Electronic Discovery and Digital Evidence in a Nutshell - Chapter VI Outline

Here's another installment of my outline of Electronic Discovery and Digital Evidence in a Nutshell, the second edition of the West Academic guide to electronic discovery law in the United States authored by Judge Shira Scheindlin (the judge in the Zubulake v. UBS Warburg) and members of the Sedona Conference. An outline of the previous chapter was posted on January 12, 2017.

CHAPTER VI – PRODUCTION OF ESI - Request and production of ESI Governed by FRCP 34 - 34(b)(1) – request can specify the form of the ESI. - 34(b)(2) – response can object to the requested form; must state form it intends to produced in. Unless otherwise stipulated must produce documents as they are kept in the ordinary course of business or organize and label them according to the categories in the request. If request does not specify must be produced in form kept in the ordinary course of business, or a reasonably usable form. ESI need not be produced in more than one form. - ESI is distinguished by the fact that it can be produced in a number of different forms and is searchable and sortable.

A. RULE 34 FORM OF PRODUCTION (PAPER, IMAGES, NATIVES OR OTHER FORMS) a. Is production in PDF form acceptable? Dixon v. Experian (N.D. Ind. 2014) production of unsearchable PDFs. Motion to compel approved required ESI in its native format. b. Database Reports and Emails – PSEG Power v. Alberici (N.D.N.Y. 2007) Emails produced divorced from attachments. Court ordered re-production of emails with their attachments. c. Unless the requesting party states a clear preference (which may trigger negotiation if the responding party objects), the requesting party may be forced to accept whatever “reasonably useable” form the requesting party chooses. XL Specialty v. Bollinger (E.D. La. 2014) – 4M documents produced as unindexed by OCR recognizable images. Motion to compel native format was denied. d. Reasonably usable? Sedona Principle 12 – absent party agreement or court order production should be in form in which it is ordinarily maintained or reasonably usable, “ taking into account the need to produce reasonably accessible metadata that will enable the receiving party to have the same ability to access, search, and display the information as the producing party where appropriate or necessary in light of the nature of the information and the needs of the case.”

B. RULE 34 ORGANIZATION OF PRODUCTION a. Are FRCP 34(b)(2)(E)(i) [requiring documents to be organized according to categories in the request] and FRCP 34(b)(2)(E)(ii) [if party does not specify form for ESI must produce in form used in ordinary course of business or reasonably usable form] mutually exclusive? b. Anderson Living v. WPX Energy (D.N.M. 2014) ESI produced as searchable PDFs need not be categorized because it was searchable. c. Venture v. Barrett (N.D. Cal. 2014) Goal of FRCP 34(b)(2)(E)(i) is to prevent a document dump, and applies to ESI as well as FRCP 34(b)(2)(E)(ii). Ordered initial production of ESI without an agreement as to form, to be re-produced custodial and organization information, and with load files containing metadata and searchable text. d. SEC v. Collins & Aikman (S.D.N.Y. 2009) form in which ESI is ordinarily maintained is not necessarily reasonably usable. Records must be produced in the compilations (175 organized file folders) already prepared by the SEC for their own internal review purposes, despite the SEC’s objection that producing the compilations would reveal attorney work product. The court held that production of a sprawling, disorganized database did not satisfy the requirement that the documents be produced in a reasonably useable form.

C. PRODUCTION OF METADATA a. Application metadata embedded in a file and system metadata used by file system to track file location, name, size, creation, modification and usage. b. Native format: associated file structure defined by the original creating application. c. Document metadata – information accessed via properties view. d. Embedded metadata – track changes or comments. e. User added metadata – includes annotations and subjective coding information. f. Vendor added metadata – data generated as a result of processing a document g. Williams v. Sprint (D. Kan. 2005) – metadata for Excel spreadsheets was scrubbed prior to production and certain cells locked so they could not be accessed. Metadata was not specifically requested. Court held that ESI should be produced with metadata intact unless the party timely objects to its production, parties agree that it should not be produced, or producing party requests a protective order. Party should have reasonably understood request to mean spreadsheets should be produced with their metadata intact. Ordinarily maintained is not synonymous with native format. Data may be archived for long terms storage. Routine migration may result in loss of metadata. If metadata is relevant to claims or defenses it must be specified for preservation purposes.

D. PRODUCTION OF DATABASES a. Aguilar v. ICE (S.D.N.Y. 2008) – Plaintiffs requested production of ICE database and ICE produced text searchable PDFs. Court held that metadata is more critical to understanding a database. b. Sedona Conference Six Database Principles i. Scope of Discovery – only database fields that contains relevant information, not underlying application. ii. Accessibility and proportionality – not all data in database is equally accessible. Parties should apply proportionality to determine marginal value and cost. iii. Use of test queries and pilots – to determine burden and benefits of collecting and production information iv. Validation – reasonable measures to ensure that collection is complete and did not alter the data. v. Data Authenticity and Admissibility – validation of collection does not make the information true or authentic – these are separate issues. vi. Form of Production – the way in which the requesting party intends to the use the data is important in determining the form of production.

E. PRODUCTION OF DIGITAL IMAGES AND LOAD FILES a. Production of ESI in form in which it is ordinarily maintained may present burdensome privacy or privilege concerns, or difficult to use without proprietary software, and so must be produced as digital images. b. Particular fields to be included vary and should be negotiated by the parties depending on the needs of the case.

F. ON-SITE INSPECTION AND MIRROR IMAGES a. Court ordered inspections are allowed under FRCP 34(a) to mirror image an opposing parties hard drives. b. FRCP 34(a) does not create a routine right of access. Courts must balance need for relevant evidence against disclosure of privileged material and undue intrusiveness. c. Inspection protocols should: i. Forensic expert will obtain the images ii. Images maintained by party whose drives were imaged. iii. Production party must have chance to remove privileged or non-relevant information. iv. Responsive data disclosed with privilege log. d. Ingrid & Isabel v. Baby Be Mine (N.D. Cal. 2014) – because response to requests was late and inadequate, court ordered plaintiff be given access to defendant’s computers by expert jointly retained by the parties. e. Schreiber v. Schreiber (N.Y. Sup. Ct. 2010) – courts will not order wholesale turnover of computer drive. No fishing expeditions. Will consider need for confidentiality of competitive materials, privileged materials, and inconvenience to owner. Necessary components of protocol: i. Discovery referee to supervise. ii. Forensic computer expert iii. Cloning procedure that prevents alteration or files and allows for recovery of files. iv. Scope of discovery – keywords and date range. v. First level review by producing party. vi. Second level review by requesting party. vii. Mechanism for resolving disputes by the referee. viii. Provisions for costs to be borne by the requesting party. ix. Fast track discovery schedule x. Provisions for retention and disposition of clone at conclusion of action. f. Mere conjecture or suspicion that an adversary has not produced discoverable information is not enough. g. Courts may deny request for imaging where the burden on the responding party is too great.

G. DISCOVERY FROM RULE 30 (b)(6) WITNESS WITH KNOWLEDGE OF DOCUMENT RETENTION AND PRODUCTION a. 30(b)(6) witnesses must testify about information known or reasonably available to an organization; not just personal knowledge. b. Majority rule is that scope of deposition is limited by relevance and privilege bounds of FRCP 26(b). Some courts have held that the requirement that a party noticing the Rule 30( b)( 6) deposition “describe with reasonable particularity the matters on which examination is requested” limits the scope of the deposition to the contents of that notice. c. IT professional or record retention manager is routinely designated as 30(b)(6) witness. d. In re Actos Prod. Liab. (W.D. La. 2014) – no one person familiar with all aspects of preservation and collection. Company hired consultant that interviewed many employees and made on-site visits. Court found that because consultant was never employee and showed no knowledge of IT procedures and interplay with litigation hold policy, Takeda did not act in good faith in designating him, and Takeda acted in bad faith as to destruction and deletion of documents and engaged in willful abuse of judicial process in attempt to conceal deletion and destruction.

H. PRODUCTION FROM NON-PARTIES PURSUANT TO RULE 45 a. Rule 26( b)( 2)( B) (not reasonably accessible data) is the same as Rule 45( e)( 1)( D). b. Rule 26( b)( 5)( B) (inadvertent disclosure of material) is the same as Rule 45( e)( 2)( B). c. Rule 34( b)( 2)( E)( iii) corresponds to Rule 45( e)( 1)( C). d. Rule 34( b)( 2)( E)( ii) is the same as Rule 45( e)( 1)( B) (form of production). e. Court must have personal jurisdiction to enforce FRCP 45 subpoena. f. Concept of possession, custody and control applies just as it does for FRCP 34 document request. g. Relief From Undue Burden or Expense – Rule 45 subpoenas may be subject to heightened scrutiny; courts will relief nonparties from substantial burden. h. Nonparty Preservation Duties - Third parties may have obligations to preserve evidence relevant to others’ litigation imposed by contract or other special relationship once they have notice of the existence of the dispute. i. Subpoenas of Internet Service Providers – Getting email, social media postings, etc. from ISP prohibited by Electronic Communications Privacy Act absent customer’s express consent. j. Legal Restrictions on Disclosure – i. HIPAA – privacy protection for health records. Title II of HIPAA provides extensive rules regarding the secure storage and exchange of electronic data transactions and requirements promoting the confidentiality and privacy of individually identifiable health information. ii. Computer Fraud and Abuse Act – illegal to access a computer without authorization or to exceed authorized access.

I. CROSS BORDER PRODUCTION ISSUES a. Aerospatiale Framework – Hague Convention is not the exclusive or mandatory procedure for obtaining evidence from abroad. Five factor test: i. Importance to litigation of requested info. ii. Specificity of request iii. Did info originate in U.S.? iv. Alternate means to obtain info? v. Would noncompliance undermine the important interests of the United States? b. Subsequent decisions added additional factors to the Aerospatiale test: i. Competing interests of nations whose laws are in conflict. ii. Hardship of compliance iii. Good faith of party requesting discovery. c. Privacy and Data Protection Laws i. EU laws regulate the collection, processing, transfer and disclosure of personal information. ii. In the Matter of a Warrant to Search a Certain E-Mail Account Controlled by and Maintained by Microsoft Corp. (S.D.N.Y. 2014) emails stored on servers in Dublin. Court held that SCA warrant operates like a subpoena “Even when applied to information that is stored in servers abroad, an SCA Warrant does not violate the presumption against extraterritorial application of American law. d. Foreign Discovery in the United States – i. 28 U.S.C. 1782 procedural mechanism. ii. Certain Funds, Accounts and/or Inv. Vehicles v. KPMG (2d Cir. 2015) – discovery from American firms denied because it was not established that it was for use in foreign proceedings and other proceedings were not within reasonable contemplation. e. Sedona International Framework and Principles i. Due respect should be demonstrated to foreign data protection laws. ii. Where full compliance presents a conflict party’s conduct should be judged under standard of good faith and reasonableness. iii. Preservation or discovery should be limited in scope in order minimize conflict of laws and impact on data subject. iv. Where conflict exists, a court order or stipulation should try to minimize it. v. Data controller should be prepared to demonstrate that data protection obligations have been addressed and safeguards instituted. vi. Protected data should be retained only as long as necessary to satisfy legal and business needs.

Legal Tech Judges' Panel

Today I was at the Legal Tech show at the Hilton in Manhattan. I attended a panel with Magistrate Judge Andrew Peck of the U.S. District Court for the Southern District of New York; Judge Elizabeth LaPorte of the U.S. District Court for the Northern District of California, and Magistrate Judge James Francis of the U.S. District Court for the Southern District of New York. One year ago, I attended a panel at Legal Tech involving the same judges. Tara Emory of Driven hosted the panel this year.

Judge Peck placed great emphasis on the importance of a 502(d) order to guard against the waiver of privilege when producing documents. He described it as a 'get of jail free card'. The proposed order available on his site provides the broadest possible protection under 502(d) in paragraph 1, and paragraph 2 provides for sufficient time to review for privilege. He said it was akin to malpractice not have a 502(d) order in place.

Judge LaPorte discussed how the fear of making a mistake can lead parties to over preserve data. If parties put certain topics off limits at a case management conference they won't be questioned later on the failure to preserve such data.

Judge Peck stressed the importance of showing the relationship between search terms and discovery requests. There may be no way to produce a company's database, but it may be possible to export aspects of the database's content. Judge Francis suggested that a 30(b)(6) deposition might be necessary to determine how to produce a database, but Judge LaPorte preferred using a sample report to determine the scope of production rather than resorting to a deposition.

Judge Francis discussed how it might be possible for parties to cooperate on the use of search tools - even to the extent of letting the other side train a TAR system. Judge Peck noted that while here may be disclosure of collection, search, and review strategies, parties zn exchange these without needing to disclose them for future litigation.

Judge LaPorte talked about how tiered discovery involves prioritizing review of certain documents, not necessarily limiting the review. ESI agreements can specify particular custodians for review. Judge Peck said that parties should always let the court know what is happening in tiered discovery beforehand, but this approach will commonly be approved and save time, but not if parties have to later justify their steps to the court. Judge Francis explained that the tiered approach should narrow what is needed to reviewed at each successive step.

Judge Peck noted that for cross border discovery under EU data regulations, the implementation of a hold constitutes processing. The General Data Protection Regulation has provided damages equal to 4% of gross global revenue for certain violations. This will enter into effect in 2018. Judge Peck felt that in the past courts have held the attitude that damages assessed under past EU regulations would be minimal or unlikely to be implemented at all. He said that parties should not use EU data privacy laws as an excuse not to make productions at all.

Judge Peck discouraged attorneys from filing 25 page motions on why discovery requests are overboard.

In forming agreements, Judge Francis said parties should go for the low hanging fruit first and settle issues that are easy to agree on, in order to build momentum. Judge Peck criticized attorneys for being reluctant to involve their clients in discovery issues. Judge LaPorte recommended the discovery checklists she has for her jurisdiction. I believe she had this in mind: https://www.cand.uscourts.gov/filelibrary/466/Initial%20Discovery%20and%203rd%20Party%20Data%20Assessment%20Checklist.pdf

Judge Francis referred to the Progressive Casualty Ins. Co. v. Delaney (D. Nev. May 20, 2014) as an example of how not handle agreements on document searching. In this case, from a set of 1.8M documents, the parties' original agreement led to them having to review 565K documents manually. The producing party panicked and made a unilateral decision to use TAR. Judge Francis suggested that protocols should provide for a meet and confer when parties needed to depart from the protocol itself. He thought that the court was incorrect to treat the protocol as ironclad, and believes such agreements should by their nature be flexible. Judge LaPorte found fault with the producing party in Progressive for not following a vendor's best practices.

Electronic Discovery and Digital Evidence in a Nutshell - Chapter V Outline

Here's another installment of my outline of Electronic Discovery and Digital Evidence in a Nutshell, the second edition of the West Academic guide to electronic discovery law in the United States authored by Judge Shira Scheindlin (the judge in the Zubulake v. UBS Warburg) and members of the Sedona Conference. An outline of the previous chapter was posted on December 20, 2016.

CHAPTER V – SEARCH AND REVIEW OF ESI

A. SEARCH METHODS a. Filtering on select criteria – search terms, search terms with Boolean operators, date ranges, file sizes, file types, etc. b. Victor Stanley v. Creative Pipe, (D. Md. 2008) – where party did not take reasonable steps to identify privileged documents where they could not identify keywords used, qualifications of person who designed the search, and whether results were analyzed to check reliability c. William A. Gross Constr. v. American Mfrs. Mut. Ins. Co. (S.D.N.Y. 2009) court ordered parties to meet-and-confer where they could not agree on keywords to search party data on non-party server, rather than designating on its own.

B. USE OF TECHNOLOGY FOR SEARCH AND REVIEW a. Reasonable process for searching large volumes of data: i. Collect data from client using filtering process. ii. Sample data to determine proper scope of data to be processed vis-à-vis likelihood of responsive documents and corresponding costs and burden. iii. Load into electronic review platform for analysis. iv. Establish selection criteria. v. Filter data using selection criteria vi. Perform review for responsive, privilege and production determinations. b. Craig Ball – Step by Step of Smart Search i. Start with Request for Production ii. Seek input from key players – what event triggered conversation? iii. Look at what you’ve got and the tools you’ll use. Search tool should be able to review content of container files, and identify exceptional files that can’t be searched. iv. Communicate and Collaborate – tell other side the tools and terms you’re using. Do two rounds of keyword search giving the other party the chance to review the first production before proposing additional searches. v. Incorporate misspellings, variants and synonyms. 1. Fuzzy searching. vi. Filter and deduplicate first vii. Test, test, test – false hits may turn up in system files. – test keywords against data that is clearly irrelevant. viii. Review the hits – preview search hits in context in a spreadsheet with 20-30 words on each side of the hit. ix. Tweak queries and retest – achieve better precision without effecting recall. x. Check the discards – examine closely when refining queries; more random later. c. Search Tips i. Tier ESI and have keywords for each tier. ii. When searching email for recipients each by the email address, not the name.

C. TECHNOLOGY ASSISTED REVIEW a. How does it work? i. Computerize system that harnessing human judgments of subject matter experts on a smaller set of documents, then extrapolates judgement to the remaining document collection. ii. Knowledge engineering – rule based or linguistic approach. Capture expertise of SME. Rules discriminate between responsive and non-responsive documents. iii. Machine learning – predictive coding – need training set of responsive and non-responsive documents. Can be passive or active. 1. Passive expert select training documents using judgmental or random selection. 2. Active learning – after SME selects seed set, computer selects documents for SME to review and add to training set. Finds documents whose relevance is least certain. iv. Grossman-Cormack TREC study. Used F1 scores – harmonic mean of recall and precision – average weighted to the lower of the two measures. Two best TAR teams did twice as good as human judges. b. Have Courts Accepts TAR as a Search Methodology? i. Da Silva Moore v. Publicis Groupe (S.D.N.Y. 2012) Use of predictive coding appropriate given 1. Parties agreement 2. Large amount of ESI - >3M documents. 3. Superior to manual review or keyword searches 4. Need for cost effectiveness and proportionality under 26(b). 5. Transparent process. Staging of discovery by most relevant sources good way to control costs, must judges willing to grant discovery extension to allow for staging. Parties should consider ‘strategic proactive disclosure of information’ – tell other side who your key custodians are. Helpful to have ediscovery vendors at hearings ii. FHFA v. HSBC (S.D.N.Y. 2014) party permitted to use predictive coding even though opposing party showed a document was not produced that was in a parallel case. No one should expect perfection from the document review process. c. Can Responding Parties Be Required to Use TAR? i. Kleen Prods. V. Packaging Corp. (N.D. Ill. 2012) Sedona Principle 6, parties are best situated to evaluate procedures to preserve and produce their own ESI. Court urged parties to come up with way to refine Boolean search rather than ordering a TAR search. ii. EORHB v. HOA Holdings, (Del. Ch. 2012) court ordered both parties to use TAR sua sponte. but later withdrew the order. d. How Involved Should the Court Get in the TAR Process? i. Most of the courts that have addressed TAR issues have either entered orders stipulated by the parties, advised the parties to negotiate a protocol, or allowed a party to proceed with their own protocol, without prejudice to the opposing party challenging the adequacy of the results. ii. Independent Living Ctr. of S. Cal. v. City of Los Angeles (C.D. Cal. 2014) Should predictive coding protocol include a quality assurance phase? Plaintiff could insist it be performed if they paid one half of costs. iii. Judicial Modesty: Not an Oxymoron: Case for restraint in the electronic age Judge Francis – parties are entitled to use TAR, but whether the tool will produce reliable results is something that judges are ill equipped to determine. But judges should try to resolve e-discovery issues at pretrial conferences; phase discovery and order sampling.

D. NEGOTIATION AND AGREEMENT ON SEARCH PROTOCOLS a. Paul/Baron Information Inflation Process: i. Meet and Confer to identify methods to narrow scope of searches. ii. Conduct initial searches on meet and confer parameters. iii. Share initial search results and adjust parameters. iv. Repeat process in an iterative fashion until mutually agreed time or mutually agreed cap on responsive documents reached. b. In re Biomet Hip Implant (N.D. Ind. 2013) Biomet through keyword culling and de-duping narrows documents from 19M to 2.5M then used predictive coding on the set of 2.5M. Plaintiffs move for predictive coding on all 19M documents. Court rules likely benefits outweighed burden and expense to Biomet. Court also refused disclosure of seed set. c. I-Med Pharma v. Biomatrix (D.N.J. 2011) party relieved of obligation to produce documents recovered from unallocated space after searching all data on system without limiting to certain custodians or time periods. d. Progressive Cas. v. Delaney (D. Nev. 2014) after search as per party agreement with search terms found 565K in 1.8M document set, party not allowed to use TAR to reduce set to 55K documents, had to produce all original hits. e. Edwards v. National Milk (N.D. Cal. 2013) Model Joint Stipulation and Order i. Definitions 1. Document Review Corpus – document remaining after exclusion of document types, dupes, system files, documents outside of date range. 2. Confidence level likelihood that sampling is accurate. 3. Estimation Interval – statistical error rate of a measured confidence level. ii. Protocol 1. Document Collection 2. Control Set - a random, statistically valid sampling of documents to estimate the number of responsive documents in the corpus. The control set sample shall be determined using a 95% confidence level and 2% estimation interval. 3. Seed Set and Initial Training – seed set includes responsive document identified by party and found with Boolean search terms. 4. Iterative Review and Further Training 5. Review - Review and iterative training will proceed until all identified documents have been reviewed and the system indicates that the remainder of the document review corpus is not likely to be responsive. 6. Validation - perform a validation test by reviewing a statistically valid and random sampling of unreviewed documents to confirm that the number of potentially responsive documents in the unreviewed corpus is statistically insignificant. the review process will continue until the validation test achieves a 1% or less responsiveness rate.

E. VALIDATION OF SEARCH EFFORTS a. Must conduct a reasonable search, the cost and effectiveness of which meets the proportionality requirement of Rule 26(g). b. Recall is more important than precision. Precision is only a factor if it is very low – in the case of a data dump. c. Recall is difficult to measure. For many matters, it is neither feasible nor necessary to expend the effort to estimate recall with a margin of error of ± 5%, at a 95% confidence level— the standard required for scientific publication. d. As per Grossman-Cormack – even a perfect review by an expert with a recall of 100% is unlikely to achieve measured recall of 70% if performed by a second expert.