EDDE JOURNAL. A Publication of the E-Discovery and Digital Evidence Committee ABA Section of Science & Technology Law

Transcription

1 PAGE 3 A Publication of the E-Discovery and Digital Evidence Committee ABA Section of Science & Technology Law AUTUM N 2011 VOLUME 2 ISSUE 4 Editor Thomas J Shaw, Esq. Tokyo, Japan Committee Leadership Co-Chairs Message Co-Chairs: George L. Paul, Esq. Phoenix, AZ Lucy L. Thomson, Esq. Alexandria, VA Steven W. Teppler, Esq. Sarasota, FL Eric A. Hibbard Santa Clara, CA Vice-Chairs: Hoyt L. Kesterson II Glendale, AZ Bennett B. Borden Richmond, VA SciTech Homepage EDDE Homepage Join the EDDE Committee 2011 American Bar Association. All rights reserved. Editorial policy: The EDDE Journal provides information about current legal and technology developments in e- Discovery, digital evidence and forensics that are of professional interest to the members of the E- Discovery and Digital Evidence Committee of the ABA Section of Science & Technology Law. Material published in the EDDE Journal reflects the views of the authors and does not necessarily reflect the position of the ABA, the Section of Science & Technology Law or the editor(s). By Stephen Mason Encrypted Data It was inevitable that encryption would be used to provide for the security of data. Motor vehicles transported people and goods more efficiently and faster than a horse, but the manufacturers did not produce vehicles specifically for the use of bank robbers: it was just that bank robbers decided that the technology was suitable for a quick getaway. Encryption is no different, and the law has to deal with the way human beings use technology to their advantage. This article considers the emerging approach taken by judge in the United States of America, Canada and England & Wales in responding to the need for law enforcement agencies to obtain evidence that is encrypted. Read more Predictive Coding: E-Discovery Game Changer? By Melissa Whittingham, Edward H. Rippey and Skye L. Perryman Predictive coding promises more efficient e-discovery reviews, with significant cost savings, to combat the inflationary growth of electronically stored information (ESI). Should you consider using it? This article discusses whether predictive coding is a game changer or simply another tool in the e-discovery arsenal. We also note factors to consider when assessing whether predictive coding could be helpful for your next case. Predictive coding refers generally to the use of automation to manipulate ESI during any stage of e-discovery. The technology is also known by such other names as automated document review, automated Read more E-Discovery in Pennsylvania: Bridging the Gap in the Electronic Age By John A. Schwab and Abigail M. Faett The various jurisdictions in the United States, both state and federal, have grown in e- discovery maturity at vastly differing rates. Pennsylvania is no different. State courts in Pennsylvania have only begun to produce cases addressing e-discovery within the past few years. The Supreme Court of Pennsylvania, responsible for promulgating the Pennsylvania Rules of Civil Procedure, recently began examining the value of incorporating e-discovery terms and principles into Pennsylvania s procedural rules. On the other end of the spectrum, Pennsylvania s federal courts are well-versed in e-discovery and their judicial opinions on the subject abound. While this may be due, in part, to the 2006 revisions to the Federal Rules of Civil Procedure, Pennsylvania federal courts eagerly apply e-discovery concepts. Read more By Joe Howie Caution: Certification Programs Under Construction In answer to a growing need for expertise and competence in the e-discovery discipline, many different approaches and programs have arisen. These different approaches have included the use of an e-discovery certification for those involved in or who want to be involved in this area of the legal profession. While there are several significant potential benefits of e- Discovery certification programs, lawyers ought to exercise a level of caution about some of the new e-discovery certification programs that have recently sprung into existence out of whole cloth. As with any new area of practice, a rigorous due diligence is warranted. Caution is warranted so that lawyers can safeguard the interests of: their firms or corporations in using only qualified personnel on sensitive e-discovery tasks, the staff at their firms, Read more

2 PAGE 2 Encrypted Data By Stephen Mason United States of America It was inevitable that encryption would be used to provide for the security of data. Motor vehicles transported people and goods more efficiently and faster than a horse, but the manufacturers did not produce vehicles specifically for the use of bank robbers: it was just that bank robbers decided that the technology was suitable for a quick getaway. Encryption is no different, and the law has to deal with the way human beings use technology to their advantage. This article considers the emerging approach taken by judges in the United States of America, Canada and England & Wales in responding to the need for law enforcement agencies to obtain evidence that is encrypted. It was only a matter of time before the courts had to deal with encrypted data, and the failure to obtain the password to decrypt the data. One of the first cases in which this problem was raised is in the case of In re Grand Jury Subpoena to Sebastien Boucher. 1 The facts were that on 17 December 2006, Boucher and his father entered the United States from Canada at Derby Line, Vermont. Customs and Border Protection Officer Chris Pike found a laptop computer in the vehicle they were travelling in. He opened the computer and switched it on without entering a password. He searched the various files in the computer, and discovered approximately 40,000 images, some of which appeared to be pornographic, based on the names of the files. Boucher was asked if any of the files contained abusive images of children, to which he responded that he was not certain. Officer Pike continued to search the files, and noticed some files with names that suggested child pornography. He then requested the help of Special Agent Mark Curtis, who determined that a number of files contained abusive images of children. Boucher was then given rights under Miranda, and told the Special Agent that he downloaded pornographic files, and indicated that he did not intentionally download child pornography and deleted any such images when he came across them. Boucher was given access to the laptop and navigated to Z drive, obtaining access by inserting a password. The Special Agent did not see Boucher do this. Boucher was subsequently arrested and his laptop was seized. After obtaining a search warrant, the government discovered that the Z drive was encrypted. The investigating authorities could not open the Z drive. A grand jury subpoena was issued for Boucher, directing him (at 2) to: provide all documents, whether in electronic or paper form, reflecting any passwords used or associated with the Alienware Notebook Computer, Model D9T, Serial No. NKD900TA5L00859, WL (D.Vt.).

3 PAGE 3 seized from Sebastien Boucher at the Port of Entry at Derby Line, Vermont on December 17, Boucher moved to quash the subpoena because, he alleged, that it violated his right not to incriminate himself under the provisions of the Fifth Amendment. Whether the privilege against self incrimination applied in this instance depended on whether the subpoena sought testimonial communication. Both parties agreed that the contents of the laptop computer were not covered by the Fifth Amendment, because they were voluntarily prepared and not testimonial in nature. Niedermeier, MJ, commented, at 3, that: Entering a password into the computer implicitly communicates facts. By entering the password Boucher would be disclosing the fact that he knows the password and has control over the files on drive Z. The procedure is equivalent to asking Boucher, Do you know the password to the laptop? If Boucher does know the password, he would be faced with the forbidden trilemma; incriminate himself, lie under oath, or find himself in contempt of court. The learned judge concluded that the provisions of the Fifth Amendment prevented the government from compelling Boucher from providing the password on the basis that it would compel him to display the contents of his mind to incriminate himself. The government appealed this decision. 2 Chief District Court Judge William K. Sessions, III, of the District of Vermont, overruled the initial ruling and sustained the government s appeal. The government argued on appeal that it did not seek the password for the encrypted hard drive, but required Boucher to produce the contents of the encrypted hard drive in a format they could be viewed by the grand jury. The government was aware of the existence and location of the information during the border examination, which meant the information was not testimonial, as noted by the learned judge at 3: Boucher accessed the Z drive of his laptop at the ICE agent s request. The ICE agent viewed the contents of some of the Z drive s files, and ascertained that they may consist of images or videos of child pornography. The Government thus knows of the existence and location of the Z drive and its files. Again providing access to the unencrypted Z drive adds little or nothing to the sum total of the Government s information about the existence and location of files that may contain incriminating information. 2 In re Grand Jury Subpoena to Sebastien Boucher, 2009 WL (D.Vt.).

4 PAGE 4 In this instance, Boucher had already cooperated and potentially incriminated himself by admitting ownership of the laptop, and provided law enforcement officers with partial access to it prior to his arrest. 3 Canada In Canada, the reverse occurred in the case of R. v. Beauchamp, 4 in which the defence sought an order to require the Crown to disclose a copy of encrypted files, located on a hard drive, that had been seized by the police. The Crown has not been able to de-encrypt the files, and as a result had no knowledge of the data that was encrypted. It was agreed that the encrypted information was both potentially inculpatory and potentially exculpatory for the accused parties. The Crown submitted that the encrypted information was beyond its control, although it was, arguably in its possession, but not in a format that it was able to view it. The learned judge concluded that the Crown was in partial possession and control of the hard drives, but it had no knowledge of the information the encrypted files. R Smith J analysed the position thus, at 40: The seizure by the police of the hard drives containing encrypted information is similar to the seizure of a locked safe which the police cannot open, containing documents which include both inculpatory and exculpatory evidence. The police or Crown would clearly be in possession or control of the safe, but if they did not have the key or combination and were unable to break the safe open, then they would not have knowledge of the contents of the safe. In this case, the Crown s control of the contents of the safe, which are known to one accused but not to the Crown, is not complete, as the Crown needs the key or combination, or in this case the password, in order to access the documents in the safe. The unique feature of this case is that the accused Cattral has the key or password, which is necessary to complete the possession or control of the information in the safe. The application for disclosure of a copy of the encrypted files in the hard drives was refused, although the learned judge indicated that the applicants may, at their option, obtain disclosure of the contents if they provide the password or key to the Crown and the Crown would then review the material. 3 The Boucher case was not cited in an identical argument before Borman, DJ in United States of America v. Kirschner, 2010 WL (E.D.Mich.), who decided that the subpoena requiring the defendant to give up the password must be quashed, on the basis that the request would incriminate him. For more discussion and reference to other article, see David Colarusso, Heads in the Clouds, A Coming Storm The Interplay of Cloud Computing, Encryption, and the Fifth Amendment s Protection Against Self-incrimination, Boston University School of Law Journal of Science and Technology Law, Volume 17 Issue 1 Winter CANLII (ON SC).

5 PAGE 5 England & Wales Refusal of the accused to reveal the key There are three methods of reading the plain text of encrypted data: examine the keys, as in the US case of United States of America v. Hersh a.k.a. Mario 5, obtain the password that protects the encryption key, or attempt to guess what the password is. 6 It is probable that most suspects will not offer up the relevant password or key, as in the case of R v S (F) and A (S), 7 which means investigators have to try other means to determine the content of the encrypted files, if possible. In R v S (F) and A (S), 8 the Court of Appeal dismissed an interlocutory appeal under s 35(1) of the Criminal Procedure Investigations Act 1996 by S and A against the decision of Martin Stephens QC J at the Central Criminal Court, during the course of a preparatory hearing heard on 26 June 2008, when he refused to order that counts alleging that the appellants had committed offences under s 53 of the Regulation of Investigatory Powers Act 2000 should be stayed. In 2007, H was made the subject of a control order under the Prevention of Terrorism Act He was required to live and remain in Leicestershire, and not to leave his home address without the consent of the Secretary of State for the Home Department. The appellants are alleged to have conspired together, and with H and others, to breach the order. They conspired to help H to abscond from his address in Leicester and to convey him to a secret address in Sheffield, which S did on 9 September Shortly after their arrival, the police entered the premises. H and S were found in separate rooms. S was alone in the same room as a computer. The password to an encrypted file appeared to have been partially entered. He was arrested, subsequently interviewed, and made no comment. A search of his home address in London revealed 5 United States Court of Appeals for the Eleventh Circuit No July 17, 2002 before Anderson and Marcus CJJ and Middlebrooks DJ, available on-line at see also J. Alex Halderman, Seth D. Schoen, Nadia Heninger, William Clarkson, William Paul, Joseph A. Calandrino, Ariel J. Feldman, Jacob Appelbaum, and Edward W. Felten, Lest we remember: Cold boot attacks on encryption keys (2 April 2008), Princeton University Electronic Frontier Foundation, available at 6 In R v ADJ [2005] VSCA 102 the defendant claimed that he could not recall the password, and suggested possible alternatives, none of which were correct, so the police used password cracking software that took over four months to identify the password: the encrypted partition revealed a large quantity of abusive images of children; Eoghan Casey, Practical approaches to recovering encrypted digital evidence, International Journal of Digital Evidence 1.3 (2002); and Jason Siegfied, Christine Siedsma, Bobbie-Jo Countryman and Chester D Hosmer Examining the encryption threat, International Journal of Digital Evidence 2.3 (2004); Hank Wolfe, Penetrating encrypted evidence, Digital Investigation 1.2 (2004), pp ; Christopher Hargreaves and Howard Chivers, Recovery of encryption keys from memory using a linear scan, Proceedings of the 2008 Third International Conference on Availability, Reliability and Security (2008), IEEE Computer Society, pp ; Carsten Maartmann-Moe, Steffen E. Thorkildsen and André Årnes, The persistence of memory: Forensic identification and extraction of cryptographic keys, The Proceedings of the Ninth Annual DFRWS Conference, in Digital Investigation 6 (2009), S132 S [2008] EWCA Crim 2177, [2008] WLR (D) [2008] EWCA Crim 2177, [2008] WLR (D) 313.

6 PAGE 6 computer material. A number of documents had been deleted from the computer hard drives, but when retrieved, they provided the basis for charges against S under s 58 of the Terrorism Act However, in the absence of the passwords for the encrypted files present on the computer hard drives, and the full password for an encrypted file on the laptop upon which the encryption key appeared to have been already partially entered in Sheffield, the encrypted files could not be opened. A was also arrested on 9 September His address was also searched, and the police seized computer material. One of the disks seized included an area on the disk that was encrypted. S and A were each served with a notice under s 53 of RIPA The notices were identical in terms, and the relevant parts were set out in the judgment of the President, Sir Anthony May, at [6]-[8]: 6. The first notice served on S immediately identified the purpose, the investigation of protected electronic information, and after explaining that the notice imposed a legal obligation, failure to comply with which was an offence, it continued: Disclosure requirement I hereby require you to disclose a key or any supporting information to make information intelligible the information to which this notice relates is: the full encryption key in order to access the encrypted volume of the laptop computer that is exhibited as exhibit AM/1 under file path: C:\Documents and Settings\Administrator\My Documents\My Videos, within a file called Ronin.wma. This was found in the room where you were arrested at 386 Abbeydale Road, Sheffield. 7. The reason for the notice was explained, with particulars given of the precise circumstances in which the interests of national security and the prevention or detection of crime were said to arise. 8. The notice then described how disclosure can be verbal or written provided the information is sufficient to unlock the encryption, and that the person to whom the notice is given may select which of any relevant keys or combination of keys should be disclosed provided the information is put into intelligible form. The remaining notices were in identical terms, appropriate to the electronic information identified in them. Neither S or A complied with the notices, and argued, in essence, that the notices compelling them to disclose the passwords or keys to the encrypted computer files were incompatible with the privilege

7 PAGE 7 against self-incrimination. Section 49 of RIPA 2000 creates the power to require disclosure of any protected information; which means, under the provisions of s 56(1): protected information means any electronic data which, without the key to the data cannot, or cannot readily, be accessed, or cannot, or cannot readily, be put into an intelligible form; The provisions of s 49(1) require the protected information to which any notice relates to have been acquired by means of the exercise of a statutory power or any other lawful means, and s 49(2) requires the application to be based on reasonable grounds for believing the following: (a) that a key to the protected information is in the possession of any person, that the imposition of the disclosure requirement in respect of the protected information is necessary on grounds falling within sub-section (3) or necessary for the purpose of securing the effective exercise of proper performance by any public authority of any statutory power or statutory duty that the imposition of such a requirement is proportionate to what is sought to be achieved by its imposition and that it is not reasonably practicable for the person with the appropriate permission to obtain possession of the protected information in an intelligible form without the giving of a notice under this section. For the purposes of this section, what is necessary is limited to the interests set out in s 49(3): in the interests of national security; for the purpose of preventing or detecting crime; or in the interests of the economic well-being of the UK. It is a criminal offence knowingly to refuse or fail to make the disclosure required by a notice issued under s 49. The data that was encrypted might have contained incriminating information, but it is not certain that it would contain incriminating information. Stephens QC J decided that the privilege against self-incrimination was not available because the encrypted material existed, which meant its existence did not depend on the appellants, and the notice was legitimate and proportionate. After briefly discussing the privilege against self-incrimination, and the limits that apply to the privilege, the President raised the question as to whether the principle itself is engaged in each individual case. The

8 PAGE 8 arguments concentrated on whether the passwords to the keys were properly a piece of information with an existence separate from the will of each appellant. The learned President analysed the situation: On analysis, the key which provides access to protected data, like the data itself, exists separately from each appellant s will. Even if it is true that each created his own key, once created, the key to the data, remains independent of the appellant s will even when it is retained only in his memory, at any rate until it is changed. If investigating officers were able to identify the key from a different source (say, for example, from the records of the shop where the equipment was purchased) no one would argue that the key was not distinct from the equipment which was to be accessed, and indeed the individual who owned the equipment and knew the key to it. Again, if the arresting officers had arrived at the premises in Sheffield immediately after S had completed the process of accessing his own equipment enabling them to identify the key, the key itself would have been a piece of information existing, at this point, independently of S himself and would have been immediately available to the police for their use in the investigation. In this sense the key to the computer equipment is no different to the key to a locked drawer. The contents of the drawer exist independently of the suspect: so does the key to it. The contents may or may not be incriminating: the key is neutral. In the present cases the prosecution is in possession of the drawer: it cannot however gain access to the contents. The lock cannot be broken or picked, and the drawer itself cannot be damaged without destroying the contents. 9 In this instance, only the appellants had the passwords to decrypt the documents. The learned President noted that if they gave up the passwords as required, The actual answers, that is to say the product of the appellants minds could not, of themselves, be incriminating. The keys themselves simply open the locked drawer, revealing its contents. 10 The learned President continued his analysis, If however, as for present purposes we are assuming, they contain incriminating material, the fact of the appellants knowledge of the keys may itself become an incriminating fact. For example, to know the key to a computer in your possession which contains indecent images of children may itself tend to support the prosecution case that you were knowingly in possession of such material. The case of In Re: Boucher 11 was cited to illustrate the point, and the distinction was made when knowledge of the password will be relevant to the privilege against self-incrimination. The privilege would only apply if the data, which exists independently of the will of the appellants (the privilege against self-incrimination does not apply to the data), contains incriminating material. If the data did not contain incriminating material, then the knowledge of how to obtain access to it would also not be 9 [2008] EWCA Crim 2177, [2008] WLR (D) 313 at [2008] EWCA Crim 2177, [2008] WLR (D) 313 at WL (D. Vermont Nov. 29, 2007).

9 PAGE 9 incriminating. If the encrypted data were revealed, and they contained incriminating material, then it would be for the trial judge to exclude the evidence under s 78 of the Police and Criminal Evidence Act 1984 if considered appropriate. The Court of Appeal upheld the decision of Martin Stephens QC J because the purpose of the statute is to regulate the use of encrypted material and to impose limitations on the circumstances in which it may be used, subject to a proportionality test and judicial oversight, and neither the process, nor any subsequent trial could be considered to be unfair. 12 Obtaining the password One way of understanding what might be included in encrypted files is to interpret information against known data, as in the United States case of United States of America v. Hersh a.k.a. Mario. 13 In his summary of the facts, Circuit Judge Marcus pointed out that a search of Hersh s residence uncovered evidence of computer images of juvenile males engaged in sexual activities. A number of files were encrypted, and the judge described, in footnote number four, how these were handled by the investigators: Several computer files containing child pornography were found in Hersh's residence: (1) three recovered computer files with viewable images found on the C-drive of Hersh s computer, and (2) encrypted files found on a high-capacity Zip disk. The images on the Zip disk had been encrypted by software known as F-Secure, which was found on Hersh s computer. When agents could not break the encryption code, they obtained a partial source code from the manufacturer that allowed them to interpret information on the file print outs. The Zip disk contained 1,090 computer files, each identified in the directory by a unique file name, such as sfuckmo2, naked31, boydoggy, dvsex01, dvsex02, dvsex03, etc., that was consistent with names of child pornography files. The list of encrypted files was compared with a government database of child pornography. Agents compared the 1,090 files on Hersh s Zip disk with the database and matched 120 file names. Twenty- two of those had the same number of pre-encryption computer bytes as the pre-encrypted version of the files on Hersh s Zip disk. 12 In the Annual Report by the Chief Commissioner of the Office of Surveillance Commissioners, The Rt. Hon. Sir Christopher Rose indicated at 4.11 that During the period of this report, NTAC approved 26 applications for the service of a notice under s.49 of RIPA Part III. Of these 17 went on to obtain permission from a Judge. No permissions were refused and 15 Notices were served. Eleven individuals failed to comply resulting in seven charges and two convictions. The types of crime under investigation were: counter terrorism, child indecency and domestic extremism. In May 2009, Oliver Drage, 19, of Liverpool, was arrested by police officers investigating child sexual exploitation. His computer was seized. It was protected by a 50-character password. He was convicted of failing to disclose an encryption key in September He was sentenced to 16 weeks imprisonment at Preston Crown Court on Monday 4 October 2010: Man jailed over computer password refusal, BBC News, 5 October 2010, at 13 United States Court of Appeals for the Eleventh Circuit No July 17, 2002 before Anderson and Marcus, Circuit Judges, and Middlebrooks, District Judge available in electronic format at

10 PAGE 10 In this instance, although the files could not be decrypted, nevertheless there was a sufficient link between the names of the files and evidence of child pornography known to the police. On other mechanism could be used: to apply for a search warrant and install key logging software on the computer, so as to obtain the password when the computer was used, as in the case of United States v. Scarfo, 180 F.Supp.2d 572 (D.N.J. 2001). Stephen Mason is a barrister with an interest in electronic signatures, authentication, security, electronic evidence, and internet use, interception and monitoring of communications, data protection and privacy. He is an Associate Research Fellow at the Institute of Advanced Legal Studies in London, a member of the IT Panel of the General Council of the Bar of England and Wales, and an independent director of tscheme Limited (tscheme is the national body responsible for accreditation and supervision referred to in Article 3(4) of the EU electronic signature Directive). He is the author of Electronic Signatures in Law (Tottel, 2nd edn, 2007) [the 3rd edition is to be published by Cambridge University Press in January 2012 in both paper and electronic formats], and the general editor of Electronic Evidence (2nd edn, LexisNexis Butterworths, 2010) and International Electronic Evidence (British Institute of International and Comparative Law, 2008). He is the founder, editor and publisher of the international journal Digital Evidence and Electronic Signature Law Review ( now in its eighth year, and which has become an international focal point for lawyers in the area.

11 PAGE 11 Predictive Coding: E-Discovery Game Changer? By Melissa Whittingham, Edward H. Rippey and Skye L. Perryman Predictive coding promises more efficient e- discovery reviews, with significant cost savings, to combat the inflationary growth of electronically stored information (ESI). Should you consider using it? This article discusses whether predictive coding is a game changer or simply another tool in the e-discovery arsenal. We also note factors to consider when assessing whether predictive coding could be helpful for your next case. What is predictive coding? Predictive coding refers generally to the use of automation to manipulate ESI during any stage of e- discovery. The technology is also known by such other names as automated document review, automated document classification, automatic categorization, predictive categorization, and predictive ranking. Predictive coding software, often used in conjunction with traditional early case assessment technologies, presents the possibility to increase rates of document review in turn dramatically reducing review costs. In short, predictive coding (i) start*s+ with a set of data, derived or grouped in any number of variety of ways (e.g., through keyword or concept searching); (ii) use[s] a human-in-the-loop iterative strategy of manually coding a seed or sample set of documents for responsiveness and/or privilege; (iii) employ[s] machine learning software to categorize similar documents in the larger set of data; (iv) analyze[s] user annotations for purposes of quality control feedback and coding consistency. 1 This process can be used to aid reviewers during a traditional manual review or to select and produce documents that have not been viewed by attorneys. Who offers predictive coding? E-discovery vendors currently fall into three camps with respect to predictive coding. The first camp readily admits that they do not offer predictive coding. The second camp offers predictive coding services as the term generally has come to be understood. These include Kroll OnTrack, Servient, and Recommind. Epiq Systems offers Equivio>Relevance that uses statistical and self-learning techniques to calculate graduated relevance scores for each document in the data collection. 2 Several vendors offer software platform Relativity coupled with Content Analyst, marketed as Relativity Analytics, that provides concept search technology. 1 Jason R. Baron, Law in the Age of Exabytes: Some Further Thoughts on Information Inflation and Current Issues in E- Discovery Search, 17 RICH. J.L. & TECH. 9, 32 (Spring 2011). 2 Equivio, Equivio>Relevance, (last visited Aug. 26, 2011).

12 PAGE 12 In June of this year, Recommind announced that it was issued a patent on predictive coding 3 (although it has thus far been unsuccessful in its effort to trademark the term predictive coding 4 ). According to the company, the patent covers systems and methods for iterative computer-assisted document analysis and review. 5 A Recommind representative has announced that Recommind will seek to license the patent to other companies that already offer their own versions of predictive coding or that want to have the ability. 6 Some view the patent as a marketing tactic before a possible IPO. 7 Others note that the patent is broad and could be challenged on the basis of both novelty and nonobviousness. 8 At this point, it is unclear how the patent will affect the predictive coding market. The third set of vendors claim to offer predictive coding services but, it is unclear whether they have true predictive coding as the term has come to be understood. These vendors may use traditional early case assessment tools in an iterative manner that mimics predictive coding outcomes. For example, the vendor may use filtering, keyword, and date searches to reduce a document set. Manual review can then yield additional information to further hone the search terms and group documents. Several repetitions of this process may further winnow the document set. Although this can be a helpful search technique, it is not predictive coding in the traditional sense of technology providing individual coding calls. Is Predictive coding a game changer? Although linear document review in which individuals manually review and code documents ordered by date, keyword, and the like has long been the accepted standard, this approach has become costly and, in many cases, inefficient given the exponential increase in ESI. 9 Further, recent studies demonstrate that manual review may not be the gold standard it was previously thought to be. 10 Unlike individual reviewers, computers do not get headaches or get tired. 11 Search technology 3 See Press Release, Recommind, Recommind Patents Predictive Coding (Jun. 8, 2011), 4 USPTO, Office Action About Applicant s Trademark Application (May 18, 2011), May-2011/sn/false#p=1 ( Registration is refused because the applied-for mark merely describes a characteristic, feature or function of applicant s goods. ); Evan Koblentz, Predictive Coding is Not a Registered Trademark, EDD UPDATE, Jun. 10, 2011, 5 See Press Release, Recommind, Recommind Patents Predictive Coding (Jun. 8, 2011), see also U.S. Patent No. 7,933,859 (filed May 25, 2010). 6 Evan Koblentz, Recommind Intends to Flex Predictive Coding Muscles, LAW.COM, Jun. 8, 2011, &slreturn=1&hbxlogin=1. 7 Id. 8 Id.; Christopher Danzig, Predictive Coding Patented, E-Discovery World Gets Jealous, ABOVE THE LAW BLOG, Jun. 9, 2011, 9 See Craig Carpenter, Predictive Coding Explained, RECOMMIND BLOG, Mar. 10, 2010, 10 See Maura R. Grossman & Gordon V. Cormack, Technology-Assisted Review in E-Discovery Can Be More Effective and More Efficient Than Exhaustive Manual Review, 17 RICH. J.L. & TECH. 11 (2011),

13 PAGE 13 has become closer to approximating human reasoning. 12 Given that predictive coding technology has the potential to be the most proportionate way of managing a case, this is an important new technology that must be considered. Should you consider using predictive coding? We think that predictive coding may be a terrific tool for some cases but, for others, may be less suitable than a traditional review. It depends on the circumstances. The list below offers factors to consider when assessing whether to use predictive coding. 1. Volume of Documents Whether you are producing documents or processing a document dump, predictive coding generally works best with a large quantity of documents. The algorithms behind predictive coding generally need a significant amount of data to work properly. There is also a greater benefit to avoid manual review of all documents with a larger amount of data. The same predictive coding techniques used to identify responsive documents may also be used to assess whether the documents are privileged. It remains to be seen whether predictive coding will work well with technical documents but it is certainly possible that predictive coding could be used here as well. 2. Initial Work Unlike traditional reviews where the bulk of work can occur during the middle or towards the end of the review, predictive coding requires the most work at the start of the review. Instead of a team of contract attorneys diving into the documents and passing their selections to more senior attorneys, predictive coding works best when experienced reviewers review documents until the system is sufficiently trained. Using the skills and knowledge of more senior lawyers to train properly the system will provide long-term benefits. Although this may take a few days of effort at the start, it should be followed by a long tail of cost savings. 3. Get What You Expect As discussed, vendors offer a variety of services and may have different flavors of predictive coding. To ensure you are getting the services you expected, you should ask your vendor to take you through the proposed workflow and explain how it would work. This will guarantee that everyone including the client is on the same page for the review. Herbert L. Roitblat, Anne Kershaw, & Patrick Oot, Document Categorization in Legal Electronic Discovery: Computer Classification vs. Manual Review, 61 J. AM. SOC Y. FOR INFO. SCI. AND TECH. 1 (2010). 11 See John Markoff, Armies of Expensive Lawyers, Replaced by Cheaper Software, N.Y. TIMES, Mar. 4, 2011, 12 See IBM, Watson Research Center, (last visited Aug. 21, 2011).

14 PAGE Price How predictive coding services will be priced in the future remains uncertain. As demonstrated by fees for de-duplication services, vendors tend to charge by the cost savings to the firm not the effort it takes the vendor to provide the service. This means that even if use of predictive coding would cost significantly less than manual review, vendor fees eventually could reduce the amount of savings. In the short term, firms could reap the benefits. Established predictive coding vendors may be firm on pricing, but many vendors may be eager to break into the field and establish a reputation. If you shop around, you may be able to find a vendor willing to offer predictive coding at reduced rates or even for free on a trial basis. 5. Other Uses for Predictive Coding Use of predictive coding software does not have to be an all or nothing commitment. Using predictive coding techniques could enhance a traditional review. Predictive coding software can rank responsive documents meaning that a document could be, for example, 84% responsive. Documents can be ranked by responsiveness so that reviewers see more likely responsive documents first. This information could greatly assist manual reviewers when reviewing the documents and speed up the review. After a certain time, if reviewers find that they are agreeing with the computer, the computer assessments could be used for the remainder of the documents without having actual attorney review. Even if this step is not ultimately taken, predictive coding could aid reviewers in a traditional review. 6. Consider Safeguards. Many lawyers (and their clients) are hesitant to be the test case for the use of predictive coding when there is no reported decision on this or a similar technology, especially when e-discovery sanctions are at an all-time high. 13 As U.S. Magistrate Judge Andrew Peck recently noted at the Carmel Valley ediscovery Retreat, none of the important cases on searches has actually endorsed the use of keywords. 14 All of these cases involved criticism of the way that keywords had been used. 15 To protect yourself in court when using predictive coding, cooperation could be key. Similar to discussing keyword search lists, it may be best to discuss use of predictive coding with the opposing side. Judge Peck advocates being up-front about use of the technology and to get the opponents agreement and buy-in. 16 If agreement is not forthcoming, the court could be consulted to rule quickly 13 Dan H. Willoughby, Jr., Rose Hunter Jones, & Gregory R. Antine, Sanctions for E-Discovery Violations: By the Numbers, 60 DUKE L.J. 789 (2010), Ashby Jones, Study: Lawyer Sanctions Over Electronic Discovery on the Rise, WSJ LAW BLOG, Jan. 13, 2011, 14 Chris Dale, Judge Peck and Predictive Coding at the Carmel ediscovery Retreat, THE E-DISCLOSURE INFORMATION PROJECT, Aug. 2, 2011, 15 Id. 16 Id.

15 PAGE 15 on the issue. Determining how much of the process to reveal will be established in each case, but some discussion of the technology and how it will be used should provide a measure of protection in court. Conclusion The growth of ESI (and the importance of these documents to litigations) make finding a manageable solution to reviewing such material an urgent need. Predictive coding is at the forefront of the response to this issue. Technologies differ from vendor to vendor and the use of any product necessitates diligence from its users to ensure accurate and defensible document review. Use of predictive coding will likely grow more common in the near future. Edward Rippey (erippey@cov.com) is a partner at Washington-based Covington & Burling. He handles complex commercial litigation, including patent cases, and is Chair of the E-Discovery Practice Group. Melissa Whittingham (mwhittingham@cov.com) is a litigation and food & drug associate at the firm, and has expertise in predictive coding and related e-discovery issues. Skye Perryman (sperryman@cov.com) is a litigation associate at the firm, and is a member of the e-discovery practice group.

16 PAGE 16 E-Discovery in Pennsylvania: Bridging the Gap in the Electronic Age By John A. Schwab and Abigail M. Faett The various jurisdictions in the United States, both state and federal, have grown in e-discovery maturity at vastly differing rates. Pennsylvania is no different. State courts in Pennsylvania have only begun to produce cases addressing e-discovery within the past few years. The Supreme Court of Pennsylvania, responsible for promulgating the Pennsylvania Rules of Civil Procedure, recently began examining the value of incorporating e-discovery terms and principles into Pennsylvania s procedural rules. On the other end of the spectrum, Pennsylvania s federal courts are well-versed in e-discovery and their judicial opinions on the subject abound. While this may be due, in part, to the 2006 revisions to the Federal Rules of Civil Procedure, Pennsylvania federal courts eagerly apply e-discovery concepts. This article will outline recent judicial opinions and the proposed rule changes at the state level, and also examine the unique nature of how federal courts in Pennsylvania address e-discovery. Recent Developments in Pennsylvania E-Discovery Law Since the advent of e-discovery, few Pennsylvania courts have addressed the subject. This has changed somewhat in recent years beginning with Brooks v. Frattaroli, where a trial court of the Court of Common Pleas of Lebanon County denied plaintiff s discovery request seeking access to defendant s computer system due to the imprecise nature of the request. 1 In doing so, the court acknowledged the dearth of decisional and rule-making precedent regarding ESI discovery in Pennsylvania compared to the veritable explosion of electronic discovery precedent within the federal civil justice system. 2 On the other hand, the court recognized that the Pennsylvania Rules of Civil Procedure permit requests to enter another party s property for the purpose of inspecting and measuring, surveying, photographing, testing, or sampling the property or any designated object or operation thereon... 3 The court then balanced the value of obtaining ESI with the risk that unrestricted access to an opposing party s ESI could cause discovery abuse and invasion of privacy. 4 Indeed, the court s concern about a fishing expedition is found throughout its opinion. To address such concerns and strike a balance between the potential usefulness and abusiveness of e-discovery, the court examined the (1) scope 1 Brooks v. Frattaroli, 2009 Pa. Dist. & Cnty. Dec. LEXIS 148, at *1-3 (C.C.P. Lebanon Oct. 5, 2009) 2 Id. at *4. 3 Id. (citing Pa.R.C.P ). 4 Id. at *4.

17 PAGE 17 of the requested discovery; (2) confidentiality and privacy; (3) discovery history; (4) costs; and (5) type of case. 5 In applying these factors, the court expressed concern over the expansive nature of the request, which had the potential to recover all metadata, all internet queries, all deleted files, and all stored files. This would, in turn, allow observation into all of defendant s financial records, customer lists, employee performance records, and personal communications. 6 Based on its analysis, the court refused to grant plaintiff direct access to defendant s computer system due to the expansive nature of the request for ESI. 7 Nevertheless, the court noted that its decision was without prejudice and invited a more focused ESI discovery request that is founded upon more clearly identified justification. 8 In McMillen v. Hummingbird Speedway, Inc., a trial court of the Court of Common Pleas of Jefferson County refused to establish a privilege for information posted on Facebook and MySpace. 9 After defendants requested information related to plaintiff s membership in social networking sites, including all user names and passwords, plaintiff claimed that communication shared with one s private friends on social networking sites was privileged, and thus, protected against disclosure. 10 Noting plaintiff s failure to cite any authority to support his position, the court found that no social network site privilege exists and granted defendants request. 11 The court also noted that Pennsylvania generally does not favor evidentiary privileges, and those which do exist are to be narrowly construed. 12 The court balked at the creation of a new privilege because the terms and policies of both Facebook and MySpace dispel any notion that the information one chooses to share, even if only with one friend, will not be disclosed to anyone else. 13 The court also stated that the value of allowing defendants the opportunity to address the truth or falsity of plaintiff s claims outweighed any relational harm suffered by social network users. 14 If there is any indication that the social networking site might contain information relevant to the prosecution or defense of a lawsuit, litigants should be permitted to exhaust all rational means for ascertaining the truth. 15 The ruling in McMillen comports with a more recent Pennsylvania case, Zimmerman v. Weis Markets, Inc., where a trial court of the Court of Common Pleas of Northumberland County also permitted discovery of ESI on social networking sites. 16 Unlike the 5 Id. at * Id. at * Id. at * Id. at *13. 9 McMillen v. Hummingbird Speedway, Inc., 2010 Pa. Dist. & Cnty. Dec. LEXIS 270, at *13 (C.C.P. Jefferson Sept. 9, 2010). 10 Id. at *1, *3. 11 Id. at *3. 12 Id. 13 Id. at *6. 14 Id. at * Id. at *12 (citing Koken v. One Beacon Ins. Co., 911 A.2d 1021, 1027 (Pa. Commw. Ct. 2006)). 16 Zimmerman v. Weis Markets, Inc., No. CV , slip op. at 6 (C.C.P. Northumberland May 19, 2011)

18 PAGE 18 McMillen court, however, the Zimmerman court relied primarily on federal court decisions and state court opinions from outside Pennsylvania in determining that no reasonable expectation of privacy applied to the postings on the social networking sites. 17 E-discovery issues are also beginning to make their way up to Pennsylvania s appellate courts. In Papadopolos v. Schmidt, Ronca & Kramer, P.C., the Superior Court affirmed dismissal of plaintiffs complaint based on the willful spoliation of plaintiffs hard drive. 18 Plaintiffs, a husband and wife, retained the law firm of Smith, Ronca & Kramer, P.C. to represent them in a personal injury claim but the law firm failed to file a timely lawsuit. 19 Upon learning of this and the resultant bar of related claims in the future, plaintiffs filed a professional negligence claim against the law firm. 20 In response to the claim, the law firm asserted a defense of the statute of limitations claiming that plaintiffs suit was filed beyond the two-year statute of limitations. 21 During discovery, counsel for the law firm requested plaintiffs notes from meetings with their prior counsel; however, all of the notes were not produced. 22 In the husband s deposition, he disclosed the existence of notes which he had routinely transferred onto one of the several computers in his home. 23 After a recess in the deposition, the husband presented a computer file purportedly containing his notes. 24 Upon further examination, counsel for the law firm observed that some notes had a modification date which pre-dated the creation date of the file itself; the husband could not explain the discrepancy. 25 As a result, the trial court awarded $3,500 to the law firm s counsel for time and expenses related to the discovery dispute as well as sanctions of $1,000 jointly upon plaintiffs and their counsel. 26 The trial court also ordered that the digital evidence relevant to the case be tendered to a forensic examiner in its natural state. 27 However, after the issuance of that Order, plaintiffs filed a motion disclosing that plaintiffs purchased new computers... and destroyed the hard drives... to prevent personal information from being discovered by unauthorized persons. This act resulted in the trial court s dismissal of the complaint with prejudice. 28 In affirming that ruling, the appellate court held that dismissal of a complaint with prejudice is an appropriate sanction for deliberate spoliation. 29 The 17 Id. at Papadopolos v. Schmidt, Ronca & Kramer, P.C., 2011 Pa. Super. 95, 2011 WL , at *1 (Pa. Super. Ct. May 5, 2011). 19 Id. 20 Id. 21 Id. 22 Id. at *2. 23 Id. 24 Id. at *6. 25 Id. 26 Id. at *7. 27 Id. 28 Id. at *8. 29 Id. at *11 (citing Creazzo v. Medtronic, Inc., 903 A.2d 24 (Pa. Super. Ct. 2006); Mount Olivett Tabernacle Church v. Edwin L. Wiegand Space Division, 781 A.2d 1263 (Pa. Super. Ct. 2001)).