In records management, a traditional school of thought teaches an enterprise to destroy its records as soon as it can.
Second School of Thought
An opposing school of thought holds that in this electronic age legal authorities are suspicious of aggressive programs to get rid of records. According to this school, the quantities of records are much, much greater than was true in the age of paper, and the cost of keeping them is declining. Suspicious authorities like judges will punish early destruction of records under such doctrines “spoliation of evidence” and “obstruction of justice.”
The basic logic of spoliation and obstruction law is simple: You had records. You knew they would be relevant to a lawsuit or official investigation. You hid them or destroyed them and thus made the truth harder to uncover. You should be punished.
Incentive to Keep More Records
Autumn 2010 I advocated the second school of thought at a tech law conference in Europe. I pointed to judicial decisions in North America, and argued that law is giving enterprises reason to be more generous in their retention of records, especially electronic mail of important people.
Some of the reaction I received from my European colleagues was that Europe is different from litigious North America. A lawyer from the UK said English law does not include the concept of “spoliation.” So my European friends said they just don’t see the need to tell enterprise clients to keep email.
A Universal Principle of Law
I suspect my European friends had not (as of Autumn 2010) thought carefully enough about this. The logic of spoliation and obstruction law, as it applies to computer records, seems universal to me: Any legal authority will be unhappy if you hide or destroy your records knowing that the authority is likely to want access to them.
That universal principle is being applied this week in the UK. In the News Corp. tabloid hacking/bribery case, UK prosecutors have charged Rebekah Brooks (former head of News Corp.’s newspapers) with a crime called “conspiracy to pervert justice.” According to the Wall Street Journal, prosecutors allege that she endeavored “to conceal documents, computers and other electronic equipment” from a police investigation. “Brooks Hit with Obstruction Charges,” Wall Street Journal, May 16, 2012, page B1.
Apparently prosecutors are not charging that Ms. Brooks destroyed records. But had she destroyed relevant records (rather than just conceal them) it seems logical that prosecutors would have considered that to be an effort to pervert justice too.
Logical Policy
The legal systems of the world have a natural interest in the voluminous electronic records that computers and smart phones are creating. It is hard for an enterprise and its executives to anticipate which records authorities will determine, after-the-fact, should have been retained. I therefore argue that enterprises have incentive to give themselves a margin for error. As a matter of policy, they are prudent to archive more of those records, especially email of important people, so they can easily be located in a controversy.
I further argue that this line of reasoning can help executives and professionals stay clear of ethical trouble. If they are keeping relatively copious records, they stave off appearance that they unethically disposed of records.
–Benjamin Wright
Mr. Wright teaches the law of data security and investigations at the SANS Institute.
P.S. I read further evidence that destruction of e-records in the face of an investigation is universally seen as an act that law should punish. Apparently under antitrust law, the Korea Fair Trade Commission raided Google's offices in South Korea. One (rumored) allegation made against Google is that it had deleted documents so as to frustrate the KFTC's investigation. 31 May 2012.
I have to disagree with the recommendation to hold on to records longer than necessary just in case there is an investigation. I would go further to say that avoiding a bad outcome from an investigation is the primamry reason to destroy information in a timely manner. I do agree that if you appear to be destroying mass amounts of information it could be percieved that you are trying to hide something. This is the reasoning behind a records retention schedule, policy and guidelines and a good information governance program. So that when investigators do come knocking at your door you can say, with confidence, that we disposed of that record on this date, by these means, according to our policy. In the end, it is the investigators responsibility to prove that you did something wrong.
ReplyDeleteAnonymous: I really appreciate your thoughtful comment. I'll defend my argument here, but I'll also acknowledge that reasonable minds can disagree. Two points:
ReplyDelete1. In the digital age, you can try to delete a record under your retention/destruction policy, but you can never say for sure if the record is unrecoverable. A copy of the record can lurk in a thousand different places (blackberry, thumbdrive, backup tape etc.). A copy might also be recoverable via forensics. See Seneca County Board of Commissioners http://legal-beagle.typepad.com/wrights_legal_beagle/2009/01/foia-requires-recovery-of-deleted-e-mails.html Thus, I am skeptical that you can say "with confidence" that the record was destroyed.
2. Record destruction must cease and litigation hold must start when the record holder has reason to believe that litigation or an investigation is coming. In my experience, knowing when to apply a litigation hold is really hard. I've seen smart people debate whether the facts at a given point in time warrant the triggering of a litigation hold. In the case of Arthur Andersen, well-educated, experienced professionals, including qualified counsel, were in discussions about how to apply the firm's very-well drafted retention policy (which included a litigation hold provision). But when the whole matter was explained to a jury, the jury concluded Andersen was a crook. --Ben