|
|
Although litigators consider
themselves some of the fastest paced and most nimble of all attorneys,
litigation as an industry accepts change in slow, painful gulps.
Substantial changes to the way evidence is exchanged -- namely
the emergence of so-called e-discovery -- is no exception.
In an era when trial by ambush is prohibited, litigators inexplicably
continue to ignore the fact that as much as 30 percent of all
evidence is maintained solely in electronic form.1
While a "head-in-the-sand" approach to discovery may
be easier, less costly and less technical, it cannot be considered
zealous advocacy and may even be the basis for a malpractice
action.2 The good news is that once the
new role of technology in litigation is accepted, litigators
will find that the world of e-discovery is often a fruitful source
of some of the best "smoking gun" documentary evidence.3
In truth, many lawyers who embrace technology welcome e-discovery
and the idea that all litigators will be forced to understand
and engage in conversations about megabytes, metadata, and computer
forensics. However, a complex understanding of technology is
not needed to conduct e-discovery effectively. Attorneys who
understand the basic tenets, strategies, and pitfalls of litigation
should not be wary of jumping headfirst into any e-discovery
battle. The only real difference between electronic evidence
and paper evidence is that one is found on computers, floppy
disks, and network backup tapes; the other is found in a filing
cabinet.
Preserving E-Evidence
In the chronology of a lawsuit, issues of spoliation of e-evidence
arise immediately upon commencement or notification of suit.
Unlike paper evidence, which generally requires some overt, intentional,
or negligent act to destroy it, electronic evidence is often
subject to an automated document retention policy that overwrites
or deletes data. If a policy like this is continued after notice
or commencement of suit it's likely that evidence will be spoliated.
Apart from spoliation due to the document retention policy, acts
such as deleting the hard drives of departed employees or reusing
back-up tapes may lead to sanctions against the client. Both
acts are common practice in the corporate world.
To give this issue context, one need only consider the recent
headlines related to allegations of lost data and intentional
deletion of material in the Enron investigation. When confronted
on the issue of lost data, officials in that matter have claimed
that all data was deleted or recycled pursuant to standard document
retention policies. This response acknowledges the risks of which
practitioners should be aware related to corporate data-retention
policies, but fails to acknowledge the need to preserve data
upon commencement or notice of a possible suit.
The Enron investigation also highlights the increasing importance
of electronic evidence as contrasted to paper documents. The
Enron investigation initially revealed that a large number of
documents had been shredded both at Enron and at Arthur Anderson.
That data was feared lost forever. However, that initial focus
ignored the reality that the bulk of the evidence probably existed
electronically, on the servers, hard drives, and back-up tapes
of Enron and Arthur Anderson.
The lessons learned from the Enron matter should not be presumed
to exist only in the world of extremely large corporations. These
same issues are relevant to any size business client and the
strategic options available to the non-spoliating party are becoming
more and more well known. Quite simply, any business that utilizes
today's technological conveniences -- from the mom-and-pop main
street business to large multinational firms -- could be the
target of an electronic discovery request and/or a sanction for
failing to preserve computer data. A simple understanding of
these issues can easily eliminate these risks.
In hindsight, the solutions to Enron's difficulties are rather
straightforward. Essentially, the goal is to preserve electronic
data. Upon notice or commencement of suit, immediate consideration
should be given to the suspension of any document retention policy.
This can often be accomplished by simply informing the client
in writing of this obligation and instructing them to suspend
any policy calling for the scheduled deletion, recycling, or
overwriting of data. Failure to do so, resulting in the loss
of data after notice of suit, may result in sanctions.4
Another means to achieve data preservation goals is to have the
data that exists at the time of notice or commencement copied
and set aside. The client can then continue operating under its
standard policy. Special instructions are often needed, however,
regarding the preservation of new data. This can be accomplished
by creating an electronic storage area for any new relevant and
discoverable data that is generated.
From a practical standpoint, preserving data is more difficult
when the client has multiple locations with various document
preservation policies. A simple letter to this client informing
them of their obligation to suspend their document retention
policy will not suffice and either a court order or stipulation
should be sought defining the scope of the data to be preserved.
This order, in which a party who owns data seeks to define its
obligation to preserve it, should be distinguished from an order
(often ex parte) sought by a party seeking to prevent
an opposing party from destroying its own data.5
The issuance of an order will often add urgency to the client's
perceptions regarding their responsibility to preserve data while
limiting the burden of preserving irrelevant data.
Managing E-Evidence
Once preserved, electronic evidence can be managed in a manner
not unlike other evidence. For example in federal court, FRCP
Rule 26(a), the initial disclosure rule, requires the disclosure
of "data compilations," which arguably requires each
party to disclose information about their computer systems, storage
of back up data etc.6 Advisers to the
federal judiciary suggest that the initial disclosure of data
compilations does not require a complete search of all client
data or a complete listing of every document that may be subject
to discovery, but instead a description of how these documents
are kept. Satisfying this obligation does not require technical
knowledge. A simple conference with the client IT department
to inquire about the programs, computers, and backup systems
used may suffice.7
An opponent's initial disclosures, however, should not be relied
upon as an assurance that no significant electronic evidence
exists. Often, a party is not aware that deleted material is
recoverable and discoverable, and as such it is not disclosed.
This also applies to underlying information about electronic
documents, such as access dates, creation dates, and other information
known as "metadata" (i.e., data about the data).
Another consideration at the initial disclosure stage of the
suit is whether the disclosure of a computer forensic expert
or electronic discovery expert may be needed. If, for example,
the knowledge of a party is at issue (and this knowledge can
be proved or rebutted by examining data) a forensic expert may
be appropriate. This expert should be disclosed with other expert
disclosures. Additionally, if an electronic discovery expert
is giving a deposition, submitting an affidavit, or testifying
regarding the availability, restoration cost, or process of preparing
data for discovery, that person should be disclosed so that their
opinions will not be excluded under FRCP Rule 37.
Sensitive Issues
After initial disclosures are completed, the Rule 16 conference
or corresponding state court conference can be an opportunity
to understand the level at which electronic evidence will be
exchanged and to settle a number of issues particularly sensitive
in the electronic evidence context. One issue to be addressed
here is inadvertent waiver of privilege. Because computers and
storage media often contain very large numbers of documents,
the risk of disclosing privileged material is great. In some
jurisdictions even the inadvertent release of data containing
privileged material may result in a waiver.8.
A stipulation or court order can resolve such a risk.
Another consideration for the Rule 16 conference relates to the
cost of production of computer evidence in discovery. Because
this evidence may be stored on back-up tapes or other media,
may be mixed in with irrelevant and privileged materials, or
may have been created on an outdated system, there are often
costs related to the restoration and production of this data.
Whether a client's IT staff or an electronic discovery company
handles the processing of the data, the costs may be significant.
Although the courts generally have required that the producing
party pay for production, a number of jurisdictions have allowed
cost splitting or assumption of the costs by a requesting party.9 Authority from jurisdictions nationwide is
often cited on this issue and trial court decisions often are
the foundation on which the arguments rely. This reveals that
this issue, like many of the issues related to electronic evidence,
is unsettled.
Additional considerations for the Rule 16 conference relate to
the technology available to review and cull electronic evidence.
A variety of services and software are available which allow
for key word searching, the removal of duplicates, privilege
searches, and time/user slices. The technology in this area can
also allow the attorney to view the evidence online or in electronic
form and make notes on electronic overlays for other reviewing
attorneys. It is not uncommon for attorneys to negotiate the
key words that will be used in the searches as well as negotiate
specific time periods to which the search for data will be limited.
These stipulations can reduce the amount of data that is processed
and produced and thus substantially reduce the cost of the production
both in review time and money.
Discovering E-Evidence
Once discovery begins, the chase is on for smoking gun e-mails,
memos admitting liability, deleted design documents, and other
documents never intended to see the light of day. Simply adding
a request for e-mails and electronic documents to a standard
discovery request will not likely inspire an opponent to conduct
such a forensic search. Specific requests, clearly aimed at electronic
evidence, are needed instead. It has been proven time and time
again that e-mails are fertile ground for unearthing damaging
documents. Individuals believe them to be private communication.
For example, in Linnen v. A.H. Robbins, a 1999 case involving
the fen-phen drug, an employee of the pharmaceutical company
stated in an email message exchanged with a colleague, "Do
I have to look forward to spending my waning years writing checks
to fat people with a silly lung problem?"
The issue as to how far a producing party must dig in response
to a request for electronic evidence is unsettled but increasingly
favors a deeper inquiry. For example, some decisions allow access
to active data and deleted data alike,10
while in Minnesota, access to personal home computers has been
allowed.11
The submission of an affidavit by an electronic discovery expert
describing the burden, or lack thereof, in obtaining a targeted
piece of data is becoming standard practice in motions to compel
and motions for protective orders related to electronic evidence.
Undeniably, as the court in Anti-Monopoly, Inc. v. Hasbro, Inc.
noted "[t]oday it is black letter law that computerized
data is discoverable if relevant." However, with the variety
of storage locations and the development of new technology, the
question remains as to how far a party has to dig.12
One theme in favor of more production rather than less is the
idea that the difficulty in recovering data from one's own computers
is one's own fault. Many parties have sought protection from
the court due the high cost of producing legacy (i.e.,
old) data and restoring back-up tapes. Courts consistently have
found the difficulty of recovering such data is the result of
a party's own decisions and record keeping scheme.
Accordingly they have found that the requesting party should
not be burdened by the producing party's choice of storage method.13 However consistent with other splits of
authority related to e-discovery, the United States Supreme Court,
in Oppenheimer Fund, Inc. v. Sanders, 437 U.S. 340 (1982), found
that a party should not be penalized for failing to maintain
data in a manner convenient to future litigants.
Acquiring E-Evidence
There is an emerging common procedure for acquiring electronic
evidence and keeping costs and review time down. This procedure
simply requires the application of time-tested methods of litigation
to new media. More and more the federal 30(b)(6) deposition or
its state court equivalent is used to investigate the opposition's
data. Typically an IT professional is deposed with information
about the party's document retention policy, back-up procedures,
and computer systems. This person should be questioned about
whether their employer has suspended its document retention policy.
The most common answer is that no preservation has occurred and
a variety of spoliation sanctions have been ordered from default
to jury instructions. Sanctions may also be available if a party
responding to a request fails to diligently examine its data
and produce the requested information.14
The days of ignoring the electronic evidence portion of a discovery
request are over.
Upon completion of the IT deposition and the acquisition of an
understanding of a party's data, documents requests can be served.
These requests will be more pointed and less likely to fail to
a motion for a protective order than a request filed before deposition
which seeks all of an opponent's data. If this informed documents
request is coupled with a previous stipulation limiting the scope
of the request by key word, user slice, or time slice it is even
more likely to be enforced.
Just as technology is used to generate e-evidence, technology
can be used to collect it and review it. It is wise to utilize
an electronic discovery expert to recover client data from back-up
media. Most vendors in the industry will capture this data at
any time of day, which avoids interruption of the client's operation.
They also utilize specialized methods for copying (imaging) the
data so that nothing on the target hard drive is damaged; they
also often have access to outdated software so that the data
can be restored to a readable format. The use of an electronic
discovery expert is useful whether responding to a request for
data or requesting data in electronic form.
E-Evidence at Trial
After the data has been exchanged and reviewed, the introduction
of electronic evidence at trial requires additional considerations.
The two central issues that arise at trial with electronic evidence
are authentication and hearsay. A consideration of these issues
before trial should eliminate any serious hindrances to admission
of the evidence.
The authentication issue can be explained rather simply. Metadata
(e.g., information about the creation of the electronic
document) will often indicate when and where a document was created,
but it does not necessarily indicate who generated that data
(who actually typed it in). Fed. R. Evid. 901 provides guidance
on how to authenticate electronic evidence. Generally under this
rule, testimony describing the process by which the computer
evidence is generated and how the process produces accurate results
will suffice.
Hearsay objections also often occur when electronic evidence
is offered at trial.15 A variety of exceptions
have been applied including party admissions and business records.
The application of the business records exception is the most
commonly litigated. Although exclusion of computer evidence under
the hearsay rule is unlikely, consideration of the issue before
trial eliminates a break-up in the flow of the presentation of
the evidence.
Once the issue of electronic evidence is examined in the context
of the chronology of a lawsuit, it becomes apparent that an understanding
of the rules of civil procedure is more valuable than technical
computer knowledge. An acknowledgment of the serious pitfalls
related to spoliation, a basic understanding of where data is
stored (hard drives, discs, back up tapes etc.), and a willingness
to negotiate the scope of data sought for review avoids excessive
costs and review time. Beyond these issues, there is little difference
between the exchange of electronic evidence and good old paper
evidence. |
J. Robert Keena is associate legal counsel at ONTRACK
Data International, Inc., an electronic discovery and computer
forensics company.
Mr. Keena (rkeena@ontrack.com)
writes and speaks nationally on e-discovery practices and strategies. |
