Electronic Data Records Law | How to Win E-Discovery

Reasonable, Proportionate ESI Demand

Denied without Rational Basis

E-discovery is not the gateway to a feast for the litigant requesting access to the electronic records held by its adversary. The party requesting e-discovery of complex information 

from a larger enterprise must be careful.  If the request is not targeted, proportionate to the seriousness of the case and rationally based on already-known evidence, the request may be blocked. 

Sanctions for Overly-Broad eDiscovery Request?

One e-discovery expert, Mary Mack, even predicts that soon a court will sanction a requester for being overly broad in its e-discovery request.  

Another leader in e-discovery, Craig Ball, advises that when a requester demands that the record holder preserve ESI, the requester is shooting himself in the foot if he “demands the moon and paralyzes [his] opponent’s operations.”

In other words, crafting an e-discovery request is hard work. The request must be tailored to the case at hand as it exists – and according to the information that is available – at the time of the request.

Request Denied

See Mirbeau of Geneva Lake, LLC v. City of Lake Geneva, 2009 U.S. Dist. LEXIS 101104 (E.D. Wis. Oct. 15, 2009).   After a city government turned over some paper printouts of email, the requester (Mirbeau) demanded that the city make all its computers and electronic storage devices available for forensic examination.  To justify this demand, the requestor argued that, in an earlier deposition, a city employee hinted that some relevant electronic evidence was being destroyed. 

The court denied the request because the requester “failed to demonstrate why a more rigorous discovery process, with extensive forensics analysis of the computers by the plaintiffs, is needed in this case….  Mirbeau has failed to identify what type of information it hopes will be discovered through the forensic mapping of the entire City’s computer system, and Mirbeau has not explained that the information it is requesting would be in the form in which the defendant’s ESI [electronically stored information] is normally maintained.” 

Court Urges Cooperation

Still, the court believed further e-discovery was warranted because the city had been less than diligent in retrieving records. The court urged the parties to cooperate to come up with a fair way to get information. It said : “While not intended to be all inclusive, the parties need to contemplate: (1) what different methods could be used to find ESI relevant to this litigation; (2) whether neutral parties could be procured to run scans on the electronic devices of the defendants; (3) whether the searches for ESI could be staggered, such as not to disrupt the City’s ability to function; (4) whether the searches could be narrowed such that they are focused only on certain parties and certain dates; and (5) what methods need to be in place to ensure that the privacy rights of third parties are not adversely affected during the discovery process.”

Rational Request, Based on Existing Evidence

The negotiation of e-discovery is a delicate, intellectual process.  It's not enough for the requester to say, "give me [or save for me] everything you got."  Nor is it enough for the record holder to say, "you aren't entitled to anything more," or "we just don't have any more records than these."

In this computer age -- when one fully comprehends every scrap of data that may exist anywhere on an iPhone, hard drive, or backup tape -- the quantity of records in an enterprise is infinite.  Accordingly, it is ridiculous to say either:

- "I want everything" (to find and disclose every last data element takes too much effort); or

- "nothing more exists" (something more always exists somewhere within the control of the enterprise).

For the requesting party, a key challenge is to gather enough intelligence via depositions, interrogatories or other research to inform rational e-records demands.

For the responding party, the challenge is to be cooperative, while not enabling a "fishing expedition" by the requester.

–Benjamin Wright

Text Messages Wiped from BlackBerries

Lawsuit Evidence Erased from Personal & Corporate Cell Phones | Court Punishes | Business Policy

To spoliate means to destroy or conceal evidence that one has reason to believe will be needed in litigation.  If a court finds a litigant has spoliated evidence, such as records, then the court will impose penalties.

Courts have punished many organizations for failing to keep electronic mail records.  Logically, the same punishment awaits organizations that fail to retain executive text

and instant messages, but to support that proposition I’ve not been able to cite a case.  Now I can cite Southeastern Mechanical Services, Inc. v. Brody, 2009 WL 2883057 (M.D. Fla. Aug. 31, 2009).

In a trade secret lawsuit, the court had ordered several employees of the defendant to surrender their BlackBerries to forensic experts for investigation.  (Two of the BlackBerries belonged to the corporate defendant; one was the personal property of the employee.)  But when the experts received the BlackBerries, the devices were devoid of data – no text message records, no calendar items, no call history, nothing.  The court knew that the employees regularly used the devices for more than just telephone calls. 

The defendant argued there was no spoliation because the devices were configured so that all electronic mails would be copied and preserved in the defendant’s corporate e-mail server.  Yet the court was highly suspicious. What about text messages?  Those were not copied to the e-mail server.  Why were all of the devices wiped clean? 

The court concluded that the defendant and/or its employees had intentionally destroyed records such as text messages on the smart-phones.  As punishment the court dealt the defendant a strategic disadvantage in the lawsuit, in the form an adverse inference for the jury later in the lawsuit.  (In other words, as the jury is empaneled, it will be informed that the defendant had mishandled important records, which could be taken as a strike against the defendant.)

Lesson:  As a matter of policy, an enterprise is wise to preserve the business text and instant messages (IM) of its employees – especially executives, managers and professionals -- just as it does email.  A text message can be legal evidence just as an email can be.

The phones in this case were BlackBerries.  It seems the outcome would have been the same were the phones, Androids, iPhones (which now supports MMS) or some other form of PDA.  Eventually, we'll see cases dealing with record retention/destruction for MMS (multimedia messaging service).  Soon thereafter the cases will address high definition (HD) videoconferencing, also known as telepresence.

Update:  A policy workshop I led created some language for enterprise policy on recording text, Facebook and other "unconventional" electronic business messages.

Another Update: Modern smartphones like the HTC One allow the user to back text messages up to an email account, like an enterprise account. Thus, when an executive sends or receives a legally significant text message, she can archive it in her enterprise email account.

–Benjamin Wright

Mr. Wright teaches eDiscovery and Data Security Law at the SANS Institute.

Medical and Education Record Retention and Purge Policy

Tiered e-Archives for Patient Records and Electronic Mail

How long should an enterprise retain e-data? What's a smart policy on e-record destruction?  Hear how East Carolina University answered the questions for e-mail, medical records and security videos.

The institution retains those three classes of data in a dedicated archival system (more than just normal production records and backup).

East Carolina retains e-mail of top school administrators seven years, then purges it.  In my experience, seven years is the traditionally-recognized period for responsible retention of important financial records.

East Carolina elected to retain e-mail of faculty and staff for three years.

It archives security video (very voluminous) 30 days.  

The university saves patient records until 20 years after patient's death.

To reduce costs, the university retains archives in tiers. Newer or higher-priority archives are in higher-performance "primary" storage, whereas older archives are relegated to slower storage, outside the network backup program.

On the topic of tiers, I’ll go one step further than what I read about East Carolina U.  I envision another, even lower and less expensive tier, where archives are retained and organized but not accessible by fully-automated means.  

From the perspective of e-discovery theory, a rationale for tiered storage is this:  E-discovery law is most intolerant when records are destroyed too early.  In the e-records world, too-early destruction is the most common type of "spoliation" or "obstruction of justice".  E-discovery law is also intolerant (but maybe a bit less so) when a litigant possesses records, but she doesn’t know it and can’t find them.  

Finally, e-discovery law seems to be more tolerant when a litigant possesses records, knows she possesses them, knows more or less where they are, but just can't get to them very easily.  When this is the case in a lawsuit, a litigant is much less likely to be charged with spoliation.  Instead, the plaintiff and defendant are prone to go before the judge and argue about the extent to which the dusty old e-archives are important and about who should pay for how much of the cost of retrieving them.

-–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in e-record archival.

FRE 502 Electronic Mail | Federal Cases

Inadvertent Disclosure of Privileged Records in E-Discovery

Scrub EDD

A danger in e-discovery is that the party disclosing records will inadvertently give its opponent some that are protected by attorney-client privilege (i.e., attorney-client confidentiality) or as attorney work product.  E-discovery records are often so voluminous that privileged records might be turned over by mistake.

To address the danger Congress is adding Rule 502 to the Federal Rules of Evidence.  Effectively the new Rule provides that if a litigant inadvertently discloses a privileged document, he can still prevent his opponent from using it – so long as he took reasonable steps to prevent the disclosure in the first place. In other words, before releasing records, a litigant needs to make a reasonable search through them to cull out (screen) any that contain protected attorney-client communications (or attorney work product).  

Protection Denied

Such a search is not always easy.  In Victor Stanley, Inc. v. Creative Pipe, Inc., 250 F.R.D. 251 (D. Md. 2008), the defendant did search to cull or filter out privileged communications before delivering a mass of e-discovery records to the plaintiff.  But the cull was imperfect, and 165 privileged documents passed to the plaintiff.  

The defendant argued those 165 records should still be protected (i.e., the plaintiff should return them and refrain from using them), but the court disagreed.  The court said for those 165 documents the defendant had “waived” the privilege.  The court justified its decision by criticizing the methods the defendant used to cull out the privileged records, noting that simple keyword searches are known to miss things in electronically stored information (ESI).  The court concluded the defendant’s methods were not reasonable, as the defendant could not document it had designed and executed anything beyond a slapdash, rudimentary keyword search.

When Protection Applies

An explanatory note to new Rule 502 describes a good search:  “Depending on the circumstances, a party that uses advanced analytical software applications and linguistic tools in screening for privilege and work product may be found to have taken ‘reasonable steps’ to prevent inadvertent disclosure.  The implementation of an efficient system of records management before litigation may also be relevant.” --Explanatory Note on Evidence Rule 502 Prepared by the Judicial Conference Advisory Committee on Evidence Rules (Revised 11/28/2007)

Incentive for Searchable Archive

Accordingly, Rule 502 will give enterprises more reason to keep well-indexed e-mail records in an archival system that supports sophisticated searches and makes records about those searches as they are executed.* 

–Benjamin Wright

*Here is another reason for maintaning an email archive:  A competent email archive provides an enterprise a core group of records to search under an eDiscovery demand.  It enables the enterprise to say, in reply to the demand: "I can easily and inexpensively search this core archive.  It is not reasonable to expect me to search more deeply."