•© D.H. Haines

The Rules Are Changing: Electronic The Rules Are Changing: Electronic Records Management & The Records Management & The

Discovery of Digital InformationDiscovery of Digital Information

David H. HainesDavid H. HainesExecutive Vice President Executive Vice President

Strategy & DevelopmentStrategy & Development

SuperiorGlacierSuperiorGlacier

•© D.H. Haines

Strategic Issues for InsurersStrategic Issues for Insurers

• Risk Assessment – Companies and insurers need to develop a plan or framework for electronic evidence management with focus on operational risk

• Preservation – Critical to differentiate rules for document retention from preservation in litigation

• Scope – Discovery scope must pass the judicial standard of proportionality – specific, meet reasonableness test set by the courts

•© D.H. Haines

Electronic Discovery Implications Electronic Discovery Implications for Insurers: for Insurers:

Entity Risk & Operational RiskEntity Risk & Operational Risk

• Entity Risk = Insurer party to litigation or regulatory investigation - potential for non-compliance with e-discovery obligations

• Operational Risk = Insured's’ e-discovery duties, exposure and responsibilities of insurers via contract coverage obligations

• Experience highlights limited, to no focus on operational risk by insurers

•© D.H. Haines

Key Mandate to Differentiate Key Mandate to Differentiate Rules for Retention vs. Rules for Retention vs.

PreservationPreservation Document Retention Policies confused with duty to

preserve incumbent, particularly on insurers, viewed by the courts as frequent users of the litigation system

The duty to preserve in a pending litigation emerges with a requirement the insured cease all normal course of business retention processes in favor of a clearly communicated preservation plan

FRCP Rules require proactive Duty to Preserve even absent preservation order or Notice letter.

Be sure to understand obligations of a Legal Hold and it’s

impact.

•© D.H. Haines

What is a Legal Hold?What is a Legal Hold?What is a Legal Hold?What is a Legal Hold?

A legal hold is a communication issued as a result of current or anticipated litigation, audit, government investigation or other such matter that suspends the normal disposition or processing of records. Legal holds can encompass business procedures affecting active data, including, but not limited to, backup tape recycling. The specific communication to business or IT organizations may also be called a “hold,” “preservation order,” “suspension order,” “freeze notice,” “hold order,” or “hold notice.” – The Sedona Conference Glossary

•© D.H. Haines

Strategic IssuesStrategic Issues

Scope - Defining scope requires knowledge of information structures that capture & store potentially relevant information in opponents (and insured's own technical environment). Critical factors include:

Invest in early investigation of the opponents technology infrastructure

Prepare and conduct 30 (b) (6) depositions of key IT managers, with knowledge not only of corporate, but departmental systems, depending on the nature of the dispute.

Prepare a Blueprint of Where (information most likely exists and How (to Focus the investigation)

•© D.H. Haines

Electronic Discovery TrendsElectronic Discovery Trends

E-discovery requirements exist in an increasing majority of litigation. Plan with an expectation of electronic discovery requests and understand the vital role of metadata.

In most organizations, 90%+ of data is electronic yet the percentage retained in that form is less than 50% by some estimates. 60% of corporations report that the average amount of data reviewed in an investigation exceeds 500 GB.

Plaintiffs’ counsel are savvy. Regulators are up-to-date up with technology. All target email and attachments typically, emerging IM, VM.

•© D.H. Haines

Electronic Discovery TrendsElectronic Discovery Trends

Technology – use of advanced search & retrieval tools to enable content searching, in context, filtering data, retrieving hidden metadata –potential smoking gun

Preservation Repositories –for compliance, investigation preparedness, litigation needs to save major expense of Review – highest cost in discovery process.

Top concerns: Attorney diligence; cost sharing; discovery dispute resolution; privacy issues.

•© D.H. Haines

Electronic Discovery Model -7 Step Process Electronic Discovery Model -7 Step Process Step 1-Create Your E-Discovery Plan Step 1-Create Your E-Discovery Plan

Step 2-Preserve- Plan for Preservation order-Be pre-emptive. Assure hold on back-up tape rotation Step 2-Preserve- Plan for Preservation order-Be pre-emptive. Assure hold on back-up tape rotation

Step 3-Identify Collection - Maintain chain-of-custody. Determine forensic issues or needs Step 3-Identify Collection - Maintain chain-of-custody. Determine forensic issues or needs

Step 4-Collect -Potentially responsive data –Inventory collectionStep 4-Collect -Potentially responsive data –Inventory collection

Step 5-Analyze then Process –De-duplicate, refine and cull-via keywords. issues and date parameters Step 5-Analyze then Process –De-duplicate, refine and cull-via keywords. issues and date parameters

Step 6-Review–Use Internal or External Solutions - Secure Web Repository Step 6-Review–Use Internal or External Solutions - Secure Web Repository

Step 7-Production – Caution in assuring proper segmentation of data (privileged from non-privileged)Step 7-Production – Caution in assuring proper segmentation of data (privileged from non-privileged)

Scope & Define Data Management Needs

& Gather Client Requirements

Develop Focused Strategic Electronic

Discovery Plan

Collect Data from all relevant systems, applications and

stored data

Analyze Data- “Pre-Process” to

identify file types, proper handling and

related issues

Preserve Relevant Legacy

Data Implement On-going

Preservation

Apply or adjust De-Duplication algorithms and search criteria

De-Duplicate, search, annotate

load data to Review Platform-In-house

or Hosted

Prepare Review Strategy.

Perform Online Review

Produce

responsive data in requested format.

Generate Report for Audit trail

Prepare for potentialDefense-of-Process

Train potential witnesses

Create Discovery Plan: Identify Data Sources- Maintain Chain-of-Custody. Assess Forensic Need

Preservation

Processing Review Production Defense of Process

•© D.H. Haines

Attorney-Client Privilege & Attorney-Client Privilege & Work ProductWork Product

• Attorney-client privilege and work product doctrines apply to electronic documents as to paper.

• Emails and their attachments analyzed separately for privilege. eSpeed, Inc. v. Chicago Board of Trade, (S.D.N.Y.)

• Analyzing privilege claim for emails and attachments - St. Paul Fire & Marine Ins. Co. vs. SSA Gulf Terminals, Inc., E.D. La. emails protected by work product doctrine

• Waiver. Disclosure to third parties, including experts,

waives the privilege. United States Fidelity & Guaranty Co. v. Braspetro Oil Services Co., (S.D.N.Y.)

•© D.H. Haines

E-Discovery Roadmap: Meet E-Discovery Roadmap: Meet and Conferand Confer

• Proposed R.26(f) requires the parties at the scheduling conference, to discuss any issues “relating to preserving discoverable information,” and

• Any issues concerning discovery of electronically stored information, including the form in which it should be produced

•© D.H. Haines

Duty to Preserve- Duty to Preserve- Preservation Best PracticesPreservation Best Practices

1. Investigate.

2. Take an early position on scope of discovery.

3. Get out notices.

4. Get back acknowledgments.

5. Ask clients only to preserve.

6. Ask clients not to collect.

7. Ask clients not to review.

8. Instruct IT to suspend tape rotation and other SOPs.

9. Make litigation-specific backups.

•© D.H. Haines

Preservation of E-mailPreservation of E-mail

Methods:

Custodian-based preservation.

Technology-based preservation and enforcement.

Hybrid approaches.

Real-time data preservation.

Interval data preservation.

Audit, documentation, and certification.

•© D.H. Haines

E-Mail ManagementE-Mail Management

Improved e-mail management is necessary• Courts are prepared to sanction for perceived misconduct

• Major misconceptions about the appropriate balance between records management and litigation

• Accomplishing compliance-driven goals is not always sufficient

• Identifying records grade materials for lifecyle* retention not a usual focus

E-Mail archiving “best practices” have not been

adequately documented

* Source: Mindwrap - A technical dictionary of terms for guidance: http://www.mindwrap.com/infoblurbs/infoblurbs.html

•© D.H. Haines

Potential Sources of Potential Sources of EvidenceEvidence

Emails & metadata Voicemail IM - Instant Messaging File server / department shares Document management systems HRIS and rating systems Policies and procedures Internet cache and history (aka replicant data) Cookies (embedded data) Backup data (archived vs disaster recovery rules-based) Removable data Handheld devices Forensically recoverable data

•© D.H. Haines

Multiple Litigations: Multiple Litigations: Overlapping HoldsOverlapping Holds

• Be quick and aggressive with a preservation plan.

• Be specific with a protective order on preserving newly-created data.

• Reduce not-at-issue legacy data according to retention policies.

• Enforce records retention policy on a go-forward data.

• Corporate and outside counsel: When a case is over, archive or remove data that is no longer at issue and outside retention requirements.

•© D.H. Haines

Data Collection: PlanningData Collection: Planning

• Use a team of inside and outside counsel, experts, client business and IT personnel.

• Minimize interruption and intrusion.• Leverage client time for identifying content. • Use experts directed by counsel. Reduce

risk law firm & client personnel may need to testify.

• Preserve metadata and chain-of-custody. Use technology and procedures designed for e-discovery tracking and production.

•© D.H. Haines

You

Them

Your servers& backup media

The ISP(InternetServiceProvider)

Theirservers& backupmedia

The Achilles heel: EMWhere to find email…

© SuperiorGlacier

•© D.H. Haines

““Electronic Fingerprint” Electronic Fingerprint” ReminderReminder

• Before you click that “send” button, think: Are you able to defend the statements

made in that E-mail? Are you willing to do so under oath in

court?

•© D.H. Haines

The Three E’s for an Effective The Three E’s for an Effective E-Mail Policy *E-Mail Policy *

• EstablishEstablish a written policy that governs content and usage and sets policies on retention and deletion

• EducateEducate employees about the policy and require them to read and understand it

• Enforce the policy with penalties for violations, up to and including dismissal

• Source: ePolicy Institute

•© D.H. Haines

Computer Forensics –Computer Forensics –Is it necessary?Is it necessary?

• For forensic preservation: Question the need for disk imaging. Limit Use -key personnel only Quantify value vs. cost. Image onsite or in EDD labs. For evidence, work incrementally:

• Capture and preserve image.• Get preliminary analysis.• Consider focused analysis.• Develop evidence & testimony.

•© D.H. Haines

Sizing Data – Preparing e-Sizing Data – Preparing e-Discovery BudgetDiscovery Budget

Media Capacity Page Potential

3 1/ 2 floppy 1-2 mB 75 - 250

Zip disk 100-250 mB 5000 - 20,000

Full CD 650 mB 50,000

J az drive 2 gB 150,000

DVD 4.7 gB 350,000

DAT tape 4 - 20 gB 300,000 - 1.5 mm

Travan tape 20 gB 1.5 million

DLT tape 40-80 gB 3 to 6 million

Super DLT 60-120 gB 4 to 9 million

Hard Drives 4 gB-500 gB 300,000 and up

•© D.H. Haines

Sizing Data: Sizing Data: Rules of thumbRules of thumb

• Average User Data• 1 MB: 75 pages• 1 GB: 75,000 pages• Pages per email 1.8 • Pages per document 3.8

What affects the average?• Zip and “nested” zip files.• Nested messages.• Duplicates.• Software & graphics files.• Non-responsive data

Average .PST or .NSF email ---Emails--- -Attachments-- File Avg Avg 32 KB pst = 0 0100 MB = 900 300200 MB = 1,800 600400 MB = 3,500 1,200600 MB = 5,500 1,600

•© D.H. Haines

Electronic Data Challenges

• Spreadsheets and presentations have hidden slides, rows, columns, and formulae.

• Compressed, encrypted & embedded files can be automatically processed -disclose and “unitize” contents.

• Some native applications and source code require special text extraction and print drivers.

• Template “autodate” requires disclosure or substitution.

• Microsoft embedded edit history poses legal and factual questions.

•© D.H. Haines

Production Best Practices

1. Keep options open-keep electronic data electronic. Electronic format may be required.

2. Review relative costs. Electronic formats may be quicker and less expensive than paper.

3. Negotiate form of production early. Avoid the double or triple production.

4. Assess long-term needs.

5. Keep an up-to-date litigation support system to support full-text search & long- term needs for tracking files, productions & exhibits.

•© D.H. Haines

Reduce Risk – Control Costs via Litigation Contingency Planning.

• Pre-assign and train attorneys, IT, business clients, and experts to develop and manage strategies for:

• Preservation notices and acknowledgments. Preservation without spoliation. Suspension of retention and destruction

policies and specific SOPs Designation, preparation, and documentation

for 30(b)(6) deponents and other disclosures.

Standardized data collection, search, review, production, tracking, & re-use

•© D.H. Haines

Best Practice Tips – Document Best Practice Tips – Document RetentionRetention

• An effective policy includes:• Integrated, equivalent policies for paper and

electronic data.• Education for corporate control and proper

employee use of systems and data.• Practical methods for storage, retrieval, and

destruction.• Mechanisms for suspension -if litigation.• Audit and enforcement mechanisms

•© D.H. Haines

Steps to Prepare for Electronic discovery

• Understand the technology & terminology of your electronic data & processing standards

• Profile your key litigation information & map to your electronic data & systems

• Identify your specific electronic data risk areas• Develop & implement comprehensive electronic

data risk-reduction initiatives & a defensible response plan

• Incorporate electronic discovery into standard practice

•© D.H. Haines

Key electronic discovery risks

• (Mis)Use and improper retention of electronic mail

• Improper definition and retention of backup tapes

• Uncontrolled volume and distribution of data

• Outdated records management programs that do not properly incorporate electronic data

• The lack of a defined litigation response plan that addresses, preservation and defense-of-process

•© D.H. Haines

Key Items Key Items for your Radar Screenfor your Radar Screen

• Best Practices -Emerging Principles (Sedona) - www.sedonaconference.org

• Discovery of Digital Information – Judge Ronald J. Hedges U.S.M.J.

• Sarbanes-Oxley Compliance Journal – Annual Survey of Corporate Counsel - www.sox.com/news/detail.cfm

• 2006 Federal Rules of Civil Procedure Amendments incorporating important changes

•© D.H. Haines

Update on Draft Electronic Update on Draft Electronic Discovery Amendments to the Discovery Amendments to the

Federal Rules of Civil Federal Rules of Civil ProcedureProcedure

On April 12, 2006 the proposed amendments to the Federal Rules of Civil Procedure that address the discovery of electronically stored information were approved without comment by the United States Supreme Court. The new rules and amendments have been transmitted to Congress and will take effect on December 1, 2006, unless Congress enacts legislation to reject, modify, or defer the amendments. (Source: www.uscourts.gov/rules/index.html)

•© D.H. Haines

•© D.H. Haines