Electronic Data Records Law | How to Win E-Discovery

Best Practice | E-mail Record Retention

Laptop ESI Litigation Hold

Court Case | Policy Risk

Accepted “best practice” says employees like executives should review e-mails and documents one-by-one and decide which to keep and which to destroy.  The rationale behind the practice is that it is imprudent to retain all records.  This practice further holds that employees should be trained not to keep insignificant documents and email messages, lest record archives fill up with junk, making search for important records more difficult.  One more tenet of the best practice is that when litigation is anticipated, the destruction of e-mail and documents (even insignificant messages) related to the topic of the litigation should cease so that records are not spoliated.  

Accepted best practice suffered another blow in court.  In Goodman v. Praxair Services, Inc., 2009 WL 1955805 (D.Md. July 7, 2009), the court sanctioned a corporation for failing to keep all of an executive’s emails and e-documents on a topic after litigation was threatened, even though during the time in question the executive kept what she deemed to be “relevant” e-mails and documents, while allowing only “irrelevant” ones to be destroyed.

Risk

The case spotlights a big risk associated with the accepted best practice:  Knowing when and how to apply a litigation hold is tricky.  The danger sprouts from the proclivity of courts to second-guess an enterprise after it, acting through its employees, makes a decision.  Although an enterprise makes a decision about whether to implement a litigation hold on Day Number 1 (when the enterprise knows little about the potential lawsuit that may or may not materialize), the court’s review of that decision may happen on Day Number 2601, long after the lawsuit is underway and at a time when it is clear what the focus of the lawsuit is.

Even after the decision to initiate a litigation hold has been made, the hold is hard to implement in practice.  If, before the litigation hold, the enterprise's default practice is to destroy records, then to make and enforce an exception to the default for precisely the right records is not easy.

Facts

So what happened in the Goodman case?

First:  According to allegation by a consultant, the consultant and the CEO of a corporation speak by telephone (end of December 2000) concerning a disagreement over compensation to the consultant under a contract.  Allegedly, the CEO suggested that the consultant take a small amount to settle the matter rather than having to sue the corporation to win more money.

Second:  The consultant stated to the corporation in a letter dated January 5, 2001, that he had consulted two attorneys concerning this contract dispute.  The letter spoke generally about the possibility that the consultant would pursue a lawsuit on the matter, without forcefully threatening it.

Third:  February 19, 2001, the consultant sent a stronger letter threatening litigation.

Fourth:  After receipt of the February 19 letter, the corporation’s CEO instituted a litigation hold on all then-existing e-mails and other documents related to the matter in her possession.  [What is a "litigation hold" aka "legal hold"?  It is a procedure whereby a party, anticipating or knowing of a lawsuit or legal investigation, takes special steps to prevent the loss of records that would normally be destroyed.] The CEO initiated this litigation hold on her own initiative.  It was not formally instituted throughout the company and was not instituted under the supervision of counsel. The litigation hold ultimately proved to be imperfect, as the court suspected some relevant documents were destroyed when the CEO’s laptop was later discarded.

Fifth:  Before February 19, the CEO’s usual practice was to review each of her e-mails and documents, print the relevant ones (that is, relevant in her eyes) and delete the others.

Sixth:  The court seemed to believe that the CEO deleted some e-mailed related to the topic of the lawsuit between January 5 and February 19, although the court did not specifically identify any such e-mails or their content.

Seventh:  Despite the litigation hold, the corporation eventually discarded the CEO’s laptop, which, in the opinion of the court, might have held some relevant records.  Although the court did not have conclusive evidence that any particular relevant record was destroyed, it distrusted the practice whereby the CEO decided what was and was not relevant.  Said the court, “The argument of an accused spoliator that it did not violate its duty to preserve evidence because it retained the ‘relevant’ information and only deleted ‘irrelevant’ information rings particularly hollow.  The ultimate decision of what is relevant is not determined by a party's subjective assessment filtered through its own perception of self-interest.”

Three years after the consultant sent the letters identified above, the consultant sued and sought e-discovery for all of the CEO’s relevant e-mails and e-documents.  The corporation turned over the records it had.  The corporation said it had not required to institute a litigation hold until February 19, 2001, because until then it could not have reasonably expected the topic to materialize into a lawsuit. The corporation further argued that nothing relevant had been destroyed because the CEO kept what she thought was relevant.

Ruling: Spoliation

The court, however, ruled that the corporation had committed spoliation because it should have applied a litigation hold on all the CEO’s email and e-documents touching on the subject of the lawsuit, starting from the January 5, 2001, letter. (As I said, that’s the letter that talked generally about a lawsuit, without forcefully threatening it.)  Instead, the CEO said her legal hold started with the February 19 letter.

The key to this case is that the court believed the litigation hold started too late.  The court seemed suspicious that the CEO destroyed some relevant evidence between January 5 and February 19, although the court could not specifically put its finger on what that evidence was.

Punishment: Strategic Disadvantage in Lawsuit

To punish the spoliation, the court dealt the corporation a strategic disadvantage.  It said that when the jury is empaneled as the lawsuit goes to trial, the jury will be informed that the corporation was negligent in its preservation of relevant e-mails and electronic documents.  This strategic disadvantage could make it more difficult for the corporation to win the case.  (See important footnote below.)

The court further held that the consultant would be entitled to reimbursement from the corporation for some of the consultant’s litigation costs in pursuing the spoliation complaint.

Analysis: Incentive for More Generous Retention

The court’s application of law to the facts of this case fails to persuade me.  I respectfully observe that the court could not identify any relevant record that had been destroyed and could not establish that any such record had been destroyed.  Nevertheless, the opinion is influential because it was written by a federal magistrate judge, Paul W. Grimm, who is considered a leader in the law of ediscovery.

Regardless of whether the court applied the law correctly, the case continues a distinct trend in American jurisprudence.  In this decade, courts have tended to expect enterprise electronic mail records to be well preserved and are suspicious if they are not.  Selective printing of e-mail by executives has evoked judicial skepticism.

What does this case, and the trend which it continues, tell people who craft real-world policies for the review, retention and destruction of enterprise electronic mail?  They suggest that policy makers are wiser to keep all the records of important people a long time.  They suggest that the accepted “best practice” is under siege. 

Safer Practice:  Keep More Email of Important People

But wait.  The Goodman court did not say that a corporation must keep all the records of important people.  All the court said was “don’t spoliate,” which strictly speaking means don’t destroy records when you have reason to believe they will be needed for future litigation.  That’s easier said than done.  My experience says it is very hard in practice for an enterprise to divine what a court (which has not even been selected yet because no lawsuit has been filed) may consider important several years in the future.  Further, few organizations can afford to have lawyers regularly engaged in analysis as to whether a legal hold should be applied at this time to these records versus that time for those records.  Therefore, the safer practice is to keep a lot of digital records, as the cost of digital storage is dropping. 

With that said, I believe it is very hard to “keep all the records of important people a long time.”  As archival technology advances, that may become easier. 

However, as of today, I argue that an enterprise is wise to place emphasis on the long-term retention of e-mail by executives and other decision-makers.  The reason is that email is a choke point in the modern enterprise.  It records rich, time-stamped detail about the activities of the enterprise, including copies of, references to or links to documents like spreadsheets. 

Email is not a comprehensive journal of the activities in an enterprise, but it is key, and the technology available for archiving it is relatively well-developed and economical to implement.

–Benjamin Wright

A practicing attorney, Mr. Wright teaches the law of data security and investigations at the SANS Institute.

Footnote:  I don’t wish to overstate the severity of the sanction the court applied in this case.  The court held that the consultant “is entitled to an adverse jury instruction . . . with respect to [the corporation]'s failure to preserve [the CEO]'s laptop and [the CEO]'s failure to preserve her relevant emails and documents.  The appropriate instruction would be a general adverse instruction that permits, but does not require, the jury to draw an adverse inference against [the corporation] as a result of its violation of the duty to preserve relevant evidence.”  Although this does deal an advantage to the consultant, it is not a decisive advantage.  The corporation may be able to overcome it and still prevail at trial.  The sanction is less severe than the sanction in some other leading e-spoliation cases.  Hence, Goodman should not be taken as earth-rocking authority for the proposition that enterprises will be treated harshly if they rely on executives to decide, one-by-one, which record is relevant for retention and which is not.

Electronic Discovery Professional Duty

Falsehoods and Duty of Confidentiality

What is an e-forensics specialist to do when she discovers her client has been lying to her?  Typically this kind of computer specialist is hired to find, audit and report on electronically stored information (ESI).  If the specialist has been making representations to others -- such as a court, an internal investigator or an inspector general who has issued a subpoena, on the basis of what she now knows to be lies, she is in a bind.  Like any professional working for a client on a sensitive matter, the specialist will likely owe the client a duty of confidentiality.  Normally she will have signed a non-disclosure agreement. 

How to Preserve Reputation?

The specialist’s reputation is at stake. Obviously, to disassociate herself from misrepresentation, she can withdraw from the engagement.  But she fears that the third party will continue to rely on her representations, which are no longer well-founded. 

A practical technique available to this specialist is known as the noisy withdrawal.  Although noisy withdrawal is most commonly known from cases where lawyers learn that their clients have been lying to them, the technique is a responsible measure available any ethical professional.  

In a noisy withdrawal a professional announces that he is withdrawing from representation of his client. In addition (this is the noisy part) he declares to interested third parties that he disaffirms his prior statements made on behalf of the client.  With the noisy withdrawal, the professional aims to preserve his own credibility, without compromising the client’s secrets.  He does not reveal why he is withdrawing, why he is disclaiming prior statements or any information his client has told him.

Examples of Noisy Withdrawal

A recent example of a noisy withdrawal occurred in the investigation of Stanford Financial Group. Attorney Thomas Sjoblom had represented the firm before the Securities and Exchange Commission as it examined alleged fraud, corruption and irregularities.  But then he made a noisy withdrawal from the engagement.  Observers surmised that as the case progressed he had come to disbelieve what his client had been telling him. Kara Scannell, “Top Lawyer’s Withdrawal from Stanford Case Waves a Flag,” Wall Street Journal, Mar. 6, 2009.

Another famous example transpired in the Whitewater investigation during the Clinton presidential administration.  Legendary ethics expert Sam Dash made a noisy withdrawal when the Whitewater Independent Counsel wrongly gave the impression that Professor Dash endorsed the Counsel’s conduct.  (By the way, prior to this story, the late Sam Dash was my ethics professor in law school.  Over the long run, I hope Professor Dash’s teaching helps me stay out of trouble!)

–Benjamin Wright

Mr. Wright teaches cyber defense law at the SANS Institute, where he emphasizes the role of ethics and savvy public communications.

Email Retention | Public Audit & Administration

German Laws, Orders, Regulations and Instructions

Affinity with Local (County) US Government

What does the law expect of electronic government records?   Records enable governments to be transparent.  If government keeps good records of its activities and gives citizens easy access to them, then citizens can review government and hold it accountable.

Today most government records are electronic.  Accordingly, the German federal government seeks to archive its electronic records, including e-mail.  A key initiative under the Federal Ministry of the Interior is DOMEA, a project that sheds light on the legal expectations for e-government records, including electronic mail. 

The DOMEA project recognizes that: “Electronic records . . . have to meet the requirements for record keeping in public administrations, which are prescribed in laws, standing orders, regulations  and instructions.  They include important points, such as: 

“1. The completeness, integrity and authenticity of official records, which means that official documents cannot be subsequently altered, changed, removed, destroyed or deleted. 

“2. The records principle of public administration, which means that documents have to be appropriately joined together in systematically arranged subject files according to the functions of a particular office. 

“3. The accountability and lawfulness of administrative procedures, which means that accountabilities and responsibilities have to be documented in records in the course of business and that the state of affairs and the development of transactions in a given case has to be completely evident in records at any time.”

Of course, the validity of these legal standards is not limited to Germany or even Europe.

If these are the legal standards for government records, then query whether popular enterprise e-mail systems such as Microsoft Exchange and Novell Groupwise are designed to meet these standards. Generally speaking, they are not.  They do not support efficient storage, management, protection and searching of vast quantities of e-mail records, collected from a large population of users over an extended period of time.  That’s one reason enterprises like governments commonly have policies to destroy most e-mail relatively quickly, such as 90 days after transmission.

But e-mail has become central to the administration of modern government.  Very often, e-mail documents official transactions and official delegations of responsibility.  It also empowers internal audits and investigations (by for example inspectors general) for fraud, waste, corruption, mismangement and misappropriation of funds.  

For some time organizations such as governments have relied on ad hoc methods for retaining e-mail – including the print-and-file method.  But e-mail is so voluminous and has become so important that ad hoc solutions are failing.  

Last week I led an on-site workshop with the staff of a mid-size county government struggling with this problem. Staff representatives hailed from IT, counsel, finance, administration, internal audit, human resources, risk management and public health services.  The county’s e-mail system is Groupwise.  The staff concluded that the county needs, in addition to Groupwise, a dedicated e-mail archive appliance. The workshop enabled the staff to write new, modern policy on e-mail archival.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigation law at the SANS Institute.

He is an advisor to Messaging Architects, where he leads an in-house workshop to help the stakeholders in an enterprise craft workable policy on the management of email and other eRecords.

P.S.  New Mexico's Attorney General (AG) indicted the state's former Secretary of State (SoS) for tax evasion and money laundering tied to alleged kickbacks to her by the recipient of federal grant money.  Stephanie Simon, "New Mexico Roiled by New Graft Case," Wall Street Journal, August 22 -23, 2009.  Among other things, the indictment alleged that the defendant advanced her crime by fabricating two official records in 2004 -- a paper letter and a paper memo.  The indictment came on the heels of thorough document reviews by both federal and state auditors.  The auditors said the Secretary of State's office maintained poor records on its management of federal grant money.  Email records (which are very hard to forge or spoof successfully) were sparse if non-existent.  Furthermore, the Secretary of State's office says it keeps financial records only three years after the close of the fiscal year.  Now, the AG and the ex-SoS disagree sharply over the allegations.  Had the SoS's office maintained more detailed and complete records (including archived email, supported by time-stamps and other audit trails), this disagreement might now be resolved.  Either (a) the ex-SoS would have been deterred at the outset from corruption for fear that the records would betray her, (b) the records would clearly exonerate the ex-SoS, or (c) the records would unambiguously demonstrate the ex-SoS's guilt.