How To Find Out What You Know About Esi

Transcription

1 Managing the E-Discovery Process: Guidance for Federal Agencies Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Message from the Associate Attorney General Message from Magistrate Judge Paul W. Grimm Overview of the E-Discovery Process Information Management, Identification and Preservation of ESI Featuring the United States Postal Service Collection and Processing of ESI Featuring the United States Department of Agriculture Review and Analysis of ESI Rule 502 Orders Featuring the Army Corps of Engineers Delivery of ESI to DOJ and Production Featuring DOJ Litigation Support Specialists The EPA Approach Conclusion Chapter 1 Message from the Associate Attorney General Message from Magistrate Judge Paul W. Grimm Overview of the E-Discovery Process 1

2 Chapter 2 Information Management, Identification and Preservation of ESI What is the Process? When Is Litigation Reasonably Anticipated? Reasonable anticipation of litigation arises when an organization is on notice of a credible threat it will become involved in litigation or anticipates taking action to initiate litigation. Guideline 1, The Sedona Conference Commentary on Legal Holds: The Trigger & The Process (Sedona Conference Working Group on Electronic Document Retention & Production, August 2007). 2

3 Factors to Consider Plaintiff decision to send cease-and-desist letter referral to or evaluation by DOJ of potential ti claims arising from specific events approval to intervene in qui tam sought Factors to Consider Defendant credible information that it is a target of legal action (e.g., credible cease-and-desist letter) administrative claim letter from counsel indicating intent to file suit written preservation request Factors to Consider Non-party credible information received that it possesses relevant ESI that may be sought by a party to litigation (e.g., receipt of a subpoena). 3

4 Once Litigation is Reasonably Anticipated Identification Locating specific sources of relevant electronic information and determining scope, breadth, and depth. Once Litigation is Reasonably Anticipated 4

5 Photo courtesy of Peter Gibbons/National Snow and Ice Data Center, Identification Steps 1. Assemble a Litigation Response team. 2. Determine who will be responsible for documenting each step of the process. 3. Determine who is subject to the duty to preserve ESI. 4. Determine the relevant time period for which ESI must be preserved. 5. Determine what ESI needs to be preserved and where it is located. 5

6 What Information Must Be Preserved? 1. Sources of potentially relevant ESI 2. In the agency s possession, custody or control 3. At the time the duty to preserve arises (i.e., once litigation is reasonably anticipated ) What Information Must Be Preserved? Think about former employees and third parties such as government contractors. 1. Suspend routine destruction policies for potentially relevant ESI; 2. When in doubt about whether a particular document should be preserved, preserve it; 3. If both paper and electronic documents exist, preserve both; and 4. Preserve drafts and varying versions of the same electronic document, if potentially relevant. Four Categories of ESI 1. Electronic communications and transaction information, such as s and cell phone logs; 2. Electronically created and stored documents, such as word processing documents and spreadsheets; 3. Computer databases; and 4. Systems and other information, such as internet access logs. 6

7 Records and Non-Records All potentially relevant ESI s Word processing files Databases Voice mail messages (cell or office) Text messages Instant messages Audio/video Access logs, surveillance tape Digital images/.wav files Blogs, intranet Wherever stored On the network, off the network (archives, backup) Office and home (key custodians) Removable storage (flash drives, CDs, DVDs) Sources To Consider Databases Networks Computer systems (hardware/software) Servers Backup/disaster recovery tapes Tapes, discs, drives, cartridges and other storage media Laptops Personal computers Internet data Handheld wireless devices Mobile telephones Paging devices Audio systems, including voice mail Identification Counsel and I.T. personnel may need to talk to key custodians to: Identify potentially relevant ESI unique to them (hard copy/electronic, records AND non-records) Identify computer hardware devices they use (desktop computers, laptop, flash drives, PDAs, cell phones, etc.) Identify computer software they use to create potentially relevant ESI Identify locations where they have stored potentially relevant ESI (office and personal) 7

8 Computer Search for ESI Document the search criteria used (keywords, people, dates) Document the search method used (Boolean, concept, key word, fuzzy) Document the locations searched (computers, serves, backups) Document the results of the search(es) Determining the Scope The goal is to implement a reasonable plan to preserve ESI potentially relevant to the case in light of the nature of the litigation. Document why the agency determined that the scope selected was reasonable in light of the nature of the case and the costs to the agency to preserve the information. Identification Steps 1. Assemble a Litigation Response team. 2. Determine who will be responsible for documenting each step of the process. 3. Determine who is subject to the duty to preserve ESI. 4. Determine the relevant time period for which ESI must be preserved. 5. Determine what ESI needs to be preserved and where it is located. Reasonable scope of the preservation effort. 8

9 What is the Process? Preservation Ensuring that potentially relevant/responsive electronic information is protected against alteration of destruction. Litigation Hold A litigation hold is a freeze on all the ESI that falls within the scope of the preservation effort. The litigation hold or freeze supersedes all document retention policies. Routine destruction of potentially relevant ESI subject to the litigation hold must be suspended, regardless of the agency s regular destruction schedules. 9

10 Metadata = Properties Joint Preservation Duty (developing law) Agency (party to the litigation) 1. Identification of key custodians, relevant time frame, and sources of potentially ti relevant ESI (insider). 2. Preservation of sources of potentially relevant ESI. Agency I.T. personnel and records managers ensure that preservation happens. DOJ (outside counsel) 1. Identification of additional sources of potentially relevant ESI (litigator). 2. Preservation of sources of potentially relevant ESI. Verify what s been done. Evaluate if anything else needs to be done. Review agency documentation. Preservation Steps 1. Coordinate with I.T. personnel to determine how to preserve the ESI in its original native file format with the associated metadata (i.e., secure e network space; storage drive). For each category of ESI ( s, IMs, word processing documents, spreadsheets, voic , etc.) develop a preservation plan. 10

11 Three General Ways To Preserve For each category of ESI, determine the best way to preserve it. Automated (typically (yp yi.t. personnel) Change in policy (counsel must determine who has authority) Manual (counsel and/or I.T. professionals should oversee this process) Preservation Steps 1. Coordinate with I.T. personnel to determine how to preserve the ESI in its original native file format with the associated metadata (i.e., secure network space; storage drive). 2. Distribute a written Litigation Hold Notice. Litigation Hold Notice Must be in writing. Should be distributed to all custodians of potentially relevant ESI (more than just agency employees involved with the facts and legal issues in the litigation). 11

12 Written Litigation Hold Notice Elements 1. Identifies key custodians, issues involved, relevant time period, ESI, records/ departments affected. 2. Sets forth the serious consequences for failure to comply. 3. Clear instructions on what information is to be preserved and how it will be collected. 4. Computer files must be preserved in electronic (native file) format. 5. Requires acknowledgement and agreement to comply by recipient. 6. Issued by person in authority to ensure compliance. Preservation Steps 1. Coordinate with I.T. personnel to determine how to preserve (i.e., secure network space; storage drive). 2. Distribute a written Litigation Hold Notice to key custodians. 3. Follow-up with key custodians (key players most likely to have control over or access to key ESI). Follow-up with Key Custodians Counsel should follow-up with each key custodian to ensure: Custodian understands and agrees to comply with the Custodian understands and agrees to comply with the Litigation Hold Notice. Custodian understands the consequences for failing to comply. Counsel understands efforts taken by custodian to locate and preserve potentially relevant information. May want to include I.T. personnel. 12

13 Follow-up with Key Custodians Other sources? personal accounts? instant messages? old computers? other? Preservation Steps 1. Coordinate with I.T. personnel to determine how to preserve (i.e., secure network space; storage drive). 2. Distribute a written Litigation Hold Notice to key custodians. 3. Follow-up with key custodians (key players most likely to have control over or access to key ESI). 4. Set a schedule for periodic reminders of the litigation hold. Periodic Reminders Each custodian subject to the Litigation Hold Notice receives a periodic reminder of the continuing preservation obligation. Have any new issues arisen? Are there new custodians? Are there additional sources of ESI that should be added? Continue to update I.T. personnel as new witnesses are identified. I.T. personnel check in with agency counsel. 13

14 What is the Process? Chapter 3 Collection and Processing of ESI 14

15 What is the Process? Collection Gathering electronic information for further use in the E-Discovery process. Collection of ESI Unless otherwise agreed, ESI should be collected in its native file format with all associated metadata. 15

16 ESI should be collected in its native file format with the associated metadata. Unless otherwise agreed, ESI should not be printed to paper. It is not okay to instruct employees to forward relevant messages or any other electronic files to counsel or any other person. Agency counsel should not redact by deleting privileged or protected information. These practices may alter potential evidence. Collection Steps 1. Determine whether a forensic collection is required. Forensic Collection? Forensic collection Complete copy of a computer hard drive all data down to the 1 s and 0 s. This includes electronic documents, deleted d files, slack space, fragments, system files, etc. Requires computer forensic expert or trained I.T. using forensic software application. 16

17 When Might Forensic Collection Be Necessary? What proprietary information was taken? Who took it? When? 17

18 Title Content Questions To Ask 1. Does the computer itself play some role in this case? 2. Does this case involve a situation where electronic information has been deleted, altered or destroyed? If yes to either question, a forensic collection may be necessary. 18

19 Collection Steps 1. Determine whether a forensic collection is required. 2. Determine who should perform the collection. Determine Who and How Considerations: 1. The ESI should be collected by a qualified person. 2. The ESI should be collected using defensible methods (appropriate software applications, appropriate processes, etc.). Application: A forensic collection should be conducted by a computer forensic expert or trained I.T. professionals using computer forensic copying software. A non-forensic collection should be conducted by trained agency I.T. or litigation support personnel, or by a specialized vendor. Collection Steps 1. Determine whether a forensic collection is required. 2. Determine who should perform the collection. 3. Determine what software should be used. 19

20 Collection Steps 1. Determine whether a forensic collection is required. 2. Determine who should perform the collection. 3. Determine what software should be used. 4. Determine how the collection will be documented. Collection Documentation Standardized, repeatable processes Document all steps taken to collect the files Who collected the information and when Where the information came from (computer/custodian) How the information was copied (software/version) Any errors? How the information was secured 20

21 Chain Title of Custody Content Document each person who touched the ESI, what they did, when they did it, and why. Chain of Custody should include a verification report. The Collection Collection Steps 1. Determine whether a forensic collection is required. 2. Determine who should perform the collection. 3. Determine what software should be used. 4. Determine how the collection will be documented. 5. Secure the collection. 21

22 22

23 Chain Title of Custody Content Type of storage media with unique identifier Sequential numbering Track ESI back to point of origin Content Title What is the Process? 23

24 Processing Reducing the volume of information to something manageable for review. 1 Terabyte of If printed to paper could fill Sears Tower four times. Shows how massive E-Discovery can be. Searching 20,000,000 messages 10 seconds each = 55,556 hours (6.3 years) 1 second each = 5,556 hours (7.7 months) 1/4 second each = 1,389 hours (2 months) 1/10 second each = 557 hours (3 weeks) 1/100 second each = 56 hours (2.3 days) -John Jessen & Mark V. Reichenbach, Data Processing and Production Formats, Georgetown E-Discovery Training Academy (Aug. 2009). 24

25 Data Culling Process Remaining Universe of Documents Search De-duplication Culling File Type Culling Date Range Culling Operating and Program File Culling 25

26 Key Words Date Ranges Domain Names File Types Processing Usually performed by a vendor Requires technical assistance Available through GSA Prices vary, depending on volume and file types Processing Consult with DOJ Does the vendor have the appropriate clearances? Is the vendor qualified to handle the project? 26

27 Processing Title Steps 1. Select a qualified vendor. 2. Understand from a technical perspective what you want the vendor to do. (Seek DOJ assistance) Things To Discuss With DOJ What file types are at issue? Standard file types can be processed. Proprietary software files and databases cannot be processed. Will some files need to be converted prior to processing? This may change the metadata. What metadata fields should be exported? Things To Discuss With DOJ Will files be de-duplicated globally or per custodian? Will native files be converted to.tiff image (the preferred image format) to facilitate redactions, Bates numbering, etc.? If so, make sure the vendor provides links to native files as well. Will messages be threaded? 27

28 Things To Discuss With DOJ What type of deliverable do you want? Native TIFF + text (plus links to native) TIFF + text only Concordance/Summation load file Other? Processing Title Steps 1. Select a qualified vendor. 2. Understand from a technical perspective what you want the vendor to do (Seek DOJ assistance). 3. Develop a list of filters or culling criteria (Consult with DOJ). Data Culling Process Remaining Universe of Documents Search De-duplication Culling File Type Culling Date Range Culling Operating and Program File Culling 28

29 Operating and Program File Culling Removes files not created by computer users NIST (National Institute of Standards Technology) List De-NISTing Chain of Custody form should reflect whether ESI was De-NISTed Processing Title Steps 1. Select a qualified vendor. 2. Understand from a technical perspective what you want the vendor to do (Seek DOJ assistance.) 3. Develop a list of filters or culling criteria. (Consult with DOJ). 4. Vendor documentation. Vendor Chain Titleof Custody Content How was the ESI copied? Who processed the ESI? What software, versions and settings were used? How were the files de-duped? What filers were applied? Any errors? 29

30 Collection Title and Processing 1. The collection of ESI should be done by trained technical professionals. 2. Computer files must be collected as they exist on the computer in their native file format with the associated metadata. 3. Unless otherwise agreed, ESI should not be printed to paper. Collection Title and Processing 4. ESI should not be forwarded to counsel or redacted by deleting information in the file, as this alters the potential evidence. 5. Most processing is done by a vendor, working in close collaboration with agency counsel and I.T. personnel. 30

31 Collection Title and Processing 6. Investing in culling and other processing technologies may save the agency time, money and human resources as well as reduce the agency s risk if its collection and processing efforts are challenged. Chapter 4 Review and Analysis of ESI; Rule 502 Orders What is the Process? 31

32 Initial Review Evaluating information for relevance and privilege. 32

33 HOT DOC! 33

34 Discuss with DOJ How much information must be reviewed? What search criteria should be used to locate potentially relevant ESI? Who will run the research and how will they be documented? How long will the review take? Who within the agency will be responsible for ensuring quality and timeliness of the review? Coding Manuals Technical Issues How will documents be evaluated for relevance and privilege? What issues are important in the litigation and how will the team tag those documents? How will hot documents be flagged? Will attorney notes on particular documents be made and shared? How will the review be divided among several reviewers? Review TitleSteps 1. Discuss a review strategy with DOJ, including search criteria for privileged information. 2. Address technical issues and develop a coding manual for the case. 3. Discuss whether Federal Rule of Evidence 502 Order should be pursued. 34

35 Computer Searches for Privileged Information Explain the key words selected and why (such as attorney names or certain domain names for ). The search was designated and conducted by someone qualified to do the search. Search methods likely to locate the information sought were used. Search tested for accuracy. Computer Searches for Privileged Information What NOT to do Craft search terms based solely on the pleadings. Limit search to key words developed by counsel. Fail to test the accuracy of your search criteria. Fail to document your efforts. What TO do Interview key custodians. Use limiting parameters such as time period, media source, file types, key custodians, key words provided by key custodians, etc. Document the search process and results. Test the accuracy of the search. Discuss search methodologies and criteria with DOJ and possibly opposing counsel. Analysis Evaluating documents that support the claims and defenses in the case, and respond to discovery requests. 35

36 Review Title and Analysis 1. In large document cases, coordination between agency counsel and DOJ about search and review methods is essential. 2. Technical issues related to the review should be addressed and a Coding Manual developed. 3. A Federal Rule of Evidence 502 Order should be considered. 4. Computer searches for privileged information may need to be explained, so they should be defensible and verified for accuracy. Chapter 5 Delivery of ESI to DOJ and Production 36

37 What is the Process? Production Agency counsel delivers to the DOJ litigating team all of the potentially relevant ESI that the agency has identified, preserved, collected, processed and reviewed. Production Format Discuss with DOJ DOJ generally prefers native files. Other formats can be negotiated. Images (TIFF and text)? Concordance/Summation load files? Document coding Proprietary software files and programs. 37

38 Production Title Steps 1. Discuss production format and manner with DOJ. Should ESI be encrypted? 2. Deliver ESI in the format and manner agreed upon. 3. Deliver all associated documentation. Production Title Documentation Copies of all written Litigation Hold Notices and Acknowledgements; and Complete Chain of Custody All search documentation All preservation documentation All collection documentation All processing documentation 38

39 Production Title Steps 1. Discuss production format and manner with DOJ. Should ESI be encrypted? 2. Deliver ESI in the format and manner agreed upon. 3. Deliver all associated documentation. USDOJ May Process Then Review and Analyze Prior to Producing to Opposing Counsel and Presenting in Court What is the Process? 39

40 Chapter 6 The EPA Approach and Conclusion This video should not be construed as a legal interpretation of the Federal Rules of Civil Procedure and the recommendations and suggestions made herein should not be taken as an indication of any view of the Department of Justice or any other department or agency that any such recommended or suggested practices or procedures are, and should be, legally required or sufficient. The guidance is subject to legal precedent, court orders, and local rules. It provides prospective guidance only and is not intended to have the force of law or to create or confer any rights, privileges, or benefits. It is not intended to be, and should not be interpreted t as, an independent d source of rights in, or obligations to, parties in litigation with the government or any other individuals or entities. The dictates of a particular case, including, for example, any court orders dealing with ESI will indicate whether or what action is needed. Government agencies must comply with all applicable legal requirements including retention and preservation obligations required by law, such as the Federal Records Act. The Department of Justice does not endorse any software products that are referenced in this video. 40

41 The overview portion of this video was adapted, with permission, from a video created by Grand Valley State University entitled What Every Businessperson Should Know About E-Discovery, available on YouTube.com. The Electronic Discovery Reference Model and related definitions are used with permission of the E-Discovery experts and other professionals who created the model. See Managing the E-Discovery Process: Guidance for Federal Agencies Presenters Introductory Messages: The Honorable Thomas J. Perrelli Associate Attorney General of the United States The Honorable Paul W. Grimm Chief Magistrate Judge United States District Court for the District of Maryland Narrator: Sarah Michaels Montgomery Senior Litigation Counsel for E-Discovery United States Department of Justice Identification and Preservation / USPS Segment Moderator: Guillermo (Bill) J. Rojas Assistant United States Attorney Northern District of Ohio Agency presenters: David B. Ellis Chief Counsel, NELU Employment and Labor Law United States Postal Service Larry W. Creech Program Manager Corporate Information Security United States Postal Service 41

42 Collection and Processing / USDA Segment Moderator: James Payne Senior Counsel, Law and Policy Section Environment and Natural Resources Division United States Department of Justice Agency presenter: L. Benjamin Young, Jr. Assistant General Counsel, General Law Division United States Department of Agriculture Review and Analysis / Army Corps of Engineers Segment Moderator: Jim McConnon Trial Attorney, Federal Tort Claims Act Section Torts Branch, Civil Division United States Department of Justice Agency presenter: David Dyer Assistant District Counsel, New Orleans District U.S. Army Corps of Engineers Production / DOJ Litigation Support Segment Richard Sutton Director, Office of Litigation Support Environment and Natural Resources Division United States Department of Justice Joshua Wood Chief, Litigation Technology & Information Assurance Branch Office of Management Programs / Office of Litigation Support Civil Division United States Department of Justice 42

43 EPA Segment Moderator: Daniel S. Smith Trial Attorney Environmental Enforcement Section Environment and Natural Resources Division United States Department of Justice Agency presenter: Gary Jonesi Senior Counsel Office of Civil Enforcement Environmental Protection Agency 43