Electronic Data Records Law | How to Win E-Discovery

Whistleblowers Leak Secrets

Wikileaks.com for Accountability

If a public organization doesn't embrace transparency, transparency will be thrust upon it forcibly.  For any institution, its electronic records are so detailed and subject to revelation in so many ways that the institution must find a way to pre-empt their inopportune public disclosure.  Better to come clean with information now – before the lawsuit (think deposition) or the FOIA request or the hacker break-in brings the information to light.

The climate research unit at the University of East Anglia is learning directly how disconcerting unexpected disclosure can be.  
 Someone – whether an outside hacker spy or an inside whistleblower – has leaked volumes of e-mails, software, source code and programmer notes to the world.  As a world leader on climate modeling, the university is shocked to see its internal discussions hung out for public scrutiny.

Some emails suggest the university's scientists had earlier tried to destroy records to prevent their disclosure under a freedom of information request.  Other records arguably depict programmers manipulating data for key climate modeling software in a deceptive manner.  Some emails appear to show researchers misallocating expenses against a US government research grant.

Some observers speculate all these records had been assembled for a freedom of information request, and after the request was denied, an internal whistleblower elected to liberate them.  Once information leaves the confines of the institution, it's easy to broadcast through channels like Wikileaks.com.

Separately, another institution on which technology has violently imposed transparency is international banking.  An IT staffer at LGT Group stole secret bank customer records and sold them to the German tax authorities, who used them to prosecute tax evaders. “Liechtenstein Under Siege Clings to Bank Secrecy to Outdo Swiss,” Bloomberg.com 2/27/08. 

Then a US Senate investigative committee data-mined Homeland Security records of foreign visitors to uncover a pattern of Swiss bankers coming to the US illegally to solicit deposits from rich American taxpayers.  These unsavory revelations -- made possible by new technology -- has devastated the long-standing industry of secret bank accounts in places like Switzerland.  The US has largely closed down that industry as an avenue for tax evasion and other crime. Kevin McCoy, “IRS: Offshore tax crackdown should produce 'billions',” USA Today, Nov. 17, 2009.

So in this technological age of leaks and sousveillance, what are institutions to do?  Here are three mild examples of proactive transparency: 

* New York City allows web-empowered citizens to track their government's performance on details like response times on calls to the fire department or the street maintenance crews.

* The City lets the same citizens monitor how the city is spending federal stimulus dollars.

* 15 local governments in South Carolina now post their full check registers online so citizens can scrutinize how the governments spend cash and which vendors get how much money.

Update November 29, 2009:  After thinking about it, the University of East Anglia has decided that radical transparency is the only logical policy.  In the wake of the hacker break-in described above, the University has announced it will reveal "all" of its climate data as soon as possible.

–Benjamin Wright

Mr. Wright teaches Data Retention and Security Law at the SANS Institute, where he emphasizes how critical public communications are to good information security.

Related post: Whistleblowers with cameras

Recordkeeping for Social Networking Managers

Social Networks for Official, Commercial & Employment Transactions

By law, employers generally need to keep records of employment decisions.  So when the boss conveys a pink slip by way of Facebook, the employer needs a legal record of it.

What?  Fire someone by Facebook . . . a posting on a wall?  Would a manager do that?  Yes.  A spa in Canada (British Columbia) used Facebook to notify Crystal Bell of her job termination.

The history of electronic messaging tells a story about business records.  As each new form of message comes along, we initially doubt you can conduct business with such a flimsy thing.  Fax as a medium for transacting serious business?  No way, people thought in the early 1980s.  But as time passed –- and as court cases enforced fax contracts -- we grew more comfortable with fax as a business tool.  Today, fax is considered a responsible, even conservative medium for transmitting signed agreements and binding business records. 

Then, when electronic mail came into the workplace, conventional wisdom dismissed it.  Convention said e-mail was not a business record, said it could not (conveniently) be authenticated with a signature, and said it should be deleted quickly like so much water-cooler chitchat.  But naturally business people embraced e-mail as a tool for making obligations and delegating authority.  Today we see the law giving enterprises growing reason to store e-mail as business records.

I predict the same process will unfold for collaborative (Web 2.0 and social network) media like instant message, Facebook, Twitter and Myspace.  Old-fashioned folks will try to ban these technologies as methods for conducting important business.  They will, initially, ignore them as records to be kept.

But the outcome of the story is inevitable.  Busy people (like the boss in BC) will use the new channels to hire, fire, negotiate, agree and so on.

The managers of records need to plan for capturing the records of Web 2.0.  Those records can become the subject of a subpoena, an IRS taxpayer audit, an administrative summons or an internal investigation or the source of exculpatory evidence in defense of lawsuits.