Electronic Discovery
Encyclopedia
Electronic discovery refers to discovery
in civil litigation which deals with the exchange of information in electronic format
(often referred to as electronically stored information
or ESI). Usually (but not always) a digital forensics analysis
is performed to recover evidence. A wider array of people are involved in eDiscovery (for example, forensic investigators, lawyers and IT managers) leading to problems with confusing terminology.
Data is identified as relevant by attorney
s and placed on legal hold
. Evidence is then extracted and analysed using digital forensic procedures
, and is usually converted into PDF
or TIFF form for use in court.
Electronic information is considered different from paper information because of its intangible form, volume, transience and persistence. Electronic information is usually accompanied by metadata
that is not found in paper documents and that can play an important part as evidence (for example the date and time a document was written could be useful in a copyright
case). The preservation of metadata from electronic documents creates special challenges to prevent spoliation
.
Electronic discovery was the subject of amendments to the Federal Rules of Civil Procedure
(FRCP), effective December 1, 2006.
Individuals working in the field of electronic discovery commonly refer to the field as Litigation Support.
, instant messaging chats
, documents, accounting databases, CAD/CAM files, Web sites
, and any other electronically stored information that could be relevant evidence in a law suit. Also included in e-discovery is "raw data
", which Forensic Investigators can review for hidden evidence. The original file format is known as the "native" format
. Litigators may review material from e-discovery in one of several formats: printed paper, "native file,", PDF format, or as single- or multi-page TIFF images.
tapes cannot be found, or are erased and reused.
This kind of situation reached its apex during the Zubulake v. UBS Warburg
LLC lawsuit. Throughout the case, the plaintiff claimed that the evidence needed to prove the case existed in emails stored on UBS' own computer systems. Because the emails requested were either never found or destroyed, the court found that it was more likely that they existed than not. The court found that while the corporation's counsel directed that all potential discovery evidence, including emails, be preserved, the staff that the directive applied to did not follow through. This resulted in significant sanctions against UBS.
In 2006, the U.S. Supreme Court's amendments to the Federal Rules of Civil Procedure
created a category for electronic records that, for the first time, explicitly named emails and instant message chats as likely records to be archived and produced when relevant. The rapid adoption of instant messaging as a business communications medium during the period 2005-2007 has made IM as ubiquitous in the workplace as email and created the need for companies to address archiving and retrieval of IM chats to the same extent they do for email.
With electronic message archiving in place for both email and IM it becomes a fairly simple task to retrieve any email or IM chat that might be used in e-discovery. Some archiving systems apply a unique code to each archived message or chat to establish authenticity. The systems prevent alterations to original messages, messages cannot be deleted, and the messages cannot be accessed by unauthorized persons.
Also important to complying with discovery of electronic records is the requirement that records be produced in a timely manner. The changes to the Federal Rules of Civil Procedure were the culmination of a period of debate and review that started in March 2000 when then Vice President Al Gore
’s fundraising activities were being probed by the United States Department of Justice
. After White House counsel Beth Norton reported that it would take up to six months to search through 625 storage tapes, efforts began to mandate timelier discovery of electronic records.
Modern message archival systems allow legal and technology professionals to store and retrieve electronic messages efficiently and in a timely manner.
The formalized changes to the Federal Rules of Civil Procedure in December 2006 and in 2007 effectively forced civil litigants into a compliance mode with respect to their proper retention and management of electronically stored information
(ESI). The risks that litigants face as a result of improper management of ESI include spoliation of evidence, adverse inference, summary judgement, and sanctions. In some cases, such as Qualcomm v Broadcomm, attorneys can be brought before the bar and risk their livelihood.
that is stored on a computer until it is deleted by the user. Employers may have a duty to retain voicemail if there is an anticipation of litigation involving that employee.
s or smartphone
s that may contain discoverable material. This can raise issues for collection, as the tools for acquiring data from such devices are difficult to find.
) had become the standard document review method for almost two decades, native format review has increased in popularity as a method for document review since around 2004. Because it requires the review of documents in their original file formats, applications and toolkits capable of opening multiple file formats have also become popular. This is also true in the ECM (Electronic Content Management) storage markets which are converging quickly with ESI technologies. Organizations susceptible to face eDiscovery requirements should especially be aware that backup tapes are not anymore regulatory compliant. They should be prepared to respond to any eDiscovery request within a reduced timeframe, being aware that if they rely on PST files, it would be a real time and people-consuming activity to search through terabytes of files not offering advanced indexing or searching features.
Petrification involves the conversion of native files into an image format that does not require use of the native applications. This is useful in the redaction
of privilege
d or sensitive information, since redaction tools for images are traditionally more mature, and easier to apply on uniform image types. Efforts to redact similarly petrified PDF files have resulted in the removal of redacted layers and exposure of redacted information, such as social security numbers and other private information.
Traditionally, electronic discovery vendors had been contracted to convert native files into TIFF images (for example 10 images for a 10 page Microsoft Word document) with a loadfile for use in image-based discovery review database applications. Increasingly, database review applications have embedded native file viewers with tiff-capabilities. With both native and image file capabilities, it could either increase or decrease the total necessary storage, since there may be multiple formats and files associated with each individual native file. Deployment, storage and best practices are becoming especially critical and necessary to maintain cost-effective strategies.
While attorneys involved in case litigation try their best to understand the companies and organization they represent, they may fail to understand the policies and practices that are in place in the company's IT
department. As a result, some data may be destroyed after a legal hold has been issued by unknowing technicians performing their regular duties.
Given the complexities of modern litigation and the wide variety of information systems on the market, electronic discovery often requires IT professionals from both the attorney's office (or vendor) and the parties to the litigation to communicate directly to address technology incompatibilities and agree on production formats. Failure to get expert advice from knowledgeable personnel often leads to additional time and unforeseen costs in acquiring new technology or adapting existing technologies to accommodate the collected data.
Discovery (law)
In U.S.law, discovery is the pre-trial phase in a lawsuit in which each party, through the law of civil procedure, can obtain evidence from the opposing party by means of discovery devices including requests for answers to interrogatories, requests for production of documents, requests for...
in civil litigation which deals with the exchange of information in electronic format
Digital evidence
Digital evidence or electronic evidence is any probative information stored or transmitted in digital form that a party to a court case may use at trial...
(often referred to as electronically stored information
Electronically stored information
Electronically stored information, for the purpose of the Federal Rules of Civil Procedure is information created, manipulated, communicated, stored, and best utilized in digital form, requiring the use of computer hardware and software....
or ESI). Usually (but not always) a digital forensics analysis
Digital forensics
Digital forensics is a branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime...
is performed to recover evidence. A wider array of people are involved in eDiscovery (for example, forensic investigators, lawyers and IT managers) leading to problems with confusing terminology.
Data is identified as relevant by attorney
Lawyer
A lawyer, according to Black's Law Dictionary, is "a person learned in the law; as an attorney, counsel or solicitor; a person who is practicing law." Law is the system of rules of conduct established by the sovereign government of a society to correct wrongs, maintain the stability of political...
s and placed on legal hold
Legal hold
A legal hold is a process which an organization uses to preserve all forms of relevant information when litigation is reasonably anticipated....
. Evidence is then extracted and analysed using digital forensic procedures
Digital forensic process
The Digital forensic process is a recognised scientific and forensic process used in digital forensics investigations. Forensics researcher Eoghan Casey defines it as a number of steps from the original incident alert through to reporting of findings...
, and is usually converted into PDF
Portable Document Format
Portable Document Format is an open standard for document exchange. This file format, created by Adobe Systems in 1993, is used for representing documents in a manner independent of application software, hardware, and operating systems....
or TIFF form for use in court.
Electronic information is considered different from paper information because of its intangible form, volume, transience and persistence. Electronic information is usually accompanied by metadata
Metadata
The term metadata is an ambiguous term which is used for two fundamentally different concepts . Although the expression "data about data" is often used, it does not apply to both in the same way. Structural metadata, the design and specification of data structures, cannot be about data, because at...
that is not found in paper documents and that can play an important part as evidence (for example the date and time a document was written could be useful in a copyright
Copyright
Copyright is a legal concept, enacted by most governments, giving the creator of an original work exclusive rights to it, usually for a limited time...
case). The preservation of metadata from electronic documents creates special challenges to prevent spoliation
Spoliation of evidence
In law, spoliation of evidence is the intentional or negligent withholding, hiding, altering, or destroying of evidence relevant to a legal proceeding...
.
Electronic discovery was the subject of amendments to the Federal Rules of Civil Procedure
Federal Rules of Civil Procedure
The Federal Rules of Civil Procedure govern civil procedure in United States district courts. The FRCP are promulgated by the United States Supreme Court pursuant to the Rules Enabling Act, and then the United States Congress has 7 months to veto the rules promulgated or they become part of the...
(FRCP), effective December 1, 2006.
Individuals working in the field of electronic discovery commonly refer to the field as Litigation Support.
Types of ESI
Examples of the types of data included in e-discovery are e-mailE-mail
Electronic mail, commonly known as email or e-mail, is a method of exchanging digital messages from an author to one or more recipients. Modern email operates across the Internet or other computer networks. Some early email systems required that the author and the recipient both be online at the...
, instant messaging chats
Instant messaging
Instant Messaging is a form of real-time direct text-based chatting communication in push mode between two or more people using personal computers or other devices, along with shared clients. The user's text is conveyed over a network, such as the Internet...
, documents, accounting databases, CAD/CAM files, Web sites
Website
A website, also written as Web site, web site, or simply site, is a collection of related web pages containing images, videos or other digital assets. A website is hosted on at least one web server, accessible via a network such as the Internet or a private local area network through an Internet...
, and any other electronically stored information that could be relevant evidence in a law suit. Also included in e-discovery is "raw data
Raw data
'\putang inaIn computing, it may have the following attributes: possibly containing errors, not validated; in sfferent formats; uncoded or unformatted; and suspect, requiring confirmation or citation. For example, a data input sheet might contain dates as raw data in many forms: "31st January...
", which Forensic Investigators can review for hidden evidence. The original file format is known as the "native" format
Native and foreign format
A native format, in the context of software applications, refers to the file format which the application works with during creation, edition or publication of a file...
. Litigators may review material from e-discovery in one of several formats: printed paper, "native file,", PDF format, or as single- or multi-page TIFF images.
Electronic messages
Quite often, discovery evidence is either delayed or never produced, many times because of the inaccessibility of the data. For example, backupBackup
In information technology, a backup or the process of backing up is making copies of data which may be used to restore the original after a data loss event. The verb form is back up in two words, whereas the noun is backup....
tapes cannot be found, or are erased and reused.
This kind of situation reached its apex during the Zubulake v. UBS Warburg
Zubulake v. UBS Warburg
Zubulake v. UBS Warburg is a case heard between 2003 and 2005 in the United States District Court for the Southern District of New York. Judge Shira Scheindlin, presiding over the case, issued a series of groundbreaking opinions in the field of electronic discovery...
LLC lawsuit. Throughout the case, the plaintiff claimed that the evidence needed to prove the case existed in emails stored on UBS' own computer systems. Because the emails requested were either never found or destroyed, the court found that it was more likely that they existed than not. The court found that while the corporation's counsel directed that all potential discovery evidence, including emails, be preserved, the staff that the directive applied to did not follow through. This resulted in significant sanctions against UBS.
In 2006, the U.S. Supreme Court's amendments to the Federal Rules of Civil Procedure
Federal Rules of Civil Procedure
The Federal Rules of Civil Procedure govern civil procedure in United States district courts. The FRCP are promulgated by the United States Supreme Court pursuant to the Rules Enabling Act, and then the United States Congress has 7 months to veto the rules promulgated or they become part of the...
created a category for electronic records that, for the first time, explicitly named emails and instant message chats as likely records to be archived and produced when relevant. The rapid adoption of instant messaging as a business communications medium during the period 2005-2007 has made IM as ubiquitous in the workplace as email and created the need for companies to address archiving and retrieval of IM chats to the same extent they do for email.
With electronic message archiving in place for both email and IM it becomes a fairly simple task to retrieve any email or IM chat that might be used in e-discovery. Some archiving systems apply a unique code to each archived message or chat to establish authenticity. The systems prevent alterations to original messages, messages cannot be deleted, and the messages cannot be accessed by unauthorized persons.
Also important to complying with discovery of electronic records is the requirement that records be produced in a timely manner. The changes to the Federal Rules of Civil Procedure were the culmination of a period of debate and review that started in March 2000 when then Vice President Al Gore
Al Gore
Albert Arnold "Al" Gore, Jr. served as the 45th Vice President of the United States , under President Bill Clinton. He was the Democratic Party's nominee for President in the 2000 U.S. presidential election....
’s fundraising activities were being probed by the United States Department of Justice
United States Department of Justice
The United States Department of Justice , is the United States federal executive department responsible for the enforcement of the law and administration of justice, equivalent to the justice or interior ministries of other countries.The Department is led by the Attorney General, who is nominated...
. After White House counsel Beth Norton reported that it would take up to six months to search through 625 storage tapes, efforts began to mandate timelier discovery of electronic records.
Modern message archival systems allow legal and technology professionals to store and retrieve electronic messages efficiently and in a timely manner.
The formalized changes to the Federal Rules of Civil Procedure in December 2006 and in 2007 effectively forced civil litigants into a compliance mode with respect to their proper retention and management of electronically stored information
Electronically stored information
Electronically stored information, for the purpose of the Federal Rules of Civil Procedure is information created, manipulated, communicated, stored, and best utilized in digital form, requiring the use of computer hardware and software....
(ESI). The risks that litigants face as a result of improper management of ESI include spoliation of evidence, adverse inference, summary judgement, and sanctions. In some cases, such as Qualcomm v Broadcomm, attorneys can be brought before the bar and risk their livelihood.
Voicemail
Most employees have voicemailVoicemail
Voicemail is a computer based system that allows users and subscribers to exchange personal voice messages; to select and deliver voice information; and to process transactions relating to individuals, organizations, products and services, using an ordinary telephone...
that is stored on a computer until it is deleted by the user. Employers may have a duty to retain voicemail if there is an anticipation of litigation involving that employee.
Smartphones and Personal Digital Assistants
Many corporate employees have company-issued PDAPDA
A PDA is most commonly a Personal digital assistant, also known as a Personal data assistant, a mobile electronic device.PDA may also refer to:In science, medicine and technology:...
s or smartphone
Smartphone
A smartphone is a high-end mobile phone built on a mobile computing platform, with more advanced computing ability and connectivity than a contemporary feature phone. The first smartphones were devices that mainly combined the functions of a personal digital assistant and a mobile phone or camera...
s that may contain discoverable material. This can raise issues for collection, as the tools for acquiring data from such devices are difficult to find.
Reporting formats
Although petrifying documents to static image formats (tiff & jpegJPEG
In computing, JPEG . The degree of compression can be adjusted, allowing a selectable tradeoff between storage size and image quality. JPEG typically achieves 10:1 compression with little perceptible loss in image quality....
) had become the standard document review method for almost two decades, native format review has increased in popularity as a method for document review since around 2004. Because it requires the review of documents in their original file formats, applications and toolkits capable of opening multiple file formats have also become popular. This is also true in the ECM (Electronic Content Management) storage markets which are converging quickly with ESI technologies. Organizations susceptible to face eDiscovery requirements should especially be aware that backup tapes are not anymore regulatory compliant. They should be prepared to respond to any eDiscovery request within a reduced timeframe, being aware that if they rely on PST files, it would be a real time and people-consuming activity to search through terabytes of files not offering advanced indexing or searching features.
Petrification involves the conversion of native files into an image format that does not require use of the native applications. This is useful in the redaction
Redaction
Redaction is a form of editing in which multiple source texts are combined and subjected to minor alteration to make them into a single work. Often this is a method of collecting a series of writings on a similar theme and creating a definitive and coherent work...
of privilege
Privilege (evidence)
An evidentiary privilege is a rule of evidence that allows the holder of the privilege to refuse to provide evidence about a certain subject or to bar such evidence from being disclosed or used in a judicial or other proceeding....
d or sensitive information, since redaction tools for images are traditionally more mature, and easier to apply on uniform image types. Efforts to redact similarly petrified PDF files have resulted in the removal of redacted layers and exposure of redacted information, such as social security numbers and other private information.
Traditionally, electronic discovery vendors had been contracted to convert native files into TIFF images (for example 10 images for a 10 page Microsoft Word document) with a loadfile for use in image-based discovery review database applications. Increasingly, database review applications have embedded native file viewers with tiff-capabilities. With both native and image file capabilities, it could either increase or decrease the total necessary storage, since there may be multiple formats and files associated with each individual native file. Deployment, storage and best practices are becoming especially critical and necessary to maintain cost-effective strategies.
Common issues
A number of different people may be involved in an eDiscovery: lawyers for both parties, forensic specialists, IT managers, and records managers, amongst others. Forensic examination often uses unusual terminology and acronyms (for example "image" refers to the acquisition of digital media) which can lead to confusion.While attorneys involved in case litigation try their best to understand the companies and organization they represent, they may fail to understand the policies and practices that are in place in the company's IT
Information technology
Information technology is the acquisition, processing, storage and dissemination of vocal, pictorial, textual and numerical information by a microelectronics-based combination of computing and telecommunications...
department. As a result, some data may be destroyed after a legal hold has been issued by unknowing technicians performing their regular duties.
Given the complexities of modern litigation and the wide variety of information systems on the market, electronic discovery often requires IT professionals from both the attorney's office (or vendor) and the parties to the litigation to communicate directly to address technology incompatibilities and agree on production formats. Failure to get expert advice from knowledgeable personnel often leads to additional time and unforeseen costs in acquiring new technology or adapting existing technologies to accommodate the collected data.
See also
- Data retentionData retentionData retention defines the policies of persistent data and records management for meeting legal and business data archival requirements. A data retention policy weighs legal and privacy concerns against economics and need to know concerns to determine both the retention time, archival rules, data...
- Telecommunications data retentionTelecommunications data retentionIn the field of telecommunications, data retention generally refers to the storage of call detail records of telephony and internet traffic and transaction data by governments and commercial organisations...
- Telecommunications data retention
- Early case assessmentEarly case assessmentEarly case assessment refers to estimating risk to prosecute or defend a legal case. Global organizations deal with legal discovery and disclosure requests for electronically stored information "ESI" and paper documents on a regular basis.Over 90% of all cases settle prior to trial...
- Legal governance, risk management, and complianceLegal governance, risk management, and complianceLegal Governance, Risk Management, and Compliance or "LGRC", refers to the complex set of processes, rules, tools and systems used by corporate legal departments to adopt, implement and monitor an integrated approach to business problems....
External links
- Federal Judicial Center: Materials on Electronic Discovery
- The Electronic Discovery Reference Model (an industry group working on standards)
- Grand Valley State University: e-discovery video
- The Sedona Conference (Think tank of jurists, lawyers, experts, and academics)
- The Masters Conference (Federal Judges, lawyers, experts, International and academics)
- Women in eDiscovery (NON Profit Women's organization)