Regulations, Policies and Ethics · Topic 3 of 4
eDiscovery, Agencies and Privacy Law
Learn business records as evidence, division of responsibilities, eDiscovery roles, law enforcement agencies, privacy and compliance, and related laws.
- 5 min
- Business records qualify when made in the regular course of business at or near the event.
- Legal counsel and IT work together in eDiscovery; a legal hold preserves data.
- Roles are separated so a suspect never controls the evidence.
What it is
Investigations take place inside a web of legal duties. Records created in the normal course of business can be evidence, many people share the work, agencies may need to be involved, and privacy and compliance laws limit what an investigator can collect and how it is handled.
How it works
Records of regularly conducted activity as evidence
Records kept in the ordinary course of business, such as logs, invoices and access records, are an exception to the hearsay rule (FRE 803(6), the business records exception). To qualify, the record must be:
- Made at or near the time of the event by someone with knowledge.
- Kept as part of a regular business practice.
- Made as a regular practice of that activity.
- Supported by a custodian or a certification that confirms these conditions.
Computer generated logs are strong evidence because they are created automatically and consistently. Records made only for a lawsuit, or created long after the event, do not qualify. This is why consistent logging policies matter.
Division of responsibilities
| Role | Responsibility |
|---|---|
| First responder | Secures the scene and preserves evidence until the investigator arrives |
| Forensic investigator or examiner | Acquires, analyzes and reports |
| Evidence custodian | Stores evidence and maintains the log |
| System or network administrator | Provides access, background and logs, and does not alter evidence |
| Legal counsel | Advises on authority, privilege, privacy and admissibility |
| Management or HR | Authorizes the investigation and handles personnel decisions |
| Law enforcement | Takes over criminal matters, uses warrants and arrests |
Clear roles prevent contamination of evidence and conflicts of interest. For example, a system administrator who is the suspect must not be the one collecting the evidence.
Legal and IT team considerations for eDiscovery
The Electronic Discovery Reference Model describes the stages: information governance, identification, preservation, collection, processing, review, analysis, production and presentation.
| Team | Considerations |
|---|---|
| Legal | Defines the scope and relevant custodians, issues a legal hold that stops deletion, reviews for privilege, decides what is produced |
| IT | Locates data sources, suspends auto deletion and backup rotation, collects in a defensible way, documents the process |
Both teams must communicate early. Failing to preserve relevant data after a duty to preserve arises can lead to court sanctions. Data should be collected with its metadata intact, and a record kept of what was searched.
Role of local and international agencies
Cybercrime often crosses borders. Local law enforcement handles the initial report and criminal process, while national bodies and international organizations help with cross border cases.
| Body | Role |
|---|---|
| Local and national police and cybercrime units | Investigate and prosecute |
| FBI and the Secret Service (US) | Federal cybercrime investigation |
| Internet Crime Complaint Center (IC3) | Receives online crime reports in the US |
| National CERTs and CSIRTs | Coordinate incident response |
| INTERPOL | Links police forces in member countries |
| Europol's European Cybercrime Center | Supports EU cybercrime cases |
| Mutual legal assistance treaties | Formal ways to request evidence from another country |
International cooperation is slow, so early contact and fast requests to preserve data are important. The Budapest Convention on Cybercrime is the main international treaty that aligns laws and cooperation.
Legal issues, privacy issues and legal compliance
The main concerns are:
- Authority: collect only with a warrant, consent or policy basis.
- Privacy: personal data of employees and customers is protected, and examination must be limited to what is relevant.
- Privilege: communications with lawyers must be kept apart.
- Jurisdiction: where the data and people are located decides which laws apply.
- Data retention and transfer: keep and move data as the law requires.
- Compliance: follow the rules of regulated sectors.
Using a privacy conscious approach, such as limiting access, minimizing the data collected and securing it, protects the organization and the case.
Other laws that may influence computer forensics
| Law | Subject |
|---|---|
| Computer Fraud and Abuse Act (US) | Unauthorized access to computers |
| Electronic Communications Privacy Act, Wiretap Act and Stored Communications Act (US) | Interception of communications and access to stored messages |
| HIPAA (US) | Protects health information |
| Sarbanes Oxley Act | Financial records and controls of public companies |
| Gramm Leach Bliley Act | Financial customer data |
| GDPR (EU) | Personal data protection, with large fines for violations |
| UK Computer Misuse Act and Data Protection Act | Unauthorized access, personal data in the UK |
| Digital Millennium Copyright Act (US) | Copyright, circumvention |
| PCI DSS | A payment industry standard, not a law |
An investigator should know which laws cover the data involved before collecting it. For example, health data triggers HIPAA duties, and personal data of EU residents triggers GDPR.
A worked example
A hospital suspects an employee of reading patient records. The investigator asks legal counsel to confirm authority, and the IT team preserves the access logs under a legal hold. The logs qualify as business records because they were made automatically in the course of regular activity.
The examination is limited to the records relevant to the case, because health information is protected by HIPAA.
How the exam asks about this
- "Which FRE rule covers records of regularly conducted activity?" → Rule 803(6).
- "What stops routine deletion of relevant data when litigation is expected?" → A legal hold.
- "Which law protects health information?" → HIPAA.
What to remember for the exam
- Business records qualify when made in the regular course of business at or near the event.
- Legal counsel and IT work together in eDiscovery; a legal hold preserves data.
- Roles are separated so a suspect never controls the evidence.
- Cross border cases rely on agencies such as INTERPOL and Europol, and on treaties.
- Know which law covers the data type: HIPAA, SOX, GLBA, GDPR and others.
Forensic work may expose personal data that the case does not need. Collect and keep only what is relevant and protect it.
Common mistakes
Ignoring the duty to preserve. Letting automatic deletion run after litigation is foreseeable can lead to sanctions.
Letting the suspect administer the evidence. This is a conflict of interest and a chain of custody problem.
Assuming one country's law applies everywhere. Data location and the subject's residence can bring other laws into play.
Check yourself
What makes a log a business record?
It is made at or near the time of the event, in the regular course of business, as a regular practice.
What is a legal hold?
An instruction to preserve relevant data and stop routine deletion once litigation is expected.
Which treaty aligns cybercrime laws and cooperation internationally?
The Budapest Convention on Cybercrime.
Topic 3 of 4 in Regulations, Policies and Ethics
Test yourself on Regulations, Policies and Ethics
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.