Electronic Data Records Law | How to Win E-Discovery

Restraining Order | Cell Phone Evidence

Want to capture cell phone evidence related to a restraining order?  Maybe someone sent a video, a text message, or a photograph to your smartphone – or a mobile device belonging to your child -- and you’d like to preserve it so you can show it to a judge or justice of the peace.

Perhaps the evidence will provide grounds for granting of a restraining order.   Or perhaps the evidence shows that the sender of the message is violating an existing restraining order.

--Benjamin Wright

A restraining order, sometimes called a protective order, is a rule issued by a court requiring someone to refrain from doing something.   An example would be an order that an abusive family member stay away from and not communicate with other family members.

Sometimes the problem with evidence on an iPhone or other mobile device is that it can be erased, or the device itself may disappear.

To learn how to save the evidence, please see my do-it-yourself training video.  The training serves both lawyers and the self-help community. 

Risk Mitigation | Email Archive

Evidence | Tort Lawsuit Defense

Insurance | Hidden Cameras | E-Messages

Law and politics give institutions incentive to collect and archive plentiful records.  The best way to maintain plentiful records in practice is to archive email.

Records are evidence of due diligence and responsible corporate behavior.  In the past, records were expensive to keep and manage. But costs are plummeting as information technology advances.

A case in point:  The use of a taser in police work is controversial because, legally speaking, officers should use it only when circumstances warrant.  But proving, after-the-fact, what the circumstances were can be difficult. So the company that makes tasers sees an opportunity.  Recognizing that the cost of gathering and storing video evidence is declining, the company has developed a video camera for police officers to wear while on duty. The camera will capture trainloads of data.  The company has further developed a technology for economically storing and managing that data. Veronica Dagher, “New Taser 'Shoots' Evidence,” Wall St. J., Sept. 2, 2009.

Update:  A police officer in Fort Smith, Arkansas, was wearing a video camera when he fatally shot a gunman, November 2009.  The police department released the video record to local media.  The local prosecutor investigated the shooting, and part of the investigation included review of the video record.  The prosecutor concluded that the officer acted lawfully, as he had ordered he gunman nine times to drop the gun he was pointing at officers.


Insurance

For an enterprise like a police department or a doctors' office, greater quantities of records can mean reduced risk of liability for negligence (tort).  Good records support a defendant’s position that its people exercised due care and it therefore is not liable.

For physicians, lawyers and other professionals, classic advice for the avoidance of malpractice claims is to make and retain thorough records of services performed.


Hidden Cameras

In this technological age, hidden cameras and surprise evidence are becoming more common.  They can embarrass an organization, as they did ACORN, a high-profile advocacy group for the poor.

Yet, surprise evidence may evaporate if the organization maintains its own detailed records that counteract the surprise.  Example: In the famous murder prosecution of Carolyn Warmus, a key issue was whether she placed a phone call to a gun shop.  At trial, her defense team produced “surprise evidence” – an original telephone bill – showing she did not make the call.  But the evidence backfired because the prosecution established that the “original” bill was in fact a forgery.  It did so by drawing on secure computer records at the telephone company and testimony from a telephone company employee.


Electronic Message Archival

The electronic records in an enterprise such as a government agency are often in diverse formats and locations, which makes long-term retention and management difficult.  The enterprise therefore has incentive to emphasize the archiving of electronic messages such as e-mail. Three reasons:

1. Electronic messages represent a detailed, time-stamped diary of many of the day-to-day activities and intentions of the executives and staff at the enterprise.

2. The IT industry has fielded numerous, competitive products for archival of enterprise electronic messages.  Good archive products support economical retention and rigorous searching of records.  Good archival includes storage of records in a non-proprietary format like XML.

3. If electronic messages are the focal point for record archiving, then the enterprise can direct employees to use electronic messages generously as the journal of their activities.  Journaling can include attaching to email documents like spreadsheets or (short) videos.

–Benjamin Wright

Mr. Wright teaches the law of data security and investigations at the SANS Institute.

Surveillance Technology Changes Law Enforcement

Municipal Government Referendum on Digital Video and Photography

FOIA as Data-mining by Citizens

Computers change how police investigations work.  Take a traffic citation, for example. In the past, for a police officer to issue a traffic ticket, the officer had to be present at the scene and had to talk to the motorist face-to-face.  At an emotional level – as well as an administrative one -- the police officer was deterred from issuing tickets for minor, technical violations of traffic laws.  

For example, if an officer observed a motorist not quite clear an intersection before the traffic light turned red, the officer might think twice before chasing the motorist down and issuing a citation.  To pursue the motorist takes time away from other duties.  Then, the motorist may argue the officer’s observation was wrong.  Further, the motorist may confront the officer as a human.  The motorist may say by words, body language or the expression on his face, “you are a jerk for issuing me this frivolous ticket.” Police officers don’t like being told (even politely and subtly) that they are hyper-technical jerks.

Digital technology changes this legal proceeding.  A red light camera at an intersection transmits electronic records to a police officer (detective) who is not standing on the street, but seated in a comfortable office.  The records provide evidence that is more fixed than mere memory.  The officer can review the digital evidence in no time and issue the citation with the click of a button.  For the officer, the legal investigation and decision are like playing a dull, unemotional video game.  The officer may issue many more citations than in the past.

Automated traffic cameras can make a motorist angry.  The motorist loses the ability to discuss the situation with the investigating officer at the scene, where the motorist might talk about the danger of slamming on the brakes when a light changes.  With computer enforcement, the motorist just gets a bland notice in the mail with a photograph and possibly web access to a computer video of the event. 

Jim Ash, a citizen of College Station, Texas, feels that the dehumanization of law enforcement is an infringement of privacy, a civil right.  In our electronic age, privacy is an ill-defined notion, but it resonates with people in a democracy.

Mr. Ash is leading a grass-roots voter referendum [see Footnote] to ban red-light cameras in College Station.  He is exploiting the power that modern technology affords individuals – a web site and numerous freedom of information act (FOIA) requests for discovery of voluminous electronic records (including email) maintained by the City of College Station and other local governments in Texas.  He says he has uncovered an email from the mayor acknowledging that red light cameras will cause more rear-end collisions, while possibly reducing other collisions. (Most mayors would prefer that their email be withheld from political activists like Ash.)

Ash has collected about 1000 verified signatures from College Station voters, enough to cause the referendum to appear on a forthcoming ballot.  He plans to deliver the signatures to City Hall management in a rally scheduled for around Noon, July 16, 2009.

Ash is promoting the rally with radio commercials playing in College Station.  Following are two MP3s of the commercials.

Download See you there Track 1

Download You want to see this Track 2

Update:  The College Station City Secretary has confirmed that Ash and his team collected and delivered more than enough signatures to place the red light issue on the ballot for the next election.   Ash has formed a political action committee named Take Back Your City.

Update November 4, 2009:  According to the local TV station, the voters of College Station, Texas, voted to approve the petition initiative against red light cameras.

Update:  This photo shows workers deactivating the red light cameras in College Station, November 24, 2009:

–Benjamin Wright

Mr. Wright delivers training on cyber defense law and ethics under the SANS Institute.

Footnote:  When I originally wrote about Jim Ash's voters' effort in College Station, I called it a "referendum," not having researched or thought about the technical difference between a referendum and a petition initiative under the city's charter or under the Texas law of municipalities.  I have since learned that the effort is a "petition initiative," not a referendum.

Email Document Recordkeeping

Local County Government Compliance with State Standards

Records managers at Travis County, Texas, are publicly debating how to draft retention policy for the e-mail of over 4000 users. The county is subject to many confusing state directives and standards on records retention.  

The Travis officials (Steven Broberg and Shawn Malone) have assembled a web site and blog to explain the issues and solicit public input. The officials outline three options, roughly being:

1. Continue the status quo, where each employee stores, deletes and/or categorizes e-mail without clear, modern guidance from management on how this should be done. Under this approach, some employees store a lot, and some store less. Some print “important” e-mails and place them in a file cabinet; others do not.  

 2. Train each employee to rigorously review each e-mail and decide its retention status (i.e., destroy quickly; OR place in category X so it can be retained for a certain period; OR place in category Y so it can be retained for a different period; and so on). New technology, such as artificial intelligence, may be on the horizon to facilitate this option.  

This is what I have previously called the make-a-decision style of e-mail records management.  The Travis officials call this the bucket approach . . . each e-mail fits into a bucket (i.e., a category to which are assigned rules for retention, destruction and so on) and a way must be found to put the e-mail into the right bucket.  The officials note that some learned commenters have advocated the bucket approach, but the officials have appealed to the commenters to bring forward a good example of the bucket approach working in practice.  See video at the bottom of blog post. 

3. Keep all e-mail “indefinitely” (spam excluded).  Related to option #3 is what Broberg & Malone call the haystack approach to e-mail records management.  Rather than trying to place each e-mail into category X or Y so it can be found and managed as though it were a sheet of paper, the haystack approach simply keeps copious volumes of e-mail and then relies on search engines to find particular e-mails when they are needed, such as for e-discovery or an investigation.

Here’s my initial input to Broberg and Malone.  

First, option #3 could be implemented in many different ways. It should be understood as not a single option, but a large family of options, with many flavors and nuances.

Second, I have previously voiced skepticism about option #2. 

Third, I recently witnessed a large institution wrestle with the same topics.  It knew that, like Travis County, its present condition was option #1. The e-mail system deleted each e-mail within 90 days, unless the user (such as an inventor) took effort to store it specially, such as in a folder.  Its present e-mail usage had created and was continuing to create, vast heaps of records. The internal audit department argued that all this stuff, stored according to user discretion, contained important material. Copies were spread around (rather haphazardly) on servers, desktops, laptops, BlackBerries and Androids.  Those e-mails, and the data contained therein, included: 

* assets of the enterprise (contracts, negotiations, representations, internal controls, intellectual property, delegations of authority)

* evidence that is and will be relevant to present and future investigations (lawsuits, e-discovery, corruption audits, fraud allegations, false pretenses, whistleblower complaints, retaliation complaints, misappropriation of funds, misallocation of funds probes, hostile work environment claims, etc.)

* sensitive information such as trade secrets, other intellectual property and personally identifiable (private) information

Internal audit argued that this scattered corpus of stuff needs to be managed, measured, controlled and secured.  For privacy and other reasons, audit trails need to be kept to show who looked at which archives and when.

Further, argued internal audit, as the years go by, decisions about how long to keep this or that can change on account of matters like future litigation hold and changes in law (or changes in records management philosophy). In other words, the institution might initially set an e-mail for seven-year retention, but later learn it should be retained for 10 years. The institution needs a way to find the e-mail so it can be moved to the longer retention period.

E-mail, concluded internal audit, needs to be managed under a centralized archive appliance.  In other words, all e-mail (excluding spam and the like) needs to be copied into a archiving system control by the institution, not individual employees.  (Employees might still keep their own copies of e-mails at their discretion, but centralized archival ensures that the institution gets a copy of everything.)

Centralized e-mail archiving is largely a departure away from Travis County’s option #1, and it's not option #2.

Policy?

 So precisely how long should an enterprise keep email records? There is no universally-correct answer. I have led in-house workshops to address this question at numerous, diverse enterprises. The outcome of these workshops has varied, depending on many factors, including corporate culture.

In my experience, the best email retention policy is one that is developed by collaboration of the various stakeholder departments in the enterprise (legal, IT, HR, operations et al.). Normally, these different stakeholders will start with different positions on what the policy should say. But, in my experience, after the stakeholders have talked through the issues, they tend to compromise their positions and coalesce into a policy that is unique to the enterprise.

--Benjamin Wright

Mr. Wright is senior instructor for the SANS Institute, where he teaches its 5-day course on the law of e-discovery, electronic records, data privacy and computer investigations. 

EMail | Non-Disclosure Agreement Case

E-records Impeach Opponent's E-Discovery

Burst.com’s electronic mail records served the company well in its trade secret lawsuit against Microsoft.  

Wrongful Withholding of Records?

Burst had held conversations with Microsoft in which it confidentially (under non-disclosure agreement) revealed trade secrets (nonpublic ideas of an inventor) about Burst's streaming media technology.  Burst later alleged that Microsoft chose to use these trade secrets without Burst’s consent, and without compensation to Burst.  

So Burst sued, claiming misappropriation of trade secrets and breach of contract.  During the discovery phase of the lawsuit, Microsoft was required to reveal all of its e-mail records on the topic, and Microsoft did turn over a large number of e-mails regarding its development and use of streaming technology. 

But a question arose in court whether Microsoft complied fully with the discovery requirements.  Burst contended that Microsoft had wrongfully withheld some e-records or destroyed them.  To support its contention, Burst produced numerous of its own email records showing particular exchanges between Burst and Microsoft, where Microsoft had produced no corresponding records on its end. Stefanie Olsen, “Microsoft ordered to uncover old e-mails,” September 10, 2003.  

Microsoft's Mismanagement of Records Played to Adversary's Advantage

This mismatch in email records led the court to suspect Microsoft was being evasive.  The court ordered Microsoft to sift through backup tapes in search for missing e-records (looking for electronically stored information (ESI) in network backup is a tedious and expensive process!).  The court's suspicion, coupled with the order to look through backup, cast Microsoft at a strategic disadvantage, and contributed to company’s decision to settle the case and pay Burst $60 million. Tim Siglin, “Microsoft Settles Burst.com Lawsuit,” March 14, 2005.

Had Burst not retained its e-mail records, it would not have had them when needed to pursue this lawsuit in protection of its intellectual property (IP).

--Benjamin Wright

Mr. Wright teaches the law of data security and investigations at the SANS Institute.