Electronic discovery (or e-discovery, eDiscovery) refers to discovery in civil litigation which deals with the exchange of information in electronic format (often referred to as electronically stored information or ESI).[1] Usually (but not always) a digital forensics analysis is performed to recover evidence. A wider array of people are involved in eDiscovery (for example, forensic investigators, lawyers and IT managers) leading to problems with confusing terminology.[1]
Data is identified as relevant by attorneys and placed on legal hold. Evidence is then extracted and analysed using digital forensic procedures, and is usually converted into PDF or TIFF form for use in court.[1]
Electronic information is considered different from paper information because of its intangible form, volume, transience and persistence. Electronic information is usually accompanied by metadata that is not found in paper documents and that can play an important part as evidence (for example the date and time a document was written could be useful in a copyright case). The preservation of metadata from electronic documents creates special challenges to prevent spoliation. Electronic discovery was the subject of amendments to the Federal Rules of Civil Procedure (FRCP), effective December 1, 2006.
Individuals working in the field of electronic discovery commonly refer to the field as Litigation Support.
Contents |
Examples of the types of data included in e-discovery are e-mail, instant messaging chats, documents, accounting databases, CAD/CAM files, Web sites, and any other electronically stored information that could be relevant evidence in a law suit. Also included in e-discovery is "raw data", which Forensic Investigators can review for hidden evidence. The original file format is known as the "native" format. Litigators may review material from e-discovery in one of several formats: printed paper, "native file,", PDF format, or as single- or multi-page TIFF images.
Quite often, discovery evidence is either delayed or never produced, many times because of the inaccessibility of the data. For example, backup tapes cannot be found, or are erased and reused.
This kind of situation reached its apex during the Zubulake v. UBS Warburg LLC lawsuit. Throughout the case, the plaintiff claimed that the evidence needed to prove the case existed in emails stored on UBS' own computer systems. Because the emails requested were either never found or destroyed, the court found that it was more likely that they existed than not. The court found that while the corporation's counsel directed that all potential discovery evidence, including emails, be preserved, the staff that the directive applied to did not follow through. This resulted in significant sanctions against UBS.
In 2006, the U.S. Supreme Court's amendments to the Federal Rules of Civil Procedure created a category for electronic records that, for the first time, explicitly named emails and instant message chats as likely records to be archived and produced when relevant. The rapid adoption of instant messaging as a business communications medium during the period 2005-2007 has made IM as ubiquitous in the workplace as email and created the need for companies to address archiving and retrieval of IM chats to the same extent they do for email.
With electronic message archiving in place for both email and IM it becomes a fairly simple task to retrieve any email or IM chat that might be used in e-discovery. Some archiving systems apply a unique code to each archived message or chat to establish authenticity. The systems prevent alterations to original messages, messages cannot be deleted, and the messages cannot be accessed by unauthorized persons.
Also important to complying with discovery of electronic records is the requirement that records be produced in a timely manner. The changes to the Federal Rules of Civil Procedure were the culmination of a period of debate and review that started in March 2000 when then Vice President Al Gore’s fundraising activities were being probed by the United States Department of Justice. After White House counsel Beth Norton reported that it would take up to six months to search through 625 storage tapes, efforts began to mandate timelier discovery of electronic records.
Modern message archival systems allow legal and technology professionals to store and retrieve electronic messages efficiently and in a timely manner.
The formalized changes to the Federal Rules of Civil Procedure in December 2006 and in 2007 effectively forced civil litigants into a compliance mode with respect to their proper retention and management of electronically stored information (ESI). The risks that litigants face as a result of improper management of ESI include spoliation of evidence, adverse inference, summary judgement, and sanctions. In some cases, such as Qualcomm v Broadcomm, attorneys can be brought before the bar and risk their livelihood.
Most employees have voicemail that is stored on a computer until it is deleted by the user. Employers may have a duty to retain voicemail if there is an anticipation of litigation involving that employee.
Many corporate employees have company-issued PDAs or smartphones that may contain discoverable material. This can raise issues for collection, as the tools for acquiring data from such devices are difficult to find.
Although petrifying documents to static image formats (tiff & jpeg) had become the standard document review method for almost two decades, native format review has increased in popularity as a method for document review since around 2004. Because it requires the review of documents in their original file formats, applications and toolkits capable of opening multiple file formats have also become popular. This is also true in the ECM (Electronic Content Management) storage markets which are converging quickly with ESI technologies. Organizations susceptible to face eDiscovery requirements should especially be aware that backup tapes are not anymore regulatory compliant. They should be prepared to respond to any eDiscovery request within a reduced timeframe, being aware that if they rely on PST files, it would be a real time and people-consuming activity to search through terabytes of files not offering advanced indexing or searching features.
Petrification involves the conversion of native files into an image format that does not require use of the native applications. This is useful in the redaction of privileged or sensitive information, since redaction tools for images are traditionally more mature, and easier to apply on uniform image types. Efforts to redact similarly petrified PDF files have resulted in the removal of redacted layers and exposure of redacted information, such as social security numbers and other private information.[2][3]
Traditionally, electronic discovery vendors had been contracted to convert native files into TIFF images (for example 10 images for a 10 page Microsoft Word document) with a loadfile for use in image-based discovery review database applications. Increasingly, database review applications have embedded native file viewers with tiff-capabilities. With both native and image file capabilities, it could either increase or decrease the total necessary storage, since there may be multiple formats and files associated with each individual native file. Deployment, storage and best practices are becoming especially critical and necessary to maintain cost-effective strategies.
A number of different people may be involved in an eDiscovery: lawyers for both parties, forensic specialists, IT managers, and records managers, amongst others. Forensic examination often uses unusual terminology and acronyms (for example "image" refers to the acquisition of digital media) which can lead to confusion.[1]
While attorneys involved in case litigation try their best to understand the companies and organization they represent, they may fail to understand the policies and practices that are in place in the company's IT department. As a result, some data may be destroyed after a legal hold has been issued by unknowing technicians performing their regular duties.
Given the complexities of modern litigation and the wide variety of information systems on the market, electronic discovery often requires IT professionals from both the attorney's office (or vendor) and the parties to the litigation to communicate directly to address technology incompatibilities and agree on production formats. Failure to get expert advice from knowledgeable personnel often leads to additional time and unforeseen costs in acquiring new technology or adapting existing technologies to accommodate the collected data.