Electronic Data Records Law | How to Win E-Discovery

Electronic Mail Message Forged

Electronic Evidence | Forensics and Authentication in Police Investigation

For responsible parties like corporations and government agencies, a reason to retain all their e-mail, text and instant message records is to refute forgeries of e-records.  Thorough email archives (including each attachment) provide forensic evidence to invalidate false claims.

Just ask Australia’s prime minister, Kevin Rudd.  His political opponents tried to embarrass him with an electronic mail record purportedly from his senior advisor Andrew Charlton.  The e-mail appeared to show corruption; it appeared to show Rudd’s government conferring a business advantage to Rudd’s friend John Grant.

But fortunately for the government, it retained its own e-mail records for the time in question.  An investigation revealed that the scandalous e-mail was a forgery!

The investigation proceeded in two steps. First it examined the alleged sender’s digital records.  “Searches by the Department of Prime Minister and Cabinet and Treasury of Dr Charlton's computer and the system of the public service had found nothing.  ‘There have been exhaustive searches conducted on Dr Charlton's computer email system and no such correspondence can be found,’ Mr Rudd said.”

Second, the Australian Federal Police (equivalent to FBI) conducted a forensic analysis of two computers used by the purported receiver of the e-mail.  "Preliminary results of those forensic examinations indicate that the email referred to at the centre of this investigation has been created by a person or persons other than the purported author of the email," said the AFP.

This revelation of course played to the Prime Minister’s distinct advantage.  He could show that his adversaries had based their attack on misrepresented facts.

The Strategy Lesson:  Unless you are a criminal, your e-records are your friend.  Had the government been destroying its records quickly, it would not have been so capable of exposing this fraud.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader on ESI investigations.

Case | E-Discovery Legal Hold

County Underestimates Value of Its Own E-mail Records

Some public agencies don't realize that in litigation their own good records can be their best defense.

Commonly a defendant in a lawsuit is reluctant to search through its e-mails – and incredulous that a court would force it to dig deep for them. In Toussie v. County of Suffolk, 2007 WL 4565160 (E.D.N.Y. Dec. 21, 2007), a New York county made the process of e-discovery excessively difficult and expensive for itself.

Plaintiffs sued the county for allegedly barring them from participation in a real estate auction to which they were entitled. After the lawsuit started, the county did a poor job of preserving its e-mail records. Then, when the plaintiffs demanded – in the “discovery” phase of the lawsuit -- that the county search for and disclose relevant e-mail, the county faltered.  It initially turned over only two e-mail records.

The plaintiffs complained repeatedly to the judge. The judge insisted that the county search for and turn over e-mail records.

Eventually, the county complied.  It hired an outside e-discovery consultant, who restored 417 backup tapes, and found 2,403 pages of relevant emails and attachments.  The restoration and searching of backup tapes is very expensive.

Despite this expenditure by the county, the plaintiffs were still able to show that the county had lost some relevant e-mails.  The court therefore ordered the county to pay the legal costs plaintiffs incurred to force the county to conduct a thorough search for e-mail records.  The court said the county should have implemented a litigation hold from the start of the lawsuit, but it didn't.

Notably, the e-mails that the county did recover tended to support the county's side of the case.

Analysis:  The county would have been better served if, as a matter of policy before the dispute started, it had competently archived all of the e-mail of important employees.  A good archiving system would have allowed the county to possess and easily find the relevant e-mails – including those that supported the county's position. It would have obviated the need to restore backup tapes.

Further, the archival of plentiful records would have avoided the complaint that the county had failed to implement a proper litigation hold.  And that would have prevented the county having to reimburse the plaintiffs' attorneys fees.

–Ben Wright

E-Message Archives | EDiscovery Strategy

Electronic Discovery Reference Model (EDRM) XML Schema

Relevant Records vs Irrelevant Records

In a lawsuit, e-discovery forces the party holding records that are relevant to the lawsuit (the disclosing party) to reveal them to the other party (the receiving party).  The purpose of e-discovery is solely to disclose relevant records. It is not to disclose more information than is required, and it is not to enable a “fishing expedition” by the receiving party through the records of the disclosing party. [In lawyers’ parlance a “fishing expedition” is an unrestrained trawl through an opponent’s records in search of unspecified wrongdoing, such as bribes, kickbacks or misallocation of funds.]

For the disclosing party, over-disclosure is bad.  Inevitably the volumes of data disclosed in e-discovery will contain more than is required.  That excess data opens the opportunity for fishing by the receiving party, the adversary.

For example, imagine a lawsuit over a contract.  In e-discovery Party A discloses e-mails pertaining to the contract.  But receiving Party B may accidentally discern from the e-mails (and the attachments and meta-data associated with them) evidence of a different topic, such as apparent unauthorized use by Party A of trademarks owned by Party B.  The trademark topic was not the purpose of the e-discovery (it’s not the subject of the lawsuit), and Party A did not need to disclose evidence on that topic.

Accordingly, disclosing Party A aims to control e-discovery and keep it within rules.  Party A can better achieve its goal if disclosed data are broken into little units and Party A precisely explains each of the units.

The division of data into precisely-explained units is one potential outcome of the Electronic Discovery Reference Model (EDRM). EDRM proposes to set a uniform framework for e-discovery and standards for the exchange of e-discovery data.  It promises to enable tools for computer-aided review, sampling, snipping, tagging, and explaining of units of disclosed data.

One EDRM project is crafting an XML Interchange Format.  XML is all about tagging data elements so they can be processed (often automatically) and understood.  EDRM’s XML Format provides for tags like “Description” and “CustomDocumentInfo” to be associated with each unit of disclosed data, such as an e-mail message.  These tags can contain free-form text.  These text tags are an opportunity for the disclosing party to annotate, explain and interpret the disclosure.  A text tag can, for example, show why a record (i.e., e-mail X) is being disclosed, what it means and what its context is.  It might explain that e-mail X is a direct part of the employee discussion about the terms of the contract that is the subject of the lawsuit.  Such a tag can subtly help the disclosing party restrain the purpose for which the record is used.

Further, a savvy disclosing Party A could use these tags to help explain why record X is disclosed but not record Y.  In other words, in the tags Party A might make the case for why e-mail X is disclosed (it directly relates to the contract in question), but why the 10 replies to e-mail X are not disclosed (they don’t relate to the contract).  Party A could put in the tags explanations about the search criteria (search methogology or algorithm) it used to find and produce e-mail X, while not finding or producing the 10 replies.  For example, Party A might explain it searched for records containing the concept "mineral contract," but not for all the records touching on a record containing that concept.

Hence, a disclosing party could possess more tactical options if its archives (such as e-mail and instant messages) were in a system that is compatible with EDRM’s XML Format.  (I'll call these tactical options an "edge," but that's not to imply the disclosing party is getting anything unfair.)  When the disclosing party is required to turn over e-mails in e-discovery, it can use text tags to tell its side of the story with respect to each one of those e-mails.*

This edge grows more important as more of the records subject to e-discovery become small e-mails and instant messages (IM, Twitter, iPhone, BlackBerry or cell phone text), rather than larger “documents” like letters and memos.  The reason is that, roughly speaking, courts require that if part of a record must be disclosed, then the disclosing party must turn over the whole record, even if it contains other, irrelevant material.

–Benjamin Wright

Update: The disclosing party might use an XML tag to place a warning on particular units of data. For example, the tag might warn that a particular email contains sensitive personally-identifiable information, which must be kept secure and the review of which must be limited to only necessary personnel. See the story of a medical malpractice defense law firm that lost patient records connected with a lawsuit, thus causing the patients to be notified that their data had suffered a breach.

Related Article: How to Document Instant Messages