Ethical EDD

ETHICAL EDDA Guide To Making Ethically Sound Decisions In Handling EDD Processing

ETHICAL EDD – Copyright 2010 ADS – For internal use on ACC website only. May not be distributed.

To provide a framework that will empower legal advisors to make ethically sound decisions related to the handling and processing of ESI.

Ethical focus is on the following responsibilities• Competence • Diligence• Promptness • Accuracy• Defensibility • Expeditiousness • Efficient Use of Resources

Scope We will also address topics that should be

considered when making decisions at various stages of EDD.

PURPOSE


AGENDA Who is defining the landscape? A Paradigm Shift – Embracing the

Openness Jurisdictional Differences – A quick

example EDRM – We’ll look at the stages & point

out choices that represent potential ethical danger zones Identification - Lit Hold & IT Policies – Accurate,

Defensible, Prompt? Production Requests – Crafting & Responding - Universe of Data – How defensible is your data

manifest? Pre-Processing – Is your culling methodology accurate

& defensible? Bulk Tagging – Combining Tools with Competence &

Diligence De-duping – Refresher; Is Global “global”?; Is re-duping

defensible? Clustering & Searching – Competence & Accuracy


PREFACE

I am a Consultant; not a litigator. E-Discovery in the courtroom

represents “…a rapidly evolving situation...”

I am not here to lay down Bright Line rules.

I’m here to talk about general principles.


WHO IS SHAPING THE LANDSCAPE?

Consider the experience of those shaping the landscape... The litigator’s Electronic Discovery landscape is largely

being shaped by Magistrate & District Court Judges. They have no practical litigation experience with E-

Discovery yet they are the ones making the rules and sanctioning firms.

ESI didn’t exist when they were attorneys. They are creating rules with very draconian penalties

for failure to follow them. All of this comes with huge costs.

Example: A Magistrate Judge presiding over the discovery hearings

on a construction case involving over 40 parties & non-parties ruled that 38 duplicate copies of the hard drives containing one party’s production request were to be produced and delivered to the other 38 parties within 24 hours. When counsel pointed out the practical issues regarding the time it would take to do this, the Judge effectively said “I don’t care! Do it!”


ETHICAL OBLIGATION VS. PROFESSIONAL RESPONSIBILITY?WHAT CAN YOU DO? As a practical approach, you need to

present to the judge the EDD strategy and methodology utilized for your case in a way that justifies the soundness of your decisions, obviates your forthrightness, demonstrates your understanding of the technology involved and your adherence to best practices.

It could be argued that the legal community involved in litigating ESI cases has an obligated duty to guide the educational process of the judges charged with making the rules.


EMBRACING THE OPENNESS…

A PARADIGM SHIFT Litigators are not trained to share

information. They are trained to give the absolute minimum they possibly can.

In EDD, the courts are pushing a different paradigm regarding sharing (and not resorting to the Judge to make a ruling).

Sedona talks about being as open as you can possibly be. Doing the opposite can get to be very expensive.

In any case, once the Judge finds out you’ve been hiding, they are going to force you to open up.


COMPETENT? DILIGENT?

JURISDICTIONAL DIFFERENCES Jurisdictional differences play a large part The rapid pace of rulings and lack of accepted

guidelines has resulted in extreme differences in the rules among jurisdictions.

“...decisions in adjacent jurisdictions are diametrically opposed to one another...”

Example: In the case of inadvertently produced privilege documents; does the producing party have a duty to report? DC and MD are neighbors but the rules in

each jurisdiction are exactly opposite of one another.

One says that attorneys have a “professional responsibility & duty to report” inadvertently produced privilege documents; the other says it is not required.


EFFICIENT? DILIGENT? COMPETENT?

ARE YOU ON THE SAME PAGE AS OUTSIDE COUNSEL?

How well do you understand the process, methodology and technological tools at your disposal?

You have the professional responsibility to not only understand the capabilities; but also to have the requisite expertise and wherewithal to efficiently, economically, accurately and defensibly leverage the technology and resources available to you.

Is your outside counsel also following this mindset? Where do differences in methodology and expertise exist between your team and outside counsel? How would you answer this question if posed in Court?


EACH STAGE REPRESENTS RISK

The goal of EDRM is to develop guidelines and standards for e-discovery consumers and providers.

Should We Self Collect? Do We Cull Internally?

Chain of

Custody?

Domain Filtering

?

Bulk Tagging

?

Subjective or

Deterministic?

How Inclusiv

e?

Near Dupes?

Omissions?

Data & Custodia

n Mapping?

Do We Have It

All?

Duplicates

Included?

Production

Format?


DILIGENT? DEFENSIBLE? ACCURATE? COMPETENT?

IDENTIFICATION- A Hypothetical Example…

Self-Collection – Your thoughts?

Under what circumstances should you allow custodians or internal staff to identify or self collect relevant data?

Judge Scheindlin recently categorized the practice of self-collection as an act of gross negligence. Other judges have made similar assessments.


Humor Break: In the interest of openness and sharing; welcome to my world…

Used by permission of Tom Fishburne. www.tomfishburne.com


IDENTIFICATION - UNIVERSE OF DATADEFENSIBLE? ACCURATE? EFFICIENT?


DEFENSIBLE? ACCURATE? EFFICIENT?LITIGATION HOLD: Identification &

Preservation Subjective vs. Deterministic practices

Subjective - Users isolate and / or retain documents “related to X” Is the identification of relevant documents being left

up to each custodian? How is the accuracy of their interpretation and

actual execution being monitored? Without knowledge of the case, how can a user

decide what is relevant? Deterministic - Objective process that uses very

specific rules to determine whether a document meets a particular criteria. Identify & preserve all email with To/From/CC/BCC

containing specified domains and email addresses Document Management Systems - Identify

documents that meet specified content or custodial criteria.


DEFENSIBLE? PROMPT?

LITIGATION HOLD: Data Mapping & Tape Backups

Data Maps - Identifying Data Sources in Advance Prepare data maps based on custodians most likely to

have data of interest in any litigation Prepare a subject matter map that consists of specific

data most likely to be of interest in litigation Identify present and historical data sources including

legacy data Archive data - identify & catalogue your physical

sources* of data (*including any dark storerooms full of unmarked tapes)

Tapes – ***A Special Note*** Expect the courts to be less likely to accept financial

burden or inaccessibility as a reasonable argument against collecting from tape backups. Tools now exist that can cheaply catalogue and search tapes.

Several Magistrate Judges have been given live demonstrations of tools that can index & search tapes quickly & cheaply. Expect them to be less likely to accept inaccessible as a reasonable argument.

If there is no legal reason to retain them; get rid of them!


DEFENSIBLE? PROMPT? DILIGENT? COM

PETENT?LITIGATION HOLD: The Power of

Policy Do you have existing policies that define how

custodians are to manage their data and data-containing devices?

Email? Are users responsible for managing the size of their

email store files? Are they allowed to use offline storage files?

Lotus Notes: Do users detach large attachments from email in order to manage the size of their mailbox? How is this resolved/identified when the data is collected?

Are users allowed to access non-work email accounts (gmail, Yahoo, etc.) from work computers?

Distribution Lists - Custodians may receive email that is sent to distribution lists (DLs) of which they are a member. Searches for just the custodian’s email address may result in these messages being excluded from the collection.

Is this membership tracked? Does it include the dates they were added/removed from

the DL?


DEFENSIBLE? PROMPT? DILIGENT? COM

PETENT?LITIGATION HOLD: The Power of

Policy BlackBerry & Other PDA devices

What is the policy regarding non-email communications and data? SMS (Text) Messages MMS (Multimedia Messaging Services) Messages - RIM only

stores the text of these messages. Are the images relevant?

PIN Messages (Personal Identification Number) - Is your BB server configured to store and retain PIN messages? Are PINs of users stored along with the dates of any device or configuration changes that would result in a new PIN?

IM (Instant Messaging) - Is your BB server configured to store and retain IM data?

Notes, address books, mobile documents, photos - Is your system configured to sync and retain this data?

If not synchronized, what differences exist between the device and the server versions of the address books? Did you compare aliases to see if custodians utilized other forms of communication under different names?


ACCURATE? COMPETENT?

PRODUCTION REQUESTSResponding to Production Requests Courts expect attorneys to be as open and a generous

with information as they can be. EDD is a conundrum for many litigators because it is 180

degrees from what a judge would expect you to do with paper. They WANT you to volunteer information and they can get very angry with you if you don’t.

Crafting Production Requests Judges want you NOT to hide anything. "They want you to construe ESI requests as broadly as

possible. Narrow requests piss them off. In paper discovery, the narrow request is normal, but in Electronic Discovery, Judges don’t want to see that."*

* Senior Counsel, New York City Law Department


DEFENSIBLE? COMPETENT? ACCURATE? DILI

PRODUCTION REQUESTS – IMPORTANT!

1. Be careful to be open and “avoid being under inclusive in what you are producing. Don’t ‘go lawyer’ on deciding how inclusive to be.”

2. (This is even harder.) You have to really know what you have and what you’ve given over.

Example: In a recent case with one of my clients, opposing counsel opposed a motion for summary judgment regarding signed releases. The argument was that because they didn’t have any claims at the time of the release, they left the space blank. They didn't fill it out and claimed that they couldn’t have detailed any claims because zero claims existed at the time the release was signed.

In the privilege log however, there were nearly 300 docs pertaining to the large list of claims and damage calculations that predated the date they signed the release.


VOLUME OF DATA – You should know this… How much data do you have? There is a big difference between the amount of data

collected and the amount of data you will have after culling 50 Gb of email will result in a lot more reviewable data than

a 300 Gb forensic image taken from a hard drive. Why? Forensic images include system files, programs, unused

drive space and deleted files. A 300 Gb image may equate to only 20 Gb of Reviewable ESI to be processed once it has been analyzed.

Collected Email data is, in essence, pre-culled ESI. 50 Gb = 50 Gb.

1 Gigabyte (Gb) of Reviewable ESI Approximately 70-100K pages About 25-30 bankers boxes

1 Terabyte (Tb) = 1024 Gb of Reviewable ESI Approximately 70-100 Million pages Approximately 25,000- 30,000 bankers boxes

EFFICIENT RESOURCE USAGE? PROMPT?

DILIGENT? COMPETENT?


CULLING METHODS De-mystifying “De-NIST-ing”

The NSRL List (also called the NIST list) list can be used to eliminate known system files based on their digital signature.

The list is a collection of digital signatures of known, traceable software applications. It is updated regularly.

Culling Tools – In house or use a vendor? There are several culling tools available for “Do It

Yourself” culling. Consider the following when deciding if in house culling

is right for you: Who is going to be using the program? IT or dedicated staff?

Who is managing the in house collections? Are they qualified to handle their own evidence?

Chain of custody – Is client capable of documenting this? How frequently will culling be needed? Compare risk vs. cost savings

DEFENSIBLE? ACCURATE? COMPETENT?


CULLING- A Hypothetical Example…Culling by Domain In pre-processing, it is decided to narrow

the scope of your data through the use of email domain culling. This allows you to eliminate email from non-work sources, solicitation/spam, weekly industry newsletters, fantasy sports newsletters, etc. What is the obligation to share the list of

excluded domains with opposing counsel? A pornography website is among the excluded

domains. The email was identified among the data for a prominent employee. What is the responsibility to those you represent?

DEFENSIBLE? DILIGENT?



Avoid falling victim to the risks associated with under-informed or improper use of “bulk coding” options of pre-processing software applications. Domain filtering is a useful tool in categorizing

and prioritizing documents but it does not negate the responsibility to review the documents.

Clustering or near dupe applications with categorizations stating “you don’t have to review those records...” or similar.

Context is relevant. Since context can differ for even Hash level duplicates, you should not blindly code exact duplicates identically. The context may alter that categorization, so it is critical to at least review the differences related to the context of duplicates.

Avoid the temptation of the Easy Button.

PRE-CULLING/REVIEW – BULK TAGGING


DEFENSIBLE? ACCURATE? COMPETENT? DILIGENT?

Bulk Tagging - Non-Responsive Documents

Is an MD5 Hash matching duplicate of a non-responsive document also non-responsive?

The file “Take This Job And Shove It.MP3” is found among thousands of other songs in a users iTunes library. An exact duplicate of the file sits alone in a disgruntled former employee’s desktop folder named “For The Jerks”. The former employee is among several involved in a IP theft case. Are both files equally non-responsive?

BULK TAGGING- A Hypothetical Example…


DE-DUPLICATION - Hash values -You should know this…

Hashing uses an algorithm to compute a unique value for a file

Even the most minute difference between 2 seemingly identical files will result in completely different hash values

Hashes are deterministic – Hash algorithms will generate the same hash value for any static file every single time.

Hash values appear in a normalized, hexadecimal format.

Examples of 32 digit MD5 hash values: The quick brown fox jumps over the lazy dog Hash Value: 9e107d9d372bb6826bd81d3542a419d6 The quick brown fox jumps over the lazy dog. Hash Value: e4d909c290d0fb1ca068ffaddf22cbd0

Numerous acceptable algorithms exist. Examples include:

MD5 SHA-1 SHA-256



DE-DUPLICATION – A Hypothetical Example… De-duplication – Review Strategies Global de-duplication will result in fewer

documents to review. However, it can hinder the review team’s understanding of context as it pertains to the custodians. Could a standard de-duplication policy

be used in every case? How much of a part does the expense

of review play vs. understanding the context?

What other variables should be considered?

EFFICIENT? PROMPT? DEFENSIBLE? ACCURATE? COM

PETENT?


DE-DUPLICATION – Another Hypothetical Example… De-duplication – Production Assume that you globally de-dupe in

order to reduce review costs. When it comes time to produce your

documents, do you produce the globally de-duplicated set, a vertically de-duplicated set, or all of the data (no de-duplication)?

A recent ruling resulted in sanctions when a party produced a globally de-duplicated set of documents. The issue related to the order in which certain key custodians’ data was compared to that of other custodians.

EFFICIENT? DEFENSIBLE? ACCURATE?


CLUSTERING – Early Case Assessment (ECA)Concept Based Clustering

Compares documents based on actual content

Similar documents can be grouped together to increase review efficiency Groups of similar, non-relevant documents can be

de-prioritized or possibly excluded Groups of similar, specialized documents can be

foldered for review by experts or specific members of the review team

Clustering is related to searching Many clustering technologies are language

independent Some technologies allow for user directed*

clustering *We’ll cover this further when we discuss searching

EFFICIENT? PROMPT? DEFENSIBLE? ACCURATE? COM

PETENT?


SEARCHING – A Real World Example… Searching - Keyword Search Request

Received A firm submitted a search request that

included the names of several large organizations. Among the requested terms was “Ernest & Young”. Based on the written discovery request, which mentions Ernst & Young, it is obvious that the intent was to search for “Ernst & Young”. A member of your team notes this spelling error.

Do you run the search as instructed or do you modify the spelling? What if the error is discovered after processing many of the documents, or mid-way through your review?



SEARCHING: BASIC TYPES AND DIFFERENCES

Standard Boolean Operators AND, OR, NOT, W/x Wildcards, Fuzziness, Stemming

Quality of results can vary Overbroad results from use of “kitchen sink” strategy or inclusion of over-common terms Missed documents due to lack of research when devising search strategy – Initial search terms will lead to better search terms! Take advantage of “sampling” to improve quality of search terms

Many vendors offer consulting services to aid in improving the efficiency of key word searching.

Key Word Searching – A Quick ReviewConcept SearchingSearchable vs. Non-Searchable DocumentsTREC & EDRM

ACCURATE? DEFENSIBLE? COMPETENT?



Two primary approaches are generally used Guided and Unguided Taxonomies (classifications) Both create “clusters” of similar or related documents

Guided Taxonomies utilize user or expert created “guides” to help categorize documents that share similar concepts.

Industry or case specific terms can be clarified to ensure that certain words are properly interpreted based upon context. E.g. The term “option” could be categorized with “stocks”, “compensation”, “price”, “market” and similar words to help distinguish it from “option” used in reference to a choice.

Unguided Taxonomies identify concepts based upon the document collection

Allows user to identify related documents lacking specified keywords Identifies related concepts that may have been overlooked

Let’s take a look at an example on the next slide.

Key Word Searching Concept SearchingSearchable vs. Non-Searchable DocumentsTREC & EDRM




Unguided Taxonomies - Latent Semantic Analysis (LSA) Analyzes the co-occurrences of words in the

collection. Analysis resolves conditions wherein words have

multiple meanings or where multiple words share the same meaning

Considers relationships between words The concept “bicycle” would relate to the concept “vehicle” The concept “chain” would relate to the concept “bicycle” But

only where bicycle-related documents were concerned. Documents mentioning “restaurant chain” would not be

related, despite the presence of the term “chain” User could search for “bicycle” and get documents

discussing “helmets”, “pedals”, “tri-athalon” or “Schwinn” that DO NOT actually contain the word “bicycle”.

Key Word Searching Concept Searching - continuedSearchable vs. Non-Searchable DocumentsTREC & EDRM




A Guided Approach Using the Bayesian Algorithm Built upon the theorem authored by Thomas Bayes (1702-

1761) Bayesian indexes can be used to identify documents that are

conceptually similar to a selected sample set of documents. The result is a category of similar documents that can then be

used to identify any additional documents that are likely of the same nature.

Email spam filters use Bayesian mathematics to calculate the probability that an email is legitimate based on the frequency of specific keywords found within them.

In Electronic Discovery applications, this technology can be used to create “hot” subsets of similar documents as a category to find “like” documents based on the subset.

Key Word Searching Concept Searching - continuedSearchable vs. Non-Searchable DocumentsTREC & EDRM




Searchable Documents All content within the file is available to be indexed & searched “Speaking” documents and text based files

Non-Searchable Documents Non-speaking documents such as binary files Encrypted or password protected documents Corrupt documents Image documents without any embedded text

These may be made searchable if OCR is generated for them

Are non-searchable documents addressed in your production requests?


DILIGENT? ACCURATE? DEFENSIBLE? COMPETENT?



TREC1 “The Text REtrieval Conference (TREC), co-sponsored by the National Institute of

Standards and Technology (NIST) and U.S. Department of Defense, was started in 1992 as part of the TIPSTER Text program. Its purpose was to support research within the information retrieval community by providing the infrastructure necessary for large-scale evaluation of text retrieval methodologies.”

“Most of today’s commercial search engines include technology first developed in TREC.”

EDRM2 The EDRM Search Project is intended to create a normalized search schema that

will allow searches to be written in an application independent manner. It includes a broad array of search techniques; from Boolean to Concept / Clustering based methodologies.

The goal of EDRM is to develop guidelines and standards for e-discovery consumers and providers.

Technology and the landscape are both ever-evolving. Staying abreast of both is your professional

responsibility.1. http:// trec.nist.gov 2. www.edrm.net


DEFENSIBLE? COMPETENT?


SEARCHING – A Hypothetical Example… Searching - Stemming Current tools allow stemmed searches to

eliminate unwanted word variations. For example, a search for the word “option” in a stemmed search would return options, optional, optionor, optionee, optionally, optioned, etc. In a back-dating case, would you allow opposing counsel to selectively eliminate variations that appear to be unrelated to stock options?

If yes, would you expect opposing counsel to be willing to provide a list of the excluded variations of the search term?


ETHICAL EDDTopical Speaker: Joseph Derting, CFP, CCST, CCFA, iCA, CCA

Joseph Derting is a pioneer in the development and implementation of electronic discovery application processes. As Director of Consulting and Hosting Services at ADS, he works with clients from the onset of litigation through production.

Joseph’s industry contributions include: management of the conceptualization and development of EDD software applications; strategic consulting and providing technology-based evidentiary counsel; 8 years of managing electronic discovery processing; creation and implementation of test procedures for the five generations of EDD software; conceptualization and development of electronic discovery software training materials & methodology; and conducting on-site certification training programs in the use EDD software in nearly 70 litigation support offices around the U.S., U.K. and Canada.

Joseph has taught electronic discovery theory to over 200 professionals in Europe and North America, with more than 80+ training and speaking engagements to his record. He has been a featured speaker at numerous seminars and educational events. He is certified by Oregon State University in Computer Forensics and trained in the use and presentation of electronic evidence in Court; often appearing in U.S. District Court on behalf of clients. Recent Speaking Engagements (sample listing)

2007 FRCP Rule Changes & Effects on E-Discovery - Vendor Responsibilities - Portland, OR2008 Understanding Metadata CLE – Seattle, WA2009 Data Culling Methodologies CLE – Washington, DC2009 EDD to English: A Primer on Basic Terminology, Methodology & Practice CLE – Portland, OR2010 Bridging the Gap: Intermediate EDD Methodology & Practice CLE – Seattle, WA

2010Ethical EDD CLE - ACCA Southern California Chapter2010 Certifications

Certified discover-e Operator, discover-e TrainerCertified Forensic Professional – Oregon State UniversityConcordance Certified Software Trainer & FYI AdministratorCertified iConect Administrator Certified Clearwell Administrator

EducationB.A. Business Administration - University of Washington, 1988

AssociationsEDRM – Co-Lead – Probabilistic Hash Project, 2009-2010

Ethical EDD

Documents

Transcript of Ethical EDD