Electronic Data Records Law | How to Win E-Discovery

Cull ESI

Search Costs in E-Discovery and E-Disclosure

Does the cost of filtering attorney-client communications from legal disclosures justify a policy of skimpy retention of email?

To understand that question, we need background:  If an enterprise possesses records, it must be prepared to disclose them when required to do so by law.  Disclosure entails effort to find and compile the relevant records.  If the records are paper, the searching and compiling are performed manually.  But if the records are electronic, automated methods for searching and compiling may be available.

For records of electronic mail, modern archival technology enables easy searches, even if the number of records is large.  Search engines can make finding/compiling records rather low cost.  From a policy perspective, those low costs help to justify more complete and lengthy retention of e-mail within an enterprise.

But wait. Some say those low costs are offset by the expense of screening out attorney communications when law requires that the enterprise disclose records.

Is that true?  Let’s analyze the topic.

When the owner of e-mail records such as a public agency must release records under e-discovery or freedom of information act (FOIA), the owner may normally withhold those records protected by attorney-client privilege.  Why?  The law wants to encourage open communication between counsel and client and to enable lawyers to create work product outside the scrutiny of adversaries.

Given this right to withhold, a record holder naturally wants to cull out any protected attorney communications before it discloses records.  If performed manually, this detection and sifting can involve much time and expense.  Some therefore argue the holder would have been wiser in the first place not to have retained the records.  They advocate deleting e-mail records as soon as possible.  If the holder does not possess the records, they say, the holder avoids the eventual cost of filtering out the protected records.

That argument, however, ignores how rapidly search engines are advancing.  Advanced search engines employing artificial intelligence and other techniques can (so their promoters claim) outperform lawyers when examining copious records. See, Daniel Fisher, “The Data Explosion,” Forbes, October 1, 2007.  I courageously predict search engine advances will accelerate as better search methodology and algorithms are developed.

As search technology improves, the need for expensive, manual screening for protected communications diminishes.

Sure, search engines can make mistakes. A lady from a government agency reminded me that if a privileged e-mail slips out in a FOIA disclosure, the law provides no way to claw it back.  So her agency tediously examines e-mails before divulging them.

My reply:  people make mistakes too.  Moreover, the risk of an occasional privilege slip-up is small reason for a government agency to adopt a policy of early e-mail destruction.  While I respect the agency’s need for confidentiality with its lawyers, many other considerations suggest the agency is wise to keep generous electronic mail records.

Another point:  is it really in the public’s interest for a government agency to place colossal emphasis on protecting its lawyer records?

As the costs drop for implementing pretty-good automated measures for screening out protected records, the argument for minimizing the size of email archives drops too.

–Benjamin Wright, JD

 

EMail Evidence | Criminal Defense

Should Corporate Executives Prefer Early Deletion of E-Records?

Some executives fear that e-mail will come back to haunt them, so they minimize their use of it.  And they want corporate e-mail destroyed quickly.  

But electronic records came to the rescue of David Stockman, former CEO of bankrupt auto parts maker Collins & Aikman.  Stockman and other executives were indicted by prosecutors for alleged lying about the company’s financial condition.  Prosecutors apparently based the charges on an investigation by an outside law firm working on behalf the company’s board of directors.  Stockman and his co-defendants maintained that they were victims of a rush to justice.  They said the law firm and the prosecutors failed to examine all the complex evidence carefully. 

They and the government undertook to assemble a database containing 10 million company records, including (no doubt) copious e-mail records.  Key topics in the case included C&A's:

*  day-to-day internal communications among executives and employees regarding the accounting and invoicing for particular transactions, and 

* day-to-day communications with suppliers -- involving innumerable, detailed, nitty-gritty negotiations and documentation over topics like transaction-by-transaction rebates.

From this massive database, the defendants drew evidence, bit-by-tiny-bit, to tell their side of the story.   In a database of this size, the ability to find the right evidence depends much on the careful selection of search methodology and search algorithms.  Sometimes the only effective way to comprehend what is in the database is to engage a selective sampling of records.

Eventually the defense prevailed.  In an unusual move, the prosecutors withdrew the charges, stating that they had come to reassess the evidence in the case.  

In other words, the executives were fortunate that the company retained so many records like e-mail.  E-archives exonerated the defendants.

In a putative corporate scandal, the relevant e-mail records can be maddeningly plentiful.  A large number of computer-based records is unsurprising in a modern white collar crime investigation or police raid of corporate offices.

In this case, the defendants' legal team patiently mined the company’s email (and other records) to build a convincing case that prosecution was unwarranted.

As the quantity of records in a case swells like this, the ability of parties to review records one-by-one declines.  Increasingly the law will favor those who can draw on statistical methods (or linguistic analysis) to tease out the evidence that tells their side of the case.

(David Stockman is most famous as the Ronald Reagan’s budget director in the 1980s.)

–-Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in enterprise governance and records management.  He also delivers training in cyber defense law at the SANS Institute.

E-Message Archives | EDiscovery Strategy

Electronic Discovery Reference Model (EDRM) XML Schema

Relevant Records vs Irrelevant Records

In a lawsuit, e-discovery forces the party holding records that are relevant to the lawsuit (the disclosing party) to reveal them to the other party (the receiving party).  The purpose of e-discovery is solely to disclose relevant records. It is not to disclose more information than is required, and it is not to enable a “fishing expedition” by the receiving party through the records of the disclosing party. [In lawyers’ parlance a “fishing expedition” is an unrestrained trawl through an opponent’s records in search of unspecified wrongdoing, such as bribes, kickbacks or misallocation of funds.]

For the disclosing party, over-disclosure is bad.  Inevitably the volumes of data disclosed in e-discovery will contain more than is required.  That excess data opens the opportunity for fishing by the receiving party, the adversary.

For example, imagine a lawsuit over a contract.  In e-discovery Party A discloses e-mails pertaining to the contract.  But receiving Party B may accidentally discern from the e-mails (and the attachments and meta-data associated with them) evidence of a different topic, such as apparent unauthorized use by Party A of trademarks owned by Party B.  The trademark topic was not the purpose of the e-discovery (it’s not the subject of the lawsuit), and Party A did not need to disclose evidence on that topic.

Accordingly, disclosing Party A aims to control e-discovery and keep it within rules.  Party A can better achieve its goal if disclosed data are broken into little units and Party A precisely explains each of the units.

The division of data into precisely-explained units is one potential outcome of the Electronic Discovery Reference Model (EDRM). EDRM proposes to set a uniform framework for e-discovery and standards for the exchange of e-discovery data.  It promises to enable tools for computer-aided review, sampling, snipping, tagging, and explaining of units of disclosed data.

One EDRM project is crafting an XML Interchange Format.  XML is all about tagging data elements so they can be processed (often automatically) and understood.  EDRM’s XML Format provides for tags like “Description” and “CustomDocumentInfo” to be associated with each unit of disclosed data, such as an e-mail message.  These tags can contain free-form text.  These text tags are an opportunity for the disclosing party to annotate, explain and interpret the disclosure.  A text tag can, for example, show why a record (i.e., e-mail X) is being disclosed, what it means and what its context is.  It might explain that e-mail X is a direct part of the employee discussion about the terms of the contract that is the subject of the lawsuit.  Such a tag can subtly help the disclosing party restrain the purpose for which the record is used.

Further, a savvy disclosing Party A could use these tags to help explain why record X is disclosed but not record Y.  In other words, in the tags Party A might make the case for why e-mail X is disclosed (it directly relates to the contract in question), but why the 10 replies to e-mail X are not disclosed (they don’t relate to the contract).  Party A could put in the tags explanations about the search criteria (search methogology or algorithm) it used to find and produce e-mail X, while not finding or producing the 10 replies.  For example, Party A might explain it searched for records containing the concept "mineral contract," but not for all the records touching on a record containing that concept.

Hence, a disclosing party could possess more tactical options if its archives (such as e-mail and instant messages) were in a system that is compatible with EDRM’s XML Format.  (I'll call these tactical options an "edge," but that's not to imply the disclosing party is getting anything unfair.)  When the disclosing party is required to turn over e-mails in e-discovery, it can use text tags to tell its side of the story with respect to each one of those e-mails.*

This edge grows more important as more of the records subject to e-discovery become small e-mails and instant messages (IM, Twitter, iPhone, BlackBerry or cell phone text), rather than larger “documents” like letters and memos.  The reason is that, roughly speaking, courts require that if part of a record must be disclosed, then the disclosing party must turn over the whole record, even if it contains other, irrelevant material.

–Benjamin Wright

Update: The disclosing party might use an XML tag to place a warning on particular units of data. For example, the tag might warn that a particular email contains sensitive personally-identifiable information, which must be kept secure and the review of which must be limited to only necessary personnel. See the story of a medical malpractice defense law firm that lost patient records connected with a lawsuit, thus causing the patients to be notified that their data had suffered a breach.

Related Article: How to Document Instant Messages