Electronic Data Records Law | How to Win E-Discovery

Network Backup as E-mail Repository

Expensive E-Discovery (EDD) for an Enterprise

IT network backup can store many e-mails that are relevant and discoverable in a lawsuit.  But to search for e-mail by way of network backup is very inefficient.  

Sometimes, courts do order organizations to go into backup to retrieve computer records - to the vexation of the IT department. The risk that such an order might someday come is one reason for an enterprise to keep plentiful e-mail archives in a system specifically designed for storage and search of large volumes of records.

This risk applies to lawsuits both in the US and elsewhere. A case in point is the Australian decision BT (Australasia) v State of New South Wales & Telstra, [1998] FCA 363 (9 April 1998). 

In a commercial dispute between telecommunications carriers, the plaintiff demanded e-mail records from defendant Telstra. Telstra’s records of many of these e-mails were available only in network backup. The court ordered Telstra to search backup tapes, at considerable expense, to retrieve certain e-mails.

Telstra did not have to design its e-mail system so that backup was the archive.  Had the company, as a matter of routine policy, treated its e-mails as durable assets of the company – preserved in an archival appliance that allows for easy records search and management – it would not have been forced to rummage through backup for e-discovery.  

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, leader in email record retention, recovery and investigation.  See free, recorded webinar.

Email Deleted | England

Restoring Network Backup Tapes

A landmark case in England teaches that lessons in the US on e-mail retention and destruction policy are equally applicable in the United Kingdom. The lessons: 1. Early deletion of e-mail can cost a company later in litigation. 2. The law is giving all organizations incentive to generously retain e-mail in a centralized archival system.  (This incentive would even extend to webmail that employees use for business purposes.)

Digicel et al v. Cable & Wireless, et al [2008] EWHC 2522 (Ch) was a commercial dispute between telecommunications providers in the Caribbean (including St Lucia, St Vincent and the Grenadines, Grenada, Barbados, The Cayman Islands, Trinidad and Tobago, and The Turks and Caicos Islands).

Digicel claimed C&W unlawfully failed to connect Digicel to C&W’s network. Digicel sued in English court. Under the Civil Procedure Rules (applicable in England and Wales), Digicel sought from C&W “disclosure”of e-mail of seven former employees. (In the US we use the word “discovery” rather than disclosure.)

Said the British court: "The 7 individuals are former employees of a [C&W] Defendant company. The e-mail accounts of those former employees were deleted [purged] from the relevant server following the ending of their employment. However, it may be the case that some or all of the individual's e-mail accounts exist on the back-up tapes."

The court's logic illuminates why I argue against the practice of destroying employee e-mail upon termination of employment (aka dismissal). E-mail records of ex-employees are assets of the employer that the employer is often wise to keep.  

To search for particular e-mails by way of corporate backup tapes is expensive and tedious. C&W argued that this effort was not legally justified.

The UK court evaluated whether to order searching (restoration) of C&W’s backup tapes. For guidance, it looked to experience in other countries, such as the law of e-discovery in the US. 

The court decided to order extensive restoration of back-up tapes.  

The court noted that some foreign (such as US) judicial decisions have shifted some of the cost of e-disclosure (e-discovery) to the requesting party (Digicel). The court said it would postpone until later the question whether Digicel should bear any of the costs.

The court’s approach was remarkably consistent with the US approach (citing US authorities), where courts have taught us more about e-discovery and electronically stored information (ESI). 

–Benjamin Wright

Mr. Wright is an consultant to messagingarchitects.com, leader in sound process for eDisclosure and Groupwise archival.  Mr. Wright and Messaging Architects have teamed to educate professionals about eDiscovery.   Mr. Wright is also a senior instructor at the SANS Institute, where he teaches the modern law of internal investigations and enterprise data policies.

EMail Evidence | Criminal Defense

Should Corporate Executives Prefer Early Deletion of E-Records?

Some executives fear that e-mail will come back to haunt them, so they minimize their use of it.  And they want corporate e-mail destroyed quickly.  

But electronic records came to the rescue of David Stockman, former CEO of bankrupt auto parts maker Collins & Aikman.  Stockman and other executives were indicted by prosecutors for alleged lying about the company’s financial condition.  Prosecutors apparently based the charges on an investigation by an outside law firm working on behalf the company’s board of directors.  Stockman and his co-defendants maintained that they were victims of a rush to justice.  They said the law firm and the prosecutors failed to examine all the complex evidence carefully. 

They and the government undertook to assemble a database containing 10 million company records, including (no doubt) copious e-mail records.  Key topics in the case included C&A's:

*  day-to-day internal communications among executives and employees regarding the accounting and invoicing for particular transactions, and 

* day-to-day communications with suppliers -- involving innumerable, detailed, nitty-gritty negotiations and documentation over topics like transaction-by-transaction rebates.

From this massive database, the defendants drew evidence, bit-by-tiny-bit, to tell their side of the story.   In a database of this size, the ability to find the right evidence depends much on the careful selection of search methodology and search algorithms.  Sometimes the only effective way to comprehend what is in the database is to engage a selective sampling of records.

Eventually the defense prevailed.  In an unusual move, the prosecutors withdrew the charges, stating that they had come to reassess the evidence in the case.  

In other words, the executives were fortunate that the company retained so many records like e-mail.  E-archives exonerated the defendants.

In a putative corporate scandal, the relevant e-mail records can be maddeningly plentiful.  A large number of computer-based records is unsurprising in a modern white collar crime investigation or police raid of corporate offices.

In this case, the defendants' legal team patiently mined the company’s email (and other records) to build a convincing case that prosecution was unwarranted.

As the quantity of records in a case swells like this, the ability of parties to review records one-by-one declines.  Increasingly the law will favor those who can draw on statistical methods (or linguistic analysis) to tease out the evidence that tells their side of the case.

(David Stockman is most famous as the Ronald Reagan’s budget director in the 1980s.)

–-Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in enterprise governance and records management.  He also delivers training in cyber defense law at the SANS Institute.

Case | E-Discovery Legal Hold

County Underestimates Value of Its Own E-mail Records

Some public agencies don't realize that in litigation their own good records can be their best defense.

Commonly a defendant in a lawsuit is reluctant to search through its e-mails – and incredulous that a court would force it to dig deep for them. In Toussie v. County of Suffolk, 2007 WL 4565160 (E.D.N.Y. Dec. 21, 2007), a New York county made the process of e-discovery excessively difficult and expensive for itself.

Plaintiffs sued the county for allegedly barring them from participation in a real estate auction to which they were entitled. After the lawsuit started, the county did a poor job of preserving its e-mail records. Then, when the plaintiffs demanded – in the “discovery” phase of the lawsuit -- that the county search for and disclose relevant e-mail, the county faltered.  It initially turned over only two e-mail records.

The plaintiffs complained repeatedly to the judge. The judge insisted that the county search for and turn over e-mail records.

Eventually, the county complied.  It hired an outside e-discovery consultant, who restored 417 backup tapes, and found 2,403 pages of relevant emails and attachments.  The restoration and searching of backup tapes is very expensive.

Despite this expenditure by the county, the plaintiffs were still able to show that the county had lost some relevant e-mails.  The court therefore ordered the county to pay the legal costs plaintiffs incurred to force the county to conduct a thorough search for e-mail records.  The court said the county should have implemented a litigation hold from the start of the lawsuit, but it didn't.

Notably, the e-mails that the county did recover tended to support the county's side of the case.

Analysis:  The county would have been better served if, as a matter of policy before the dispute started, it had competently archived all of the e-mail of important employees.  A good archiving system would have allowed the county to possess and easily find the relevant e-mails – including those that supported the county's position. It would have obviated the need to restore backup tapes.

Further, the archival of plentiful records would have avoided the complaint that the county had failed to implement a proper litigation hold.  And that would have prevented the county having to reimburse the plaintiffs' attorneys fees.

–Ben Wright

E-Message Archives | EDiscovery Strategy

Electronic Discovery Reference Model (EDRM) XML Schema

Relevant Records vs Irrelevant Records

In a lawsuit, e-discovery forces the party holding records that are relevant to the lawsuit (the disclosing party) to reveal them to the other party (the receiving party).  The purpose of e-discovery is solely to disclose relevant records. It is not to disclose more information than is required, and it is not to enable a “fishing expedition” by the receiving party through the records of the disclosing party. [In lawyers’ parlance a “fishing expedition” is an unrestrained trawl through an opponent’s records in search of unspecified wrongdoing, such as bribes, kickbacks or misallocation of funds.]

For the disclosing party, over-disclosure is bad.  Inevitably the volumes of data disclosed in e-discovery will contain more than is required.  That excess data opens the opportunity for fishing by the receiving party, the adversary.

For example, imagine a lawsuit over a contract.  In e-discovery Party A discloses e-mails pertaining to the contract.  But receiving Party B may accidentally discern from the e-mails (and the attachments and meta-data associated with them) evidence of a different topic, such as apparent unauthorized use by Party A of trademarks owned by Party B.  The trademark topic was not the purpose of the e-discovery (it’s not the subject of the lawsuit), and Party A did not need to disclose evidence on that topic.

Accordingly, disclosing Party A aims to control e-discovery and keep it within rules.  Party A can better achieve its goal if disclosed data are broken into little units and Party A precisely explains each of the units.

The division of data into precisely-explained units is one potential outcome of the Electronic Discovery Reference Model (EDRM). EDRM proposes to set a uniform framework for e-discovery and standards for the exchange of e-discovery data.  It promises to enable tools for computer-aided review, sampling, snipping, tagging, and explaining of units of disclosed data.

One EDRM project is crafting an XML Interchange Format.  XML is all about tagging data elements so they can be processed (often automatically) and understood.  EDRM’s XML Format provides for tags like “Description” and “CustomDocumentInfo” to be associated with each unit of disclosed data, such as an e-mail message.  These tags can contain free-form text.  These text tags are an opportunity for the disclosing party to annotate, explain and interpret the disclosure.  A text tag can, for example, show why a record (i.e., e-mail X) is being disclosed, what it means and what its context is.  It might explain that e-mail X is a direct part of the employee discussion about the terms of the contract that is the subject of the lawsuit.  Such a tag can subtly help the disclosing party restrain the purpose for which the record is used.

Further, a savvy disclosing Party A could use these tags to help explain why record X is disclosed but not record Y.  In other words, in the tags Party A might make the case for why e-mail X is disclosed (it directly relates to the contract in question), but why the 10 replies to e-mail X are not disclosed (they don’t relate to the contract).  Party A could put in the tags explanations about the search criteria (search methogology or algorithm) it used to find and produce e-mail X, while not finding or producing the 10 replies.  For example, Party A might explain it searched for records containing the concept "mineral contract," but not for all the records touching on a record containing that concept.

Hence, a disclosing party could possess more tactical options if its archives (such as e-mail and instant messages) were in a system that is compatible with EDRM’s XML Format.  (I'll call these tactical options an "edge," but that's not to imply the disclosing party is getting anything unfair.)  When the disclosing party is required to turn over e-mails in e-discovery, it can use text tags to tell its side of the story with respect to each one of those e-mails.*

This edge grows more important as more of the records subject to e-discovery become small e-mails and instant messages (IM, Twitter, iPhone, BlackBerry or cell phone text), rather than larger “documents” like letters and memos.  The reason is that, roughly speaking, courts require that if part of a record must be disclosed, then the disclosing party must turn over the whole record, even if it contains other, irrelevant material.

–Benjamin Wright

Update: The disclosing party might use an XML tag to place a warning on particular units of data. For example, the tag might warn that a particular email contains sensitive personally-identifiable information, which must be kept secure and the review of which must be limited to only necessary personnel. See the story of a medical malpractice defense law firm that lost patient records connected with a lawsuit, thus causing the patients to be notified that their data had suffered a breach.

Related Article: How to Document Instant Messages