By Wright Noel and Eric P. Blank
Second of Two Parts
Last month, we ventured into the challenges presented by electronic discovery in a technology-driven age. This month, we take a look at the issues to be aware of so that you control the case, not the other way around.
Understand Your Case
Recognize the nature of your case and the likely types of evidence that will be exchanged in discovery. The case law on electronic evidence often involves two types of matters - employment cases and intellectual property/trade secret cases.
Alert to the possible gold mine in communications that may have never been printed to paper, both plaintiffs and defendants in employment cases focus on retention and production of e-mail traffic. Since e-mail is easily altered, it may be important to find and produce multiple copies. It is not uncommon, and very damaging, to discover that the alleged "smoking gun" e-mail with an improper suggestion is actually an altered e-mail.
Trade secret/intellectual property cases also naturally tend to be electronic evidence cases. With data usually stored in electronic format and the ease with which complex data can be transported, the only way to discover if data were actually taken may be through the use of electronic evidence and the services of a computer forensic firm. Electronic "fingerprints" are often left behind. These allow an expert to determine, with considerable accuracy, whether data were taken, when data were altered and what may have happened to data.
Take Straightforward Steps to Preserve Electronic Evidence
Advise your client and key witnesses, in writing, that they are not to delete electronic evidence. Follow up to make sure this happens.
Under the new federal rules, it appears that routine destruction of electronic evidence (such as occurs when backup tapes are recycled) does not have to be halted. However, if a key witness chooses the wrong time to clean out her e-mail inbox or to reformat her hard-disk drive, you may be forced to incur the expense of a forensic computer consultant or face spoliation sanctions, or both.
Produce Electronic Data Intelligently
Maintain the integrity of electronic data when they are produced. For example, separating attachments from e-mails in a document production may seem like a fun way to put your opponent to a lot of trouble, but it will only lead to a court ordering you to produce the documents again.
Worse, unless exceptional steps are taken during the original production, or the original production is used as the template for the second production (a tremendously time consuming endeavor), reproducing documents may mean that you produce a different set of documents on the "do-over." Producing extra or fewer documents the second time around invites your opponent to question the integrity of the production and will surely be an issue in any discovery motion.
Maintain the integrity of metadata, if necessary (any good production house will do this as a matter of course), or you will face bigger problems. Depending on the severity of such discrepancies, your opposing counsel may ask the court to let her computer consultant take over, or at least monitor, the production process. This might happen at your client's expense.
Prepare Your Witnesses
As part of your deposition preparation, ask your witnesses what steps they took to save and produce electronic evidence. Ideally, you will discover, prior to the deposition, whether your witness forgot about several e-mail folders or files. These documents can then be produced before the deposition.
This is vastly preferable to experiencing, mid-deposition, the thrill of your witness's revelation that electronic evidence has been ignored or withheld. Such testimony will cause the other side to question how well electronic documents were gathered and produced. Worse, it will provide evidence that electronic discovery is incomplete. It may give opposing counsel the opportunity to request the intrusive imaging of your client's hard-disk drives.
To turn the tables, ask the other side's witnesses during deposition how they gathered electronic evidence. It is amazing how often a witness has failed to look through her sent messages, deleted e-mails, electronic documents or Word files as part of the document production. Asking questions regarding how a witness gathered electronic evidence at a minimum ensures that all of the documents relevant to the case are produced. It also may provide evidence to prove a deficient production and to facilitate the production of a complete set of documents.
Beware of Databases
If your case involves money, you will probably be working with databases. Databases are problematic and their sloppy handling as electronic evidence is endemic.
Databases (including, for example, Microsoft Excel files, but also including complex accounting software) are dynamic sets of electronic information. Only rarely can a database be printed in a helpful manner. Hidden data, formulae, color coding and layers of data cannot be reproduced on a two-dimensional sheet of paper.1 If you print out 30,000 pages of Excel spreadsheets, you risk having to reproduce the data electronically.
In addition, depending on how the database is administered, there actually may be numerous databases that everyone thinks are the same database. Individuals within a company using the database may have data unique to the database on their computers. These issues have been brought to the forefront with regard to accounting firms' activities in securities cases.2
Accounting firms often use proprietary databases in assisting their clients, which may be shared between offices, servers and computers. The database in one office may be slightly different than the one in an office across the country. If a specific database is critical to the case, the use of a computer forensic consultant may be necessary.
Agree on Data Production
Even if it appears your case does not call for computer forensics, it is good practice to have opposing counsel agree regarding how electronic evidence will be gathered and produced. Document these agreements. If you cannot agree, you at least have framed the issue early and will know whether the court will need to determine what is reasonable.
This can save both parties significant time and energy and avoid headaches and cost later when opposing counsel otherwise might try to use electronic evidence as a means of intimidation. It also may prevent the court from issuing sanctions for the failure to maintain metadata in the unlikely event that issues suddenly change and metadata becomes vital to the case. Similar discussions should take place regarding how documents will be produced, the need to interrupt regular electronic destruction and the need to recover lost or destroyed documents.
Use Joint Experts Wisely
Some attorneys, to try and save time and money, agree to use a joint electronic evidence expert to image hard-disk drives, examine networks or restore data from back-up tapes, and to produce data to all parties. Generally, joint experts are faster, and cheaper, than two independent experts.
However, there are risks associated with the loss of complete control and of work product protections. When a joint expert is retained, you will not know, before your opposing counsel receives the information, what happened on your client's hard-disk drive. In some cases, this is catastrophic, and an independent expert could have saved you considerable headaches. For example, if you suspect that your client may have attempted to improperly delete information from his hard-disk drive, using an independent expert can save the day.
Deleting information or programs from a hard-disk drive rarely actually removes that data. Instead, the computer is programmed to write over the data as needed. In most cases, even if a portion of the data has been written over, a computer expert can still recover much of the deleted information. When you use an independent expert, in most cases, all data from the hard-disk drive can be produced, both deleted and undeleted. Moreover, using an independent expert will allow you to conduct sample searches using terms that you choose and take the steps you feel are necessary to remove all work product and privileged material.
Recent case law and the new FRCP amendments are bringing a certain degree of proportionality to electronic evidence. Both anticipate that counsel will cooperate in facilitating the retention and production of relevant electronic evidence. Electronic evidence does not have to be a nightmare, but it certainly requires that you stay awake to opportunities, pitfalls and new developments.
Wright Noel is a trial attorney with The Noel Law Firm, PLLC, and the founding member of Data Guardians, an electronic evidence and data security firm: www.01dg.com. He can be reached at 425-295-6008.
Eric P. Blank is an attorney with Blank Law & Technology P.S., a law firm offering software investigations and electronic evidence support to corporations, governments, and attorneys. He can be reached at 206-256-9699 or www.digital-legal.com.
1 Williams v. Sprint/United Mgmt Co., 2005 WL 2401626 (D. Kan. 2005) (requiring database produced in native format).
2 In re Honeywell Int'l, Inc. Securities Litigation, 2003 U.S. Dist. LEXIS 20602 (S.D.N.Y. 2003).
