How To Find Out What You Know About Esi

Managing the E-Discovery Process:

Guidance for Federal Agencies

Chapter 1 Message from the Associate Attorney General Message from Magistrate Judge Paul W. Grimm Overview of the E-Discovery Process

Chapter 2 Information Management, Identification and Preservation of ESI Featuring the United States Postal Service

Chapter 3 Collection and Processing of ESI

Featuring the United States Department of Agriculture Chapter 4 Review and Analysis of ESI

Rule 502 Orders

Featuring the Army Corps of Engineers Chapter 5 Delivery of ESI to DOJ and Production

Featuring DOJ Litigation Support Specialists Chapter 6 The EPA Approach

Conclusion

Chapter 1 Message from the Associate Attorney General

Message from Magistrate Judge Paul g g g W. Grimm

Chapter 2 Information Management, Identification and Preservation of ESI

and Preservation of ESI

What is the Process?

When Is Litigation

“Reasonably Anticipated”?

“Reasonable anticipation of litigation arises when an organization is on notice of a credible threat it will become involved in litigation or anticipates taking action to initiate litigation.”

Guideline 1, The Sedona Conference Commentary on Legal Holds:

Factors to Consider

Plaintiff

• decision to send cease-and-desist letter

f l t l ti b DOJ f t ti l • referral to or evaluation by DOJ of potential

claims arising from specific events

• approval to intervene in qui tam sought

Defendant

• credible information that it is a target of legal action (e.g., credible cease-and-desist letter) • administrative claim

Factors to Consider

• administrative claim

• letter from counsel indicating intent to file suit • written preservation request

Non-party

• credible information received that it possesses relevant ESI that may be sought by a party to litigation (e g receipt of a subpoena)

Factors to Consider

Once Litigation is “Reasonably Anticipated”

Identification

“Locating specific sources of relevant

electronic information and determining

scope, breadth, and depth.”

www.edrm.net

Photo courtesy of Peter Gibbons/National Snow and Ice Data Center, www.nsidc.org.

Identification Steps

1. Assemble a Litigation Response team.

2. Determine who will be responsible for documenting each step of the process.

3. Determine who is subject to the duty to preserve ESI. 4. Determine the relevant time period for which ESI must be

preserved.

What Information Must Be Preserved?

1. Sources of potentially relevant ESI 2. In the agency’s possession, custody or

control

3. At the time the duty to preserve arises (i.e., once litigation is “reasonably anticipated”)

What Information Must Be Preserved?

1. Suspend routine destruction policies for potentially relevant ESI;

Think about former employees and third parties such as government contractors.

2. When in doubt about whether a particular document should be preserved, preserve it;

3. If both paper and electronic documents exist, preserve both; and

4. Preserve drafts and varying versions of the same electronic document, if potentially relevant.

Four Categories of ESI

1. Electronic communications and

transaction information, such as e-mails

and cell phone logs;

2 Electronically created and stored

2. Electronically created and stored

documents, such as word processing

documents and spreadsheets;

3. Computer databases; and

Records and Non-Records

All potentially relevant ESI

• Emails

• Word processing files • Databases • Voice mail messages

(cell or office)

Wherever stored

• On the network, off the network (archives, backup)

• Office and home (key custodians) (cell or office) • Text messages • Instant messages • Audio/video • Access logs, surveillance tape • Digital images/.wav files • Blogs, intranet custodians) • Removable storage (flash drives, CDs, DVDs)

Sources To Consider

• Databases • Networks • Computer systems (hardware/software) • Laptops • Personal computers • Internet data • Handheld wireless • Servers • Backup/disaster recovery tapes

• Tapes, discs, drives, cartridges and other storage media

devices

• Mobile telephones • Paging devices • Audio systems, including

voice mail

Identification

Counsel and I.T. personnel may need to talk to key custodians to:

• Identify potentially relevant ESI unique to them (hard copy/electronic, records AND non-records) • Identify computer hardware devices they use

(desktop computers, laptop, flash drives, PDAs, cell phones, etc.)

Computer Search for ESI

• Document the search criteria used

(keywords, people, dates)

• Document the search method used

(Boolean, concept, key word, fuzzy)

• Document the locations searched

(computers, serves, backups)

• Document the results of the search(es)

Determining the Scope

The goal is to implement a reasonable plan to preserve ESI potentially relevant to the case in light of the nature of the litigation.

Document why the agency determined that the scope selected was reasonable in light of the nature of the case and the costs to the agency to preserve the information.

Identification Steps

1. Assemble a Litigation Response team.

2. Determine who will be responsible for documenting each step of the process.

3. Determine who is subject to the duty to preserve ESI. 4. Determine the relevant time period for which ESI must be

preserved.

5. Determine what ESI needs to be preserved and where it is located.

What is the Process?

Preservation

“Ensuring that potentially relevant/responsive

electronic information is protected against

alteration of destruction

.”

www.edrm.net

Litigation Hold

• A litigation hold is a “freeze” on all the ESI that falls within the scope of the preservation effort.

• The litigation hold or “freeze” supersedes all document retention policies.

Metadata = Properties

Joint Preservation Duty

(developing law)

DOJ (outside counsel)

1. Identification of additional sources of potentially relevant ESI (litigator).

Agency (party to the litigation)

1. Identification of key custodians, relevant time frame, and sources of

t ti ll l t ESI

2. Preservation of sources of potentially relevant ESI.

• Verify what’s been done. • Evaluate if anything else

needs to be done. • Review agency

documentation. potentially relevant ESI

(insider).

2. Preservation of sources of potentially relevant ESI.

• Agency I.T. personnel and records managers ensure that preservation happens.

Preservation Steps

1. Coordinate with I.T. personnel to determine how to preserve the ESI in its original native file

format with the associated metadata(i.e.,

secure network space; storage drive). secu e e o space; s o age d e)

Three General Ways To Preserve

For each category of ESI, determine the best

way to preserve it.

• Automated (typically I.T. personnel)( yp y p ) • Change in policy (counsel must determine

who has authority)

• Manual (counsel and/or I.T. professionals should oversee this process)

Preservation Steps

1. Coordinate with I.T. personnel to determine how to preserve the ESI in its original native file format with the associated

metadata(i.e., secure network space; storage drive). 2. Distribute a written Litigation Hold Notice.

Litigation Hold Notice

• Must be in writing.

• Should be distributed to all custodians of potentially relevant ESI (more than just agency

p y ( j g y

Written Litigation Hold Notice Elements

1. Identifies key custodians,

issues involved, relevant time period, ESI, records/ departments affected. 2 Sets forth the serious

4. Computer files must be preserved in electronic (native file) format. 5. Requires acknowledgement

and agreement to comply 2. Sets forth the serious

consequences for failure to comply.

3. Clear instructions on what informationis to be preserved and how it will be collected.

and agreement to comply by recipient.

6. Issued by person in authority to ensure compliance.

Preservation Steps

1. Coordinate with I.T. personnel to determine how to preserve (i.e., secure network space; storage drive). 2. Distribute a written Litigation Hold Notice to key custodians. 3. Follow-up with key custodians (key players most likely to

h t l t k ESI)

have control over or access to key ESI).

Follow-up with Key Custodians

Counsel should follow-up with each key

custodian to ensure:

• Custodian understands and agrees to comply with the • Custodian understands and agrees to comply with the

Litigation Hold Notice.

• Custodian understands the consequences for failing to comply.

Follow-up with Key Custodians

Other sources?

• personal e-mail accounts?pe so a e a accou ts • instant messages? • old computers? • other?

Preservation Steps

1. Coordinate with I.T. personnel to determine how to preserve (i.e., secure network space; storage drive).

2 Distribute a written Litigation Hold Notice to key 2. Distribute a written Litigation Hold Notice to key

custodians.

3. Follow-up with key custodians (key players most likely to have control over or access to key ESI).

4. Set a schedule for periodic reminders of the litigation hold.

Periodic Reminders

• Each custodian subject to the Litigation Hold Notice receives a periodic reminder of the continuing preservation obligation.

• Have any new issues arisen? Are there new custodians? Are there additional sources of ESI that should be added? Are there additional sources of ESI that should be added? • Continue to update I.T. personnel as new witnesses are

identified.

What is the Process?

What is the Process?

Collection

“Gathering electronic information for further

use in the E-Discovery process.”

www.edrm.net

Collection of ESI

Unless otherwise agreed, ESI should be

collected in its native file format with all

associated metadata

ESI should be collected in its native file

format with the associated metadata.

• Unless otherwise agreed, ESI should not be printed to paper.

• It is not okay to instruct employees to forwardIt is not okay to instruct employees to forward relevant e-mail messages or any other electronic files to counsel or any other person. • Agency counsel should not redact by deleting

privileged or protected information.

• These practices may alter potential evidence.

Collection Steps

1. Determine whether a forensic collection is required.

Forensic Collection?

Forensic collection

• Complete copy of a computer hard drive –all data down to the 1’s and 0’s. This includes

l t i d t d l t d electronic documents, deleted files, slack space, fragments, system files, etc.

• Requires computer forensic

When Might Forensic Collection

Be Necessary?

What

proprietary

information was

taken?

Title

Content

Questions To Ask

1. Does the computer itself play some role in this case?

2. Does this case involve a situation where electronic information has been deleted altered electronic information has been deleted, altered or destroyed?

Collection Steps

1. Determine whether a forensic collection is required. 2. Determine who should perform the collection.

Determine Who and How

Considerations:

1. The ESI should be collected by a qualified person. 2. The ESI should be collected using defensible methods

(appropriate software applications, appropriate processes, etc.).

A li ti

Application:

• A forensic collection should be conducted by a

computer forensic expert or trained I.T. professionals using computer forensic copying software.

• A non-forensic collection should be conducted by trained agency I.T. or litigation support personnel, or by a specialized vendor.

Collection Steps

1. Determine whether a forensic collection is required.

2. Determine who should perform the collection.

3 D t i h t ft h ld b d

Collection Steps

1. Determine whether a forensic collection is required.

2. Determine who should perform the collection.

3 D t i h t ft h ld b d

3. Determine what software should be used. 4. Determine how the collection will be

documented.

Collection Documentation

• Standardized, repeatable processes • Document all steps taken to collect the files

· Who collected the information and when · Where the information came from

(computer/custodian)

· How the information was copied (software/version)

· Any errors?

Title

Content

Chain of Custody

• Document each person who touched the

ESI, what they did, when they did it, and

why.

• Chain of Custody should include a

verification report.

The Collection

Collection Steps

1. Determine whether a forensic collection is required.

2. Determine who should perform the collection

collection.

3. Determine what software should be used. 4. Determine how the collection will be

Title

Content

Chain of Custody

• Type of storage media with unique identifier • Sequential numbering

• Track ESI back to point of origin

Title

Content

Processing

“Reducing the volume of information to

something manageable for review.”

www.edrm.net

1 Terabyte of E-mail

If printed to paper could fill

Sears Tower four times.

Shows how massive E-Discovery can be.

Searching 20,000,000 E-mail messages

10 seconds each = 55,556 hours (6.3 years) 1 second each = 5,556 hours (7.7 months) 1/4 second each = 1,389 hours (2 months) 1/10 second each = 557 hours (3 weeks) 1/10 second each = 557 hours (3 weeks) 1/100 second each = 56 hours (2.3 days)

-John Jessen & Mark V. Reichenbach, Data Processing and Production

Search Search De De--duplication duplication Culling Culling

Data Culling

Process

Remaining Universe Remaining Universe of Documents of Documents

Key Words Date Ranges Domain Names File Types www.digital-legal.com

Processing

• Usually performed by a vendor

· Requires technical assistance · Available through GSA

· Prices vary, depending on volume and file types

Processing

• Consult with DOJ

· Does the vendor have the appropriate clearances?

Title

1. Select a qualified vendor.

2. Understand from a technical perspective

what you want the vendor to do. (Seek

Processing Steps

DOJ assistance)

Things To Discuss With DOJ

• What file types are at issue? Standard file types can be processed. Proprietary software files and databases cannot be processed. • Will some files need to be converted prior to

processing? This may change the metadata. • What metadata fields should be exported?

Things To Discuss With DOJ

• Will files be de-duplicated globally or per custodian?

Things To Discuss With DOJ

• What type of deliverable do you want?

· Native

· TIFF + text (plus links to native) TIFF + text only

· TIFF + text only

· Concordance/Summation load file · Other?

Title

1. Select a qualified vendor.

2. Understand from a technical perspective what you want the vendor to do (Seek DOJ assistance).

Processing Steps

assistance).

3. Develop a list of filters or culling criteria (Consult with DOJ). Search Search De De--duplication duplication Culling Culling

Data Culling

Process

Remaining Universe Remaining Universe of Documents of Documents

Operating and Program File Culling

• Removes files not created by computer users • NIST (National Institute of Standards Technology)

List De NISTing • De-NISTing

• Chain of Custody form should reflect whether ESI was De-NISTed

Title

1. Select a qualified vendor.

2. Understand from a technical perspective

what you want the vendor to do

Processing Steps

(Seek DOJ assistance.)

3. Develop a list of filters or culling criteria.

(Consult with DOJ).

4. Vendor documentation.

Title

Content

Vendor Chain of Custody

• How was the ESI copied? • Who processed the ESI?

• What software, versions and settings were used?

Title

1. The collection of ESI should be done by trained technical professionals.

2. Computer files must be collected as they exist f f

Collection and Processing

on the computer in their native file format with the associated metadata.

3. Unless otherwise agreed, ESI should not be printed to paper.

Title

4. ESI should not be forwarded to counsel or redacted by deleting information in the file, as this alters the potential evidence.

Collection and Processing

Title

6. Investing in culling and other processing technologies may save the agency time, money and human resources as well as reduce the agency’s risk if its collection and

Collection and Processing

reduce the agency s risk if its collection and processing efforts are challenged.

Chapter 4 Review and Analysis of ESI; Rule 502 Orders

Rule 502 Orders

Initial Review

“Evaluating information for

relevance

and privilege.”

Discuss

with DOJ

How much information must be reviewed?

What search criteria should be used to locate potentially relevant ESI?

Who will run the research and

with DOJ

Who will run the research and

how will they be documented? How long will the review take? Who within the agency will be responsible for ensuring quality and timeliness of the review?

Technical Issues

Coding Manuals

• How will documents be evaluated for relevance and privilege?

• What issues are important in the litigation and how will the team tag those documents?

• How will “hot” documents be flagged?

• Will attorney notes on particular documents be made and shared?

• How will the review be divided among several reviewers?

Title

1. Discuss a review strategy with DOJ, including

search criteria for privileged information. 2. Address technical issues and develop a coding

manual for the case

Review Steps

manual for the case.

3. Discuss whether Federal Rule of Evidence 502

Computer Searches for Privileged

Information

• Explain the key words selected and why (such as attorney names or certain domain names for e-mail). • The search was designated and conducted by someone

f

qualified to do the search.

• Search methods likely to locate the information sought were used.

• Search tested for accuracy.

What NOT to do

• Craft search terms based solely on the pleadings.

• Limit search to key words developed by counsel

What TO do

• Interview key custodians. • Use limiting parameters such as

time period, media source, file types key custodians key

Computer Searches for Privileged

Information

developed by counsel. • Fail to test the accuracy of your

search criteria.

• Fail to document your efforts.

types, key custodians, key words provided by key custodians, etc.

• Document the search process and results.

• Test the accuracy of the search. • Discuss search methodologies

and criteria with DOJ and possibly opposing counsel.

Analysis

“Evaluating documents that support the

claims and defenses in the case, and

Title

1. In large document cases, coordination between agency counsel and DOJ about search and review methods is essential.

2. Technical issues related to the review should be

Review and Analysis

2. Technical issues related to the review should be addressed and a Coding Manual developed. 3. A Federal Rule of Evidence 502 Order should be

considered.

4. Computer searches for privileged information may need to be explained, so they should be defensible and verified for accuracy.

What is the Process?

Production

Agency counsel delivers to the DOJ

litigating team all of the potentially

relevant ESI that the agency has

identified, preserved, collected,

processed and reviewed.

• DOJ generally prefers native files. • Other formats can be negotiated.

– Images (TIFF and text)? – Concordance/Summation load

Production Format

Discuss

with DOJ

Concordance/Summation load

files?

Title

1. Discuss production format and manner with DOJ. Should ESI be encrypted?

2. Deliver ESI in the format and manner agreed upon.

Production Steps

upon.

3. Deliver all associated documentation.

Title

• Copies of all written Litigation Hold Notices and Acknowledgements; and

• Complete Chain of Custody All search documentation

Production Documentation

Title

1. Discuss production format and manner with DOJ. Should ESI be encrypted?

2. Deliver ESI in the format and manner agreed upon. 3 Deliver all associated documentation

Production Steps

3. Deliver all associated documentation.

USDOJ May Process Then Review and Analyze Prior to Producing to Opposing Counsel and

Presenting in Court

Chapter 6 The EPA Approach and Conclusion

This video should not be construed as a legal interpretation of the Federal Rules of Civil Procedure and the recommendations and suggestions made herein should not be taken as an indication of any view of the Department of Justice or any other department or agency that any such recommended or suggested practices or procedures are, and should be, legally required or sufficient. The guidance is subject to legal precedent, court orders, and local rules. It provides prospective guidance only and is not intended to have the force of law or to create or confer any rights, privileges, or benefits. It is not intended to be, and

h ld t b i t t d i d d t f i ht i

should not be interpreted as, an independent source of rights in, or obligations to, parties in litigation with the government or any other individuals or entities. The dictates of a particular case, including, for example, any court orders dealing with ESI will indicate whether or what action is needed. Government agencies must comply with all

applicable legal requirements including retention and preservation obligations required by law, such as the Federal Records Act.

The overview portion of this video was adapted, with permission, from a video created by Grand Valley State University entitled “What Every Businessperson Should Know About E-Discovery,” available on YouTube.com.

The Electronic Discovery Reference Model and related definitions are used with permission of the E-Discovery experts and other professionals who created the model. See www.edrm.net.

Managing the E-Discovery Process: Guidance for Federal Agencies

Presenters

Introductory Messages:

The Honorable Thomas J. Perrelli

Associate Attorney General of the United States The Honorable Paul W. Grimm

Chief Magistrate Judge

United States District Court for the District of Maryland

Narrator:

Sarah Michaels Montgomery Senior Litigation Counsel for E-Discovery United States Department of Justice

Identification and Preservation / USPS Segment

Moderator:

Guillermo (Bill) J. Rojas Assistant United States Attorney Northern District of Ohio

Agency presenters:

Collection and Processing / USDA Segment

Moderator:

James Payne

Senior Counsel, Law and Policy Section Environment and Natural Resources Division United States Department of Justice

Agency presenter:

L. Benjamin Young, Jr.

Assistant General Counsel, General Law Division United States Department of Agriculture

Review and Analysis / Army Corps of Engineers Segment

Moderator:

Jim McConnon

Trial Attorney, Federal Tort Claims Act Section Torts Branch, Civil Division

United States Department of Justice

Agency presenter:

David Dyer

Assistant District Counsel, New Orleans District U.S. Army Corps of Engineers

Production / DOJ Litigation Support Segment

Richard Sutton

Director, Office of Litigation Support Environment and Natural Resources Division United States Department of Justice Joshua Wood

C f & f

Chief, Litigation Technology & Information Assurance Branch Office of Management Programs / Office of Litigation Support Civil Division

EPA Segment

Moderator:

Daniel S. Smith Trial Attorney

Environmental Enforcement Section Environment and Natural Resources Division United States Department of Justice

Agency presenter: