A large and rapidly expanding Digital Universe

Transcription

1 Litigation Holds and e Discovery Rules C. Allen Shaffer Bricker & Eckler LLP A large and rapidly expanding Digital Universe SOURCE: IDC, The Diverse and Exploding Digital Universe: An Updated Forecast of Worldwide Information Growth Through 2011 (March 2008), Figure 1 used Bricker with & permission. Eckler LLP Greater Complexity In the Storage and Use of ESI 1

2 The Dynamic and Fragile Nature of ESI A Walk Through of the ediscovery Process Used with permission of EDRM. Your Information Management Create Records Discard Unneeded Records Consider Retention Needs Business Information Lifecycle Label & Organize Records Store & Backup Records Use Records 2

3 Your information management on litigation Create Records Discard Unneeded Records Consider Retention Needs Business Information Lifecycle Label & Organize Records Store & Backup Records Use Records A Walk Through of the ediscovery Process Used with permission of EDRM. A Walk Through of the ediscovery Process Used with permission of EDRM. 3

4 A Walk Through of the ediscovery Process Used with permission of EDRM. A Walk Through of the ediscovery Process Used with permission of EDRM. A Walk Through of the ediscovery Process Used with permission of EDRM. 4

5 What Does this Mean? First, your attorney must learn about your ESI What Must Your Attorney Know? 1. The nature and basis of their claims and defenses 2. Their clients computer systems, & retention policies and practices 3. The identities of IT personnel and their respective responsibilities 4. The identities of the key players in the litigation What Must Your Attorney Know? 5. Where likely relevant information is stored 6. The nature of the information stored in each such location 7. The identities of the custodians of likely relevant information 8. Steps taken to preserve likely relevant information 5

6 What Must Your Attorney Know? 9. Potential preservation problems, including suspension of auto-delete features & future preservation 10. The formats in which likely relevant information is stored 11. The nature and operation of backup systems 12. The necessity for, and capabilities and availability of vendors Safe Harbor Preservation issues must be dealt with immediately (IT Best Practices Standard One Hour after duty to preserve is triggered) What does This Mean? The creation of a safe harbor to prevent sanctions against a party who fails to produce ESI as a result of the routine, good-faith operation of an electronic information system 6

7 When Does Duty to Preserve Trigger? Once a party reasonably anticipates litigation, it must suspend its routine document retention / destruction policy and put in place a litigation hold to ensure the preservation of relevant documents. Potential Sources of ESI Workstations and laptops Network servers File servers, application servers Third party hosts for disaster recovery Third party hosts AOL, Yahoo, Google, MSN PDAs, Blackberries, Treos, Smart phones Diskettes, CDs, DVDs, Thumb drives Voice mail, cell phones, text messages Home computers Websites and intranets i-pods Web 2.0: Social Networks, Blogs, Wikis, Cloud Computing Duty to Preserve What preservation steps must be taken? 7

8 Preservation Steps Written notice must be issued to every custodian of potentially relevant ESI with detailed explanation of what ESI might be relevant in the litigation, and explanation of what to do to preserve Preservation Steps Must be followed by meeting with each custodian, and measures to isolate relevant ESI, while preserving metadata Preservation Steps The legal hold must be monitored by counsel, the hold notice must be periodically reissued, and it must be updated as conditions change 8

9 Preservation Steps When the matter has ended, steps must be taken to remove the hold How do You Find the Stuff? Plan, plan, plan. Know what you want and where to get it BEFORE beginning the collection. Understand redundant storage, backup and disaster recovery programs. List all limiters, e.g., dates, custodians and file types. Preserve data and application metadata. Document chain of custody. A Word on Metadata Metadata is data about data 3 General types: File System, Document (embedded), specific Production of metadata (beyond searchable text) is not necessary in many cases Preservation of metadata is always required until or unless there is an agreement or order otherwise (i.e., its only needed until its needed!) Metadata is easily changed in the normal course open, close, print, save 9

10 A Word on Metadata Metadata can be falsified. E.g., changing the system clock on the P.C. and saving and printing the document Hard drive imaging a complete bit by bit duplicate of the entire contents of the drive is the best method of preserve metadata (and deleted data ) Sever tools can also be used to preserve document level metadata and some specific metadata, e.g., copying the entire.pst container file to preserve the entire contents of a particular user s in-box. How do You Find the Stuff? Establish security procedures for transporting and storing ESI. use a forensic examiner or mirror hard drives where authenticity or completeness of collection may be questioned. Conduct a complete search the first time. Custodian Interviews Outside counsel must carefully explain relevant aspects of the document production. Identify where data is stored in organization. Be aware that different privacy issues may exist for personnel and data residing outside the U.S. Include past employees. Identify and interview assistants and others with access to data of key custodians. 10

11 Collection Search and Retrieval Plan for and Create a Good Set of Search Terms (and Boolean connectors, if needed). Test Search Terms (Before Rule 26 Conference, if Possible). Reach Agreement with Opposing Counsel on Search Terms and/or Disclose Search Terms in Discovery Response. Be aware if you can t get agreement you may need a professional to design your search. Collection Search and Retrieval Use search terms in relevance and privilege review Use both positive and negative search terms Positive: in house counsel s names Negative: their spouses names Learn key words used by personnel Best Practices for Review Educate review team about the case Create reference material: Relevant dates Factual issues in the case Names of legal personnel or departments Determine objective and subjective coding procedures Re-educate review team about the case 11

12 Best Practices for Review Be prepared to articulate to the Court: What de-duplication procedures were used Which key words were chosen and how they were used to search the documents The rationale for selecting those key words The qualifications of the individuals selecting the key words to design effective searches Whether and to what degree the results of the search were measured for reliability and quality The Convergence Records Retention Legal Discovery These two issues are converging from both legal process and technology perspectives. Both records managers and lawyers face significant eretention and ediscovery issues What is the Challenge Facing Lawyers and Records Managers? They must understand: Where ESI is What ESI should be preserved How it is technologically stored and managed 12

13 What is the Challenge Facing Information Technology? IT is being asked not just to archive and back up information, but also to help classify it, policy manage it, and efficiently preserve, search, retrieve, and produce it. How do you Solve The eretention Problem Develop policies based upon Information Life Cycle Management Cradle to grave policy management of information based upon its content and changing value over time Information Life Cycle Management Organizations must foster: Efficient management of information while it has business or legal value Defensible disposal of it when it no longer has value While facilitating the search, collection, culling and production of information for ediscovery. 13

14 How do you Solve the ediscovery Problem Solve the eretention problem Develop policies & procedures to quickly identify relevant ESI and preserve it Develop methodologies for isolating relevant ESI, including metadata, searching it, and processing it, including privilege review eretention ediscovery Team A cross-functional group composed of in-house personnel from the organization s business units, IT, legal & records management as well as an outside ediscovery expert The Purpose of the Team Perform a GAP analysis Determine priorities Manage the process of realigning the organization s eretention practices, adopting an information management lifecycle approach, and establishing ediscovery policies and procedures 14

15 Purpose: GAP Analysis Analyze the current status of the organization s electronic records management program and the current and likely future requirements of the organization. Then determine how to bridge the GAP GAP Analysis Includes: Retention requirements, policies & practices Creation, receipt & storage of various types of ESI Hardware, software & network systems Messaging systems design & usage Archive & backup policies & practices Historic discovery requirements and practices GAP Analysis Methodology Questionnaire to personnel about how they create, use & store electronic information. Questionnaire to IT Department about architecture t of computer systems & networks, existing protocols, actual practices, etc. Interviews of key personnel Analysis of existing systems Discussion of where Organization wants/needs to be 15

16 Three Fundamental Constituencies 1. Legal/records management/compliance/audit want policies and processes facilitating retention and defensible disposition, and automation of data collections and legal holds for ediscovery. 2. IT wants cost reduction, improved information management, ease of administration of technology solutions, and direction from Legal on policy. 3. Business unit personnel want technology that makes them more efficient, and access to information. Prioritize Goals What information, applications and workflows are most important to the organization? Which cause the most cost, disruption, risk and pain? What information is subject to specific obligations and how is it being managed? What information is the most difficult for IT to manage because the storage media is not aligned with the actual service-level requirements. Evaluate System and Application Metadata Determine what electronic information systems embed into or attach to ESI 16

17 Evaluate Inaccessibility of ESI Sources This will include: Legacy data Backup tapes Deleted, residual and fragmented data Depending upon the nature of the case, may also include virtually any source that creates undue burden or cost to access, search, review, process and produce eretention Policies and Procedures Realistic & tailored to the organization Enforceable Incorporate legal l holds As simple as possible Based on content Written ediscovery Policies and Procedures Repeatable and cross-functional Establish an IT point person Include legal hold notices and make an audit trail Provide guidance to IT about what to collect and hold Leverage automated tools to the extent possible Should be written 17

18 Legal Hold Notice Must be carefully considered in conjunction with business, IT, records management and legal Must determine what must be preserved and how it should be preserved and collected broadly described Must be clearly communicated to persons likely to have relevant evidence Must be supervised by counsel Should explain the nature of sanctions that could result if directions not followed Written record must be kept and hold must be periodically revisited Training Employee Awareness Buy-in of employees is essential Requires training Education on the potential pitfalls of ediscovery and the importance of proper eretention Should be a formal training program 1. Design the Program Inputs should be solicited from: Recent incidents: This will give you insight into weaknesses in employee knowledge of processes or e-discovery concepts in general. Employee concerns: Employees who are already aware of e-discovery fundamentals can be a good source of information about day-to-day problems related to legal holds or other discovery-related activities. Management concerns: Management s perspective is usually more operational or strategic. Their concerns help to complete the picture. 18

19 Design the Program Keep in mind the following: Deliver the message on a frequent basis: Holding one-time sessions and assuming your work is done is a dangerous approach. Over time, the impact awareness sessions have on employee behavior diminishes. Repetition is the key to awareness maintenance. The types of awareness materials you select and your organization s culture play a significant role in how often you bring employees back into the classroom. Design the Program Keep in mind the following: Ensure you have management support: An awareness program will never meet its goals without strong management support. Funding, employee attendance at awareness sessions, and employee perception of the importance of e- discovery all depend on support across all levels of management. Monitor Compliance with Policies Rule 37(f) provides safe harbor For the destruction of ESI through routine, good faith operation of computer system Routine retention & destruction must be consistent with policies 19

20

21 Identification of Relevant Data in Litigation Perform initial evaluation of the case: What are the substantive issues involved? Who within the organization is likely to be a custodian of relevant information? Really understand the information management system & user habits Where and how is date stored? Backed up? How does the IT Dept. s oral tradition differ from written procedures (if there are written procedures!) How do custodians deal with ESI on a daily basis? Identification of Relevant Data in Litigation Design and apply the search strategy: Reliance upon custodians to eye-ball relevant ESI pursuant to your instructions Keyword, Boolean logic, and Proximity (iteratively) Clustering similarity with ESI already identified Taxonomy & Ontology relationship searching Bayesian classifiers likelihood ESI is relevant Fuzzy logic degree to which ESI may be relevant Document your strategy with a view that you may well need to defend it later Cause must be shown for extraordinary measures such as forensic searching A Word on Computer Forensics Used to identify and review deleted data that persists on the hard drives until overwritten Data persists in the slack space Painstaking, expensive, time consuming Anti-Forensics = real good times Requires trained personnel & specialized forensic software 21

22 A Word on Discovery Agreements / Orders Nearly always helpful to clarify the obligations and expectations of the parties and the court Civ. R. 26(B)(4) will allow burdensome discovery upon a showing of good cause Therefore you had better preserve it until or unless you get an agreement/order stating that you don t have to Come to the negotiation table knowing what your costs are to respond Civ. R. 37 (F)(4) Safe harbor factors include compliance with orders / agreements A Word on Discovery Agreements / Orders Civ. R. 16(B) Potential conference agenda: Part 12 catch all provision makes preservation issues potential topic New Part 8 [t]he timing, methods of search and production, and the limitations, if any, to be applied to the discovery of documents and electronically stored information [34(B) default] New Part 9 Claw Back Agreements [26(B)(6)(b) default] The Last Word: Honor your agreements and don t screw around with skirting Court Orders Preservation of ESI Reasonable efforts to preserve must begin as soon as litigation is reasonably anticipated Civ. R. 37(F)(1) & (3) Safe Harbor timing Collection (extraction of data) may come later when you are faced with a discovery request provided it was adequately preserved Litigation hold Written instructions to possible custodians and key players not to delete relevant information Issue early on and supplement as your understanding of the case & key players evolves 22

23 Preservation of ESI IT staff/consultants & specialized software may be needed for: Imaging or ghosting entire hard drives Suspending back up tape recycling (not a substitute t for imaging) i Suspending automated document destruction (perhaps selectively) Tools: Ghosting Tools: E.g., Norton Ghost Imaging Tools: E.g., DD (Dept of Defense) A Word on Metadata Metadata is data about data 3 General types: File System, Document (embedded), specific Production of metadata (beyond searchable text) is not necessary in many cases Preservation of metadata is always required until or unless there is an agreement or order otherwise (i.e., its only needed until its needed!) Metadata is easily changed in the normal course open, close, print, save A Word on Metadata Metadata can be falsified. E.g., changing the system clock on the P.C. and saving and printing the document Hard drive imaging a complete bit by bit duplicate of the entire contents of the drive is the best method of preserve metadata (and deleted data ) Sever tools can also be used to preserve document level metadata and some specific metadata, e.g., copying the entire.pst container file to preserve the entire contents of a particular user s in-box. 23

24 Defensible Collection of ESI Planning the collection strategy Consider terms of discovery agreements or orders Consider instructions of the requesting party and your arguments for deviation Unreasonably broad, burdensome Not relevant or reasonably likely to lead to admissible evidence (low threshold) If Metadata will be produced, take care to avoid disturbing Defensible Collection of ESI Chain of custody Document collection activities on standardized forms Limit & document access after collection Involve personnel whom you don t mind being deposed Consider Hashing ESI at point of collection to create digital fingerprints (more later) Use appropriate collection tools to match E.g., RoboCopy to collect ESI from Windows PCs E.g., Hashing with HashTab or PinpointHash E.g., Forensic Toolkits such as EnCase ($$$) or PenguinSleuth, Helix, Fire Processing ESI Many vendors & software products available De-duplication Hash (MD5 or SHA-1) each file or (better) parts of each file Create an index of all unique hash values Compare each file s hash value to the index Eliminate redundant data chunks & replace with pointer to the saved single instance Compression can be 10:1 or even 50:1 Filtering, e.g. Date range, keyword, custodian, or other agreed parameters Prepare for review triage, organize, format 24

25 A Word on Hashing Hashing is a means for creating a digital fingerprint for ESI A hash function converts data of any size or length into a unique string of alphanumeric characters of a fixed length (MD5 = 32; SHA-1 = 40) The slightest difference between two files will result in a completely different hash values Hash Function The more granular the hashing is performed the more specific one can be about what is duplicated 1J49S84LSX6W348FIR DJZFQIT Review & Analysis of ESI Review & analysis must be iterative process Review plan For big jobs consider using support staff, temps, etc for initial review, summary, tagging, coding, indexing Provide very clear direction and careful oversight to support staff Attorney should make the call for production decisions after the prep work has been completed Review & Analysis of ESI Technology to speed the process: Hosted environments such as Applied Discovery, Kroll Ontrack, FIOS, Pitney-Bowes These vendor offer end-to-end support for identification, collection, processing, review, and production Older, less jazzy litigation support tools such as Summation and Concordance Huge install base Far cheaper for small cases Limited functionality Custom solutions by your in-house IT staff or IT consultants 25

26 Production Consider agreeing in advance on production formats, numbering system, etc Use Civ. R. 16(B) Discretionary Pretrial Conference Producing party must provide data in a reasonably useable format (usually searchable) unless agreement otherwise Civ. R. 34(B) Native format is becoming increasingly popular due to the reduced cost of not having to image or print every document and the benefit to the receiving party of searching and indexing with the metadata Production Privilege and confidentiality are acute issues with native production Negotiate a Claw Back Agreement and Confidentiality Order Still need to review the ESI PDF/TIFF are (currently) more common means of electronic production Allows for redaction, Bates Numbering, etc Use Load File where metadata is required PDF vs. TIFF pros & cons of each 26