Category Archives: Spoliation

My Analysis of Calbar Formal Opinion 2015-193: eDiscovery & ESI? “Don’t Be Stupid”

The last three words from this short Beverly Hills Cop video clip sum up my analysis of the opinion:

I wrote public comments to COPRAC (The State Bar of California Committee on Professional Responsibility and Conduct) re their interim versions of the opinion and, in a rare step, I’m posting a verbatim excerpt because my assessment of this opinion remains unchanged.  One modification – I bolded a quote, because the Committee adopted my definition verbatim in their opinion (page three, footnote six):

“I’m seeing a very common thread in COPRAC’s reasoning that afflicts those who understand technology at a more surface-level; the tendency to think of it in physical, rather than ethereal terms.  In other words, the Committee has focused on the word evidence, instead of the word electronic.  Take water, for example.  Whether it exists in a lake, a bathtub, or a glass, it’s still water.  It’s the same with evidence.  Whether it exists as writing on a tombstone, a paper document, or in electronic form (e.g. sitting on a flash drive), it’s still evidence.  It’s the medium that should distinguish it for your purposes.  That’s the contrast missing here.

Whereas the Committee has done a better job of defining parameters such as clawbacks and laying out accurate mistakes by our hapless attorney, once again, it descends into conduct that isn’t eDiscovery-based; but competence-based.  This opinion relies too much on unrelated reasoning, such as “assumes”, “relying on that assumption” and “under the impression”.  That’s not an eDiscovery problem; that’s a general competence problem.  It’s also not what the audience needs.  If they’re attorneys licensed in California, they’ve presumably passed both a Professional Responsibility course and the MPRE exam and know – or should know – their duty of competence.  It’s not as if an attorney retains a med-mal case, then immediately “assumes” or is “under the impression” that s/he’s a doctor and can read an x-ray.  But I could intertwine those facts with this opinion and make it about medical experts.  What attorneys specifically need to know is how their actions, or lack thereof, in the procurement, assessment and handling of electronic evidence morph into a violation.  This is a highly specialized area unto itself.  See my previous example.  The x-ray is electronic evidence.  Proper acquisition is one matter; analysis, forensic or otherwise, is quite another.  That doesn’t just include the adversary’s evidence.  It also includes the Client’s evidence.  In this scenario, one is seeking to exculpate the Client through all available means – not just via the adversary.

Contradictions also exist in Footnote Six on page three that states, “This opinion does not directly address ethical obligations relating to litigation holds.”.  I respectfully submit that the opinion goes on to do exactly that.  Perhaps this is due to the criteria set forth in Footnote Six being inaccurate as defined.  In a legal setting, Attorney is charged to know what the Client does not, and this may involve issuing litigation hold instructions to their own Client; not just third parties or adversaries.  If attorney was interacting with the CIO or CTO (The “Information”/”Technology” chiefs, perhaps s/he could reasonably reply on their assessments.  But here, attorney is interacting with the CEO who likely has no intimate knowledge of what goes on in the IT department.  It should read, “A litigation hold is a directive issued to, by or on behalf of a Client.”  Otherwise, how does the competent Attorney protect a Client who, in good-faith, endeavors to do the right thing or protect themselves when a Client, in bad-faith, engages in intentional spoliation?  One of those scenarios exists on page two, when the eDiscovery expert, “tells Attorney potentially responsive ESI has been routinely deleted from the Client’s computers as part of Client’s normal document retention policy”.

Understanding these nuances and acting on them is the very definition of competence as applied to an eDiscovery attorney – or an attorney who engages the services of a third-party eDiscovery vendor.  In this arena, eDiscovery is like a game of falling dominos; once competence tips over, the rest (acts/omissions, failing to supervise, and confidentiality) will logically follow.  As they say, timing is everything.”

Conclusion:  The opinion does a good job of explaining fundamentals of the eDiscovery process, but in my opinion, doesn’t go nearly far enough.

Solid State, Spoliation, Stochastics, Shrodinger’s Cat & Wyatt Erp

MP900401975Last year, I was presenting at the Calbar Solo Summit and the issue of gleaning evidence from solid state drives (aka SSDs) came up.  From a technological standpoint, SSDs are highly efficient; from a forensics standpoint, they can be a nightmare.

The problem one faces with being queried about this issue is that it results in a very common answer I have to give when faced with a one-hour presentation and little time to explain; it depends.  Of course, on this blog, I’m not time-constrained.  Furthermore, I don’t re-invent the wheel when others have so elegantly explained the issue.

But, for a basic overview, let’s break down the data recording patterns into three possibilities:

  1. Random data is written to an open area.  When data is marked for deletion, it is not deleted immediately, but in the future, when a need arises to utilize that space.
  2. New data is written to an area containing existing data that is marked for deletion, thereby overwriting that data.
  3. Data marked for deletion is actually erased, then other data is written to the same area at a future time.

If you asked most people what happens when they record something on magnetic tape, most believe that there’s simply one ‘head’ that records onto the tape while simultaneously recording over anything that already exists on the tape.  Not so.

This is where “ERP”, comes in.  It’s just a simple mnemonic that stands for “Erase”, “Record” and “Playback”.  There are actually three separate heads, in that order, so when the tape passes over them, the first head erases any data, then the second head records new data.  In playback mode, obviously, the other two heads are bypassed and the playback head is used.

The reason I mention it is that most people also believe that deleting data on a drive is instantaneous, when normally, as illustrated from the examples above, it is not.  However, SSDs are closest to that process through an operation called ‘self-corrosion’.  Very soon after data is marked for deletion, that data may be gone; and I mean, really gone and unrecoverable.

Add that to the long list of challenges faced by data forensic investigators.

News of the World Buries the eDiscovery Lede: Spoliation

For those who aren't familiar with the term, "burying the lede" refers to an article that fails to express the most important issue in the 1st sentence or paragraph.

Obviously, by now you've heard about the News of the World phone-hacking scandal.  If you're an eDiscovery professional, then you'll find the lede buried all the way in paragraph nineteen:

"On Saturday, the Guardian newspaper, which has led the reporting on the scandal, said Scotland Yard was investigating evidence that a News International executive may have deleted millions of internal e-mails to obstruct the phone-hacking probe. The company denies the allegation." [italics/bold added]

If the allegation turns out to be true, I only have one question.  When will they ever learn?

e-Evidence Insights: A Good Senator, Spoliated.

…with deference to Mark Twain…

MP900400181 Recently-former-Senator John Ensign's (R-NV) affair and alleged attempts to cover it up would normally be fodder for the press – and I'd take little notice of it.  However, with the release of the Senate Ethics Committee Panel report, we find this:

"The report also accuses Ensign of deleting documents and files the committee was likely to request. The senator deleted the contents of a personal email account after the investigation was launched, it says." [italics added]

And this:

"The committee's report describes Cynthia Hampton as running up $1,000 in phone bills by texting Ensign while he was traveling in Iraq with a congressional delegation."

I want to distinguish between the first quote and the second.  The former is clearly in the realm of relevance (save for an attempted-but-likely-futile privilege argument against access to his personal email account), but the latter is an example of how 'beside-the-point' ESI becomes relevant.  The affair may be morally wrong, but texts between the two players are private – or at least they would be, except for the likelihood that access to them might lead to relevant evidence that would tend to prove or disprove a material fact.  Examples?  Did they conspire to cover up the affair through means that would be deemed improper?  Plus, who paid the phone bill?

This is how your personal cell, PDA or email account ends up in the hands of your adversaries.  You're not immune.

What do you think the odds are that Sen. Ensign knew, or should have known that destroying evidence after learning of an investigation is at best sanctionable conduct and at worst, a crime?

This is how destruction turns into obstruction.  Time to call "Aunt Judy"…or Judge Judy…

e-Discovery California: Deutch in Dutch with AG for Spoliation

MP900314122 How long does it take to shred 2.7 million documents?  I guess it depends on whether 'Tax Lady' Roni Deutch used machines or simply hit the 'delete' key.  Inconsequential; as we already know, destroying documents in violation of a court order will certainly lead to sanctions.  However, this time, our new California Attorney General, Kamala Harris, is seeking jail time for contempt.

This is one of two high-profile cases of this type.  The other involves a Houston, TX company called TaxMasters, although I'm not aware of any e-discovery-related issues with that case.  However, it's no coincidence that these cases receive stepped-up coverage at tax time.

Nevertheless, I'll be following the outcome of the former case.  It's not every day an AG calls you a "predator for profit".

Newton’s 3rd Law of eDiscovery

"For every eDiscovery action, there is an equal and opposite reaction."

— Sir Isaac Newton


As I've mentioned before, my litigation hold letter – that you see over on the right sidebar – is still the most popular link on the blog (next to the actual posts, that is…).  I've also provided this template to attendees of my presentations.  A question comes up regularly:

"If we send out a letter like that, our adversary will simply replace their name with ours and send it right back to us.  We don't want that to happen!"

It's a good point.   And as I've also mentioned before, what's good for you may also be good for your adversary.  Furthermore, there's absolutely no fault in thinking about this strategically, for example, keeping your clients' advantages/disadvantages in mind when you craft your demands and responses (which, hopefully, you're doing anyway).

There are times when you want everything but the kitchen sink, but sometimes, the sink itself will do nicely.  After all, if both sides produce a gargantuan amount of product, somebody's going to have to review it – and pay for it.

Be careful what you wish for in litigation; you might get it – and get nothing.

An adversary may produce reams of product, the sole purpose of which is to either make it next to impossible to find relevant needles in the document haystack, or worse, obfuscate the fact that they didn't produce relevant documents at all.  Oracle's Larry Ellison knows a bit about this [In re Oracle Corp. Sec. Litig., 627 F.3d 376 (9th Cir. 2010)].

That's why my template is meant only as a guide.  It may be appropriate to issue a letter that simply says, "You're on notice and we expect you to preserve relevant data."  And here's the other elephant in the room to consider; are you absolutely certain that your client is completely forthcoming about their own data?  If not, we already know who'll be on the hook for it.

As for attorneys who are complicit in assisting their clients with 'hiding the football'?  As they said in the movie, Airplane, "…they bought their tickets, they knew what they were getting into. I say, let 'em crash!"

Huh?  Wrong Newton?  Don't look at me.  Go back and redo your keyword & concept searches!


The Augur Sanction

MP900442519 e-Discovery Santions are increasing!  e-Discovery sanctions are decreasing!  Well, one of those statements is true, but here’s a better question; does it matter?

My pal Bob Ambrogi at Catalyst posted this excellent analysis showing the increase in sanctions.  Of course, when I ran into him at LTNY, we both chuckled over the fact that the latest Gibson, Dunn report states the opposite.  Bob followed-up on his own article with another excellent analysis on the discrepancy.

When it comes to this portion of the e-Discovery discipline, I prefer to look at it as simply “discovery”.  I even have a nifty formula.  The number of attorneys/clients engaging in discovery misconduct is directly proportional to those engaging in e-Discovery misconduct.  The proportion then increases/decreases based upon the bad actors’ knowledge of electronic forensics.  In other words, someone is more likely to engage in trickery if they think they won’t get caught – and when it comes to e-Forensics, in most cases, they don’t even know how we catch them.

Obviously, this doesn’t make me a genius.  If anything, it’s common sense.  But, betwixt and between all the debate about cooperation, I remain firmly in the “I’ll believe it when I see it” category.

This is all beside the point, anyway.  As I’ve stated before, if you look at the total amount of sanctions, it’s still an infinitesimal number when applied to the amount of cases.

Continued education of all parties regarding the process involved still augurs well for the future by keeping honest parties honest – and making dishonest parties at least think twice before acting.