Electronic Data Records Law | How to Win E-Discovery

Simulated Lawsuits

Computer Game as Legal Educator and Lawsuit Outcome Predictor

E-discovery and e-investigations involve ever-growing quantities of legal records . . . oceans of records.  To sift and understand these oceans, we need new tools.

Two such tools are crowdsourcing and sentiment analysis.

Crowdsourcing can employ an  army of virtual workers to analyze massive numbers of records like emails.  CrowdFlower will demonstrate this application of crowdsourcing at the SANS Institute’s E-Records Summit in September.

Sentiment analysis uses linguistic software to glean the intent or attitude of people expressed in large numbers of records, such as text messages or Twitter tweets.

Tools like crowdsourcing and sentiment analysis are little known in legal circles.  How can courts, lawyers and investigators gain experience?  How can they evaluate these new tools and learn their uses?

I suggest those tools (and others) be incorporated into computer games.  In the Information Age, games and simulations are assuming a larger role in education, training and dispute resolution.  For example, managers at healthcare providers learn how to cope with adversity, such as employee termination, through computer-aided simulation.

And diplomats use simulated negotiations to envision how  to resolve international disputes.   See Simulated talks show possible solution for Arctic dispute

Lawyers, law students and even courtroom judges can play computer games for the serious purpose of evaluating evidence, testing arguments and ascertaining what the outcome of litigation should be.  Computer games can be quicker, more insightful and less expensive than the traditional form of litigation simulation, i.e., mock trial.

I can imagine lawyer computer games including tools like crowdsourcing and sentiment analysis.

Imagine that a law firm is defending an age discrimination lawsuit involving 3 million electronic mail records at a corporation.  To assess those records and develop strategy, the law firm could play games with them.  It could feed the records into a computer game that uses crowdsourcing, sentiment analysis and the like to test and search the records under different standards and scenarios.  The firm might, for example, learn that sentiment analysis reveals an overall executive desire to comply with employment laws, even though a few “stray remarks” use impolitic language to discuss older workers.  Alternatively, the firm might discover that a thorough review of the emails, by hundreds of reviewers, reveals a management culture at the corporation that is insensitive to rights of older employees.  (See Efrati and Koppel, “Google is set back in age-bias case in ruling with broad implications,” Wall Street Journal, August 6, 2010.)

Either way, the law firm is better able to advise and represent its corporate client.

The law industry is slow to recognize new methods.  As inventors like CrowdFlower develop innovations for the industry, computer games can publicize those innovations and teach lawyers and investigators to think differently.

–Benjamin Wright

Mr. Wright teaches IT law at the SANS Institute.

EDD Search and Analysis

Advanced ESI Culling, Clustering and Concept Review

E-discovery search and analysis engines are proliferating.   Enhanced keyword search methods (such as fuzzy search that looks for forensic gems like misspelled keywords) are coming to recognize more nuances.  Other analytical technologies are emerging as well, and they are influencing the outcomes of audits, lawsuits and internal investigations.

Take the Lehman Brothers bankruptcy, which oversees 3.2 billion e-mail and instant message records. To glean value from this ocean of records, investigators and auditors need more than just conventional keyword search.  New methods include visual mapping of users, dates, transactions and relationships and searches for concepts like compensation rather than just words like “salary” or “bonus.” Telis Demos, "Smoking-Gun Search Engines Find Profit," Fortune, March 2, 2009, p. 24.

Savvy inspection of eDiscovery records can uncover hidden inference and meaning, and dramatically change the result of lawsuits and investigations.  For instance, the US Department of Justice indicted David Stockman, ex-CEO of Collins & Aikman, for alleged fraud, supporting its indictment with extensive factual references and analysis – including the report of an internal investigation conducted by a prestigious law firm on behalf of the company’s board of directors.  For Stockman, the outlook was grim; at a minimum he faced a grueling criminal trial.  

However, during the pre-trial litigation, Stockman’s defense team assiduously assembled a 15-million  (!) document database of e-mail and other records from the company.  From this huge corpus, the team drew out unexpected insights about how business actually transpired at the company and about how supplier rebates (a key topic) worked in the industry.  The insights suggested that neither DoJ nor the internal investigator really understood the case.  These insights enabled the defense to construct a radically different interpretation of Stockman’s tenure as CEO and, eventually, to persuade the DoJ that it had made a mistake.  In an unusual about-face, DoJ withdrew criminal charges against Stockman before the trial began.

In other words, ESI data-mining is the reason Stockman walks a free man today.

According to Ranjit Sarai, eDiscovery specialist at Messaging Architects, litigants like Stockman can achieve courtroom advantage by exposing e-mail databases to advanced or experimental search techniques. “When an investigator is trying to understand a multitude of e-mail records, scrub them for privacy compliance or cull out privileged communications, keyword-oriented searches can be very tedious and can mask the big picture.  Alternative analytical tools can often yield better results.  For example, they can visually map things like time relationships, which can highlight suspicious activities or contradict an adversary’s interpretation of what happened in the case.”

To assemble such as database, a litigant like Stockman would need to access to the records in a machine-processable format, such as XML.  Sometimes courts roughly refer to such as format as "native format," but eDiscovery formatting is a complex topic.

–Benjamin Wright

Mr. Wright is an advisor to messagingarchitects.com, experts in e-discovery services, training and software.   Here is an ARMA podcast describing Messaging Architects' work in e-mail archiving, including its workshop for development of an email records policy in an enterprise.

Cull ESI

Search Costs in E-Discovery and E-Disclosure

Does the cost of filtering attorney-client communications from legal disclosures justify a policy of skimpy retention of email?

To understand that question, we need background:  If an enterprise possesses records, it must be prepared to disclose them when required to do so by law.  Disclosure entails effort to find and compile the relevant records.  If the records are paper, the searching and compiling are performed manually.  But if the records are electronic, automated methods for searching and compiling may be available.

For records of electronic mail, modern archival technology enables easy searches, even if the number of records is large.  Search engines can make finding/compiling records rather low cost.  From a policy perspective, those low costs help to justify more complete and lengthy retention of e-mail within an enterprise.

But wait. Some say those low costs are offset by the expense of screening out attorney communications when law requires that the enterprise disclose records.

Is that true?  Let’s analyze the topic.

When the owner of e-mail records such as a public agency must release records under e-discovery or freedom of information act (FOIA), the owner may normally withhold those records protected by attorney-client privilege.  Why?  The law wants to encourage open communication between counsel and client and to enable lawyers to create work product outside the scrutiny of adversaries.

Given this right to withhold, a record holder naturally wants to cull out any protected attorney communications before it discloses records.  If performed manually, this detection and sifting can involve much time and expense.  Some therefore argue the holder would have been wiser in the first place not to have retained the records.  They advocate deleting e-mail records as soon as possible.  If the holder does not possess the records, they say, the holder avoids the eventual cost of filtering out the protected records.

That argument, however, ignores how rapidly search engines are advancing.  Advanced search engines employing artificial intelligence and other techniques can (so their promoters claim) outperform lawyers when examining copious records. See, Daniel Fisher, “The Data Explosion,” Forbes, October 1, 2007.  I courageously predict search engine advances will accelerate as better search methodology and algorithms are developed.

As search technology improves, the need for expensive, manual screening for protected communications diminishes.

Sure, search engines can make mistakes. A lady from a government agency reminded me that if a privileged e-mail slips out in a FOIA disclosure, the law provides no way to claw it back.  So her agency tediously examines e-mails before divulging them.

My reply:  people make mistakes too.  Moreover, the risk of an occasional privilege slip-up is small reason for a government agency to adopt a policy of early e-mail destruction.  While I respect the agency’s need for confidentiality with its lawyers, many other considerations suggest the agency is wise to keep generous electronic mail records.

Another point:  is it really in the public’s interest for a government agency to place colossal emphasis on protecting its lawyer records?

As the costs drop for implementing pretty-good automated measures for screening out protected records, the argument for minimizing the size of email archives drops too.

–Benjamin Wright, JD

 

EMail Evidence | Criminal Defense

Should Corporate Executives Prefer Early Deletion of E-Records?

Some executives fear that e-mail will come back to haunt them, so they minimize their use of it.  And they want corporate e-mail destroyed quickly.  

But electronic records came to the rescue of David Stockman, former CEO of bankrupt auto parts maker Collins & Aikman.  Stockman and other executives were indicted by prosecutors for alleged lying about the company’s financial condition.  Prosecutors apparently based the charges on an investigation by an outside law firm working on behalf the company’s board of directors.  Stockman and his co-defendants maintained that they were victims of a rush to justice.  They said the law firm and the prosecutors failed to examine all the complex evidence carefully. 

They and the government undertook to assemble a database containing 10 million company records, including (no doubt) copious e-mail records.  Key topics in the case included C&A's:

*  day-to-day internal communications among executives and employees regarding the accounting and invoicing for particular transactions, and 

* day-to-day communications with suppliers -- involving innumerable, detailed, nitty-gritty negotiations and documentation over topics like transaction-by-transaction rebates.

From this massive database, the defendants drew evidence, bit-by-tiny-bit, to tell their side of the story.   In a database of this size, the ability to find the right evidence depends much on the careful selection of search methodology and search algorithms.  Sometimes the only effective way to comprehend what is in the database is to engage a selective sampling of records.

Eventually the defense prevailed.  In an unusual move, the prosecutors withdrew the charges, stating that they had come to reassess the evidence in the case.  

In other words, the executives were fortunate that the company retained so many records like e-mail.  E-archives exonerated the defendants.

In a putative corporate scandal, the relevant e-mail records can be maddeningly plentiful.  A large number of computer-based records is unsurprising in a modern white collar crime investigation or police raid of corporate offices.

In this case, the defendants' legal team patiently mined the company’s email (and other records) to build a convincing case that prosecution was unwarranted.

As the quantity of records in a case swells like this, the ability of parties to review records one-by-one declines.  Increasingly the law will favor those who can draw on statistical methods (or linguistic analysis) to tease out the evidence that tells their side of the case.

(David Stockman is most famous as the Ronald Reagan’s budget director in the 1980s.)

–-Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, thought leader in enterprise governance and records management.  He also delivers training in cyber defense law at the SANS Institute.

E-Message Archives | EDiscovery Strategy

Electronic Discovery Reference Model (EDRM) XML Schema

Relevant Records vs Irrelevant Records

In a lawsuit, e-discovery forces the party holding records that are relevant to the lawsuit (the disclosing party) to reveal them to the other party (the receiving party).  The purpose of e-discovery is solely to disclose relevant records. It is not to disclose more information than is required, and it is not to enable a “fishing expedition” by the receiving party through the records of the disclosing party. [In lawyers’ parlance a “fishing expedition” is an unrestrained trawl through an opponent’s records in search of unspecified wrongdoing, such as bribes, kickbacks or misallocation of funds.]

For the disclosing party, over-disclosure is bad.  Inevitably the volumes of data disclosed in e-discovery will contain more than is required.  That excess data opens the opportunity for fishing by the receiving party, the adversary.

For example, imagine a lawsuit over a contract.  In e-discovery Party A discloses e-mails pertaining to the contract.  But receiving Party B may accidentally discern from the e-mails (and the attachments and meta-data associated with them) evidence of a different topic, such as apparent unauthorized use by Party A of trademarks owned by Party B.  The trademark topic was not the purpose of the e-discovery (it’s not the subject of the lawsuit), and Party A did not need to disclose evidence on that topic.

Accordingly, disclosing Party A aims to control e-discovery and keep it within rules.  Party A can better achieve its goal if disclosed data are broken into little units and Party A precisely explains each of the units.

The division of data into precisely-explained units is one potential outcome of the Electronic Discovery Reference Model (EDRM). EDRM proposes to set a uniform framework for e-discovery and standards for the exchange of e-discovery data.  It promises to enable tools for computer-aided review, sampling, snipping, tagging, and explaining of units of disclosed data.

One EDRM project is crafting an XML Interchange Format.  XML is all about tagging data elements so they can be processed (often automatically) and understood.  EDRM’s XML Format provides for tags like “Description” and “CustomDocumentInfo” to be associated with each unit of disclosed data, such as an e-mail message.  These tags can contain free-form text.  These text tags are an opportunity for the disclosing party to annotate, explain and interpret the disclosure.  A text tag can, for example, show why a record (i.e., e-mail X) is being disclosed, what it means and what its context is.  It might explain that e-mail X is a direct part of the employee discussion about the terms of the contract that is the subject of the lawsuit.  Such a tag can subtly help the disclosing party restrain the purpose for which the record is used.

Further, a savvy disclosing Party A could use these tags to help explain why record X is disclosed but not record Y.  In other words, in the tags Party A might make the case for why e-mail X is disclosed (it directly relates to the contract in question), but why the 10 replies to e-mail X are not disclosed (they don’t relate to the contract).  Party A could put in the tags explanations about the search criteria (search methogology or algorithm) it used to find and produce e-mail X, while not finding or producing the 10 replies.  For example, Party A might explain it searched for records containing the concept "mineral contract," but not for all the records touching on a record containing that concept.

Hence, a disclosing party could possess more tactical options if its archives (such as e-mail and instant messages) were in a system that is compatible with EDRM’s XML Format.  (I'll call these tactical options an "edge," but that's not to imply the disclosing party is getting anything unfair.)  When the disclosing party is required to turn over e-mails in e-discovery, it can use text tags to tell its side of the story with respect to each one of those e-mails.*

This edge grows more important as more of the records subject to e-discovery become small e-mails and instant messages (IM, Twitter, iPhone, BlackBerry or cell phone text), rather than larger “documents” like letters and memos.  The reason is that, roughly speaking, courts require that if part of a record must be disclosed, then the disclosing party must turn over the whole record, even if it contains other, irrelevant material.

–Benjamin Wright

Update: The disclosing party might use an XML tag to place a warning on particular units of data. For example, the tag might warn that a particular email contains sensitive personally-identifiable information, which must be kept secure and the review of which must be limited to only necessary personnel. See the story of a medical malpractice defense law firm that lost patient records connected with a lawsuit, thus causing the patients to be notified that their data had suffered a breach.

Related Article: How to Document Instant Messages