Watch out, your metadata is showing

The Arizona supreme court has just decided that the metadata of a document is governed by the same rules as the document. If the metadata is attached to a public record, then the metadata too is a public record; so if, as a police officer disciplined after blowing the whistle on colleagues, you ask for your performance results then you should get metadata like who wrote them and when so you can prove whether they were written before or after you made yourself unpopular.

The original court viewed the metadata as a 'byproduct' and an 'electronic orphan' of the document, the supreme court said it was illogical to separate it - because if the date was written on a paper record you'd get to see it so why should it be hidden because it was added electronically. The case was complicated by the fact that Arizona law on public records doesn't actually define what a public record, and by the fact that America has two sets of laws (State and Federal) and while federal law says metadata has to be included with documents produced as evidence in a court case, public records in the US are governed by state law.

Up until now, metadata in public documents has been dug out by eagle-eyed investigators. They've revealed things like the fact that Google was behind an anonymous complaint to the Australian Competition & Consumer Commission about eBay only accepting PayPal payments in Australia and not Google Checkout; or that the farmers who asked congress to hold hearings on a Google-Yahoo deal handed in a letter written by lobbyists LawMedia in what looked like a tit-for-tat fight over net neutrality; or that the MPAA actually wrote an anti-piracy letter that the California attorney general put his name too - or closer to home, that the 'dodgy dossier' on WMDs was plagiarised from student essays by civil servants rather than compiled from real research by the security services.

Virus writers know this; it was Word metadata that convicted the writer of Melissa. Companies know this - or they ought to by now. If you're archiving email in a repository, it's crucial to store the original metadata for forensic purposes. If you’re storing documents in a repository, you need to store - and produce - metadata. The information in metadata is as important as the actual document and sometimes more so, says Craig Carpenter, VP general counsel at enterprise search experts Recommind. "“Without knowing when something happened, or who was involved, electronic evidence is often useless – thus, metadata is critical.
 
“Because of metadata’s critical nature, it is generally deemed to be part and parcel of the document it describes – if the document is relevant and must be divulged, then so must the metadata.  To somewhat varying degrees, jurisdictions like the UK and US require that relevant evidence or information should be preserved and shared with the other side, for example in litigation, as it is needed to help the trier of fact, the judge or jury, determine the ultimate outcome of a matter."

"Metadata can certainly be the subject of disclosure orders in civil litigation," agreed UK lawyer Simon Bradshaw and pointed at this UK legal definition of a document which "also extends to additional information stored and associated with electronic documents known as metadata".

But that's for documents stored by companies. What about government and public bodies and the Freedom of Information Act? Do the principles of the Arizona ruling apply here? Carpenter thinks so; "While there is an absence of specific statutory coverage, this same theory generally holds true with FOIA-like situations – that is to say, that where it is not relevant metadata probably does not need to be divulged, but where it is potentially relevant, for example who sent certain email messages, to whom, when et cetera, it generally does need to be divulged."

There are tools for removing metadata from documents (Office has a built-in option). There are tools for preserving metadata; Adobe often works with the police and security forces to secure chains of evidence. Companies need to know how to use both options (and when to use which one) - and Arizona might be a timely reminder that so do public bodies.

-Mary