p. 1

[close]

p. 2

e-discovery right from the start employment law collection craig ball about this collection 2 right from the start 8 ways to hit the ground running 5 surefire steps to splendid search 8 geek speak lawyer s guide to the language of data storage and networking 17 meeting the challenge of e-mail in civil discovery 37 preservation of esi after layoffs 75 selecting engaging and working with e-discovery service providers 80 piecing together the e-discovery plan a plaintiff s guide to meet and confer 88 selected biyc columns on electronic discovery for employment lawyers 103 about the author 163 about this collection i m not an employment law specialist but the majority of cases in which i serve as an expert are disputes between employers and employees particularly departed employees who through guile or error left with proprietary data through computer forensics i ve exposed many a data thief but i m equally proud of the cases where my work proved that proprietary data either didn t run off or wasn t exploited in the common law justice oliver wendell holmes jr wrote even a dog distinguishes between being stumbled over and being kicked that distinction so often lies at the heart of what we seek to divine from the electronic evidence was the act complained of mean or careless did the employee spirit their e-mail to a thumb drive to abscond with client lists or pricing or did he or she mean only to retrieve personal messages are there genuine issues of e.g harassment sexism racism ageism or religious discrimination if so are they confined to an aberrant corporate cul-de-sac or entrenched in the company culture when a data theft case involves a veteran employee or senior executive the central question isn t whether they hold proprietary data if they worked from home or on the road company information likely resides on their home machines thumb drives and personal e-mail accounts 2

[close]

p. 3

instead the issues are what do they have where is it and where did it come from when did they acquire it who are they sharing it with and how are they using it whether damages should flow whether injunctive relief should issue and what steps are needed to rectify abuse all hinge on whether the dog was kicked or stumbled over on the face of things one looks like the other often it s the electronic evidence perhaps only the digital trail visible to a skilled analyst that allows us to tell the difference america s halcyon days of hammer and harness are behind us we are knowledge workers now yet even those who drive trucks or empty bedpans are tasked by pixels and tracked by bytes the evidence of what we do and say of when and where and how we go of what we own and earn and spend is digital more than 99 of it will never exist as anything but electronically stored information and most takes forms that require special tools or expertise to see and interpret this irritates and intimidates old school lawyers at great cost to unwitting clients the old school cling to what they know and disregard the rest they print documents or convert them to paper-like formats like tiff they unleash armies of reviewers against hordes of irrelevant documents they thunder that e-discovery is out-of-control extolling the merits of raw meat rather than learning to make fire sure it s scary to face the fact that something you can t see and don t understand can hurt you but we ve been down that road before take germs it s barely 150 years since john snow challenged the miasma theory of disease and stemmed a cholera epidemic by proving a contaminated well was the common source of infection he posited that invisible beasties in the water were responsible what a nutcase then dr oliver wendell holmes sr the famous jurist s father made himself a pariah in the medical community by advocating antiseptic techniques more invisible bogeybugs the eminent doctors scoffed and now he wants us to wash our hands gowns and instruments they also thought it too costly complicated and out of control just as we demand clean hands from surgeons clients and courts expect clean hands from lawyers in the sense of meeting a task ethically and in good faith a lawyer without the skills needed to properly preserve collect analyze and present electronic evidence is all-butincompetent to manage litigation today and visiting the cost to compensate for those shortcomings upon the client is its own ethical minefield that s why you must make it your mission to master electronic discovery now let me tell you why you ll be glad you did 3

[close]

p. 4

occasionally you ll win a case on charm a good or bad judge an appealing client a hateful opponent or just dumb luck but without any of these things you ll win most of the time if you have the evidence proving your case much of that evidence is digital it s there it s waiting for you eager to tells its compelling story ready to show your client was right and the other side should pay big or go hence without day the employment lawyer who can get to the digital evidence find it understand it and use it enjoys an enormous competitive advantage it s bad to want to win at any cost it s worse to accept defeat without a whimper the selected articles and columns that follow were chosen with the interests of employment lawyers in mind but they are but a sampling of the articles i ve written about electronic discovery and computer forensics and make available at www.craigball.com i hope you find them along with my blog posts webcasts and other resources to be an valuable accessible introduction to the technology and best practices of electronic discovery craig ball july 2009 4

[close]

p. 5

right from the start smart first steps in electronic discovery craig ball © 2008 certainly it s smart to prepare for e-discovery to be proactive about electronically stored information esi and implement early case assessment systems and strategies but sometimes the lawsuit s the first sign of trouble and you have to choose which fires to fight and fast don t be paralyzed by fear of failure or confusion about where to begin there are no perfect ediscovery efforts before the esi experts come aboard there are things you can and must do here s a quick compendium of eight ways to hit the ground running 1 apply the five ws of good journalism who what when where and why to get a handle on your core preservation duties immediately make a list of the people events time intervals business units records and communications central to the case a list the apparent key players don t forget assistants who e.g handle the boss email and significant third parties over whom your client has a right of direction or control b hone in on what happened both from your perspective and theirs and posit what esi sheds light either way or tends to explain or challenge the key players actions and attitudes c decide what dates and time periods are relevant for preservation is there a continuing preservation obligation going forward d determine which business units facilities systems and devices most likely hold relevant esi your lists will change over time but a focused thoughtful and well-documented effort diligently implemented is more defensible less costly and invariably more effective than a scattershot approach don t delay it needn t be flawless right now reasonable will do 2 focus on the fragile first what potentially relevant esi has the shortest shelf life and requires quickest action to preserve while it s still reasonably accessible voice mail web mail and text messaging computers requiring forensic examination web content and surveillance video are examples of esi that tend to be rapidly discarded or overwritten grabbing e-mail of key custodians before it migrates to backup media can save a bundle and accelerate search and processing 5

[close]

p. 6

3 protect employees from themselves people who wouldn t dream of shredding a paper record will purge esi with nary a thought in the blink of an eye history will be reinvented as employees delete overly candid e-mail and commingled personal and business communications the results are often catastrophic and always costly assess whether those entrusted with preservation can be trusted to perform and don t rely on custodial preservation alone when its failure is reasonably foreseeable 4 holds should be instructional not merely aspirational too many lawyers draft legal hold instructions designed to protect lawyers broadly disseminating a form hold directive saying keep everything isn t helpful and will come back to haunt you at deposition i got that memo they say but i didn t do anything custodians need to know where to start tell them what to do and how to do it give examples that inform and deadlines that demand action get management buy in for the time needed to comply better a handful of key players take the hold directive seriously than dozens or hundreds of minor players wink at it 5 boots on the ground good doctors don t diagnose over the phone likewise good lawyers meet key players and get a firsthand sense of how they operate seek out the people who manage the systems that hold the evidence and learn the who what when where and why of your client s esi face-to-face it s not just enormously helpful it s what courts demand 6 build the data map including local collections and databases federal practice requires identification of potentially relevant esi but it s a best practice everywhere that goes for the less-accessible stuff too courts won t accept we don t know what we have or where it is so be ready to identify potentially relevant esi that you will and won t explore or produce data stored off the servers or on databases pose special challenges made harder by turning a blind eye to its existence don t fall prey to if we don t tell them we have it they won t ask for it 7 consider how you ll collect store search review and produce esi all esi is just a bunch of ones and zeros making sense of it controlling costs and minimizing frustrating do-overs rides on how you choose to process and produce information so add an h how to those five ws and ponder your options for how the data gets from here to there 8 engage the other side even warring nations cease fire to carry off fallen comrades you don t have to like or trust the opposition but you have to be straight with them if you want to stay out of trouble in e-discovery tell the other side what you re doing and 6

[close]

p. 7

what you re unwilling to do collaborate anywhere you can lawyers over-discover cases more from ignorance and mistrust than guile or greed but even when you face someone gaming the system your documented candor and good faith effort to cooperate will serve you well in court 7

[close]

p. 8

8

[close]

p. 9

surefire steps to splendid search craig ball © 2009 hear that rumble it s the bench s mounting frustration with the senseless slipshod way lawyers approach keyword search it started with federal magistrate judge john facciola s observation that keyword search entails a complicated interplay of sciences beyond a lawyer s ken he said lawyers selecting search terms without expert guidance were truly going where angels fear to tread federal magistrate judge paul grimm called for careful advance planning by persons qualified to design effective search methodology and testing search methods for quality assurance he added that the party selecting the methodology must be prepared to explain the rationale for the method chosen to the court demonstrate that it is appropriate for the task and show that it was properly implemented most recently federal magistrate judge andrew peck issued a wake up call to the bar excoriating counsel for proposing thousands of artless search terms electronic discovery requires cooperation between opposing counsel and transparency in all aspects of preservation and production of esi moreover where counsel are using keyword searches for retrieval of esi they at a minimum must carefully craft the appropriate keywords with input from the esi s custodians as to the words and abbreviations they use and the proposed methodology must be quality control tested to assure accuracy in retrieval and elimination of `false positives it is time that the bar even those lawyers who did not come of age in the computer era understand this no help despite the insights of facciola grimm and peck lawyers still don t know what to do when it comes to effective defensible keyword search attorneys aren t trained to craft keyword searches of esi or implement quality control testing for same and their experience using westlaw lexis or google serves only to inspire false confidence in search prowess even saying hire an expert is scant guidance who s an expert in esi search for your case a linguistics professor or litigation support vendor perhaps the misbegotten offspring of william safire and sergey brin the most admired figure in e-discovery search today the sultan of search is jason r baron at the national archives and records administration and jason would be the first to admit he has no training in search the persons most qualified to design effective search in e-discovery 9

[close]

p. 10

earned their stripes by spending thousands of hours running searches in real cases making mistakes starting over and tweaking the results to balance efficiency and accuracy the step-by-step of smart search so until the courts connect the dots or better guidance emerges here s my step-by-step guide to craftsmanlike keyword search i promise these ten steps will help you fashion more effective efficient and defensible queries 1 start with the request for production 2 seek input from key players 3 look at what you ve got and the tools you ll use 4 communicate and collaborate 5 incorporate misspellings variants and synonyms 6 filter and deduplicate first 7 test test test 8 review the hits 9 tweak the queries and retest 10 check the discards 1 start with the request for production your pursuit of esi should begin at the first anticipation of litigation in support of the obligation to identify and preserve potentially relevant data starting on receipt of a request for production rfp is starting late still it s against the backdrop of the rfp that your production efforts will be judged so the rfp warrants careful analysis to transform its often expansive and bewildering demands to a coherent search protocol the structure and wording of most rfps are relics from a bygone time when information was stored on paper you ll first need to hack through the haze getting beyond the any and all and touching or concerning legalese try to rephrase the demands in everyday english to get closer to the terms most likely to appear in the esi add terms of art from the rfp to your list of keyword candidates have several persons do the same insuring you include multiple interpretations of the requests and obtain keywords from varying points of view if a request isn t clear or is hopelessly overbroad push back promptly request a clarification move for protection or specially except if your rules permit same don t assume you can trot out some boilerplate objections and ignore the request if you can t make sense of it or implement it in a reasonable way tell the other side how you ll interpret the demand and approach the search for responsive material wherever possible you want to be able to say we told you what we were doing and you didn t object 10

[close]

p. 11

2 seek input from key players judge peck was particularly exercised by the parties failure to elicit search assistance from the custodians of the data being searched custodians are the subject matter experts on their own data proceeding without their input is foolish ask key players if you were looking for responsive information how would you go about searching for it what terms or names would likely appear in the messages we seek what kinds of attachments what distribution lists would have been used what intervals and events are most significant or triggered discussion invite custodians to show you examples of responsive items and carefully observe how they go about conducting their search and what they offer you may see them take steps they neglect to describe or discover a strain of responsive esi you didn t know existed emerging empirical evidence underscores the value of key player input at the latest trec legal track challenge higher precision and recall seemed to closely correlate with the amount of time devoted to questioning persons who understood the documents and why they were relevant the need to do so seems obvious but lawyers routinely dive into search before dipping a toe into the pool of subject matter experts 3 look at what you ve got and the tools you ll use analyze the pertinent documentary and e-mail evidence you have unique phrases will turn up threads look for words and short phrases that tend to distinguish the communication as being about the topic at issue what content context sender or recipients would prompt you to file the message or attachment in a responsive folder had it occurred in a paper document knowing what you ve got also means understanding the forms of esi you must search textual content stored in tiff images or facsimiles demands a different search technique than that used for e-mail container files or word processed documents you can t implement a sound search if you don t know the capabilities and limitations of your search tool don t rely on what a vendor tells you their tool can do test it against actual data and evidence does it find the responsive data you already know to be there if not why not any search tool must be able to handle the most common productivity formats e.g .doc docx .ppt .pptx .xls .xlsx and .pdf thoroughly process the contents of common container files e.g .pst .ost .zip and recurse through nested content and e-mail attachments as importantly search tools need to clearly identify any exceptional files unable to be searched such as non-standard file types or encrypted esi if you ve done a good job collecting and preserving esi you should have a sense of the file types comprising the esi under scrutiny be sure that you or your service providers analyze the complement of file types 11

[close]

p. 12

and flags any that can t be searched unless you make it clear that certain files types won t be searched the natural assumption will be that you thoroughly searched all types of esi 4 communicate and collaborate engaging in genuine good faith collaboration is the most important step you can take to insure successful defensible search cooperation with the other side is not a sign of weakness and courts expect to see it in e-discovery treat cooperation as an opportunity to show competence and readiness as well as to assess your opponent s mettle what do you gain from wasting time and money on searches the other side didn t seek and can easily discredit won t you benefit from knowing if they have a clear sense of what they seek and how to find it tell the other side the tools and terms you re considering and seek their input they may balk or throw out hundreds of absurd suggestions but there s a good chance they ll highlight something you overlooked and that s one less do over or ground for sanctions don t position cooperation as a trap nor blindly commit to run all search terms proposed we ll run your terms if you agree to accept our protocol as sufficient isn t fair and won t foster restraint instead ask for targeted suggestions and test them on representative data then make expedited production of responsive data from the sample to let everyone see what s working and what s not importantly frame your approach to accommodate at least two rounds of keyword search and review affording the other side a reasonable opportunity to review the first production before proposing additional searches when an opponent knows they ll get a second dip at the well they don t have to make draconian demands 5 incorporate misspellings variants and synonyms did you know google got its name because its founders couldn t spell googol whether due to typos transposition im-speak misuse of homophones or ignorance electronically stored information fairly crawls with misspellings that complicate keyword search merely searching for management will miss managment and mangement to address this you must either include common variants and errors in your list of keywords or employ a search tool that supports fuzzy searching the former tends to be more efficient because fuzzy searching also called approximate string matching mechanically varies letters often producing an unacceptably high level of false hits how do you convert keywords to their most common misspellings and variants a linguist could help or you can turn to the web until a tool emerges that lists common variants and predicts the likelihood of false hits try a site like http www.dumbtionary.com that checks keywords against over 10,000 common misspellings and consult wikipedia s list of more than 4,000 common misspellings wikipedia shortcut wp:lcm 12

[close]

p. 13

to identify synonyms pretend you are playing the board game taboo searches for car or automobile will miss documents about someone s wheels or ride consult the thesaurus for likely alternatives for critical keywords but don t go hog wild with dr roget s list question key players about internal use of alternate terms abbreviations or slang 6 filter and deduplicate first always filter out irrelevant file types and locations before initiating search music and images are unlikely to hold responsive text yet they ll generate vast numbers of false hits because their content is stored as alphanumeric characters the same issue arises when search tools fail to decode e-mail attachments before search here again you have to know how your search tool handles encoded embedded multibyte and compressed content filtering irrelevant file types can be accomplished various ways including culling by binary signatures file extensions paths dates or sizes and by de-nisting for known hash values the national institute of standards and technology maintains a registry of hash values for commercial software and operating system files that can be used to reliably exclude known benign files from e-discovery collections prior to search http www.nsrl.nist.gov the exponential growth in the volume of esi doesn t represent a leap in productivity so much as an explosion in duplication and distribution much of the data we encounter are the same documents messages and attachments replicated across multiple backup intervals devices and custodians accordingly the efficiency of search is greatly aided and the cost greatly reduced by deduplicating repetitious content before indexing data for search or running keywords employ a method of deduplication that tracks the origins of suppressed iterations so that repopulation can be accomplished on a per custodian basis applied sparingly and with care you may even be able to use keywords to exclude irrelevant esi for example the presence of keywords cialis or baby shower in an e-mail may reliably signal the message isn t responsive but testing and sampling must be used to validate such exclusionary searches 7 test test test the single most important step you can take to assess keywords is to test search terms against representative data from the universe of machines and data under scrutiny no matter how well you think you know the data or have refined your searches testing will open your eyes to the unforeseen and likely save a lot of wasted time and money the nature and sample size of representative data will vary with each case the goal in selection isn t to reflect the average employee s collection but to fairly mirror the collections of 13

[close]

p. 14

employees likely to hold responsive evidence don t select a custodian in marketing if the key players are in engineering often the optimum custodial choices will be obvious especially when their roles made them a nexus for relevant communications custodians prone to retention of esi are better candidates than those priding themselves on empty inboxes the goal is to flush out problems before deploying searches across broader collections so opting for uncomplicated samples lessens the value it s amazing how many false hits turn up in application help files and system logs so early on i like to test for noisy keywords by running searches against data having nothing whatsoever to do with the case or the parties e.g the contents of a new computer being able to show a large number of hits in wholly irrelevant collections is compelling justification for limiting or eliminating unsuitable keywords similarly test search terms against data samples collected from employees or business units having nothing to do with the subject events to determine whether search terms are too generic 8 review the hits my practice when testing keywords is to generate spreadsheet-style views letting me preview search hits in context that is flanked by 20 to 30 words on each side of the hit it s efficient and illuminating to scan a column of hits pinpoint searches gone awry and select particular documents for further scrutiny not all search tools support this ability so check with your service provider to see what options they offer armed with the results of your test runs determine whether the keywords employed are hitting on a reasonably high incidence of potentially responsive documents if not what usages are throwing the search off what file types are appearing on exceptions lists as unsearchable due to e.g obscure encoding password protection or encryption as responsive documents are identified review them for additional keywords acronyms and misspellings are terms that should be finding known responsive documents failing to achieve hits are there any consistent features in the documents with noise hits that would allow them to be excluded by modifying the query effective search is an iterative process and success depends on new insight from each pass so expect to spend considerable time assessing the results of your sample search it s time wisely invested 14

[close]

p. 15

9 tweak the queries and retest as you review the sample searches look for ways you can tweak the queries to achieve better precision without adversely affecting recall do keyword pairs tend to cluster in responsive documents such that using a boolean and connector will reduce noise hits can you approximate the precise context you seek by controlling for proximity between terms if very short e.g three letter acronyms or words are generating too many noise hits you may improve performance by controlling for case e.g all caps or searching for discrete occurrences i.e the term is flanked only by spaces or punctuation 10 check the discards keyword search must be judged both by what it finds and what it misses that s the quality assurance courts demand a defensible search protocol includes limited examination of the items not generating hits to assess whether relevant documents are being passed over examination of the discards will be more exacting for your representative sample searches as you seek to refine and gain confidence in your queries thereafter random sampling should suffice no court has proposed a benchmark or rule-of-thumb for random sampling but there s more science to sampling than simply checking every hundredth document if your budget doesn t allow for expert statistical advice and you can t reach a consensus with the other side be prepared to articulate why your sampling method was chosen and why it strikes a fair balance between quality assurance and economy the sampling method you employ needn t be foolproof but it must be rational remember that the purpose of sampling the discards is to promptly identify and resolve ineffective searches if quality assurance examinations reveal that responsive documents are turning up in the discards those failures must receive prompt attention search tips defensible search strategies are well-documented record your efforts in composing testing and tweaking search terms and the reasons for your choices along the way spreadsheets are handy for tracking the evolution of your queries as you add cut test and modify them effective searches are tailored to the data under scrutiny for example it s silly to run a custodian s name or e-mail address against his or her own e-mail but sensible for other collections it s often smart to tier your esi and employ keywords suited to each tier or when feasible to limit searches to just those file types or segments of documents i.e message body 15

[close]