Friday, July 4, 2014

IRS Loss of eMails is a Crime

IRS loss of emails is a crime and may become known as a crime of the century.

City of Norfolk has an 8-Day eMail Retention Policy.
4 July 2014, By Hap Cluff, Director of Technology, City of Norfolk (2002-2011), and recognized electronic data retention and disposition policy and process expert.

Given the current IRS email scandal, it may be of interest to your listeners and especially residents of Norfolk that the City of Norfolk (and most other cities in Hampton Roads) may have shorter email retention policies than the IRS.

In Norfolk however, each user is required to sign an agreement to correctly maintain her/his data. All supervisors and executives sign the same agreement which requires them to assure that users, over whom they are responsible, properly maintain their data.

The situation with the IRS reminds me of Eliot Ness, “we can’t get Al Capone for murder but we can get him for income tax evasion.”

We may not be able to get Lois Lerner for “viewpoint discrimination” but she can be criminally charged for losing her emails. It doesn’t matter how they were lost she is still responsible. Just moving them to her personal desktop hard drive is not sufficient, she is responsible to make sure they are backed up.

Same applies to IRS Commissioner John Koskinen, he is criminally liable for the destruction of emails by Lois Lerner even if by the accidental crash of a hard drive. According to David S. Ferriero, Archivist of the United States, the IRS did not comply with required retention or reporting regulation. “They did not follow the law.” That’s called a crime in America.

Email Process.
In the City of Norfolk, email users (regardless if they are the creator or receiver) may delete any and all emails at their sole discretion (except the Police Chief, who is required to retain all emails, he receives, indefinitely). However, all users are compelled to sign an Acceptable Use Policy (AUP) by which they are obligated to securely maintain all documents requiring retention for the legal retention period and for the disposition (disposal) of documents when they are required to be destroyed. Norfolk has adopted the Library of Virginiaretention and disposal policies.

Emails are legally considered “transient” documents until, and unless, the content of the email falls into retention requirements. Transient files do not require any period of retention and may be disposed of immediately, i.e., “hey Joe, lets do lunch at 11:30 today.”

In Norfolk (and this is very typical in all organizations) when a user deletes an email it goes to his/her “Deleted Items” folder where it is systematically purged after 60 days. Once removed from the “Deleted Items” folder, the system holds it for 8 days at which time it is overwritten and permanently destroyed. Similar to the Cockpit Voice Recorder (CVR) on missing Flight 370.

Technical Procedure for Emails.
As long as a user keeps her/his emails in any other folder than the “Deleted Items” folder, all emails will be retained indefinitely and backed up nightly by the City’s IT department server and data storage system. Emails, in MS Exchange, do not ever exist on the desktop hard drive; the only way they can get there is if the user deliberately copies, or “saves,” them to a folder on their desktop hard drive. This makes the user the sole person responsible for the data’s proper retention (i.e., backup).

A user may bypass the 60 day retention period by “hard” deleting an email. This is done using the Shift key and Delete key. In this case the email goes directly to the City’s IT system and will be permanently deleted in 8 days.

The storage capacity of a users email account is solely dependent upon the business needs of the user.

Chronology of Events Regarding eMail Retention at IRS.
Z Street, a pro-Israel non-profit organization filed suit against the IRS for “viewpoint discrimination” in December 2010 requesting all emails (and other documents) be turned over to Z Street. At that point a line was drawn and IRS was under court order to seize and freeze all emails prior to December 2010 and ongoing until the suit was settled. In other words, any and all emails referring to “viewpoint discrimination” by anyone at the IRS were to be identified and secured (which means backed up).

Any destruction (by deliberate act or acts of God) of emails in existence at that time and any emails created, received, or sent following that court order back in December 2010, regardless of the cause, was in violation of that court order and thereby would become a criminal act. This should have ended the IRS policy of limiting email retention to 6 months in its tracks.

You Just Cannot Make This Stuff Up.
IRS contracted with Sonasoft to archive all IRS emails, from 2005 to 2011. Sonasoft's fiscal year 2011 contract (of $14,000 a year) with the IRS ended on August 31, 2011. Eight days later, September 8, 2011, the IRS officially closed out its relationship with Sonasoft.

Lois Lerner's computer allegedly crashed in June 2011, just ten days after House Ways and Means Committee chairman Rep. Dave Camp first wrote a letter asking if the IRS was engaging in targeting of nonprofit groups. Two months later, Sonasoft's contract ended and the IRS gave its email-archiving contractor the boot.

IRS official, and frequent White House visitor, Nikole Flax allegedly suffered her own computer crash in December 2011, three months after the IRS ended its relationship with Sonasoft.

Once the contract with Sonasoft was cancelled, Sonasoft was under no obligation to retain any IRS data. The IRS only had to wait 6 months after Flax’s December 2011 alleged crash and all records of any emails regarding “viewpoint discrimination” would be permanently and irretrievably destroyed. The physical disposal of the local/desktop hard drives ended any possible means of data retrieval. Perhaps the IRS IT techie who was told to destroy the hard drives kept them for his/her own protection.

Contrary to some TV “experts” both the IRS or City’s emails are long gone. Not even the best forensic techie geek in the world can recover data from a hard disk that doesn’t exist, nor from a storage disk which has been electronically shredded/purged and/or overwritten multiple times. Our only hope is the NSA can find the missing emails.

FOIA vs eDiscovery
The Z Street request was not a Freedom of Information Act (FOIA) request it was an eDiscovery. The difference is that eDiscovery is a legal subpoena and requires an immediate freeze including the isolation of any possible devices that may contain such data that is, or may be, part of the discovery. One unique condition with eDiscovery is, if you fail to produce the files, you lose the lawsuit. This includes willful destruction of any physical device upon which such data may have been stored. The moment the court delivered the Z Street eDiscovery subpoena the IRS was required to keep and produce any and all documents relating to any alleged “viewpoint discrimination” for as long as the lawsuit was being litigated. Failure to do so for any reason is admission of guilt.

I processed numerous FOIA requests for the City of Norfolk. I even wrote the City’s procedures for processing FOIA requests. The difference between FOIA request and an eDiscovery subpoena is, a FOIA is at the expense of the requestor, where as the eDiscovery is at the expense of the City/IRS until and unless it is proven in court that the City was not libel, at which time the City’s costs are to be reimbursed.

Once a FOIA request is received, a response is required within 5 days; which merely means formally telling the requestor, in writing, when you will get the data and approximately how much it will cost them to get it. If they agree and pay the money up front their FOIA request is processed.

Backup vs Archive
IRS backed up its emails onsite and the policy was to retain all emails for 6 months. The email-archive was off-site, in the cloud, and was not subject to the 6 months restriction. The archived emails themselves, were also backed up in addition to being preserved in the archive. To date, no retention or disposition time frame for the archived emails, has been released by the IRS.

IRS Like Norfolk Has Blackberrys
Organizations with a fair number of Blackberry users have, in addition to their Microsoft Exchange server, a BES (Blackberry Enterprise Server). The BES is the interface between MS Exchange and RIM’s (Research In Motion -the Blackberry’s company name) system to communicate worldwide with any Blackberry user and/or any other device. The BES has a storage component that also stores emails and can restore lost emails.

Blackberry to Blackberry “messages” can be made to be untraceable (this is good for police officers when messaging with snitches or pulling a sting).

Text Messages are Not Email.
Text messages are kept for 21 days by Verizon or other carriers and not by the Blackberry users company (i.e., IRS, City). Texts cannot be produced by the IRS or City they do not have them, they require a separate subpoena to the carrier to get access (freeze and seize).

Servers Do Not Store Emails
Virtual Servers are the norm today. These servers do not store data. They only have “storage” capacity for the application that the server is running. All data is stored in a separate storage system. Norfolk uses IBM’s XIV storage system (50 terabytes).

Is This a Coincidence?
Of the IRS lawyers who made contributions in the 2012 election, 95% contributed to Obama rather than to Romney.

IRS Commissioner Douglas Shulman’s name appeared in the White House visitor logs 157 times over a period of just 3½ years (Sep 2009 to Jun 2013).

###

Retention and Disposition Are Equal Legal Liabilities.
NOTE: it is equally criminally liable to fail to retain a document for the retention period, as it is to fail to dispose of a document for which the retention period has been exceeded. Even well known archiving vendors are unaware of this legality. I personally pointed this out to several email archiving vendors, during my time as CIO, to which they had no response. Their system could be set to retain/archive all emails, for say 3 years, but would not allow for emails that were required to be destroyed in 2 years to be deleted.

One agency, of which I am aware, failed to dispose of some mainframe computer tapes and when confronted with a lawsuit were compelled to produce the data contained thereon. The problem was, they had replaced their mainframe computer and had to contract for another mainframe with the costly applications software and tape reading equipment to be able to produce the data. As I recall it was well over a million dollars.


References / Sources
THE IRS SCANDAL: TIMELINE
www.DiscoverTheNetworks.org A Guide to the Political Left – David Horowitz
“This website describes the networks and agendas of the political Left.”

See also Forbes Timeline 25 May 2013, by Paul Roderick Gregory
The Timeline of IRS Targeting Of Conservative Groups

5 IRS Scandal Myths - National Review Online 10 June 2013, by Andrew Stiles

IRS Controversy 2013


City of Norfolk Administration Policy.
CHAPTER 10: INFORMATION TECHNOLOGY
TITLE: Electronic data security/storage/recovery policy (10-003)
F. FILE RESTORATION
Each user is ultimately responsible for determining the appropriate backup procedures for his or her data.

AUP signed by every employee (contractors, vendors, volunteers, et. al., have a similar AUP that is required to be signed by them and any person assigned to work.)

Department Executives shall fulfill the following responsibilities.
Ensure that all subordinate users abide by the guidelines set forth in this policy and other related documents.

IRS Policy.
IRS policy 6 months backup. IRS told Reason.com Peter Suderman as reported on 20 June 2014 that, “employees were responsible for keeping their own long-term archives.”

This policy makes Lois Lerner criminally liable for retention of her emails.

David S. Ferriero, Archivist of the United States
... when pressed by Michigan Republican Tim Walberg about whether the IRS failure to inform the National Archives when it learned that two years of the former head of the tax exempt division’s email were lost, he said: “They did not follow the law.”

“Archivist: IRS did not follow law on lost emails”
Politico, 24 June 2014, by Rachael Bade

The IRS Had a Contract With an Email Backup Company
IRS employees were responsible for keeping their own long-term archives.

Sonasoft's contracts with Treasury were pretty modest: about $5,556 in 2005, $24,706 in 2008, and $13,983 in both 2009 and 2010. And the company itself is not very large (it has a market cap of $4.4 million). So it's quite possible that the extent of its services were pretty limited.

Where are the Sonasoft servers and storage systems located??? This may present a further criminal action on the part of the IRS. Data is not allowed to be stored outside the borders of the United States. What is the Nationality of the owners of Sonasoft.

IRS CANCELLED Contract with Email-Storage Firm Weeks After Lerner’s Computer Crash

Hap Wrote: You cannot make this stuff up.
Sonasoft’s fiscal year 2011 contract with the IRS ended on August 31, 2011. Eight days later, September 8, 2011, the IRS officially closed out its relationship with Sonasoft

Lois Lerner’s computer allegedly crashed in June 2011, just ten days after House Ways and Means Committee chairman Rep. Dave Camp first wrote a letter asking if the IRS was engaging in targeting of nonprofit groups. Two months later, Sonasoft’s contract ended and the IRS gave its email-archiving contractor the boot.

IRS official and frequent White House visitor Nikole Flax allegedly suffered her own computer crash in December 2011, three months after the IRS ended its relationship with Sonasoft.


Once the contract with Sonasoft was cancelled they were under no obligation to retain any data. The IRS only had to now wait 6 months and all records of any emails would be destroyed.

What they forgot is the eDiscovery subpoena of Z Street back in
Z Street originally filed this lawsuit in the Eastern District of Pennsylvania in December of 2010

“viewpoint discrimination” case
The complaint alleges that the Internal Revenue Service (“IRS” or “Defendant”) violated the First Amendment when it implemented an internal review policy that subjected Israel-related organizations that are applying for tax-exempt status under Section 501(c)(3) of Title 26 of the U.S. Code to more rigorous review procedures than other organizations applying for that same status. Plaintiff maintains that this so-called “Israel Special Policy” represents impermissible viewpoint discrimination on the part of the federal government, and has requested declaratory and injunctive relief.

This case was initially brought against Douglas H. Shulman, who was Commissioner of Internal Revenue at the time the complaint was filed. John Koskinen has been substituted pursuant to Federal Rule of Civil Procedure 25(d).
Case 1:12-cv-00401-KBJ Document 49 Filed 05/27/14 Page 1 & 2 of 34


Z Street not mentioned in DTN timeline
Z Street is a non-profit corporation dedicated to educating the public about various issues related to Israel and the Middle East. The education is from a particular viewpoint:
educating the public about Zionism; about the facts relating to the Middle East and to the existence of Israel as a Jewish State; and about Israel’s right to refuse to negotiate with, make concessions to, or appease terrorists



C:\0Docs\0Hap\WRITING\FallacyReports\IRS Scandal a Crime.wpd