail retention policies (the make-a-decision policies) that emphasize a user examining each particular message and then deciding whether to destroy it or to keep it.  But some learned people disagree with me.  An argument they sometimes make in favor of the make-a-decision style policy is that it mimics how paper was handled. With paper, they argue, lots of documents came across the desk of each official. The official would decide whether to throw the paper in the trash can, or to place it in folder A, or folder B or folder C.

Yet this Toledo Blade case demonstrates that e-mail is different from paper. Even after e-mail is deleted, it can still be recovered forensically.  The cost of recovery can be high, but this court forced government to incur that cost.

Technical footnote: The court ruled the commissioners had probably violated the county's policy by deleting e-mails that were of significant value, when the policy said that only insignificant records would be deleted. However, this detail should not change our understanding of the case's import.  From the point of view of someone writing records management policy, the risk is ever-present that a court will second-guess users after-the-fact.  Looking back at past decisions, a court can always say, "user should not have allowed that e-mail to be deleted" or "user should have placed that e-mail in retention category X rather than retention category Y."  Users always make records management mistakes, and thus leave an enterprise constantly exposed to the threat of having to employ forensics (after-the-fact) to reverse user decisions.  Therefore, the policy writer is motivated just to remove users from retention/deletion decisions.

Background:  One of the purposes behind Freedom of Information Acts -- and public records acts generally -- is to enable citizens, FBI, police and internal auditors to investigate public officials for fraud, waste, corruption, embezzlement, conflicts of interest and misappropriation of funds.  The ever-present possibility of such a probe motivates officials to be fair and honest.

–Benjamin Wright

How Long to Retain Public Records?

Storing Too Many Messages on Tape?

Dallas County officials are debating a proposed policy under which the default will be to delete electronic mail quickly.   But some question whether such a policy would lead to elimination of records needed for legal purposes (such as open records law) and to legal exposure for county employees.

The county is considering the 90-day policy because e-mail storage is expensive and cumbersome under its present technology.  Proponents of the proposed policy argue that the county should archive only messages that an employee has deemed to be an official “record.”  They maintain that Texas state guidelines mandate only the storage of official records, not all e-mail.  Hence, they envision that employees will review each e-mail one-by-one to decide how it will be categorized for retention purposes, and if an employee does not designate it a record, then it would be deleted after 90 days. (Deletion would be suspended for e-mail subject to any special litigation hold).

Skeptics of the proposed policy fear employees (personnel) are not well-qualified to make such decisions.  Although employees have historically made similar decisions with respect to paper records, the number of paper records was much smaller.  Employees will need special training.  [Query whether the costs and risks associated with employee time, training and attention exceed the cost of just keeping copious e-mail records.]  What’s more, say the skeptics, an employee could be second-guessed for making a mistake and allowing an e-mail to be destroyed by the default policy rather than taking special effort to preserve it.  According to the Dallas Morning News, “Destroying local government records is a Class A misdemeanor and can be a third-degree felony under some circumstances.”

Dallas County e-mail records (ESI) have previously been the subject of controversy in litigation.

An alternative for the county would be to implement an e-mail archival appliance that efficiently stores older records separate from the county’s day-to-day production e-mail system.

–Benjamin Wright

Mr. Wright teaches technology law at the SANS Institute (CLE and CPE).

Local Government Email | Freedom of Information Act

E-discovery under State Open Records or Sunshine Laws

Police Video Records

Increasingly, public agencies are required to search for, locate, uncover and turn over e-mail records in response to freedom of information and open records requests.  

Generally speaking, under either state or federal law, a freedom of information act requires government to disclose requested records to citizens.  Sometimes a FOIA might be known as (or associated with) an open records act or a sunshine act.  

One example: A Kentucky judge required state government to give a man copies of e-mails between his wife, a state employee, and another state employee whom the man suspected was having an affair with his wife. (Associated Press, “Judge: Ky. Man Can See His Wife's E-Mail,” Nov. 20, 2007.)

Another example:

A newspaper requested under Arizona’s open records law access to records of e-mail by a county official on county computers. The official fought the request, claiming the records were personal and therefore not subject to disclosure. The Arizona Supreme Court held that the records must be shown to a trial judge. The judge should then decide whether they are personal records (deserving of privacy), which are to be withheld, or public records. (The Reporters Committee for Freedom of the Press, "Judge must decide whether e-mail is private," April 27, 2007.)

Third example:  A West Virginia judge held the state's FOIA required the state to release e-mails of the state's Supreme Court Chief Justice. The justice had send the e-mails from his government account to the head of a private coal company.  (The Reporters Committee for Freedom of the Press, "Even high court subject to FOIA in West Virginia," September 18, 2008). Although the released e-mails did not pertain directly to the court's internal administration or cases pending before the justice, they touched on more than merely personal matters.  They at least mentioned upcoming supreme court elections.

To respond to these requests takes time and resources on the part of agency IT staff. Haphazard records management makes the job more difficult.  Agencies therefore have incentive to keep organized, searchable e-mail records.  And they are wise to insist that all employees (including governors and supreme court justices) route all official messages to or through centrally-controlled archives.

These cases are just random examples.  I wouldn't be surprised to find similar cases in other states, whether Indiana, Ohio, Colorado, Tennessee, Arkansas, Indiana or wherever.

With the proliferation of digital gadgets in government, the quantity of records that are discoverable under FOIA is exploding.  One company that makes equipment for police departments has developed a video camera, which an officer would wear on his head, to record everything he sees and hears while on duty.  Veronica Dagher, "New Taser 'Shoots' Evidence," Wall St. J., 9/2/09.  Wow!  That would create a bonanza of government records and evidence.  [Query whether, to comply with privacy laws, police should publish warnings (such as big decals on squad cars) that officers are video recording all they see and hear.]

Update:  Reportedly, when Sarah Palin resigned as governor of Alaska, she cited $2 million as the cost incurred by the state to respond to FOIA requests about her.   FOIA is a growing expense for government.  Governments need to employ technology to contain that cost.  For example, any time government delivers information to one FOIA requester, it should publish that information on the web.  Web publication will avoid the cost of retrieving and culling the information again under future requests.

--Ben Wright

Mr. Wright, a practicing attorney, teaches the Law of Data Security and Investigations at the SANS Institute.