Computerized Lawyer: Document Destruction and Confidentiality
By Michael K. McChrystal, William C. Gleisner III,
and Michael J. Kuborn
For many years, both clients and lawyers have confronted questions
about how long they must retain documents and what procedures should be
employed when it comes time to destroy documents. The computer age will
fundamentally change how these questions are answered.
Computer data is amazingly resilient. It is more accurate to describe
the deletion of computer information as analogous to removing the label
from a manila file folder, while leaving the folder itself intact and in
the filing cabinet.1 Law enforcement
agencies fully understand this concept.2
"Deleted" material remains intact
Lawyers and clients should know that data they've entrusted to a
computer system may have a much longer life and be harder to erase than
merely executing a "delete" command.
Computers presently lack the capability to truly delete information.
When you direct a personal computer to delete portions of a file it
simply amends the FAT, or master computer directory, so that the sector
that contains the information becomes available for use by other
data.3 The information in the sectors thus
"deleted" remains intact until overwritten. If you delete an entire
file, your computer will simply change the first letter of the file's
name to a special character making it unrecognizable to your software
that searches for information contained within the medium. The entire
file is still there and can be recalled easily in its entirety with
normal commercial "undelete" software until the space it occupies has
been overwritten.4
Formatting the hard drive, or other efforts to permanently remove
data from a computer, may prove ineffective. Special software known as a
"sector editor" can recover the portions that have not been overwritten
by bypassing the FAT and reading the actual zeros and ones that make up
computerized data.5 Moreover, since even on
a well-used disk electro-chemical changes take place when data is saved
to disk, special equipment such as tunneling microscopes and spin
detectors can examine previously recorded data even if it has been
overwritten.6
Additionally, duplicate copies of part or all of deleted documents
and completed activities may remain on your system for a considerable
time. As your computer moves information temporarily from physical
memory (to make room available for other processes), it will create swap
files that can be copies of everything you've worked on.7 In Windows 95, these files will be identified by
special file names, such as Win386.swp, which also may contain passwords
and keys to encrypted material.8 Software
programs, such as word processors, will create automatic backup copies
of company files before users have had an opportunity to save them in an
encrypted form.9
Implications for lawyers and clients
Michael McChrystal (top), Marquette 1975, is a
professor of law at the Marquette University Law School. William
Gleisner (middle), Marquette 1974, is of counsel and manager of
information systems to the Milwaukee law firm of Hausmann-McNally S.C.
Michael Kuborn (bottom), Marquette 1998, is with the
Sheboygan firm of Olsen, Kloet, Gunderson & Conway and is a former
sergeant with the Wisconsin State Patrol, trained in computer recovery
and computer search and seizure techniques.
Obviously, all of this has very serious implications for clients and
lawyers alike. For those seeking discovery, it opens up possibilities
that heretofore were largely overlooked in litigation (although the
costs of recovery may be quite high).10 The
implications for law enforcement also are apparent.11 Those who dispose of used computers or other
storage media12 must recognize that selling
or trashing a computer may be tantamount to relinquishing ownership
control over the data stored there. With loss of control, one also loses
the expectation of privacy which is the foundation of any right of
privacy.13
If one is concerned about the sanctity of the data contained on a
computer hard disk, then perhaps the safest course of action is to
remove the hard drive and retain it in a safe location or have it
destroyed. Because hard drives save data magnetically, however, simply
burning or crushing the hard drive may not be enough to destroy data. In
an extreme case, it may be necessary to demagnetize the medium before
attempting to obliterate it.
Alternatively, you could try your luck with some of the new products
on the market that profess to totally erase all traces of data from a
hard drive, such as the new software known as "Shredder for Windows 95."
You can evaluate this software for yourself by visiting Shredder's Web
site.14
Advances in technology are occurring at a dizzying speed, and thus
just around the corner may be new ways of safely deleting data or
protecting information . However, lawyers can't depend on speculation of
what the future may hold. In the here and now, lawyers need to know, and
their clients should be told, that great care needs to be taken to
ensure that data they have entrusted to a computer system (via a hard
drive, floppy disk, tape backup, or whatever) may have a much longer
life and be harder to erase than merely executing one of the "delete"
commands available on today's computers.
Endnotes
1 Feldman, 8 Prac. Law. 41, 45
(1996).
2 U.S. Department of Justice,
Criminal Division, Office of Development and Training, Federal
Guidelines for Searching and Seizing Computers, passim (1994).
3 Feldman, supra, at 42.
4 See, http://www.csulb.edu/~murdock/
"Overwriting" a computer file involves the saving of new data to a part
of the hard drive where old or deleted data had resided.
5 Rothman, 10 Legal Tech. News 1, 7
(1998). All of today's computers function on a binary system.
Essentially, binary code is a system for encoding data by using bits, 0
or 1, in which 0 represents "off" and 1 represents "on." Webster's
New World Dictionary of Computer Terms (5th Ed. 1994).
6 Hatley, The Times, March
5, 1997, p. 15.
7 Grossman, Legal Times,
July 21, 1997, p. 42.
8 Id.
9 Feldman, supra, at
48.
10 There are investigative
agencies that purport to provide "computer forensic" assistance in
restoring erased or partially overwritten or destroyed computer files.
See, e.g., Kroll's so-called "Cyber-Evidence Kit," advertised
in The American Lawyer, p. 9 (March, 1998); see also,
http://www.krollassociates.com.
11 See note 2,
supra.
12 Such as tapes, floppies, and
removable hard drives.
13 Copenhefer, supra,
587 A.2d at 1356.
14 See http://www.shredder.com.
Wisconsin
Lawyer