Electronic Data Records Law | How to Win E-Discovery

Lawsuit Advantage

Electronic Discovery Search-Strategy

Litigants by their nature are in search of advantage over their adversaries.  In this computer age, new tools for advantage emerge every day. 

An intriguing discipline that could yield new tools is linguistic analysis, especially sentiment analytics.  A company
named Jodange searches vast quantities of text in social media (Twitter, Facebook, LinkedIn, Yelp, online dating sites) to ascertain the opinion (the sentiment) of thought leaders or interest groups.  It employs computer-driven algorithms to analyze, for instance, the compositional semantics within text (e.g., tweets on Twitter) to glean what, say, US consumers think of brand X.

For sentiment analytics, I see a promising application in what we lawyers call "eDiscovery."  eDiscovery is a rapidly growing field, where much money is at stake.  eDiscovery includes the collection and review of vast quantities of data (especially email) in a lawsuit or investigation.  A business or government lawsuit can involve tens of millions of emails -- too many to read and understand one-by-one.  Linguistic analysis, and sentiment analytics, could be valuable to a litigant seeking e-Discovery (EDD) advantage.

Intent Influences Legal Results

Why do I think sentiment analytics could be especially relevant to a lawsuit?  The reason is that very often legal liability or outcome depends on the “intent” of a person or an enterprise.  For example, to commit a crime a defendant must usually intend to do something wrong.  No intent, no crime.  

In complex criminal cases, like one against a corporate defendant, the defendant strives to show that it had no intent to behave badly or break the law.

To deduce the intent of people or entities from large numbers of communications such as e-mails is not easy for a jury or a judge.  Sentiment analytics could help.  Just as it can help interpret the opinion of 20,000 consumers, it could help answer questions like, what was the corporation thinking, what did it mean to do, what was its intention?

Example in a Lawsuit

I imagine this kind of argument being made by an antitrust defendant in court:  “Sentiment analytics of four million emails within ABC Corporation reveals that neither the company, its staff nor its leadership had a plan, desire or intention to fix prices, to conspire with competitors or to otherwise violate the antitrust laws.”  Presented correctly, that kind of argument could be powerful, and could open a new chapter in American jurisprudence.

The cases to which sentiment analytics applies need not necessarily involve extremely large numbers of messages.  Sentiment analytics might be useful for interpreting, say, a few hundred messages in a child custody battle or the augmented reality advertisements broadcast to the patrons of a restaurant during a particular week.

Investigators -- whether they be courts, auditors or regulatory authorities -- need new tools.  Linguistic analysis tools could help any kind of investigator make sense of voluminous electronic evidence.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigations law at the SANS Institute.

Archive Facebook Business Messages

Employee Policy

Professionals, business people, and government employees are increasingly using Facebook and other social media for official business, often as agents of their employers.  Commonly, the employers are required or well-advised to make and keep records of the employees’ social media communications. 

This issue arose in a workshop that Messaging Architects and I led at a sizable enterprise (having about 8000 employees).  The purpose of the workshop was to establish policy on the retention of electronic records. The workshop pulled together representatives of disparate stakeholders within the enterprise, including the IT, legal and compliance departments.

Workshop participants, including representatives from human resources, feared that employees would ignore a policy that forbids them from using text messages, Facebook and Google Buzz to transact business.  So the workgroup drafted this language for adoption as HR corporate policy: 

“If an employee uses electronic messages for business, outside an enterprise email system account, the employee is expected to strive to make records of the messages such that they are within the control of the enterprise.”

Dear Reader:  What do you think of such a policy?

Next question:  Speaking practically, how would an employee make and keep records of Facebook communications?  I don't have all the answers, but here's a step to consider:

Facebook allows a user to submit many of his postings via email. So at http://www.facebook.com/mobile/?v=web Facebook shows the user that if he sends some text to a special email address, then the text will be posted as coming from the user. 




















For example,  . . .   here is a screenshot of a message I posted from my email account:









Facebook posts this kind of incoming email as a status update to the user’s Wall.  Note that when a user like me submits text via email, the only text that appears on the user’s Wall (status update) is the text in the subject line of the user’s email. If the user writes anything in the content of the email, Facebook seems to ignore it and seems not to post it.

Thus, in the example above, I wrote all the text in the subject line of the message from my email account to my FB account.

If an employee were to submit to FB by way of her employer-controlled e-mail account, then the account would retain the submission according to whatever record retention/destruction policy the employer has set – 90 days, seven years, or whatever. [Interesting questions: In the employer's email system, are there limits to the number of characters that can be transmitted in the subject line of an outgoing message and can be stored in the record of that message?]

A FB user can submit more than text from his email account. The FB user can also submit a photo (or even a video). FB posts the photo on the user's Wall, with text taken from the subject line of the email. For instance:


















So . . . the above is one convenient way for a business professional to store her Wall posts into her employer's email system, such that the posts will be preserved for audit, inspection, supervision, ediscovery, litigation hold and the like. 

I argue that email archives are the starting place for any enterprise that wishes to maintain electronic records for legal compliance purposes.  I argue the same goes for Twitter.

My ideas here leave scads of answered questions, such as how to record comments that others post on the user's Wall.

–Benjamin Wright

Mr. Wright teaches IT and records management law at the SANS Institute, where social network law is part of the curriculum.  He chairs a (proposed) SANS conference on e-records and e-discovery slated for Las Vegas, September 2010.

Update:  Cutting-edge Web 2.0 lawsuit.

Employee Privacy on Social Network

Trespassing in Cyberspace

Computer Investigation Law

Investigators engaged in electronic discovery should be mindful of posted terms, conditions, EULAs, labels, notices, warnings, banners, contracts, agreements and no-trespassing signs.  They can have legal effect in the electronic world, and may be binding on an investigator who encounters them. 

Consider Pietrylo v. Hillstone Restaurant Group.  

While off-duty, restaurant employees maintained a password-protected MySpace forum, labeled as “talk about all the crap/drama/and gossip occurring in our workplace, without having to worry about outside eyes prying in.”  Pietrylo created and maintained the forum, explicitly designated it as “invitation only,” and distributed passwords to a limited number of employees.  One of these employees gave her password (whether voluntarily or otherwise is unclear) to restaurant management.  Management accessed the forum, and discovered . . .

Facebook Business Records

Record Retention Policy?

Social networking like Twitter is becoming more popular as a medium of communication for official, business or professional messages.  Should these messages be recorded?  Often the answer is yes.

California attorney Laura Meier has written an article* saying it is becoming more common for local governments to use Facebook and other social networking media to interact with citizens.  An example (not cited by Ms. Meier) is City of Westerville, Ohio.  Ms. Meier suspects that public records/ open meetings / sunshine laws could require governments to record much of this communication.  These laws generally help citizens monitor the actions of their government and audit for misuse of public resources.

The Florida Attorney General opined that presumably most of the Facebook communications created by a Florida city government would be public records that should be retained according to official schedules for public records.

Update:  See new post on how to record Facebook messages for official business.

Private enterprises are using Facebook to transact business.  (Soon they may be using Google Buzz too.)  A vendor named Worklight offers software that provides a “secure corporate overlay for Facebook,” claiming its product allows enterprise employees to interact via Facebook, while ensuring that sensitive information does not leak to outsiders.  Worklight suggests one way to use Facebook (using its secure software) in a private company would be to approve purchasing transactions.  Manager Sally for instance might use Facebook to authorize clerk Bill to spend $10,000. The enterprise would need to make and keep a virtual record of such authorization for purposes of internal control.

I am not aware of any vendor yet selling software to help an enterprise record activity in a public social networking environment like Facebook.  (Vendors, note the market opportunity here.)  One of my fellow instructors at the SANS Institute, Kevin Johnson, says that Facebook publishes APIs that a third-party vendor might use to make such software. (Kevin is a contributor to Social Media Security.)

Until a vendor makes a product for recording Facebook, how is an enterprise to record it?  One not-so-convenient way is “print screen.”

I prefer not discouraging enterprises like municipal governments from using effective technology to fulfill their mission.  As they assess the difficulty of recording Facebook, they should remember that records management has never been perfect.  Paper records were easy to mishandle and lose.

–Benjamin Wright

Mr. Wright teaches eDiscovery and data security law at the SANS Institute.

* D. Derleth, L. Meier, R. Moin, "Social Networking Sites:  Legal Issues for Public Agencies and Public Officials to Consider," The Public Law Journal, vol. 32, no. 4, Fall 2009.  Another issue Ms. Meier raises is whether information posted on a social media site could put a city on notice of a hazardous condition, which the city is obligated to address, even though the city does not have staff dedicated to monitoring the site sufficiently to understand the notice and act on it.

Recordkeeping for Social Networking Managers

Social Networks for Official, Commercial & Employment Transactions

By law, employers generally need to keep records of employment decisions.  So when the boss conveys a pink slip by way of Facebook, the employer needs a legal record of it.

What?  Fire someone by Facebook . . . a posting on a wall?  Would a manager do that?  Yes.  A spa in Canada (British Columbia) used Facebook to notify Crystal Bell of her job termination.

The history of electronic messaging tells a story about business records.  As each new form of message comes along, we initially doubt you can conduct business with such a flimsy thing.  Fax as a medium for transacting serious business?  No way, people thought in the early 1980s.  But as time passed –- and as court cases enforced fax contracts -- we grew more comfortable with fax as a business tool.  Today, fax is considered a responsible, even conservative medium for transmitting signed agreements and binding business records. 

Then, when electronic mail came into the workplace, conventional wisdom dismissed it.  Convention said e-mail was not a business record, said it could not (conveniently) be authenticated with a signature, and said it should be deleted quickly like so much water-cooler chitchat.  But naturally business people embraced e-mail as a tool for making obligations and delegating authority.  Today we see the law giving enterprises growing reason to store e-mail as business records.

I predict the same process will unfold for collaborative (Web 2.0 and social network) media like instant message, Facebook, Twitter and Myspace.  Old-fashioned folks will try to ban these technologies as methods for conducting important business.  They will, initially, ignore them as records to be kept.

But the outcome of the story is inevitable.  Busy people (like the boss in BC) will use the new channels to hire, fire, negotiate, agree and so on.

The managers of records need to plan for capturing the records of Web 2.0.  Those records can become the subject of a subpoena, an IRS taxpayer audit, an administrative summons or an internal investigation or the source of exculpatory evidence in defense of lawsuits.

Web 2.0 records are a topic of growing interest to financial regulators.  The US Treasury Department is proposing extensive recordkeeping requirements for OTC non-standardized derivatives contracts.  Given technology's rapid advance, this proposal will involve the retention of many informal records.

Update:  Government attorneys are cautioning officials about government maintenance of Facebook pages.

–Benjamin Wright

Mr. Wright is a paid colleague of Messaging Architects, consultants in eDiscovery services.  He provides training in e-commerce law at the SANS Institute.