What is discoverable when it comes to investigations?
We fielded a recent customer question that made us take another look at what IT organizations need to consider when performing eDiscovery searches or responding to information queries such as Freedom of Information requests.
The question was initially surprising, but when we looked closer, it’s a reasonable one and an area where IT and Legal only intersect when there are problems.
What is ESI?
The term ESI is regularly used in the legal community and is an acronym for Electronically Stored Information – not simply electronically searchable information. The distinction is an important one.
Most legal processes were modelled around paper files – hence the term “discovery.” In 2006 the US judiciary finally addressed burgeoning electronic information discovery, or eDiscovery, by amending the Federal Rules of Civil Procedure (FRCP) to include electronic information. It should be noted that UK courts incorporated rules to handle electronic discovery some years earlier, but the legal community universally regards ESI as “anything stored via electronic means.”
An important distinction about ESI is that nobody, anywhere, has more granular descriptions on what it is, how it’s stored, etc. In fact, laws and acts and statutes that refer to ESI talk about “preserving” such data and leave the means of preservation up to the holders, i.e. the IT organization.
If it’s saved, it’s discoverable
Courts consider evidence as sacred – it is not to be destroyed nor tampered with, and it must be produced whenever it exists.
Early attempts to define records as the only legally-binding form of electronically stored information quickly failed in the courts, and numerous recent cases have expanded the notion of electronically stored to include video recordings and even smartphones. Essentially, if a device can store information, that information is ESI.
The problem becomes discovery. Just because information might be stored on a particular device does not mean it will be simple or even possible to retrieve or discover that information. Even old backup tapes have proved problematic in that regard – some older formats are simply unreadable by today’s machines.
The courts have accommodated this problem – somewhat – in what is called proportionality. This notion is that the time, effort, and costs to discover electronic information needs to be proportional to the size of the case. This is obviously to prevent $50,000 cases from generating hundreds of thousands of dollars of eDiscovery. However, it does not give companies a free pass.
Plaintiffs and defendants are both entitled to discovery
It’s too hard to discover that information, so it’s not proportional to the case is an argument which has been made – and lost – in numerous cases. In most cases, there need to be genuine extenuating circumstances because both sides are entitled to discover evidence that either supports or refutes their case if such evidence exists.PST files are a good example of this. A court may order discovery for a given group of custodians (ie users) pertaining to a specific matter during a specific period of time. That order presumes that all relevant information will be discovered. Format is irrelevant, and any PST files in possession of that custodian are presumed to be discoverable.
Not discovering (i.e., collecting, reviewing, and processing) those files can mean a quick trip back to court to discuss spoliation sanctions, wherein the party who failed to discover the information within those PSTs is compelled to do so, at their own expense, regardless of how “proportional” they might be, and may also be subject to a fine.
Proportionality is being revisited by the courts for 2015 Amendments to the FRCP, but until those take effect, the proportional argument has no merit.
Lack of technology is no excuse
Judges often know more than the named parties in court cases; many US District Judges are responsible for case law that has defined the boundaries of eDiscovery, computer-assisted review, etc. In short, they know about technology.
Judges who understand the capabilities and boundaries of technology are not shy about directing parties to use it, nor shy to impose orders or even sanctions on those who don’t. In a famous case involving ESI, Valeo v Cleveland Die, one party argued that the other’s eDiscovery was impossible to understand without using technology – the claim was denied. In another, Spieker v Quest Cherokeeo, an argument was made that eDiscovery would be disproportionate to the amount of the claim – denied, based on the judge’s knowledge of technology which would make such eDiscovery less costly.
PST files? Lawyers regularly use them as container files to ship around eDiscovery collections from parties to law firms, etc., so the technology isn’t unknown to them. In fact, courts are likely to assume that PST containers were exploded and searched as part of a discovery request; parties who failed to discover email items because they were captured in desktop PST files will surely face sanctions if they are ever questioned about such files.
IT Organizations need to get ahead of this problem
With the knowledge that ESI format has no bearing on whether or not they need to discover such information, IT organizations should consider proactive remedies to eliminate PST files before they have to perform lengthy and expensive eDiscovery searches.
For companies with retention schedules, it is perfectly reasonable to apply those schedules retroactively to data within PST files: in other words, if it would have been deleted x months after initial creation, it should not have existed in a PST file in the first place after the point of deletion.
For companies without such schedules, or even for users whose PST data falls within corporate guidelines, IT organizations have several choices. One is to centralize PST files: simply move them from the user’s desktops onto a central server, which will greatly simplify management and discovery (remember that as soon as that user’s files are put on legal hold, his or her PST files are also subject to hold – far safer to remove them from the desktop entirely). Centralized PST files are still accessible to users; in fact, it looks like nothing has changed. Companies can also re-ingest these email items back into users’ in-boxes, as mailbox quotas no longer apply to modern versions of Exchange.
Both of the above strategies come at a cost: additional storage. The third and best option is also the most cost-effective: archiving. An email archiving solution will eliminate PSTs, place stubs of archived mail back into users’ in-boxes, and deploy technology such as compression and single-instance storage to move the contents of PST files as well as all older email data into efficient archives. If the solution is on-premise, storage is at least 50% less than the size of the original items. If the solution is an appliance, the same efficiency technologies are incorporated into the appliance which also functions as the storage vehicle. And if the solution is cloud storage, then cloud-style storage options and pricing apply.
The other key benefit of eliminating PSTs through archiving is search and retrieval. Discovery is the most painful aspect of PST data, yet archiving solutions provided by Barracuda all offer powerful search and discovery software that will rapidly, painlessly, and defensibly locate and collect all email data that is relevant to any discovery request.
Leaving PST files on desktops and hoping for the best, or worse, assuming they are not subject to discovery, is simply a strategy that is too risky for most customers to adopt.