March 2002 


Display Ads
Article Index
Mar '02 Issue
Latest Issue
MSBA Home Page

Unearthing Documents Byte by Byte

By J. Robert Keena


Although litigators consider themselves some of the fastest paced and most nimble of all attorneys, litigation as an industry accepts change in slow, painful gulps. Substantial changes to the way evidence is exchanged -- namely the emergence of so-called e-discovery -- is no exception.

In an era when trial by ambush is prohibited, litigators inexplicably continue to ignore the fact that as much as 30 percent of all evidence is maintained solely in electronic form.1 While a "head-in-the-sand" approach to discovery may be easier, less costly and less technical, it cannot be considered zealous advocacy and may even be the basis for a malpractice action.2 The good news is that once the new role of technology in litigation is accepted, litigators will find that the world of e-discovery is often a fruitful source of some of the best "smoking gun" documentary evidence.3

In truth, many lawyers who embrace technology welcome e-discovery and the idea that all litigators will be forced to understand and engage in conversations about megabytes, metadata, and computer forensics. However, a complex understanding of technology is not needed to conduct e-discovery effectively. Attorneys who understand the basic tenets, strategies, and pitfalls of litigation should not be wary of jumping headfirst into any e-discovery battle. The only real difference between electronic evidence and paper evidence is that one is found on computers, floppy disks, and network backup tapes; the other is found in a filing cabinet.

Preserving E-Evidence

In the chronology of a lawsuit, issues of spoliation of e-evidence arise immediately upon commencement or notification of suit. Unlike paper evidence, which generally requires some overt, intentional, or negligent act to destroy it, electronic evidence is often subject to an automated document retention policy that overwrites or deletes data. If a policy like this is continued after notice or commencement of suit it's likely that evidence will be spoliated. Apart from spoliation due to the document retention policy, acts such as deleting the hard drives of departed employees or reusing back-up tapes may lead to sanctions against the client. Both acts are common practice in the corporate world.

To give this issue context, one need only consider the recent headlines related to allegations of lost data and intentional deletion of material in the Enron investigation. When confronted on the issue of lost data, officials in that matter have claimed that all data was deleted or recycled pursuant to standard document retention policies. This response acknowledges the risks of which practitioners should be aware related to corporate data-retention policies, but fails to acknowledge the need to preserve data upon commencement or notice of a possible suit.

The Enron investigation also highlights the increasing importance of electronic evidence as contrasted to paper documents. The Enron investigation initially revealed that a large number of documents had been shredded both at Enron and at Arthur Anderson. That data was feared lost forever. However, that initial focus ignored the reality that the bulk of the evidence probably existed electronically, on the servers, hard drives, and back-up tapes of Enron and Arthur Anderson.

The lessons learned from the Enron matter should not be presumed to exist only in the world of extremely large corporations. These same issues are relevant to any size business client and the strategic options available to the non-spoliating party are becoming more and more well known. Quite simply, any business that utilizes today's technological conveniences -- from the mom-and-pop main street business to large multinational firms -- could be the target of an electronic discovery request and/or a sanction for failing to preserve computer data. A simple understanding of these issues can easily eliminate these risks.

In hindsight, the solutions to Enron's difficulties are rather straightforward. Essentially, the goal is to preserve electronic data. Upon notice or commencement of suit, immediate consideration should be given to the suspension of any document retention policy. This can often be accomplished by simply informing the client in writing of this obligation and instructing them to suspend any policy calling for the scheduled deletion, recycling, or overwriting of data. Failure to do so, resulting in the loss of data after notice of suit, may result in sanctions.4

Another means to achieve data preservation goals is to have the data that exists at the time of notice or commencement copied and set aside. The client can then continue operating under its standard policy. Special instructions are often needed, however, regarding the preservation of new data. This can be accomplished by creating an electronic storage area for any new relevant and discoverable data that is generated.

From a practical standpoint, preserving data is more difficult when the client has multiple locations with various document preservation policies. A simple letter to this client informing them of their obligation to suspend their document retention policy will not suffice and either a court order or stipulation should be sought defining the scope of the data to be preserved. This order, in which a party who owns data seeks to define its obligation to preserve it, should be distinguished from an order (often ex parte) sought by a party seeking to prevent an opposing party from destroying its own data.5 The issuance of an order will often add urgency to the client's perceptions regarding their responsibility to preserve data while limiting the burden of preserving irrelevant data.

Managing E-Evidence

Once preserved, electronic evidence can be managed in a manner not unlike other evidence. For example in federal court, FRCP Rule 26(a), the initial disclosure rule, requires the disclosure of "data compilations," which arguably requires each party to disclose information about their computer systems, storage of back up data etc.6 Advisers to the federal judiciary suggest that the initial disclosure of data compilations does not require a complete search of all client data or a complete listing of every document that may be subject to discovery, but instead a description of how these documents are kept. Satisfying this obligation does not require technical knowledge. A simple conference with the client IT department to inquire about the programs, computers, and backup systems used may suffice.7

An opponent's initial disclosures, however, should not be relied upon as an assurance that no significant electronic evidence exists. Often, a party is not aware that deleted material is recoverable and discoverable, and as such it is not disclosed. This also applies to underlying information about electronic documents, such as access dates, creation dates, and other information known as "metadata" (i.e., data about the data).

Another consideration at the initial disclosure stage of the suit is whether the disclosure of a computer forensic expert or electronic discovery expert may be needed. If, for example, the knowledge of a party is at issue (and this knowledge can be proved or rebutted by examining data) a forensic expert may be appropriate. This expert should be disclosed with other expert disclosures. Additionally, if an electronic discovery expert is giving a deposition, submitting an affidavit, or testifying regarding the availability, restoration cost, or process of preparing data for discovery, that person should be disclosed so that their opinions will not be excluded under FRCP Rule 37.

Sensitive Issues

After initial disclosures are completed, the Rule 16 conference or corresponding state court conference can be an opportunity to understand the level at which electronic evidence will be exchanged and to settle a number of issues particularly sensitive in the electronic evidence context. One issue to be addressed here is inadvertent waiver of privilege. Because computers and storage media often contain very large numbers of documents, the risk of disclosing privileged material is great. In some jurisdictions even the inadvertent release of data containing privileged material may result in a waiver.8. A stipulation or court order can resolve such a risk.

Another consideration for the Rule 16 conference relates to the cost of production of computer evidence in discovery. Because this evidence may be stored on back-up tapes or other media, may be mixed in with irrelevant and privileged materials, or may have been created on an outdated system, there are often costs related to the restoration and production of this data. Whether a client's IT staff or an electronic discovery company handles the processing of the data, the costs may be significant. Although the courts generally have required that the producing party pay for production, a number of jurisdictions have allowed cost splitting or assumption of the costs by a requesting party.9 Authority from jurisdictions nationwide is often cited on this issue and trial court decisions often are the foundation on which the arguments rely. This reveals that this issue, like many of the issues related to electronic evidence, is unsettled.

Additional considerations for the Rule 16 conference relate to the technology available to review and cull electronic evidence. A variety of services and software are available which allow for key word searching, the removal of duplicates, privilege searches, and time/user slices. The technology in this area can also allow the attorney to view the evidence online or in electronic form and make notes on electronic overlays for other reviewing attorneys. It is not uncommon for attorneys to negotiate the key words that will be used in the searches as well as negotiate specific time periods to which the search for data will be limited. These stipulations can reduce the amount of data that is processed and produced and thus substantially reduce the cost of the production both in review time and money.

Discovering E-Evidence

Once discovery begins, the chase is on for smoking gun e-mails, memos admitting liability, deleted design documents, and other documents never intended to see the light of day. Simply adding a request for e-mails and electronic documents to a standard discovery request will not likely inspire an opponent to conduct such a forensic search. Specific requests, clearly aimed at electronic evidence, are needed instead. It has been proven time and time again that e-mails are fertile ground for unearthing damaging documents. Individuals believe them to be private communication. For example, in Linnen v. A.H. Robbins, a 1999 case involving the fen-phen drug, an employee of the pharmaceutical company stated in an email message exchanged with a colleague, "Do I have to look forward to spending my waning years writing checks to fat people with a silly lung problem?"

The issue as to how far a producing party must dig in response to a request for electronic evidence is unsettled but increasingly favors a deeper inquiry. For example, some decisions allow access to active data and deleted data alike,10 while in Minnesota, access to personal home computers has been allowed.11

The submission of an affidavit by an electronic discovery expert describing the burden, or lack thereof, in obtaining a targeted piece of data is becoming standard practice in motions to compel and motions for protective orders related to electronic evidence. Undeniably, as the court in Anti-Monopoly, Inc. v. Hasbro, Inc. noted "[t]oday it is black letter law that computerized data is discoverable if relevant." However, with the variety of storage locations and the development of new technology, the question remains as to how far a party has to dig.12

One theme in favor of more production rather than less is the idea that the difficulty in recovering data from one's own computers is one's own fault. Many parties have sought protection from the court due the high cost of producing legacy (i.e., old) data and restoring back-up tapes. Courts consistently have found the difficulty of recovering such data is the result of a party's own decisions and record keeping scheme.

Accordingly they have found that the requesting party should not be burdened by the producing party's choice of storage method.13 However consistent with other splits of authority related to e-discovery, the United States Supreme Court, in Oppenheimer Fund, Inc. v. Sanders, 437 U.S. 340 (1982), found that a party should not be penalized for failing to maintain data in a manner convenient to future litigants.

Acquiring E-Evidence

There is an emerging common procedure for acquiring electronic evidence and keeping costs and review time down. This procedure simply requires the application of time-tested methods of litigation to new media. More and more the federal 30(b)(6) deposition or its state court equivalent is used to investigate the opposition's data. Typically an IT professional is deposed with information about the party's document retention policy, back-up procedures, and computer systems. This person should be questioned about whether their employer has suspended its document retention policy. The most common answer is that no preservation has occurred and a variety of spoliation sanctions have been ordered from default to jury instructions. Sanctions may also be available if a party responding to a request fails to diligently examine its data and produce the requested information.14 The days of ignoring the electronic evidence portion of a discovery request are over.

Upon completion of the IT deposition and the acquisition of an understanding of a party's data, documents requests can be served. These requests will be more pointed and less likely to fail to a motion for a protective order than a request filed before deposition which seeks all of an opponent's data. If this informed documents request is coupled with a previous stipulation limiting the scope of the request by key word, user slice, or time slice it is even more likely to be enforced.

Just as technology is used to generate e-evidence, technology can be used to collect it and review it. It is wise to utilize an electronic discovery expert to recover client data from back-up media. Most vendors in the industry will capture this data at any time of day, which avoids interruption of the client's operation. They also utilize specialized methods for copying (imaging) the data so that nothing on the target hard drive is damaged; they also often have access to outdated software so that the data can be restored to a readable format. The use of an electronic discovery expert is useful whether responding to a request for data or requesting data in electronic form.

E-Evidence at Trial

After the data has been exchanged and reviewed, the introduction of electronic evidence at trial requires additional considerations. The two central issues that arise at trial with electronic evidence are authentication and hearsay. A consideration of these issues before trial should eliminate any serious hindrances to admission of the evidence.

The authentication issue can be explained rather simply. Metadata (e.g., information about the creation of the electronic document) will often indicate when and where a document was created, but it does not necessarily indicate who generated that data (who actually typed it in). Fed. R. Evid. 901 provides guidance on how to authenticate electronic evidence. Generally under this rule, testimony describing the process by which the computer evidence is generated and how the process produces accurate results will suffice.

Hearsay objections also often occur when electronic evidence is offered at trial.15 A variety of exceptions have been applied including party admissions and business records. The application of the business records exception is the most commonly litigated. Although exclusion of computer evidence under the hearsay rule is unlikely, consideration of the issue before trial eliminates a break-up in the flow of the presentation of the evidence.

Once the issue of electronic evidence is examined in the context of the chronology of a lawsuit, it becomes apparent that an understanding of the rules of civil procedure is more valuable than technical computer knowledge. An acknowledgment of the serious pitfalls related to spoliation, a basic understanding of where data is stored (hard drives, discs, back up tapes etc.), and a willingness to negotiate the scope of data sought for review avoids excessive costs and review time. Beyond these issues, there is little difference between the exchange of electronic evidence and good old paper evidence.

J. Robert Keena is associate legal counsel at ONTRACK Data International, Inc., an electronic discovery and computer forensics company. Mr. Keena (rkeena@ontrack.com) writes and speaks nationally on e-discovery practices and strategies.


1 Monte E. Sokol & Phillip P. Andriola, "Cyberspace Becomes Ground Zero in Discovery Process and at Trial," N.Y.L.J., 12/1/97, S5.
2 Brian J. Simpson & Reed F. Simpson, "Computer Discovery Techniques: Legal Malpractice," 39
Orange Cty. Lawyer 12 (August 1997).
See Siemens v. Atlantic Richfield, 1994 U.S. Dist LEXIS 3026 (S.D.N.Y. 1994).
See William T. Thompson Co. v. General Nutrition 593 F.Supp. 1443 (C.D. Cal 1984).
See Linnen v. A.H. Robbins, 1999 WL 462015 (Mass. Super. Ct. 6/16/99). A helpful example of a copy of an electronic evidence preservation order can be found on the website for the Firestone/Ford case at http://www.insd.uscourts.gov/firestone/default.htm.
6 See e.g. Kleiner v. Burns, 2000 WL 1909470 (D. Kan. 12/15/00).
See http://www.fclr.org/ for a list of topics to be discussed at this stage of the litigation.
8 See United States v. Keystone Sanitation Co., 885 F.Supp. 672 (M.D. Pa. (1994)
Rhone-Poulenc Rorer, Inc. v. Home Indemnity, 1991 WL 111040 (E.D. Pa. 1991).
10 Simon Property Group v. My Simon, Inc., 194 F.R.D. 639 (S.D. Ind. 2000).
Northwest Airlines v. Local 2000, C.A. No. 00-08DWF/AJB (D. Minn. 2/2/00) (Order on Defendants' Motion for Protective Order and Plaintiff's Motion to Compel Discovery); Northwest Airlines v. Local 2000, C.A. No. 00-08DWF/AJB (D. Minn. 2/29/00) (Memorandum Opinion and Order).
Anti-Monopoly, Inc. v. Hasbro, Inc., (S.D.N.Y. 6/1/95)
See Delozier v. First Nat'l Bank of Gaitlinburg, 109 F.R.D. 161 (E.D. Tenn. 1986).
Jankins v. TDC Management Corp. 21 F.3d 436 (D.D.C. 1994) (excluding evidence from trial and, imposing fees and costs in excess of $70,000 for failure to turn over computer discs and other evidence).
In re Estate of Newman, 58 S.W.3d 640 (9/11/01).