Source: https://www.pepperlaw.com/publications/when-electronic-records-disappear-but-legal-issues-linger-2018-09-06/
Timestamp: 2019-04-25 08:07:27+00:00

Document:
This article was published in Law360 on September 6, 2018. © Copyright 2018, Portfolio Media, Inc., publisher of Law360. It is republished here with permission.
The ripples from ephemeral communication tools may extend into civil litigation too, as a company’s use of, or acquiescence of employees’ use of, these tools is inconsistent with the company’s duty to preserve evidence. This may open the door for sanctions for spoliation under Federal Rule of Civil Procedure 37(e).
Examine your document retention policy, and determine if it addresses the use of ephemeral communication. If it does not, you should seriously consider either prohibiting the use of such apps or restricting them to nonbusiness messages only.
In addition, corporate guidelines must provide a systematic way to police this policy through regular training sessions, quality control monitoring systems and certifications of compliance by employees.
If there are valid business reasons for using ephemeral communication tools, those reasons must be set forth clearly as well as the circumstances under which the tools will be appropriately used.
If ephemeral communication tools are permitted under designated circumstances, or if a company suspects employees may be using these apps, the company must take certain steps if it is on notice of potential litigation. Companies must turn off any automatic deletion tools or be subject to charges of spoliation.
Once a hold on all deletions has been issued, and the automatic deletion tool deactivated, a company should have a system to audit and confirm the deletion tool remains inactive and that no other ephemeral communication apps have been employed.
What Are Ephemeral Communications Apps?
Ephemeral communications apps, also called disappearing messaging apps, are reshaping the landscape of digital communication by enabling their users to send messages that are automatically deleted after a specified period of time. Snapchat was an early innovator, providing a platform on which users could share photos and videos for a short period of time before they would be deleted. Dozens of other apps have quickly followed. Apps like Instagram, Cyber Dust, Wickr Me, Burn Note, Confide, Telegram Messenger, TigerText, Sicher, Whisper and others all enable users to send messages, pictures and videos that self-destruct. While these apps were designed for social entertainment, enterprises and their employees have quickly realized the benefits, and app developers have responded. Wickr, for example, now offers fully encrypted enterprise-level communications that are automatically deleted after a specified period of time.
The benefits of such a system are compelling, particularly in the era of the EU’s General Data Protection Regulation and the California Consumer Privacy Act, when the need to be forgotten is strong and when data breach is a constant threat. Companies can greatly reduce the risk of data breach and enhance the security of their most valuable assets if their communications are ephemeral, particularly sensitive internal communications. Further, employees may be more comfortable raising compliance or harassment issues if they know that there will not be a permanent record.
While there is nothing illegal about an enterprise choosing to use such a system, there may be grave implications for legal document preservation. For decades, email has been the primary source of communication and collaboration in companies and thus has been vital evidence in litigation. What will happen when companies no longer retain their communications?
Similarly, a recently unsealed filing in litigation between CBS executives and the Redstone family’s National Amusements Inc., or NAI, for control of the broadcaster revealed accusations that CBS executives destroyed evidence by using TigerText, an app that can delete text messages immediately after they are read.5 While the details of the discovery remain redacted, the motion stated that CBS acknowledged that employees used the ephemeral communication app, including its legal department, but the company refused to suspend the app’s use or impound the devices used. NAI argued that CBS was obligated to preserve all evidence relevant to the dispute and intentionally failed to do so. Shortly after the filing was unsealed, CBS said in a public statement that it had adopted TigerText for cybersecurity reasons after the Sony hack and not for any nefarious reason. NAI requested that the court enter an order to prevent further spoliation. NAI has since withdrawn its motion without prejudice in exchange for commitments by CBS to image all devices and conduct forensic searches for deleted messages on previous imaging, thus removing the threat of spoliation of data.
In November 2017, the DOJ implemented new provisions to its FCPA Corporate Enforcement Policy aimed at incentivizing self-disclosure of misconduct. These provisions allow for a presumption that the agency will decline to pursue an enforcement action when the company “voluntarily self-disclose[s] misconduct in an FCPA matter, fully cooperate[s], and timely and appropriately remediate[s], all in accordance with the standards set forth [in the U.S. Attorney’s Manual].”6 When there are aggravating circumstances that warrant a criminal resolution, such as extensive pervasiveness and high-level executive involvement in the criminal misconduct, the DOJ will recommend a 50 percent reduction in the low end of the sentencing guidelines.
Finally, the company must demonstrate “timely and appropriate remediation.”9 A company does so by conducting a thorough root-cause analysis of the misconduct and by instituting a robust compliance and ethics program that is appropriate for the company’s size and resources. Remediation also includes discipline of culpable employees. Significantly, the policy requires that a company maintain “[a]ppropriate retention of business records, and prohibit the improper destruction or deletion of business records, including prohibiting employees from using software that generates but does not appropriately retain business records or communications.”10 Given that the main feature of an ephemeral communication app is the nonretention of communications, a company must choose between permitting its employees to use these apps or complying with the DOJ’s policy and possibly having the DOJ decline an enforcement action if misconduct is discovered and self-reported.
These cases indicate the courts’ willingness to view the use of disappearing apps as contrary to a duty to preserve if the appropriate cause of action or mechanism is available, although recoverability of the messages may be a requisite.
Federal Rule of Civil Procedure 37(e) provides for sanctions in the event that a party fails to preserve relevant data. Based on the Uber court’s discussion of the potential implications of a company’s using ephemeral communications, as well as analogous case law, it appears that a company that encourages or permits its employees to use ephemeral communications apps runs the risk that a court will find the company failed to preserve relevant data. If the loss is deemed to have been intentional and material, the most severe sanctions pursuant to Rule 37(e)(2) are possible, including adverse inference instructions or termination of the action.
It does not appear that any court has imposed sanctions as a result of ephemeral communications-related spoliation. However, cases involving data-wiping programs like CCleaner, which securely erases data, provide an instructive analogy. In Klipsch v. ePRO e-commerce, where Klipsch alleged that ePRO sold counterfeit Klipsch products, the Second Circuit reviewed the trial court’s imposition of discovery sanctions for intentional destruction of relevant data.16 Klipsch’s electronically stored information, or ESI, consultant found that ePRO custodians manually deleted files and emails using data-wiping software before the court-ordered forensic examination. The court found that ePRO intentionally spoliated relevant ESI, awarded costs associated with bringing the motion, and imposed a $5 million restraint on ePRO’s assets. The Second Circuit affirmed, finding that the amount of sanctions awarded were not impermissibly punitive or disproportional.
Similarly the court in Lexpath Technologies Holdings Inc. v. Welch addressed the allegation that a former employee intentionally deleted files.17 The plaintiff’s consultant testified that Welch ran CCleaner on the laptop, rendering more than 53,000 files unrecoverable, before removing the program from the laptop. Despite Welch’s argument that the program had a legitimate information technology use, the court found that Welch intentionally deleted relevant files once litigation was reasonably foreseeable. Pursuant to Federal Rule of Civil Procedure 37(e), the court determined that the appropriate sanction would be to instruct the jury that it may presume the information was unfavorable to Welch.
The legal implications of ephemeral communication tools are surfacing in various types of litigation and investigations. As the use of these apps increases, a company must constantly evaluate how to reconcile the use of, or acquiescence of employees’ use of, these tools with the company’s duty to preserve evidence. While the courts are just now analyzing the legal implications of these tools, companies should consider following best practices highlighted above.
1 Sansone v. Greitens, No. 17AC-CC00635 (Circuit Court Cole County, MO).
2 Citizens for Responsibility & Ethics in Wash. v. Trump, No. 17-cv-1228 (D.D.C. March 20, 2018).
3 Dep’t of Justice, U.S. Attorney’s Manual § 9-47.120(3)(c) (Nov. 2017), https://www.justice.gov/usam/usam-9-47000-foreign-corrupt-practices-act-1977.
4 See, e.g., Aarian Marshall, The Uber-Waymo Lawsuit Gets A New Star — And Takes a Wild Turn, Wired (Nov. 30, 2017), https://www.wired.com/story/uber-waymo-richard-jacobs-lawsuit/.
5 CBS Corp. v. Nat’l Amusements Inc., 2018 Del. Ch. LEXIS 157.
6 U.S. Attorney’s Manual, supra note 3, § 9-47.120(1) .
7 Id. at § 9-47.120(3)(a).
8 Id. at § 9-47.120(3)(b).
9 Id. at § 9-47.120(3)(c).
10 Id. at § 9-47.120(3)(c).
11 Citizens for Responsibility & Ethics in Wash. v. Trump, 302 F. Supp. 3d 1127, (D.D.C. March 20, 2018).
13 Sansone v. Greitens, No. 17AC-CC0063 (Cole Co., 19th Judicial Circuit, Order dated April 30, 2018).
14 Sansone, (Order dated June 29, 2018).
15 Jasmine Ramirez, Court in Confide Case Says Plaintiff Must Prove Records of Messages, ABC 17 News (June 19, 2018), https://www.abc17news.com/news/judge-in-confide-case-says-plaintiff-must-provide-records-of-messages/755504636.
16 880 F.3d 620 (2d Cir. 2018).
17 2016 WL 4544344 (D.N.J. Aug. 30, 2016).
Donna Fisher and Matthew Hamilton are partners in Pepper Hamilton’s Health Sciences Department, a team of 110 attorneys who collaborate across disciplines to solve complex legal challenges confronting clients throughout the health sciences spectrum. Jessica Southwick is an associate in the Health Sciences Department.

References: v. 
 v. 
 v. 
 v. 
 § 9
 v. 
 § 9
 § 9
 § 9
 § 9
 § 9
 v. 
 v.