> Hi all, > I'm working on a new article that tries to answer the following > question: > > When is expunging data valid to keep avoid e-discovery costs or protect > personal privacy, and when would it be considered "destruction of > evidence"? > Is having set policy of "records are delete every x days," or "free hard > drive space is wiped nightly" enough, or is more required? > > The above question is phrased from the stand point of a business, but > I > must admit Im more interested in the answer from an individual > standpoint. > For those not in the know, wiping a drive after an investigation had begun > (or if you have a reasonable expectation to believe a legal investigation > it > about to begin) is considered Destruction of evidence or Spoliation of > evidence. Once an investigation is likely to begin, you have what is > known > as a duty to preserve. Two likely outcomes if you are found to have > caused > spoliation of evidence are: 1. Prosecution under criminal statues > concerning > destruction of evidence (check with a layer in your jurisdiction). 2. The > judge may slap you with a spoliation-based adverse inference, which > basically means a statement saying that since you destroyed evidence, it > is > likely there was something incriminating there, and the court should > assume > it would have help your adversarys case. Now all that said there are > exceptions made for data that has been removed because of normal, routine > processes. > > I can think of many valid reasons for wiping a drives freespace > routinely: > > 1. Protect privacy from others with physical access. > 2. Fear that the machine might be stolen. > 3. Donating the machine. > 4. Reallocating the machine to someone of a different security level. > > But would that hold up in a court case? I'm having problems finding case > law. I'd imagine no matter what your reasons, prosecuters will try to get > a > spoliation-based adverse inference judgment against you if any drive > wiping had been detected. Anyone have experience with this, or know a case > where someone did drive wiping for privacy reasons, but the prosecution > tried to make it seem like destruction of evidence that may never have > been > there in the first place? > > > Adrian
I suspect you are going to get a lot of "I am not a layer but ... " responses. I'd suggest you try sending your question(s) to the EFF (http://www.eff.org) or to Denise Howell et al over at the "This Week In Law" podcast (http://twit.tv/twil). Either one should be able to help you identify any relevant case law. If you do decide to go this route, please let us know the outcome. -- byte_bucket _______________________________________________ Pauldotcom mailing list [email protected] http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com
