Instant Messages (IMs) have become an increasingly popular method of communication, both in the personal and business world. [1] They have the benefit of being an efficient, rapid and oftentimes free means of communication. [2] IMs are often candid and free-form, and when users close their IM dialogue box when the conversation ends, the chat session generally disappears and is not recorded. [3] However, with the advent of the e-discovery amendments to the Federal Rules of Civil Procedure (FRCP), many electronically stored documents have become subject to discovery in litigation. [4] While Word documents, Excel spreadsheets and e-mails are accepted as discoverable documents for litigation purposes, it is unclear whether IMs can and should be requested during the discovery process. [5] This article will explore issues related to the discoverability of instant messages and will ultimately suggest that businesses employ techniques to closely monitor employee use of instant messages to prevent a “smoking gun” IM from costing employers millions of dollars in court.
II. Are IMs Discoverable?
On December 1st, 2006, the FRCP were amended to allow for the discovery of electronically stored information (ESI). [6] That is, in a litigation setting, counsel may request a variety of electronic documents during the discovery process. [7] It is easy to classify certain communications as falling under the FRCP amendments, such as emails and word documents. [8] Other communications, such as a telephone call, generally do not fall into the regulations due to the real-time nature of the communication and a deeply-rooted expectation of privacy. [9] However, IMs may fall into a category all their own, taking on characteristics of both an electronic document and a real-time telephone call. [10] The question therefore becomes, are IMs discoverable? [11]
If the company in question is in the financial services industry and is therefore governed by the Securities and Exchange Commission (SEC) and the National Association of Securities Dealers (NASD), then they must retain all IM conversations for at least three years. [12] However, no state or federal rules offer guidance as to whether other businesses must retain their IM correspondence. [13] It is certain that court cases will hash this out in the future, but in the meantime it is important to have a discussion about on which side of the line IMs fall: is it a real-time communication like a telephone call, or an asynchronous communication like an email? [14]
Much like a telephone call, IM users interact in real time [15], and the dialogue very much mimics the flow of an oral conversation [16], though in a “chat” box on a computer screen. [17] Additionally, “unless unusual steps are taken, [telephone and IM] conversations are not recorded.” [18] Much like a telephone call, many IM users have a perception that what is said during that IM conversation will be kept private and is not being monitored. [19] There is, therefore, an inherent expectation of privacy that is not there with respect to emails. [20]
However, most instant message platforms allow users to decide whether they want to record the conversation digitally or not. [21] Telephones almost always require extra equipment before you can record conversations, whereas IM software has that feature built in, though it is usually not the default setting. [22] In fact, when you change your IM settings to record conversations, some programs alert you to warn those you are chatting with that the conversation is being recorded, suggesting that otherwise users will not expect that their conversation will be saved for possible production in the future. [23]
Additionally, IMs may be more like emails than telephone calls because IMs do come in a textual format, and though IMs are most often sent between people who are available at the same point in time to “chat,” it is possible to send an IM to someone who is online but away from their computer. That message will reach the person even though a real-time exchange has not occurred. IM users, however, must at least be signed into their online account to receive messages, whereas email users can retrieve their messages at any time, even if they were sent while the recipient was not online. These are just some of the reasons why it is difficult to decide whether IMs should be discoverable under the amendments to the FRCP.
III. Should Companies Retain their IMs?
Electronically stored information (ESI) is the focus of the December 1, 2006 amendments to the FRCP, which implies that only stored information may be requested. [24] However, a court may decide that a company should have stored certain kinds of information, even if they did not in fact do so, and impose fines. [25] For a company that did not retain IM conversations, a court’s analysis on whether the company is liable for penalties will likely revolve around whether the company acted reasonably. [26] Factors a court is likely to consider when deciding if a company acted reasonably with respect to IM retention are: “(1) How was the IM being used? (Why, by whom, and when?) (2) What particular IM systems are being used? (3) Is IM addressed in the document retention policy? (4) What is the basis for that IM policy? (5) How well is the policy enforced? (6) Is the IM relevant to the litigation? (7) Was the company on notice that the IM should have been preserved? (When why and how?).” [27] A company therefore should be prepared to face a request for IMs in litigation, and should they be unable to produce records of IMs, be able to defend the reasonableness of failing to keep records of these conversations. [28]
IV. Authentication of IMs
If a court decides that IM conversations are in fact discoverable, and the company in question did keep IM records, another issue is authentication of those communications. The first problem is the identification of the conversation participants. It is almost impossible to know, with certainty, who the two people in the conversation really were – “even if a user believes that “UTFan” is Person X, Person Y may have hacked into the UTFan username.” [29] Authentication of any information to be used in court is key, and IMs pose a very serious identification challenge. [30] This kind of problem may be counteracted by enacting stringent security standards for logging into IM programs, such as highly complicated passwords. This would create a presumption that the person speaking under a particular username is the primary accountholder. This presumption could then be rebutted in court with evidence to the contrary.
In addition to this, IMs may be altered after the date of the conversation, and then post-dated. [31] This may be easy for someone that is somewhat computer savvy since a company using IM software is likely to have thousands of conversations to keep track of, so a small change in any one conversation is likely to go undetected. [32] It has been suggested that to authenticate IMs and prevent tampering, a company’s best option is to store all IMs with a third party server which can monitor the data and ensure that nothing is changed after the conversation has been terminated and saved. [33]
V. Recommendation
There can be no doubt that IMs pose a challenge to the litigation world; a balance must be struck between providing the information each side needs in the discovery phase, but also keeping expectations of privacy in check. Employers must first realize that employees are using instant message programs, whether they realize it or not. [34] Ignoring the problem will not make it go away, and courts are not likely to allow ignorance as an excuse for not retaining these documents. [35] While it is unclear whether IMs will become discoverable on a large scale, it would not be surprising if in the near future courts adopted a default rule that IMs are as discoverable as their email counterparts. [36]
To defend themselves, employers must assure that employees are trained as to the importance of instant messages in potential litigation. Some companies have adopted such techniques as making sure that employees are only using a company sanctioned IM program, and then every time a conversation begins a message pops up reminding the employee that the conversation they are about to have is not private and will be monitored/recorded. [37] Though instant messages may often be thought of in the same category as a casual telephone call – informal and conducive to a candid exchange – instant messages should be treated with more care. Employees must be taught that what they type is not for the receiver’s eyes only, but potentially will be seen by an adversary and a judge in trial proceedings.
Whereas “smoking gun” emails have damned companies in the past, “smoking gun” IMs may be the wave of the future. Plaintiffs’ attorneys are likely to seize on the fact that most IMers falsely assume that their communications will never be seen by anyone other than the recipient. [38] When those using instant messages are made aware of the consequences of their words being recorded, the likelihood of instant messages becoming the downfall of a lawsuit is reduced substantially. In this situation, it would seem that education is the key. Some companies have taken the stand that IMs are simply not allowed or only allowed for certain employees. [39] This is an unrealistic approach that robs the company of the efficiency of allowing IMs in the workplace, and of course, employees are likely to do it anyway.
Sources
[1] Posting of Timothy J. Carroll to EDD Blog Online, IMs as ESI: When to Save Instant Messages and How to Properly Authenticate Retained IMs, http://eddblogonline.blogspot.com/2007/08/ims-as-esi-when-to-save-instant.html (Aug. 1, 2007) [hereinafter Carroll] (“IM has been around for several years, and its popularity in the business environment is increasing.”).
[2] Scott M. Gawlicki, Instant Messaging: Smooth Operator or Legal Burden – GCs Feel the Heat as Plaintiffs’ Lawyers Dig Up IMs, INSIDE COUNSEL, May 2005,http://www.insidecounsel.com/issues/insidecounsel/15_162/technology/134-1.html (last visited Nov. 13, 2007).
[3] Thomas W. Burt & Gregory S. McCurdy, E-Discovery of Dynamic Data and Real-Time Communications: New Technology, Practical Facts, and Familiar Legal Principals, 115 YALE L. J. POCKET PART 166, 168 (2005), available at http://yalelawjournal.org/images/pdfs/52.pdf.
[4] Posting of K&L Gates to Electronic Discovery Law, E-Discovery Amendments to the Federal Rules of Civil Procedure Go into Effect Today, http://www.ediscoverylaw.com/2006/12/articles/news-updates/ediscovery-amendments-to-the-federal-rules-of-civil-procedure-go-into-effect-today/ (Dec. 1, 2006) (last visited Nov. 13, 2007) [hereinafter K&L Gates].
[5] Carroll, supra note 1.
[6] FED. R. CIV. P. 26(a)(1), 33, 34; K&L Gates, supra note 4.
[7] See K&L Gates, supra note 4.
[8] Carroll, supra note 1.
[9] See Burt & McCurdy, supra note 3, at 167.
[10] Carroll, supra note 1.
[11] Burt & McCurdy, supra note 3, at 166.
[12] ComplianceResources.org, Comply with Me – Ask the Compliance Expert,http://www.complianceresources.org/counsel/comply_archive/expert/200512.html (last visited Nov. 13, 2007) [hereinafter ComplianceResources.org]; Carroll, supra note 1.
[13] Fubright & Jaworksi L.L.P., Instant Messaging: Are the Risks Worth the Rewards?, E-DISCOVERY & INFORMATION MANAGEMENT – FULBRIGHT CLIENT ALERT, Feb. 15, 2007, at 2, available at http://www.fulbright.com/images/publications/ClientAlertInstantMessagingEDIM.pdf.
[14] Burt & McCurdy, supra note 3, at 166 (“All communication can be broken down into two categories: real-tiem and asynchronous.”).
[15] ComplianceResources.org, supra note 12.
[16] Carroll, supra note 1.
[17] Burt & McCurdy, supra note 3, at 168.
[18] Id. at 167.
[19] Id. at 168.
[20] Id.
[21] Id.
[22] Burt & McCurdy, supra note 3, at 168.
[23] Id.
[24] See ComplianceResources.org, supra notes 12 (“IM is discoverable to the extent it has been stored.”)
[25] Gawlicki, supra note 2.
[26] ComplianceResources.org, supra notes 12.
[27] Id. (numbering added).
[28] Id.
[29] Fubright & Jaworksi L.L.P., supra note 13, at 1.
[30] Id.
[31] Carroll, supra note 1.
[32] Id.
[33] Id.
[34] A 2005 survey conducted by the ePolicy Institute revealed that “31 percent of employees use [instant messaging programs] at the office, and 78 percent of them use it without managements knowledge or the IT department’s control.” Gawlicki, supra note 2.
[35] ComplianceResources.org, supra notes 12 (discussing that courts are likely to look at the reasonableness of the company’s IM retention policy to determine whether the company should have kept more thorough records of IM conversations).
[36] Gawlicki, supra note 2.
[37] Id.
[38] Id.; Adam Rubinger & Dean Gonsowski, Instant Messaging: Newest E-discovery Frontier?, DIGITAL DISCOVERY & E-EVIDENCE, June 2004, at 1, available athttp://www.fiosinc.com/resources/pdfFiles/200406_instant_messaging.pdf (last visited Nov. 13, 2007).
[39] Gawlicki, supra note 2.