Breaking Up Is Hard To Do
I had a client that was a small company. They were embroiled in some bitter litigation with an ex-partner who was demanding some Electronically Stored Information (ESI) as of the date of the dissolution of the company. Helping them respond to the discovery request taught them a lot about their handling of their ESI.
While discussing their situation, the owner marveled at how much he had learned in this process. He volunteered that he would now start counseling his own clients about their ESI quite differently! So I’m taking today’s blog as an opportunity to pass on to you some of my client’s new-found wisdom concerning ESI.
What should an organization do about ESI when an employee leaves? It’s natural to want to reuse the desktop and laptop computers. However, just passing them on to another employee is fraught with danger. There may be personal information, “remembered” passwords, and confidential information the new owner should not have access to. Worse still, there may be evidence of questionable web surfing activity.
One might think the easiest solution to this is to erase the hard drive and build a new one. However, I have seen a number of suits filed after an employee has left and employers no longer had valuable evidence that could have helped their defense. Here is my advice: Preserve the ESI on the ex-employee’s drives. Create an inventory of what is on the drives. A simple “print directory” program will work; there is no need for a full forensic image. Remove the drives and replace them with new ones. Store them in antistatic packaging and in a secure location for at least 3 years. This way, if you are ever faced with litigation, you have preserved the ESI and you know its location and content, as required by the e-discovery amendments.
Does this cost? Yes, the new drive and the work of installing and building the new system cost. But I think my client would assure that those costs are negligible “insurance” compared to the level of costs in having to try to reconstruct it years later!
Does the ex-employee have files stored on an office server? Email on a mail server? Are there backup tapes of the employee’s data, on their PC and/or on the servers? My advice concerning ESI on servers mirrors that for desktop and laptop computers. Inventory and archive a copy of all their server files. Delete any personal files to free up space on the server.
Organizations face other changes that impact ESI, such as migrating to a new server. Prior to taking such actions, the organization should make a complete backup of the current server and place in safe storage. This backup should not go into a regular backup rotation procedure (since such tapes may soon be reused), but kept separate.
Computer storage has become, relatively speaking, cheap. Given the e-discovery amendments’ emphasis on preservation of evidence and the increasing number of cases involving ESI, preserving ex-employees’ hard drives intact makes good economic and litigation sense.
