Why Does My Case Need Electronic Discovery?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Many would agree that nothing in history has changed culture as much as the digital revolution has changed ours. With 70 percent of households owning computers and 80 percent of business communications being e-mail, computers are intertwined with every aspect of our daily life. Research tells us that somewhere between 95 and 97 percent of all information is now generated electronically and less than 3 percent will ever see paper. Electronically stored information is unique in that it captures much more information about files than a printed version. With the volume of electronic information, it is no longer sufficient to print "important" documents to be placed in client files the same way it was 5 years ago. Extrapolate the volume and locations of electronic data contained within your own practice to your clients' business (or even personal life) and you can begin to understand that electronic discovery is no longer warranted only for large, complex types of litigation.
"Electronically Stored Information", as defined in most requests for production, include e-mail and associated file attachments, word processing documents, spreadsheets, business records, presentations, and any other data that is created or stored on a computer, computer network, or other electronic media. Electronic discovery includes files residing on Personal Computers, laptops, network servers, diskettes, Personal Digital Assistants (PDAs), Blackberries, smart cell phones, CD-ROMs, MP3 Players, backup tapes, and other archival media.
Electronic documents contain information that isn't available with paper. As digital content is forwarded, downloaded, archived, copied or moved, it maintains a history called "metadata". For example, the metadata of a word processing document contains the date and time the document was created, who the authors were, the prior history of the document, and possibly its editing history. A proper computer forensic examination can be used to determine additional metadata in backup files, temporary files, and in temporary print files. So depending on how the discovery request is phrased, the request for production of a single specific document can generate numerous pieces of evidence with valuable historical information that would have never been printed.
The N ational Law Journal reported in September of 2005 that more than 50 percent of evidence found in electronic discovery is e-mail. Yet e-mail users continue to assume a level of privacy when using e-mail and will convey thoughts that would never be communicated using other methods. And even more people think they only need to watch what they say in company email and that their personal web-based email (like Yahoo or Hotmail) is "safe".
Unlike paper evidence, electronic evidence can rarely be completely destroyed without leaving signs that may themselves be responsive in a matter. Unbeknownst to typical computer users, files from a computer cannot be deleted without extreme efforts. Although attempts to delete, hide, or encrypt electronic data can occur, a computer forensics examination of the digital media can recover the information and produce evidence of any attempt of spoliation.
Computers meticulously record details and history of their use. System data may include records of who had access to the computers or network, the use of printers, fax machines, and other devices attached to the network to send and receive documents, the use of email, and a record of Internet use, particularly web sites visited and search terms used.
Information that a computer user has viewed on the computer screen or created without intentionally saving may also be automatically saved on the system and recoverable.
Understanding the activities that transpired on a computer can be crucial, yet the usage component of digital analysis may be neglected as counsel focuses on finding relevant data content.
The majority of evidence in today's society is electronic. By relying only on paper - or even on paper that was printed from electronic files - one will likely fail to find the relevant evidence. Due to the perception of cost, time, and complication, some attorneys fail to do any electronic discovery. However, electronic discovery is often more cost effective and efficient than perceived. Sorting through millions of pages of information stored on a hard drive to find relevant information can be simplified through the use of forensic tools that enable searches filtered by keyword, timeframe, or other criteria. In addition, the searches can be run across both voluminous active files and deleted or hidden data.
The use of electronic discovery and computer forensics is now common in cases regarding divorce, breach of contract, defamation, trade secret and intellectual property theft, sexual harassment in the workplace, wrongful dismissals, fraud, and spoliation of evidence. Even in cases related to wage and injury claims, defense attorneys are often going after e-mail and other electronic evidence.
|
Nationally Recognized Federal Case Involves Knoxville Company and EDiscovery ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Court Orders Defendant Tennessee State Agencies to Produce Responsive ESI, Including All Metadata and Deleted Information; Potentially Shifts Costs to Defendants as Sanction for Failure to Implement Effective Litigation Hold and Other Discovery Miscues.
John B. v. Goetz, 2007 WL 3012808 (M.D. Tenn. Oct. 10, 2007)
This case is a class action on behalf of roughly 550,000 children who are entitled under federal law to medical services that include early and periodic screenings for their physical well being, including their dental and behavioral health needs, along with any necessary follow-up medical services. Through this action, plaintiffs seek to enforce their rights to such services under various federal statutes. Defendants in the case include Tennessee state officials who are in charge of the state programs for these services. To assist it in providing these services, the State enters into contracts with a number of Managed Care Contractors ("MCCs"). The MCCs are not parties in the suit.
Contemporaneous with the filing of the complaint, plaintiffs requested class certification and the parties agreed to entry of a Consent Decree to remedy plaintiff's complaints and to certify the class. Lengthy and complex proceedings followed, including several show cause and contempt hearings.
In the latter half of 2006 and in early 2007, the court held a series of hearings and conferences on the parties' discovery disputes, and ordered the production of certain electronically stored information ("ESI") from the defendants. The court also held that the MCCs' responsive records and ESI were within the possession, custody, and control of defendants, and required the defendants to obtain such information from the MCCs and produce it as well.
|
| EDiscovery Case Law
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
APC Filtration, Inc. v. Becker, 2007 U.S. Dist. LEXIS 76221 (N.D.Ill. Oct. 12, 2007).
Plaintiff filed a trade secret misappropriation action against its former national sales manager and the competing company he established. The former manager claimed that his personal computer had crashed and that he had been told it was beyond repair. He acknowledged that he travelled 20 miles to a construction site to dispose of the computer in a dumpster. Defendants thus were unable to produce information that may have been on the computer relating to contacts by the sales manager with a former supplier for plaintiff and with a major potential customer for plaintiff. Plaintiff sought sanctions for spoliation.
The court found that the former sales manager acted in bad faith when he disposed of his computer within days after receiving a copy of plaintiff's complaint. The court also found that disposal of the computer culminated in violation of a later court order to produce records of all communications with plaintiff's former supplier and plaintiff's potential customer.
The court held that the default judgment sanction requested by plaintiff was not warranted because plaintiff was able to obtain copies of many of the documents on the destroyed computer from third parties. However, after reviewing likely prejudice to plaintiff's case from destruction of the computer, the court concluded that communications of the former sales manager with plaintiff's former supplier and plaintiff's potential customer in order to take away the supplier and customer from plaintiff would be deemed conclusively proven. Defendants were ordered to pay plaintiff's attorney fees and costs (including costs of a computer forensics expert's report) in seeking sanctions and third party discovery.
Hawaiian Airlines, Inc. v. Mesa Air Group, Inc. (In re Hawaiian Airlines, Inc., Debtor), 2007 Bankr. LEXIS 3679 (Bankr. D. Haw. Oct. 30, 2007).
The debtor claimed that defendant, a competing airline, improperly used confidential information received as a potential investor in the debtor. On the day after the debtor filed suit against the airline, counsel for the airline emailed the top three officers of the company with instructions to preserve all documents relating to the lawsuit. The Executive Vice President and Chief Financial Officer, who had signed the confidentiality agreement with the debtor, then began seeking information on data wiping programs and signed a declaration that he had not copied the confidential information on to his office laptops. He later wiped the laptop hard drives and changed the clocks on the laptop computers. The airline argued that the hard drives had been wiped to remove "adult content" but, according to the court, there was no evidence that such content had been on the hard drives.
The court held that the airline could have taken reasonable steps to prevent the destruction of evidence. Backups of the laptop hard drives could have been made promptly after suit was filed, and the airline "could and should have taken reasonable steps to prevent all of its employees from doing wrongful and foolish things, like destroying evidence, under the pressure of litigation." The court concluded that the airline facilitated the misconduct of its high level employee by failing to back up the hard drives. The court imposed a remedial sanction that included binding findings of fact that the airline improperly retained and misused the confidential information received from the debtor.
Benton v. Dlorah, Inc., 2007 U.S. Dist. LEXIS 80503 (D. Kan. Oct. 30, 2007)
Plaintiff claimed gender discrimination by her university employer. She testified at her deposition that she had used her personal computer rather than the university's system to communicate with students at the school and had deleted hundreds of emails with students. The university sought production of the hard drive on her computer to have a computer forensics expert recover the deleted email. Plaintiff objected that her personal computer contained personal and privileged information.
The court concluded that plaintiff should produce the hard drive for an inspection limited to the deleted email. Even if her email with the students had been deleted in good faith and before she contemplated a legal action against the university, the email still was in her possession, custody, or control because the email was retrievable from the hard drive. The court also ordered plaintiff to pay $1,000 in sanctions to reimburse the university for fees and costs incurred in twice seeking production of the hard drive. Additional sanctions requested by the university for spoliation were denied because there was insufficient evidence to conclude she had a duty to preserve the email at the time the email was deleted.
Wingnut Films, Ltd. v. Katja Motion Pictures Corp., 2007 WL 2758571 (C.D.Cal. Sept. 18, 2007).
In this contract dispute, discovery was a long, drawn out battle where the defendant repeatedly failed to comply with court ordered discovery. For over a year, the defendant responded to orders compelling production by repeatedly certifying they had fully complied without producing any correspondence, memoranda, e-mail, notes, work papers or litigation settlement documents. Relying on Tulip Computers Int'l B.V. v. Dell Computer Corp., 2002 WL 818061 (D.Del. Apr.30 2002), the court ordered the defendant to retain an outside vendor to access servers and hard drives of specified employees and conduct keyword searches for responsive documents and e-mails. The court also imposed monetary sanctions under Fed. R. Civ. P. 37(b)(2) and 26(g)(3) in the amount of $125,000.
|
| States Launching E-Discovery Rules
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From Law.com
Waves of state court systems are adopting electronic discovery rules as local lawyers struggle with the costs and uncertainty of e-discovery in an expanding range of cases.
Most of the states' rules were rolled out amid debate about the electronic discovery amendments to the Federal Rules of Civil Procedure, which kicked in on Dec. 1, 2006.
New rules in Idaho and New Jersey took effect last year, while rules in Indiana, Minnesota, Montana and New Hampshire began this year. Arizona's rules are effective starting on Jan. 1, 2008. Proposed rules are on the table in Maryland, Nebraska and Ohio. In addition, committees at the California, Illinois and Tennessee courts and the Washington State Bar Association are studying the issue.
|
Computer Forenscs 101 - ExpertLaw.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Thirty years ago computers were colossal machines utilized only by government agencies and prodigious corporations. These early machines were so large and complex that they required their own temperature-controlled rooms in order to function properly. Since that time they have metamorphosed into ordinary domestic devices that are as much a part of our daily lives as the telephone or the television. Because Americans use personal computers to communicate, work, learn, plan, and entertain, we have come to view our PCs as extensions of ourselves. For this reason, computers often contain important information, which can be used as evidence in legal proceedings, even if the information is not directly related to computers. This computer-based evidence can be anything from e-mail, to photographs, to confidential documents. Most importantly, the data frequently can be retrieved from a suspect computer, even if the user has deleted the information, defragmented the drive, or even reformatted the drive.
| |
