Electronic Data Records Law | How to Win E-Discovery

B2B Cyber Security Lawsuit | Guerrilla Publicity Dogs Bank Online

Populist Politics

Forensics Disagreement | Web PR Levels Court-of-Law Playing Field

The web changes how public disputes are contested.  Inexpensive web 2.0 publicity disrupts the balance of power.

Internet Bank Robbery - The Facts

After computer thieves stole [Krebs] $200,000 from the bank account of Hillary Machinery Inc., the company demanded reimbursement from its bank, PlainsCapital Bank. 
  The bank refused.  Thus began one of the most gripping cases in the history of computer security law . . . and a lesson in how to use the Internet as a populist podium . . . 

Apparently the investigation of the heist has not determined conclusively how the hackers succeeded in tricking the bank to transmit money out of the account.  Each party believes the forensic investigation proves it is blameless.

The Law On Internet Bank Robberies

The legal relationship between Hillary and the bank is largely governed by Uniform Commercial Code Article 4A and the banking agreements signed between the parties. In a case like this, an essential issue is whether the bank employed commercially reasonable security procedures when it acted upon what purported to be electronic payment instructions from Hillary. The bank maintains that its security was reasonable, and therefore it need not reimburse the money.

As this dispute escalated, Hillary might have sued, possibly in Texas state court or possibly in federal court.

But the bank seized the legal initiative.  It sued Hillary in federal court!  The bank may have calculated that a federal court would review this complex, technical case more thoughtfully than a state court.  So it preempted from Hillary the option to sue in state court.  

From the federal court, the bank seeks an affirmation that its security was reasonable.  In essence, the bank said Hillary had called into question the integrity of the bank's operations, and the bank is entitled to clear its name by way of litigation.

The bank is forcing Hillary to spend money on lawyers, quite possibly hoping Hillary will decide this quarrel is too expensive, too much trouble and will settle and shut up.  From the perspective of traditional litigation strategy, the bank is probably in a stronger position because it can afford to spend much more on lawyers and technical experts to fight the case.

 

Internet as Populist Bullhorn

This is an unusual lawsuit.  But it has taken an even more remarkable twist.  Instead of cowering, Hillary has gone on the publicity warpath.  On its primitive web page, Hillary complains noisily about the bank and its security.  

It started working with other interested and knowledgeable parties, and is shouting from the virtual rooftops, “Can you believe this?  Hackers stole $200,000 from my bank account, and then my bank sued ME!”  That's one newsy sound bite.

Hillary has attracted quite a few news stories (including in the Dallas Morning News and the Denver Post), much of it favorable to Hillary.  The most sensational is a TV report on Fox Business, which is posted on the web.  Hillary of course points to many of these reports from its web site. 

What's more, Hillary affiliates appear to be posting pointed comments on web discussion threads.  When a popular Dallas news blog wrote an unrelated story about PlainsCapital, someone apparently associated with Hillary posted a comment saying (paraphrase) “Thieves stole money from our PlainsCapital account, and then PlainsCapital hauled us into court!” linking to the Fox Business video.  [Another example:  see the second comment, from Amanda, below this post.] 

Someone who appears to be the spouse of a Hillary co-owner vocally discusses the case in an online forum, complaining about the bank and pointing to the media reports.  

This controversy between Hillary and the bank now dominates the Wikipedia page about the bank.  Can this be good for the bank?

In the public comments to a key blog article on the lawsuit, one observer sympathetic to Hillary finds that the bank has published a job posting for a wire transfer risk specialist.  The observer suggests, yeah, they need someone with those skills!  The actions of this "observer" (Is he or she affiliated with Hillary?  A volunteer?  Who knows.) give the impression that the public is rallying to Hillary's aid.*

The bank hasn't said much to defend itself in public.  The bank's tight-lipped approach (“our lawsuit speaks for itself”) hasn't played well.  There is no way all this chatter on the web has been good for the bank's reputation.  The damage to the bank's image could far exceed $200,000.

Hillary is a reasonable-size mom and pop business ($35 million in 2008 annual sales).  PlainsCapital ($4.4 billion in assets) is much larger.  The bank's old-style approach – let our lawyers do our talking – seems to have enabled populist underdog Hillary to land some blows on its opponent.

Although many details about this case are known to the public, many are not.  We don't know, for instance, everything about the security or insecurity of Hillary's computers or whether the bank had offered Hillary some additional security procedures that Hillary declined to use.  (An example of additional security might be sms text messages to cell phones of Hillary officials as each and every event transpires within the bank account.)  The bank may have a stronger story here than it has revealed so far.

 

Cyber Publicity is Faster Than a Lawsuit

But as things are going now, the bank may not have a good chance to tell its side of this cybertheft story.  Internet-driven public opinion may solidify long before the bank can explain.

Talking on the web (Hillary's approach) is fast and cheap. Talking through lawyers in the courtroom (the bank's approach) is slow and expensive. 

Publicity is different today than it was a few years ago.  In the past, an unflattering report might appear on TV or in a newspaper, and then it was gone and few would remember.  But media reports today live persistently on the web.  Months-or-years-old reports can show up when prospective customers google “PlainsCapital Bank.” 

This squabble is not over.  But as of February 16, 2010, little Hillary seems to have exploited the web as an asymmetrical weapon against a larger adversary.

Update: Resolution May 2010

Hillary and Plainscapital settled their their lawsuit, and agreed to keep the terms confidential.  The settlement came two days after the court rejected motions by Plainscapital that the case go to arbitration; Plainscapital apparently wanted arbitration because it felt a public trial was less likely to deliver it a net benefit.  It is hard for me to conclude that this lawsuit was good for Plainscapital.  The bank started the lawsuit.  The bank's apparent goal was to clear its name and reputation.  The bank did not achieve its goal.

–Benjamin Wright

Mr. Wright teaches IT security law at the SANS Institute, where he stresses how critical public communications (policies, notices, banners, warnings, contracts, subpoenas, interviews, social media, press releases, declarations in court and much more) are to effective cyber defense, negotiations and investigations.

* Gadzooks.  Notice how easily a grumpy member of the public was able to dig up a choice detail about PlainsCapital (its job posting for a risk specialist) and link to it from a well-trafficked location with an unfavorable comment.  The world did not operate this way a few years ago.  Organizations like PlainsCapital live in more of a fishbowl today than they once did.  Organizations must re-calibrate how they make and maintain their public images.

[Note:  Since I originally posted this article, Hillary Machinery and its affiliates have contacted me and asked that I correct a couple of factual errors.  Based on what they said and what I read elsewhere on the web, I have revised my article here.  If anyone believes that I have made a mistake here or any other place, I ask that person to telephone me promptly at 1.214.403.6642.]

Archive Twitter Official Business Records

Twitter Legal Compliance Policy

Many enterprises and professionals are using Twitter* for official business.  One local government example is the City of Raleigh, North Carolina.  The Raleigh municipal government appears to be using Twitter to broadcast public service messages.

For legal purposes, many professionals and enterprises are wise to archive some or all of their Twitter (or Foursquare) communications.  Records may be needed for such purposes as subpoenas, e-discovery (EDD), public records law and the like.  

How does one record Twitter for long-term storage?  In practice it is difficult for an enterprise (or an individual professional) to manage electronic records –-Twitter or otherwise -- for long periods of time. This difficulty motivates records managers to focus their attention and resources.

I argue that electronic mail should normally be the cornerstone for archiving electronic business records.  My feeling is that e-mail is the first digital place the legal system expects to find important records.  When records managers tackle electronic records, e-mail is the logical first place for to focus attention and resources.  Every business person has an e-mail account, through which he or she exchanges important messages.

Thus, as a business professional adopts social media like Twitter and Facebook for serious communications, a practical approach to archiving those communications is to capture them in the professional's email account.  Services like Twitter and Facebook come and go.  They are hot this year, but something else may replace them next year.  The professional's email account, however, is fairly permanent and stable.  The email account is the unified, timeless place to store all important communications.

I've previously suggested how to use a business email account to capture Facebook messages.  Native Facebook provides tools for exchanging many kinds of FB messages via email.

I've looked for similar tools at Twitter.com.  However, native Twitter does not appear to support email as much as FB does.  Instead, Twitter supports SMS*.  SMS is normally associated with cell phones. 

Twitter's support for SMS gives me ideas for simple record-keeping.  It is relatively easy to integrate SMS with email for the purpose of capturing messages in an e-mail account.  I offer some simple examples here. I'll bet even better ways exist. 

For some professionals, the easiest way to submit a tweet* to Twitter via SMS, while also saving a copy in a business email account, is with a cell phone.  Many cell phone services such as Sprint allow the user to send an SMS message to a mobile number (such as the mobile number that Twitter supports) and, at the same time, to an e-mail address.  Accordingly, a user could use SMS on his Sprint phone to send a tweet to Twitter, with a copy to his business e-mail account, where it can be archived like all his other email.

In the alternative, the professional can subscribe to a paid service like ipipi.com to act as a gateway between email and SMS.

If the professional uses Microsoft Outlook for e-mail, she could exchange SMS message from her email client using the Outlook Mobile Service.  The service works via an SMS account with a provider like your cell phone carrier, and thus might involve special charges.  Using the Outlook Mobile Service, the user could send an SMS tweet to Twitter, and her Outlook account would keep a record just as it normally would keep a record of an outgoing email.

Here is a screenshot of a tweet sent from a Sprint phone.




What do you think of these ideas, Gentle Reader?

Update:  Apparently there is a twitter gadget for gmail that will store your tweets in gmail so they can be archived like email.

Another update:  Apparently Twitter, and search engines that search Twitter, lose much of the tweet conversation quickly.  Although Twitter keeps tweets indefinitely, it is unable to search for features like hashtags, which organize ongoing conversations, such as #iranelection.  Similarly, LinkedIn seems not to display public conversations more than a couple of weeks.

Third update:  The Broward County Sheriff's Department has created its own Twitter-like service, called CyberVisor, to broadcast messages about crimes and emergencies as they develop.  Presumably the Sheriff's Department can control and record this service better than something on Twitter.

–Benjamin Wright

Mr. Wright teaches e-discovery, records management and cyber security law at the SANS Institute.


* What is Twitter? Twitter is a popular social media service that allows users to broadcast and read short messages.  The little messages are normally stored on Twitter’s web site (in the form of a so-called micro-blog), and are often transmitted to other places such as cell phones and widgets on other web pages.

* What is SMS?  SMS means short message service.  It is best known as the standard for exchanging text messages among cellular and mobile phones.

* What is a tweet?  A tweet is a short text message, no more than 140 characters, broadcast or micro-blogged from a user's account in Twitter.

Subpoena Facebook

Locating Social Network Legal Evidence

[See latest update 2014 on how to get subpoena results.]

If you seek to cause Facebook to disclose the content of communications to or from a Facebook user, remember that the user's home or business email account may contain much of the information you seek.  (The same goes for LinkedIn, Foursquare, Yelp, Skype, Groupon or online dating sites and services.)

The email account may contain some of the messages the user posted on Facebook.  Facebook allows a user to submit, via email, updates for publication on his or her Facebook Wall.  See my records management discussion about the Facebook-update-by-email feature.

Further, Facebook often emails a user with notices about and/or copies of content of messages posted by others for the benefit of the user.  For example, here is a screenshot of an email from Facebook:
















Hence, the user’s email account may contain the content and date/time of many desired Facebook messages, even those messages (ESI*) that have been deleted from Facebook.  

 

Records on Cell Phones

Another place to look for Facebook notices and content may be SMS records on the user’s cell phone. Facebook can be configured to send certain notices (with copies of FB message content) to the user’s SMS account. The types of notices that FB sends to SMS are not as numerous as the types that FB may send to electronic mail.

  Service Providers Resist

Normally, when handed a civil subpoena, such as in a divorce, infidelity or child custody investigation, a service provider like Facebook (or Hotmail or Google ) will resist disclosing the content of a user’s communications unless and until the user consents.  A common rationale cited for resistance is that the content is protected under the Stored Communications Act.

Compelling User to Cooperate

Often, law will compel the user to consent to the service provider releasing records of communications. Some recent cases have been compelling users to turn over, to their adversaries, their social media user ID and password.

Metadata and other Non-Message Content Data

See practical discussion on the retetion and disclosure of text and other messages by service providers.  Service providers may see a distinction between the content of messages and metadata about the messages, such as time of transmission.  Some service providers believe they can be compelled to turn over meta data but not message content.

An emerging class of social media services (Foursquare.com, Yelp, Gowalla) collect and store not just messages, but also  location information.  John was at the burger joint on May 11, 6:33pm, and at the ball park May 12 at 7:07pm.  This data will be the target of subpoenas.  The degree to which service providers will resist the subpoenas remains to be seen.

–Benjamin Wright

Mr. Wright teaches data law at the SANS Institute.  

*What is "ESI"?  ESI means electronically stored information.  It is a legal term of art applying to electronic information that is desired for legal purposes such as a lawsuit or an investigation.

See related post on deception in investigations on Facebook  and other social networks.

Related article: How to record what you see on Facebook or other online media.

Update 2013:  Facebook sent an SMS text to my phone telling me it will begin sending me a steady stream of text messages regarding FB activities of my friends and me . . . unless I opt out.  So the default at FB (at least for a user like me) is to send lots of text messages to my phone that refer to activity in my FB world.

Update:  Send a preservation letter to the subject of an investigation.

Tag Disclosed ESI | Privacy, Control, Security

Warn FBI, Auditor, Examiner, Adversary, Regulator, Investigator or Inspector General

Ediscovery Production Strategy-Services for Text, Email, Twitter, Facebook Google+ or Other Social Network Records

Subpoena . . . tax audit . . . court order . . . police raid . . . search warrant . . . criminal investigation . . . regulatory proceeding . . . administrative summons . . . grand jury inquiry . . . litigation discovery demand -- any of these could compel or motivate a party holding e-records to reveal or produce them.

But often the party that receives (or seizes) the records should be expected to safeguard them after they arrive.

Laws requiring the safeguarding of records are many and diverse.  One small example:  As a business discloses information to the federal government, it can (if justified) tag or annotate the information as a “trade secret.”  By so doing, the business warns government employees that they violate federal law (18 U.S.C. Section 1905) if they abuse the trade secret, such as disclose it to a competitor or to the news media.

Legally speaking, the tagging or annotating of records can be strategically powerful.  But when a large quantity of e-records (SMS, chat, e-mail, Web 2.0, iPhone, BlackBerry) is involved, manual annotation is laborious and expensive.

Emerging technology affords a solution.  Technology empowers producing parties to annotate (label, tag) records with ever-better precision and efficiency.

When records like instant messages are disclosed under law, it is becoming more common that they be disclosed in an electronic format that supports annotations, such as XML.

Electronic annotation (commenting) enables highly granular, specifically-targeted legal notices.  Targeted annotation can give the producing party an advantage.  The advantage is more apparent when large numbers of record are at issue and different records require different notices.

By long-standing practice, lawyers often mark disclosed records with warnings or reservations of rights. But historically these notices were expressed as general, blanket statements in transmittal letters. (See footnote.)

When numerous records are involved, blanket statements may not be as effective as specific, record-by-record annotations.   Suppose for example that five million email records are being produced.  Within those records are, say, 2137 that contain personally identifiable information (PII), which the producing party is obligated to safeguard.  The producing party may better fulfill its obligation by specifically annotating each of the 2137 with strong warnings, rather than with general notices covering the whole five million.  (Example:  “WARNING: This email may contain private data protected by law.  Access on need-to-know basis only.”)

Specific annotations can include any of a range of legal statements:  disclaimers, instructions, interpretations, cross references, self-serving language, reservations of rights, claims of privacy, contractual terms of use, designation as attorney work product and more.

According to Ranjit Sarai, e-discovery consultant at Messaging Architects, “Annotations can involve advanced services in e-record production.  Manual annotation of individual records can be very time consuming.  But we can recommend or develop routines for identifying relevant records and placing the prescribed annotations on them.  We can facilitate collaborative, team annotations.  We can also help bring the appropriate attention to annotations.  Some annotations should be understated.  Others should scream out in blinking neon lights.”

Update:  Tags and annotations can be inserted according to varying degrees of granularity, whether record-by-record, word-by-word, or something else.  US intelligence agencies are managing massive databases on terrorists by tagging each word, one-by-one.  A tag can show, for example, the level of security clearance an analyst needs in order to see the word.  Advanced search software can prevent an analyst from seeing information for which he does not have adequate clearance, while alerting him that the database may contain additional information relevant to his inquiry, access to which will require higher authority.   Siobhan Gorman, "How a Team of Geeks Cracked Spy Trade," Wall St. J., 4 Sept. 09.

–Benjamin Wright

Mr. Wright delivers education on cyber defense law under the SANS Institute.


Footnote:  A case known as Teachers Insurance(1) suggested that when a company discloses information to the Securities and Exchange Commission, it waives attorney-client privilege on that information, unless it explicitly reserves its privilege rights.  Applying that idea, a company in another case(2) attempted to make such a reservation of rights in the transmittal letter sent with documents disclosed to the SEC. 

(1)Teachers Insurance and Annuity Assn. of America v. Shamrock Broadcasting Co, 521 F. Supp. 638 (SDNY 1981).

(2)In re Subpoena Duces Tecum to Fulbright and Jaworski and Vinson & Elkins, 183 Fed. Sec. L. Rep. para. 99,505 (DDC 1983).

Text Email Home PC - BlackBerry - iPhone - Cell Phone

Discovery in Business Lawsuit?

How far will the law will go to get the e-mails, text message records, that are relevant to a legal inquiry like a lawsuit?

An eye-opening Canadian case is CIBC World Markets Inc. v. Genuity Capital Markets, [2005] O.J. No. 614 (S.C.J) (QL).

CIBC sued Genuity, alleging it had stolen trade secrets from CIBC.  When a lawsuit like this is filed, the parties are expected to apply a litigation hold to ensure no records are destroyed.  But a litigation hold is hard to implement if a litigant is not causing copies of all business e-mails to be stored in a central archive.  Furthermore, if the litigant is not storing copies of all its employees’ messages, then it may be forced to canvass their home computers.
 
In the CIBC case, the court permitted forensics experts to go to great lengths and expense to locate e-mail.  They were granted access to all PCs, BlackBerries (smart mobile phones) and similar devices under the influence of the Genuity's employees, including devices at home (like iPods, iPhones or Androids) and belonging to spouses and children!  (In an investigation like this, imagine what goes through the mind of an employee who might have been involved in any kind of marital strife or infidelity.)

The lesson from the case is that enterprises are wise to keep extensive, centrally-managed archives of all business-related e-mail (including webmail, SMS, MMS [multimedia message service], text messages and instant messages) by employees and other personnel.  That way they avoid the expense and hassle associated with searches of home computers and other personal gadgets.

This topic grows more important as informal electronic contracting, such as trading in OTC derivatives, attracts greater scrutiny, regulation, litigation and investigations.

–Benjamin Wright

Click Here

 

Mr. Wright teaches electronic data and records law at the SANS Institute.