Electronic Data Records Law | How to Win E-Discovery

FBI Cloud Computing Raid

Minimizing Collateral Damage

When the FBI raided DigitalOne, a co-location data center, in search of data belonging to criminals, it also disrupted innocent businesses.  One of those was Instapaper.  Services for Instapaper were offline for most of a day.  The services unexpectedly stopped, and then resumed many hours later.  

Whether the disruption was unavoidable is unclear.  
The FBI did not explain how the raid transpired.  DigitalOne suggested that the FBI was clumsy, taking a whole enclosure of servers, rather than the particular servers that were the focus of its raid. 

Some in the technical community have criticized the FBI for not knowing the difference between an enclosure and a server.

I don’t know whether the FBI was in fact clumsy.  The full story is probably complicated.

Problem Will Be More Common

This not the first time that a well-meaning FBI raid of a contract data center caused disruption to innocent businesses housed at the center. A company named Liquid Motors complained in court when an FBI data center raid damaged its business, which was not connected with the criminal activity that precipitated the raid.

Disruptions like this threaten to grow more common.  Co-location, cloud computing and other IT outsourcing are on the rise.  FBI and other law enforcement need to refine their methods of investigation.  When they must raid a data center that serves multiple clients, they should not cause more harm than good.

What FBI Should Do

Yes, FBI needs to shut down cyber criminals and collect evidence so they can be prosecuted.  But FBI undermines the community’s trust when it damages innocent bystanders.

Before executing a raid, FBI should evaluate whether its mission truly requires it to seize hardware and take it offline.  It should develop techniques for surgically getting what it needs, while avoiding disruption of anything else.

FBI further should strive for transparency and accountability.  It should vow to the community to disclose as much as it can, as soon as it can, about what it is doing and how. It should explain which servers it is impacting, in what way and for what reason.

I realize that explanation to the public is time-consuming work.  And explanation can lead to second-guessing and criticism.  But explanation is necessary to ensure that FBI is constantly refining its methods and learning from any mistakes it makes. Explanation also promotes FBI’s stature within the technical community.

–Benjamin Wright

Mr. Wright teaches the law of data security and investigations at the SANS Institute.

Related:  Justice for innocent users of Megaupload

FOIA Meets Electronic Mail

Populist Politics

Publish Internal Records on the Web?

Freedom of Information Act requests will eventually motivate governments will publish on the web large portions of their official records, including the emails and text messages of officials and administrators.  Federal, state and local governments are being swamped with FOIA requests for email records of officials like county commissioners.

As more and more of these records are released to the public, people publish them on the web.  AnnArbor.com, a news organization, has assembled and published more than 2700 pages of emails of the city council members for the municipality of Ann Arbor, Michigan.  The records cover messages exchanged among members during the council's public meetings.  The municipality had released the e-mail records, piecemeal, on paper in response to numerous FOIA demands over time.  The news outlet then gathered them from the various requesters, scanned them into digital form, organized them and published them on the web.  As a consequence government became more transparent in that city.

As technology advances, and as populist activists make more use of FOIA, it will become easier and more common to find and assemble records like these on the open Web.   Ever-greater transparency in public administration is an inexorable force in the 21st century.

Wise government leaders will embrace radical transparency.  Instead of dribbling records out in small units, they will jump straight to the endgame and publish an ever-growing swath of their internal records and communications directly on the web and make them easily searchable.  

Meanwhile many politicians and managers will live in denial and fail to understand how technology is changing society.  The Ann Arbor city council, for instance, explicitly decided in October not to publish on the web a database of emails similar to the one that annarbor.com compiled and published.

–Benjamin Wright

Mr. Wright teaches eDiscovery and eData Security Law at the SANS Institute, where he stresses the growing role of web publicity. 

Whistleblowers and Digital Records Force Transparent Governance

Public Disclosure Defuses Scandal

Publish FOIA Response?

Technology motivates any publicly accountable organization (nonprofit, corporation, government) to adopt a radically open style of governance.

Owing to email, data logs, text messages and the like, the quantity of official business records ascends skyward, while the granularity of those records grows ever more fine.  Detailed within these innumerable records are the secrets of the organization.

Stored this way, secrets are dangerous.

Keeping secrets –- or just withholding information -- is becoming harder and harder.  Secrets and records can leak out by way of FOIA, spies, gossip, hackers, mistakes, e-discovery, whistleblowers, external surveillance, or just the natural course of events (sousveillance). In finance, a "trusted" banker will leak to a friend secrets about exotic instruments like credit default swaps, which are so new that the law has yet to establish "insider trading" rules applicable to them.  Kara Scannell, "Trader's 'Nice Little Kiss' Tests Reach of Regulations," Wall Street Journal, March 31, 2010.

A leak is dangerous.

The leak is an invitation for an adversary to allege malfeasance.  When a secret leaks, the adversary's storyline becomes (a) the organization possessed information that the public needed, (b) the organization wrongfully withheld the information and (c) the public now knows the information only because a righteous force external to the organization brought it to light.

For a smart organization, the best posture is to preempt the leaking.  Before the leak happens, it should embrace transparency and publish (most all of) its records and activities onto the public Internet.  It should expose its information to independent review and debate.  Authors Tapscott and Ticoll admiringly call such an organization the naked corporation.

False Statement?

Take for example the story of the small, grassroots political action committee named “Take Back Your City,” which is promoting a vote by citizens against red light cameras in the municipality of College Station, Texas.  Through freedom of information act, the PAC obtained extensive email records regarding the city government’s use of the cameras.  In this trove of information, the PAC found what it believes is smoking gun evidence that the city is engaged in false, illegal political advertising about the effectiveness of the cameras.  The city claims – in a flyer to be inserted in monthly utility bills -- that the cameras have reduced traffic accidents, but the PAC says an internal city email contradicts that claim.  The PAC attached the email as evidence to a formal complaint it filed with the Texas Ethics Commission. 

Whether this complaint will result in ethics sanctions against the city (or more particularly the city manager cited in the complaint), I don’t know.  But the city’s defense would be easier had it been more open and transparent with its records.  When it gave the email records to the PAC, it could have also posted them all on its web page as well.  (Why not? The city had already gone to the trouble to compile them.)  Then, when it prepared its flyer for the utility bills, it could have made its point about accident reductions while also saying, “Each citizen can draw his or her own conclusions.  The city has posted on its web page exhaustive records regarding traffic cameras.” 

Such openness takes the punch out of allegations that the city lied.  Effectively, it enables the city to say, “We drew a conclusion from the data and told citizens our conclusion, but our statements to citizens were more than just that.  We also made all the data available to the citizens and told them they could read it themselves and draw their own conclusions.  We've opened the data to third party review.”

Investigating Leaks

Another lesson in transparency derives from the contrast in styles between the board of directors at Hewlett-Packard Company and the town council at Watertown, Massachusetts.

When HP saw that someone on its board was leaking company secrets, it assumed cloak-and-dagger
  mode. It didn’t talk about the problem.  It secretly hired private investigators to spy on members of its board as well as reporters in the media.  The private eyes violated the privacy of the directors by hijacking their telephone calling records.  AT&T discovered the hijacking and reported it to its customer, Tom Perkins, one of the directors targeted by the spying. The result was an embarrassing, debilitating scandal, with lawsuits, criminal complaints, an SEC investigation, a congressional investigation, and the end of career for two of the company’s top lawyers.

HP followed the old-fashioned, closed approach to resolving a crisis.  But in this Internet age -- where clandestine activities are hard to keep clandestine -- that approach led to disaster.

Compare the youtube video below.  It shows the town council dealing with the same problem as the HP board – insider leaks.  The leaks pertained to closed-door deliberations about contracts.  But rather than spying on its members in the dark of night, the Watertown council brought the issue into the open.  It discussed the topic in public, video-broadcast session! 

Notice that Watertown’s transparency immediately deters future leaks.  The leaker has to be thinking, “My leaks are attracting negative attention.  Now all the citizens are on alert, and some knowledgeable witness watching out there may come forward with embarrassing information that reveals me as the leaker.  I’d best stop leaking.”



By being transparent, the council uses the Internet as its enforcer, and it avoids the risk of a HP-style scandal.  Legal compliance meets modern public communications.

–Benjamin Wright

At the SANS Institute, Mr. Wright stresses that, in the wake of a data security incident, the delivery of a effective public message is as important as the technical and legal response.

Email Retention | Public Audit & Administration

German Laws, Orders, Regulations and Instructions

Affinity with Local (County) US Government

What does the law expect of electronic government records?   Records enable governments to be transparent.  If government keeps good records of its activities and gives citizens easy access to them, then citizens can review government and hold it accountable.

Today most government records are electronic.  Accordingly, the German federal government seeks to archive its electronic records, including e-mail.  A key initiative under the Federal Ministry of the Interior is DOMEA, a project that sheds light on the legal expectations for e-government records, including electronic mail. 

The DOMEA project recognizes that: “Electronic records . . . have to meet the requirements for record keeping in public administrations, which are prescribed in laws, standing orders, regulations  and instructions.  They include important points, such as: 

“1. The completeness, integrity and authenticity of official records, which means that official documents cannot be subsequently altered, changed, removed, destroyed or deleted. 

“2. The records principle of public administration, which means that documents have to be appropriately joined together in systematically arranged subject files according to the functions of a particular office. 

“3. The accountability and lawfulness of administrative procedures, which means that accountabilities and responsibilities have to be documented in records in the course of business and that the state of affairs and the development of transactions in a given case has to be completely evident in records at any time.”

Of course, the validity of these legal standards is not limited to Germany or even Europe.

If these are the legal standards for government records, then query whether popular enterprise e-mail systems such as Microsoft Exchange and Novell Groupwise are designed to meet these standards. Generally speaking, they are not.  They do not support efficient storage, management, protection and searching of vast quantities of e-mail records, collected from a large population of users over an extended period of time.  That’s one reason enterprises like governments commonly have policies to destroy most e-mail relatively quickly, such as 90 days after transmission.

But e-mail has become central to the administration of modern government.  Very often, e-mail documents official transactions and official delegations of responsibility.  It also empowers internal audits and investigations (by for example inspectors general) for fraud, waste, corruption, mismangement and misappropriation of funds.  

For some time organizations such as governments have relied on ad hoc methods for retaining e-mail – including the print-and-file method.  But e-mail is so voluminous and has become so important that ad hoc solutions are failing.  

Last week I led an on-site workshop with the staff of a mid-size county government struggling with this problem. Staff representatives hailed from IT, counsel, finance, administration, internal audit, human resources, risk management and public health services.  The county’s e-mail system is Groupwise.  The staff concluded that the county needs, in addition to Groupwise, a dedicated e-mail archive appliance. The workshop enabled the staff to write new, modern policy on e-mail archival.

–Benjamin Wright

Mr. Wright teaches e-discovery and e-investigation law at the SANS Institute.

He is an advisor to Messaging Architects, where he leads an in-house workshop to help the stakeholders in an enterprise craft workable policy on the management of email and other eRecords.

P.S.  New Mexico's Attorney General (AG) indicted the state's former Secretary of State (SoS) for tax evasion and money laundering tied to alleged kickbacks to her by the recipient of federal grant money.  Stephanie Simon, "New Mexico Roiled by New Graft Case," Wall Street Journal, August 22 -23, 2009.  Among other things, the indictment alleged that the defendant advanced her crime by fabricating two official records in 2004 -- a paper letter and a paper memo.  The indictment came on the heels of thorough document reviews by both federal and state auditors.  The auditors said the Secretary of State's office maintained poor records on its management of federal grant money.  Email records (which are very hard to forge or spoof successfully) were sparse if non-existent.  Furthermore, the Secretary of State's office says it keeps financial records only three years after the close of the fiscal year.  Now, the AG and the ex-SoS disagree sharply over the allegations.  Had the SoS's office maintained more detailed and complete records (including archived email, supported by time-stamps and other audit trails), this disagreement might now be resolved.  Either (a) the ex-SoS would have been deterred at the outset from corruption for fear that the records would betray her, (b) the records would clearly exonerate the ex-SoS, or (c) the records would unambiguously demonstrate the ex-SoS's guilt.