Electronic Data Records Law | How to Win E-Discovery

Network Backup as E-mail Repository

Expensive E-Discovery (EDD) for an Enterprise

IT network backup can store many e-mails that are relevant and discoverable in a lawsuit.  But to search for e-mail by way of network backup is very inefficient.  

Sometimes, courts do order organizations to go into backup to retrieve computer records - to the vexation of the IT department. The risk that such an order might someday come is one reason for an enterprise to keep plentiful e-mail archives in a system specifically designed for storage and search of large volumes of records.

This risk applies to lawsuits both in the US and elsewhere. A case in point is the Australian decision BT (Australasia) v State of New South Wales & Telstra, [1998] FCA 363 (9 April 1998). 

In a commercial dispute between telecommunications carriers, the plaintiff demanded e-mail records from defendant Telstra. Telstra’s records of many of these e-mails were available only in network backup. The court ordered Telstra to search backup tapes, at considerable expense, to retrieve certain e-mails.

Telstra did not have to design its e-mail system so that backup was the archive.  Had the company, as a matter of routine policy, treated its e-mails as durable assets of the company – preserved in an archival appliance that allows for easy records search and management – it would not have been forced to rummage through backup for e-discovery.  

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, leader in email record retention, recovery and investigation.  See free, recorded webinar.

SOX Record-keeping

Arthur Andersen’s Records Management Crime

The US legal system is giving all enterprises (whether public corporations, private LLCs or otherwise) reasons to be more liberal in their retention of records, especially e-mail.  One reason is a change in obstruction of justice law.

The traditional obstruction of justice statute, 18 U.S.C. §1512(b), punishes anyone who corruptly persuades another person to destroy documents to impair their use in an official proceeding.  Under that traditional statute, a criminal court convicted Arthur Andersen for destroying Enron-related papers and electronic records. The jury in Andersen’s trial said Andersen’s internal record management practices violated the statute.

But one month after Andersen’s jury trial, Congress adopted the Sarbanes-Oxley Act (SOX).  SOX modified obstruction of justice law by making it easier to convict people who destroy records.  SOX included new 18 U.S.C. §1519, which now punishes anyone who destroys, conceals, or covers up any record to impede or influence a federal lawsuit or an investigation by any federal agency, or in relation to or contemplation of any such matter or case.

Notice the differences between the traditional §1512(b) and new §1519.  Under traditional §1512(b) a crime was committed only if the defendant "corruptly persuaded another person" to destroy documents.  It might be hard for a prosecutor in a criminal trial to show corrupt persuasion of a second person.  Further, the exact words of §1512(b) seem not to apply if the defendant directly destroyed documents.   In new §1519, Congress omits the traditional “corruptly persuades another person” element. Further, new §1519 employs expansive language -- “in relation to or contemplation of any such matter or case” – to stretch the law to cover destruction of records in any way connected to a specifically anticipated lawsuit or investigation.

Enterprises be aware.  The effect of §1519 is powerful.  To win an obstruction of justice conviction, the prosecutor does not have to work as hard as he or she did in the Andersen case.  The prosecutor no longer has to show the defendant acted "corruptly" to "persuade" someone else to destroy documents.  Now, it is enough for the prosecutor to simply show that the defendant intended to destroy records with federal litigation in mind.

With new §1519, Congress emphasized its intolerance of people who mulch records in view of a lawsuit or investigation, even one that is not pending or imminent.  Hear how Senate Report 107-146 interprets new 18 U.S.C. §1519:  “This statute is specifically meant NOT to include any technical requirements, which some courts read into other obstruction of justice statutes, to tie the obstructive conduct to a pending or imminent matter. It is also meant to do away with the distinctions, which some courts have read into obstruction statutes, between court proceedings, investigations, regulatory or administrative proceedings . . . and less formal governmental inquiries. The intent of the provision is simple: people should not be destroying, altering or falsifying documents to obstruct any governmental function.”

Think about that statement from a record management perspective at a complex enterprise.  The statement seems to imply that the enterprise must implement a litigation hold with respect to future (specifically-anticipated) lawsuits/investigations, even though they are not pending or imminent.  For an enterprise, it is tough to know what is and is not anticipated somewhere out there in the future.  But the risk is that later, after the lawsuit gets going, the court may judge the enterprise's decisions retrospectively, with the benefit of 20-20 hindsight.  The court may determine, "Oh, you could have seen this coming (even though it was not imminent), so you should have implemented a legal hold."

Given that it is now easier to be convicted for destroying records, the logical response for an enterprise is to keep more records longer . . . to give itself a wider margin for error.

SOX’s new contribution to obstruction of justice law should be viewed in the context of recent cases punishing premature destruction of electronic records.  In that context, one sees a whole legal system that expects more lavish record retention than in the past.

–-Benjamin Wright

Mr. Wright teaches cyber security and investigations law at the SANS Institute.

Reference: B. Wright, “Shredding Documents Post-Arthur Andersen: Reforming Corporate Record Retention Policies for the Information Age,” a paper published 2002.

Payment Card Issuers Over-reacted to TJX

Federal Trade Commission Misunderstands Card Data Privacy.

Rethink PCI Law.

The TJX credit card data break-in is reputed to be the largest in history. On the heels of the incident, many credit card issuers replaced cards believed to be compromised. To replace cards is expensive (not to mention disruptive to consumers), and many card issuers demanded, through lawsuits and otherwise, that TJX reimburse them. December 2007 TJX settled one class action lawsuit with issuers of affected VISA cards, agreeing to pay $41 million. Dow Jones Newswires, "TJX Gets Over 95% Acceptance Of VISA Settlement Agreement," December 20, 2007. May 2008 TJX said it had support for settlement with Mastercard issuers for $24 million.

The Federal Trade Commission concluded that TJX had maintained inadequate controls to protect credit card data and had therefore committed unfair trade practices. Consequently, the Commission has punished TJX by requiring it to adopt new controls (in the vein of the PCI - Payment Card Industry Data Security Standard) and file extensive paperwork with the government for years to show that the controls are in place.

That's the background. Now think about this . . . August 2008 federal authorities announced indictments of the ring of criminals at the heart of the TJX heist. The ring had stolen data from both TJX and many other retailers. According to authorities, the criminals used stolen data to withdraw tens of thousands of dollars at a time from automated teller machines. Their ATM withdrawals added up to hundreds of thousands of dollars.

Further, last year six people were convicted in Florida for using data, apparently stolen from TJX, to buy gift cards and goods worth AT LEAST ONE MILLION DOLLARS. Jon Swartz, "11 Charged in TJX Identity Theft," USA Today, August 6, 2008.

Do you see an imbalance here? TJX settles with VISA & Mastercard issuers for $65 million, whereas the actual reported fraud is only a tiny fraction of that amount. Further, when card issuers canceled all those cards, they alarmed and inconvienced millions of cardholders to excess.

Secured Personal Data On Stolen Laptop

Data Breach Notice to Employees and Dependents

Compromise of Password-Protected Computer Lost in Burglary

Anheuser-Busch notified thousands of employees that their personal data, and the data of their dependents, may theoretically be at risk of identity theft. The data were on a password-protected laptop, and the data were encrypted.

The case comes to light because one of the states involved, New Hampshire, requires notice be sent both to affected individuals and to the state attorney general, who publishes the notices on the web. New Hampshire’s law does not require notice if data were encrypted. AB says the data were encrypted. It also says it has no information suggesting the burglars are attempting identity theft. So why did it give notice?

My guess is that the company was motivated more by the politics of the situation than a strict reading of the law.