1 New El e c t r o n i c Di s c o v e r y Te a m s, Ro l e s & Fu n c t i o n s Eric Friedberg Stroz Friedberg New York, NY THE onference INSTITUTE Copyright 2008, The Sedona Conference and Eric Friedberg. SM
2 NEW ELECTRONIC DISCOVERY TEAMS, ROLES, AND FUNCTIONS Eric Friedberg 1 A. Introduction Many electronic discovery sanctions may be traced to a lack of effective coordination and communication among personnel who are attempting to preserve data in accordance with a duty that has been triggered: the legal department communicates to IT an incomplete list of the custodians to be preserved; IT mixes up the correct list of custodians with an incorrect list; custodians do not read or understand the instructions they are given in the litigation hold notice to protect s from an auto-delete or recycling function; HR provides an incomplete list of personnel to legal, which bases its litigation hold distribution list on the erroneous material it received. There are endless permutations. Indeed, in Zubulake, in describing the problems at UBS that lead to the overwriting of relevant backup tapes, Judge Schiendlin quoted the famous line from Cool Hand Luke: What we ve got here is a failure to communicate. Zubulake v. U.B.S., 229 F.R.D. 422, 424 (S.D.N.Y. 2004). Lack of coordination and communication can also lead to business failures in the area of electronic discovery and records management in that projects that could create efficiency, save money, reduce retention of unnecessary data, and make important business records more accessible are undermined. These failures often occur because, due to lack of process, the requisite corporate constituencies cannot come together to approve and implement such projects. 1 Eric Friedberg is Co-President of Stroz Friedberg, a national, consulting and technical services firm specializing in digital forensics, electronic discovery, data breach response, and investigations. Mr. Friedberg is a former Assistant U.S. Attorney for the U.S. Attorney s Office in Brooklyn, where he served as the lead cyber-crime prosecutor, the Chief of the Narcotics Unit, and Senior Litigation Counsel. Previously, Mr. Friedberg was a litigation associate at the New York office of Skadden, Arps, Slate, Meagher & Flom. He is a graduate of Brandeis University and Brooklyn Law School.
3 Compliance with emerging electronic discovery obligations, and conducting electronic discovery in a consistent and efficient manner, requires new cross-disciplinary teams (hereinafter New Teams ), with updated organizational roles (hereinafter New Roles ) and functions (hereinafter New Functions ). These New Teams often draw representatives from an organization s in-house legal, IT, compliance, records management, and human resources departments at the corporate and business unit levels, as well as from the outside counsel and the forensic/electronic discovery vendor to whom the company looks for strategic advice. In addition to improving compliance and efficiency, New Teams can also assure consistency in the positions that the company s representatives take on electronic discovery matters, including key issues under the recent electronic discovery amendments to the Federal Rules of Civil Procedure (the New Rules ) regarding the accessibility of electronically stored information ( ESI ) within the corporate network; the descriptions provided during meet and confer conferences and initial disclosures about the systems on which data is located; and the form of production in which ESI should be produced in the company s litigations. B. Buy-in The creation of New Teams and their agendas vary widely because of the different levels of sophistication and business processes in their respective corporate cultures. Invariably, the New Team confronts its company s level of buy-in and support for its mission. At one end of the spectrum, senior management and the board back and fund a broad mandate to improve records management and electronic discovery processes, and support the requisite change management. In other cases, the New Team members do what they can to coordinate their respective functions but have little budget and less staffing, and struggle in tackling larger initiatives. In such cases, senior management seems to have little understanding of how records management and electronic discovery are increasingly interwoven with corporate governance, ethics, and compliance. While senior management is ultimately responsible for the increased risk inherent in failing robustly to support New Teams, the individual team members on the front lines often feel exposed in attempting to do more with less in an era of rising obligations and multimillion dollar sanctions.
4 C. The Work of the New Team The New Team coordinates the company s response to the need for improved records management, litigation holds, electronic discovery processes, and the requisite hardware and software solutions that support such initiatives. Within this bailiwick are dozens of types of projects and issues. A number of those that are drawing current, significant attention are explored below. 1. Forms of Litigation Hold. A major focus of certain New Teams is re-writing and re-issuing forms of litigation holds to bring them in line with current case law regarding triggering events and best practices in the area of data preservation. New Teams are also focusing on how to implement systems that remind custodians of their obligations and catalog the issuance of the hold and the reminders. The need for coordination in these areas is paramount. HR and IT must accurately identify the custodians and coordinate effectively regarding new and departing employees; in-house legal and outside counsel must agree on the language of the litigation hold; legal and IT must coordinate to select and deploy any litigation hold tracking software; and IT, in-house legal, outside counsel, and the outside forensic consultants must coordinate regarding the methodology for collecting the data. 2. Archiving Platforms. One of the most significant challenges for large companies is dealing with unstructured data such as and loose electronic files in both the records management and litigation hold arenas. If the company s solution is an enterprise archiving repository relying heavily on auto-tagging and centrally managed aging of items, the enormous coordination tasks can fall to a New Team. The legal propriety and consequences of using any kind of autotagging technology must be dealt with by in-house and outside counsel, but the actual administration of those technologies will likely be controlled by a blend of legal, IT, and compliance resources. The complexity of using archiving tools to age and then expire unstructured data is enormous, and typically specialized consultants must join the New Team s deployment efforts to make sure that the platform s configuration mirrors what counsel has approved.
5 3. Consistency of Corporate Positions. One way in which New Teams can provide significant risk mitigation is to promulgate and enforce consistent corporate positions on subjects emanating from the New Rules. For example, the Rules now state that relevant data that is reasonably accessible must presumptively be produced, whereas data that is not reasonably accessible must be preserved but need not be produced in the first instance. Issues constantly arise as to whether backup tapes, information in enterprise databases, information on a company s Intranet, voic s, deleted data, or decommissioned servers, for example, are reasonably accessible. Inconsistency between a company s public positions on this subject can create exposure in all of the fora in which those positions are taken. A decision about whether, in a particular case, to convert inaccessible data to accessible data can be significant, because it can bear on whether the company really treats that data as inaccessible. Thus, it can be difficult to defend not restoring backup tapes on the theory that they are inaccessible when the tapes are restored every time an absentminded executive deletes a mildly important . The issues around reasonable accessibility lend themselves well to being coordinated by the New Team. The legal resources can establish the rules, which the IT personnel must learn to appreciate and not evade in response to one-off requests. The New Team can then push the positions out to the company s multiple outside counsel and vendors. Similarly, it can be imperative to have consistency (or at least robust dialogue) around issues such as whether auto-delete should be turned off; whether the rotation of backup tapes should be suspended; or whether archiving or journaling should be enabled as a mechanism to comply with the duty to preserve. Such decisions become part of the company s history of compliance, and counsel pressing spoliation charges often look for inconsistencies in that history to undermine the company s current position. For example, if a company s position in a particular case is that suspending the rotation of backup tapes on a goingforward basis is too burdensome to preserve data, that position could be undermined if the company took that same step one or more times in the past.
6 The New Team is the perfect place for coordinating such issues, as all of the necessary legal, IT, and compliance constituents are present. The New Rules also provide for early meet and confer meetings, in which the parties are expected to discuss the structure of their respective networks, the kinds of data housed therein, and their plans with respect to preservation and production. To be best prepared to fulfill their obligations, counsel should know at least in general terms the types of systems and data the client corporation maintains. The need for such knowledge has created a number of New Functions that the New Team typically administers, including data mapping and drafting sample interrogatory responses regarding the company s systems. 4. Data Mapping. Data mapping is the process of identifying and describing in an inheritable written form the structure and nature of all or a portion of a company s network and data stores. Data mapping projects sometimes include identifying key system administrators who can provide additional detail regarding the systems they administer. The challenge of data mapping projects is to avoid the problem that the painters of the Verrazano Bridge encounter: as soon as they finish on the Staten Island end, the Brooklyn end of the bridge is already rusty. Large corporate systems suffer constant changes, upgrades, and migrations, making a highly granular approach to data mapping difficult. One successful approach to data mapping builds knowledge management tools, teams of personnel with institutional knowledge, and general descriptions of systems which may need further refinement to be ready to file in court but which have the advantage of not being obsolete the day after they are written. Structuring a data mapping project to navigate between the Scylla and Charybdis of excessive generality and excessive specificity can best be achieved through coordination between the New Team s legal and IT resources, with the legal department defining an approach after absorbing information from IT regarding how dynamic the systems are. A sophisticated electronic discovery vendor can also play an important role by bringing to bear its experience with data mapping projects for other companies and providing bandwidth to canvas dozens if not hundreds of a company s system-owners, since internal IT personnel rarely can spare the time.
7 5. Collecting and Searching ESI. New Functions within the New Team s jurisdiction are the collection (copying) of ESI in a forensically-sound manner and the searching of that data using effective and accepted technologies. Many large companies seek to self-collect ESI in routine cases for cost-saving and confidentiality purposes. Corporate IT departments that self-collect must train their personnel in a variety of forensic platforms and native applications, such as EnCase, EnCase Enterprise, ExMerge, FTK, XXCOPY, ImageMASSter, and Linux disk dump so that data can be collected in accordance with forensic best practices. Personnel must keep current in their certifications and should participate in peer groups to keep sharp and avoid myopia. One challenge for the non-it members of the New Team is to gain sufficient familiarity with these technical solutions to help forge the company s technical protocols for performing self-collections. The key consideration in establishing these New Functions is to determine where the internal IT function leaves off and when outside vendors should be utilized. Even highly-competent in-house forensic teams can not handle spikes in collections required by large civil or regulatory matters, short deadlines, or a confluence of cases. In addition, it is much more difficult to search data effectively than to collect it. There is less external training available for electronic discovery search technologies and methodologies. As a result, in-house personnel typically rely on off-the-shelf software, which may fail to properly search data or to convert data to searchable form. The challenges of effectively handling non-searchable binary data (such as e-faxes and non-searchable PDFs), password-protected and encrypted files, corrupt-but-repairable files, and unpacking embedded data (such as a picture of a spreadsheet embedded in a PowerPoint embedded in a Word Document) can be quite difficult for in-house IT staff to manage. Many in-house IT personnel, for example, use the Outlook client to search Outlook mail. That client, however, does not search attachments or flag items that it can not search. New Teams can address these risks by receiving outside consulting advice on acceptable protocols for searching electronic data. Determining where to draw the line between in-house and external resources is
8 not only a technical issue. Cases that are high-profile or in which the prior role of IT has already been criticized may call for the use of independent resources. Management should also realize that in-house personnel who collect and process ESI will be subjected to intense scrutiny in 30(b)(6) or other depositions. Accordingly, such personnel should be smart, articulate, aware of their legal obligations, and make good witnesses. Indeed, acting as the 30(b)(6) witness regarding the company s systems and data retention/recycling could be viewed as a New Role itself. Of course, companies have been providing such witnesses for years. However, given emerging spoliation case law and the New Rules, it often falls to the shoulders of the 30(b)(6) witness to articulate the reasonableness of the company s strategies, methodologies, and positions regarding what data is and is not reasonably accessible; the burden of addressing data stockpiles and legacy data; and the technical efficacy of the manner in which ESI was processed and produced in the matter. As a result, some companies are using their forensic/electronic discovery consultants to carry this heavy burden in 30(b)(6) depositions. Whether inside or outside resources act as the company s 30(b)(6) witness, it is important for the New Team to watch for any inconsistencies between the testimony given in different matters, especially on issues such as the accessibility of data and related claims of burdensomeness, data stockpiles, and positions on disabling of back-up tape rotation and suspension of auto-delete. Finally, a disadvantage of self-collection can be the loss of independent, strategic advice that can be provided by a forensic/electronic discovery consulting firm on such issues as whether to perform full forensic images of custodians computers (to be able to search for deleted material) as opposed to copying only active files; and whether to disable auto-delete, use journaling, or take backup tapes out of rotation. These are hot-button issues that at times can be subject to political or economic pressures within the company. New Teams can ameliorate this downside to self-collection by building outside consulting advice into the company s standard protocol for collections and preservation efforts.
9 6. Outside Electronic Discovery Counsel. One of the most important New Team members is the company s outside counsel in charge of electronic discovery. Outside counsel can wield enormous control over how electronic discovery obligations are met. In many cases they help select forensic and electronic discovery vendors. The right counsel can facilitate the entire New Teams process, providing stewardship and key strategic advice to achieve compliance and help avoid sanctions. Indeed, New Teams are using outside counsel to train in-house Team members on emerging case law and the obligations under the New Rules. Not only does the substantive advice help the New Team, but in the event of an electronic discovery mishap, the training itself demonstrates the organization s good faith, which is a key to avoiding sanctions. Outside counsel, however, must be closely managed by the in-house members of the New Team. First and foremost, a company s outside counsel must have deep expertise in electronic discovery law and strategy. When outside electronic discovery counsel is also trial counsel, the in-house team members should closely consider whether outside counsel s electronic discovery advice will be adversely affected by its role as trial counsel. Such an affect can take the form of over-preserving data so as to avoid any arguments that might, in trial counsel s view, distract from the merits of the case. This might be the right strategy in a particular case, but it can also cost the company substantial sums of money and create stockpiles of data that are difficult to manage thereafter. In cases involving spoliation and remediation, the actions of outside counsel that directed the electronic discovery-gone-awry will be closely scrutinized, and privilege waiver may be advisable in order to explain the good faith actions that were taken. Or, the company may want to distance itself from electronic discovery counsel. Such matters become more difficult to manage where electronic discovery counsel and trial counsel are the same. On the other hand, there are clearly inefficiencies in having multiple counsel, and separate electronic discovery counsel can struggle to become fully integrated in the matter so as to render their best advice.
10 Another hot-button issue regarding outside counsel is their role in the selection of forensic and electronic discovery vendors. Indeed, some law firms have begun to act as electronic discovery vendors themselves. Recently, a trend has begun for companies to establish preferred vender lists through Requests For Proposals (RFPs) and dictate to their outside counsel their choice of vendors. The advantages to this process are increased efficiency and negotiated bulk-rates. The disadvantages can be, in the short term, disturbing the working relationship that it may have with other, quality vendors. More importantly, if the RFP process is structured largely around price, high-end vendors who mitigate risk through high-quality consulting advice can be edged out by lower-cost but lower-quality solutions. In-house New Team members should focus very closely on when their law firms act as electronic discovery vendors. Typically, law firms limit their activities in this area to hosting client data in a Summation, Concordance, Documatrix, SQL, or Oracle based litigation support database. The advantages of doing this may include the control the law firm has over the support of that database and the familiarity its lawyers obtain with the in-house tool. On the other hand, hosting technologies evolve quickly, and using law firm platforms may preclude costsaving techniques such as clustering, near-duplicate identification, and statistical profiling of data. Law firm methodologies sometimes rely on outdated, costly procedures, such as tiffing or PDFing all data, when the trend is to review data in native format and promote documents to tiff /PDF as needed only to redact and bates-stamp. Finally, outside counsel s role is critical in structuring and blessing data stockpile reduction strategies, which most companies face. Here, outside counsel must coordinate with the New Team s IT personnel, and normally the strategic outside forensic vendor, to identify and assess the nature of the data that the company seeks to reduce. Coordinated interviews of system administrators and technical sampling of data are necessary to determine whether the stockpiles are free from data as to which there is a duty to preserve. Once the New Team has concluded that a portion of the data is free from such duty, it can be destroyed.
11 C. Conclusion In sum, the touchstones of the New Team are coordination and communication, though which risk and costs can be reduced and efficiency and consistency can be gained. In the absence of such coordination, electronic discovery and compliance disasters lurk.