Electronic Data Records Law | How to Win E-Discovery

Simulated Lawsuits

Computer Game as Legal Educator and Lawsuit Outcome Predictor

E-discovery and e-investigations involve ever-growing quantities of legal records . . . oceans of records.  To sift and understand these oceans, we need new tools.

Two such tools are crowdsourcing and sentiment analysis.

Crowdsourcing can employ an  army of virtual workers to analyze massive numbers of records like emails.  CrowdFlower will demonstrate this application of crowdsourcing at the SANS Institute’s E-Records Summit in September.

Sentiment analysis uses linguistic software to glean the intent or attitude of people expressed in large numbers of records, such as text messages or Twitter tweets.

Tools like crowdsourcing and sentiment analysis are little known in legal circles.  How can courts, lawyers and investigators gain experience?  How can they evaluate these new tools and learn their uses?

I suggest those tools (and others) be incorporated into computer games.  In the Information Age, games and simulations are assuming a larger role in education, training and dispute resolution.  For example, managers at healthcare providers learn how to cope with adversity, such as employee termination, through computer-aided simulation.

And diplomats use simulated negotiations to envision how  to resolve international disputes.   See Simulated talks show possible solution for Arctic dispute

Lawyers, law students and even courtroom judges can play computer games for the serious purpose of evaluating evidence, testing arguments and ascertaining what the outcome of litigation should be.  Computer games can be quicker, more insightful and less expensive than the traditional form of litigation simulation, i.e., mock trial.

I can imagine lawyer computer games including tools like crowdsourcing and sentiment analysis.

Imagine that a law firm is defending an age discrimination lawsuit involving 3 million electronic mail records at a corporation.  To assess those records and develop strategy, the law firm could play games with them.  It could feed the records into a computer game that uses crowdsourcing, sentiment analysis and the like to test and search the records under different standards and scenarios.  The firm might, for example, learn that sentiment analysis reveals an overall executive desire to comply with employment laws, even though a few “stray remarks” use impolitic language to discuss older workers.  Alternatively, the firm might discover that a thorough review of the emails, by hundreds of reviewers, reveals a management culture at the corporation that is insensitive to rights of older employees.  (See Efrati and Koppel, “Google is set back in age-bias case in ruling with broad implications,” Wall Street Journal, August 6, 2010.)

Either way, the law firm is better able to advise and represent its corporate client.

The law industry is slow to recognize new methods.  As inventors like CrowdFlower develop innovations for the industry, computer games can publicize those innovations and teach lawyers and investigators to think differently.

–Benjamin Wright

Mr. Wright teaches IT law at the SANS Institute.

Tag Disclosed ESI | Privacy, Control, Security

Warn FBI, Auditor, Examiner, Adversary, Regulator, Investigator or Inspector General

Ediscovery Production Strategy-Services for Text, Email, Twitter, Facebook Google+ or Other Social Network Records

Subpoena . . . tax audit . . . court order . . . police raid . . . search warrant . . . criminal investigation . . . regulatory proceeding . . . administrative summons . . . grand jury inquiry . . . litigation discovery demand -- any of these could compel or motivate a party holding e-records to reveal or produce them.

But often the party that receives (or seizes) the records should be expected to safeguard them after they arrive.

Laws requiring the safeguarding of records are many and diverse.  One small example:  As a business discloses information to the federal government, it can (if justified) tag or annotate the information as a “trade secret.”  By so doing, the business warns government employees that they violate federal law (18 U.S.C. Section 1905) if they abuse the trade secret, such as disclose it to a competitor or to the news media.

Legally speaking, the tagging or annotating of records can be strategically powerful.  But when a large quantity of e-records (SMS, chat, e-mail, Web 2.0, iPhone, BlackBerry) is involved, manual annotation is laborious and expensive.

Emerging technology affords a solution.  Technology empowers producing parties to annotate (label, tag) records with ever-better precision and efficiency.

When records like instant messages are disclosed under law, it is becoming more common that they be disclosed in an electronic format that supports annotations, such as XML.

Electronic annotation (commenting) enables highly granular, specifically-targeted legal notices.  Targeted annotation can give the producing party an advantage.  The advantage is more apparent when large numbers of record are at issue and different records require different notices.

By long-standing practice, lawyers often mark disclosed records with warnings or reservations of rights. But historically these notices were expressed as general, blanket statements in transmittal letters. (See footnote.)

When numerous records are involved, blanket statements may not be as effective as specific, record-by-record annotations.   Suppose for example that five million email records are being produced.  Within those records are, say, 2137 that contain personally identifiable information (PII), which the producing party is obligated to safeguard.  The producing party may better fulfill its obligation by specifically annotating each of the 2137 with strong warnings, rather than with general notices covering the whole five million.  (Example:  “WARNING: This email may contain private data protected by law.  Access on need-to-know basis only.”)

Specific annotations can include any of a range of legal statements:  disclaimers, instructions, interpretations, cross references, self-serving language, reservations of rights, claims of privacy, contractual terms of use, designation as attorney work product and more.

According to Ranjit Sarai, e-discovery consultant at Messaging Architects, “Annotations can involve advanced services in e-record production.  Manual annotation of individual records can be very time consuming.  But we can recommend or develop routines for identifying relevant records and placing the prescribed annotations on them.  We can facilitate collaborative, team annotations.  We can also help bring the appropriate attention to annotations.  Some annotations should be understated.  Others should scream out in blinking neon lights.”

Update:  Tags and annotations can be inserted according to varying degrees of granularity, whether record-by-record, word-by-word, or something else.  US intelligence agencies are managing massive databases on terrorists by tagging each word, one-by-one.  A tag can show, for example, the level of security clearance an analyst needs in order to see the word.  Advanced search software can prevent an analyst from seeing information for which he does not have adequate clearance, while alerting him that the database may contain additional information relevant to his inquiry, access to which will require higher authority.   Siobhan Gorman, "How a Team of Geeks Cracked Spy Trade," Wall St. J., 4 Sept. 09.

–Benjamin Wright

Mr. Wright delivers education on cyber defense law under the SANS Institute.


Footnote:  A case known as Teachers Insurance(1) suggested that when a company discloses information to the Securities and Exchange Commission, it waives attorney-client privilege on that information, unless it explicitly reserves its privilege rights.  Applying that idea, a company in another case(2) attempted to make such a reservation of rights in the transmittal letter sent with documents disclosed to the SEC. 

(1)Teachers Insurance and Annuity Assn. of America v. Shamrock Broadcasting Co, 521 F. Supp. 638 (SDNY 1981).

(2)In re Subpoena Duces Tecum to Fulbright and Jaworski and Vinson & Elkins, 183 Fed. Sec. L. Rep. para. 99,505 (DDC 1983).

PII Security Legislation

Safeguard Anonymous Private Data?

Patterns of Behavior Are Protected Identifiers?

Privacy as a legal concept is in crisis. The law of privacy is becoming so expansive that the scope of the law is confusing, and literal compliance can entail strange and arduous effort.

Connecticut Legislation

Consider Connecticut’s new Public Act No. 08-167. Section 1(a) says, “Any person in possession of personal information of another person shall safeguard the data, computer files and documents containing the information from misuse by third parties . . .” Then, Section 1(c) explains:

“As used in this section, ‘personal information’ means information capable of being associated with a particular individual through one or more identifiers, including, but not limited to, a Social Security number, a driver's license number, a state identification card number, an account number, a credit or debit card number, a passport number, an alien registration number or a health insurance identification number, and does not include publicly available information that is lawfully made available to the general public from federal, state or local government records or widely distributed media.”

That seems like a breathtakingly broad definition.

Observe that it considers any “account number” as an identifier that triggers the requirement for security in Section 1(a). Public Act No. 08-167 does not define “account number,” which can make for surprising results for all kinds of organizations that collect money, including small ones like neighborhood parent-teacher associations. 

Surprising Case Example - Health Club Locker Number 

For example, suppose a small health club keeps track of membership payments according to locker numbers, which are viewable in the locker room. That practice may be a mistake under Connecticut’s law because anyone walking through the locker room could learn that my locker number, i.e., my account number, is “57". That unit of identifying information might be misused by, say, a snoopy debt collector who is investigating how much I spend on luxuries like club membership. Knowing my name and locker number, he could telephone the health club and say, “This is Ben Wright, and my locker number is 57.  Can you tell me how much I owe on my club membership this month?”

So, to say it in different words:  This little health club has opened itself to a lawsuit in Connecticut by doing something (making account number and locker number the same thing) that would seem to be perfectly natural and insignificant to anyone but the most paranoid of lawyers.

Behavior Patterns as Identifiers?

Although Connecticut’s law itemizes some identifiers like “account numbers” and Social Security numbers, its definition of personal information reaches wider than the itemized list.  The law regulates any and all “information capable of being associated” with a person through an “identifier.”

What kinds of information can be used to identify people by way of an “identifier?” What about patterns of behavior and patterns of social relationship? Could patterns of activity be “identifiers?” I don’t see why not.

Academic researchers have demonstrated that so-called anonymous data about human behavior can be used to identify individuals. For instance, researchers started with “anonymized” data from one Web 2.0 service, Twitter.  From this data, they ascertained the identities of individual Twitter users.  How did they do it? They drew on behavior data from another Web 2.0 service, Flickr.  By comparing maps of relationships from unnamed Twitter users with maps of relationships for known Flickr users, the researchers uncovered the identities of the Twitter users!

From the perspective of privacy, this research is chilling.

Is All Data About a Person Private?

Responding to this research, a privacy advocate is naturally inclined to say that no one should keep any data about anyone. 

While that response may be excessive, it does accurately reflect the privacy concern when anyone retains information about the patterns of behavior of individuals.

Another Case Example - Identifying People by Writing Style

So given how information about behavior patterns can serve as the “identifiers” of an individual . . . let's consider the following application of Connecticut law.  Suppose a small nonprofit in Connecticut works with volunteers to develop and publish opinions on controversial civil rights topics, such as abortion or homosexual marriage.  The organization attributes the opinions only to itself, without identifying the volunteers involved in writing them.  

Sally is one of those writer volunteers. The organization publishes a controversial opinion based largely on prose composed by Sally. Could the organization be violating Connecticut law simply by publishing Sally’s written words? Logically, the answer could be yes. Here’s the logic . . .

Examples of Sally’s writing – on non-controversial topics – appear in association with her name in many public places such as blogs, libraries, Facebook pages, LinkedIn comments, letters to the editor and so on.  

Research shows that people can be identified according to their writing style – syntax, word choice and so on.  In fact, researchers today track “anonymous” terrorists according to the style of their writing, records and communication on the web.

Hence, when the civil rights organization publishes Sally’s words, even with her name removed, it is failing to safeguard her personal information.  It is opening her to embarrassment and ridicule by people who disagree. Adversaries could analyze the patterns of behavior exhibited in the published words and ascertain that Sally is the author!  

In other words, in the legislative terms of Public Act No. 08-167, the organization failed to protect her personal identifying information (i.e., the patterns of her unique writing style woven into her text) from being "misused" to criticize her personally. 

What Does This Mean in Practice?

So what could the organization have done to comply with Connecticut law?  Before publishing Sally's words, the organization could have removed from the words the “identifier” linking to Sally by hiring a team of third-party writers to rearrange the words into anonymous writing style.

Shiver my timbers. Thats a lot of work for a small nonprofit, just to comply with Connecticut privacy law.  The regulation chills free speech.  Is that really what the Connecticut legislature had in mind?

Society faces an emerging conflict between the civil right of privacy and the civil right of free speech.

Global Impact of Strange Legislation

Notice that the foregoing conundrums arise from legislation enacted by just one small US state.  But in our Internet-connected world, the data privacy law of Connecticut can be applicable to the activities of an organization in Australia or Hong Kong.  Further, nothing prevents the legislature of Arizona, Pennsylvania, Michigan or name-your-jurisdiction from adopting law that is similarly strange and broad in scope -- all the while using words and standards that differ from Connecticut's.  

Full compliance with data privacy law has become very difficult.

–Benjamin Wright

Mr. Wright teaches data law, including electronic data discovery (EDD) at the SANS Institute.

Documentation for Swap Contracts

Electronic Records of OTC Derivatives Contracts

New financial regulations, when coupled with advancing technology, will force the retention of massive electronic commerce records.  Hear what the authorities are saying about the regulation of financial derivatives:

First:  Famed economist Hernando de Soto says poor documentation for $1 quadrillion worth of financial derivatives is wreaking havoc on the world economy. "Toxic Assets Were Hidden Assets," Wall Street Journal, 3/25/09, pA13.  He calls for much better documentation of derivatives contracts.

Second:  Former SEC Chairman Harvey Pitt recommends much new record-keeping and reporting by entities like hedge funds that have not previously been regulated. “Former SEC chief says gather, share more data,” USA Today, 3/27/09 p3B.

Third:  To prevent more of the “toxic” assets poisoning today’s financial system, Treasury Secretary Geithner says, “We will require that all non-standardized derivatives contracts be reported to trade repositories and be subject to robust standards for documentation and confirmation of trades, netting, collateral and margin practices, and close-out practices.”

What’s the definition of a “non-standardized derivatives contract?”  It’s really just a negotiated contract that allocates risk between two or more parties.  It can cover most any kind of risk or possibility, from the risk of a lawsuit to the potential for rain in the Australian Outback.  (A derivative can even be "embedded" in an routine commercial contract, such as a sale agreement or a mining agreement.)  The scope of this field is breathtaking.  Non-standardized derivatives contracts have become a very large, thinly-monitored part of our financial world. 

So what’s a complete record of one of these derivatives contracts look like?  Would it be a stack of paper, stapled together, with signatures at the end?  It could indeed be such a stack of paper. 

But . . . let’s think deeper about how contracts are documented these days.  As the methods for written business communication – letter, telex, fax, e-mail, instant message and so on -- have grown progressively more cheap and easy, the challenges for documenting complex contracts have risen.

If the derivatives contract were entered in the 1970s, using the practices of the day, a stack of paper, stapled together, would most likely be the form it would have taken.  It might have been supplemented with a few paper letters and, once-in-a-blue-moon, a telex or two.  (Some court cases enforced telex similar to paper correspondence.)

Then in the 1980s faxes became popular, and the contract might have been a stack of stapled paper, supplemented or amended by several faxes. (We learned years ago that faxes can be legally-binding records, just like paper-written letters.)  

Next, in the 1990s e-mail started to become a common form of business communication.  Numerous judicial decisions have held e-mail to be legally-binding “signed writings” essentially equivalent to paper letters.  

See JSO Associates, Inc. v Price (informal e-mails can constitute signed writings agreeing to hire a broker to sell securities and pay a commission) and Cloud Corp. v. Hasbro (formal paper contract that says it can be amended only by a signed writing is amended by informal e-mails).

The e-mails in a contractual relationship can be very numerous.  And they often are not as clearly written as old-fashioned, formal paper contracts were.

Today non-standard derivatives contracts (a.k.a. "swaps," or "custom," "customized," "tailored," "bespoke" or "bilateral" derivatives) can be negotiated, documented, amended, supplemented and interpreted by a dizzying array of electronic communications.  Fax and e-mail are probably most common, but instant messages, phone text messages, chat rooms, message boards, social networking channels and voicemail-converted-to-text are rising in usage among busy traders.  (Dedicated online marketplaces like Agora-X and 360T provide organized electronic environments for communication and negotiation of over-the-counter derivatives instruments.  A brochure for 360T says its secure marketplace supports "Real-time online chat with any requesting counterparty individual.")

In the derivatives world, "novation" (substitution of one counterparty for another) commonly occurs by e-mail.

All this communication can be critical to full documentation for a modern financial contract.  In the Lehman Brothers bankruptcy, for example, the administrator digs through mountains of e-mail to figure out what the firm’s rights and obligations were in the over-the-counter derivatives market.