Randall Consulting

Topic #4- Rumblings on ESI Part III-A Document Retention Policy case

Document retention and Spoliation

The legal system is unhappy with any enterprise that destroys records for the purpose of positioning itself for possible future litigation, even if such litigation that is not specifically anticipated.  The courts tend to call this action spoliation. Below is an interesting case:

Sanctions ordered for ESI spoliation because defendant did not implement a litigation hold and start preserving email until start of the litigation even though there was a known issue.

Phillip M. Adams & Associates, L.L.C. v. Dell, Inc., 2009 U.S. Dist. LEXIS 26964 (D. Utah Mar. 27, 2009).  

A defendant’s email preservation system that consisted of instructing employees to preserve email of long term value on their local computers, coupled with “very little evidence compared to what would be expected,” led the court to conclude that the “safe harbor” of Fed. R. Civ. P. 37(e) did not apply and that the defendant should be sanctioned for spoliation.

Plaintiff in a patent infringement action claimed a defendant reverse engineered plaintiff’s patented programs for solving a defect in floppy disk controllers. Plaintiff sought sanctions against the defendant for spoliation when discovery from the defendant did not provide any evidence that the defendant had infringed upon plaintiff’s patents. In asserting spoliation, plaintiff relied on email and other evidence obtained by plaintiff in other litigation and from other defendants. The defendant countered that the lack of additional email was understandable because the defendant’s email servers were “not designed for archival purposes” and employees had been instructed to locally preserve only email “of long term value.”

The court held that the defendant’s practice of having employees archive email did “not establish the good-faith nature” of the defendant’s data management practices. Also, Fed. R. Civ. P. 37(e) did not provide a “safe harbor” for email apparently not saved by employees because the fact that the defendant had backed-up servers on which it stored financial data demonstrated that the defendant “does know how to protect data it regards as important.”

“Indisputably,” according to the court, “we have very little evidence compared to what would be expected.” Computer and component manufacturers such as the defendant “were sensitized” to the floppy disk controller errors due to class actions over the errors in 1999-2000, and the defendant should have been preserving evidence related to those errors since then. However, it was clear to the court that the defendant’s “lack of a retention policy and irresponsible data retention practices are responsible for the loss of significant data.” The court concluded that sanctions against the defendant were appropriate once prejudice to plaintiff from the loss was determined following additional briefing by the parties.
 

Defendant  says its “email servers are not designed for archival purposes, and employees are instructed to locally preserve any emails of long term value. ASUSTeK employees send and receive email via company email servers. Storage on ASUSTeK's email servers is limited, and the company directs employees to download those emails they deem important or necessary to perform their job function from the company email server to their individual company issued computer.

ASUSTeK informs its employees that any email not downloaded to an employee's computer are automatically overwritten to make room for additional email storage on ASUSTeK's servers. It is ASUSTeK's routine practice that its employees download to their individual computer those emails the employee deems important or necessary to perform his or her job function or comply  with legal or statutory obligations.”

When deciding whether to sanction a party for the spoliation of evidence, courts have considered a variety of factors, two of which generally carry the most weight: (1) the degree of culpability of the party who lost or destroyed the evidence, and (2) the degree of actual prejudice to the other party. The most widely known sanction is the adverse

Inference instruction, but other sanctions range from admonitions to granting judgment or dismissal.

In 2000, An employee allegedly obtained patented material and illegally used them to test ASUS motherboards. In 2005, ASUS received a demand letter threatening litigation.

Complaint filed in 2006. The question is this when did the duty to preserve arise?

The court found that the duty arose "in the 1999-2000 environment” “when several manufacturers were sued for billions of dollars in class action lawsuits related to defects. Is this fair to the defendants? Or is it a situation for patent infringement cases where the defendant is not innocent until proven guilty?

I find this to be an intriguing decision which is the main reason it is a topic on this blog. Since the court suspected bad faith on the company’s part yet no evidence was shown to prove it the judge still ordered sanctions. What do you think? Was sanctions warranted in this case?

One thing does seem certain here that the courts are becoming more and more distrustful of early aggressive records deletion policies. The problem in this case is the defendant did not have even a decent records retention policy in place.

To read the full opinion click here:

https://ecf.utd.uscourts.gov/cgi-bin/show_public_doc?2005cv0064-731

John Randall

President

Randall Consulting

Coming up: Planning and ESI

.

Topic #4- Rumblings on ESI Part II

ESI and FCRP

Randall Consulting started an electronic discovery training blog to help educate those in this industry who have not received the proper training or whose skill with electronic discovery is minimal. With the economy still trying to regroup itself many companies cannot afford training. This blog hopefully will help bridge the gap until they can. The goal here is to provide two updates a week.

The first topic was on the electronic discovery training issue and discussed why this type of blog was needed in this industry.

http://randallconsulting.typepad.com/randall001/2009/06/the-electronic-discovery-training-issue.html

The next topic set up all future blog entries. It was on the EDRM model. The best way to give structured information was to do it around EDRM.

http://randallconsulting.typepad.com/randall001/2009/06/topic-1-the-edrm-model.html

Topic #2 which is the first step in the EDRM model discussed information management. It is imperative for those in litigation support law firms and companies to not only know the EDRM model but to be able to discuss areas within each step. For project managers and those in sales at service providers need to know much more than their present skill set.

http://randallconsulting.typepad.com/randall001/2009/06/topic-2-information-management-.html

Topic #3 went into great detail about ECM systems and in particular SharePoint.

http://randallconsulting.typepad.com/randall001/2009/07/ecm-and-the-sharepoint-riddle.html

The last blog entry was on ESI. I have decided to write a series of entries containing areas of ESI. The first such entry was on where is the ESI and what type of sources are there.

http://randallconsulting.typepad.com/randall001/2009/07/topic-4-rumblings-on-esi-part-i.html

This next entry is on ESI and FCRP. It focuses on two areas the meet and confer conference from 26(f) as well as having a broader understanding of inaccessible data. Also, note we are still in the first phase of the EDRM model which is information management and understanding the areas within.

 

ESI Rules 16 and 26(f)

We know that electronic over paper can substantially reduce copying and storage costs; enable a requesting party to more easily review, organize, and manage information. Attorneys need to address ESI in the earliest stages of litigation. All too often, attorneys view their obligation to “meet and con­fer” under Federal Rule of Civil Procedure 26(f) as a quick jog around the block.  When ESI is involved, judges should always insist that a meaningful meet and confer conference take place.

Amended Rule 26(f) also directs parties to discuss issues re­lated to claims of privilege or protection as trial-preparation mate­rial. If the parties agree on a procedure to assert such claims after production, they should discuss whether to ask the court to include their agreement in an order.

Attorneys are expected to understand their client's information infrastructure in order to negotiate what material will be disclosed, how it will be produced and in what timeframe. If the party has concerns about preservation, costs or burden, this is the time that these arguments need to be raised. For the conference to be effective, attorneys must be familiar with how their clients use computers on a daily basis and understand what infor­mation is available, how routine comput­er operations may change it, and what is entailed in producing it. Attorneys need to identify the persons who are most knowledgeable about the client’s computer system and meet with them well in advance of the Rule 26 conference; it may also be advisable to have those per­sons present at the conference.

During the [26(f)] conference, the parties should confer regarding some of the following matters:

—  ESI in general. Attorneys should attempt to agree on what steps the parties will take to segregate and preserve in order to avoid accusations of spoliation.

—  E-mail information. Attorneys should attempt to agree on the scope of e-mail discovery and search protocol. Where is all the e-mail located at?

—  Deleted information. Attorneys should attempt to agree on whether responsive deleted information still exists and the extent to which computer forensics is needed.

—  Back-up and archival data. Attorneys should attempt to agree on whether responsive back-up and archival data exists, the extent to which back-up and archival data is needed, and who will bear the cost of obtaining such data.

—  Format and media. Attorneys should attempt to agree on the format and media to be used in the production of ESI.

—  Reasonably accessible information and costs. Attorneys should attempt to determine if any responsive ESI is not reasonably accessible. Is there ESI that is only accessible by incurring undue burdens or costs

—  Privileged or trial preparation materials. Attorneys should attempt to reach an agreement regarding what will happen in the event privileged or trial preparation materials are inadvertently disclosed. If the disclosing party inadvertently produces privileged or trial preparation materials, it must notify the requesting party of such disclosure. After the requesting party is notified, it must return, sequester, or destroy all information and copies and may not use or disclose this information until the claim of privilege or protection as trial preparation materials is resolved.

—  The parties may agree to provide a quick peek, where the responding party provides certain requested materials for initial viewing without waiving any privilege or protection.

—  The parties may also establish a claw-back agreement, whereby materials that are disclosed w/o intent to waive privilege or protection are not waived and are returned to the responding party, so long as the responding party identifies the materials mistakenly produced.

The amendments also include a good faith and reasonableness "safe harbor" provision that may protect companies in the event potentially relevant evidence is not preserved due to unintentional conduct. This provision will depend on the company's history of compliance as well as its ability to substantiate its retention policies.

Training, assessments and creating a litigation response plan are the first steps counsel should take to avoid costly mistakes.

Amended Rule 16(b) provides that scheduling orders may include provisions for disclosure or discovery of ESI and any agreements the parties reach for asserting claims of privilege or of protection as trial-preparation material after production.

 Effective December 1, 2006, the term “data compilations” was changed to “electronically stored information,” clarifying a party’s duty to include ESI in its disclosures.

ESI Under Rules 26(b)(1) and 26(b)(2)

The central issue in almost all discovery management is the deter­mination of scope. Under Rule 26(b)(1), parties may obtain discov­ery relevant to the “claim or defense of any party. That is not privileged or protected as trial preparation material. In addition, the court may order discovery of information relevant to the “subject matter involved in the action” for “good cause.”

FRCP 26(b)(2)(B) This amendment allows a producing party to not produce ESI which is "not reasonably accessible because of undue burden or cost" without good cause.  This rule depends upon the producing party notifying both the court and the requesting party of the ESI which it deems to not be reasonably accessible.  The Committee Note to FRCP 26 goes further in explaining to the extent possible, the responding party should provide enough detail in its notice of the location and types of inaccessible media that may contain relevant ESI so the requesting party can evaluate to see the burdens and costs of providing the discovery and the likelihood of finding responsive information.

The requesting party may need discovery to test the assertion that the information is not reasonably accessible. Such discovery may involve taking depositions of those knowledgeable about the responding party’s information systems; some form of inspection of the data sources; and requiring the responding party to conduct a sampling of information contained on the sources identified as not reasonably accessible.

In cases involving vast amounts of ESI, or ESI that is not available from reasonably accessible sources, the cost to the producing party in locating the information, reviewing it for privilege, and otherwise preparing it for production may be much greater than in conventional discovery. Thus it may be appropriate to shift at least some of the production costs from the producing party to the requesting party. Two major cases—Rowe Entertainment, Inc. v. William Morris Agency, Inc. and Zubulake v. UBS Warburg LLC have introduced multifactor tests to determine when cost shifting is appropriate.

In Rowe, a racial discrimination case, the defendants objected to the production of e-mail information from backup media on the grounds that such discovery was unlikely to provide relevant in­formation and would invade the privacy of nonparties, and they requested that the plaintiffs to bear the costs if production was required. The court concluded that the e-mail information sought by the plaintiffs was indeed relevant and that a blanket order pre­cluding its discovery was therefore unjustified. However, balancing eight fac­tors derived from case law, the court required the plaintiffs to pay for the recovery and production of the e-mail backups, except for the cost of screening for relevance and privilege. The eight Rowe factors were (1) the specificity of the discovery requests; (2) the likelihood of discovering critical information; (3) the availability of such information from other sources; (4) the purposes for which the responding party maintains the requested data; (5) the relative benefit to the parties of obtaining the information; (6) the total cost associated with production; (7) the relative ability of each party to control costs and its incentive to do so; and (8) the resources avail­able to each party.

Zubulake, a gender discrimination case, also involved the pro­duction of e-mails that existed only on backup tapes and other ar­chived media. After concluding that the plaintiff’s request was rel­evant to her claims, the court held that the usual rules of discovery generally apply when the data is in accessible format, but that cost shifting could be considered when data were relatively inac­cessible, such as on backup tapes, and substituted seven factors for the Rowe factors. The Zubulake factors, in order of importance, were (1) the extent to which the request is specifically tailored to discover relevant information; (2) the availability of such informa­tion from other sources; (3) the total cost of production, compared to the amount in controversy; (4) the total cost of production, com­pared to the resources available to each party; (5) the relative abil­ity of each party to control costs and its incentive to do so; (6) the importance of the issues at stake in the litigation; and (7) the rela­tive benefits to the parties of obtaining the information. The court emphasized that the factors should be weighted according to their importance.

Other courts have adopted or modified the Rowe and Zubulake decisions. The Committee Notes to Rule 26(b)(2)(B) makes explicit the authority to shift costs when information that is not reasonably accessible is being produced.

Next Up:

ESI and Spoliation

John Randall

President

Randall Consulting

www.randallconsulting.net

 

Topic #4- Rumblings on ESI Part I

The next series of blog entries will focus on different aspects of ESI. This first part focuses on where is the ESI and what types of ESI are out there. You may need a magnifying glass for this journey.

 

Electronically Stored Information

Part I

Where Should I Look?

 

Discovery of ESI is generally thought of from the perspective of typical business documents such as email, office documents, or even databases. ESI that could be relevant to a particular litigation can be found in many forms and in many places. You may not even be aware of where all of ESI is maintained. More importantly, the client probably is not aware of where all potentially relevant ESI that is outside of its control, but that may be accessible.

So where does your client maintain its ESI? This will require the assistance of people responsible for the client’s Information Technology (IT) systems. Although these people will generally have good knowledge of the actual systems and software used, they may not have the knowledge of the types of information maintained. Attorneys must have enough knowledge of typical ESI locations and information content to communicate with IT personnel and guide the search for ESI.

We know or should know that ESI differs from paper information in several ways. The volume of ESI is almost always greater than paper information, and it may be located in multiple places. For example, draft and final versions of a single report may be stored electronically in multiple places. Some aspects of ESI have no counterpart in paper, meta­data being the most obvious. Metadata, which most computer us­ers never see, provide information about an electronic file, such as the date it was created, its author, when and by whom it was edited, what edits were made, and, in the case of e-mail, the history of its trans­mission. Also we know that deleting an electronic document does not get rid of it, as shredding a paper document would. An electronic document may be recov­ered from the hard drive, to the extent it has not been overwritten, and may be available on the computers of other people and on archival media or backup tapes used for disaster recovery rather than archival purposes.

Deleted Files- If you delete a file, Microsoft Windows removes it from your view; however, at that same point in time, the contents of the file are still stored on your hard drive. In addition to removing the file from your view, Microsoft Windows flags the space where the file still resides, as available. Depending on whether the space is needed for other files and how much time has passed determines how much of the original file remains.

File Slack- Files are created in varying lengths depending on their contents. DOS, Windows and Windows NT-based computers store files in fixed length blocks of data called clusters. Rarely do file sizes exactly match the size of one or multiple clusters perfectly. The data storage space that exists from the end of the file to the end of the last cluster assigned to the file is called "file slack". Cluster sizes vary in length depending on the operating system involved. Larger cluster sizes mean more file slack.

A brief summary of some of the more important ESI sources:

E-mail is a highly valuable source of information important in litigation. The content of e-mail may be informal and also subject to differing interpretations. Email may be found on company email servers; backup tapes; general server backup tapes; individual PCs used by company employees; personal PCs used by employees who do work at home; Blackberrys; Personal Digital Assistant (PDA) devices; servers of external email or individual storage devices such as USB drives and flash drives.

E-mail is used for outside communications and is often forwarded, copied, or blind copied. Because of this emails can end up on the same list of devices for many different custodians. Emails can also be archived or converted to different formats and copied and posted on web pages. Email can be maintained in different directories (folders) on various devices. Some of these directories may not be visible or known to the email user. For example, most email programs will keep copies of mail sent in a “Sent Folder” or copies of deleted email in a “Deleted Folder” and each email program may use different names for these typical folders.

E-mail deleted from an individual PC may not be deleted from an email server that received or sent the email. Email may also be filtered out by spam filters at both a server and an individual PC level and found in different directories than email that is not filtered out. Email may also be simply deleted without human intervention by a spam filter or by limits placed on individual email accounts by an IT administrator. However, even if deleted, email may still be recoverable. All this sounds like fun…eh?

E-mail may also contain attachments of files that contain hundreds of pages of printed information, video or audio recordings, or information only accessible with specialized software such as a database or accounting program.

Digital Files Typical documents include word processing files, spreadsheet files, and presentation files. This category of documents also includes pictures, scanned images, and video or audio recordings. Digital files can be easily copied, modified, combined with other files, and then transferred to a PC or server located anywhere.  Digital files can be found on all of the same devices and storage media listed above for e-mail.

Although digital files are easily copied, modified, and transferred, actual permanent deletion of these files is not easy and often will leave traces of the deletion activity. Even if the files cannot be recovered, the typical programs and processes used to permanently delete files and the information they contain will cause an “absence” of deleted or temporary files that are present on any PC or server. This absence of “deleted files” can often be a definitive indication that files have been intentionally deleted. This is again something that a computer forensic expert may be able to report.

Other Types of ESI Company data repositories are typically databases containing business information. This information can consist of accounting records, personnel records, payroll records, sales records, mailing lists, customer lists, or any other large quantity of information that a company needs or wants to retain over time. The important thing to remember with database repositories is that the relationships between individual data records may be more important than the actual data elements. Print copies of ESI records will not generally reveal the metadata that is most valuable here.

 

• Company and individual voice mail systems and telephone answering devices may contain phone messages for long periods of time.

 

• Individual PC operating system logs maintain similar data as network system records although the level of detail is generally not as extensive.

 

• Fax server or fax machine logs show dates, times, phone numbers, and the number of pages sent.

 

• Phone records show dates, times, phone numbers, and the length of calls made calls

 

• Credit card records will show dates, times, amounts, and the vendor for charges made.

 

• Bank records will show dates, times, amounts, and the transmitting or receiving entity for each transaction.

 

• Web sites may also contain information that has been deleted from other locations. Google search results have a small link shown as cached in the search results pages. Clicking on this link will provide the content of the web page that is stored on Google servers even though the original page is no longer available.

 

• Systems that use Radio Frequency Identification (RFID) tags can also record the date and time that an identification card comes within range of a sensing station.

• Many cell phones now have Global Positioning System (GPS) chips installed that can be turned on by law enforcement agencies or the owner of the phone. The Global Positioning System ("GPS") is a network of two dozen satellites orbiting at 12,000 miles above the earth. The network is capable of pinpointing precise locations anywhere on the planet. There are Internet based service providers that can track the location of a GPS enabled cell phone over an extended period of time.

• Many automobiles have GPS navigation devices that maintain a record of the automobile’s location and speed over an extended period of time.

 

• The United States Post Office and commercial delivery services such as FedEx, UPS, DHL, and Airborne allow tracking of packages and mail that shows mailing time and location, delivery time and location, and may also show the recipient’s signature.

                 

• Companies often elect to install or are required by law to install video or audio surveillance equipment covering a portion or most of their facilities. Many of these sources of ESI may require specialized software and personnel with the technical expertise to extract the information that is to be produced or analyze the information that was produced.

 

ESI, like physical records, are subject to document retention policies and thus may be intentionally destroyed as part of a legitimate document retention policy. However, if litigation is reasonably anticipated, there is an obligation to suspend standard document retention policies and preserve discoverable information. IT staff responsible for implementing document retention policies with respect to ESI may not even be aware that there is an obligation to preserve ESI that they destroy on a routine periodic basis. Failure to notify responsible IT staff of what ESI must be preserved so that ESI is not destroyed could subject a company to sanctions.

ESI, unlike physical records, is also subject to automatic destruction without any explicit action. Network and computer log files are usually limited by time or size so that new activity overwrites old activity. There may be a need to suspend the automatic destruction of ESI so that discoverable ESI that is subject to preservation obligations is not inadvertently destroyed.

Let us now talk about the latest addition to the ESI family of discoverability which is Social Network Sites.

Social networking websites have taken the world by storm.  MySpace and Facebook, users chronicle the intimate details of their lives, post their current relationship status, provide opinions, and upload up to the minute photographs. However, users often post without considering the trail of muddy footprints they leave behind. Investigators visit these sites when looking into an individual for purposes of employment, college admission, background checks, investigating criminal activity, and so forth.

This growing use of social network information raises an important question in regards to electronic discovery:

If social networking sites are accessed using an employer's computer is it then fair game when it comes to electronic discovery?

One thing to remember is computers keep track of users internet passwords so their MySpace, Facebook, Twitter password and not to mention g-mail, hotmail, yahoo, AOL and other accounts when they sign on.  This is because the website browser takes note of and saves the password. This information is stored in a protected area of Windows. Since the password does exist on the employer's hard drive, that password and therefore access to the social networking page, is it a situation where the possession and custody is now with the employer?  With the right IT know-how, the employer can easily access the site. So what happens when the employee or employer gets sued, does the social networking page become responsive to document requests? Since I am not a lawyer I could not answer that but it does bring up some intriguing questions.

This blog entry does not constitute legal advice.

Next Up: Part II- FRCP and ESI

John Randall

President

Randall Consulting

jrandall@randallconsulting.net

www.randallconsulting.net

 

Topic #3 ECM and the SharePoint Riddle

This next blog entry is a continuation from the previous entry which was on information management.

Within the last 3-4 months the doubts I have in regard to Microsoft SharePoint have increased. The same questions have arisen such as why is SharePoint so popular? Why do many experts in this space think that this is the end all and be all solution for ECM and Electronic Discovery?  A so-called silver bullet or even better no assemblies required just add plenty of water.  Some truly believe this is the only way electronic discovery should be handled in the future. My pessimism has risen because of this. Do they see something I do not? Is price the overriding reason to use SharePoint? Why is SharePoint as popular as say something like Twitter? Is SharePoint more like a religious experience? Or are they simply holding on to this platform as blind faith and hopes that this will be the ultimate ECM solution in the future?  I decided to delve much deeper into this and have spent the last 30 plus days researching and looking into SharePoint. The goal for me was to see if I could possibly convert to this religion that so many on a few lit support boards already are members of. After this research will I become a SharePoint preacher? Would I be able to spread the word to future followers?  Below are my thoughts and analysis.

Before beginning let us talk about ECM.

As defined by AIIM “Enterprise content management (ECM) is the strategies, methods, and tools used to capture, manage, store, preserve, and deliver content and documents related to organizational processes. ECM tools and strategies allow the management of an organization's unstructured information, wherever that information exists.”

AIIM (www.aiim.org) is the community that provides education, research, and best practices to help organizations find, control, and optimize their information. For over 60 years, AIIM has been the leading non-profit organization focused on helping users to understand the challenges associated with managing documents, content, records, and business processes.

So instead of saving your documents onto your desktop or shared network folder where it may not be found for months it would save the documents into a system that will help you keep track of them. ECM is not just software it is a platform. Where as everyone can agree on using an organized and systematic approach to their management of information. This is of course why it is stored, kept, shared and ultimately retrieved.  Below are a few of the major players in regards to ECM Platforms:

• Open Text - LiveLink ECM Suite
  - HQ: Waterloo, Canada
• Vignette - V7 ECM Suite
  - HQ: Austin, TX, USA
• Hyland Software, Inc. - OnBase 7.2
  - HQ: Westlake, OH
• Microsoft - Microsoft Office SharePoint Server 2007
  - HQ: Redmond, WA
• Documentum (EMC) - Documentum D6
  - HQ: Pleasanton, CA, USA
• Xerox - DocuShare 6.1
  - HQ: Stamford, CT, USA
• IBM - FileNet P8 Platform
  - HQ: White Plains, NY, USA
• Interwoven - ECM Solutions
  - HQ: San Jose, CA, USA
• Oracle - Enterprise Content Management Suite 10gR3
  - HQ: Redwood Shores, CA, USA

·          

State of ECM Industry 2009

“AIIM's annual State of the ECM Industry research found that compared to recent years, cost saving has taken a clear lead over compliance as the main business driver for investments in document and records management. Email is still out of control, with 55% of organizations having little or no confidence that important emails are recorded, complete and retrievable. Management of content types like SMS/text messages, blogs and wikis are largely off the corporate radar in 75% of organizations and their lack of inclusion in the corporate archive is a major risk.”

What is SharePoint?

SharePoint is a portal-based collaboration platform from Microsoft. It might be the most widely available collaboration tool for legal professionals, especially because it is attached to the Microsoft Office suite of tools. SharePoint has drawn a lot of attention from large law firms, particularly over the past few years and especially among those firms running a Windows Server environment with Office and Exchange.

SharePoint is contained almost entirely within a web browser, making it easy for anyone with an Internet connection to access. It can be used internally or externally. SharePoint also integrates well with Microsoft Office products and it can be configured to pull data from other law office programs, databases, websites, and other sources. A SharePoint portal page is composed of modules called web parts, which are components that implement a specified function. SharePoint sites are customizable, meaning that users can add the web parts they need for each specific project. A SharePoint site can be used within a firm or company via the organization's intranet, made available to clients on an extranet, or published to the Internet.

The SharePoint family is composed of three different applications. Windows SharePoint Services (WSS) is the basic application, and is a free add-on to the Windows Server. WSS offers the basic portal infrastructure, allowing collaborative editing of documents and document organization as well as creation of to do lists, alerts, and discussion boards. The Microsoft Office SharePoint Server (MOSS) improves upon WSS, adding better document management, search functionality, navigation features, RSS…etc.. For more experienced SharePoint users, the Microsoft Office SharePoint Designer (MOSD) is an HTML editor that helps users design their own SharePoint sites. It also provides enterprise search, document and content management, and workflow tools, while featuring strong integration with Microsoft Office.

With MOSS, users can view and edit Office documents directly within a web browser, making it simple to work on documents from anyplace with an Internet connection. The SharePoint services can also be accessed through Microsoft Outlook, and users of Office 2007 can synchronize their Outlook calendars and task lists with their SharePoint counterparts. Another advantage of using SharePoint in a firm environment is the product's ability to fully index all of the documents stored in its library, so that users throughout the organization can search across all libraries. Yes, there is much strength with using SharePoint.

With respect to records management and compliance, Office SharePoint Server 2007 offers the following integrated capabilities says Microsoft:

• “Information management and retention enables organizations to control the way content is managed to enforce compliance with corporate, legal or governmental policies. To define information management policies for their sites, organizations can use the following predefined policy features individually or in combination: auditing, bar codes and expiration. They also can develop custom information management policies.
• The Records Center site template is designed to help organizations implement their records management and retention programs. This site template extends standard Office SharePoint Server 2007 features with additional records management capabilities: vault abilities that help ensure the integrity of records stored within the Records Center, records routing, information management policy enforcement, and the ability to add records that are subject to litigation or investigations to a hold list.
• eDiscovery in Office SharePoint Server 2007 enables organizations to streamline the process of document retrieval with integrated search and the placing of records on hold that are subject to litigation or investigation. Records on hold are suspended from records management policies and expiration, ensuring access throughout the litigation process.

Information Rights Management (IRM) allows organizations to limit the actions that users can take on files that have been downloaded from SharePoint lists or libraries. IRM encrypts the downloaded files and limits the set of users and programs that are allowed to decrypt these files. IRM can also limit the rights of the users who are allowed to read files so they cannot take actions such as printing copies of the files or copying text from them.”

SharePoint Weaknesses

There are several scalability issues with SharePoint.  Based on numerous surveys done by large corporations as well as AIIM the greatest amongst these are performance issues when increasing quantity or size of the document repository, lack of support for complex document architectures.

The AIIM survey of 512 organizations that use MOSS has found that while a majority of organizations use SharePoint, less than half use it at the enterprise level. It seems based on this survey most are using it for its robust file sharing capabilities.

MOSS is rarely used for more advanced functions including:

·         Web content management

·         Digital asset management

·         Business Process automation

·         Records management

·         Forms management

Of those tools and applications that are being used:

·         Search

·         Collaboration

·         Portal

·         Document management

Of all the surveys and reports I have seen online and asked large organizations the number one reason for deploying MOSS: it’s inexpensive. While I will agree that MOSS is an inexpensive solution for a small organization, it is in fact quite the opposite for a large organization looking at enterprise licenses – a scenario which can be outrageously expensive and even considerably more than the top of the line ECM platforms on the market. So again I scratch my head at those recommending this for large firms and organizations who state it is cheap.

This is from the AIIM website in regards to a survey on Sharepoint. “SharePoint is great on document management and extremely poor with records management. The records management functionality, known as the Records Center is a MOSS component and does not function in Windows SharePoint Services (WSS).  Thus, it requires further investment beyond SharePoint itself.  Also, the Records Center is a platform, not a near-turnkey records application like that available from other companies that offer ECM platforms.  Most records functionality has to be built using the toolset.  There is no auto-declaration of records for example, nor rendition control or Clawbacks. SharePoint provides only the most basic of records management features.

Put frankly, SharePoint does not provide adequate functionality to address records management and therefore is not heavily used in applications that require this functionality, such as compliance and e-discovery.  Those who are using it “somewhat” are likely using the SharePoint environment as a platform for file sharing – only – and have augmented it with other integrated technologies and processes.

Clearly RM is an area of functionality that most users believe SharePoint does not provide well.  So, in scenarios in which RM level control is desired or necessary, then yes, the integration of an RM system with SharePoint can be very beneficial, and render a less-risk SharePoint environment.  On the other hand this does not simplify deployment – but rather complicates it.  Integration of additional functionality such as RM, was the number 2 greatest challenge sited by survey takers, second only to adequate personnel and toolsets to execute the integration.

SharePoint provides facilitated sharing of files, not necessarily in a secure or controlled environment (read RM.) So yes, in my opinion, an organization should "reignite" its RM programs when deploying SharePoint, at least to ask IF the SharePoint collections warrant records-level control. If an executive is insisting that SharePoint should “simply be implemented to ultimately solve the records management issues of the organization", a little and simple education is necessary.  This is a perception problem of what records management is. Have him/her describe what they mean by records management.  If focus is on facilitated sharing – proceed.  If focus is, on the other hand, on compliance, point them to these survey findings and beg that they learn from the experiences of those that went before him/her.

File sharing and file document storage are basically the same functionality. File sharing is typically used to denote common access (sharing) of files over a network, usually following a peer-to-peer model. (This is the big difference between file sharing and a simple file system – the ability to share files without replication.)  And, yes, based on the survey responses as well as my general, observations, the MOST predominate application of SharePoint is file sharing/ file document storage.”

The SharePoint system effectively captures and manages records and revisions. The new SharePoint release states new electronic Discovery capabilities that allow the user to search for and find specific SharePoint records in response to a discovery request. This capability is wonderful but only if you are responding to a small discovery request against just SharePoint records. With electronic discovery we all know that the odds of only searching one type of ESI are slim.  They are some weaknesses because of this.

The search results page is limited to just 50 entries. Electronic Discovery usually never targets just a SharePoint data set.  The EDD process targets large amounts of ESI that spans numerous applications and storage locations. Because of this an effective EDD capability will allow the user to create a search query that will find all responsive ESI across data producing systems including Exchange email, Instant Messaging systems, Windows file systems and SharePoint systems. This is another point how SharePoint is not there yet with electronic discovery.

While SharePoint may not compete feature to feature, it does compete to be positioned as a viable competitor to any ECM platform. As Microsoft continues to enhance SharePoint, and there is every indication that they will, it will only become more competitive. Although they have not yet integrated it into SharePoint Microsoft has leapfrogged into enterprise search with the acquisition of FAST.

To date, FAST functionality has not yet been tightly integrated into the SharePoint environment, but that is inevitable, and when that occurs, the features and functions of FAST will catapult SharePoint enterprise search functionality, positioning it among the leaders.

SharePoint still has many problems in terms of weaknesses with records management and electronic discovery. It is an ECM solution that will continue to get better as these weaknesses are addressed. Yet after this research and talking with many people in the ECM space I will not switch religions until SharePoint shows me much more. Until SharePoint fixes its number of issues with records management it will never be at the top of my list for ECM solutions.

Records Management features  D

Electronic Discovery features   C

File Sharing features  A+

Overall Grade B

References to this blog article:

http://www.ecmconnection.com

http://www.aiim.org/

http://www.microsoft.com/en/us/default.aspx

http://www.informationarchitected.com/

Next Up: Rumblings on ESI

John Randall

President

Randall Consulting

jrandall@randallconsulting.net

www.randallconsulting.net

Topic #2 Information Management

Electronic Discovery Education Blog

Records Management is now Information Management in the EDRM Model.

The first step of the EDRM model was called Records Management, at some stage it changed to Information Management.  It now recognizes that every organization manages information, but not every organization manages their information as records.  The whole environment of litigation and e-discovery elevates records management to a level where it has to become a corporate competency.

We all know or should know that more than 95% of the records being created today are electronic. Along with the overwhelming growth of electronic messages –such as e-mail and instant messaging - the management of electronic records has become an extremely critical business issue. How that information is managed has significant business, legal, and technology ramifications. Ultimately, it doesn't matter what medium is used to create, deliver, or store information when determining if content is a record and should be managed accordingly. This article will describe in more detail Information management. From an electronic discovery point of view those for those in litigation support, paralegals at firms as well as those in sales and technical engineers at service providers. The need to understand this important first step is important in having a grasp on the EDRM model. Before going further let us stop and go over some key terms in relation to information management.

Litigation Hold

A litigation hold is a directive to your client and others to preserve electronic data or other information pertaining to the litigation. A litigation hold directive should include information regarding the summary and basic nature of the case, the relevant parties and the claims. The directive should include instructions to halt any paper or electronic information destruction policies. Also, retention schedules should be reviewed and revised to ensure preservation of both electronic and hardcopy information. The directive should advise parties as to privilege protection that is given to ESI involving the attorney-client relationship as well as work product.

Preservation

Oftentimes, attorneys are under the impression that the duty to preserve arises when they receive a preservation letter from the opposing party, a preservation order from the court or a discovery request from the opposing party. This is simply not the case. As noted by FED. R. CIV. P. 37, Advisory Committee Note of 2006, "[a] preservation obligation may arise from many sources, including common law, statutes, regulations, or a court order in the case."

Depending on the common law in your jurisdiction, the obligation to preserve evidence arises when litigation is:

"Reasonably anticipated"

"Pending, imminent, reasonably foreseeable"

To minimize the risks of the destruction of evidence and avoid sanctions, electronic evidence should be preserved as soon as a party is put on "notice" that potential litigation may arise.

RETENTION POLICY

A document-retention policy is an important tool an organization uses to address the creation, retention and disposition of corporate records. Records as information created, received and maintained as evidence by an organization or person in the transaction of business, or in the pursuance of legal obligations -- can be in any media form, including paper, e-mail, electronic files, BlackBerry devices, laptops, voicemail…etc. However, not all items created in these media are records; for example, personal e-mail would not fall into this category.

Recent legislation, particularly the Sarbanes-Oxley Act, and an increasing focus on corporate misconduct make it important that a company create and adhere to a formal document-retention policy.  Again from a litigation support point of view it is important to fully understand why a document retention policy is of the utmost importance for any organization.

Records that are known to be relevant to a pending or impending litigation matter should not be destroyed. Destruction of such documents could lead to causes of action for spoliation, court sanctions, or default judgments.

A document-retention policy will of course be unique to an organization. An effective policy will describe the scope of the policy such as are individual departments affected differently, or does the policy apply to the organization as a whole? Who are the responsible individuals, exceptions to the policy, retention periods, retention methodologies (e.g., storage, format and location), how to handle confidential materials and communications and privacy considerations for employees.

Despite these challenges, it's crucial that a company be able to manage its e-mail as effectively as it does its paper records and that e-mail is a significant part of any records-management program. A number of vendors have created e-mail filtering and archiving programs to address this need. This will be examined more in the next article.

There are quite a few parallels between the activities required to achieve e-discovery preparedness and the implementation of a records management system.  Both require an organization to have a handle of what information is produced and in what systems and also where it is stored; in the e-discovery process to create a data map for the purpose of assisting in the identification of information relevant to a case. It is important that an organization create a data map that involves their records manager in the process right from the beginning.  It is also important for those in IT to have a grasp on all possible locations where data is stored.

Courts and regulators expect large companies to respond quickly and fully to broad electronic discovery requests. Failure to comply can result in negative court rulings such as civil, or even criminal sanctions. The past few years have seen an increase in multi-million dollar penalties imposed against companies for failing to properly maintain or produce electronic information.

The experienced litigators at law firms can help their clients in any litigation or investigation where electronic information is involved. So they need to have a grasp on identifying the client’s legal obligations to preserve and produce such electronic information. It is important for paralegals and those in litigation support to understand where this knowledge would be helpful:

• Drafting and opposing electronic information and document requests
• Preparing and tracking legal hold notices
• Developing plans for locating, reviewing and producing requested ESI
• Designing methodologies and search terms that allow for the faster, more efficient searching of documents and electronic storage media
• Selecting which production demands to challenge, which documents to produce and the format in which to produce the requested materials
• Of course to have the ability to defend the client’s electronic discovery and records management methodologies.

.

The main goal in designing or enhancing electronic discovery and records management programs is to achieve reasonable and defensible approaches to maintaining and deleting electronic information and to respond to discovery requests.

For companies prioritizing automated legal-hold workflows as a critical requirement, having policies and best practices for enforcing, managing and tracking legal holds by application and content is the place to start. Initial efforts should focus on the most popular target sources for electronic discovery in litigations, investigations and audits.

The records management and retention component of electronic discovery is concerned with which electronic documents are retained, for how long, and in what form. Records management is an important part of the electronic discovery and is unique to each company based on the type of materials processed, the current methods of preservation and the regulatory and legal requirements for that particular company. The foundation for successful records and information management is a program that puts the efficient functioning of business operations first, while also ensuring compliance with records retention obligations and positioning a company to respond to inevitable requests for electronic discovery.

Next Up: ECM and the SharePoint riddle.

John Randall

President

Randall Consulting

jrandall@randallconsulting.net

www.randallconsulting.net

Topic #1 The EDRM Model

Randall Consulting will be writing a series of blogs to further emphasize what was stated in the last entry. The majority of Law Firms and service providers cannot afford training right now because of the economy. With that being said I have decided to write blog entries on topics to help bridge the gap until your company can send you to get that much needed electronic discovery training.

Randall Consulting teaches its EDD classes in lifespan order. With that being said these blog topics will also follow some sort of order. The Electronic Discovery Reference Model has gained a lot of momentum in the past two years. It is now the standard for understanding the EDD lifecycle. It is also a great way to begin. Anthony Martinez from Litigation Logic posted a great topic on the E-discovery 101 LinkedIn group as well as his blog.  It was in relation to can most internal litigation support staff walk attorneys thru all the discovery phases of the EDRRM model? The simple answer is not unless they understand the lifecycle and not unless they have the proper training.

The audience for electronic discovery is rapidly expanding with each year that passes as available technology is understood and applied. Capturing, processing, reviewing and analyzing electronic data has appeal to many anticipated audiences, including:

• Law firms - litigators
• Law firms - corporate lawyers
• Law firms - litigation support staff
• Corporations - management
• Corporations - office of general counsel
• Corporations - compliance officers
• Service providers
• Software/product providers
• Consulting firms
• Federal courts
• State courts
• Regulators
• Financial institutions

EDRM

 

Step 1- Records Management- 

The proper control of unstructured information through a RM system and a retention schedule is an important pre-discovery step. All document control systems will be of assistance in better organizing and controlling unstructured information. Keeping documents in an RM system also solves chain-of-custody and preservation issues. This may be the biggest challenge facing corporations. A document retention schedule needs to be put in place.

Step 2- Identification

This includes naming potential custodians of data, timeframes, keyword lists and file types. Identification has a number of components. Be prepared to present documentation of system architectures.

This is one of IT's major contributions to identification. In terms of documenting corporate IT infrastructure and network topologies, identifying all data stores, systems and storage devices, and types of data, plus its age. Assess the relevancy of data and systems that are used for backup and recovery. Your backup and recovery policies may become part of the evidence, so they need to be recorded and auditable.

Data can also reside on laptops, flash drives, telephone switches, backup tapes, personal digital assistants, and off-site or third-party systems. There are technical solutions that can help a company to identify all the nodes on a network, including the hard drives of desktop or laptop.

Step 3- Preservation and then Collection-

This saves data in case it needs to be produced. Crucial features are litigation hold and litigation hold tracking. Preservation of potentially relevant information is complex.

Preservation of evidence depends on records-retention policies, documentation of the IT architecture, well-documented processes for putting litigation holds in place, and identification of all potential sources of data.

Some RM systems have litigation hold as a feature, but the vast majority of the data is not in a managed system. Many manage litigation holds by simply suspending normal deletion and media rotation programs, finding themselves in the position of not deleting anything, which is unsustainable.

Collection

Information must be collected from the repositories where it resides, but it must also retain its form and metadata integrity.

Review should be done if possible in native format, so the metadata can be seen and so as to preserve the chain of custody. Some vendors will consult metadata — such as who has accessed a document, authored it or edited it — as a factor in establishing relevancy to a query, but cannot necessarily reproduce that data such that it will stand up in a courtroom. Searches themselves are becoming important in the chain of custody, so you should make an accurate record of them. During collection, audit logs need to include searches by custodian, date, keyword, operator and project. If this is not possible via the software, then record this information and be prepared to swear to its accuracy. It is inherent that you understand at least the basics of computer forensics.

The EDRM model now starts to shift from Volume to Relevancy. Processing and then Review followed by analysis fall under the Step 4 tree.

Step 4- Processing-

This prepares the documents for review and can be basic or advanced. De-duplication, culling and prioritization are important, along with indexing, categorization, filtering and other content-driven analysis activities. Consult with your lawyers to determine the level of analysis that they want. If they give you some keyword searches ask them how they came up with it. Make sure you use a service provider that fully understands electronic discovery.

Review-

This is strategic attorney review.  Newer tools — such as those that allow documents to be grouped or clustered, visualization tools, and tools designed to show "missing" information are all currently available for use. These can help more creative attorneys and other legal professionals gain a competitive edge. It is important to note that more

Advanced techniques are not yet fully accepted by courts because their functionality is not widely understood. IT-savvy law firms and some regulators have begun using them, as have highly litigious end-user clients. Remember that any search software that is used must be explicable to opposing counsel, the regulator or the judge.

Step 5- Production

This is the form in which the documents must be produced for review by outside parties. Most of the review platform vendors can produce electronic content in the format in which lawyers wish to look at it, including native format.

Review, analysis and production have two delivery models — hosted or enterprise. Because case data frequently needs to be viewed and worked on by multiple firms, and also because of volume and processing considerations, the hosted model makes sense in many cases.

Step 6- Presentation-

If a case goes to trial then this would be the last phase. Consider early and often how you can most effectively present the electronically stored information at depositions, hearings and trial.

This is just a basic overview of understanding what each step in the EDRM model consists of.

For additional information on the EDRM model as well as the current projects they are working on please visit: http://www.edrm.net/

The next blog by Randall Consulting will go more in-depth on Records Management.

John Randall

President

Randall Consulting

Http://www.randallconsulting.net