How Technology Has Changed Discovery 0001

8/14/2019 How Technology Has Changed Discovery 0001

1/5

H ow Technology H asChanged D iscovery:

The Last Barrier Short of Mind-Reading

By Thomas J. McDennott, Jr. and Janet M. Nolan

The "immense remote" is what someof us sense as we confront the newworld of digital information. Thatwas Melville's phrase to describe the awe ofthe novice whaler as he confronted for thefirst time the Pacific Ocean ... and death.This immense remote of digital informationis everywhere, but nowhere. It floats throughthe air, races through cable, resides in mag-netic particles, holds thoughts we do notwant exposed. Corporations now measuretheir storage in terabytes; that's one trillioncharacters. Fifty terabytes of storage is notunusual and that's equivalent to 25 millionbooks. Webpages are expanding at the rate ofthree million a day. Experts see storage rates

growing 25-fold in three years. If justicedelayed is justice denied, then informationunlimited may be information trivialized. Butnot trivialized in litigation. It may be that oneunfortunate writing that turns the case.The land of electronic information may notbe remote to some lawyers, but no one candeny that it certainly is immense. Since Ms.Lexis and Mr. Xerox dangled their delights

Thomas J McDermott, Jr. is a partner in thelawjirm ojShanks &Herbert in San Diego anda member oj the Editorial Board oj CaliforniaLitigation. Janet M. Nolan is a paralegal at thefirm.

4


2/5

~ ~ ~ L- ~

Eventually, it will end up on the hard driveof its addressee. Again, it may be on her indi-vidual hard drive, on a server in her business,or both.

, D on 't forget thatp rin ters have m em oryalso . If the e-m ail w ere

prin ted out, ... th e printerm ay still y ield it . '

Let's assume both. Bill and Carly (theaddressee) erase. The following happens: A)Their hard drives still hold the e-mail. Thecomputer places a marker by the e-mail, indi-cating that this space on the hard drive maybe overwritten when needed. It may not actu-ally be overwritten for months or years. B)The servers where the e-rnail was sent will dothe same. C) The e-rnailmay still exist on var-ious servers and ISPs through which itpassed. D) Even if overwritten, sometimes asmany as five times, there is still some possi-bility the e-rnail can be recovered. E) If eitherthe corporation ofthe writer or the addresseeis running real-time back-up, the e-mail willhave been archived in some form, either tapeor disk or some remote server. If the compa-nies are only backing up periodically and ifthe e-mail is saved for even a short period oftime, there is a good chance that it will bearchived. Most companies back up their com-

puters every evening, thereby picking upeverything that resides on all hard drives inthe entire system each evening and saving itindefinitely. F) Don't forget that printers havememory also. If the e-rnail were printed out,then destroyed, the printer may still yield it.This is not a great source and probably shouldbe pursued only in unique and extreme cir-cumstances.Ten 'Ihings You'l l

Wan t to Do(In Addition to What You Would Do Anyway)1. Draft an interrogatory that can beanswered only by an MIS type, such as:"Describe the ;\ffS system in place with par-ticularity, specifically listing all desktops, lap-tops, printers. servers and back-up systems,setting forth for each itern, the make, amountof D-RML hard drive make and capacity,operating systems for each milt and softwareapplications running on each unit. Include acomplete description of your back-up andarchiving systems. Such descriptions shouldcover all of the above for the last ten years.':You can probably do better. The idea is toget the question into the hands of a techie,who will take it seriously and will give helpfuldata, and out of the hands of a lawyer.2. Ask eIXJ'Y deponent all the questionsyou can think of about the hardware, soft-ware and the e-mail on the desktops, or lap-tops, and company servers. Get your owntechie to prep you for these depositions.3. Ask eoent deponent about their e-mailpractices. Does he use it'! How does he print

out? Does he save'! Does the company have apolicy with regard to e-mail? What does thedeponent understand about that policy?4. Ask eueru deponent about drafts. Doeshe print out his drafts? Does he save drafts?Does he erase drafts'! If he erases, how doeshe erase?5. Review California Code of Civil Pro-

6


3/5

~ ~ .~ L-__~~

cedure section 2017 (a) and section 2031 (1)(1); review Federal Rules of Civil Procedure26 and 34.6. The document request set forth below isa definition of a writing previously publishedin Overly, "Effective Discovery of ElectronicEvidence," Orange County Law Magazine,January 1997. "Writing" shall include "datastored in a computer, data stored on remov-able magnetic or optical media (e.g.,magnet-ic tape, floppy disks and recordable opticaldisks), e-mail, data used for electronic datainterchange, audit trails, digitized picturesand video (e.g., data stored in MPEG, JPEGand GIF formats), digitized audio and voice-mail." Use this or a similar definition to smokeout what your opponent has. Then add, "If awriting is not produced due to residence in anelectronic form, state the location of suchwriting, e.g., 'e-mails on Ms. Smith's harddrive',"7. Go after the "meta" or "shadow" data.This is data like the "date created," "createdby," "last modified" and other informationgenerally not visible on the word processingscreen or document, but there, nonetheless.Another type of meta data are access controllists (ACLs) used by network administratorsto track which employees are given rights towhich files; this is a particularly fruitfulsource of information in litigation because itcan be used to identify persons fordepositions.8. More and more, organizations are usingthird party providers to do their back-up. Goafter those tapes and disks. Query - does theuse of a third party to back-up waive theattorney-client privilege?

9. Be alert if your opponent has provideddata that has been "converted into reasonablyusable formats." What, if any information islost or modified by the conversion process(especially meta data such as the "date creat-ed," "created by," and "last modified"infor-mation)?

'D evelop a stra tegy forpa rin g do wn th e in fo rm atio n

actually received . '

10. Develop a strategy for paring down theinformation actually received. Ask for every-thing, but you'll probably get more then youcan handle. For example, sample data from allthe sites, but be thorough only with thosethat are promising. Narrow your time frame,eliminate duplicate files electronically, elimi-nate files by use of file extension and keyword searches to get to the important data.Due to State Bar restrictions, I cannotspecify the names of these "reliable profes-sionals" or "computer professionals" I keepreferring to. Most of the major accountingfirms have these people in their consultingdivisions. Others can be found in forensic"experts" compilations.

When th e O th er S id e O b jects,- Don't T ell the J udge Y ou 're -J ust O ne M o re C arn ivoreAs most of you know, the FBI has imple-mented 'an electronic eavesdropping systemin which they monitor the material that pass-

es through selected ISPs (Internet ServiceProviders). Compared to monitoring one tele-phone tine, it is more like monitoring anentire AT&T grid. With some accuracy, butwith questionable sensitivity, the FBI hasnamed this system "CARNNORE."The publicity has given electronic review a

7


4/5

~---~ ~ L- ~

bad name. When you go into court to requestall of your opponent's electronic data, includ-ing its hard drives, the respondents will arguethat the request is burdensome, onerous,improper and will probably destroy its busi-ness. There is no reason to believe that acourt will grant your request without a fight,at least not yet.

, Y ou cou ld w rite a book onth is s ub je ct, bu t d oes a nyo ne

need ano ther bo ok? '

Here are some of the arguments that arespondent asked to deliver its electronic evi-dence will make and some of the possibleresponses: Our electronic information system is thecore of our business and cannot be down forone second.Response: We will come to your premisesin off hours. The scanning will be done byreliable professionals. (You should submit adeclaration from a firm practiced in this artthat will do the following:A) Establish exper-tise. B) Describe in detail the procedure to befollowed. C) Explain why there will be nobusiness interruption and how the particularobjections raised can be met. This will bereferred to as the "reliable professional" orthe "RP" response.) Computers will be downonly one at a time for a very short period, andsystem integrity will not be prejudiced.

Valuable data will be lost.Response: The Reliable Professionalresponse, "We have done this hundreds oftimes without losing data." Irrelevant and confidential material willbe viewed.Response: A directory will be printed outfirst and irrelevant material not viewed. TheReliable Professional has signed a confiden-tiality agreement. A lawyer or paraprofession-al will supervise to ensure that all courtimposed controls are followed and irrelevantand attorney-client privileged matters are notreviewed. There is too much data, too many tapes,too many hard drives, et cetera.Response: Directories can be printed outto allow quick scanning of material and tofocus only on the relevant data. Respondentscan certify that the relevant machines, tapes,disks have been provided and all others areirrelevant, e.q., the respondent can narrowthe scope of the search under the court'ssupervision. All the data has been printed and pro-duced in hard copy.Response: A) Mr.B. testified in his deposi-tion that he wrote an average of 20 e-mails aday. Youonly produced a number that wouldequal four per day. B) We are looking for hid-den, i.e., "erased" data that was not printed.C) It is common knowledge that people printout only a limited number of the e-mails theysend and receive; therefore, the respondentcan offer no assurance that the moving partyhas received all e-mails that were generated.Youcould write a book on this subject, butdoes anyone need another book? (Or worse,another electronic book?') Plunge in. Send theinterrogatories and document requests, askthe questions in depositions, get the courtorder, if necessary, hire the reliable computerprofessionals, get the hard drives, disks andtapes, and start to review them. You'llproba-bly be amazed and delighted at what you find.

8


5/5

Documents

How Technology Has Changed Discovery 0001