eDiscovery Preservation: Implementation Considerations

Address Scope of Preservation with Opposing Party ASAP

Be ready with all arguments on what is reasonable to preserve and what is not. Try to obtain agreement on lack of need to preserve disaster recovery tapes and the like. If agreement is not reached, consider going to the judge right away. Be prepared with specific information (affidavits, testimony from vendors) on cost to preserve what is being requested by the opposing party vs. what you believe is reasonable.

Custodians, Date Ranges, Keywords

One key "best practice" has emerged in the area of electronic discovery that typically will be acceptable to all interested parties: the limiting of discovery by keyword, custodian and date ranges. While not every dispute lends itself to these limitations, it is often the case that these limitations will assist all interested, including the judge. If both parties agree on these limits to preservation ahead of time and in writing, it creates a positive situation.

Care should be taken to be over-inclusive in this process to avoid the need to come back to original data stores later if more keywords, custodians or an increased date range is necessary.

Distribute the Litigation Hold

Distributing the litigation hold via email is generally accepted, and it is prudent to either track receipt automatically or request recipients acknowledge receipt by signing and returning a certification that the recipient has read the hold and understands the obligations contained within it. According to Zubulake, hold notices should be periodically reissued. Many companies send quarterly reminders and additional reminders when a major reorganization or reduction in force in the company occurs - particularly in the IT department.

Special Note: Innovation with the IT department should be encouraged. Try to find ways to ensure periodic updates of the duty to preserve, particularly for key witnesses. For example, the preservation hold could be posted on the company's intranet. Those with capable IT departments could utilize the user's workstation ID, in combination with a login script, to proactively and periodically introduce a pop-up screen with reminders of that particular custodian's duty to preserve documents. This could be enforced with a pop-up that has a timer embedded which would require the user to wait for 10 or 15 seconds before the popup could be dismissed. The popup could also require other intervention such as "I agree" or another positive step to be taken by the custodian before it could be dismissed.

Track responses to the litigation hold. Get management buy-in to enforce consequences for failure to comply. Include consideration of the HR intake process, getting employees to agree that they are records managers, or at least to complete a training program on handling records and hold orders.

Metadata

Give specific instructions to the recipients of the litigation hold regarding preservation and avoiding alteration of data and/or metadata, if relevant in the suit. See, for example, the Order for Preservation of Documents signed by Judge Scheindlin in In re: Methyl Tertriary Butyl Ether ("MTBE" Products Liability Litigation, MDL 1358 (SAS) M21-88 (March 15, 2005).

Williams v. Sprint/United Management Co., 2005 WL 2401626 (D.Kan. Sept. 29, 2005), is one of the first federal decisions specifically extending a responding party's duty to preserve to the metadata associated with relevant material, when the requesting party specifically requests production in native format. In an age discrimination class action, an agreement had been reached, and ordered by the Magistrate, to produce over 2,000 Excel spreadsheets in native format, so plaintiffs could manipulate Reduction In Force (RIF) data electronically without being manually re-entered. However, after production, plaintiffs discovered that all metadata had been "scrubbed" from the spreadsheets, and the cells locked, to prevent access to some of the data. Plaintiffs objected to the court, which issued a show cause order to the defendants for possible sanctions based on non-compliance with his prior order.

After a hearing on the show cause order, Magistrate Judge David Waxse found insufficient guidance in either case law or the Federal Rules of Evidence (existing or proposed) as to whether production of electronically stored information as ordinarily maintained would require production with the metadata intact. Turning to the Sedona Principles for Electronic Document Production and associated Comments, he noted that Comment 9.a. uses "viewability" as the standard for determining what should presumptively be considered part of a document under FRCP 34. This would include all metadata ordinarily visible to the user of a spreadsheet.

In granting the plaintiffs relief (but without awarding sanctions), the court held, "when a party is ordered to produce electronic documents as they are maintained in the ordinary course of business, the producing party should produce the electronic documents with their metadata intact, unless that party timely objects to production of metadata, the parties agree that the metadata should not be produced, or the producing party requests a protective order."

Effectively, this decision expands the scope of a responding party's duty to preserve vertically, by placing the burden on them to maintain and produce data in relevant material which is normally kept in the "background," and requiring the producing party to object to the production of metadata rather than placing the burden on the requesting party to specifically request metadata. Unless relief from the preservation burden is obtained by agreement or from the court, it is triggered whenever a requesting party asks for native format files as maintained in the ordinary course.

Because of the very fragile nature of many types of metadata, which can be altered even by simply copying or viewing a file, the prospect raised by the Williams decision of eventually having to produce some material with the new burden of keeping metadata intact may dictate a heightened sense of caution by practitioners during the preservation and collection process. A failure to adequately preserve metadata at the earliest opportunity may forever foreclose the ability to replicate what was lost, and possibly trigger spoliation risks.

Although applauded for shedding new and early light on the shadowy metadata puzzle, Judge Waxse's opinion in Williams may initially generate additional confusion in the ongoing discussion of "what is metadata" until Williams is interpreted more widely, and possibly refined, in other cases. His decision does clearly enunciate an understandable bright-line rule about the duties and burdens relating to production of metadata. However, Judge Waxse's application of the term "metadata" in his opinion to several different types of electronic information may leave those bearing such duties and burdens somewhat less than certain about their scope.

Because Plaintiffs could not reach the background, non-displaying data or formula cells in the electronic production of RIF spreadsheets at the center of this discovery dispute, Plaintiffs complained to the Court about Defendant's scrubbing of metadata and locking of cells which prevented them from seeing how the underlying data might have been used. In the opinion, Judge Waxse discusses many different types of data fields which can fall within the realm of metadata. However, he also includes the subject background spreadsheet data and formulas in that same category:

While metadata is not as crucial to understanding a spreadsheet as it is to a database application, a spreadsheet's metadata may be necessary to understand the spreadsheet because the cells containing formulas, which arguably are metadata themselves, often display a value rather than the formula itself. To understand the spreadsheet, the user must be able to ascertain the formula within the cell.

This inclusion of spreadsheet formulas and computed data - material generated or input by the user - extends beyond the ancillary nature of what is generally considered metadata. The Court, in beginning its discussion of "what is metadata" even noted:

Metadata, commonly described as "data about data," is defined as "information describing the history, tracking, or management of an electronic document."

Since, in announcing the bright-line rule described above, Judge Waxse made no distinction between the different types of metadata which must be produced, responding parties find themselves in the unenviable position of applying preservation protections to the deepest vertical levels of potentially relevant material as they prepare for discovery. Ironically, the decision stretches the potential scope of metadata to now include some "data which is the data."

Interview Recipients of the Litigation Hold

Emphasize preservation obligations per Zubulake. Have a form questionnaire that includes questions about where and how the recipient stores data. Consider whether to also interview administrative assistants. According to the ePolicy Institute, April 15, 2002, 43% of administrative assistants ghostwrite email under executives' names; 29% delete email for executives.

Document steps taken to preserve and use written documentation and timelines to show proof later regarding how seriously you took the matter. Elements of this documentation would be:

  • Preservation notices
  • IT checklists
  • Interview questionnaires
  • Certifications
  • Chain of custody forms for data collected

 

Backup Tapes and Recycling

During a Litigation Hold, the party must demonstrate good-faith compliance to the Hold while maintaining their ongoing day-to-day business operations. The recycling of backup tapes often presents particularly thorny issues, because the preservation of backup tapes in one case may be considered reasonable, but depending on the size of the corporation and the number of backup tapes involved, may be unreasonable, overbroad and burdensome in another case. This, however, is not an all-or-nothing proposition; there are options such as:

  • Pulling some tapes, based on identification of key players' server locations;
  • Pulling the oldest full backup out of rotation, or the newest full backup, or both;
  • Pulling the full backup closest in time to the events giving rise to the suit; or
  • A combination of these suggestions.

 

These options can be discussed with the opposing party and if agreement is not reached, raised with the court. Whether or not to take physical possession of the tapes from your client is a decision for the lawyers involved. It has been suggested by Judge Scheindlin in the Zubulake case, but there is always a risk of chain-of-custody issues and damage or degradation of the tapes to arise when the data has been moved from its everyday storage facility.

Snapshot Email Servers

Consider whether it would be wise to take a snapshot of all affected workstations or servers to assure compliance with the Hold. The nature of the case will dictate the scope of the process, as well as whether additional snapshots will need to be taken in the future. If there is a legitimate, serious concern that an individual may destroy relevant information upon receipt of a litigation hold notice, consider proactively preserving that person's data by reasonable means available in advance of publishing the litigation hold notice.

Forensic Images

If appropriate to the case, forensic images of the workstations and network servers involved should be taken by a certified forensic or collection vendor. There are several software products available, but an expert should be called in to perform this task to mitigate any possible problems caused by inexperienced technicians. Inadequate or faulty capture could possibly result in charges of spoliation and lead to sanctions or adverse inferences or other legal consequences. The vendor would then become the expert witness in the event that methodology on data capture becomes an issue.

Another alternative to forensic images of hard drives is to pull the original hard drive and replace it with a new hard drive with relevant active files copied to the new hard drive to allow business to continue as usual. The old hard drives should then be secured with appropriate chain of custody information.

Data Not Visible to the Network

If required by the Hold to collect user's local offline data, users should be fully informed of the proper procedure for the capture and security of data within their control, such as CDs, DVDs, thumb drives, home computers and PDAs. Users should be interviewed and a thorough inventory of materials documented. The best procedure may be to collect loose materials immediately to prevent any inadvertent loss of data or overwriting. Be sure to provide detailed instructions for the users and to employ careful chain-of-custody procedures to the materials.

Voice Mail and Voice-Over-Internet Protocol (VOIP)

Voice mail and VOIP require special handling and cooperation with the client's IT group. Examine the organization's retention policy - it may include stipulations for handling voice mail, company issued cell phones, etc. As with tape backups and other retention policies, consider whether these should be suspended for purposes of the Litigation Hold, at least until such time as the parties meet and confer on preservation of data.

Source: EDRM (edrm.net)