29
Fri, Nov
0 New Articles

From Email to Evidence

General
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Email has made so profound an impact on business communications that it is accessible by pager, portable phone, or portable data terminal (PDT). Email has become an integral and necessary part of modern business. Email is typically conversational, giving senders and recipients a relaxed, comfortable disposition toward it. Often, humorous notes are spontaneously relayed by email with the intention of sharing light-hearted laughs with colleagues and friends. When people become less formal, however, they’re more likely to say something they’ll regret. We should appreciate the wisdom of the 17th-century philosopher Baruch Spinoza who wrote, “...the world would be much happier if men were as fully able to keep silent as they are to speak.” And when the message is patently distasteful, secret, misleading, or unsolicited, it can become evidence that weighs heavily in court.

 

Email Today, Evidence Tomorrow

 

It has been 15 years since email was used as evidence in the Iran-Contra arms case. Email was used as evidence in a significant part of the prosecution case against Oliver North. At that time, electronic evidence was a somewhat unsettled proposition to the courts. Several questions were raised: How should it be treated? Was it obtained legally? Can an email really be tied to its author in the absence of a signature? What were the rights of the sender and recipients?

Email and other electronic evidence now finds its way into the courtroom on a routine basis. Email was recently used heavily against Microsoft in its antitrust case. In addition to antitrust, email has been used as evidence in cases pertaining to trade secret theft, restraint of trade, sexual harassment, wrongful termination, copyright infringement, and insider trading. All relevant evidence, including email, is generally subject to pretrial discovery pursuant to subpoena in civil and criminal litigation.

Email is also used by employers for disciplinary purposes. For example, in 1999, the U.S. Navy disciplined over 500 employees for distributing sexually explicit email. A brokerage house fired 25 employees and suspended 48 others for distributing tainted jokes via email, and The New York Times fired 23 employees on similar grounds. You need not look hard to find countless similar stories.


 

User Misconceptions

 

Many users may believe that, as system users, they have password protection, which implies that their email messages are private. Because email is electronic, some users may think that messages are just a persistent buzz on a slackened wire that stretches between their device and that of the intended recipient. Many users believe that their email messages should enjoy the same privacy protections that telephone calls or conventional mail do.

In actuality, email is very different from other forms of communication. Users’ privacy rights vary based on where the email originates, where it is stored, how it is transmitted, and where it is received. Also, email and voice mail carried over private and public networks are subject to different privacy standards than telephone calls and letters, predominately because electronic mail can be stored for an indefinite period of time on equipment owned by or under the exclusive control of the employer.

In a recent poll conducted by the research firm NFO WorldGroup on the subject of email abuse, 60 percent of the respondents admitted to having sent or received adult- oriented material over the Internet. Some 55 percent admitted that they exchanged what some might consider to be racist or sexist material, and between 21 percent and 31 percent admitted to emailing confidential information to recipients outside the company. Most companies would construe these activities as unacceptable and damaging. A common misconception the sender may have is that only the sender and intended recipients have copies of the message. Email is more like a morning newspaper left on the seat of a commuter train; it can be read at many points on its journey between the sender and intended recipient. There are up to eight copies of the transmission in four different places: production and redundancy copies on the sender’s server, at the sender’s ISP site, at the recipient’s ISP site, and on the recipient’s server. Further, when backing up servers on either private or public networks, system administrators will create a backup copy of your email. Even though you may not have access to it anymore because you’ve deleted it, the message may reside on computers elsewhere, which is like placing a copy of every letter or note you have ever sent in a big box.

The tension between individual privacy and protecting the business doesn’t stop at internal issues. Illegal wiretapping is becoming increasingly prevalent. On February 7, 2001, the news wires broke one of many similar stories pertaining to email interception. A nearly undetectable JavaScript virus had been uncovered that, via Microsoft Outlook and Netscape Navigator 5.0, unknowlingly sent a copy of emails that were forwarded back to the originator. Laws have been enacted to deal with this kind of abuse, but they are often times difficult to enforce, as you’ll see later.

 

An Employer’s Liability

 

Many companies are finding email to be a vast, unbridled liability. For some, email misuse is just a perennial irritant. If a company is grappling with sexual harassment or discrimination claims, however, then there’s a tangible, material interest in ensuring that email controls are in place and enforced. In many cases, courts have found employers responsible for email messages sent by employees, even though the employer knew nothing of the offensive email at the time of its creation or distribution and did not approve of the message or its transmission.

Prior to the passage of the Employee Communications Privacy Act (ECPA) in 1986, there were few laws on the books that specifically addressed issues relating to the use and misuse of email. This federal law prohibits the interception of email transmissions by unauthorized individuals or individuals working for a government entity who are acting without a proper warrant. The ECPA is mostly concerned with the unauthorized access by employees or corporate competitors trying to find out valuable information. The ECPA does not prohibit an employer from monitoring employee email. There are three relevant


 

The Law

 

exceptions in the ECPA that pertain specifically to the workplace: when one party consents, when the provider of the communication service can monitor communications, and when the monitoring is done in the ordinary course of business. As you can see, these three conditions are not terribly restrictive. However, some privacy advocates criticize the ECPA for being too complicated, making it difficult to apply.

Further, while the Fourth Amendment to the Constitution establishes the right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures, it does not prohibit an employer—a nongovernmental entity—from monitoring email. However, many mistakenly believe that these protections should apply in the employer/employee relationship.

State laws are often viewed as the primary sources of protection for privacy of electronic communications. The most common theory applied is the tort of invasion of privacy. This tort is typically defined to mean that “one who intentionally intrudes, physically or otherwise, upon the solitude of seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.”

 

Formal Email Policies

 

Many companies do not have a formal policy regarding the content and transmission of email. If no policies are in place, it is difficult to justify an employer’s unfettered access to employee email. In the absence of a formal email policy, the issue of implied consent may arise. Several courts have placed a high standard in implied consent, ruling that an employee’s mere knowledge of the employer’s ability to monitor cannot be considered implied consent.

If your company has a formal email monitoring policy in place, then the employees’ “right to privacy” and their expectations of privacy are quite limited. In this context, the extent of a person’s privacy turns on the notion of “reasonable expectations.” It can be argued that no one with knowledge that his or her employer is monitoring email can have a reasonable expectation of privacy in monitored email messages.

To ensure that employees are aware of company policies regarding their communications, a carefully worded email policy statement outlining “best email practices” should be drafted with the assistance of an attorney. The following issues are typically addressed in an email policy:

• The employee should understand why monitoring is necessary and how it protects employee and company interests.

• The policy should clearly state that the use of company computer systems, including email, is limited to business use.

• Email storage and backup issues should be addressed, including a statement that email, like other forms of data, will be duplicated on a regular basis for the purpose of system recovery in the event of a system failure or disaster. Email that is backed up is subject to audit.

• The policy should outline the potential disciplinary procedures for misuse of the email systems.

• The policy should explain the scope of employer monitoring and should be signed by the employee.


 

Audits

 

Email content audits should be conducted within reasonable guidelines. Any information that is gathered from an email content audit should be used appropriately to avoid seriously damaging employee morale. Employers should address auditing openly and clearly, so that there is no misunderstanding between corporate guidelines and what the employee perceives his rights to be under the law. Should an employee allege that she or he has been treated unfairly through the use of email monitoring, the court may make an effort to determine if monitoring or auditing was done for reasonable business purposes, on prior notice to employees and consistent with company policies concerning the use of the audited information.

 

A Key Business Tool

 

Many users are unclear regarding their rights and responsibilities when using company email systems. Many assume that their constitutional rights and right of privacy apply to these transmissions. Email policies will prevent an employee from construing an audit of his or her email as an invasion of privacy. To avoid any misunderstandings, employers should develop their email policies with the guidance of professional legal counsel.


BLOG COMMENTS POWERED BY DISQUS

LATEST COMMENTS

Support MC Press Online

$

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: