Suspending Automatic Deletion

Nothing in an information system waits for a legal decision. Mailboxes purge on a thirty-day cycle, chat channels expire on a timer, backup tapes rotate and overwrite, and a departing employee's laptop is reimaged within a week. Each of those processes is defensible in its own right, and each of them destroys evidence on a schedule that continues to run after a preservation duty has attached.

Why systems delete by default

Retention limits exist for reasons unconnected with litigation. Storage costs money, indexing large volumes slows systems down, privacy commitments promise that personal data will not be kept indefinitely, and a smaller data footprint reduces the harm of a security incident. Regulators in some sectors impose retention floors, but for most material outside those sectors the pressure runs the other way.

The federal sanctions rule once addressed this directly. An earlier version provided that, absent exceptional circumstances, a court could not impose sanctions for information lost through the routine, good-faith operation of an electronic information system. That provision no longer exists. The current rule replaced it, and routine operation now enters the analysis only as a factor in deciding whether a party took reasonable steps once it anticipated litigation.

The committee note accompanying the current rule is explicit that the prospect of litigation may call for intervening in routine operation. Read together, the effect is that ordinary deletion is unremarkable until a duty attaches and becomes a decision immediately afterward. The absence of a standalone immunity is the reason suspension has to be treated as an operational task with a deadline rather than a policy aspiration.

The settings that have to change

Suspension is carried out by administrators, not by custodians. A hold notice tells an employee not to delete; it does nothing about a policy that deletes on the employee's behalf. The two steps have to be taken together, and the second is invisible to everyone except the people who operate the system.

Identifying the settings is harder than changing them. Most organizations run several platforms acquired at different times, each with its own retention model, and no single person knows all of them. A written inventory of where data lives and what destroys it is the precondition for any credible suspension, and building one during a dispute is slower and less complete than maintaining one in advance.

Offboarding is the failure that recurs most often. A custodian leaves, the standard process runs, and a laptop is wiped weeks after a hold was circulated to a list that no longer included that person. The exclusion has to be built into the human resources workflow rather than handled by remembering, which is why the hold notice sent to administrators and records staff matters as much as the one sent to the team.

Ephemeral and disappearing messages

Platforms that delete content automatically after a short interval present the problem in its sharpest form. Where the timer is measured in hours, an organization that anticipates litigation has effectively no window in which to intervene, and by the time counsel is consulted the content is gone. Courts have treated the resulting loss as a consequence of a configuration choice rather than an accident.

Two threads run through the decisions. The first concerns whether the platform was adopted or configured with litigation in mind, which bears on the separate question of the intent finding that unlocks the severest measures. The second concerns whether the organization, having chosen a platform without a hold capability, took any step at all once the duty attached — instructing employees to move relevant exchanges to a retained channel, exporting threads, or turning the feature off for the affected teams.

Neither thread condemns short retention as such. Organizations adopt it for reasons that have nothing to do with evidence, and the rule does not require indefinite storage. The difficulty arises from the interaction between an automatic timer and a duty that attaches without notice.

Backups and what they are worth

Backups occupy an awkward position. They are usually duplicative, expensive to search, and maintained for disaster recovery rather than retrieval of individual records. Rule 26(b)(2)(B) allows a party to identify sources as not reasonably accessible because of undue burden or cost, and disaster-recovery media is the standard example.

The usual compromise is to pull one set out of rotation covering the period in dispute and leave the remainder running. That preserves a restoration route at a bounded cost, and it gives a concrete answer to a preservation demand that asks for all backups indefinitely. Where a sector regulation already requires retention for a fixed term, the regulatory obligation runs alongside and is not displaced by the litigation duty.

That protection weakens once live data has been lost. The current rule directs a court's attention first to whether the lost information can be restored or replaced through additional discovery, and a backup set is often the only candidate. A party that allowed live records to disappear and then rotated the backups that would have restored them has removed the cure as well as the evidence, which is a materially worse position than either failure alone.

Documenting what was suspended

The record of suspension is the evidence that reasonable steps were taken. What matters is specific: which policies were changed, by whom, on what date range of material, and what verification followed. Administrative tickets, console export logs and configuration change records serve this purpose better than a narrative written afterward.

Timing is part of the record. A suspension applied the day a demand letter arrived reads very differently from one applied after a complaint was served, and the interval between the two is where any argument about loss will be located. Recording the request as well as the change captures that interval, including the cases where an administrator was asked promptly and the work took days to complete.

The same record supports the opposite argument when a party contends that preservation was disproportionate to what the dispute actually required. A party urging that a preservation demand is excessive is expected to provide specifics about its systems, and it cannot do so without knowing what its own policies are. Documentation is therefore not only a defense against the measures available for lost electronic evidence but the raw material for negotiating the scope of preservation in the first place.