Electronic Data Records Law | How to Win E-Discovery

EMail Evidence | Criminal Defense

Should Corporate Executives Prefer Early Deletion of E-Records?

Some executives fear that e-mail will come back to haunt them, so they minimize their use of it.  And they want corporate e-mail destroyed quickly.  

But electronic records came to the rescue of David Stockman, former CEO of bankrupt auto parts maker Collins & Aikman.  Stockman and other executives were indicted by prosecutors for alleged lying about the company’s financial condition.  Prosecutors apparently based the charges on an investigation by an outside law firm working on behalf the company’s board of directors.  Stockman and his co-defendants maintained that they were victims of a rush to justice.  They said the law firm and the prosecutors failed to examine all the complex evidence carefully. 

They and the government undertook to assemble a database containing 10 million company records, including (no doubt) copious e-mail records.  Key topics in the case included C&A's:

*  day-to-day internal communications among executives and employees regarding the accounting and invoicing for particular transactions, and 

* day-to-day communications with suppliers -- involving innumerable, detailed, nitty-gritty negotiations and documentation over topics like transaction-by-transaction rebates.

From this massive database, the defendants drew evidence, bit-by-tiny-bit, to tell their side of the story.   In a database of this size, the ability to find the right evidence depends much on the careful selection of search methodology and search algorithms.  Sometimes the only effective way to comprehend what is in the database is to engage a selective sampling of records.

Eventually the defense prevailed.  In an unusual move, the prosecutors withdrew the charges, stating that they had come to reassess the evidence in the case.  

In other words, the executives were fortunate that the company retained so many records like e-mail.  E-archives exonerated the defendants.

In a putative corporate scandal, the relevant e-mail records can be maddeningly plentiful.  A large number of computer-based records is unsurprising in a modern white collar crime investigation or police raid of corporate offices.

In this case, the defendants' legal team patiently mined the company’s email (and other records) to build a convincing case that prosecution was unwarranted.

As the quantity of records in a case swells like this, the ability of parties to review records one-by-one declines.  Increasingly the law will favor those who can draw on statistical methods (or linguistic analysis) to tease out the evidence that tells their side of the case.

(David Stockman is most famous as the Ronald Reagan’s budget director in the 1980s.)

–-Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in enterprise governance and records management.  He also delivers training in cyber defense law at the SANS Institute.

E-Message Archives | EDiscovery Strategy

Electronic Discovery Reference Model (EDRM) XML Schema

Relevant Records vs Irrelevant Records

In a lawsuit, e-discovery forces the party holding records that are relevant to the lawsuit (the disclosing party) to reveal them to the other party (the receiving party).  The purpose of e-discovery is solely to disclose relevant records. It is not to disclose more information than is required, and it is not to enable a “fishing expedition” by the receiving party through the records of the disclosing party. [In lawyers’ parlance a “fishing expedition” is an unrestrained trawl through an opponent’s records in search of unspecified wrongdoing, such as bribes, kickbacks or misallocation of funds.]

For the disclosing party, over-disclosure is bad.  Inevitably the volumes of data disclosed in e-discovery will contain more than is required.  That excess data opens the opportunity for fishing by the receiving party, the adversary.

For example, imagine a lawsuit over a contract.  In e-discovery Party A discloses e-mails pertaining to the contract.  But receiving Party B may accidentally discern from the e-mails (and the attachments and meta-data associated with them) evidence of a different topic, such as apparent unauthorized use by Party A of trademarks owned by Party B.  The trademark topic was not the purpose of the e-discovery (it’s not the subject of the lawsuit), and Party A did not need to disclose evidence on that topic.

Accordingly, disclosing Party A aims to control e-discovery and keep it within rules.  Party A can better achieve its goal if disclosed data are broken into little units and Party A precisely explains each of the units.

The division of data into precisely-explained units is one potential outcome of the Electronic Discovery Reference Model (EDRM). EDRM proposes to set a uniform framework for e-discovery and standards for the exchange of e-discovery data.  It promises to enable tools for computer-aided review, sampling, snipping, tagging, and explaining of units of disclosed data.

One EDRM project is crafting an XML Interchange Format.  XML is all about tagging data elements so they can be processed (often automatically) and understood.  EDRM’s XML Format provides for tags like “Description” and “CustomDocumentInfo” to be associated with each unit of disclosed data, such as an e-mail message.  These tags can contain free-form text.  These text tags are an opportunity for the disclosing party to annotate, explain and interpret the disclosure.  A text tag can, for example, show why a record (i.e., e-mail X) is being disclosed, what it means and what its context is.  It might explain that e-mail X is a direct part of the employee discussion about the terms of the contract that is the subject of the lawsuit.  Such a tag can subtly help the disclosing party restrain the purpose for which the record is used.

Further, a savvy disclosing Party A could use these tags to help explain why record X is disclosed but not record Y.  In other words, in the tags Party A might make the case for why e-mail X is disclosed (it directly relates to the contract in question), but why the 10 replies to e-mail X are not disclosed (they don’t relate to the contract).  Party A could put in the tags explanations about the search criteria (search methogology or algorithm) it used to find and produce e-mail X, while not finding or producing the 10 replies.  For example, Party A might explain it searched for records containing the concept "mineral contract," but not for all the records touching on a record containing that concept.

Hence, a disclosing party could possess more tactical options if its archives (such as e-mail and instant messages) were in a system that is compatible with EDRM’s XML Format.  (I'll call these tactical options an "edge," but that's not to imply the disclosing party is getting anything unfair.)  When the disclosing party is required to turn over e-mails in e-discovery, it can use text tags to tell its side of the story with respect to each one of those e-mails.*

This edge grows more important as more of the records subject to e-discovery become small e-mails and instant messages (IM, Twitter, iPhone, BlackBerry or cell phone text), rather than larger “documents” like letters and memos.  The reason is that, roughly speaking, courts require that if part of a record must be disclosed, then the disclosing party must turn over the whole record, even if it contains other, irrelevant material.

–Benjamin Wright

Update: The disclosing party might use an XML tag to place a warning on particular units of data. For example, the tag might warn that a particular email contains sensitive personally-identifiable information, which must be kept secure and the review of which must be limited to only necessary personnel. See the story of a medical malpractice defense law firm that lost patient records connected with a lawsuit, thus causing the patients to be notified that their data had suffered a breach.

Related Article: How to Document Instant Messages

EDRM Expert

Standards and Guidelines for E-Discovery

E-discovery (the process of finding and disclosing electronic evidence in litigation) has become a sizable industry.  But the industry has emerged so quickly that e-discovery work is anything but uniform.  Performance of e-discovery work is evaluated largely on an ad hoc basis.  To change that, industry leaders have formed a group to set standards and guidelines.

The Electronic Discovery Reference Model pulls together law firms, e-discovery technical practitioners and the vendors of e-discovery and e-archival products.  It comprises several projects.  

One project is a set of metrics for tracking and measuring e-discovery activities.  Metrics can help litigants and courts assess which e-discovery is and is not required.  A general principle of e-discovery law is that a party should be required to expend no more than reasonable effort to locate and turn over electronic records.  Authoritative metrics can help reveal the difference between reasonable effort and unreasonable effort.

How to Search?

Another EDRM project is crafting a framework for defining and executing searches for electronic documents.  Different methods for searching (keyword, concept, heuristic and so on) a given group of records will yield different results.  An EDRM search framework could help litigants specify what they expect from e-discovery work and avoid surprise or disappointment after it is performed.

[Background: As the quantity of eDiscovery records soars, sampling of those records will become a more viable search technique. See McPeek v. Ascroff, 202 FRD 31 (DDC 2001), which endorses sampling of old backup tapes as a way to control discovery costs, rather than requiring the defendant to restore all tapes as the plaintiff requested.]

A third project is writing an ethical code of conduct for e-discovery practitioners. This code will help courts and litigants evaluate and gain confidence in the quality of e-discovery work by particular practitioners.  

Future Potential

EDRM has the potential to enable future technologies that can contribute discipline, efficiency and reliability to the e-discovery phase of litigation. It can also give the vendors of electronic archival systems direction as they develop products intended to facilitate e-discovery for future litigation. I foresee document search technologies using artificial intelligence and other advanced search analytics.

–Benjamin Wright