Corrections Telecommunication and Technology
F. Warren Benton, Ph.D.
John Jay College of Criminal Justice, CUNY
Reprints from a series published in Corrections Managers' Report.

Access the entire collection at the CTT Web Site.


Email Security and Privacy for the Correctional Manager

by F. Warren Benton, Ph.D.
Copyright Corrections Managers' Report, February/March 1999

Correctional managers are frequently the target of lawsuits. Not only are they subject to the litigation that most public managers face, such as cases involving personnel management or potential liability for an accident involving a public agency, correctional managers are also subject to prisoner lawsuits in federal court under civil rights laws. Fortunately, correctional managers lose few prisoner lawsuits.

However, as anyone who has ever been sued understands, the discovery phase of defending a lawsuit can sometimes be more painful than the most pessimistic version of a potential outcome. In discovery, the Plaintiff gets to ask for documents and other evidence that might support the claims made in the suit. Sometimes the inquiries can be extensive, and responding can be time-consuming. A particular focus may be written communications by defendants.

Email opens up new opportunities for legal discovery

This is where your email comes in. In the past, your written communications may have been in the form of infrequent memos and letters, and more frequent telephone conversations. Today, managers use email to communicate because it is quick, convenient, and accountable. Email may be valuable for management, but it can complicate the defense of a lawsuit. Consider the following new opportunities for your opponents in a legal case:

Email has nine lives: As Oliver North can explain after his experience in the Iran-Contra investigation, email messages have nine lives. You may think that you erased a message, but a recipient may not have erased it, and backup copies may reside on tapes maintained just in case the email system breaks down. Even if the official procedure is to maintain backups only for a few days, weeks, or months, cautious computer operators may take extra precautions, and back-up tapes can find their way into the wrong hands in unpredictable ways.

You may not own or control your own email: If you agency provides your email service and email address, it is likely that you do not have official control of your email. Many agencies make the terms of their email services clear - that the email is available only for official business; that the email belongs to the agency; and that the agency can view or distribute it at its discretion. Furthermore, the fact that your agency may not have issued a policy to this effect does not mean that this practice is not in effect, or that in a lawsuit the agency would not eventually take this position.

Email is convenient to search: In the past, searching files for memos and searching telephone records for matching phone numbers was expensive and time-consuming. Today, if some has a copy of your email archive, a comprehensive search on key terms and names is easy to undertake. Therefore, finding the details of your communications on an issue is greatly facilitated.

Email with your lawyer may not be protected: Based on recent federal rulings concerning President Clinton and white house lawyers, you should not assume that an email between you and your government lawyer is automatically protected by attorney-client privilege. Furthermore, in some legal cases, the fact that a message was transmitted over the internet has been construed as a waiver of confidentiality and privilege. There are good arguments against this, and the issued is discussed in more detail in an article available on the internet:

So what should a correctional manager do?

Assume that your email is public: Regardless of the precautions that might be taken to assure the privacy of your email, the best defensive approach is to assume that whatever you say in your email "can and will be used against you in a court of law."

Clarify your agency's email policy: If your agency does not have a policy about email control, retention, access, and privacy, you should take steps to see that one is developed and issued. The Oklahoma Department of corrections maintains procedures on the internet, and their general employee internet policy can be found at is Oklahoma Department of Corrections Employee Internet Policy. While Oklahoma's policy does not take this position, policies in some public agencies explicitly state that the email, including the content of the messages transmitted, is the property of the agency and is open to official review and inspection.

Consider using and maintaining a private email address: You might consider using the email service provided through you personal internet access provider a your home. Internet services have privacy policies that are not bullet-proof, but they are at least designed with your privacy in mind. Most internet service providers state their email privacy policies somewhere on their websites. For example, the Hotmail Privacy Statement includes the following: "Hotmail keeps all of your Personal Information private and does not share it with any third parties. Hotmail will not disclose your Personal Information unless acting under a good faith belief that such action is necessary to: (1) conform to legal requirements or comply with legal process; (2) protect and defend the rights or property of Hotmail; (3) enforce the Hotmail Terms of Service; or (4) act to protect the interests of its members or others."

Look for independent certification of the privacy practices of a service. For example, "TrustE" is an independent organization that certifies the privacy practices of internet services. An explanation of this program can be found at http://www.truste.org/users/users_how.html.

Advocate a secure communications network for your agency. The key elements of a secure network include: firewalls, to limit unauthorized access to your network; encryption, to automatically code messages and information transfers on the network; and audit logs, to document network communications for monitoring.