About This Blog
Summaries, news and resources relating to eDiscovery in Delaware and beyond.
Showing 6 posts in Search Methodology.
I hate to say I told you so, but...wait, no I don't.
Yesterday, the Delaware Supreme Court issued its opinion in this matter affirming the Court of Chancery's spoliation finding. The Court held the spoliation finding proper, because Genger took affirmative steps to overwrite unallocated space, saying:
We do not read the Court of Chancery’s Spoliation Opinion to hold that as a matter of routine document-retention procedures, a computer hard drive’s unallocated free space must always be preserved. The trial court rested its spoliation and contempt findings on more specific and narrow factual grounds—that Genger, despite knowing he had a duty to preserve documents, intentionally took affirmative actions to destroy several relevant documents on his work computer. These actions prevented the Trump Group from recovering those deleted documents for use in the Section 225…
Compare with my statements below that
The [Court of Chancery] opinion in this case does not require preservation of all unallocated space in every case. Genger was sanctioned because he took affirmative steps to overwrite unallocated space, in violation of the Court's order... [T]here is nothing in this opinion that creates any requirement to preserve unallocated space. Rather, the opinion only says you shouldn't go out of your way to destroy it.
I feel quite vindicated in my defense, considering there were some persons and organizations of import in the eDiscovery community lined up on the other side. Obviously, reasonable minds can disagree, especially in interpreting court decisions. Ultimately, I am thankful that the Supreme Court's decision should allay any fears created by certain interpretations of the Court of Chancery's spoliation decision.
ORIGINAL POST (2011-03-11 13:20:45):
I had almost given up on writing this post considering how long it has been since I posted In Defense of Genger, Part I and (more importantly) how long it has been since the publication of the posts I am taking issue with. However, the ongoing confusion about this case has prompted me to action.
If you have read Part I, you are familiar with the Court of Chancery's decision in TR Investors LLC v. Genger, C.A. 3994-VCS (December 9, 2009) and with the allegations made by Leonard Deutchman, General Counsel at LDiscovery LLC, in a two-part post hosted by Law.com. <!--You also understand why there's a picture of Austin Powers.--> For those who are not familiar, Mr. Deutchman asserts that the Court got the decision wrong because it (1) does not understand the technology involved (Part 1) and (2) does not understand the law of eDiscovery (Part 2).
It's sufficient to say that I respectfully disagree with Mr. Deutchman on both charges. Rebutting his posts was a fun, interesting exercise for me, but it didn't seem terribly important. I saw it as an esoteric debate between eDiscovery geeks. That has changed, because, today, a prominent media outlet has published a post that elevates the confusion about this opinion and will cause unnecessary fear among corporate counsel.
The latest case of hand-wringing and confusion over this decision comes to us from none other than Forbes by way of Daniel Fisher's post "Delaware Ruling Would Require Massive Data Backups." Mr. Fisher opens his post stating that:
A little-noticed decision by a Delaware court has the potential to impose huge costs on companies unless it is reversed, computer-security experts say...[e]xperts say retaining such data would be prohibitively expensive since the unallocated space is essentially a trash bin that is altered each time a key is tapped.
Despite the fact that Mr. Fisher twice refers to "experts" (plural) as the source for these hyper-ventilations, his lone identified source for the post is Daniel Garrie, a lawyer and managing director at Focused Solution Recourse Delivery Group LLC , a computer consulting firm in Seattle. <!--Garrie and Deutchman are both lawyers with eDiscovery vendors. Is there anything to that?--> Mr. Fisher's post continues:
“It’s almost impossible for large companies with massive amounts of equipment to comply,” said Garrie... “I don’t even know if it’s possible,” said Garrie. “I mean, anything’s possible with enough money,” but companies would have to take bit-level images of their hard drives on a regular basis and store them somewhere, to be retrieved each time they are sued. That means all the time for most large companies. The costs would be “exponentially larger,” than current electronic discovery measures. “Several large global companies,” clients he declined to name, “have expressed concern.”
Let me clear up the confusion: The opinion in this case does not require preservation of all unallocated space in every case. Genger was sanctioned because he took affirmative steps to overwrite unallocated space, in violation of the Court's order and without first telling anyone. The routine, passive overwriting of unallocated space was NOT the cause for any sanctions here, so there is nothing in this opinion that creates any requirement to preserve unallocated space. Rather, the opinion only says you shouldn't go out of your way to destroy it. Big, BIG difference. <!--If there are doubts about the Court of Chancery's understanding of eDiscovery, please see their recently released "Guidelines for Preservation of Electronically Stored Information" that clearly embraces the principles of cooperation, reasonableness, and proportionality.-->
To Mr. Garrie's credit, he is consistent—he is co-author of an article in the Northwestern Journal of Technology and Intellectual Property that makes the same mistaken arguments, and he filed a brief with the Delaware Supreme Court arguing for reversal of the Genger opinion. I obviously disagree with Mr. Garrie's opinions on this matter, but I am here to help, so I say:
Mr. Garrie, for the “[s]everal large global companies [that] have expressed concern,” please send them a link to this post and tell them not to worry.
I don't actually expect Mr. Garrie will do that, but perhaps some of his clients will stumble upon this post, in which case here is my advice to them:
If you act cooperatively and transparently, you will be fine. If you find yourself in a similar position to Mr. Genger's, share your concerns with opposing counsel and the court before you do anything. Don't take matters into your own hands and violate a court order by wiping a hard drive in the middle of the night—it's bad form and will only get you in trouble.
Stayed tuned for the decision of the Delaware Supreme Court—
I may have a lot of words to eat...
<!--Thanks to flickr user cliff1066™ for the Austin Powers pic.-->
Sorry for the quasi-necropost, but I just stumbled upon relevant case law. In reading Cecil Lynn's excellent recent article on Law.com, Drama & Destruction, that provides a great rundown of 2010 case law, I came across this case summary:
In Ross v. Abercrombie & Fitch, defense counsel argued unpersuasively that the defense had no obligation to search for or locate known documents that did not turn up using the parties' agreed-upon search terms. 2010 U.S. Dist. Lexis 47620, at *11-14 (S.D. Ohio May 14, 2010).
I haven't read the case, but this seems to support the proposition that a producing party's obligation to produce relevant materials is not limited by the application of search terms. In other words, search terms are not a shield to producing known, relevant documents. Thank you very much.
ORIGINAL POST (2009-09-18 12:22:33):
This isn't exactly timely, but it's been on my mind for months, and I wanted to share and get your feedback.
I had the pleasure of attending The Sedona Conference® Institute this past March in Philadelphia. During the last day lunch, a particularly interesting conversation started up at my table. I was sitting with people I had never met before and probably wouldn't be able to pick out of a crowd now, but we managed to have a brief and interesting discussion about keyword searching and the obligation to produce. I don't remember how it started, but the terms of the debate were this: Is there an obligation to produce responsive data that was not hit by negotiated keyword terms? That is, you have positive knowledge that responsive documents have been excluded by keyword searching. Are you obligated to produce them?
I thought, and still do, that there is absolutely an obligation to turn the documents over. Keyword searching is a method for finding responsive documents that are mixed in with a morass of non-responsive documents. But, if you have a collected group of documents that are responsive, there's no need to dump them in the unsorted pile in the first place. They should be set aside for production without having to be keyword searched at all.
I casually shared my opinion with the table and saw several nodding heads, but I was surprised to find that two gentlemen did not agreed at all. Their view was that, if the keywords were negotiated, then the results are the results and there's no obligation to turn over anything not hit by them. One gentleman (a litigator, if I recall correctly) flatly said he would not turn over the responsive documents. The other gentleman (a vendor, I think) rather snidely remarked something to the effect that 'You wouldn't tell the other side what to ask during depositions, would you?' I agreed with that but thought it was a specious analogy. Not wanting to ruin a pleasant lunch with a heated debate, I let the discussion go, but it's been eating at me ever since.
Compare the view of these two gentlemen to the view of those of us who use sampling techniques to test the accuracy of keyword searches. When testing for false negatives (exclusion of responsive documents), many people are of the opinion that even one false negative requires that the whole pile of excluded documents be manually reviewed. On the other hand, for the gentlemen at my table, it would make no sense to ever test keyword search results, because they wouldn't produce any false negatives they found. To me, not producing documents you know are responsive just because they weren't hit by negotiated keyword searches is like using keyword searching as a shield. That not only violates the principles of cooperation but amounts to bad faith.
So which is right? Am I being naive and Pollyanna-ish, or do these two guys not get it? Or maybe it's a little of both?
A colleague recently spoke to Vice Chancellor Laster about this opinion, and the Vice Chancellor reportedly said, "No self-collection in my Court." I'm not sure that statement addresses my distinction between collection and review, but it does reinforce the Vice Chancellor's opposition to unsupervised custodian document collection.
Also, below is the presentation I made for use in briefing this case for the Herrmann Technology Inn of Court:
Recently, Vice Chancellor Laster gave some of us a jolt with a bench ruling on a discovery dispute in Roffe v. Eagle Rock Energy GP, et al., C.A. No. 5258-VCL (Del. Ch. Apr. 8, 2010). The ruling addresses the issue of client self-collection and a lawyer's oversight duties.
The Association of Corporate Counsel's (AAC) website carried a summary of the ruling authored by Morgan Lewis & Bockius LLP that stated:
Vice Chancellor Laster ruled from the bench that confirmatory discovery—like formal discovery—requires the defendant’s attorney to be physically present during the collection of electronically stored information from his/her client; self collection by the client is not permitted.
[P]ointed out that lawyers have an affirmative duty to be actively engaged in the collection process to the point that a lawyer should meet in person with the client to physically review his or her electronic information repositories wherever they may be located (including, if necessary, personal computers if that is where relevant information is stored).
I think Kevin's summary is much closer to the mark, and I'll explain why in a minute. First, the language causing concern is on lines 12-19 on page 10 of the attached transcript and reads as follows:
[Y]ou do not rely on a defendant to search their own e-mail system... There needs to be a lawyer who goes and makes sure the collection is done properly... we don't rely on people who are defendants to decide what documents are responsive, at least not in this Court.
The AAC article suggests there are two things implicated by this, and other supportive, language in the ruling: (1) client self-collection is not allowed, and (2) an attorney must be present during data collection. I think that interpretation assumes the worst and goes too far.
On the issue of self-collection, when the Court says not to "rely on a defendant to search their own e-mail system" and "we don't rely on people who are defendants to decide what documents are responsive," I believe the Court refers specifically to the practice of a client acting as document reviewer and sole arbiter of responsiveness. That is well understood to be a bad practice, so there is nothing shocking about this pronouncement.
I do not think the Court, in this ruling, has said that client bulk self-collection is impermissible. I see nothing in this ruling that would prohibit a client from gathering a mass of potentially responsive documents, e.g. full email accounts for all custodians, with guidance from counsel and turning them over to counsel for review. Counsel must review all potentially responsive documents and make final responsiveness determinations.
On the issue of requiring counsel's physical presence during collection, I again think the AAC article's interpretation of the Court's ruling goes too far. The AAC article seems to rely on the word "goes" in the Court's statement that "[t]here needs to be a lawyer who goes and makes sure the collection is done properly" for the proposition that counsel must 'go' and be physically present for collection. I think we get the spirit of the Court's statement by removing the 'go' part: "[t]here needs to be a lawyer who... makes sure the collection is done properly." That is well understood to be a best, if not required, practice, so there is nothing shocking about this pronouncement either.
To be fair, there are other references in the ruling to lawyers 'getting on a plane' to get data, but these suggestions seem to be case specific. In this case, Plaintiff was supposed to be conducting confirmatory discovery on three board directors but only collected from two. The third was a Mr. Smith. So the Vice Chancellor suggests that someone get on a plane to go get Mr. Smith's documents ("And you certainly need to put somebody on a plane to go out and see Mr. Smith." page 10, line 20; "So the question for me would be, one, how fast can you do this right? And that means not only the e-mails from Mr. Smith. As I say, somebody should have been on a plane a long time ago to go through his e-mails. And if he chose to use his personal computer, well, that was his bad choice. All right? And if he has it mixed in other stuff that he gets, 150 e-mails a day, or whatever, that was his bad choice. That makes it all the more essential that a lawyer get on a plane, and go and sit down with Mr. Smith, and go through his e-mail and make sure that what is produced is -- what is responsive is appropriately produced." page 12, lines 1-13). This seems to be a specific issue with Mr. Smith in this particular case requiring the physical presence of counsel to ensure collection of, perhaps, an unwilling participant.
I think my reading of this transcript aligns with Kevin Brady's in that lawyers need to be engaged in the discovery process and may need to be physically present during data collection. If, however, my interpretation is wrong and a lawyer is required to be present during collection that may only be conducted by a vendor, the cost of discovery in Delaware may be on the rise.
Chalk this up as a victory for the somewhat maligned use of search terms in eDiscovery. I was clued into this recent article via Lifehacker, discussing the eDiscovery findings of the Lehman collapse. The article, 'Stupid' Lehman E-Mails Didn't Stay 'Just Between Us,' shows how candid people still are in email and how the use of some thoughtful keywords and a little testing can still be very effective as a result:
"Just between us," it may be "stupid" to use certain words in e-mail to "discuss" the "big trouble" you might face if you’re ever investigated for financial wrongdoing or a subsequent cover-up.
Those are some of the terms that examiner Anton R. Valukas searched for in 34 million pages of Lehman Brothers Holdings Inc. e-mails and reports, to find out who knew what about the risks that drove the fourth-largest securities firm into bankruptcy, according to his 2,200-page study on the collapse.
Read the full article.
I rise now to defend the Court of Chancery's decision in TR Investors LLC v. Genger, C.A. 3994-VCS (December 9, 2009) against the allegations made by Leonard Deutchman, General Counsel at LDiscovery LLC, in a two-part post hosted by Law.com. I promised at the end of April that a defense would be forth coming but wanted to give everyone time to read the two posts to which I respond.
Mr. Deutchman asserts that the Court got the decision wrong because it (1) doesn't understand the technology involved (Part 1) and (2) doesn't understand the law of eDiscovery (Part 2). I have decided to respond in two parts to keep each of my posts digestible.
In Part 1, Mr. Deutchman aims to discredit the Court's technical competence, and his first criticism makes unsupported assertions about the Court's findings.
The court ruled that by wiping the unallocated space of the two drives, the defendant violated the standstill agreement and was thus in contempt of court. To reach its holding, the court had to make factual leaps and draw legal conclusions that are in my view questionable.
The court's first factual leap was that because temporary files could have resided intact in unallocated space, they were, in fact, intact prior to the wiping. More specifically, the longer leap is that because temporary files could have resided intact in unallocated space, temporary files important to plaintiffs were destroyed by the wiping.
In my reading, the Court did not assume or conclude that any particular files resided in unallocated space. Read as a whole, the opinion finds that files existed in unallocated space, some of which may have been relevant, but no one will ever know because Genger destroyed them. The Court fines Genger for willful destruction of data in direct and clear violation of a Court order.
Mr. Deutchman's second criticism was that "that the files [the Court] believed continued to reside in unallocated space if the defendant had not wiped them would have been important to the matter." Here Mr. Deutchman's merely reiterates Genger's "No harm, no foul" defense—or, as Ralph Losey refers to it, the "pig-in-a-poke" defense—to which the Court replied:
For a party to intentionally violate an order not to destroy or tamper with information and then to claim that he did little harm because no one can prove how much information he eradicated takes immense chutzpah. For a court to accept such a defense would render the court unable to govern situations like this in the future, as parties would know that they could argue extenuation using the very uncertainty their own misconduct had created.
Finally, Mr. Deutchman's concludes his first post by suggesting the Court is technically incompetent by claiming the Court thinks of unallocated space as a back up system.
It is important to note that nowhere in typical computer usage or professional information technology practice is the unallocated space on a hard drive regarded as "back up" in the way that the court does here.
No IT professional or typical user would consider unallocated space to be a "backup" space, akin to an external drive or backup tape used to affirmatively back up files, simply because forensic searching could possibly locate therein lost files in their deleted or temporary states.
While the Court of Chancery is likely not full of techno geeks, they seem to more than adequately understand the technology involved. In any case, the Court does not liken unallocated space to a backup system. On this point, the Court said "the information on the unallocated space of the TRI system therefore acted somewhat as a back-stop reservoir of documents that had been deleted from the active files of TRI users," and that the unallocated space was "a data source that would have acted as a back-stop in case relevant evidence had been deleted in the months when the motivation to delete would have been at a zenith." (Emphasis added.) Frankly, Mr. Deutchman's attempt to impugn the Court with this allegation is bizarre considering the plain and clear language quoted above.
I will address Mr. Deutchman's second assault on the Genger decision shortly.
I'd like to thank Chris and Morris James for the opportunity to participate on this blog and share my thoughts. Just the other day, Chris, as he is apt to do, sent me a provocative question: "Do you guys ever use keywords during collection?" As a practitioner here in Wilmington, I enjoy this type of open ended question, because normally I can answer it and then riff on the topic like a jazz musician. Here is the content of that improv we conducted via email:
VMC: I wouldn't recommend keywords for standard collection from Email or other ESI repositories, but I would use searches for database applications to extract relevant info. Also, there are some tools that, if you allow them the latitude, they can actually run searches in native stores such as server spaces.
CJS: On one hand it makes sense to cull at collection to save loading costs, but you'd still have to pay to have it done, so maybe it's a wash? It also seems easier to run searches on all the data at once after it's collected rather than multiple times on individual stores.
VMC: I think if you have a relatively small universe (custodians in the 100's or one small business) using search tools to LOCATE rather than CULL is an interesting idea. Provided all parties are cool with the terms, it would definitely cut down on review time and costs. In theory, everything you collect would be responsive by the fact that it was hit by a search term. Then your review can be very tactical in only looking for Privilege and concentrate on that.
CJS: This is a bit semantic, but, if you otherwise would have collected everything then run keywords, isn't locating prior to collecting the functional equivalent of culling? Also, while I agree it could cut down the review, wouldn't it still be difficult to implement? I assume not all the employees are custodians, so we'd ID the custodians then run the searches on just their data? Or would they be doing that? Or would we be running the terms on all the employee data? Are we assuming all the data is in a single store? Considering keywords aren't terribly accurate, would it be better to ask the custodians to collect their relevant docs?
VMC: And so the questions continue along that line! What I was suggesting is identification of data by using keyword searches by agreement. This hypothetical search would take place across all data stores without the need to identify key custodians. You are identifying records containing relevant terms. Now, the adequacy of using terms to find relevant information has been debated. So is there room for some sort of conceptual or analytical evaluation of the communication and not merely the terms used in the records? Culling occurs normally AFTER you have identified key custodians and key data locations. By utilizing word searching, we are culling down the set of potentially relevant records to those containing the terms identified. With the source search we are discussing, there would be no need for culling as you are doing that from the get-go.
We'd love to hear your thoughts on this. Extend this conversation in the comments section.