Electronic Data Records Law | How to Win E-Discovery

Metadata | Email Discovery Control

Logs and Audit Trails for Data Privacy and Internal Control

Filtering Attorney Work Product

Electronic records such as email serve as memorials of business actions and as evidence of legal responsibility.  But they are also vulnerable to abuse by privacy infringers or trade secret thieves.

One key to protecting e-records is metadata.  Meta-data comprises all the ancillary notes and audit trail surrounding a given record (a given e-mail) . . . the system logs showing when a record was created, who accessed it and when, how and when it was changed, to whom it was forwarded and possibly much more.  Metadata can illuminate an auditor or detective about the status, the history or the security of the record in question.

For records containing personally identifiable information (PII), good meta-data can be invaluable as an instrument of privacy.  Metadata can deter a snoop.  A busybody in a hospital  who wants to peek at a celebrity’s patient record will think twice before doing so if he knows the system will create an audit trail showing what he saw and when he saw it.  Further, in the investigation of a hacker incident, system logs can inform whether (for instance) the crook accessed credit card record X or social security number Y.  Armed with this information, an investigator can evaluate whether the hacker did or did not actually breach the security of record X or record Y.

Example: In the wake of a security breach at one of its hotels, Best Western International was able to evaluate the breach and narrow the universe of affected credit card numbers by inspecting specific logs on the computer in question. 

Accordingly, a well-crafted e-mail archival system will maintain extensive meta-data about each electronic mail record.  The M+Archive product for instance keeps tabs on who viewed a record, when it was printed and so on. 

Be all that as it may, sometimes system logs are undesirable.  For example, when an attorney turns over records in an eDiscovery request, she normally should not turn over metadata that constitutes her own work product.  As she reviews individual emails in an archival system, the system may be keeping meta-records showing which records she accessed, when she accessed them and how often.  Those records are probably her attorney work product, which normally is excluded from disclosure in the discovery phase of litigation.  She should normally screen out any such work product when she turns over required emails to another party.

I spoke to Ranjit Sarai, e-discovery expert at Messaging Architects. “The management of meta-data in an enterprise archival system can be tricky,” he said. “Normally you want the system to be making meta records for security and accountability purposes.  But sometimes ediscovery lawyers want to turn this logging feature off, or they want to filter out their work product metadata before delivering records to an adversary.  We have experience helping an attorney understand the options and craft a solution for her particular case.”

–Ben Wright

Mr. Wright often serves as a public speaker on the law of electronic records and investigations.

Native Format Electronically Stored Information?

Collection, Production Tactics | Ordinarily Maintained or Reasonably Usable Form

In eDiscovery, ESI can be produced in many forms.  For both the requesting party and the producing party, the form chosen can impact strategic issues like cost, search-ability and ease of manipulation.  Form of production can be a contentious issue between litigants.

California’s new electronic discovery rules (Assembly Bill 5 - amendments to the California Rules of Civil Procedure) set a framework for negotiating the form of ESI production.  

Amended Section 2031.030(a)(2) of the Code of Civil Procedure provides:  “A party demanding inspection, copying, testing, or sampling of electronically stored information may specify the form or forms in which each type of electronically stored information is to be produced.”  [Notice the words "testing" and "sampling". 

 They are a nod to the future of eDiscovery, where one-by-one review of records is impractical, so statistical methods are used instead.] 

Further, amended Section 2031.280(d) provides:  “Unless the parties otherwise agree or the court otherwise orders, the following shall apply: (1)  If a demand for production does not specify a form or forms for producing a type of electronically stored information, the responding party shall produce the information in the form or forms in which it is ordinarily maintained or in a form that is reasonably usable.”

Like the FRCP, this framework leaves lots of room for negotiation and disagreement.  

“When collecting a unit of ESI (such as an e-mail) within an organization, we might find it in more than one format,” says Greg Smith, eDiscovery specialist at Messaging Architects.  “It might be in network backup.  It might be an e-mail management system like Groupwise.  It might be in an archival system like M+Archive.  It might be in other formats and locations too.”

Leading courts like Williams v. Sprint/United have spoken of production of ESI in its “native format.” For courts like Williams, the rough idea is that a unit of ESI should come with its original meta data and structure, so as to enable better insight into what the ESI was and what it meant.  

According to Greg Smith, “The concept of native format might mean different things for different circumstances in an enterprise information system.  For example, the structure and metadata applicable to a given e-mail might be different depending on whether the email is collected from an electronic mail system like Microsoft’s Exchange or from an archive appliance like Symantec’s Enterprise Vault.  It’s my job to help trial counsel understand the different possibilities, evaluate options and then document/explain the format decisions and actions that are executed in ESI collection and production.”

–Benjamin Wright

Mr. Wright is an affiliate of messagingarchitects.com, experts in eDiscovery services.   Here is an ARMA podcast describing Messaging Architects' work in e-mail archiving, including its workshop for development of an email records policy in an enterprise.

EDD Search and Analysis

Advanced ESI Culling, Clustering and Concept Review

E-discovery search and analysis engines are proliferating.   Enhanced keyword search methods (such as fuzzy search that looks for forensic gems like misspelled keywords) are coming to recognize more nuances.  Other analytical technologies are emerging as well, and they are influencing the outcomes of audits, lawsuits and internal investigations.

Take the Lehman Brothers bankruptcy, which oversees 3.2 billion e-mail and instant message records. To glean value from this ocean of records, investigators and auditors need more than just conventional keyword search.  New methods include visual mapping of users, dates, transactions and relationships and searches for concepts like compensation rather than just words like “salary” or “bonus.” Telis Demos, "Smoking-Gun Search Engines Find Profit," Fortune, March 2, 2009, p. 24.

Savvy inspection of eDiscovery records can uncover hidden inference and meaning, and dramatically change the result of lawsuits and investigations.  For instance, the US Department of Justice indicted David Stockman, ex-CEO of Collins & Aikman, for alleged fraud, supporting its indictment with extensive factual references and analysis – including the report of an internal investigation conducted by a prestigious law firm on behalf of the company’s board of directors.  For Stockman, the outlook was grim; at a minimum he faced a grueling criminal trial.  

However, during the pre-trial litigation, Stockman’s defense team assiduously assembled a 15-million  (!) document database of e-mail and other records from the company.  From this huge corpus, the team drew out unexpected insights about how business actually transpired at the company and about how supplier rebates (a key topic) worked in the industry.  The insights suggested that neither DoJ nor the internal investigator really understood the case.  These insights enabled the defense to construct a radically different interpretation of Stockman’s tenure as CEO and, eventually, to persuade the DoJ that it had made a mistake.  In an unusual about-face, DoJ withdrew criminal charges against Stockman before the trial began.

In other words, ESI data-mining is the reason Stockman walks a free man today.

According to Ranjit Sarai, eDiscovery specialist at Messaging Architects, litigants like Stockman can achieve courtroom advantage by exposing e-mail databases to advanced or experimental search techniques. “When an investigator is trying to understand a multitude of e-mail records, scrub them for privacy compliance or cull out privileged communications, keyword-oriented searches can be very tedious and can mask the big picture.  Alternative analytical tools can often yield better results.  For example, they can visually map things like time relationships, which can highlight suspicious activities or contradict an adversary’s interpretation of what happened in the case.”

To assemble such as database, a litigant like Stockman would need to access to the records in a machine-processable format, such as XML.  Sometimes courts roughly refer to such as format as "native format," but eDiscovery formatting is a complex topic.

–Benjamin Wright

Mr. Wright is an advisor to messagingarchitects.com, experts in e-discovery services, training and software.   Here is an ARMA podcast describing Messaging Architects' work in e-mail archiving, including its workshop for development of an email records policy in an enterprise.

Email Recovery | Network Back-up

E-mail Database Search and Forensics

Archival | What is a Subpoena?

As litigation and other requests for e-mail from backup tapes grow more frequent, an enterprise may be wise to restore, consolidate and archive all of its old e-mail held in backup.

Historically organizations did not think of e-mail as an asset worthy of preservation.  They did not archive it, though copies would end up in network backup.  

But experience has taught that e-mail evidence can be critical to defense of a lawsuit or enforcement of a contract.  Alternatively its disclosure might be required under a subpoena (see definition below), a court order, an administrative summons, an IRS tax audit or a freedom of information act request (FOIA).  Further, e-mail might be needed in an investigation (led internally or by outside criminal prosecutors) of a bribe, a kickback, an overcharge, tax evasion or a embezzlement of money, or it might be needed for an audit of alleged misallocation of funds. 

Archival

Greg Smith of Messaging Architects observes that repeated requests for e-mails from backup can warrant a change of thinking in the IT department. “While most backup software deals very efficiently with individual electronic records, it cannot provide the same level of access to email. This is because enterprise email exists as a record within a database (such as for Groupwise or Microsoft Exchange).  The database must be restored in its entirety and searched in its entirety in order to ascertain the contents of the database. With database sizes exceeding 100GB and scores if not hundreds of tapes, the cost to restore and search the tapes can be considerable. Recovering records for selective users and dates may satisfy the current discovery requirement, but with each successive lawsuit, or changes in discovery parameters for an existing lawsuit, restoration from tape can become a recurring financial liability.”

Greg continues, “The practical solution is to remove the information from tape permanently and place it in an electronic records format where information can be retained and managed as individual records and not conglomerates of information.  In such a format, individual email records can be sorted by user or date.”

Restored records can be archived in an open (non-proprietary) format, such as XML, which enables searchers to tap an ever-expanding array of search and forensics tools.  XML may or may not qualify as "native format" as that term is sometimes used in court decisions, though XML may be a more useful format than whatever the native format was.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, experts in e-discovery and consultants in e-mail investigations.

Post Script  What is a subpoena?  A subpoena is a legal demand that someone turn over information or evidence. Commonly the laws of litigation enable a party to subpoena other parties for records or other evidence. Sometimes the law also invests the power to subpoena in an official who conducts investigations, such as a government auditor or an inspector general. If a party abuses the power to subpoena, by demanding irrelevant records or by issuing a demand with no regard for the cost of compliance, a court may sanction the issuer of the subpoena.

US Interior Dept. Destroys Email

Printing of Electronic Mail as Federal Government Record Retention?

The Bureau of Indian Affairs (US Department of the Interior) suffered embarrassment in court for the deletion of financial e-mails by former Assistant Secretary – Indian Affairs, Neal McCaleb.  The e-mails contained important information about money the bureau was collecting and holding in trust for Indian tribes. McCaleb deleted the e-mails because his IT department allocated him too little hard disk space. Under department policy, he was expected to print important e-mails onto paper before he deleted them, but because of confusion about who was authorized and directed to do the printing, no one actually performed the tedious and unwanted task.

Officials like Mr. McCaleb don't naturally embrace clerical duties like printing of e-mails.

The case demonstrates  

1. how legally important e-mail records can be,

2. the folly of an IT department trying to save a couple of bucks by being stingy with hard disk space, and

3. how dangerous it is today to view printing as a way to preserve email (or text messages) need for purposes of internal control or funds management.

See Jean Pagano, “Special Master reports findings on deleted e-mails: Department of Interior described as ‘chaotic’,” Native American Press/Ojibwe News, January 31, 2003. This matter was part of the protracted “Cobell” litigation brought by Native Americans against the Department of the Interior. Cobell v. Norton, et al. Case No. 1:96CV01285 (D.D.C.).

–Benjamin Wright