The E-Discovery Question

It’s been more than a year since the federal government codified its expectations for electronic discovery, or e-discovery. The amended rules require any organization that might be sued in federal court to have systems for retrieving electronic data — which could include e-mail, network activity logs, digital recordings, voice mail, spreadsheets and more — if the information could be considered evidence in litigation.

If your school district hasn’t come up with a plan to comply with the new regulations, don’t despair. You’re far from alone. By May 2007, two-thirds of K­–12 IT administrators were aware of the Federal Rules of Civil Procedure amendments for saving electronically stored information (ESI), according to a survey from CommVault, a data management software company based in Oceanport, N.J., yet just 10 percent had a compliance plan in place.

In some ways, that’s understandable. As with many legal issues, all the ramifications of the rules aren’t yet clear, and it takes time to consider and put into place new district policies. The time to wait, however, is over. While there has yet to be a notable case of a school district getting in trouble for being unable to produce electronic documents, several corporations have been fined millions of dollars over the years when key ESI was missing.

“It’s always been the rule that you can’t get rid of evidence. Congress has just finally taken [it] upon itself to recognize ESI as a legitimate discoverable issue,” says Paul V. Carelli IV, a partner at the California law firm of Stutz, Artiano, Shinoff & Holtz, which represents a number of local school districts. “Even a small school district can be brought into federal court over a harassment or employment issue. It’s so much easier to have everything in place, rather than try to figure out where it is.”

The courts do not look kindly on a defendant who can’t produce information relevant to a case, but they don’t require a school to have saved every single e-mail message, IM and PowerPoint presentation for all time, either. The key is to create and follow a “reasonable” plan for how ESI is archived, so if the plaintiff asks to see an e-mail from 2003, you won’t say: “We’re not sure if we have it.” Individual school districts vary in the length of time each retains e-mail and other electronic communications, crafting retention policies that range from 90 days to seven years. Equally varied among schools are which types of communications are stored and the responsibility for who makes that determination. Yet the critical factor is determining which correspondence to retain, setting a policy and educating staff, then fully adhering to the established retention policy.

All or Nothing?

Take Middletown Township School District in Monmouth County, N.J., for example. “Our legal counsel advised us that the most prevalent cases are tort cases with a statutory limitation of two years,” says Jay Attiya, a K–12 network manager for the school district. Given that the discovery phase may last up to one year, the school district’s attorneys recommended creating a three-year retention policy to cover the statutory limitation plus the discovery period.

Attiya installed CommVault to archive Exchange e-mail and uses an attached storage area network to store the retained files. Only the 1,500 faculty and staff — not students — at the school district have access to e-mail, and it does not support instant messaging. The district receives more than 20,000 e-mail messages per day, and the IT teams back up all e-mail correspondence.

“If you don’t back up your e-mail, you could be accused of being negligent,” Attiya warns. “If you cannot produce the information [requested], the lack of information could be detrimental to the case. How do you prove something wasn’t there unless you have a full set of records?”

By contrast, after meeting with state legal officials, the Tyler (Texas) Independent School District opted to err on the side of caution — keeping all e-mail records for seven years. “We all walked away from the meeting sick, because no one was archiving their e-mail. For a long time, we didn’t have a [retention policy] and were not archiving e-mail at all,” says John Orbaugh, Tyler’s director of technology.

Orbaugh archived the school district’s first file on April 14, 2006. The district turned to C2C’s archiving system to capture the district’s Exchange e-mail, which eliminates the possibility of someone accidentally deleting a copy of an e-mail. The files are then stored on a DVD jukebox for seven years. (C2C is an e-mail archiving and management solutions company based in Springfield, Mass.)

In addition to ensuring maximum compliance, Orbaugh wanted to alleviate the burden on faculty and staff of having to determine which correspondence to keep or discard.

What to keep?

The School District of Osceola County in Florida, however, takes a different approach. E-mail is kept in the system for just 90 days, and records management policies determine how long other materials are kept, ranging from one to seven years. Each employee determines if an e-mail message is worthy of retaining — the issue could be anything from discussing a student’s progress to asking about a meeting with the department head for an annual review. Any such e-mail should be printed and filed, and all new hires are taught the procedures when they join the staff.

“Our lawyers commented that if we have well-defined procedures, training and the elements in place, then you’re covered. The whole point is to be able to produce documentation in a legal battle,” says Randy George, the district’s director of information services. “We revisited our policies and procedures and came to the conclusion that there’s nothing new or different we need to do.”

Even in districts that have been ahead of the game in data retention policies, some IT managers are rethinking operations in light of the federal legislation. In Niles Township High School District 219 outside of Chicago, for example, the board of education passed an administrative procedure in November that calls upon the district staff to create specific protocols for record preservation. “We published a document two years ago that has operational guidelines, but it’s not a policy,” says Guy Ballard, District 219’s chief technology officer. “Record collection has been part of the job all along, but now we want to have a policy that clarifies all the responsibilities.”

Sue Derison, director of information systems at Forsyth County Schools in Georgia, is in the process of determining what policies will keep her district completely covered. Derison points out that for some districts, state legislation concerning public records is another factor to take into account. “Here, if you have an e-mail with, say, budget content in it, you’re supposed to keep it for five years,” she says. Many states have created outlines for how school districts should approach data retention.

Beware ‘Litigation Hold’

Niles Township (Ill.) High School District 219 CTO Guy Ballard is creating a new policy to dictate record collection procedures.

There’s one big caveat to safe-harbor protections for regularly purging your records: If you’ve been named to a lawsuit, you must put a “litigation hold” on your policies and procedures for data retention for anything that could be connected to the case. The court will understand if something relevant is missing due to regularly scheduled deletions before the case was known; it won’t afterward.

Like data deletion and retention policies, a litigation hold strategy should be in place before problems happen. Many IT departments copy the entire contents of an employee’s hard drive when he or she is terminated, for example. Experts recommend the technology, legal and human resources departments work together to formulate e-discovery procedures that cover the district legally and are feasible technically and financially.

“How long to keep back-up tapes, that kind of decision, that’s not the IT person’s call. It’s the lawyer’s call, but the IT person knows the costs of storage,” says Lisa Sornen, senior staff attorney at the National School Boards Association Council of School Attorneys. “I don’t know if it’s happening in most districts — getting the superintendent, lawyer and IT department together to make plans that work for everyone.”

Of course, like any district plan, the real test is how well it’s implemented. “It can be easy to whip up a policy but then you have to do it,” says Scott McLeod, director of the Center for Advanced Study of Technology Leadership in Education. “And the third piece is monitoring how well it’s working once you’ve started, and ensuring everything keeps getting done.”