ACFE Training May 19, 2010 Electronic Discovery

1. ACFE TrainingMay 19, 2010Electronic Discovery

2. Agenda • E-Discovery in a Nutshell (50 mins) • [break – 10 mins] • Pre-Litigation Issues and Strategies (50 mins) • [break – 10 mins] • Using Technology to Ease the Pain (50 mins) • [break – 10 mins] • Live Technology Demonstration (50 mins)

3. Part I: E-Discovery in a Nutshell

4. Can I Buy a Vowel? • Discovery – “. . . the process of identifying, locating, securing and producing information and materials for the purpose of obtaining evidence for utilization in the legal process.” • Electronic Discovery (E-Discovery) – “The process of collecting, preparing, reviewing, and producing electronically stored information (“ESI”) in the context of the legal process. See Discovery.” • – The Sedona Conference Glossary

5. What Changed? Why Now? • Fundamental shift in how businesses create, store, and use information • Email has replaced the water-cooler • Now those conversations are preserved and discoverable • Information management practices have not matured as fast as technologies • Technological renaissance • Google • iPhone • Saas • Social Networking • Virtual Worlds (?!?!) • 10 years ago, no one cared if you were a Mac or a PC

6. The FRCP Chicken or the e-Egg? • In 2006, the Federal Rules of Civil Procedure were amended in part to deal with the rapidly rising costs and burden of electronic discovery. • The Federal Rules did not create electronic discovery, they only affected it. • Rule 26(f) • Rule 30(b)(6) • Rule 37(f) • And not to be outdone, Federal Rule of Evidence 502

7. Common E-Discovery Issues • Spoliation • Volume / Cost • Quality (search, review) • Inadvertent disclosure of privileged and/or confidential information • Communication (IT, Law Dept., Investigators, Compliance, Courts, Clients, Vendors, Lawyers) • Relatively young body of untested law (no appellate decisions; square peg – round hole)

8. Is there any Hope? • Standards • The Sedona Conference; The Electronic Discovery Reference Model (EDRM) • Court-mandated protocols • Collaboration (early and often) between parties • Technology – it got us into this mess, and when used properly, it can get us out • Systematization – use standards and repeatable workflows to build an efficient business process around e-discovery

9. The Electronic Discovery Reference Model

10. EDRM – Information Management • Control your ESI before it controls you • Record Retention Policies • Email / Acceptable Use Policies • Archiving • An ounce of prevention...

11. EDRM - Identification • You can’t review it if you don’t find it • Custodians – who has the data? • Interviews, org charts • Data can be anywhere • Data maps • Multiple copies? • Scope / Proportionality • Ensure efforts are “right-sized” for the case (amount in controversy)

12. EDRM - Preservation • Duty to preserve arises from Common Law (case law), not the Federal Rules of Civil Procedure • You must preserve all items which may be relevant to litigation when you reasonably anticipate litigation • This has been stated by appellate courts time and time again • This is where sanctions are typically awarded (spoliation) • Beware of automatically purging computer systems • “Honey what happened to the season of Grey’s Anatomy I recorded on the DVR?” • Remember: It is generally cheaper to preserve than to collect, process, and review. So, cast a wide net during preservation

13. EDRM - Collection • Handle ESI with care! • Metadata • volatile media • Challenges – cloud computing, SaaS, remote employees, backup tapes • If using third-party vendor to store ESI, review contracts • Chain of Custody • You will have to authenticate any piece of evidence to be used at trial, so make sure chain of custody remains intact for ESI • Shipping data – encrypt contents and send using trackable carrier • Moving data – always use a tool like Robocopy or other similar utilities that preserve metadata • Create two copies (“best evidence” copy and working copy)

14. EDRM - Processing • Data is coming from many different systems, so you must “normalize” the data either through presentation or format • Presentation – index / crawl native files and provide analytics • Format – convert to .tif images • Deal with anomalies (remediation) – passwords; encryption; corruption

15. EDRM - Analysis • What can the data tell us? • Trends; anomalies; baseline for review • This step should always be performed prior to starting a linear review • In linear review, each decision is better than the last, and every decision needs to be the best

16. EDRM - Review • Must review smarter when dealing with high volumes of ESI • Develop baseline of knowledge using analysis • Do “analytic review” • Group documents for more meaningful review experience • Discussion threads • Custodian • Chronology • Quality measures must be implemented for defensibility • Sampling • Reporting • Auditing

17. Production • Form of production (native files or images?) • How is ESI stored “in the ordinary course of business?” • Who’s responsibility is it to ask about form of production? • Duty is first on the plaintiff to request a particular form of production (if desired), but defendants are rarely rewarded for hiding the ball • Hidden or embedded content as well as redaction can complicate production of ESI

18. Presentation • How can this ESI be presented to a jury or the court at trial? • Will they understand what is being presented? • Be aware that relationships between documents and trends in the data may be very revealing and valuable in a trial. So, how should those be presented? • Use e-discovery technology (portable, web-based, easy to understand) • Scout the venue first for technical accomodations

19. A Final Thought on the EDRM • Q: Which of these stages can occur before a civil complaint is filed? • A: All of them! • What you do today could be subject to e-discovery rules after the case is filed

20. Other Challenges • Email is not privileged but attachment is privileged (boundaries of ESI) • Not reasonably accessible because of undue burden or cost • Lifecycle of ESI is difficult to track • Privacy laws • Preservation with culpable / unreliable custodians (undercover collection – see Privacy Laws

21. Collaboration – The Problem • Persons involved in e-discovery are speaking different languages • What does “delete” mean to you? • Use a glossary (Sedona Conference Glossary) • Expectations / Requirements often not defined • Different agendas / goals • Legal’s mission: risk management • IT’s mission: business continuity • Investigator’s mission: find the facts • Judge’s mission: manage process to ensure a just result

22. Collaboration – A Solution • Communication – define / explain common terms; define / explain goals; communicate risks • Collaboration – use “us against the problem” approach instead of delegating • Consistency – team approach is good, but keep regular members so they develop a good working relationship

23. Part II – Pre-Litigation Issues and Strategies • Why you should be thinking about e-discovery now…

24. Whose Law is it Anyway? • In which jurisdiction will the case be litigated? • 7th Cir. Pilot Program • Local rules • Varying case law • Federal / State court? • Must be aware of nationwide trends to best prepare for potential litigation • Seminars / Conferences • Continuing Education • Corporate Initiatives

25. Identification Issues • Where could the data be? • Smartphone (SD card) • iPod • Thumbdrives (check Windows registry to see if any used) • Internet mail accounts (Hotmail, gmail, Yahoo! Mail) • Embedded files (Office 2007 files, steganography) • Backup tapes, old servers • Old computers (tip: review old IT service tickets to trace history of witness’s hardware) • Home computer, girlfriend’s computer, child’s cell phone – privacy issues • Typically, you must only preserve one copy of a document or file as it is kept in the ordinary course of business, but if you are conducting an investigation, you may wish to collect all copies.

26. Preservation – Preventing Spoliation • Wilson v. Thorn Energy, LLC (March 15, 2010) • The court ordered sanctions for defendants’ failure to preserve relevant data where defendants failed to back up a flash drive containing all relevant financial records and where that data was lost as the result of the flash drive’s failure. • Typical E-Discovery preservation techniques can be effective before litigation. • Best Practices – EDRM.net; Sedona Conference • If you convert data, keep originals – one man’s recycle bin is another man’s trial exhibit. • Maintain a pristine, vaulted copy and create several working copies.

27. Scope of Preservation • Spend time identifying and preserving more than you think you will need (cast a wide net, sort later – but always keep costs in mind) • Computers are designed to purge data periodically to maintain optimum efficiency – make sure IT is aware that they have to disable these policies for ESI subject to preservation duty • Many companies that are very skilled in e-discovery are the very companies that regularly purge data not subject to any litigation hold or preservation request • Expert Data • Federal Rule 26(a)(2)(B) requires the disclosure of all “information considered by the [expert] in forming the [expert’s] opinion.” • Hard drive, deleted files, emails, corporate data reviewed • The plaintiff is subject to the rules as well. If you ask for data, make sure you are preserving your own as well. • And be careful what kind of ESI you create (Quon case)

28. Collection Issues • State laws limiting gathering of evidence • SC – must be a private investigator or lawyer to gather evidence to be used at trial. • Privacy (EU; US state laws; employment contracts; corporate policies) • Handle ESI with Care! • Chain of custody (shipping receipts, logs, procedures to safeguard data) • Encrypt media if sending it outside of the company • Vault ESI immediately (read-only access; limited security access; redundant hard drives) • “The hard drive ate my ESI” is not a valid argument in most cases • Protect metadata

29. Weathering the Storm • Preservation is key (prevent sanctions) • What about newly-created data? • “To the present” requests • Beware of IT projects occurring during period of preservation • Document everything! • Could you describe the entire investigation including e-discovery aspects two years from now? • 30(b)(6) deposition • Defensibility • Keys: • Repeatable processes and policies (consistency) • Auditing policies (accountability) • Transparency in technology (transparency)

30. Part III – Using E-Discovery Technologies

31. Top 5 E-Discovery Landmines to Avoid • Underestimating the “Real” Cost of Storage • Cost of “unlimited storage” becomes apparent in e-discovery • Compare $0.10 / GB to buy storage with $5,000 / GB to process and review the data during discovery • Assuming that Email Archiving is the Silver Bullet • Archiving good 1st step, but does not cover all data sources and often lacks important analytic tools needed to analyze ESI • Relying Solely on Technology to Solve the Problem • Need balance of people, processes, and technology • Trying to Solve a Non-Linear Problem with a Linear Approach • Technology should allow iterative approach and cover multiple EDRM phases • Attempting to Boil the Ocean with “Index Everything”

32. Advantages of E-Discovery Technologies • Superior analysis tools • Discussion Threading (holistic approach to reviewing email) • Reverse Lookup (finding other occurrences of a particular document across an entire case) • Participants (find others who were involved) • Real-Time feedback • Allows for iterative approach (to achieve highest quality) • Lower overall costs and improve quality

33. Preservation Technologies • Excel is probably most popular litigation hold management solution • Other solutions (price, deployment, management) • Preserve in place – difference between “2005 – 2010 and 2005 – present” • Creation of new documents; changes to documents; etc. • Point in time collections (agree upon intervals with opposing counsel?) • Backup tapes – could restore 1st one, last one, and agreed upon number in the middle at agreeable intervals • May be able to argue tapes are not reasonably accessible because of undue burden or cost (Sedona factors)

34. Why Go Native? • Metadata: the tie that binds (control over entire data set) • Sorting by custodian, date range, file type • Early Case Assessment • Analyze Scope / Impact, Risk, Readiness • Who knew what and when? • Improved review speeds • Grouping • “Analytic Review” • Improved culling rates • Exclude by attribute • Enhanced searching • Surgical precision • Transparency

35. Collecting Native Files • Robocopy (preserve metadata; scripting) • Over-Collection – is entire hard drive needed or only certain file types / date ranges? • Where will you store collected ESI? • Can have preservation implications (read-only, working copies) • Privacy Issues – does data belong to the company? What about when sent to personal email accounts? Personal thumb drive plugged into company computer? • Criminal cases – 4th A. / agent of police

36. Search – The Science Behind the Artform • Search technology • Filters • Types: keyword, boolean, fuzzy logic, concept, transparent • “be the document” – who wrote me?; why?; what terms would they use?; abbreviations / slang / jargon? • Technology can help (Clearwell terms & topics) • Iterative approach • Transparency – Victor Stanley v. Creative Pipe • 3 steps: • Preview • Sample • Report

37. Production Technologies • Ensure that you can produce data in variety of formats • EDRM XML standard • Make sure you can go backwards as well (final -> original) • Many review platforms have a proprietary load file format • Usually can convert from XML or CSV

38. Part IV – Live Technology Demonstration • Clearwell E-Discovery Platform

39. Conclusion • Questions? • Brandon D’Agostino, Esq. • Solutions Consultantbdagostino@clearwellsystems.com • www.clearwellsystems.com