e-discovery 2.0

One of the new buzz words of the last few years in computing has been Cloud Computing. After the initial hype, and the subsequent shakeout of its potential, everyone is beginning to recognize that it represents a paradigm shift in how we purchase, deploy, and utilize computing resources. The general impetus for the cloud has been its potential to reduce capital costs, offer flexibility in purchasing computing resources, and reduce operational costs in maintaining hardware resources.

A lot of what the cloud offers is achievable using existing technologies, but repurposed in new and innovative ways. Several forms of the cloud, with specific benefits to customers, are being packaged and promoted. The offerings are delivered as cloud services, such as Platform as a Service (PaaS), Infrastructure as a Service (IaaS) and Software as a Service (SaaS). Without getting into specifics, each service offering comes with a set of service agreements between the purchaser and provider of the cloud services.

As with any new initiative, there are new challenges to contend with including security and compliance with corporate policies and industry regulations.  Although these issues are substantial, for this article, let us consider the legal implications as it relates to electronic discovery. We all know that sooner or later, every organization faces litigation, and increasingly, fair number of them involves e-discovery. Traditionally, in house legal and IT teams have had an understanding of how to respond to legal requests and have focused on litigation readiness. But, how do these translate to the new cloud computing paradigm? I’ll examine some of the challenges in a series of posts on e-discovery and the cloud. For starters, let’s analyze the challenges and considerations inherent with the duty to preserve electronically stored information (ESI).

Duty to Preserve ESI

Before we get to the mechanics of electronic discovery and actual preparation for Rule 26(f) conference, the duty to preserve arises. The duty to preserve may be triggered when a legal proceeding is “reasonably anticipated” and increases in importance on receipt of pre-litigation correspondence or a similar trigger event. Traditionally, such duty to preserve is reflected by placing litigation holds. It is often the case that litigation holds are placed on at least a portion of the ESI well ahead of an actual triggering event. See Adams v. Dell as perhaps an extreme example. In fact, some organizations invest in litigation support software technologies for classifying data and placing holds on the most reasonable subset.

How does such a litigation hold translate into the cloud? As a customer of a cloud, one should craft service agreements to dedicate certain cloud-resident data, in the form of folders or other broad categories, to be preserved. If the cloud provider has deployed technology to ensure that no party within the customer’s user community can delete the preserved data, it is well and good. However, placing such restrictive access impedes normal running of the business, and becomes impractical. Essentially, data in the cloud that is available for normal course of business is in the hands of user-custodians. If they then delete the data either deliberately, or inadvertently, or through normal business functions, that data deletion is subject to spoliation claims. Even though the “safe harbor” from spoliation sanctions of Rule 37(f) applies when information is lost due to the “routine, good faith” operation of electronic information systems, when preservation order is in place, shelter under 37(f) is not possible. Thus, the actual implementation of litigation hold comes under scrutiny. Because of this, many implementations adopt preservation using a “copy and preserve” model. However, this model is at odds with live business data that is constantly evolving. Even if the latest point-in-time snapshot technology at the physical volume is employed, the result is inadequate – you end up preserving massive volumes of data in the cloud, unrelated to actual logical messages or files that need to be preserved. What is needed is some smartness in the form of an application in the cloud itself that can translate a litigation hold request into specific ESI in the cloud. Who owns and manages this application and what the service levels are for this application is a significant issue.

Now, the view from the cloud provider’s perspective is very different. In light of the flexible data management architectures available, there is a great temptation to share both data with a litigation hold and data without a litigation hold on the same physical infrastructure. As a result, the cloud provider   preserves all data from every customer that is resident on that infrastructure – a very conservative approach. As a consequence, this would preserve another customer’s ESI accidentally and that data is now discoverable, in the context of a different litigation, despite the second customer’s active management of the data. Preserving a set of live, constantly changing data in the context of a single enterprise is technically difficult; doing so across multiple customers, sharing the data infrastructure is exponentially harder.

Another related issue with preservation is the need for the ability to release preservation holds. Typically, when the litigation response team determines that the legal hold is not necessary, the hold is released. In the “copy and preserve” model of litigation hold, one has to verify that the released ESI does not overlap with other litigation holds and is marked for destruction. One of the benefits of the cloud is the flexibility in storing bits and pieces of data wherever data capacity is available. Applying the release can again be tricky for both cloud customer and the cloud provider.

Given these additional complexities of evidence in the cloud and the fact that the duty to preserve may arise well before the trigger event of litigation, the costs associated with the duty to preserve can add up very quickly. It’s essential to understand three critical items related to the duty to preserve in the cloud: 1) what the cloud provider would charge for ongoing preservation, 2) whether agreements with the cloud provider cover the legal issues raised by the duty to preserve and 3) what the cloud provider offers in terms of a flexible workflow for applying and releasing legal holds.

Learn More On Litigation Software & Electronic Discovery Litigation

To me, litigation holds in electronic discovery are like Federal sentencing.  Most Federal criminal cases end in a plea agreement, so very few are ever tried in front of a jury, but sentencing must occur in 100% of the cases.  Preservation is very similar – although you are likely to collect and produce in only a subset of cases, you must preserve in 100% of the cases.  So, just as sentencing law is extremely important to the Federal criminal bar, preservation is one of the most important phases of e-discovery to corporate or litigation counsel.  Naturally, I am surprised when I talk to corporate law departments that do not have a documented, repeatable process for legal holds that also includes standard procedures for IT.  Simply emailing a hold notice to a custodian and recording the hold on a spreadsheet is not enough given Judge Shira Sheindlin’s recent opinion in Pension Committee v. Banc of America Securities.

So, what is a defensible litigation hold strategy, and how do you get it done?  It is important to remember that the ultimate goal is preservation of any and all evidence that may be relevant to the matter at hand.  There are no hard and fast rules or checklists – only opinions from the bench of what is not enough.  The keys to defensibility are consistency, standardization, documentation, and diligence.  The place to start is with standardized policies and procedures as well as a person (or a portion of a resource) designated within the enterprise as the single point of contact for all issues related to preservation of evidence (read: project management).  Technology can help, but a great preservation strategy can be developed without an expensive or vast technology investment.  So, how do you get this done?  Here are four steps you should take now:

I. Define the Process (You cannot execute a plan that does not exist):

The first step to creating a great litigation hold strategy is defining a process or set of procedures that can be followed repeatedly.  This process could include setting up tiers for ESI sources, with tier one sources always being preserved (these might include frequently requested sources like email, file servers, and perhaps computers of key custodians), tier two sources being preserved on a case by case basis (including sources that are more industry-specific to the enterprise and therefore not always relevant in routine employment litigation or contract disputes), and finally tier three sources which include everything else.  By tiering ESI sources, the enterprise can focus on developing detailed preservation protocols for the tier one and tier two sources while developing a less detailed protocol for tier three sources which would include simply naming IT subject matter experts who would be consulted in the event that those sources were ever subject to preservation requirements.  This approach would allow the enterprise to prioritize data mapping and cataloging efforts on the tier one and tier two sources first.  Data mapping can be an enormous undertaking, so the enterprise might do well to know as much as it can about the email system rather than spending critical time focusing on ESI that may never be subject to any preservation requirement.

II. Dedicate Resources Appropriately and Engage Them Early:

Personnel are a key concern for preservation.  Allowing too many people to initiate and manage litigation holds could lead to confusion for IT and will certainly yield different results across multiple matters.  A single person or team should be appointed to manage litigation holds for the enterprise, and that person or team should develop a sound relationship with IT, paying particular attention to the subject matter experts who manage tier one data sources.  By forging the relationship early, communication and expectations will align before mistakes are made or spoliation occurs.  Of course, consistency is a key component of defensibility, and this cannot be achieved with a reactive, undocumented approach.  IT must understand the scope and consequences of spoliation, and they must be alerted early enough to halt routine destruction of ESI from the company’s systems.  Most corporate law departments have policies in place for “opening files” when new matters occur; it would be relatively easy to include a step in this procedure for engaging the appropriate personnel to begin preserving ESI at this early stage.  Leaving it up to individual attorneys or paralegals could cause preservation procedures to get implemented at various stages in the litigation, exposing the corporation to unpredictable and varying degrees of liability.

III. Audit, Log, and then Audit the Log:

Auditing the process is also critical to defensibility.  When ESI is moved, the process must be documented (even retaining shipping receipts for ESI that must be transported), and all conversions or alterations of the ESI must be documented (preferably with a procedure for commonly-encountered issues and then in a log as performed).  Log every step along the preservation path – including correspondence with custodians, when litigation hold reminders are sent, and any action performed on the preserved ESI (throughout the duration of the litigation).

IV. Talk to Your Custodians!

Interviews with custodians can go a long way toward achieving the diligence element of defensibility.  Acknowledgment by the custodian that they understand the preservation requirement being placed upon them and that they agree to preserve ESI is critical.  Often, custodians can also provide information about additional custodians who should be contacted or ESI sources that may not have been considered.  These and other matter-specific questions should be asked of the key custodians at a minimum.  This information may also prove useful when developing keywords for early case assessment or meet and confer preparation.

As you may have noticed, I have not mentioned any technology yet.  That is because a sound preservation strategy begins with sound policy, not simply purchasing a technology solution that purports to solve all of your problems.  Invest time in analyzing your litigation history, open matters, ESI sources, and personnel.  From there, processes can be developed, and where there are processes, there are then opportunities for automation and optimization through technology.  Simply defining the process is not enough – it must be repeatable and implemented consistently.  One of the best ways to ensure that a process is repeated is to automate it, removing the potentially error-prone manual work  where it is not required.

Following these steps should help jumpstart the development of a defensible preservation strategy, and once developed, you may be surprised to find that existing technology can help automate many of the procedures you have created.  Where existing technology investments fall short, venture into the market place informed and with the keys to defensibility in mind: consistency, standardization, documentation, and diligence.

Learn More On Litigation Software & Electronic Discovery Litigation

Jason R. Baron was a keynote speaker at a recent electronic discovery summit and he mentioned an electronic data discovery topic that “ought to be blogged about.”  So, with that kind of softball I had to take a swing, particularly because it’s been a topic we (at e-discovery 2.0) have been discussing lately.

The genesis of this blog (per Jason) is the recent “skepticism” evidenced by the bench regarding the defensibility of custodian based collections.  ARMA has a good piece on this very topic, entitled “Is ‘Manual’ Collection of ESI Defensible?”  The core notion is that the tried and true practice of custodian based ESI collection is now under fire by courts, which appear to be looking at this practice with an increasing level of distrust.

“While it is common for companies to use automated data-collection software and hardware, some corporate litigants opt for more informal, “manual” collection methods (i.e., searches performed by individual records custodians) when responding to ESI requests. Companies may choose the manual collection of ESI to reduce costs, particularly if they have limited levels of litigation or lower risk levels posed by the litigation itself.”

While there’s no dispute that the “automated” collection methods available in litigation software referenced above have a number of features that make this approach more efficient, the question is whether a “manual” (i.e., custodian based) collection process is somehow less defensible.  If this is truly the case, then many midsized companies without the budget to purchase such e-discovery applications will inherently be found deficient – which is a daunting notion.

Take the recent case of Ford Motor Co. v. Edgewood Properties Inc., 257 F.R.D. 418 (D.N.J. 2009) where the dispute arose out of the demolition of a Ford assembly plant in New Jersey.  Ford and Edgewood entered into a contract whereby Ford agreed to provide 50,000 cubic yards of concrete to Edgewood in exchange for Edgewood removing it from the site.  When the concrete turned out to be contaminated, the dispute started in earnest.

The crux of Edgewood’s complaint was that it was unhappy with Ford’s production and somehow suspected that the dearth of documents was due to the electronic data collection process.  Edgewood sought to “’confirm the adequacy of Ford’s manual document collection process’ by using a third-party vendor to perform keyword searches on documents not in the existing repository of ESI, but instead, documents within the possession of certain Ford custodians.”

To reconcile the dispute the court looked to the Sedona Conference’s work in the area:

“In The Sedona Conference Best Practices Commentary on the Use of Search and Information Retrieval Methods in E-Discovery, Practice Point 1 states that “[i]n many settings involving electronically stored information, reliance solely on a manual search process for the purpose of finding responsive documents may be infeasible or unwarranted. In such cases, the use of automated search methods should be viewed as reasonable, valuable, and even necessary.”(emphasis added). Once again, the Court confronts this peculiar situation insofar as Edgewood has a point that the document collection method used by Ford is not necessarily contemplated under the Sedona Principles, but that agreement by the parties at the outset as to the mode of collection would have been the proper and efficacious course of action.  However, “[a]bsen[t] agreement, a [responding] party has the presumption, under Sedona Principle 6, that it is in the best position to choose an appropriate method of searching and culling data.”

Accordingly, the court found that the lack of agreement coupled with Ford being in the best position to make a call about the methodology, was a deciding factor in generally upholding Ford’s manual collection process.

“It would be improvident at this juncture to grant Edgewood the relief it seeks when it has not shown any indicia of bad faith on the part of Ford. To countenance such a holding would unreasonably put the shoe on the other foot and require a producing party to go to herculean and costly lengths (especially in a document-heavy case such as this) in the face of mere accusation to rebut a claim of withholding. This scenario is not contemplated by the Federal Rules.”

While Ford wasn’t penalized for its manual collection, this practice has come under fire in several other opinions.  In the highly controversial case of Phillip M. Adams & Assoc., LLC v. Dell, Inc., 621 F. Supp. 2d 1173 (D. Utah 2009) custodian based collection/preservation policies were similarly under fire.

“ASUS’ practices invite the abuse of rights of others, because the practices tend toward loss of data. The practices place operations-level employees in the position of deciding what information is relevant to the enterprise and its data retention needs. ASUS alone bears responsibility for the absence of evidence it would be expected to possess. While Adams has not shown ASUS mounted a destructive effort aimed at evidence affecting Adams or at evidence of ASUS’ wrongful use of intellectual property, it is clear that ASUS’ lack of a retention policy and irresponsible data retention practices are responsible for the loss of significant data.”

Adams was in fact cited by Judge Scheindlin in her latest opus – Pension Comm. of the Univ. of Montreal Pension Plan v. Banc of America Sec. LLC, No. 05 Civ. 9016, 2010 U.S. Dist. Lexis 4546, at *1 (S.D.N.Y. Jan. 15, 2010), where she found fault with the Plaintiff’s reliance on manual collections:

“This instruction does not meet the standard for a litigation hold. It does not direct employees to preserve all relevant records–both paper and electronic-nor does it create a mechanism for collecting the preserved records so that they can be searched by someone other than the employee.  Rather, the directive places total reliance on the employee to search and select what that employee believed to be responsive records without any supervision from Counsel.

From the foregoing, it’s probably too early to call the skepticism over manual collection a trend per se.  Certainly, lobbing a preservation notice over the proverbial wall to custodians without the requisite level of supervision is a recipe for disaster.  Education (about the matter and the required tasks), compliance (with the preservation instructions) and ongoing monitoring (to ensure that compliance continues over time) are all critical responsibilities that must be thoughtfully undertaken by counsel for a defensible ediscovery process.

The question then becomes, is the problem here really about the “manual” collection efforts by the custodians or more simply the fact that they aren’t supervised with the requisite degree of care?  If this is the case, which I’d opine that it is, then “properly executed” manual collections should be fine (i.e., defensible).

But, as Ford indicates, if your company is going to rely upon a manual collection modus operandi, then it may be advisable to let the opposition in on the use of this tactic.  This approach may be mandated by local rule or it may just be the type of transparent cooperation that’s all the rage these days.

Learn More On Litigation Support Software & Electronic Discovery Litigation