Electronic Data Records Law | How to Win E-Discovery

Facebook Business Records

Record Retention Policy?

Social networking like Twitter is becoming more popular as a medium of communication for official, business or professional messages.  Should these messages be recorded?  Often the answer is yes.

California attorney Laura Meier has written an article* saying it is becoming more common for local governments to use Facebook and other social networking media to interact with citizens.  An example (not cited by Ms. Meier) is City of Westerville, Ohio.  Ms. Meier suspects that public records/ open meetings / sunshine laws could require governments to record much of this communication.  These laws generally help citizens monitor the actions of their government and audit for misuse of public resources.

The Florida Attorney General opined that presumably most of the Facebook communications created by a Florida city government would be public records that should be retained according to official schedules for public records.

Update:  See new post on how to record Facebook messages for official business.

Private enterprises are using Facebook to transact business.  (Soon they may be using Google Buzz too.)  A vendor named Worklight offers software that provides a “secure corporate overlay for Facebook,” claiming its product allows enterprise employees to interact via Facebook, while ensuring that sensitive information does not leak to outsiders.  Worklight suggests one way to use Facebook (using its secure software) in a private company would be to approve purchasing transactions.  Manager Sally for instance might use Facebook to authorize clerk Bill to spend $10,000. The enterprise would need to make and keep a virtual record of such authorization for purposes of internal control.

I am not aware of any vendor yet selling software to help an enterprise record activity in a public social networking environment like Facebook.  (Vendors, note the market opportunity here.)  One of my fellow instructors at the SANS Institute, Kevin Johnson, says that Facebook publishes APIs that a third-party vendor might use to make such software. (Kevin is a contributor to Social Media Security.)

Until a vendor makes a product for recording Facebook, how is an enterprise to record it?  One not-so-convenient way is “print screen.”

I prefer not discouraging enterprises like municipal governments from using effective technology to fulfill their mission.  As they assess the difficulty of recording Facebook, they should remember that records management has never been perfect.  Paper records were easy to mishandle and lose.

–Benjamin Wright

Mr. Wright teaches eDiscovery and data security law at the SANS Institute.

* D. Derleth, L. Meier, R. Moin, "Social Networking Sites:  Legal Issues for Public Agencies and Public Officials to Consider," The Public Law Journal, vol. 32, no. 4, Fall 2009.  Another issue Ms. Meier raises is whether information posted on a social media site could put a city on notice of a hazardous condition, which the city is obligated to address, even though the city does not have staff dedicated to monitoring the site sufficiently to understand the notice and act on it.

Local Government Email | Freedom of Information Act

E-discovery under State Open Records or Sunshine Laws

Police Video Records

Increasingly, public agencies are required to search for, locate, uncover and turn over e-mail records in response to freedom of information and open records requests.  

Generally speaking, under either state or federal law, a freedom of information act requires government to disclose requested records to citizens.  Sometimes a FOIA might be known as (or associated with) an open records act or a sunshine act.  

One example: A Kentucky judge required state government to give a man copies of e-mails between his wife, a state employee, and another state employee whom the man suspected was having an affair with his wife. (Associated Press, “Judge: Ky. Man Can See His Wife's E-Mail,” Nov. 20, 2007.)

Another example:

A newspaper requested under Arizona’s open records law access to records of e-mail by a county official on county computers. The official fought the request, claiming the records were personal and therefore not subject to disclosure. The Arizona Supreme Court held that the records must be shown to a trial judge. The judge should then decide whether they are personal records (deserving of privacy), which are to be withheld, or public records. (The Reporters Committee for Freedom of the Press, "Judge must decide whether e-mail is private," April 27, 2007.)

Third example:  A West Virginia judge held the state's FOIA required the state to release e-mails of the state's Supreme Court Chief Justice. The justice had send the e-mails from his government account to the head of a private coal company.  (The Reporters Committee for Freedom of the Press, "Even high court subject to FOIA in West Virginia," September 18, 2008). Although the released e-mails did not pertain directly to the court's internal administration or cases pending before the justice, they touched on more than merely personal matters.  They at least mentioned upcoming supreme court elections.

To respond to these requests takes time and resources on the part of agency IT staff. Haphazard records management makes the job more difficult.  Agencies therefore have incentive to keep organized, searchable e-mail records.  And they are wise to insist that all employees (including governors and supreme court justices) route all official messages to or through centrally-controlled archives.

These cases are just random examples.  I wouldn't be surprised to find similar cases in other states, whether Indiana, Ohio, Colorado, Tennessee, Arkansas, Indiana or wherever.

With the proliferation of digital gadgets in government, the quantity of records that are discoverable under FOIA is exploding.  One company that makes equipment for police departments has developed a video camera, which an officer would wear on his head, to record everything he sees and hears while on duty.  Veronica Dagher, "New Taser 'Shoots' Evidence," Wall St. J., 9/2/09.  Wow!  That would create a bonanza of government records and evidence.  [Query whether, to comply with privacy laws, police should publish warnings (such as big decals on squad cars) that officers are video recording all they see and hear.]

Update:  Reportedly, when Sarah Palin resigned as governor of Alaska, she cited $2 million as the cost incurred by the state to respond to FOIA requests about her.   FOIA is a growing expense for government.  Governments need to employ technology to contain that cost.  For example, any time government delivers information to one FOIA requester, it should publish that information on the web.  Web publication will avoid the cost of retrieving and culling the information again under future requests.

--Ben Wright

Mr. Wright, a practicing attorney, teaches the Law of Data Security and Investigations at the SANS Institute.