1. ERPA Workshop Antwerp -- April 15, 2004 1 All the President’s Email: Electronic Recordkeeping Policies and Practices in the Executive Office of the President Jason R. Baron Director of Litigation Office of General Counsel U.S. National Archives and Records Administration

2. ERPA Workshop Antwerp -- April 15, 20042OVERVIEW Litigation concerning the record status of email & rules on retention Litigation concerning the record status of email & rules on retention –Armstrong v. Exec. Office of the President ERK at the White House ERK at the White House Monitoring Schemes Monitoring Schemes Anomalies & Audits Anomalies & Audits - General Accounting Office - General Accounting Office - Congressional - Congressional - Litigation - Litigation Lessons Learned Lessons Learned

3. ERPA Workshop Antwerp -- April 15, 20043 Email & The U.S. Federal Government Mid-1980s “early adopters” of email by the Mid-1980s “early adopters” of email by the White House National Security Council staff White House National Security Council staff End of 1990s: 32 million White House email messages preserved as records of the William J. Clinton Administration End of 1990s: 32 million White House email messages preserved as records of the William J. Clinton Administration 2004: tens of billions email messages created each year by Federal government employees 2004: tens of billions email messages created each year by Federal government employees

4. ERPA Workshop Antwerp -- April 15, 2004 4 THE PROFS DECADE BEGINS: ARMSTRONG v. EXECUTIVE OFFICE OF THE PRESIDENT Filed: January 19, 1989 The last day of the Reagan Administration

5. ERPA Workshop Antwerp -- April 15, 20045 THE THREE ARMSTRONG INJUNCTIONS The initial temporary restraining order covered Reagan Admin. PROFS tapes (1989) The initial temporary restraining order covered Reagan Admin. PROFS tapes (1989) The second temporary restraining order covered Reagan and Bush era PROFS and All-in-1 tapes (1992) The second temporary restraining order covered Reagan and Bush era PROFS and All-in-1 tapes (1992) The district court’s permanent injunction covered all “electronic communications systems” and their backups (1993) The district court’s permanent injunction covered all “electronic communications systems” and their backups (1993)

6. ERPA Workshop Antwerp -- April 15, 2004 6 THE ARMSTRONG ORDER January 6, 1993 “ * * * ORDERED that Defendants are enjoined from removing, deleting, or altering information on their electronic communications systems until such time as the Archivist takes action pursuant to... the Federal Records Act to prevent the destruction of federal records, including those records saved on backup tapes.”

7. ERPA Workshop Antwerp -- April 15, 20047 Armstrong Backup Tapes Retained at NARA

8. ERPA Workshop Antwerp -- April 15, 20048 ISSUES ADDRESSED IN ARMSTRONG Email messages can be “federal records” under U.S. law - 44 USC 3301 Email messages can be “federal records” under U.S. law - 44 USC 3301 Agencies must manage the unique “electronic” email record, as it is only a “kissing cousin” of a hard-copy printout Agencies must manage the unique “electronic” email record, as it is only a “kissing cousin” of a hard-copy printout Agencies must provide for some form of periodic audit/monitoring by records managers to ensure correct application of guidance Agencies must provide for some form of periodic audit/monitoring by records managers to ensure correct application of guidance

9. ERPA Workshop Antwerp -- April 15, 20049 ISSUES ADDRESSED IN ARMSTRONG (cont’d) “Who Knew What When” Transmission and receipt data must be managed along with content Transmission and receipt data must be managed along with content –Names of senders, recipients –Distribution lists –User directories –Receipt data, including acknowledgements of receipt, where requested

10. ERPA Workshop Antwerp -- April 15, 2004 10 An Aside: A Sea of Metadata * Hidden email header information * Proprietary features of word processing, e.g., summary fields processing, e.g., summary fields * Hidden codes of all types * Embedded data * Ability to ‘undelete’ * Tracking information * Spreadsheet formulas

11. ERPA Workshop Antwerp -- April 15, 200411 How the EOP Implemented Armstrong Issued recordkeeping guidance covering applications on existing email systems Issued recordkeeping guidance covering applications on existing email systems Customized existing proprietary software to perform electronic recordkeeping functions (ARMS) Customized existing proprietary software to perform electronic recordkeeping functions (ARMS) –Introduced front-end ‘prompts’ –Built in automatic monitoring functions Restored and reconstructed email residing on backup tapes Restored and reconstructed email residing on backup tapes

12. ERPA Workshop Antwerp -- April 15, 200412 Auditing the End User By Way of Records Management Monitoring Monitoring program by EOP component Monitoring program by EOP component based on statistical sampling based on statistical sampling methods methods Record/nonrecord designations Record/nonrecord designations Policy Evolution Due to Audit function: default to “record” Policy Evolution Due to Audit function: default to “record”

13. ERPA Workshop Antwerp -- April 15, 200413 ARMS Anomalies & Audits General Accounting Office Investigation into Email Anomalies General Accounting Office Investigation into Email Anomalies Congressional Investigation into Missing Email Congressional Investigation into Missing Email Litigation: Spoliation, Sanctions, and Beyond Litigation: Spoliation, Sanctions, and Beyond

14. ERPA Workshop Antwerp -- April 15, 200414 ARMS Anomalies, Cont’d MAIL2 server / Mail2 server MAIL2 server / Mail2 server Letter D Letter D MultiHost Anomaly MultiHost Anomaly VP email VP email

15. ERPA Workshop Antwerp -- April 15, 200415 Findings of the GAO “Monitoring program did not ensure effective management of e-mail records” “Monitoring program did not ensure effective management of e-mail records” –Incomplete monitoring of presidential records –Lack of controls over incoming e-mail –Lack of documentation & testing of records management controls –Management control weaknesses

16. ERPA Workshop Antwerp -- April 15, 200416 Additional Rounds of Oversight Activity 4 days of Congressional hearings 4 days of Congressional hearings 50+ days of evidentiary hearings in litigation brought by private party against the White House 50+ days of evidentiary hearings in litigation brought by private party against the White House

17. ERPA Workshop Antwerp -- April 15, 200417 Aftermath of Audit Restoration project at $25 million expense Restoration project at $25 million expense Thousands of backup tapes restored as part of “Calverton project” Thousands of backup tapes restored as part of “Calverton project” Need for special memorandum of understanding between White House and Archivist covering post- Administration work Need for special memorandum of understanding between White House and Archivist covering post- Administration work

18. ERPA Workshop Antwerp -- April 15, 200418 Lessons Learned The need for QC checks and controls on software The need for QC checks and controls on software programs and processes programs and processes The need for clear communication channels The need for clear communication channels between IT staff, records managers, between IT staff, records managers, and the lawyers and the lawyers Integrating lessons learned in next generation ERK Integrating lessons learned in next generation ERK system at the White House: building in audit system at the White House: building in audit functions and procedures functions and procedures

19. ERPA Workshop Antwerp -- April 15, 200419

20. ERPA Workshop Antwerp -- April 15, 2004 20 For further reading: Armstrong v. Executive Office of the President, 1 F.3d 1274 (D.C. Cir. 1993), available at http://www.citizen.org/litigation/briefs/ERecords/articles.cfm?ID=62 0 Baron, Jason R., “The PROFS Decade: NARA, E-mail and the Courts,“ in Thirty Years of Electronic Records, Bruce Ambacher, ed. (Scarecrow Press 2003). ------------------, “Email Metadata In A Post-Armstrong World, 3rd IEEE Metadata Conference (1999), available at http://www.computer.org/proceedings/ meta/1999/papers/83 /jbaron.html “Clinton Administration’s Management of Executive Office of the President’s E-Mail System,” U.S. General Accounting Office Report, GAO-01-446 (April 2001), available at http://www.gao.gov/new.items/d01446.pdf

21. ERPA Workshop Antwerp -- April 15, 200421 Further Reading (Con’t) Memorandum of Understanding on the Clinton-Gore E-mail Records, available at http://www.archives.gov/presidential_libraries/presidential_records/ available at http://www.archives.gov/presidential_libraries/presidential_records/ http://www.archives.gov/presidential_libraries/presidential_records/ clinton_gore_email_records_memo.html clinton_gore_email_records_memo.html “Missing White House E-mails: Mismanagement of Subpoenaed Records,” Hearings before the Committee on Government Reform, U.S. House of Representatives, 106 th Cong, 2d Sess., Serial No. 106- 179 (March 23, March 30, May 3, and May 4, 2000) The Sedona Principles: Best Practices Recommendations & Principles for Addressing Electronic Document Production (Jan. 2004), available at Addressing Electronic Document Production (Jan. 2004), available at http://www.thesedonaconference.org http://www.thesedonaconference.org The Sedona Guidelines: Best Practices for Managing Information and Records in the Digital World (draft forthcoming 2004), at http://www.thesedonaconference.org

22. ERPA Workshop Antwerp -- April 15, 2004 22 Jason R. Baron Director of Litigation, NARA 8601 Adelphi Rd, Suite 3110 College Park, MD 20740 USA telephone (301) 837-1499 email: jason.baron@nara.gov