Randall Consulting

Topic #4- Rumblings on ESI Part III-A Document Retention Policy case

Document retention and Spoliation

The legal system is unhappy with any enterprise that destroys records for the purpose of positioning itself for possible future litigation, even if such litigation that is not specifically anticipated.  The courts tend to call this action spoliation. Below is an interesting case:

Sanctions ordered for ESI spoliation because defendant did not implement a litigation hold and start preserving email until start of the litigation even though there was a known issue.

Phillip M. Adams & Associates, L.L.C. v. Dell, Inc., 2009 U.S. Dist. LEXIS 26964 (D. Utah Mar. 27, 2009).  

A defendant’s email preservation system that consisted of instructing employees to preserve email of long term value on their local computers, coupled with “very little evidence compared to what would be expected,” led the court to conclude that the “safe harbor” of Fed. R. Civ. P. 37(e) did not apply and that the defendant should be sanctioned for spoliation.

Plaintiff in a patent infringement action claimed a defendant reverse engineered plaintiff’s patented programs for solving a defect in floppy disk controllers. Plaintiff sought sanctions against the defendant for spoliation when discovery from the defendant did not provide any evidence that the defendant had infringed upon plaintiff’s patents. In asserting spoliation, plaintiff relied on email and other evidence obtained by plaintiff in other litigation and from other defendants. The defendant countered that the lack of additional email was understandable because the defendant’s email servers were “not designed for archival purposes” and employees had been instructed to locally preserve only email “of long term value.”

The court held that the defendant’s practice of having employees archive email did “not establish the good-faith nature” of the defendant’s data management practices. Also, Fed. R. Civ. P. 37(e) did not provide a “safe harbor” for email apparently not saved by employees because the fact that the defendant had backed-up servers on which it stored financial data demonstrated that the defendant “does know how to protect data it regards as important.”

“Indisputably,” according to the court, “we have very little evidence compared to what would be expected.” Computer and component manufacturers such as the defendant “were sensitized” to the floppy disk controller errors due to class actions over the errors in 1999-2000, and the defendant should have been preserving evidence related to those errors since then. However, it was clear to the court that the defendant’s “lack of a retention policy and irresponsible data retention practices are responsible for the loss of significant data.” The court concluded that sanctions against the defendant were appropriate once prejudice to plaintiff from the loss was determined following additional briefing by the parties.
 

Defendant  says its “email servers are not designed for archival purposes, and employees are instructed to locally preserve any emails of long term value. ASUSTeK employees send and receive email via company email servers. Storage on ASUSTeK's email servers is limited, and the company directs employees to download those emails they deem important or necessary to perform their job function from the company email server to their individual company issued computer.

ASUSTeK informs its employees that any email not downloaded to an employee's computer are automatically overwritten to make room for additional email storage on ASUSTeK's servers. It is ASUSTeK's routine practice that its employees download to their individual computer those emails the employee deems important or necessary to perform his or her job function or comply  with legal or statutory obligations.”

When deciding whether to sanction a party for the spoliation of evidence, courts have considered a variety of factors, two of which generally carry the most weight: (1) the degree of culpability of the party who lost or destroyed the evidence, and (2) the degree of actual prejudice to the other party. The most widely known sanction is the adverse

Inference instruction, but other sanctions range from admonitions to granting judgment or dismissal.

In 2000, An employee allegedly obtained patented material and illegally used them to test ASUS motherboards. In 2005, ASUS received a demand letter threatening litigation.

Complaint filed in 2006. The question is this when did the duty to preserve arise?

The court found that the duty arose "in the 1999-2000 environment” “when several manufacturers were sued for billions of dollars in class action lawsuits related to defects. Is this fair to the defendants? Or is it a situation for patent infringement cases where the defendant is not innocent until proven guilty?

I find this to be an intriguing decision which is the main reason it is a topic on this blog. Since the court suspected bad faith on the company’s part yet no evidence was shown to prove it the judge still ordered sanctions. What do you think? Was sanctions warranted in this case?

One thing does seem certain here that the courts are becoming more and more distrustful of early aggressive records deletion policies. The problem in this case is the defendant did not have even a decent records retention policy in place.

To read the full opinion click here:

https://ecf.utd.uscourts.gov/cgi-bin/show_public_doc?2005cv0064-731

John Randall

President

Randall Consulting

Coming up: Planning and ESI

.

Topic #4- Rumblings on ESI Part III

ESI and Spoilation

 

 

 

What is spoliation? The alteration, destruction or concealment of information which is relevant to pending or threatened litigation, when a party knows or should know that the information is relevant and is on notice of the litigation or potential litigation, which denies the party’s opponent access to such access to such information to its detriment. Determining whether sanctions are warranted for spoliation of ESI is challenging because it is easier to intentionally or inadvertently delete or modify ESI and it is more difficult for parties to craft preservation policies that ensure that the appropriate data is being preserved.

 

Once a finding of spolia­tion has been made, courts may address whether the specific act of spoliation in question justifies an extreme sanction, such as an adverse inference jury instruction, issue preclusion, or judgment/dismissal, rather than a less severe sanction, such as additional discovery with shifting of costs and a monetary sanction

 

Once a finding of spolia­tion has been made, courts may address whether the specific act of spoliation in question justifies an extreme sanction, such as an adverse inference jury instruction, issue preclusion, or judgment/dismissal, rather than a less severe sanction, such as additional discovery with shifting of costs and a monetary sanction

 

ESI presents numerous issues regarding the scope of dis­covery, the allocation of costs, the form of production, and the preservation of data and spoliation. To manage these issues, courts need to understand the relevant technology at a level that allows communication between all parties involved.

 

 

2009  sampling of Court decisions in regards to Spoliation:

First published at Lexis.com

In Micron Technology, Inc. v. Rambus, Inc., (D.Del., Jan. 9, 2009)

 On January 9, 2009, District Court Judge Sue L. Robinson, in a patent infringement action that was filed in 2000, sanctioned defendant Rambus Inc. for spoliation conduct including the destruction of “innumerable documents relating to all aspects of Rambus’ business” dating back to the late 1990s. The dispute between Micron and Rambus related to Micron’s alleged infringement of multiple Rambus’ patents. After a bench trial on the issue of alleged spoliation of evidence and unclean hands, Judge Robinson declared that the patents in suit were unenforceable against Micron. For Rambus, this is the third decision from three different jurisdictions (Delaware, Virginia and California) where Rambus has been charged with spoliation of evidence based upon its licensing, litigation and record retention plans including its now-infamous “Shred Days.” The Virginia court (Rambus, Inc. v. Infineon Techs. AG, 220 F.R.D. 264 (E.D. Va. 2004) found that Rambus had spoliated evidence, however, a California court (Hynix Semiconductor Inc. v. Rambus, Inc., No. C-00-20905 RMW, 2006 WL 565893 (N.D. Cal. Jan. 5, 2006) found that Rambus did not spoliate evidence.

TeleQuest International Corp. v. Dedicated Business Systems, Inc., 2009 U.S. Dist. (D.N.J. Mar. 11, 2009)

An adverse inference sanction was imposed against a defendant who ran a defrag program and a data wiping program on his computer before turning the computer over to plaintiff’s forensics expert pursuant to a court order.

Plaintiff alleged its former employee stole a list of plaintiff’s customers and vendors. An email of a competitor of plaintiff sent by the former employee attached a printout of plaintiff’s customers and vendors. Two orders were issued to the competitor and the employee to produce their computers for forensic examination, but only the employee, appearing pro se, produced a computer for inspection. Plaintiff’s forensic consultant determined that the computer had been “defragged” two days before delivery and that a data wiping program had been run on the computer and then uninstalled on the day the computer was delivered. According to the forensic consultant, data could not be recovered from the hard drive of the computer using conventional forensic tools. Plaintiff sought sanctions, including a default judgment or an adverse inference, against the employee and the competitor.

The court noted that a default judgment already had been entered against the competitor for failure to plead. Although the former employee’s running of a “defrag” program and a data wiping program directly violated court orders and the employee’s duty to preserve evidence, the sanction of striking his answer and entering a default judgment was extreme. The “far lesser sanction” of an adverse inference sanction was warranted concerning “all materials deleted or destroyed following the commencement of this lawsuit.

Technical Sales Associates, Inc. v. Ohio Star Forge Co., 2009 U.S. Dist. LEXIS 22431 (E.D. Mich. Mar. 19, 2009

Sanctions against defendant were deemed appropriate because intentional deletion of evidence by defendant just prior to forensic examination was not protected by the safe harbor provision of Fed. R. Civ. P. 37(e) for information lost from the routine, good faith operation of an electronic information system.

Plaintiff sought sanctions against defendant for spoliation while defendant sought an order holding plaintiff and its computer forensics expert in contempt. In preparing to search defendant’s computer files for a disputed email, plaintiff’s computer forensics expert found that a file wiping program had been installed on a personal computer formerly used by the recipient of the disputed email and nearly 70,000 email documents had been deleted or altered so that they could not be read. Also, the recipient’s mailbox on his current computer was deleted just before the forensic examination. Defendant contended plaintiff and its computer forensics expert should be held in contempt for violating the stipulated court order for the examination by not first reporting to defendant what had been found during the examination. Plaintiff sought sanctions for the file wiping and the mailbox deletion.

The court held that the report to plaintiff did not violate the order to first allow defendant to review data captured from the search. The court’s order was “clearly aimed at protecting the discovery of actual data, not the absence of data.” On the other hand, sanctions to be determined at trial against defendant were appropriate. Defendant contended that the files wiped from the email recipient’s prior personal computer (after plaintiff had sought production of information from the files) had been “copied and relocated” to the recipient’s current computer. However, there was no way to prove that contention. Also, while defendant contended email folders deleted at 2 a.m. on the day before the examination could be recovered from the recycle bin, plaintiff’s expert declared that moving the files to the recycle bin could have changed dates of email in the folders to fall outside the range of dates being searched to find the disputed email.

The court concluded that defendant’s actions concerning files on the recipient’s computers violated defendant’s obligation to preserve evidence. Fed. R. Civ. P. 37(e) did not provide a “safe harbor” for defendant because the “rule is intended to protect a party from sanctions where the routine operation of a computer system inadvertently overwrites potentially relevant evidence, not when the party intentionally deletes electronic evidence.” The court held that monetary sanctions and plaintiff’s entitlement to an adverse inference instruction to the jury would be determined at trial.
 
 

In Adorno, et. al. v. Port Authority of New York and New Jersey, 2009 U.S. Dist. LEXIS 27505 (S.D.N.Y. Mar. 31, 2009),

District Court Judge Denny Chin granted defendants' summary judgment motion in part and denied plaintiffs' motion for spoliation sanctions holding that although defendants had a duty to preserve evidence, plaintiffs could not demonstrate that the evidence allegedly lost or destroyed by defendants was harmful to defendants' case. The case was brought by a group of Hispanic employees who sued the defendants alleging discrimination on the basis of national origin, race and ethnicity related to defendants' appointment and promotion practices.  Defendants moved for summary judgment and plaintiffs moved for spoliation sanctions under FRCP 37. In early 2005, plaintiffs filed a charge with the EEOC alleging discrimination. The EEOC issued right to sue letters to all plaintiffs in October 2005.  The complaint was filed in January 2006. The court noted that defendants' duty to preserve some documents arose in 2001 as a result of an on-going discrimination litigation filed on behalf of certain Asian officers. Because the Asian officer litigation overlapped to some extent with plaintiffs' claims, defendants had a duty to preserve relevant documents beginning in February 2001. In the Second Circuit, spoliation sanctions are warranted when the court determines that the party with control of the evidence was under an affirmative duty to preserve relevant documents and failed to do so.  A party seeking sanctions must show that the party with control over the evidence had a "culpable state of mind."  Spoliation sanctions are not limited to cases where the evidence was destroyed willfully or in bad faith, but may also be imposed when a party negligently loses or destroys evidence. The spoliated evidence must be relevant to the party's claims or defenses such that a reasonable trier of fact could find that it would support those claims or defenses. Defendants argued unsuccessfully that because the Asian officer EEOC charge did not relate to the specific promotion classifications at issue in the present litigation, defendants were not on notice to preserve documents related to those promotion classifications.  The court rejected the argument stating that the allegations in the Asian officer litigation were broad enough to cover all such promotions. The court concluded that defendants' failure to preserve documents was, at worst, negligent.  The court was unconvinced that defendants failed to put a litigation hold in place or otherwise communicate document preservation or destruction policies to its employees, such that a finding of gross negligence by defendants would be appropriate.  Plaintiffs cited witness deposition testimony indicating that certain employees were unaware of or unfamiliar with defendants' document preservation and destruction policies. The court found that this evidence alone was insufficient to demonstrate the lack of any such policies.  Nor was any evidence presented that defendants acted willfully or with the intent to destroy evidence that it believed would be adverse to its interests. The court refused to sanction defendants as the court was not persuaded that a reasonable jury could find that the evidence was harmful to defendants' defense of the case stating that "when the culpable party was negligent, there must be extrinsic evidence to demonstrate that the destroyed evidence was relevant and would have been unfavorable to the destroying party. Electronic Funds Solutions, LLC v. Murphy, “Electronic Funds II”, 2009 Cal. App. Unpub. LEXIS 4956 (Cal. App. 4th Dist. 2009) A second default judgment against defendants for wiping computer drives was affirmed because defendants continued after reversal of the first default judgment to fail to comply with a trial court discovery order. However, the court ordered the trial court to strike a "ruinous" $50 million punitive damages award included with the second default judgment. A $24 million default judgment entered as a discovery sanction against defendants who "wiped" a computer hard drive just prior to turning the drive over for plaintiff's inspection was reversed. Electronic Funds Solutions v. Murphy, "Electronic Funds I", 2005 Cal. App. LEXIS 1910 (Cal. App. 4th Dist. Dec. 14, 2005). Plaintiffs amended their complaint, and the trial court again struck defendants' answer. A second default judgment was entered for a total of $67.3 million, including $50 million in punitive damages. Defendants appealed again on the ground that there was no evidence that they had continued to disobey discovery orders following entry of the first default judgment. The court held that the trial court did not abuse its discretion in again issuing terminating sanctions because defendants still had not complied with existing discovery orders. Although defendants asserted they were willing to turn over copies of computer hard drives made before the drives were wiped clean, defendants failed to do so. Defendants also failed to take steps to produce materials that they claimed were turned over to a third party. However, the court instructed the trial court to modify its judgment by striking the $50 million punitive damages award. Plaintiffs had not introduced evidence of the financial condition or net worth of the individual defendants, and the $50 million punitive damages award was six times the corporate defendant's annual income. According to the court, "[s]uch an award would be ruinous to any company, not to mention its owners." Oz Optics v. Zeynep, 2009 Cal. App. Unpub. LEXIS 2952 (Cal. App. 1st Dist. Apr. 15, 2009) Monetary sanctions against defendant for scrubbing data on her laptop before turning it over for inspection pursuant to a court order were properly limited to an amount that would not affect her ability to defend herself. A jury determined that defendant, after being placed in charge of a company acquired by plaintiff, breached her employment agreement with plaintiff by working to set up a competitor of the acquired company while working for plaintiff. The jury awarded plaintiff $370,000 while awarding defendant $4,513 for plaintiff’s breach of its severance agreement with her. Defendant admitted that she used scrubbing software on the laptop issued to her by plaintiff just before turning the laptop over to plaintiff pursuant to a court order. Plaintiff appealed in part on the ground that a sanction for the destruction of evidence on the laptop should have been more than $90,000. The court affirmed the trial court’s sanction of $90,000 as a reasonable amount designed to compensate plaintiff for its attorney fees and costs in dealing with defendant’s discovery abuse. The trial court had found that a greater sanction would have affected defendant’s ability to defend herself. Plaintiff could not receive its full $234,000 in fees and costs incurred as a result of defendant scrubbing files because the sanction was meant to reimburse plaintiff rather than penalize defendant, and a sanction greater than $90,000 would have been punitive by hampering defendant from defending herself. Beard Research, Inc. v. Kates, 2009 Del. Ch. LEXIS 94 (Del. Ch. May 29, 2009) An ex-employee and his new employers were jointly obligated to preserve evidence in a misappropriation of trade secrets action and were sanctioned with an adverse inference for spoliation of evidence on the ex-employee's laptop computer. Plaintiffs, two related outsourcing firms in the chemicals industry, filed suit against a former employee and his subsequent employers for tortuous interference with business relations and misappropriation of trade secrets. Plaintiffs sought a default judgment against defendants as a sanction for the former employee's deletion of files on his laptop, replacement of the hard drive on the laptop and loss of the original hard drive, and additional deletion of files from the laptop just before its production for inspection pursuant to court order. The subsequent employer defendants contended that the former employee acted alone. According to the former employee, the original hard drive had simply been lost and files deleted just before production of the laptop were deleted only to avoid embarrassment over the nature of the files. The court pointed out that the two subsequent employers and the former employee became defendants in the action at the same time, hired the same attorney, and received plaintiffs’ document requests. The "complete absence of any evidence" that any of the defendants took any steps to preserve relevant evidence on the laptop thus led the court to conclude that the subsequent employers bore at least some responsibility for destruction of evidence on the laptop. An adverse inference was appropriate, according to the court, regarding a missing PowerPoint presentation to shareholders of a subsequent employer. However, an adverse inference was not appropriate regarding missing email to or from the former employee. There were two sides to any email, and no email from the other side of the former employee's email was discovered by plaintiffs. Defendants also were ordered jointly and severally to reimburse plaintiffs for their attorney fees and expenses, including expert expenses, in seeking sanctions. Realnetworks, Inc. v. DVD Copy Control Association, 2009 U.S. Dist. LEXIS 38221 (N.D. Cal. May 5, 2009)   Plaintiffs that could not locate notebook computers of an employee whose employment was terminated less than a week prior to the filing of plaintiffs’ action were sanctioned for failing to preserve the notebooks. However, sanctions were limited to an award of attorney fees and costs for defendants because the contents of the notebooks were unknown and other sources of information were available. Plaintiffs filed an action for a declaratory judgment that they had not breached a license agreement on technology to prevent copying of videos, and defendants counterclaimed for breach of contract. Defendants deposed an employee of plaintiffs whose job had been terminated just prior to plaintiffs’ action. The former employee testified that she had been instructed to delete relevant email and that she had turned over her notebooks when she left her job. Another employee of plaintiffs testified at deposition that he deleted “tons of stuff” every day. A consultant for plaintiffs testified at deposition that he had not been instructed to preserve relevant documents before erasing documentation at the end of his consultancy. Defendants sought sanctions, including an order precluding plaintiffs from impeaching the former employee’s testimony and precluding plaintiffs from offering testimony from the consultant or other employee. The court first determined that plaintiffs’ duty to preserve evidence in anticipation of the litigation arose only shortly before plaintiffs released their product and defendants objected to the release. According to the court, “[a] general concern over litigation does not trigger a duty to preserve evidence,” and plaintiffs’ duty to preserve evidence arose only when plaintiffs knew there was potential litigation. That duty arose after the consultant had finished his work and disposed of documents. In any event, the consultant located a backup drive at his home with non-email documents and turned over those documents. The court noted that the employee who testified that he deleted “tons of stuff” submitted a declaration after his deposition that he had not deleted relevant email or documents received or generated in connection with his work and that he had not been instructed to delete any email. Also, the content of the lost notebooks of the former employee was not known, and information on the five issues the former employee was expected to testify about was available from sources other than the notebooks. The court thus concluded that an order precluding plaintiffs from impeaching or contradicting the former employee’s testimony was not warranted. However, plaintiffs had failed to preserve the notebooks, and defendants were awarded their attorney fees and costs for pursuing the evidence of spoliation of the notebooks. Next Up: ESI and Planning John Randall President Randall Consulting

 

 

 

 

 

Topic #4- Rumblings on ESI Part II

ESI and FCRP

Randall Consulting started an electronic discovery training blog to help educate those in this industry who have not received the proper training or whose skill with electronic discovery is minimal. With the economy still trying to regroup itself many companies cannot afford training. This blog hopefully will help bridge the gap until they can. The goal here is to provide two updates a week.

The first topic was on the electronic discovery training issue and discussed why this type of blog was needed in this industry.

http://randallconsulting.typepad.com/randall001/2009/06/the-electronic-discovery-training-issue.html

The next topic set up all future blog entries. It was on the EDRM model. The best way to give structured information was to do it around EDRM.

http://randallconsulting.typepad.com/randall001/2009/06/topic-1-the-edrm-model.html

Topic #2 which is the first step in the EDRM model discussed information management. It is imperative for those in litigation support law firms and companies to not only know the EDRM model but to be able to discuss areas within each step. For project managers and those in sales at service providers need to know much more than their present skill set.

http://randallconsulting.typepad.com/randall001/2009/06/topic-2-information-management-.html

Topic #3 went into great detail about ECM systems and in particular SharePoint.

http://randallconsulting.typepad.com/randall001/2009/07/ecm-and-the-sharepoint-riddle.html

The last blog entry was on ESI. I have decided to write a series of entries containing areas of ESI. The first such entry was on where is the ESI and what type of sources are there.

http://randallconsulting.typepad.com/randall001/2009/07/topic-4-rumblings-on-esi-part-i.html

This next entry is on ESI and FCRP. It focuses on two areas the meet and confer conference from 26(f) as well as having a broader understanding of inaccessible data. Also, note we are still in the first phase of the EDRM model which is information management and understanding the areas within.

 

ESI Rules 16 and 26(f)

We know that electronic over paper can substantially reduce copying and storage costs; enable a requesting party to more easily review, organize, and manage information. Attorneys need to address ESI in the earliest stages of litigation. All too often, attorneys view their obligation to “meet and con­fer” under Federal Rule of Civil Procedure 26(f) as a quick jog around the block.  When ESI is involved, judges should always insist that a meaningful meet and confer conference take place.

Amended Rule 26(f) also directs parties to discuss issues re­lated to claims of privilege or protection as trial-preparation mate­rial. If the parties agree on a procedure to assert such claims after production, they should discuss whether to ask the court to include their agreement in an order.

Attorneys are expected to understand their client's information infrastructure in order to negotiate what material will be disclosed, how it will be produced and in what timeframe. If the party has concerns about preservation, costs or burden, this is the time that these arguments need to be raised. For the conference to be effective, attorneys must be familiar with how their clients use computers on a daily basis and understand what infor­mation is available, how routine comput­er operations may change it, and what is entailed in producing it. Attorneys need to identify the persons who are most knowledgeable about the client’s computer system and meet with them well in advance of the Rule 26 conference; it may also be advisable to have those per­sons present at the conference.

During the [26(f)] conference, the parties should confer regarding some of the following matters:

—  ESI in general. Attorneys should attempt to agree on what steps the parties will take to segregate and preserve in order to avoid accusations of spoliation.

—  E-mail information. Attorneys should attempt to agree on the scope of e-mail discovery and search protocol. Where is all the e-mail located at?

—  Deleted information. Attorneys should attempt to agree on whether responsive deleted information still exists and the extent to which computer forensics is needed.

—  Back-up and archival data. Attorneys should attempt to agree on whether responsive back-up and archival data exists, the extent to which back-up and archival data is needed, and who will bear the cost of obtaining such data.

—  Format and media. Attorneys should attempt to agree on the format and media to be used in the production of ESI.

—  Reasonably accessible information and costs. Attorneys should attempt to determine if any responsive ESI is not reasonably accessible. Is there ESI that is only accessible by incurring undue burdens or costs

—  Privileged or trial preparation materials. Attorneys should attempt to reach an agreement regarding what will happen in the event privileged or trial preparation materials are inadvertently disclosed. If the disclosing party inadvertently produces privileged or trial preparation materials, it must notify the requesting party of such disclosure. After the requesting party is notified, it must return, sequester, or destroy all information and copies and may not use or disclose this information until the claim of privilege or protection as trial preparation materials is resolved.

—  The parties may agree to provide a quick peek, where the responding party provides certain requested materials for initial viewing without waiving any privilege or protection.

—  The parties may also establish a claw-back agreement, whereby materials that are disclosed w/o intent to waive privilege or protection are not waived and are returned to the responding party, so long as the responding party identifies the materials mistakenly produced.

The amendments also include a good faith and reasonableness "safe harbor" provision that may protect companies in the event potentially relevant evidence is not preserved due to unintentional conduct. This provision will depend on the company's history of compliance as well as its ability to substantiate its retention policies.

Training, assessments and creating a litigation response plan are the first steps counsel should take to avoid costly mistakes.

Amended Rule 16(b) provides that scheduling orders may include provisions for disclosure or discovery of ESI and any agreements the parties reach for asserting claims of privilege or of protection as trial-preparation material after production.

 Effective December 1, 2006, the term “data compilations” was changed to “electronically stored information,” clarifying a party’s duty to include ESI in its disclosures.

ESI Under Rules 26(b)(1) and 26(b)(2)

The central issue in almost all discovery management is the deter­mination of scope. Under Rule 26(b)(1), parties may obtain discov­ery relevant to the “claim or defense of any party. That is not privileged or protected as trial preparation material. In addition, the court may order discovery of information relevant to the “subject matter involved in the action” for “good cause.”

FRCP 26(b)(2)(B) This amendment allows a producing party to not produce ESI which is "not reasonably accessible because of undue burden or cost" without good cause.  This rule depends upon the producing party notifying both the court and the requesting party of the ESI which it deems to not be reasonably accessible.  The Committee Note to FRCP 26 goes further in explaining to the extent possible, the responding party should provide enough detail in its notice of the location and types of inaccessible media that may contain relevant ESI so the requesting party can evaluate to see the burdens and costs of providing the discovery and the likelihood of finding responsive information.

The requesting party may need discovery to test the assertion that the information is not reasonably accessible. Such discovery may involve taking depositions of those knowledgeable about the responding party’s information systems; some form of inspection of the data sources; and requiring the responding party to conduct a sampling of information contained on the sources identified as not reasonably accessible.

In cases involving vast amounts of ESI, or ESI that is not available from reasonably accessible sources, the cost to the producing party in locating the information, reviewing it for privilege, and otherwise preparing it for production may be much greater than in conventional discovery. Thus it may be appropriate to shift at least some of the production costs from the producing party to the requesting party. Two major cases—Rowe Entertainment, Inc. v. William Morris Agency, Inc. and Zubulake v. UBS Warburg LLC have introduced multifactor tests to determine when cost shifting is appropriate.

In Rowe, a racial discrimination case, the defendants objected to the production of e-mail information from backup media on the grounds that such discovery was unlikely to provide relevant in­formation and would invade the privacy of nonparties, and they requested that the plaintiffs to bear the costs if production was required. The court concluded that the e-mail information sought by the plaintiffs was indeed relevant and that a blanket order pre­cluding its discovery was therefore unjustified. However, balancing eight fac­tors derived from case law, the court required the plaintiffs to pay for the recovery and production of the e-mail backups, except for the cost of screening for relevance and privilege. The eight Rowe factors were (1) the specificity of the discovery requests; (2) the likelihood of discovering critical information; (3) the availability of such information from other sources; (4) the purposes for which the responding party maintains the requested data; (5) the relative benefit to the parties of obtaining the information; (6) the total cost associated with production; (7) the relative ability of each party to control costs and its incentive to do so; and (8) the resources avail­able to each party.

Zubulake, a gender discrimination case, also involved the pro­duction of e-mails that existed only on backup tapes and other ar­chived media. After concluding that the plaintiff’s request was rel­evant to her claims, the court held that the usual rules of discovery generally apply when the data is in accessible format, but that cost shifting could be considered when data were relatively inac­cessible, such as on backup tapes, and substituted seven factors for the Rowe factors. The Zubulake factors, in order of importance, were (1) the extent to which the request is specifically tailored to discover relevant information; (2) the availability of such informa­tion from other sources; (3) the total cost of production, compared to the amount in controversy; (4) the total cost of production, com­pared to the resources available to each party; (5) the relative abil­ity of each party to control costs and its incentive to do so; (6) the importance of the issues at stake in the litigation; and (7) the rela­tive benefits to the parties of obtaining the information. The court emphasized that the factors should be weighted according to their importance.

Other courts have adopted or modified the Rowe and Zubulake decisions. The Committee Notes to Rule 26(b)(2)(B) makes explicit the authority to shift costs when information that is not reasonably accessible is being produced.

Next Up:

ESI and Spoliation

John Randall

President

Randall Consulting

www.randallconsulting.net

 

Topic #4- Rumblings on ESI Part I

The next series of blog entries will focus on different aspects of ESI. This first part focuses on where is the ESI and what types of ESI are out there. You may need a magnifying glass for this journey.

 

Electronically Stored Information

Part I

Where Should I Look?

 

Discovery of ESI is generally thought of from the perspective of typical business documents such as email, office documents, or even databases. ESI that could be relevant to a particular litigation can be found in many forms and in many places. You may not even be aware of where all of ESI is maintained. More importantly, the client probably is not aware of where all potentially relevant ESI that is outside of its control, but that may be accessible.

So where does your client maintain its ESI? This will require the assistance of people responsible for the client’s Information Technology (IT) systems. Although these people will generally have good knowledge of the actual systems and software used, they may not have the knowledge of the types of information maintained. Attorneys must have enough knowledge of typical ESI locations and information content to communicate with IT personnel and guide the search for ESI.

We know or should know that ESI differs from paper information in several ways. The volume of ESI is almost always greater than paper information, and it may be located in multiple places. For example, draft and final versions of a single report may be stored electronically in multiple places. Some aspects of ESI have no counterpart in paper, meta­data being the most obvious. Metadata, which most computer us­ers never see, provide information about an electronic file, such as the date it was created, its author, when and by whom it was edited, what edits were made, and, in the case of e-mail, the history of its trans­mission. Also we know that deleting an electronic document does not get rid of it, as shredding a paper document would. An electronic document may be recov­ered from the hard drive, to the extent it has not been overwritten, and may be available on the computers of other people and on archival media or backup tapes used for disaster recovery rather than archival purposes.

Deleted Files- If you delete a file, Microsoft Windows removes it from your view; however, at that same point in time, the contents of the file are still stored on your hard drive. In addition to removing the file from your view, Microsoft Windows flags the space where the file still resides, as available. Depending on whether the space is needed for other files and how much time has passed determines how much of the original file remains.

File Slack- Files are created in varying lengths depending on their contents. DOS, Windows and Windows NT-based computers store files in fixed length blocks of data called clusters. Rarely do file sizes exactly match the size of one or multiple clusters perfectly. The data storage space that exists from the end of the file to the end of the last cluster assigned to the file is called "file slack". Cluster sizes vary in length depending on the operating system involved. Larger cluster sizes mean more file slack.

A brief summary of some of the more important ESI sources:

E-mail is a highly valuable source of information important in litigation. The content of e-mail may be informal and also subject to differing interpretations. Email may be found on company email servers; backup tapes; general server backup tapes; individual PCs used by company employees; personal PCs used by employees who do work at home; Blackberrys; Personal Digital Assistant (PDA) devices; servers of external email or individual storage devices such as USB drives and flash drives.

E-mail is used for outside communications and is often forwarded, copied, or blind copied. Because of this emails can end up on the same list of devices for many different custodians. Emails can also be archived or converted to different formats and copied and posted on web pages. Email can be maintained in different directories (folders) on various devices. Some of these directories may not be visible or known to the email user. For example, most email programs will keep copies of mail sent in a “Sent Folder” or copies of deleted email in a “Deleted Folder” and each email program may use different names for these typical folders.

E-mail deleted from an individual PC may not be deleted from an email server that received or sent the email. Email may also be filtered out by spam filters at both a server and an individual PC level and found in different directories than email that is not filtered out. Email may also be simply deleted without human intervention by a spam filter or by limits placed on individual email accounts by an IT administrator. However, even if deleted, email may still be recoverable. All this sounds like fun…eh?

E-mail may also contain attachments of files that contain hundreds of pages of printed information, video or audio recordings, or information only accessible with specialized software such as a database or accounting program.

Digital Files Typical documents include word processing files, spreadsheet files, and presentation files. This category of documents also includes pictures, scanned images, and video or audio recordings. Digital files can be easily copied, modified, combined with other files, and then transferred to a PC or server located anywhere.  Digital files can be found on all of the same devices and storage media listed above for e-mail.

Although digital files are easily copied, modified, and transferred, actual permanent deletion of these files is not easy and often will leave traces of the deletion activity. Even if the files cannot be recovered, the typical programs and processes used to permanently delete files and the information they contain will cause an “absence” of deleted or temporary files that are present on any PC or server. This absence of “deleted files” can often be a definitive indication that files have been intentionally deleted. This is again something that a computer forensic expert may be able to report.

Other Types of ESI Company data repositories are typically databases containing business information. This information can consist of accounting records, personnel records, payroll records, sales records, mailing lists, customer lists, or any other large quantity of information that a company needs or wants to retain over time. The important thing to remember with database repositories is that the relationships between individual data records may be more important than the actual data elements. Print copies of ESI records will not generally reveal the metadata that is most valuable here.

 

• Company and individual voice mail systems and telephone answering devices may contain phone messages for long periods of time.

 

• Individual PC operating system logs maintain similar data as network system records although the level of detail is generally not as extensive.

 

• Fax server or fax machine logs show dates, times, phone numbers, and the number of pages sent.

 

• Phone records show dates, times, phone numbers, and the length of calls made calls

 

• Credit card records will show dates, times, amounts, and the vendor for charges made.

 

• Bank records will show dates, times, amounts, and the transmitting or receiving entity for each transaction.

 

• Web sites may also contain information that has been deleted from other locations. Google search results have a small link shown as cached in the search results pages. Clicking on this link will provide the content of the web page that is stored on Google servers even though the original page is no longer available.

 

• Systems that use Radio Frequency Identification (RFID) tags can also record the date and time that an identification card comes within range of a sensing station.

• Many cell phones now have Global Positioning System (GPS) chips installed that can be turned on by law enforcement agencies or the owner of the phone. The Global Positioning System ("GPS") is a network of two dozen satellites orbiting at 12,000 miles above the earth. The network is capable of pinpointing precise locations anywhere on the planet. There are Internet based service providers that can track the location of a GPS enabled cell phone over an extended period of time.

• Many automobiles have GPS navigation devices that maintain a record of the automobile’s location and speed over an extended period of time.

 

• The United States Post Office and commercial delivery services such as FedEx, UPS, DHL, and Airborne allow tracking of packages and mail that shows mailing time and location, delivery time and location, and may also show the recipient’s signature.

                 

• Companies often elect to install or are required by law to install video or audio surveillance equipment covering a portion or most of their facilities. Many of these sources of ESI may require specialized software and personnel with the technical expertise to extract the information that is to be produced or analyze the information that was produced.

 

ESI, like physical records, are subject to document retention policies and thus may be intentionally destroyed as part of a legitimate document retention policy. However, if litigation is reasonably anticipated, there is an obligation to suspend standard document retention policies and preserve discoverable information. IT staff responsible for implementing document retention policies with respect to ESI may not even be aware that there is an obligation to preserve ESI that they destroy on a routine periodic basis. Failure to notify responsible IT staff of what ESI must be preserved so that ESI is not destroyed could subject a company to sanctions.

ESI, unlike physical records, is also subject to automatic destruction without any explicit action. Network and computer log files are usually limited by time or size so that new activity overwrites old activity. There may be a need to suspend the automatic destruction of ESI so that discoverable ESI that is subject to preservation obligations is not inadvertently destroyed.

Let us now talk about the latest addition to the ESI family of discoverability which is Social Network Sites.

Social networking websites have taken the world by storm.  MySpace and Facebook, users chronicle the intimate details of their lives, post their current relationship status, provide opinions, and upload up to the minute photographs. However, users often post without considering the trail of muddy footprints they leave behind. Investigators visit these sites when looking into an individual for purposes of employment, college admission, background checks, investigating criminal activity, and so forth.

This growing use of social network information raises an important question in regards to electronic discovery:

If social networking sites are accessed using an employer's computer is it then fair game when it comes to electronic discovery?

One thing to remember is computers keep track of users internet passwords so their MySpace, Facebook, Twitter password and not to mention g-mail, hotmail, yahoo, AOL and other accounts when they sign on.  This is because the website browser takes note of and saves the password. This information is stored in a protected area of Windows. Since the password does exist on the employer's hard drive, that password and therefore access to the social networking page, is it a situation where the possession and custody is now with the employer?  With the right IT know-how, the employer can easily access the site. So what happens when the employee or employer gets sued, does the social networking page become responsive to document requests? Since I am not a lawyer I could not answer that but it does bring up some intriguing questions.

This blog entry does not constitute legal advice.

Next Up: Part II- FRCP and ESI

John Randall

President

Randall Consulting

jrandall@randallconsulting.net

www.randallconsulting.net

 

Topic #3 ECM and the SharePoint Riddle

This next blog entry is a continuation from the previous entry which was on information management.

Within the last 3-4 months the doubts I have in regard to Microsoft SharePoint have increased. The same questions have arisen such as why is SharePoint so popular? Why do many experts in this space think that this is the end all and be all solution for ECM and Electronic Discovery?  A so-called silver bullet or even better no assemblies required just add plenty of water.  Some truly believe this is the only way electronic discovery should be handled in the future. My pessimism has risen because of this. Do they see something I do not? Is price the overriding reason to use SharePoint? Why is SharePoint as popular as say something like Twitter? Is SharePoint more like a religious experience? Or are they simply holding on to this platform as blind faith and hopes that this will be the ultimate ECM solution in the future?  I decided to delve much deeper into this and have spent the last 30 plus days researching and looking into SharePoint. The goal for me was to see if I could possibly convert to this religion that so many on a few lit support boards already are members of. After this research will I become a SharePoint preacher? Would I be able to spread the word to future followers?  Below are my thoughts and analysis.

Before beginning let us talk about ECM.

As defined by AIIM “Enterprise content management (ECM) is the strategies, methods, and tools used to capture, manage, store, preserve, and deliver content and documents related to organizational processes. ECM tools and strategies allow the management of an organization's unstructured information, wherever that information exists.”

AIIM (www.aiim.org) is the community that provides education, research, and best practices to help organizations find, control, and optimize their information. For over 60 years, AIIM has been the leading non-profit organization focused on helping users to understand the challenges associated with managing documents, content, records, and business processes.

So instead of saving your documents onto your desktop or shared network folder where it may not be found for months it would save the documents into a system that will help you keep track of them. ECM is not just software it is a platform. Where as everyone can agree on using an organized and systematic approach to their management of information. This is of course why it is stored, kept, shared and ultimately retrieved.  Below are a few of the major players in regards to ECM Platforms:

• Open Text - LiveLink ECM Suite
  - HQ: Waterloo, Canada
• Vignette - V7 ECM Suite
  - HQ: Austin, TX, USA
• Hyland Software, Inc. - OnBase 7.2
  - HQ: Westlake, OH
• Microsoft - Microsoft Office SharePoint Server 2007
  - HQ: Redmond, WA
• Documentum (EMC) - Documentum D6
  - HQ: Pleasanton, CA, USA
• Xerox - DocuShare 6.1
  - HQ: Stamford, CT, USA
• IBM - FileNet P8 Platform
  - HQ: White Plains, NY, USA
• Interwoven - ECM Solutions
  - HQ: San Jose, CA, USA
• Oracle - Enterprise Content Management Suite 10gR3
  - HQ: Redwood Shores, CA, USA

·          

State of ECM Industry 2009

“AIIM's annual State of the ECM Industry research found that compared to recent years, cost saving has taken a clear lead over compliance as the main business driver for investments in document and records management. Email is still out of control, with 55% of organizations having little or no confidence that important emails are recorded, complete and retrievable. Management of content types like SMS/text messages, blogs and wikis are largely off the corporate radar in 75% of organizations and their lack of inclusion in the corporate archive is a major risk.”

What is SharePoint?

SharePoint is a portal-based collaboration platform from Microsoft. It might be the most widely available collaboration tool for legal professionals, especially because it is attached to the Microsoft Office suite of tools. SharePoint has drawn a lot of attention from large law firms, particularly over the past few years and especially among those firms running a Windows Server environment with Office and Exchange.

SharePoint is contained almost entirely within a web browser, making it easy for anyone with an Internet connection to access. It can be used internally or externally. SharePoint also integrates well with Microsoft Office products and it can be configured to pull data from other law office programs, databases, websites, and other sources. A SharePoint portal page is composed of modules called web parts, which are components that implement a specified function. SharePoint sites are customizable, meaning that users can add the web parts they need for each specific project. A SharePoint site can be used within a firm or company via the organization's intranet, made available to clients on an extranet, or published to the Internet.

The SharePoint family is composed of three different applications. Windows SharePoint Services (WSS) is the basic application, and is a free add-on to the Windows Server. WSS offers the basic portal infrastructure, allowing collaborative editing of documents and document organization as well as creation of to do lists, alerts, and discussion boards. The Microsoft Office SharePoint Server (MOSS) improves upon WSS, adding better document management, search functionality, navigation features, RSS…etc.. For more experienced SharePoint users, the Microsoft Office SharePoint Designer (MOSD) is an HTML editor that helps users design their own SharePoint sites. It also provides enterprise search, document and content management, and workflow tools, while featuring strong integration with Microsoft Office.

With MOSS, users can view and edit Office documents directly within a web browser, making it simple to work on documents from anyplace with an Internet connection. The SharePoint services can also be accessed through Microsoft Outlook, and users of Office 2007 can synchronize their Outlook calendars and task lists with their SharePoint counterparts. Another advantage of using SharePoint in a firm environment is the product's ability to fully index all of the documents stored in its library, so that users throughout the organization can search across all libraries. Yes, there is much strength with using SharePoint.

With respect to records management and compliance, Office SharePoint Server 2007 offers the following integrated capabilities says Microsoft:

• “Information management and retention enables organizations to control the way content is managed to enforce compliance with corporate, legal or governmental policies. To define information management policies for their sites, organizations can use the following predefined policy features individually or in combination: auditing, bar codes and expiration. They also can develop custom information management policies.
• The Records Center site template is designed to help organizations implement their records management and retention programs. This site template extends standard Office SharePoint Server 2007 features with additional records management capabilities: vault abilities that help ensure the integrity of records stored within the Records Center, records routing, information management policy enforcement, and the ability to add records that are subject to litigation or investigations to a hold list.
• eDiscovery in Office SharePoint Server 2007 enables organizations to streamline the process of document retrieval with integrated search and the placing of records on hold that are subject to litigation or investigation. Records on hold are suspended from records management policies and expiration, ensuring access throughout the litigation process.

Information Rights Management (IRM) allows organizations to limit the actions that users can take on files that have been downloaded from SharePoint lists or libraries. IRM encrypts the downloaded files and limits the set of users and programs that are allowed to decrypt these files. IRM can also limit the rights of the users who are allowed to read files so they cannot take actions such as printing copies of the files or copying text from them.”

SharePoint Weaknesses

There are several scalability issues with SharePoint.  Based on numerous surveys done by large corporations as well as AIIM the greatest amongst these are performance issues when increasing quantity or size of the document repository, lack of support for complex document architectures.

The AIIM survey of 512 organizations that use MOSS has found that while a majority of organizations use SharePoint, less than half use it at the enterprise level. It seems based on this survey most are using it for its robust file sharing capabilities.

MOSS is rarely used for more advanced functions including:

·         Web content management

·         Digital asset management

·         Business Process automation

·         Records management

·         Forms management

Of those tools and applications that are being used:

·         Search

·         Collaboration

·         Portal

·         Document management

Of all the surveys and reports I have seen online and asked large organizations the number one reason for deploying MOSS: it’s inexpensive. While I will agree that MOSS is an inexpensive solution for a small organization, it is in fact quite the opposite for a large organization looking at enterprise licenses – a scenario which can be outrageously expensive and even considerably more than the top of the line ECM platforms on the market. So again I scratch my head at those recommending this for large firms and organizations who state it is cheap.

This is from the AIIM website in regards to a survey on Sharepoint. “SharePoint is great on document management and extremely poor with records management. The records management functionality, known as the Records Center is a MOSS component and does not function in Windows SharePoint Services (WSS).  Thus, it requires further investment beyond SharePoint itself.  Also, the Records Center is a platform, not a near-turnkey records application like that available from other companies that offer ECM platforms.  Most records functionality has to be built using the toolset.  There is no auto-declaration of records for example, nor rendition control or Clawbacks. SharePoint provides only the most basic of records management features.

Put frankly, SharePoint does not provide adequate functionality to address records management and therefore is not heavily used in applications that require this functionality, such as compliance and e-discovery.  Those who are using it “somewhat” are likely using the SharePoint environment as a platform for file sharing – only – and have augmented it with other integrated technologies and processes.

Clearly RM is an area of functionality that most users believe SharePoint does not provide well.  So, in scenarios in which RM level control is desired or necessary, then yes, the integration of an RM system with SharePoint can be very beneficial, and render a less-risk SharePoint environment.  On the other hand this does not simplify deployment – but rather complicates it.  Integration of additional functionality such as RM, was the number 2 greatest challenge sited by survey takers, second only to adequate personnel and toolsets to execute the integration.

SharePoint provides facilitated sharing of files, not necessarily in a secure or controlled environment (read RM.) So yes, in my opinion, an organization should "reignite" its RM programs when deploying SharePoint, at least to ask IF the SharePoint collections warrant records-level control. If an executive is insisting that SharePoint should “simply be implemented to ultimately solve the records management issues of the organization", a little and simple education is necessary.  This is a perception problem of what records management is. Have him/her describe what they mean by records management.  If focus is on facilitated sharing – proceed.  If focus is, on the other hand, on compliance, point them to these survey findings and beg that they learn from the experiences of those that went before him/her.

File sharing and file document storage are basically the same functionality. File sharing is typically used to denote common access (sharing) of files over a network, usually following a peer-to-peer model. (This is the big difference between file sharing and a simple file system – the ability to share files without replication.)  And, yes, based on the survey responses as well as my general, observations, the MOST predominate application of SharePoint is file sharing/ file document storage.”

The SharePoint system effectively captures and manages records and revisions. The new SharePoint release states new electronic Discovery capabilities that allow the user to search for and find specific SharePoint records in response to a discovery request. This capability is wonderful but only if you are responding to a small discovery request against just SharePoint records. With electronic discovery we all know that the odds of only searching one type of ESI are slim.  They are some weaknesses because of this.

The search results page is limited to just 50 entries. Electronic Discovery usually never targets just a SharePoint data set.  The EDD process targets large amounts of ESI that spans numerous applications and storage locations. Because of this an effective EDD capability will allow the user to create a search query that will find all responsive ESI across data producing systems including Exchange email, Instant Messaging systems, Windows file systems and SharePoint systems. This is another point how SharePoint is not there yet with electronic discovery.

While SharePoint may not compete feature to feature, it does compete to be positioned as a viable competitor to any ECM platform. As Microsoft continues to enhance SharePoint, and there is every indication that they will, it will only become more competitive. Although they have not yet integrated it into SharePoint Microsoft has leapfrogged into enterprise search with the acquisition of FAST.

To date, FAST functionality has not yet been tightly integrated into the SharePoint environment, but that is inevitable, and when that occurs, the features and functions of FAST will catapult SharePoint enterprise search functionality, positioning it among the leaders.

SharePoint still has many problems in terms of weaknesses with records management and electronic discovery. It is an ECM solution that will continue to get better as these weaknesses are addressed. Yet after this research and talking with many people in the ECM space I will not switch religions until SharePoint shows me much more. Until SharePoint fixes its number of issues with records management it will never be at the top of my list for ECM solutions.

Records Management features  D

Electronic Discovery features   C

File Sharing features  A+

Overall Grade B

References to this blog article:

http://www.ecmconnection.com

http://www.aiim.org/

http://www.microsoft.com/en/us/default.aspx

http://www.informationarchitected.com/

Next Up: Rumblings on ESI

John Randall

President

Randall Consulting

jrandall@randallconsulting.net

www.randallconsulting.net