E-Discovery Strategy, Search & Artificial Intelligence

E-mail Archive Policy

Lesson from Tyco Scandal. In a legal dispute, you want as much of two assets as you can get – evidence and brainpower. You want evidence to supply facts so you can understand and support your side of the case. And you want good analysis and judgment so you can assemble the best arguments and make the best decisions about how to manage your case.

Since e-discovery affects both evidence and brainpower, it is revolutionizing litigation and, more generally, all manner of investigations.

A lawsuit today is not your father’s lawsuit.

The advent of electronic records like e-mail causes the quantity of records potentially relevant to a lawsuit/investigation to swell beyond imagination. In any dispute, this profusion of records opens vast opportunity to those able to exploit it. Smart litigants today (a) welcome oceans of records, and (b) seek advanced analytics and artificial intelligence to glean from those oceans the best case.

Observe the lesson from the Tyco International scandal . . . Continue Reading E-Discovery Strategy

Encrypted Personal Data On Stolen Laptop

Compromise of Password-Protected Computer Lost in Burglary

Anheuser-Busch notified thousands of employees that their personal data, and the data of their dependents, may theoretically be at risk of identity theft. The data were on a password-protected laptop, and the data were encrypted.


The case comes to light because one of the states involved, New Hampshire, requires notice be sent both to affected individuals and to the state attorney general, who publishes the notices on the web. New Hampshire's law does not require notice if data were encrypted. AB says the data were encrypted. It also says it has no information suggesting the burglars are attempting identity theft. So why did it give notice?

My guess is that the company was motivated more by the politics of the situation than a strict reading of the law.

The facts: A burglary in a Missouri building harvested several laptop computers from the offices of multiple companies. One of those laptops, belonging to AB, contained personal information (names, addresses, social security numbers and so on) about certain AB employees and their dependents.

Continue reading about encrypted laptop data

Local Government E-mail Retention

Freedom of Information, Open Records and Sunshine Laws

Increasingly, public agencies are required to search for and turn over e-mail records in response to freedom of information and open records requests.

Generally speaking, under either state or federal law, a freedom of information act requires government to disclose requested records to citizens. Sometimes a FOIA might be known as an open records act or a sunshine act.

One example: A Kentucky judge required state government to give a man copies of e-mails between his wife, a state employee, and another state employee whom the man suspected was having an affair with his wife. (Associated Press, “Judge: Ky. Man Can See His Wife's E-Mail,” Nov. 20, 2007.) Continue Reading

State Government Healthcare Electronic Mail Destruction

Duty to Preserve Electronically Stored Information (ESI)

When a lawsuit is filed or reasonably anticipated, parties are expected to apply a "litigation hold" to ensure records are not destroyed.

In a class action case concerning rights to state-paid medical care (connected with Medicare), a federal trial court has criticized Tennessee state agencies for failing to preserve electronic records. Said the court:

continue reading about potential government spoliation

Healthcare Internal Control: Retained E-mail & IM Records

Board of Directors Fiduciary Duty

Medicare Compliance & Fraud Investigations

Electronic records such as e-mail do more than satisfy discovery requests in litigation. They serve as a check against mistake, fraud and other wrongdoing. Healthcare institutions need to retain these records to enable investigations of misconduct on the part of administrators or other decision-makers.

For example, when the board of directors of HealthSouth Corporation (operator of multiple hospitals) investigated massive accounting and Medicare fraud within the company, it needed access to the e-mail records of executives. Continue reading "Healthcare Internal Control: Retained E-mail & IM Records"

Mr. Wright teaches email law at the SANS Institute.

TJX Breach Now Put into Perspective

Law of Payment Card Industry Data Security Standard

Excessive Cancelation of Compromised Credit Cards

The ring of criminals at the heart of the TJX credit card break-in has been indicted. The indictments help us evaluate the civil legal system's (especially the Federal Trade Commission's) response to the TJX heist. Read more at the new site for Wright's Legal Beagle, the thought-leadership blog for Messaging Architects.