Electronic discovery
Electronic discovery refers to discovery in legal proceedings such as litigation, government investigations, or Freedom of Information Act requests, where the information sought is in electronic format. Electronic discovery is subject to rules of civil procedure and agreed-upon processes, often involving review for privilege and relevance before data are turned over to the requesting party.
Electronic information is considered different from paper information because of its intangible form, volume, transience and persistence. Electronic information is usually accompanied by metadata that is not found in paper documents and that can play an important part as evidence. The preservation of metadata from electronic documents creates special challenges to prevent spoliation.
In the United States, at the federal level, electronic discovery is governed by common law, case law and specific statutes, but primarily by the Federal Rules of Civil Procedure, including amendments effective December 1, 2006, and December 1, 2015. In addition, state law and regulatory agencies increasingly also address issues relating to electronic discovery. In England and Wales, Part 31 of the Civil Procedure Rules and Practice Direction 31B on Disclosure of Electronic Documents apply. Other jurisdictions around the world also have rules relating to electronic discovery.
Stages of process
The is an ubiquitous diagram that represents a conceptual view of these stages involved in the ediscovery process.Identification
The identification phase is when potentially responsive documents are identified for further analysis and review. In the United States, in Zubulake v. UBS Warburg, Shira Scheindlin ruled that failure to issue a written legal hold notice whenever litigation is reasonably anticipated will be deemed grossly negligent. This holding brought additional focus to the concepts of legal holds, eDiscovery, and electronic preservation. Custodians who are in possession of potentially relevant information or documents are identified. Data mapping techniques are often employed to ensure a complete identification of data sources. Since the scope of data can be overwhelming or uncertain in this phase, attempts are made to reasonably reduce the overall scope during this phase—such as limiting the identification of documents to a certain date range or custodians.Preservation
A duty to preserve begins upon the reasonable anticipation of litigation. Data identified as potentially relevant during preservation is placed in a legal hold. This ensures that data cannot be destroyed. Care is taken to ensure this process is defensible, while the end goal is to reduce the possibility of data spoliation or destruction. Failure to preserve can lead to sanctions. Even if a court does not rule that the failure to preserve is negligence, they can force the accused to pay fines if the lost data puts the defense "at an undue disadvantage in establishing their defense."Collection
Once documents have been preserved, collection can begin. The collection is the transfer of data from a company to its legal counsel, who will determine the relevance and disposition of data. Some companies that deal with frequent litigation have software in place to quickly place legal holds on certain custodians when an event is triggered and begin the collection process immediately. Other companies may need to call in a digital forensics expert to prevent the spoliation of data. The size and scale of this collection are determined by the identification phase.Processing
During the processing phase, native files are prepared to be loaded into a document review platform. Often, this phase also involves the extraction of text and metadata from the native files. Various data culling techniques are employed during this phase, such as deduplication and de-NISTing. Sometimes native files will be converted to a petrified, paper-like format at this stage to allow for easier redaction and Bates-labeling.Modern processing tools can also employ advanced analytic tools to help document review attorneys more accurately identify potentially relevant documents.
Review
During the review phase, documents are reviewed for responsiveness to discovery requests and for privilege. Different document review platforms and services can assist in many tasks related to this process, including rapidly identifying potentially relevant documents and culling documents according to various criteria. Most review tools also make it easy for large groups of document review attorneys to work on cases, featuring collaborative tools and batches to speed up the review process and eliminate work duplication.Analysis
Qualitative analysis of the content discovered in the collection phase and after being reduced by the preprocessing phase. The evidence is looked at in context. Correlation analysis or contextual analysis to extract structured information relevant to the case. Structuring the data along a timeline or clustered by topic is common. For example, one can arrange evidence by how it relates members of a group as a form of social network analysis.Production
Documents are turned over to opposing counsel based on agreed-upon specifications. Often this production is accompanied by a load file, which is used to load documents into a document review platform. Documents can be produced either as native files or in a petrified format alongside metadata.Presentation
Displaying and explaining evidence before audiences. The idea is that the audience understands the presentation, and non-professionals can follow the interpretation. Clarity and ease of understanding are the focus here. The native form of data needs to be abstracted, visualized, and brought into context for the presentation. The results of the analysis should be the subject of the presentation. Clear documentation should provide reproducibility.Types of electronically stored information
Any data that is stored in an electronic form may be subject to production under common eDiscovery rules. This type of data has historically included email and office documents but can also include photos, video, instant messaging, collaboration tools, text, messaging apps, social media, ephemeral messaging, Internet of things, databases, and other file types.Also included in ediscovery is "raw data", which forensic investigators can review for hidden evidence. The original file format is known as the "native" format. Litigators may review material from ediscovery in one of several formats: printed paper, "native file", or a petrified, paper-like format, such as PDF files or TIFF images. Modern document review platforms accommodate the use of native files and allow for them to be converted to TIFF and Bates-stamped for use in court.
Electronic messages
In 2006, the U.S. Supreme Court's amendments to the Federal Rules of Civil Procedure created a category for electronic records that, for the first time, explicitly named emails and instant message chats as likely records to be archived and produced when relevant.One type of preservation problem arose during the Zubulake v. UBS Warburg lawsuit. Throughout the case, the plaintiff claimed that the evidence needed to prove the case existed in emails stored on UBS' own computer systems. Because the emails requested were either never found or destroyed, the court found that they were more likely to exist than not. The court found that while the corporation's counsel directed that all potential discovery evidence, including emails, be preserved, the staff that the directive applied to did not follow through. This resulted in significant sanctions against UBS.
To establish authenticity, some archiving systems apply a unique code to each archived message or chat. The systems prevent alterations to original messages, messages cannot be deleted, and unauthorized persons cannot access the messages.
The formalized changes to the Federal Rules of Civil Procedure in December 2006 and 2007 effectively forced civil litigants into a compliance mode with respect to their proper retention and management of electronically stored information. Improper management of ESI can result in a finding of spoliation of evidence and the imposition of one or more sanctions, including adverse inference jury instructions, summary judgment, monetary fines, and other sanctions. In some cases, such as Qualcomm v. Broadcom, attorneys can be brought before the bar.
Databases and other structured data
Structured data typically resides in databases or datasets. It is organized in tables with columns, rows, and defined data types. The most common are Relational Database Management Systems that are capable of handling large volumes of data such as Oracle, IBM Db2, Microsoft SQL Server, Sybase, and Teradata. The structured data domain also includes spreadsheets, desktop databases like FileMaker Pro and Microsoft Access, structured flat files, XML files, data marts, data warehouses, etc.Audio
Voicemail is often discoverable under electronic discovery rules. Employers may have a duty to retain voicemail if there is an anticipation of litigation involving that employee. Data from voice assistants like Amazon Alexa and Siri have been used in criminal cases.Reporting formats
Although petrifying documents to static image formats had become the standard document review method for almost two decades, native format review has increased in popularity as a method for document review since around 2004. Because it requires the review of documents in their original file formats, applications and toolkits capable of opening multiple file formats have also become popular. This is also true in the ECM storage markets, which converge quickly with ESI technologies.Petrification involves the conversion of native files into an image format that does not require the use of native applications. This is useful in the redaction of privileged or sensitive information since redaction tools for images are traditionally more mature and easier to apply on uniform image types by non-technical people. Efforts to redact similarly petrified PDF files by incompetent personnel have removed redacted layers and exposed redacted information, such as social security numbers and other private information.
Traditionally, electronic discovery vendors had been contracted to convert native files into TIFF images with a load file for use in image-based discovery review database applications. Increasingly, database review applications have embedded native file viewers with TIFF capabilities. With both native and image file capabilities, it could either increase or decrease the total necessary storage since there may be multiple formats and files associated with each individual native file. Deployment, storage, and best practices are becoming especially critical and necessary to maintain cost-effective strategies.
Structured data are most often produced in delimited text format. When the number of tables subject to discovery is large or relationships between the tables are of essence, the data are produced in native database format or as a database backup file.