The Many Different Types of Electronic Discovery Searches

Transcription

1 May 2004 Volume 2, Number 2 Result Categories of Electronic Discovery Searches Table of Contents The Ethical Implications of Your Computer Result Categories of Electronic Discovery Searches Lawyers often ask us to send them all files associated with the result set of a keyword search. In fact, that is the most common request we get. We manage to get repeat engagements with lawyers because we almost always talk them out of actually getting all the files. The results of a keyword search in a forensic electronic discovery case often have no bearing on the matter we are engaged to investigate. Here are some categories of results. Over 90% of the results of a keyword search will be irrelevant to the case Completely Random It is pretty rare, but occasionally completely by luck, a combination of ASCII characters will cause a search hit. They will be embedded in a sea of meaningless data that may represent the middle of an executable file. This data is, of course, useless in a case. Lexicons When the search term is an English word, it will often show up in various lexicons on the computer that have been installed by application programs such as Microsoft Office. In almost all cases these result sets are not applicable to any case. System References Sometimes the search term shows up in a file name. For example, searching for John Doe might yield references to a file named John Doe Memo Depending on how many times this file was opened and closed, saved, shortcuts created to it, deleted, recycled, copied or printed, it may show up, just as a file name, literally dozens, or even hundreds of times on the disk. In some cases it might be interesting to know the history of the file, which a forensic expert may be able to provide, but merely

2 exporting and providing the references to the file on the hard disk without interpretation of the operating system references is not very helpful. Internet References Search term results may be found in cached internet pages, and may or may not be relevant to the case. A term like the name Joel, which may have relevance to the case because of a case player named Joel Williams might result in 200 files that reference Billy Joel. Contextually Irrelevant System Data may be contextually irrelevant because it shows up in system or application files. For example, the term confidential may show up in the Windows help file regarding maintenance of system passwords. Personal The same term, confidential might show up in personal s that are irrelevant to the business case. In almost all cases, it is obvious when these s are truly personal. The success of a keyword search often results from the forensic expert s ability to wade through a mountainous haystack to find a few dozen relevant needles. Business A search term will often show up most often in irrelevant business data. For example, a search for the term Gulfstream might yield thousands of hits in a copy of an FAA approved parts list, but the data in a generic FAA database might be completely irrelevant to the case. Relevant Data Finally, we get to the category of relevant data. As lawyers, you are accustomed to wading through reams of irrelevant discovery documents. As forensic experts, we have to be careful not to try and make the call as to whether documents that may be relevant and may not are included in a case. The more we understand about the matter the better job we can do in our reporting of data on the computers being inspected. In general, we will err on the side of inclusiveness. But, even with this predisposition, relevant data will usually make up a very small part of the result sets of a search term.

3 The Ethical Implications of Your Computer (And Other Technology in Your Office) Most lawyers know how to use . Most lawyers have voic and fax machines. Most litigators even know that their discovery requests need to include requests for electronically stored documentation. But do you know how long you ethically have to keep voic s or how to store electronic files or how extensive your electronic discovery requests should be? The following are some brief risk management/ethics suggestions for lawyers to ponder when using technology. 1. Document Retention policies Arizona Ethics Opinion provided guidance regarding how long client files must be maintained (assuming that the files have not been returned to the clients). The Opinion does not, however, explain how long law firms should maintain electronic files or whether the firms even have to preserve electronic files if the firms have paper copies. The inclusion of electronic data in discovery leads to new responsibilities in requests, skills and storage. As a practical (and risk management) suggestion, law firms need to establish document retention policies and stick to them. The revised Ethical Rules now specify that client files are client property and that the file includes almost every document/item in the folder except internal practice memos. Ethical Rule 1.16(d) explains that lawyers must give the client the file, upon request. At the conclusion of a representation the lawyer either may turn over the entire file to the client or store the file for the number of years specified in Opinion But what if that file is electronic? You ve scanned in all papers from opposing counsels, the client, and the court do you still need to keep a paper file? Not as long as you safeguard and maintain the electronic file for the same amount of time that would be required of a paper file. Remember, if you keep electronic copies of voic s and s, those also may be considered part of the client file that must be preserved (depending upon what your document retention policy states and your standard practice). If you regularly maintain client files on disk and the client requests his or her file, you may provide the client with the disk. However, if it is not the practice of the firm to keep client files electronically, the firm is not required to provide an electronic version just because the client wants the file on

4 disk. To safeguard an electronic file, the disk, tape or other medium upon which the documents, voic s, s, and faxes are stored must be preserved in a secure and climate-appropriate environment. While paper files might be able to survive seven years in off-site un-airconditioned, damp warehouses disks and other electronic medium will not. Store the disks in a cool, dry, static-free environment That electronic file storage facility must maintain the confidentiality and security of the files, which means assuring that the disks are kept in a locked room/vault where the documents can be readily retrieved by only authorized individuals from the firm. If the firm s server backup is maintained by an off-site provider, assure that the provider understands your duties of confidentiality and security, so that other firms will not have access to those back ups nor will information be stored on a system that can be accessed by unauthorized third parties. 2. Confidentiality Requirements When Hiring a Forensic Technology Expert All engagements of technology experts must include a confidentiality provision that confirms that the expert understands the lawyer s duties of confidentiality, attorney/client privilege, and work product privilege. In the event that the expert extracts information from the opposing party or opposing counsel s technology that even remotely looks like it might contain privileged information, the expert should assure that the information will not be transmitted to the other side. Similarly, any information extracted for the purposes of analysis should be returned to the producing party at the conclusion of the matter. In other words, confidentiality works both ways the expert cannot obtain information that would not be discoverable and the expert must maintain the secrecy of the information during and after the representation. Forensic experts have professional confidentiality requirements. 3. Standard of Care: Do Your Document Requests Include Requests for Fax Machine Logs? Discovery requests and responses to discovery requests no longer are limited to paper. Now the standard of care requires that litigators request electronic records as well, including records from laptops, computer servers, discs, off-site back-up services, fax machine logs, internet data, and even information from PDAs. There are numerous publications available to assist lawyers in drafting ethically (and legally) sufficient discovery requests to capture this new dimension of information. For example, the ABA Litigation Section has published on the ABA website ( draft Electronic Discovery Standards. Consult with a technology expert to gain further insight into other sources of electronic

5 information that should be included in your civil discovery requests. The standard of care may require you to obtain forensic computer images. For questions about ethics issues associated with technology, contact Lynda C. Shely at or