Electronic Data Records Law | How to Win E-Discovery

Native Format Electronically Stored Information?

Collection, Production Tactics | Ordinarily Maintained or Reasonably Usable Form

In eDiscovery, ESI can be produced in many forms.  For both the requesting party and the producing party, the form chosen can impact strategic issues like cost, search-ability and ease of manipulation.  Form of production can be a contentious issue between litigants.

California’s new electronic discovery rules (Assembly Bill 5 - amendments to the California Rules of Civil Procedure) set a framework for negotiating the form of ESI production.  

Amended Section 2031.030(a)(2) of the Code of Civil Procedure provides:  “A party demanding inspection, copying, testing, or sampling of electronically stored information may specify the form or forms in which each type of electronically stored information is to be produced.”  [Notice the words "testing" and "sampling". 

 They are a nod to the future of eDiscovery, where one-by-one review of records is impractical, so statistical methods are used instead.] 

Further, amended Section 2031.280(d) provides:  “Unless the parties otherwise agree or the court otherwise orders, the following shall apply: (1)  If a demand for production does not specify a form or forms for producing a type of electronically stored information, the responding party shall produce the information in the form or forms in which it is ordinarily maintained or in a form that is reasonably usable.”

Like the FRCP, this framework leaves lots of room for negotiation and disagreement.  

“When collecting a unit of ESI (such as an e-mail) within an organization, we might find it in more than one format,” says Greg Smith, eDiscovery specialist at Messaging Architects.  “It might be in network backup.  It might be an e-mail management system like Groupwise.  It might be in an archival system like M+Archive.  It might be in other formats and locations too.”

Leading courts like Williams v. Sprint/United have spoken of production of ESI in its “native format.” For courts like Williams, the rough idea is that a unit of ESI should come with its original meta data and structure, so as to enable better insight into what the ESI was and what it meant.  

According to Greg Smith, “The concept of native format might mean different things for different circumstances in an enterprise information system.  For example, the structure and metadata applicable to a given e-mail might be different depending on whether the email is collected from an electronic mail system like Microsoft’s Exchange or from an archive appliance like Symantec’s Enterprise Vault.  It’s my job to help trial counsel understand the different possibilities, evaluate options and then document/explain the format decisions and actions that are executed in ESI collection and production.”

–Benjamin Wright

Mr. Wright is an affiliate of messagingarchitects.com, experts in eDiscovery services.   Here is an ARMA podcast describing Messaging Architects' work in e-mail archiving, including its workshop for development of an email records policy in an enterprise.

EDD Search and Analysis

Advanced ESI Culling, Clustering and Concept Review

E-discovery search and analysis engines are proliferating.   Enhanced keyword search methods (such as fuzzy search that looks for forensic gems like misspelled keywords) are coming to recognize more nuances.  Other analytical technologies are emerging as well, and they are influencing the outcomes of audits, lawsuits and internal investigations.

Take the Lehman Brothers bankruptcy, which oversees 3.2 billion e-mail and instant message records. To glean value from this ocean of records, investigators and auditors need more than just conventional keyword search.  New methods include visual mapping of users, dates, transactions and relationships and searches for concepts like compensation rather than just words like “salary” or “bonus.” Telis Demos, "Smoking-Gun Search Engines Find Profit," Fortune, March 2, 2009, p. 24.

Savvy inspection of eDiscovery records can uncover hidden inference and meaning, and dramatically change the result of lawsuits and investigations.  For instance, the US Department of Justice indicted David Stockman, ex-CEO of Collins & Aikman, for alleged fraud, supporting its indictment with extensive factual references and analysis – including the report of an internal investigation conducted by a prestigious law firm on behalf of the company’s board of directors.  For Stockman, the outlook was grim; at a minimum he faced a grueling criminal trial.  

However, during the pre-trial litigation, Stockman’s defense team assiduously assembled a 15-million  (!) document database of e-mail and other records from the company.  From this huge corpus, the team drew out unexpected insights about how business actually transpired at the company and about how supplier rebates (a key topic) worked in the industry.  The insights suggested that neither DoJ nor the internal investigator really understood the case.  These insights enabled the defense to construct a radically different interpretation of Stockman’s tenure as CEO and, eventually, to persuade the DoJ that it had made a mistake.  In an unusual about-face, DoJ withdrew criminal charges against Stockman before the trial began.

In other words, ESI data-mining is the reason Stockman walks a free man today.

According to Ranjit Sarai, eDiscovery specialist at Messaging Architects, litigants like Stockman can achieve courtroom advantage by exposing e-mail databases to advanced or experimental search techniques. “When an investigator is trying to understand a multitude of e-mail records, scrub them for privacy compliance or cull out privileged communications, keyword-oriented searches can be very tedious and can mask the big picture.  Alternative analytical tools can often yield better results.  For example, they can visually map things like time relationships, which can highlight suspicious activities or contradict an adversary’s interpretation of what happened in the case.”

To assemble such as database, a litigant like Stockman would need to access to the records in a machine-processable format, such as XML.  Sometimes courts roughly refer to such as format as "native format," but eDiscovery formatting is a complex topic.

–Benjamin Wright

Mr. Wright is an advisor to messagingarchitects.com, experts in e-discovery services, training and software.   Here is an ARMA podcast describing Messaging Architects' work in e-mail archiving, including its workshop for development of an email records policy in an enterprise.

EMail | Non-Disclosure Agreement Case

E-records Impeach Opponent's E-Discovery

Burst.com’s electronic mail records served the company well in its trade secret lawsuit against Microsoft.  

Wrongful Withholding of Records?

Burst had held conversations with Microsoft in which it confidentially (under non-disclosure agreement) revealed trade secrets (nonpublic ideas of an inventor) about Burst's streaming media technology.  Burst later alleged that Microsoft chose to use these trade secrets without Burst’s consent, and without compensation to Burst.  

So Burst sued, claiming misappropriation of trade secrets and breach of contract.  During the discovery phase of the lawsuit, Microsoft was required to reveal all of its e-mail records on the topic, and Microsoft did turn over a large number of e-mails regarding its development and use of streaming technology. 

But a question arose in court whether Microsoft complied fully with the discovery requirements.  Burst contended that Microsoft had wrongfully withheld some e-records or destroyed them.  To support its contention, Burst produced numerous of its own email records showing particular exchanges between Burst and Microsoft, where Microsoft had produced no corresponding records on its end. Stefanie Olsen, “Microsoft ordered to uncover old e-mails,” September 10, 2003.  

Microsoft's Mismanagement of Records Played to Adversary's Advantage

This mismatch in email records led the court to suspect Microsoft was being evasive.  The court ordered Microsoft to sift through backup tapes in search for missing e-records (looking for electronically stored information (ESI) in network backup is a tedious and expensive process!).  The court's suspicion, coupled with the order to look through backup, cast Microsoft at a strategic disadvantage, and contributed to company’s decision to settle the case and pay Burst $60 million. Tim Siglin, “Microsoft Settles Burst.com Lawsuit,” March 14, 2005.

Had Burst not retained its e-mail records, it would not have had them when needed to pursue this lawsuit in protection of its intellectual property (IP).

--Benjamin Wright

Mr. Wright teaches the law of data security and investigations at the SANS Institute.

E-mail Litigation Hold in Local Government

Costly E-Discovery in Backup Tapes

Commonly a public agency destroys e-mail relatively quickly, while expecting individual administrators and professionals to keep needed records as a special exception.  Then, when hit with a lawsuit, the agency assumes individual employees can be told to save e-mails that are relevant to the lawsuit.

But this approach is not faring well in court, in good part because employees are not talented at keeping records.  The approach can lead to sanctions in court, or a requirement that the agency undertake the expensive task of digging through network backup tapes.  

Consider for instance the plight of the Washington Metro Transit Authority (District of Columbia region).