Computer Forensics and E-Discovery Blog

I Didn't Get The Email-How Often It Happens

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Wed, 15 Jul 2009 11:12:04 -0600

In the last 12 months, I have had three cases that I've labeled as "I didn't get the email" (IDGTE) cases. It is often my role to help a judge or jury understand how email sent from one party to another might not get delivered. There are obvious reasons such as being removed by a SPAM filter. However in most systems, you can see what file(s) the SPAM filter removed. Thus, the recipient can figure out what happened.

But there are so-called silent lost email messages in which neither party is notified of the delivery failure and, in general, we never know what caused the failure.

"Addressing Email Loss with SureMail: Measurement, Design, and Evaluation" measures such silent loss as approximately 0.71% to 1.02%.

This article caught my attention because most of the material that I have found on lost emails is aimed at bulk mailers, a far different situation than email between friends or business parties. I believe that the number IDGTE cases will continue to rise. I'd like to hear from anyone who knows about IDGTE cases. I'm collecting a library of them.

Questions and comments are welcome.

What's New in e-Discovery

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Mon, 29 Jun 2009 15:44:18 -0600

Jason R. Baron wrote a guest blog, DESI, Sedona and Barcelona, in Ralph Losey's blog e-Discovery Team. In the blog, Jason Reports from the DESI III Global E-Discovery/E-Disclosure Workshop at ICAIL 2009 and The Sedona Conference® International Programme on Cross Border E-Discovery and Privacy. He reports on many of the individual presentations and has some great links.

Jason reports a familiar refrain, being prepared for the Rule 26 "meet and confer" and his interesting study on "asymmetric preparation" for the meeting. He also discusses the use of testing e-discovery plans before launching full fledged e-discovery, a procedure similar to Judge Shira Scheindlin’s "Rolling Discovery" that I reported on previously.

Another trend among the presentations was the use of clustering techniques reduce the size of the ESI that has to be reviewed.

What encouraged me most about these conferences is the genuine sharing of researchers with practitioners-attorneys. From my experience of 40 years in academe, I know that such collaborations between theoretical research and practitioner are not a given.

I'm interested in hearing from attorneys who have been through an e-discovery case. What worked? What didn't work? What will you do differently next time?

10 Steps to Effective Litigation Holds

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Tue, 23 Jun 2009 13:12:36 -0600

I just came across Jeffrey Beard's white paper on litigation holds, a must read for folks relatively new to e-discovery and a good idea for those who have more experience. It concludes with 10 best practices for litigation holds. He emphasizes planning ahead for e-discovery, strategies for putting the hold in place (categorize ESI with respect to potential spoliation), and ongoing communication. He also argues that litigators can use the Rule 26 hearing as an advantage by setting the scope of discovery, a refrain I've been singing for some time.

Judge Shira Scheindlin Advocates Rolling Discovery

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Wed, 27 May 2009 16:53:28 -0600

My last post highlighted an observation by Judge Shira Scheindlin’s, judge in the seminal Zubulake v UBS Warburg, in a podcast with Ralph Losey, attorney and frequent e-discovery blogger.

Both have wise and thoughtful comments on both e-discovery and legal education. However, Judge Scheindlin introduced one idea that is, I believe, so important as to merit an entire discussion by itself.

In expressing concerns about the cost of e‑discovery being used as a bludgeon to force defendants to settlements in order to avoid the costs of e-discovery, she advocates “rolling discovery.”

And I know there’s been a fear, I hear it all the time in The Bar, that the cost of e-discovery is shifting the ground in terms of the ability to extort settlements. But I do think … that there is no need to try and find every piece of relevant email, but you should instead scale your search. We should be thinking in terms of rolling productions in a series. Let’s start off – let’s see what we can get in an economical manner and produce that first, and then come back with secondary, more focused discovery. Because, you know, I don’t think you should have to spend a million dollars to find electronic evidence if the case is two million. I think that’s where you go immediately for protection and do not allow yourself to be extorted.

I used to do human factors research. We often had questionnaires for subjects to complete or had materials subjects had to manipulate. Before we started the study, we tried the materials out on ourselves, graduate students, and teaching assistants. We used the testing to identify typos, confusing instructions, or a missing step. If we were trying to get funding for the study, we would do a small study, called a pilot study, which we used to show agencies as proof of concept.

Rolling discovery has the same concept. A smaller initial discovery request would test the search terms and criteria. It could be used to develop a realistic estimate of the eventual costs and could let attorneys begin their review earlier in the production process. It could verify an argument of some materials not being “reasonably accessible” as provided in the e-discovery amendments to the FRCP.

A question to my readers: What would have to change in order to implement a rolling discovery process? What are the obstacles to a rolling discovery procedure?

Judge Shira Scheindlin Opines on the Future of e-Discovery

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Wed, 27 May 2009 16:23:50 -0600

Shira A. Scheindlin is a United States District Court judge for the Southern District of New York and she presided over the pivotal e-discovery case Zubulake vs. UBS Warburg. Her rulings, known as Zubulake 1 through 5 set presidents for the practice of e-discovery. Ralph Losey is an attorney and frequent blogger on e-discovery.

Judge Scheindlin and Ralph recently participated in a podcast focusing on e-discovery education. Judge Scheindlin included several observations about the state of e-discovery; however, her comments on the state of, and future of, e-discovery are insightful. Speaking of the future of e-discovery, she said:

We used to say there’s e-discovery as if it was a subset of all discovery. But now there’s no other discovery. [Emphasis added.]

As an e-discovery expert, I’ve had countless attorneys and even some judges argue that e-discovery is one of the worst ideas any litigator every heard of—that e-discovery is not needed. I’ve heard attorneys tell me that they have agreed with opposing counsel that a particular case does not “need” e-discovery. [More about that in another posting!]

Since 90 % of new communication is said to be done electronically, I’m certain that she is correct in judging the pervasiveness of e-discovery in future litigation. I’m sending copies of her remarks to a bunch of the attorneys I know who share the attitude that they can ignore e-discovery if they wish.

I welcome questions and comments.

What's Up Doc?

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Thu, 11 Dec 2008 16:06:03 -0600

I came across a prognostication from Mary Mack, Corporate Technology Counsel at Fios. She offers 20 predictions re e-discovery for 2009. Some are funny and some are scary. I will be discussing several of them in future posts, but for now, they are well worth reading.

White collar defendants will be sunk by criminal e-discovery evidence rules created by case law involving drug dealers and child pornographers.
The financial crisis will increase the volume of e-discovery in bankruptcy courts and cause such a backlog with the magistrate judges that the use of special masters and mediators will double or triple.
In the wake of the financial crisis, law firms, IT departments and corporate legal departments will create a surfeit of top e-discovery talent as layoff by machete takes hold.
Credit-constrained vendors and service providers will not be able to scale on demand and will cut corners on redundancy and backup that will severely impact a client's case.
Software as a Service will start gaining inroads due to lack of credit and a reluctance to make capital purchases.
Laid-off financial services professionals will join review teams to troll through instant messaging.
A major government official, board member, officer or partner will be held personally responsible for e-discovery spoliation or obstruction.
Key cases will be used liberally: Lorraine will be used to challenge authenticity and admissibility; the Qualcomm CREDO will be issued; and Mancia, American Home Products and Qualcomm will be used to determine whether sanctions apply.
Family law will bring e-discovery to the state level, keeping solo forensics practitioners fully engaged.
A magistrate judge will get so frustrated he or she will write a sanctions opinion with the words "COOPERATION PROCLAMATION" in all caps.
There will be many more law schools offering e-discovery courses for credit.
e-Discovery providers will discover diversity and alternative billing.
There will be a dramatic increase in international e-discovery (e-disclosure) requirements due to the financial crisis, arbitration, class actions and competition law.
The number of practitioners sporting "Technology Counsel" titles will triple.
The federal government will create an e-discovery response team in reaction to the recent White House archiving and SEC email issues.
Web 2.0 will start to emerge as the next technical/legal challenge (dynamic, multi-company content).
e-Discovery attorneys and providers will do more case-level pro bono work, supplementing educational and rule-making activities.
SOX guidelines will be applied to the legal hold process.
Insurance providers will get involved earlier and more visibly in the e-discovery process.
Law firms will be sanctioned for not having their own e-discovery houses in order.

I'd certainly be interested in any predictions my readers have.

A Model E-discovery Order

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Tue, 11 Nov 2008 09:37:59 -0600

I’m always on the lookout for good templates for e-discovery documents and orders. In Star, Inc. v. QFA Royalties LLC, No. 07-cv-02223-WYD-CBS (D. Colo. Filed Oct. 10, 2007), Magistrate Judge Craig B. Shaffer issues an excellent e-discovery order. In it, he calls for an E-discovery Liaison.

To promote communication and cooperation between the parties, each party shall designate a single individual through whom all e-discovery requests and responses are made (“the e-discovery liaison”).

Judge Shaffer specifies that each E-discovery Liaison must be:

a. familiar with the party’s electronic systems and capabilities in order to explain these systems and answer relevant questions;

b. knowledgeable about the technical aspects of e-discovery, including electronic document storage, organization, and format issues;

c. prepared to participate in e-discovery dispute resolutions; and,

d. responsible for organizing the party’s e-discovery efforts to insure consistency and thoroughness and, generally, to facilitate the e-discovery process.

In the remainder of the order, he addresses many of the topics I have been discussing: searching strategy, timing, the format of the production (including metadata), document retention and preservation (AKA Litigation Hold), privilege, and costs.

Questions and comments are welcome. In particular, I’d like to know of any other model orders, letters, and other forms for e-discovery.

When Business and Personal ESI Meet

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Wed, 29 Oct 2008 15:00:57 -0600

Koosharem Corp. v. Spec Personnel, LLC, 2008 WL 4458864 (D.S.C. Sept. 29, 2008) has a well known “story line” but is very interesting in two respects.

Kenneth Fuston was a former employee of Koosharem who left to join SpecPersonnel. The plaintiff alleged that Fuston took confidential information, used it to hire some 20 of the plaintiff’s employees, and started a business in direct competition with the plaintiff.

The court ordered that the Fuston produce to produce emails between himself and any current or past employee of either company from both his home and work computer. He produced 1,936 pages of email, however

Plaintiffs noted several problems with defendants’ original production. Notably, all of the emails produced reflected the date compiled rather than the date received or sent, several emails allegedly retrieved from Trevor Doyle did not have Doyle listed as a sender or recipient, and many emails were missing their attachments. These irregularities, plaintiffs argued, called the authenticity of the documents into question. Plaintiffs also argued that documents were modified even after notice of litigation and that defendants made no document retention efforts after the lawsuit was filed. Specifically in support of production of home computers, plaintiffs argued that defendants’ new hires were not immediately provided with a company email account and thus conducted work from home computers and personal email accounts. Also, according to the plaintiffs, former employees emailed confidential information to their homes before going to work for defendants.

The court granted the second motion to compel and required forensic inspection of, not only the defendant’s home and work computers, but also those of the employees who left Koosharem and went to SpecPersonnal.

I’m frequently asked for samples of various documents needed in e-discovery, for example, a litigation hold letter. In issuing his order in this case, Judge William M. Catoe included a detailed, 20-step protocol for conducting the forensic analysis. He includes a time line as well. It is excellent and I recommend it to anyone looking for a template for an expert examination of ESI devices.

Secondly, note that the home computers of the plaintiff’s ex-employees’ were subjected to forensic analysis. More and more I find myself recommending that you keep your personal and business communication and data strictly separated. I understand the convenience of sending a personal email from a work machine in the middle of a busy day (or sending a business email from a personal account at night), but as I see more cases in which inspection of personal, home computers is compelled, I’m beginning to think the risks are too high.

Deleting Isn't Deleting

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Tue, 21 Oct 2008 12:46:01 -0600

Today’s blog is about deleting files and file slack space, a rich source of evidence for the forensic examiner—and a favorite topic of mine.

Most people have heard the expression “formatting a disk.” Formatting a drive divides up the space on the drive into pieces called sectors. Each sector has a numeric address. As an application needs disk space, the operating system assigns it enough sectors to fill its needs. To keep track of “who’s got what,” the operating system keeps a directory that is much like a phonebook. When a user needs to access some data, the operating system goes to the directory and looks up the data’s location.

But what happens when you delete a file that was stored in one or more of these sectors? Again, the operating system goes to the directory and finds the data’s location. However, rather than actually deleting (removing) the data, all the operating system does is place a special mark in the directory indicating the disk space is no longer needed and can be reassigned to other applications that need space. Nothing is done to the file itself. The file just remains on the drive

until the operating system reassigns the space to some application. It is much like a renter who is told by the landlord “I’m going to put the house on the marked, but you can stay until the new owner moves in.”

What happens when the operating system eventually reassigns the space? The first thing to know is that when disk space is needed, operating system assigns whole sectors at a time. That is, an application needing 2 ½ sectors would be assigned a full 3 sectors. When the information is

written to disk, the first 2 ½ sectors is over-written, leaving the last ½ sector unchanged. This unchanged space between the end of the file and the end of the sector is called slack space or simply slack.

What is in the slack space? Remember, when a file is deleted the operating system only marked the space as available to be reused. If a new file only takes up a portion of the sector, the old data “stays” there until it, too, is eventually overwritten. In the example of the file needing 2 ½ sectors, the last ½ sector contains whatever was stored there before the overwriting occurred.

Slack space has the potential to contain any information that was ever stored—or even viewed—on the computer. Photos, documents, credit card numbers, internet browser histories, you name it. The data in the slack space may be whole files or simply fragments of files (most often a mix of the two), but a forensic engineer can view, retrieve and catalog the evidence found in slack space.

Slack space is a good example of the difference between a user doing a "copy-and-paste" and a forensic examiner making a valid forensic image. Using "Copy" in our example, only the 2 ½ sectors would be copied, while a valid forensic image copies the entire 3 sectors.

The bottom line? 1, Don't assume that something is gone off your computer just because you can't see it! 2. And the data in slack space can be the very piece of evidence you need in a case.

The E-Discovery Maze and Other Musings

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Tue, 14 Oct 2008 14:39:51 -0600

I came across several interesting items this week so this post is going to be about a variety of things.

The Round Table Group, an expert services firm, approached me about writing an article for their newsletter. They wanted something different. I ended up writing about some actual scenarios from my practice. Although it was written for the Round Table Group’s clients, “Threading the E-Discovery Maze” is available publically.

IMS Services is another expert placement firm. Their latest newsletter, written by frequent blogger Robert Ambrogi, has an excellent compendium of e-discovery resources. He includes reading materials, blogs, and vendors.

Recently President Bush signed into law Rule 502, an addition to the rules of evidence. I found an excellent discussion of it at Law.com: “How Rule 502 Affects Lawyers and E-Discovery.”

My expert reports often contain drawings, diagrams, and screen shots. That means they get too large to email. There are a number of web sites that enable you to send large files securely through their website. Robin Good has a list of four such sites along with definitions and range of services. Typically, they work by uploading your material to their website and sending an email to the recipient with a link to download. Some allow you to store materials for a substantial period of time, making them great for collaboration or working away from the office. Obviously, if you have an ftp site (a technique for transferring files over the Internet), you do not need such services, but many small firms don't.

On July 1, a number of amendments to the rules of civil procedure went into effect in Ohio. According to the Ohio Supreme Court’s press release, key amendments include:

clarifying that issues related to electronically stored information are appropriate topics for resolution during pretrial conferences; clarifying that discovery of electronically stored information is permitted; amending to provide factors a judge should consider in determining sanctions when a party has destroyed potentially relevant electronically stored information; and specifying that a subpoena may be used to obtain electronically stored information from nonparties.

That reminded me that many states are making changes to their state version of the rules of civil procedure. Here is an updated list of the status of e-discovery rule changes in each state.

Ken Withers is Director of Judicial Education and Content for The Sedona Conference®, an Arizona-based non-profit law and policy think-tank which has been on the forefront of issues involving complex litigation, intellectual property and antitrust law. His thoughtful upcoming article for the San Diego Lawyer Magazine is titled “E-Discovery and the Combative Legal Culture: Finding A Way Out of Purgatory” and proposes a more collaborative relationship between opposing counsel. He gives examples of the explosion of e-discovery and discusses moving beyond the adversarial legal culture. He argues “cooperative discovery” is a means of controlling e-discovery costs. I’ve had some cases in which the opposing counsel cooperated with each other and some in which the definitely did not. And I can tell you from my perspective, cooperation is better.

I'd be interested to hear from attorneys what their experience is with cooperative discovery and whether they think it has a chance.

Breaking Up Is Hard To Do

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Tue, 30 Sep 2008 15:13:30 -0600

I had a client that was a small company. They were embroiled in some bitter litigation with an ex-partner who was demanding some Electronically Stored Information (ESI) as of the date of the dissolution of the company. Helping them respond to the discovery request taught them a lot about their handling of their ESI.

While discussing their situation, the owner marveled at how much he had learned in this process. He volunteered that he would now start counseling his own clients about their ESI quite differently! So I’m taking today’s blog as an opportunity to pass on to you some of my client’s new-found wisdom concerning ESI.

What should an organization do about ESI when an employee leaves? It’s natural to want to reuse the desktop and laptop computers. However, just passing them on to another employee is fraught with danger. There may be personal information, “remembered” passwords, and confidential information the new owner should not have access to. Worse still, there may be evidence of questionable web surfing activity.

One might think the easiest solution to this is to erase the hard drive and build a new one. However, I have seen a number of suits filed after an employee has left and employers no longer had valuable evidence that could have helped their defense. Here is my advice: Preserve the ESI on the ex-employee’s drives. Create an inventory of what is on the drives. A simple “print directory” program will work; there is no need for a full forensic image. Remove the drives and replace them with new ones. Store them in antistatic packaging and in a secure location for at least 3 years. This way, if you are ever faced with litigation, you have preserved the ESI and you know its location and content, as required by the e-discovery amendments.

Does this cost? Yes, the new drive and the work of installing and building the new system cost. But I think my client would assure that those costs are negligible “insurance” compared to the level of costs in having to try to reconstruct it years later!

Does the ex-employee have files stored on an office server? Email on a mail server? Are there backup tapes of the employee’s data, on their PC and/or on the servers? My advice concerning ESI on servers mirrors that for desktop and laptop computers. Inventory and archive a copy of all their server files. Delete any personal files to free up space on the server.

Organizations face other changes that impact ESI, such as migrating to a new server. Prior to taking such actions, the organization should make a complete backup of the current server and place in safe storage. This backup should not go into a regular backup rotation procedure (since such tapes may soon be reused), but kept separate.

Computer storage has become, relatively speaking, cheap. Given the e-discovery amendments’ emphasis on preservation of evidence and the increasing number of cases involving ESI, preserving ex-employees’ hard drives intact makes good economic and litigation sense.

Employee Blogs: The Risks and Rewards

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Tue, 23 Sep 2008 08:00:00 -0600

Law.com has an interesting article “Work Blogs Take Off, and So Do the Suits” that discusses various approaches to the issue of employee blogging. Since blogging is so very public, an employer has a vested interest in the images its employees portray in their blogs.

Initially, employers prohibited employee blogs. That turns out to be hard to do since one can blog anonymously. In many cases, employers are not only encouraging blogging, but providing the resources to do so. They do this for many reasons. Some view it as marketing and actually employ media firms to help get positive messages in the blogs. Others, perhaps facing layoffs or stock declines, do it to keep a finger on the pulse of employees. Some law firms encourage associates to blog as part of their recruiting effort.

The problems that employee blogging can create for an employer seem almost endless: libeling a competitor, harassment, negative images of the company, exposure of trade secret information, leaking confidential information, defamation, and attempts to influence stock prices. Furthermore, employees can claim that company actions, such as termination, are retaliation for material in their blog. And , as Law.com points out, the suits have begun:

Earlier this year, Cisco Systems and one of its lawyers, Richard Frenkel, were sued for defamation over an anonymous blog in which Frenkel allegedly accused two Texas attorneys of engaging in criminal conduct in a case against Cisco. Ward v. Cisco, No. 2007-2502 (Gregg Co., Texas, Dist. Ct.); Albritton v. Cisco, No. 2008-481-CCL2 (E.D. Texas).

In Georgia, a former Delta Air Lines flight attendant who claims she was fired after she posted photos of herself in uniform on her blog sued the airline for sexual discrimination. The case was stayed last year while the airline is in bankruptcy. Simonetti v. Delta Airlines Inc., No. 5-cv-2321 (N.D. Ga. 2005).

In Colorado, a group of Quiznos Master franchisees last year sued the company for wrongful termination, claiming they were retaliated against for posting on their blog the suicide letter of a former franchisee, who attributed his suicide to troubles at work. The case settled in December. Bray v. QFA Royalties, No. 06-cv-02528-JLK-CBS (D. Del.).

My point here is that blogging is a fact of life and businesses need to take steps to protect themselves from liability. That means they need a clear policy on employee blogging. At a minimum, they need what Cisco did as a result of the Ward case: require a disclaimer stating that the opinions are those of the blogger and not the employer.

Jeannie Wyatt of Schwabe, Williamson & Wyatt wrote an excellent guest editorial for the Puget Sound Business Journal on how businesses should discuss employee blogging. She offers four fundamentals in establishing blogging policy:

Instruct, don't restrict, employee bloggers. Keeping in mind that not all employee blogging may be restricted, use your blog policy to educate employees. The policy should clearly define permitted and prohibited content, as well as acceptable use of employer-owned technology. For example, employees should be prohibited from posting confidential company and trade secret information, as well as using unauthorized copyrighted material or trademarks. Finally, employees must be instructed not to criticize competitors, customers, or fellow employees.
Educate and follow through. Once a blogging policy is in place, train employees on the policy and enforce it. If the blogging policy prohibits employee use of employer-owned technology for anything other than job-related duties, do not turn a blind eye when it is violated. Down the road, it will be very difficult for the employer to establish that violation of the company's blogging policy is grounds for termination if it is not consistently enforced. As with all company policies, be sure to revisit the blogging policy from time to time. This way, it will always adequately express expectations and reflect current law.
Don't be too quick to terminate an employee for violating the blogging policy. It is important to consult with an attorney before terminating an employee for blogging. There are some instances where an employee's blog may be damaging to the reputation of the company but still be protected. This was the case in Konop v. Hawaiian Airlines, a case involving the blog of a Hawaiian Airlines pilot, Robert Konop. He claimed that he was wrongly disciplined based on the content of his blog. In his blog, Konop stated that the president of Hawaiian Airlines was suspected of fraud, incompetent, and "did his dirty work like the Nazis in World War II." Konop also criticized labor concessions sought by Hawaiian Airlines and the pilots union, and encouraged blog readers to consider alternate union representation. The Ninth Circuit Court of Appeals determined that the content of the blog represented protected union activity and lacked the actual malice needed to make it defamatory.
Lead by example. Many probably remember the trouble Whole Foods CEO John Mackey found himself in last summer when it was discovered that over the course of several years, he had submitted anonymous posts bad-mouthing competitor Wild Oats. Mackey did not reveal that he was disparaging Wild Oats at the same time the two progressive grocery brands were considering a merger. When Mackey was found out, the Federal Trade Commission stepped in and halted the merger until it could assess what damage Mackey's postings might have had on Wild Oats' financials. While the merger eventually closed, the Securities and Exchange Commission is still investigating Mackey's postings -- a development that is likely the subject of many postings.

I wonder how many of you have Internet posting policies.

Do they include blogging?

How many of your clients understand their risk in employee blogging?

Backup-But Verify

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Tue, 16 Sep 2008 09:37:32 -0600

Starting today, I am a judge in the Equivio Case Studies Contest. Equivio provides “near-duplicate” and “email thread” analysis on collections of electronic documents. Equivio users are invited to submit case studies of their use of Equivio. There are some lavish prizes; it is too bad the judges cannot win any of them. Submitting a case study is easy and short. The contest runs through September 30.

In the wake of hurricanes Gustav (in the picture) and Ike, my thoughts turned to backups, disaster recovery plans, and such. I evacuated for Gustav and still haven’t unpacked all the boxes of paper files-and yes, I do still have paper files. I love my web-based automated backup service for the electronic files; it even sent me email when it hadn’t heard from my desktop computer for 5 days during the evacuation!

I get frequent calls from folks whose computer has just crashed and they need help in getting their data back. I try to be gentle when I ask about backups. At least once a year the answer I get is “We have a backup. But it won’t load; the loader says it is corrupted.” A oversaw computer operations for more than 20 years and never tested my backup or disaster recovery system. Now I do!

The Duty to Preserve: Teaching Your Clients

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Tue, 09 Sep 2008 08:00:00 -0600

I came across a great blog on LegalLiteracy.com. This blog advertises “Building Bridges Between Business and Law” and talks about legal issues to the business community. In discussing a recent court decision in which a couple lost a suit filed by Recording Industry Association of America’s (RIAA) over their alleged distribution of copyrighted material, it provides an excellent discussion of the obligation to preserve evidence in civil cases vs. the right to non-incrimination in criminal cases.

The couple, after suit had been filed, reformatted their hard drive, thereby destroying evidence of whether or not they were using Kazaa (a file sharing program) to share copyrighted music. There was, as might be expected, quite a bit of commentary and criticism from the lay community when Judge Neil Wake ruled sanctions were warranted because of the spoliation.

I bring this article to your attention knowing that you fully understand the duty to preserve evidence. However, I thought that you may find it useful with clients who have never been informed (or who might need a reminder) of the necessity to follow litigation hold procedures.

For a litigation hold war story, check out Conrad Jacoby's blog on the outcome of Southern New England Telephone Company (“SNET”) v. Global NAPS, Inc., 2008 WL 2568567 in which defendants used software to overwrite relevant files in an attempt to thwart their discovery.

It Can Be Costly to Try the Paper Blizzard Approach to Production!

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Tue, 02 Sep 2008 13:42:41 -0600

White v. Graceland Coll. Ctr. for Prof’l Dev. & Lifelong Learning, Inc., 2008 WL 3271924 (D. Kan. Aug. 7, 2008) is a case I’ve been waiting for.

From a practitioners view point, I think the form in which ESI is produced is key in managing an e-discovery case. The form of ESI means the format and application that can process that format. Common forms are Microsoft Office documents such as Word (.doc) documents, Excel (.xls) spreadsheets, and PowerPoint (.ppt) presentations. Adobe’s Portable Document Format (.pdf) is also popular, in part because Adobe makes reader for the format free to the public. (It is interesting to note that the .pdf format contains substantially less internal metadata than Microsoft Word files do.) The Tagged Image File Format, .tiff, was created in an attempt to bring standardization to scanners, but is now widely seen in scanning, optical character recognition, and faxing applications.

In discussing the form of ESI production, we also speak of native format. By that we mean the form in which documents were originally created, edited, and stored. Thus the native format for Word documents are the .doc files, as opposed to the Acrobat .pdf format to which a Word document can be converted.

There are numerous tools and techniques available for investigating discovery production when it is in electronic, searchable forms. I know attorneys who say they prefer the traditional paper production, but when we start talking about terabytes of data, that is a warehouse full of paper documents!

The e-discovery amendments to the Federal Rules of Civil Procedure allow the requesting party to specify the form in which the ESI is to be produced. If the requester fails to do so, the producer is directed to disclose the forms it will use. If the parties cannot agree on the form, they may have to confer with the court. The rules allow the producer to transform the ESI into a “reasonably usable” alternate form, however, the amendments are clear that if the ESI is searchable by the producer, it must be searchable by the requester. The Committee Notes that accompany the amendments warn “[the] option to produce in a reasonably usable form does not mean that a responding party is free to convert [ESI] from the form in which it is ordinarily maintained to a different form that makes it more difficult or burdensome for the requesting party to use the information efficiently in the litigation," and that "[i]f the responding party ordinarily maintains the information it is producing in a way that makes it searchable by electronic means, the information should not be produced in a form that removes or significantly degrades this feature." [Emphasis added.]

In the White case, the plaintiff called for certain documents including emails and attachments. In producing emails and attachments, the defendant forwarded the emails to an administrative assistant who then converted them into Adobe .pdf format. Those documents were then printed and provided to the plaintiff in paper form.

The court ruled that the emails and attachments were not produced in a “reasonably usable” form and that the plaintiff was entitled to them in native form with their metadata intact. U.S. Magistrate Judge David Waxse went on to say

The Court notes that this discovery dispute is an example of one which the re-production of discovery could have been altogether avoided had the parties adequately conferred at their Fed. R. Civ. P. 26(f) conference regarding production of electronically stored information ("ESI"). While not all disputes regarding discovery of ESI can be prevented by early efforts by counsel to investigate and consider the possible forms discovery may be produced, many disputes could be managed and avoided altogether by discussing the issue before requests for production are served. Guideline 4(f) of the Guidelines of Discovery of Electronically Stored Information, available on the District of Kansas' website, specifically mentions that during the Fed. R. Civ. P. 26(f) conference, counsel should attempt to agree on the format and media to be used in the production of the ESI. [Emphasis added.]

While the point of this blog post is the importance of addressing the form of ESI production, I couldn’t help including the plug for adequate preparation for, and participation in, the Rules 26 conference.

Now You See It, Now You Don't: The "Hidden Partition" Trick

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Mon, 25 Aug 2008 16:44:44 -0600

The Fortiva Blog has an excellent discussion of 2006 Phoenix Four v Strategic Resources. In this case, which is also adding to the ongoing discussions on ethics, the court faulted defendant's counsel for not being proactive in searching for relevant ESI and called them “grossly negligent.”

The 2006 Phoenix Four Inc v. Strategic Resources Corp., decision indicates that counsel has a duty to be proactive regarding their client’s e-discovery. In this case, SRC Corp. had ceased operations and was evicted from its offices after the legal dispute had commenced. As a result, during discovery they claimed that there were no computers or electronic records to search.

Although counsel had discussed with the defendants the need to locate and gather paper and electronic documents, it was still found that counsel had “failed in its obligation to locate and timely produce the evidence stored in the server that the Defendants had taken with them.” The court held the attorney responsible for not asking about hidden partitions in his client’s servers, where it turns out, is where most of the evidence was later found.

According to the judge in this case, counsel's obligation is not confined to a request for documents; the duty is to be proactive and search for sources of information. The expectation was that counsel would undertake a more methodical survey of the Defendants’ sources of information, and not simply accept the defendants’ representation that, because it was no longer in operation, there were no computers or electronic collections to search.

The judges [sic] expectations did not end there, however. Counsel was also expected to have asked what had happened to the computers and whether information was stored on the server that the defendants had kept. And, in the absence of a satisfactory answer to that question, counsel would have been expected to direct that a technician examine the server. According to the court, this forensic effort is no different than questioning the information technology personnel of a live enterprise about how information is stored on the organization’s computer system, and is therefore considered part of counsel’s duty.

The court found counsel's "deficiencies here to constitute gross negligence" and awarded monetary sanctions against counsel and client. [Emphasis added.]

I’ve written before about the expanded role of trial attorneys under the e-discovery amendments, but this one surprised me. I don’t know any attorney who would think to ask whether there whether there were hidden partitions on a server.

I often recommended taking valid forensic images of computers and servers at the beginning of litigation, but not for that reason! However, a forensic investigation of the server would have disclosed the hidden partition in this case.

I use a standardized questionnaire/interview to map out client’s ESI and I’m tempted to add a question about hidden partitions to it. But anyone who would create a hidden partition to hide information probably wouldn’t tell me about it! But as e-discovery case law unfolds, it remains clear that trial counsel’s role is expanding and includes a responsibility to be proactive in dealing with their client’s ESI—both understanding it and finding it.

The Rule 26 "Meet and Confer": Take It Seriously

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Tue, 19 Aug 2008 08:08:08 -0600

The e-discovery amendments to the Federal Rules of Civil Procedure call for trial attorneys to be prepared to discuss any of their client’s Electronically Stored Information, ESI, that they expect to be a part of the case. Rules 26.a.1 requires that detailed information about the owners, often called custodians, of ESI be prepared forthe Rule 26 "Meet and Confer".

In addition to the list of custodians, the rules require a description, by “category and location” of all ESI in the possession, custody, or control of the custodians. This description is to be discussed at the Rule 26 conference.

Before these amendments, attorneys hoped to avoid e-discovery (and many still do!) and waited as long as they could to call me. I would get calls that something like this, “Discovery closes in two weeks and we think there are some electronic documents we need to get from the other side.” With the advent of the amendments, savvy attorneys know that they have to get started with e-discovery early. Judges are learning as well and don’t take it too well when counsel “blow off” the requirements of the Rule 26 “meet and confer.”

Mikron v Hurd, Mikron Industries Inc. v. Hurd Windows & Doors, Inc., 2008 WL 1805727 (W.D. Wash. Apr. 21, 2008), was a breach of contract case in which the defendants sought to shift the costs of e-discovery to the plaintiffs. Seattle District Court Judge Robert S. Lasnik ruled against the defendants on both procedural and substantive grounds. In stating the procedural grounds, Judge Lasnik wrote “the Court finds that defendants failed to discharge their meet and confer obligation in good faith, as required by Fed.R.Civ.P. 26(c). Accordingly, defendants' motion for protective order regarding ESI is DENIED for failure to comply with Rule 26(c).” [Emphasis added.]

What does this mean in real life? The e-discovery amendments are changing life for litigators, in more ways than one. The need to plan for e-discovery and prepare to have meaningful discussions of ESI with opposing counsel at the Rule 26 conference is real and here to stay.

My next few blogs will continue to discuss preparation for the Rule 26 conference. Questions about any of my topics are welcome as are reader comments.

But It's MY Computer

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Tue, 12 Aug 2008 08:00:00 -0600

Mark Fass has an excellent article on the divorce woes of Frank Moore. Ms. Moore filed for divorce citing cruel and inhuman treatment, including an extramarital affair. According to her attorney, she found "hundreds and hundreds of pages" of “really salacious instant message conversations” on a laptop computer Mr. Moore left in the trunk of a car. The parties disputed the ownership of the laptop: Ms. Moore saying it was used by the family and Mr. Moore saying it was issued by his employer for his use. Ms. Moore wanted to use these messages to support her claim. Mr. Moore argued that she had improperly seized his computer.

New York Supreme Court Justice Saralee Evans ruled that Ms. Moore had done nothing wrong and she cited the “filing cabinet” analogy put forth in Byrne v. Byrne, 168 Misc.2d 321. She went on to say “Ms. Moore's actions also did not constitute computer trespass or using a computer without authorization, as the files were on a readily accessible computer.” The judged ruled that the laptop was subject to discovery.

Note that the messages were in plain sight and discovered by a casual user not extracted by a forensic specialist. Users of text messaging and email often seem to feel invisible, as if no one will know what they have written. I have seen some truly extraordinary sentiments put in email and text messages. I suggest you don’t email or text anything you wouldn’t want your mother or boss to read or to see written in lights in Time Square!

Hold It! The Changing Role of the Trial Attorney and the Litigation Hold Letter

jhassell@electronicevidenceretrieval.com (Johnette Hassell, Ph.D.) — Sat, 02 Aug 2008 10:10:26 -0600

The ease at which data in the Information Age can be stored and deleted is both a blessing and a curse. We create new letters, new invoices, and new emails. We clean out old emails, buy new and bigger hard drives, and archive old reports. Our IT staff (if we have one) rotates backup tapes. We update databases, usually over-writing what was there before. We delete old files (or at least we should!) to make room for more. We defragment our drives to speed up our computer’s responsiveness. We use spam filters to delete, or at least hide, unwanted email and advertising.

But what if, in these day-to-day processes, we delete evidence relevant to litigation that is pending or that we should have known about?

The e-discovery amendments to the Federal Rules for Civil Procedure recognize the concept of reusing computer resources and include the concept of a Litigation Hold. As soon as a party knows of, or should have known of, pending litigation, it must stop all activities that could delete relevant information and preserve all potentially relevant electronically stored information (ESI).

As the trial attorney, how do you get the word out to your client to stop deleting potential evidence? The answer is a Litigation Hold Notification. The plaintiff attorney should issue such a notification to his/her client and to opposing counsel. Such notices should also spell out whether there are any requirements to preserve new ESI as well. In my next blog, I will discuss the need for clients to have a Litigation Hold Plan, but attorneys need to be prepared to ensure that ESI is preserved. In real life, that often means creating a preservation plan for the first time.

But the attorney’s responsibility doesn’t stop with just issuing the letter. As Judge Scheindlin told the UBS Warburg attorneys in the Laura Zubulake case, counsel has an affirmative responsibility to ensure that ESI is being preserved. This affirmative responsibility means repeatedly contacting the major players to remind them of the responsibilities and auditing their compliance. A single letter just won’t do it in the light of Judge Scheindlin’s ruling.

One solution is for the trial attorney to have an e-Discovery Liaison or e-Discovery Coordinator. This can be someone in the firm or an outside technical expert. Another approach is to have a team (I often call it a SWAT team) within the client’s organization. This team has the responsibility for creating, documenting, and monitoring the company’s ESI preservation policy.

One thing is clear, the role of the trial attorney is changing. I believe the attorney who knows the most about e-discovery, and about this changing role, will have an upper hand in litigation.