Digging for E-Datai Kristin M. Nimsgerii You won't find entries for 'electronic evidence' and 'e-discovery' in the latest edition of Black's Law Dictionary. But knowing what they are and how to use them may save your client's case, and your practice. Plaintiff lawyers with busy trial practices often operate in a head-down, shoulder-to-thegrindstone fashion. Managing a heavy caseload as well as an office can take so much energy and time that keeping up with the latest litigation trends may seem impossible. If this sounds like you, you probably haven't examined both the promise and the peril that electronic evidence can present in your clients' cases. If so, you may be setting them up for a fall and putting yourself at risk for a malpractice claim. In 2001, businesses in North American sent an estimated 2.5 trillion e-mail messages, a number that was expected to grow to 3.25 trillion in 2002.iii Ninety-three percent of all business documents are created electronically,iv and most are never printed.v But that doesn’t mean that copies aren’t being made. Almost all businesses and many individuals have learned the importance of backing up electronic data regularly—even daily. The result: copies upon copies of electronic evidence that may be relevant in litigation. Let’s say you suspect a defendant has electronic data that could help your client’s case. How do you get access to it? If you don’t know, you may miss out on critical evidence. Or let’s say your client receives a request to produce electronic data that is clearly discoverable.vi How do you proceed? What if your client routinely deletes or writes over data? How do you protect the client from committing spoliation by unwittingly erasing or destroying electronic evidence relevant to pending litigation—and consequently risking sanctions, including dismissal of the complaint or default judgment on a counterclaim? Heads up: It’s time to learn what you need to know about electronic evidence to protect your clients’ interests and avoid the potentially catastrophic results of ignorance and inaction. Getting the e-goods E-discovery can produce a treasure trove of evidence. The discovery of just one e-mail message can transform a contentious legal battle into settlement discussions. For example, in Linnen v. A.H. Robins Co., the family of a woman who died after taking the diet-pill combination of the prescription drugs fenflurarmine and phentermine (known as fen-phen) sued the drugs’ makers. The plaintiffs claimed the drugs, taken in combination, caused the woman to develop a deadly lung disorder.vii Computer forensic engineers hired by the plaintiffs were able to recover an email from one A.H. Robins employee to another that read: "Do I have to look forward to spending my waning years writing checks to fat people worried about a silly lung problem?"viii Shortly after this revelation, the case settled. 1

Linnen is not an isolated case. E-mail and other types of electronic evidence are at the center of many well-publicized lawsuits. For example, in the Bridgestone/Firestone multidistrict litigation concerning allegedly defective tires on Ford Explorers, the court has ordered specifically addressing how electronic evidence will be handled.ix So what do you do when you think e-evidence may be central to your case and it’s in the hands of the defendant? First, look to the federal rule governing initial disclosures—Federal Rule of Civil Procedure 26. Because jurisdictions may no longer "opt out" of the disclosure requirement, attorneys must address the impact of this rule on electronic evidence.x Even if a case is in state court, this rule and other relevant federal rules discussed below may apply because state rules often mirror the federal rules. Some states (for example, California and Texas) have special rules addressing electronic evidence. Federal Rule 26(a)(1)(B) specifically requires the disclosure of "data compilations" (for example, electronic files, databases, and e-mails) after a full investigation of the case. This imposes a duty on attorneys to identify all sources and locations of electronic data in their clients’ possession.xi Data will commonly be located on desktop and laptop computers, network hard discs, removable media (like floppy discs, tapes, and CD-ROMs), and, increasingly, personal digital assistants like the Palm Pilot. Data may also be in the possession of third parties, including Internet service providers and other peripherally involved entities. Determining how much e-mail and other electronic data is in a defendant’s control can be difficult to do without the assistance of an experienced electronic discovery expert. However, this information is essential for compliance with Rule 26(f), which requires all parties to meet to discuss a discovery plan. To do this, attorneys will need to understand how their client's information systems create, store, and destroy electronic evidence. If the defendant has not produced this information, you can ask the court to compel compliance with the rule. Under Rule 26(a)(2), the parties must also disclose the identities of their e-discovery or forensic experts or risk not being able to call them to testify at trial. Obviously, any person who has performed a forensic analysis of the parties’ hard drives or other systems falls within the scope of this rule. The more interesting issue is whether one must disclose the identity of an expert who handles the collection and reproduction of electronic data without conducting any sort of forensic analysis. These experts clearly possess the kind of "scientific, technical, or other specialized knowledge" contemplated by Federal Rule of Evidence 702. After the Rule 26 disclosures, you can acquire more in-depth information through a combination of traditional discovery tools: interrogatories, requests for production of documents, and depositions.xii The Rule 30(b)(6) deposition is an excellent tool for obtaining more information about the layout of the defendant's computer system to guide further discovery. If the defendant is a company, depose the person who would have the most knowledge of: 2

· the number, types, and locations of computers currently in use and no longer in use · the operating systems and application software the company is using, including the dates of use · the company's file-naming and location-saving conventions · disc- or tape-labeling conventions · backup and archival disc or tape inventories or schedules · the most likely locations of electronic records relevant to the subject matter of the case · backup rotation schedules and archiving procedures, including any backup programs in use at any relevant time · electronic-records-management policies and procedures · corporate policies regarding employee use of company computers and data · the identities of all current and former employees who have or had access to network administration, backup, archiving, or other system operations during the relevant period. Once you have this information, you can refine your discovery requests to obtain relevant data from the locations and systems identified in the deposition. Under the amended Federal Rules of Civil Procedure, requests for electronic data should be carefully crafted. A request for "all electronic data" will likely result in an objection based on burden or expense, and courts have been inconsistent on how deeply they will allow a discovering party to dig.xiii Therefore, discovery requests must be specific and exhibit an understanding of how electronic data are created, stored, and destroyed. The particular type of electronic data in the defendant's possession that you may want to look at will vary depending on the issues in controversy. However, you should consider the following categories of evidence in crafting your requests for production: · e-mail (sent, received, or drafted) and corresponding dates, times, recipients, and file attachments · word-processing files · tables, charts, graphs, and database files · electronic calendars · proprietary software files · internet browsing applications (bookmarks, cookies, history log). After you have collected this data, e-evidence experts using the latest technology can drill down through the layers of information to find the most salient tidbits relating to the issues in your case. For example, the data can be mined to locate files created by a certain user, having certain file extensions, created within specific dates, or containing relevant keywords. Computer forensic tools can even restore deleted e-mails or files. One of the most useful electronic-discovery management tools may be the pretrial conference required by Federal Rule of Civil Procedure 16. As with the Rule 26(f) meeting on discovery, both parties should be prepared to provide the court with expert testimony regarding the nature, 3

location, and volume of electronic data, as well as the time and cost involved in producing it. Doing so will help limit the scope of discovery required from your client while maximizing the disclosures that are required from the defendant. Topics for discussion at the Rule 16 conference may include preservation of evidence (including whether backup, archival, and deleted files will be exchanged), preliminary disclosures as to the parties' computer systems (including numbers, types, and locations of computers, operating systems in use, and backup schedules), document-processing and production formats, testifying experts, cost allocation, and anticipated evidentiary disputes. The conference can be used to your client's advantage to gain an understanding of the defendant's electronic records management procedures or, at the very least, to gauge the degree to which the defendant is prepared to address electronic evidence in your case. Avoiding pitfalls Spoliation claims are usually leveled at a defendant, but many a plaintiff has lost a case before it was filed by failing to preserve relevant evidence. Defendants are increasingly pursuing eevidence—like personal e-mails saved on home computers, information stored on personal digital assistants, and cell-phone logs—from plaintiffs, so you must caution your clients to beware of the consequences of failing to adequately preserve electronic data in their possession. Unlike paper documents, which require an overt act like shredding to be destroyed, electronic data can be and often is destroyed by routine computer use. Simply turning on a personal computer can destroy "slack" and "temporary" files, cause data to be overwritten, or cause metadata (for example, data showing when a file was created or modified) to be altered. Clicking on a file can change its "last-accessed" date, inviting a suggestion that it has been altered.xiv You can help your clients protect themselves against a potential spoliation accusation and its consequences by telling them to immediately halt all electronic document-handling policies that result in the recycling of potentially relevant tapes or other e-data destruction. An e-discovery expert can help explain which policies or actions are potentially harmful. Consider suggesting that the data on the client's hard drive be preserved using mirror-imaging technology, available from most reputable e-discovery and computer forensics experts. This freezes the data like a snap shot. This is especially helpful if the client is a company that employs many computer users, because it avoids having to train each employee in e-data preservation and allows work to continue on the company's computers even with a preservation order in place.xv Data preservation issues arise mostly in business tort lawsuits; however, plaintiff lawyers should also be aware of proper preservation protocols to ensure that their corporate opponents are using best practices when preserving key data. Another potential pitfall for plaintiff attorneys whose clients have relevant electronic documents is inadvertent production. A critical aspect of any digital discovery plan addresses the potential for inadvertent waiver of privileged information. Plaintiffs can take the lead on this issue by 4

gaining an agreement or a court order in advance of discovery that states that the inadvertent disclosure of a privileged document does not constitute a waiver of privilege, that the privileged document should be returned, and that any notes relating to the document or copies of it made by an opponent will be destroyed. With 70 percent of all written data now stored in electronic form,xvi gone is the day when an attorney is likely to find the "smoking gun" document in a box located in a remote storage facility. Plaintiff lawyers who continue to ignore this reality risk defeat for their clients and damage to their reputations. Those who take the time to learn what e-evidence is, how to find it, and how to use it will increase their chance of uncovering the information that wins the case.

i

This article originally appeared in the January 2003 issue of Trial magazine. Reprinted with permission of TRIAL (January 2003). Copyright the Association of Trial Lawyers of America. ii Kristin M. Nimsger, is the electronic evidence project line manager at Kroll Ontrack, Inc. She can be reached at [email protected]. iii Elizabeth Weinstein, “Help! I'm Drowning in E-Mail,” WALL ST. J., Jan. 10, 2002, at B1, http://webreprints.djreprints.com/00000000000000000024542001.html (last visited Nov. 20, 2002). iv KEVIN CRANE, DESIGNING A DOCUMENT STRATEGY (2000). v Lori Enos, “Digital Data Changing Legal Landscape,” E-COMMERCE TIMES, May 16, 2000, www.ecommercetimes.com/perl/story/3339.html. vi Simon Property Group v. mySimon, Inc., 194 F.R.D. 639 (S.D. Ind. 2000); Linnen v. A.H. Robins Co., No. 97-2307, 1999 WL 462015 (Mass. Super. Ct. June 16, 1999); Playboy Enters., Inc. v. Welles, 60 F. Supp. 2d 1050 (S.D. Cal. 1999); Anti-Monopoly, Inc. v. Hasbro, Inc., No. 94 Civ. 2120, 1995 WL 649934 (S.D.N.Y. Nov. 3, 1995); Crown Life Ins. Co. v. Craig, 995 F.2d 1376 (7th Cir. 1993); Santiago v. Miles, 121 F.R.D. 636 (W.D.N.Y. 1988); Bills v. Kennecott Corp., 108 F.R.D. 459 (C.D. Utah 1985). vii Linnen, No. 97-2307, 1999 WL 462015. viii ALICIA MUNDY, DISPENSING WITH THE TRUTH (2001). ix In re Bridgestone/Firestone, Inc., Tires Prods. Liab. Litig., No. MDL 1373 (S.D. Ind. Jan. 30, 2001), www.insd.uscourts.gov/firestone/bf_docs/93730480.pdf (last visited Nov. 20, 2002). x Before the Federal Rules of Civil Procedure were amended in 2000, Rule 26 contained a clause allowing individual districts to opt out of the initial disclosure requirement. xi Kleiner v. Burns, No. 00-2160-JWL, 2000 WL 1909470 (D. Kan. Dec. 15, 2000). xii Sample electronic-discovery interrogatories can be found at www.ontrack.com/datatrail/interrogatory_mailer.doc. xiii Playboy Enters., Inc., 60 F. Supp. 2d 1050; Van Westrienen v. Americontinental Collection Corp., 189 F.R.D. 440 (D. Or. 1999); Symantec Corp. v. McAfee Assoc., Inc., No.C-97-20367-JF (EAI), 1998 WL 740807 (N.D. Cal. Aug. 14, 1998); Fennell v. First Step Designs, Ltd., 83 F.3d 526 (1st Cir. 1996). xiv In re Prudential Ins. Co. Sale Practices Litig., 169 F.R.D. 598 (D.N.J. 1997); Proctor & Gamble Co. v. Haugen, 179 F.R.D. 622 (D. Utah 1998). xv Gates Rubber Co. v. Bando Chem. Ind., 167 F.R.D. 90 (D. Colo. 1996). xvi See CRANE, note 2.

5