Instant (& Text) Message e-Discovery & Record Retention

Text Message Data Forensics

Cell & Mobile Phone Text/Chat Records

Archival, Destruction & Spoliation Law

Some large corporations are coming to rely heavily on instant messaging (IM). My humble prediction is that they will eventually find themselves needing to retain IM (including video/audio) and text records the same as they do e-mail records.

Today I am not aware of a judicial decision punishing an enterprise for failing to store (or for being unable to find) IM records, but the cases will eventually come. [UPDATE: I wrote the immediately foregoing sentence in 2008.  I have now found a case on corporate text messages.] Litigants will seek access to IM records under the e-discovery provisions of the rules of civil procedure.

IM records are already being created, though corporate IT departments may not be storing them centrally. Users' PCs are creating those records. Cell phones are storing those records, and services like Apple's MobileMe are replicating them across all the user's synched-up devices (phone, desktop, laptop, iPod). And, the latest operating systems such as Vista and Apple's Leopard automatically make shadow copies of everything on a PC's hard drive, which includes IM logs. Computer forensics can recover these records, even after they have been deleted.

Central Storage

Eventually, corporations will come to believe they are wise to store all IM records centrally. (The same can be said for Twitter tweets and social networking messages, to the extent they are used to transact business.) When those records are demanded as part of e-discovery (or as part of an internal fraud investigation), an enterprise prefers to sift through centrally-managed records than to search for local records on individual PCs.

Click Here

Some will take the attitude that if IM records are discoverable, then IM should be banned from the enterprise. I disagree with that attitude. If tools like e-mail and IM are helping people be productive, then those tools should be available for use.

All digital tools (PCs, smart phones, e-mail, IM etc.) create records that are discoverable in litigation. For example, phone text messages are providing investigators a treasure trove of evidence in sex abuse cases.

Cases

In several criminal cases prosecutors have successfully subpoenaed text messages from devices like smart cell phones. "Police Blotter: Armed robbers nabbed through text messages".

In connection with lawsuits involving political protests organized by text message, the City of New York has subpoenaed the records of the MIT student who created the "TXTmob" text messaging service. The city seeks records showing message content and user identity.

The quantity of records grows much, much bigger every day. This reality is something to which any enterprise should become accustomed.

Rather than trying to prevent the creation of records, which is a futile undertaking, an enterprise is wiser to look for ways to understand and exploit its ever-growing ocean of records. In litigation (and elsewhere) voluminous records can be used to advantage.

Update 2011:  Forensics to recover texts and photos deleted from mobile devices.

--Benjamin Wright

Attorney Wright teaches the law of eDiscovery and e-record retention at the SANS Institute.

Interested in text message privacy? See my article on employer privacy disclaimers.

Facebook Privacy Terms of Service

Law of Social Network Profiles and Tracking

Law, Divorce & Online Records Investigations

Privacy advocates such as NYU professor Clay Shirky argue people should be entitled to a degree of privacy for their postings in social networking sites like Facebook and Flickr. They argue employers (for example) should not as a matter of public policy be trolling these sites to spy on employees or prospective employees. See this video.

Post Banners and Terms of Service

Here's an idea: People could post legal terms of service on social networking pages declaring that employers and prospective employers are forbidden from looking at or copying from the pages or tracking people from there. Such terms would be like No Trespassing signs on land, or end user license agreements (EULA) on software. Some case law supports the notion that terms posted on a web site can restrict the right of visitors to gather information from the site. (See also Mark Rasch's discussion of web terms-of-services cases and my legal analysis of privacy contracts with robots.)

Arguably, if an employer grabs information off of a site in violation of posted terms, and that leads to termination of an employee, then the employee could sue the employer for violating the terms of the web site.

Like Footer At Bottom of Email

Note that the idea of posting privacy terms of service on a web page is similar to the accepted practice of placing a confidentiality notice at the footer of an e-mail.

Even if the terms are not legally binding on the employer, they could be ethically binding. An ethical obligation can be more than high-minded hot air. It can carry substantive implications. For example, suppose Bob posts a prominent notice on his MySpace page that his employer may not view the site. Suppose further that the employer ignores the notice, looks at the page, doesn't like what it sees, and fires Bob. The employer might be poisoning its relationship with its entire employee population. Many employees may feel the employer had crossed a line it should not have crossed. Moreover, many customers and suppliers of the employer might feel the same way when they learn about Bob's plight.

If Bob's employer falsely denies having seen Bob's terms, computer forensics could prove the employer wrong, just as it sometimes can uncover or explain impersonation or identity theft when it is committed on social sites.


--Benjamin Wright

 Mr. Wright teaches cyber defense, e-discovery and investigations law at the SANS Institute.

P.S. Facebook's terms of use limit what investigators, who are collecting evidence, can do.


Update: Trial lawyers are scrutinizing social network pages to decide who they do and do not want on a jury.


Another Update: A person in divorce proceedings with an estranged spouse might post terms on a social networking page stating that the spouse and the spouse's agents/attorneys may not access the page and agree not to use anything available on the page. Or, a social network denizen may desire to post terms that tell insurers or lenders to shoo.


Nothing I publish publicly is legal advice for a particular situation, but the foregoing is something to think about.  If you need legal advice, you should consult your lawyer.