Electronic Data Records Law | How to Win E-Discovery

Public Relations of a Data Security Breach?

Professional Education - Technology

[Update:  I've an evaluating Google Buzz as a vehicle for crisis communications, such as public announcements and interaction following an information security incident.]

Public communications are an under-appreciated facet of cybersecurity.  Over the years, I have increasingly emphasized public communications in my SANS LEG523 course on the law of information security (which includes e-discovery, record retention and internal investigations). 

Public communications is much more than just press releases and press conferences.  It embraces a wide array of
public statements related to IT security -- policies, disclaimers, web notices, contracts, network terms & conditions, blogs, filings submitted to regulators, interactions with law enforcement, breach notices to consumers, declarations made in courts of law, and much, much more. 

For instance, observe how central publicity is to the pivotal IT security lawsuit PlainsCapital Bank v. Hillary Machinery.

If anything could summarize my 5-day LEG523 course, it would be this:  Words count, and words need to selected carefully.  The words your enterprise utters to the world can have an astonishing impact on legal liability, public reputation, regulatory compliance, the cooperation (or not) of law enforcement and so on.  Silence also counts, and silence is often a bad idea. 

No other training course in the world will shake up your thinking about information and computer security as much as LEG523. 

I'd be happy to answer questions about the course.

Learn more and register.

--Benjamin Wright, Senior Legal Issues Instructor, SANS Institute

Financial E-Recordkeeping Law

National Instrument 31-101: E-mail, Collaboration, Online Chat, Instant Message, and Social Networking Records?

Canada is in the process of adopting new rules on the retention of electronic records by securities firms such as stock brokerages. The rules will impose rigorous requirements for preservation and availability of records for e-mail, text and other communications between firms and their clients.

The rules are part of proposed National Instrument (NI) 31-103, which will install a new nationwide regime for regulation of securities firms. Although authorities hoped to have made NI 31-103 effective as of March 31, 2009, they are still refining it. They anticipate publishing the next draft around April 1, 2009, with implementation beginning sometime after that.

Even though the rules are not yet final, firms can see that the new retention requirements are coming. They are wise to begin e-record retention now.  NI 31-103's new requirements are consonant with the larger trend in society to expect that enterprises keep plentiful electronic records.

Proposed NI 31-103 Section 5.15(1)(a) provides: “A registered firm must maintain records to accurately record its business activities, financial affairs, and client transactions.”

Proposed Section 5.5: “In most circumstances, registered firms should maintain the following records to satisfy subsection 5.15(1)(a) . . . all e-mail, regular mail, fax and other written communications with clients.”

What are the standards for record retention? Seven years is an important time period. Proposed Section 5.16:

"(1) A registered [securities] firm must keep its records safe and in a durable form.
(2) For a period of two years after the creation of a record, a registered firm must keep the record in a manner that permits it to be provided promptly to the regulator, and thereafter the record may be kept in a manner that permits it to be provided to the regulator in a reasonable period of time.
(3) A record provided under subsection (2) must be in a form that is capable of being read by the regulator.
(4) A registered firm must keep
  (a) an activity record for seven years from the date of the act, and
  (b) a relationship record for seven years from the date the person or company ceases to be a client of
the registered firm."

So 5.16 generally provides for shorter retention for “activity records” (seven years from the date of the act) than for “relationship records” (seven years after the client ceases its engagement of the firm).

5.16 goes on to define "relationship records" (which relate for example to the ongoing relationship between a firm and its customer) and “activity records” (which relate for example to specific purchase and sale transactions). In particular instances, however, the difference between an activity record and a relationship record could be indistinct and unclear. An e-mail can contain both activity information and relationship information.  Under a conservative interpretation, this lack of clarity could militate toward keeping even presumably “activity” records longer than seven years.

US securities firms have been dealing with similar record retention rules for a decade, and the US experience is a useful guide for Canadian firms. In 1997 the US Securities and Exchange Commission expressly required securities firms to store certain client communications such as e-mail under SEC Rule 17a-4. As new technologies have emerged, the requirements have been read to include them. For example, NASD Rule 03-33 specifically interpreted 17a-4 to include instant messages.

On several occasions US regulatory authorities have penalized firms for poor electronic records retention practices. For example the New York Stock Exchange fined J.P. Morgan $2.1 million.

As a matter of practice, compliance with rules like Rule 17a-4 and NI 31-103 can be easier if electronic messages are stored in a dedicated message archive server rather than in a production e-mail server or in network backup.

There is no reason in principle why such rules would not be read to include records of new forms of communications as they arise – such as postings on a message “wall” in a social networking environment like Facebook or Ning or txt or video communications via Skype.

–Benjamin Wright