Watch for the left hook
Watch for the left hook
The last thing you want if you’ve been engaged via an ediscovery order is to cop a surprise that knocks you off your feet. Litigation prone organisations are gearing up for the new rules of play, so IDM decided to look at the arsenal of tools at your disposal, including hired help.
The Age recently reported that lawyers have struck gold with ediscovery. In May 2005 Coleman Holdings was awarded $US1.45 billion after it had filed suit against Morgan Stanley for helping Sunbeam Products Inc. to falsify its finances in an acquisition deal. Morgan Stanley, claimed Coleman, had deliberately made certain emails unavailable.
Armed with dazzling stories from foreign trenches, some are saying that the onerous cost of electronic discovery - as one aspect of compliance - is forcing companies to settle before reaching court. There could be some truth to this, despite it sounding like fear mongering, but there’s no doubt that an ediscovery order can be expensive if you’re served one. Thankfully, though, we’re still behind the U.S.
As CCH’s ediscovery specialist, Scott Gillard says, “The good thing about Australia is that we are behind the US in terms of ediscovery. In the US, 2007 will be worth US$2billion. Australia is worth $5 million in comparison. Case law simply can’t generate the kind of rules that have been set in the US. The reason it is so expensive there is due to the requirement to produce discoverable evidence in a timely fashion.”
For Australia, establishing something similar to the Federal Rules of Civil Procedure, introduced in the U.S. late last year, will require a case like the Zubulake decision. Judge Schniendlin’s 20 findings became the basis for the FRCP legislation. UBS Warburg LLC, was unable to produce emails because staff did not adhere to the UBS’ stated directive to preserve the relevant emails.
An indication that Australia is heading in the same direction is Victoria’s Document Destruction Act which amend its Crimes Act 1958 and Evidence Act 1958. This creates significant criminal and civil consequences for those found to have destroyed documents that could “reasonably” be expected to be used as evidence. To date, this law remains untested.
Had this legislation been introduced earlier than September 2006 and proceedings against Pan Pharmaceuticals commenced in Victoria, recent allegations over Jim Selim’s order to Pan’s IT manager Karl Brooks to destroy electronic records would have been an interesting test. Similar to the Zubulake case, WORM enabled disk (eg: EMC’s Centera or NetApp’s SnapLock), optical (Plasmon UDO) or a variety of tape storage systems could have circumvented this problem. As it was, Brooks was able to say, “I could try” to delete data so it “is not retrievable by anyone”.
It seems likely to be only a matter of time before such a case arises. If the plaintiff commences proceedings in Victoria and your organisation has an office there, these laws can be applied no matter where the dispute occurred. On the other hand, in NSW News Limited’s 3 day destruction schedule for its emails attracted little more than a sneer from Justice Sackville.
If pain persists…
The real reasons people need to be more educated on the risks of ediscovery are found in the absolute dominance of digitally born documents. While the ability to automate the collation and processing of electronic documents is faster than if done by paper, electronic documents mutate, multiply and proliferate as people incessantly reply, forward and attach them to email. Then there are increasingly mobile storage locations as well as the ability to take forensic snap shots of environments in flux. Even for the most basic request of finding an email from 5 years ago seems daunting. Add today’s use of PDAs and laptops and scoping a discovery order gets hazier.
e.law’s managing director Allison Stanfield says that some organisations are acutely aware of the risks and are preparing. “Many corporate organisations are looking at litigation readiness. If they’re in the pharmaceutical or manufacturing industry where there is a lot of sensitive intellectual property, there is a likelihood that they will be looking at being ‘litigation ready’. It becomes their insurance.”
Her advice is that everyone should be responsible for information management, which means using an electronic document and records management systems diligently across the enterprise. Stanfield asks, “If an EDRMS has been implemented, to what degree it has been adhered to? We assist companies to develop document destruction and retention policies and procedures to ensure staff are aware, from the reception to the CEO.” Equally important is destroying files beyond their retention schedule. “We review files in accordance with policy and go through the archiving regime to ensure necessary files are deleted.”
A distinction Stanfield sees many fail to make is between backups (for recovery) and archiving (for compliance). She says, “Many companies don’t foresee the need to diligently archive their electronic records and because there is no fixed regime on document management and archiving, it increases the cost when something does happen.”
Besides business processes, there is the inherent value in knowing your information. Scott Mann, Dimension Data’s Incident Response Group manager says, “The C-level manager is looking for assurance, whether they are being pushed by a third party regulator, a litigant in a civil matter or simply that management wants to be clear on a decision they’re making. If you’re dismissing someone, there is always the potential legal angle. A government department may have spent $300 thousand on training an individual, and in this instance, you would want to make sure that the action taken is warranted by the allegations.”
CCH’s Gillard says that “If ediscovery is an after thought, it can be expensive due to the process. You could be forced to look through 100,000 emails in a short amount of time. We recently had a client who didn’t want to do ediscovery and were confident their client had printed all relevant documents. The problem is that 98% of information never gets to paper, including deleted files. When it came to the hearing, the other side agued there could be information stored electronically. They had to go back to data source.”
Presenting information to the courts requires first identifying which documents are relevant and where they reside in the organisation, whether it’s held by a third party or on old tapes. If data is stored on old media, it might need to be restored. As DiData’s Mann points out, “Tape can be problematic. It’s an issue of backwards compatibility. We’ve found that people have the tapes to restore from but not the legacy equipment to restore it with.”
For most businesses, getting on with business will likely be the priority, not archiving for litigation. If this is so, one option would be to outsource off-site tape storage management to places like VaultCentral or TMS.
Then there is the de-duplication process. As e.law’s Stanfield says, “In most cases only 20 documents are crucial where as the search could involve tens of thousands of files across multiple locations.”
Coming at it from a data recovery perspective is Kroll Ontrack’s Adrian Briscoe. Leveraging its global network of processing centres and history in data recovery, Briscoe claims that once the relevant tapes, hard-drives and media have been acquired, Kroll Ontrack will process the results in two days. He says, “We offer the fastest processing times in the world.” Having processed Enron’s documents, its profile in Europe and the U.S. is somewhat higher than in Australia. The key to its service is its Power Controls software, used to recover data from old tapes and other systems. He says in cases where evidence can’t leave its country of origin, files are duplicated at its secured laboratory in Queensland and sent to Michigan or Europe for processing.
All e.discovery service providers handle the de-deplication process using “MD5 hashing” technology which is also commonly used for encryption and provides the tools for the disk-based CAS systems mentioned above. An interesting fact here is that while many analysts and vendors decry the limited capacity and access speeds of magneto optical disk and UDO disk, most computer forensic experts still swear by it for preserving evidence.
After the relevant documents and files have been retrieved, before a complete process is done, most edisocvery specialists will use the Ringtail database, which enables a full review and culling of documents. The next stage involves validating, rendering into an acceptable format such as TIFF or PDF, then stamping to apply an order to the document sets. Unless you’ve got the resources to handle this yourself, it’s probably a good idea to explore the capabilities of specialists familiar with the process.
Even if you’re not litigation ready, looking at your information from the perspective of an ediscovery order could be an interesting exercise. It puts it in context; that crisis moment when you’re choice is to defend, settle or throw in the towel. Your actions will depend entirely on how well you know your information, the speed of your response and what you’re willing to do to with it.
Satisfying Federal Court Rules. London Economics (Aust) Pty Ltd v Frontier Economics Pty Ltd4): Applicant sought discovery by certain parties then employed by the respondent (who had been formerly employed by the applicant). Materials included computer programs, data files, tapes and CD-Rom disks. Discovery request satsifies court rules.
Who’s Anton Piller? A2B Telecommunications Pty Ltd v Hinkley & Anor1): In related proceedings Hotline Communications Ltd & Ors v Adam Hinkley & Ors, Anton Piller Order used to obtain copies of source code and related materials from Hinkley.
Establishing defendants broadens discovery. G Breschi & Son Pty Ltd V AFT Ltd5): Justice determines that discovery can be used to ascertain who might be the proper defendant.
Media = document. Sony Music Entertainment (Aust) Ltd v University of Tasmania: Court asked to decide whether CD ROMs and backup tapes are “documents”. Justice considers electronic records, databases and storage media to be documents.
Source: NUTS AND BOLTS OF ELECTRONIC DISCOVERY, Steve White, Principal – White SW Computer Law