Depends on whether your org has a specific retention policy for such things. Moving them to offline backup monthly and scrubbing old backups at retention threshold is Good Practice(tm) but YMMV.
Having good note taking hygiene
jasonbrown1965
#22
. . .
Protip: If someone turns up to an interview holding a Moleskin and claiming to be a journalist, shoot them.
Seriously, what real journo can afford pricey notepads for basic notetaking?
. .
stuohy
#25
s2e <- not a lawyer! But, in a flashback to my old life in ADR I am remembering something a judge once told me about this. You should have more than an "established pattern of behavior." Even having a written policy around why you destroy/retain documents will not always be able to save you from sanction. You are obligated to preserve evidence when you "should have known" it would have been relevant to future litigation.
With that said (here comes the non-legally founded opinion) you should provide your possible future council with clear evidence that you made a good faith effort to adhere to the letter of the law without making all your historic data claimed in its entirety from one request for production.
If you are concerned about this I would put a policy in place that clearly states how, when and more importantly why you retain documents. Then make sure you follow it. This way you will have something to point to when you no longer have a specific email/document that explains why it was not retained and shows how you did your due diligence in trying to preserve any possible future evidence.
If overreaching litigation is your concern I would consider something like the following. I would archive any emails or documents that are to be saved because of your policy into encrypted bundles organized by the date range of the e-mails to which only you have the individual password for each date. (password manager with a base and then a date based hash you use would be my thought.) That way if you are legally compelled to provide access to your backups for a specific case your lawyer can first send request they pick from the list of archives. And, if they push back, may be able to use the undue burden of decryption / searching through the entire archive of files with individual passwords to push them to specify the specific date-range(s) that they are interested in. More so, you will have final say on whether the documents are decrypted and sent since they cannot go around you to compel your email provider. (Depending upon how long your provider retains deleted e-mails.)
Again, not a lawyer, but I think erring on the side of providing your legal counsel with the most possible ammunition while still being in the appropriate bounds of the law is a good idea. If you lawyer is able to argue them down to the minimal possible set of (clearly documented and adhered to) date-ranges there is less chance of them being able to leverage unrelated incidents in order to non-judicially gain access to your entire historical set of contacts and communications.
Hope that sparks a lawyer on here to speak up and talk a bit more about how technical controls actually play out in the legal landscape.
ethannorth
#26
A good rule of thumb for setting yourself up to thrive, should you have to deal with overboard hostile discovery requests at some future date is: if it feels sensitive, then pick up the phone instead of writing it down, especially in an email.
Encrypted VOIP is best, such as Signal.
Deleting old emails is something of a double edged sword, since they can often be used to refute the legal adversary's narrative just as well as they can be used against you.
As @jonathanstray mentioned already, it's an especially bad idea to write a source's name down. You're inevitably going to end up with some primary source documents as well as your own work product on your computer; there's no getting around that. At a certain point, that's why having a good lawyer on your side is essential, but there's absolutely no need to keep records of sources names in writing.
Lawyers are pretty cagey about how they use email. They may not be infosec people, but they're generally pretty careful about the written records they create, especially with email, as opposed to phone or in-person conversations. This is just a natural occupational side-effect of participating in many exhaustive discovery processes over one's career. So, it's not some impossible standard to keep an awareness of this. Lawyers do it. You can too.